Version 3.1

Author: tylchan

src/react/docs/videos/DevicesPillar.md

@@ -4,7 +4,6 @@ sidebar_position: 3
 
 # Devices Pillar
 
-Welcome! This video introduces Zero Trust and the Microsoft Zero Trust Workshop
+This video covers how to deliver the Devices pillar of the Microsoft Zero Trust Strategy Workshop.
 
 <iframe width="560" height="315" src="https://www.youtube.com/embed/wraJn-jGd_M?si=AKBKorPL0auEXFmy" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
-

src/react/docs/videos/index.mdx

@@ -22,6 +22,6 @@ We have produced the following videos to help you run your own workshops:
 
 - [Artificial Intelligence Pillar](./videos/AIPillar)
 
-- [ DevSecOps Pillar](./videos/DevSecOpsPillar)
+- [DevSecOps Pillar](./videos/DevSecOpsPillar)
 
 - [Zero Trust Assessment Overview](./videos/Assessment)

src/react/docs/workshop-guidance/AI/AI_000.md

@@ -1,10 +1,10 @@
 # Require Users to Use Entra ID Auth to Interact with Agents
 
 **Implementation Effort:** Medium – IT must configure agent authentication flows, consent, and app registrations that tie interactive agents to Entra ID, but this is a one‑time project rather than an ongoing program.  
-**User Impact:** Medium –   Users may be prompted to sign in with Entra ID or grant delegated permissions when interacting with agents, but only those who use these agents are impacted.
+**User Impact:** Medium – Users may be prompted to sign in with Entra ID or grant delegated permissions when interacting with agents, but only those who use these agents are impacted.
 
 ## Overview
-Requiring users to authenticate with Microsoft Entra ID before interacting with an agent ensures that every user action is tied to a verified identity. Interactive agents use the Microsoft Entra Agent Identity platform to perform delegated actions on behalf of real users. To enable this, IT configures the agent to request user tokens via OAuth, validate them, and extract claims for authorization decisions. Doing this also provides IT visiblity of user activity and interaction with AI workloads, and enables implementation of controls such as strong authentication, compliant device, etc.
+Requiring users to authenticate with Microsoft Entra ID before interacting with an agent ensures that every user action is tied to a verified identity. Interactive agents use Microsoft Entra Agent ID to perform delegated actions on behalf of real users. To enable this, IT configures the agent to request user tokens via OAuth, validate them, and extract claims for authorization decisions. Doing this also provides IT visibility of user activity and interaction with AI workloads, and enables implementation of controls such as strong authentication, compliant device, etc.
 
 Without this setup, agents may operate without strong identity assurance, increasing risks such as unauthorized access, misuse of delegated permissions, or inability to enforce Zero Trust controls.
 This activity supports the Zero Trust principle of Verify explicitly because user identity, tokens, claims, and delegated permissions are validated at every interaction.
@@ -19,4 +19,4 @@ https://learn.microsoft.com/en-us/entra/agent-id/identity-platform/interactive-a
 https://learn.microsoft.com/en-us/entra/agent-id/identity-platform/interactive-agent-request-user-authorization [learn.microsoft.com]
 * Agent users in Microsoft Entra Agent ID
 * [Microsoft Entra ID P1 — feature comparison](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-licensing#available-versions-of-microsoft-entra-multifactor-authentication)
-https://learn.microsoft.com/en-us/entra/agent-id/identity-platform/agent-users [learn.microsoft.com]
+https://learn.microsoft.com/en-us/entra/agent-id/identity-platform/agent-users [learn.microsoft.com]

src/react/docs/workshop-guidance/data/RMT_006.md

@@ -2,7 +2,7 @@
 
 **Implementation Effort:** Medium - Definition of the taxonomy can be low effort and done quickly either when a taxonomy already exists for the company or the default taxonomy can be used.
 
-**User Impact:** Medium - End user education on the company taxonomy and expetcations on usage.
+**User Impact:** Medium - End user education on the company taxonomy and expectations on usage.
 
 ## Overview
 
@@ -24,5 +24,3 @@ Identify (but do not enforce at this time) access restrictions related to each s
 
 * Create and publish sensitivity labels https://learn.microsoft.com/en-us/purview/create-sensitivity-labels
 * Microsoft Information Protection Deployment Acceleration Guide: https://microsoft.github.io/ComplianceCxE/dag/mip-dlp/
-
-

src/react/docs/workshop-guidance/devices/DEV_116.md

@@ -14,7 +14,7 @@ This supports *Verify explicitly* by requiring admins to satisfy multiple condit
 
 1. Create a Conditional Access policy targeting directory roles (Global Administrator, Security Administrator, Intune Administrator, etc.)
 2. Require multi-factor authentication for all admin sign-ins
-3. Require compliant or Hybrid Azure AD joined devices
+3. Require compliant or Microsoft Entra hybrid joined devices
 4. Block legacy authentication for admin accounts
 5. Restrict access to trusted locations where appropriate
 6. Enable sign-in frequency controls to limit session persistence

src/react/docs/workshop-guidance/devices/RMD_020.md

@@ -5,10 +5,9 @@ The APP data protection configuration framework is organized into three distinct
 
 **Level 1** **enterprise basic data protection**– Microsoft recommends this configuration as the minimum data protection configuration for an enterprise device.
 **Level 2** **enterprise enhanced data protection** – Microsoft recommends this configuration for devices where users access sensitive or confidential information. This configuration is applicable to most mobile users accessing work or school data. Some of the controls may impact user experience.
-**Level 3 enterprise high data protection** – Microsoft recommends this configuration for devices run by an organization with a larger or more sophisticated security team, or for specific users or groups who are at uniquely high risk (users who handle highly sensitive data where unauthorized disclosure causes considerable material loss to the organization). An     organization likely to be targeted by well-funded and sophisticated adversaries should aspire to this configuration.
+**Level 3 enterprise high data protection** – Microsoft recommends this configuration for devices run by an organization with a larger or more sophisticated security team, or for specific users or groups who are at uniquely high risk (users who handle highly sensitive data where unauthorized disclosure causes considerable material loss to the organization). An organization likely to be targeted by well-funded and sophisticated adversaries should aspire to this configuration.
 
 
 ## Reference
 
 * https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-framework 
-

src/react/docs/workshop-guidance/devices/RMD_153.md

@@ -4,9 +4,8 @@
 
 **Remote Help** is a feature that allows IT support to remotely assist users' devices using Microsoft Defender for Endpoint. It integrates with Intune to provide secure, role-based access for troubleshooting. It enhances security by using encrypted connections and role-based access control (RBAC) to ensure only authorized personnel can provide support.
 
-Remote Help is available with an add on license or an Intune Suite license.  For more information about licensing options, see [Microsoft Intune licensing](https://learn.microsoft.com/en-us/mem/intune/fundamentals/licenses).
+Remote Help is available with an add-on license or an Intune Suite license. For more information about licensing options, see [Microsoft Intune licensing](https://learn.microsoft.com/en-us/mem/intune/fundamentals/licenses).
 
 ## Reference
 
 * [Remote Help with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/remote-help)
-

src/react/docs/workshop-guidance/identity/RMI_023.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-For new cloud applications that require user profile creation and are using Entra ID for single sign on, enable automatic provision them via Entra ID as well. This is foundational step to enforce least privilege consistently (e.g. when an account is no longer assigned to an application for SSO, it will trigger a deactivation of the user profile within the application).
+For new cloud applications that require user profile creation and are using Entra ID for single sign-on, enable automatic provisioning for them via Entra ID. This is a foundational step to enforce least privilege consistently (e.g. when an account is no longer assigned to an application for SSO, it will trigger a deactivation of the user profile within the application).
 
 
 ## Reference

src/react/docs/workshop-guidance/identity/RMI_027.md

@@ -2,9 +2,9 @@
 
 ## Overview
 
-Migrate exisiting SaaS application provisioning to automatic user provisioning in Microsoft Entra ID.  This is foundational step to enforce least privilege consistently (e.g. when an account is no longer assigned to an application for SSO, it will trigger a deactivation of the user profile within the application).
+Migrate existing SaaS application provisioning to automatic user provisioning in Microsoft Entra ID. This is a foundational step to enforce least privilege consistently (e.g. when an account is no longer assigned to an application for SSO, it will trigger a deactivation of the user profile within the application).
 
-This migration will also help reducing dependencies and footprint of disjointed provisioning tools.
+This migration will also help reduce dependencies and footprint of disjointed provisioning tools.
 
 ## Reference
 

src/react/docs/workshop-guidance/identity/RMI_030.md

@@ -2,9 +2,9 @@
 
 ## Overview
 
-Migrate existing on-premisis applications that require user profiles to use Entra ID Application provisioning. This is foundational step to enforce least privilege consistently (e.g. when a is no longer assigned to an application, it will trigger a deactivation of the user profile within the application).
+Migrate existing on-premises applications that require user profiles to use Entra ID Application provisioning. This is foundational step to enforce least privilege consistently (e.g. when an account is no longer assigned to an application, it will trigger a deactivation of the user profile within the application).
 
-This migration will also help reducing dependencies and footprint of disjointed provisioning tools.
+This migration will also help reduce dependencies and footprint of disjointed provisioning tools.
 
 ## Reference