Merge pull request #16015 from MicrosoftDocs/main

publish main to live 10:30 AM 8/28/24

memdocs/intune/developer/intune-graph-apis.md

@@ -497,13 +497,13 @@ To invite the user to be a guest of your tenant:
 
 This sends an invite to the user.
 
-   <img src="../media/aad-multiple-tenant-invitation.png" width="624" height="523" alt="A sample guest invitation" />
+   <img src="../media/aad-multiple-tenant-invitation.png" width="624" height="523" alt="A sample guest invitation">
 
    The user needs to choose the **Get Started** link to accept your invitation.
 
 When the relationship is established (or your invitation has been accepted), add the user account to the **Directory role**.
 
-Remember to add the user to other roles as needed. For example, to allow the user to manage Intune settings, they need to be either a **Global Administrator** or an **Intune Service administrator**.
+Remember to add the user to other roles as needed. For example, to allow the user to manage Intune settings, they need to be at least an **Intune Service administrator**.
 
 Also:
 

memdocs/intune/fundamentals/microsoft-intune-service-description.md

@@ -49,6 +49,8 @@ You can start to use Intune with a 30-day free trial that includes 100 user lice
 > [!NOTE]
 > If your organization has a Microsoft Online Services work or school account, and you might continue with this Intune subscription in production after the trial period ends, then choose the **Sign in** option on that page and authenticate by using the Global Administrator account for your organization. This action ensures that your Intune trial links to your existing work or school account.
 
+Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to the initial set up or emergency scenarios when you can't use an existing role.
+
 <!--- For a list of settings that you can set up on mobile devices, see:
 
 - [Enrolled device management capabilities of Microsoft Intune](introduction-intune.md)

memdocs/intune/includes/reports-credential-reqs.md

@@ -8,8 +8,7 @@ Authentication and authorization are based on Microsoft Entra credentials and In
 
 Requirements for accessing the Intune Data Warehouse (including the API) are:
 
-- User must be one of:
-  - Microsoft Entra Global Administrator
+- User must have a minimum of one of the following roles:
   - An Intune service administrator
   - User with role-based access to **Intune data warehouse** resource
   - User-less authentication using [application-only authentication](../developer/data-warehouse-app-only-auth.md) 

memdocs/intune/protect/certificate-authority-add-scep-overview.md

@@ -133,7 +133,7 @@ As the administrator, create a SCEP certificate profile to target to users or de
 
 ## Removing certificates
 
-When you unenroll or wipe the device, the certificates are removed. The certificates aren't revoked.
+After you unenroll or wipe the device, the certificates are removed from the device by Intune and queued for revocations. Revocation on the certificate authority depends on API implementation by each third party. 
 
 ## Third-party certification authority partners
 

windows-365/enterprise/whats-new.md

@@ -58,6 +58,10 @@ For more information about public preview items, see [Public preview in Windows
 <!-- ########################## -->
 ## Week of August 28, 2024 (Service release 2408)
 
+#### Azure Monitor support on Windows 365 Cloud PCs<!--53421756-->
+
+Azure Monitor Agent can now  be installed on Windows 365 Enterprise and Windows 365 Government Cloud PCs. For more information, see [Azure Monitor overview](/azure/azure-monitor/overview).
+
 <!-- vvvvvvvvvvvvvvvvvvvvvv -->
 ### Device security