Additional updates to documentation and FAQ regarding post deployment steps

Author: Mike Swantek

FAQ.md

@@ -7,7 +7,17 @@ Run it on **Day 0**, before end-user AI workloads are deployed. Stage the script
 Use `run.ps1 -Tags foundation,dspm` for the Purview/audit/policy modules, then `run.ps1 -Tags defender,foundry` for Defender plans and Foundry integrations. Each underlying PowerShell script is idempotent and can also be invoked individually for even finer control.
 
 ## Which steps remain manual?
-Microsoft has not published APIs for the Defender portal toggles ("Enable data security for AI interactions" and "Enable suspicious prompt evidence"). After the scripts run, you must flip those switches **in the portal**, then rerun the verification script to confirm the state.
+Several portal toggles cannot be automated via API today and must be enabled manually:
+
+**In Defender for Cloud** (Azure portal → Defender for Cloud → Environment settings → [subscription] → AI services → Settings):
+- **Enable user prompt evidence** — Includes suspicious prompt segments in Defender alerts
+- **Enable data security for AI interactions** — Connects Azure AI telemetry to Microsoft Purview for DSPM for AI
+
+**In Microsoft Purview** (Purview portal → DSPM for AI):
+- **Activate Microsoft Purview Audit** — Required for audit log ingestion (DSPM for AI → Overview → Get Started)
+- **Secure interactions from enterprise apps** — The KYD collection policy for enterprise AI apps (DSPM for AI → Recommendations)
+
+After the scripts run, you must enable these toggles **in the portal**, then rerun the verification script (`34-Validate-Posture.ps1`) to confirm the state.
 
 ## Can I test the Defender scripts by toggling settings off and rerunning them?
 Yes—but rerunning the PowerShell will only detect that the portal toggle is off and remind you to re-enable it. It cannot flip the switch back on; do that manually in Defender for Cloud and re-run the validation script for confirmation.

README.md

@@ -119,18 +119,14 @@ azd up
 
 ### Post-deployment manual steps
 
-After automation completes, you **MUST** manually enable two settings that cannot be automated via API:
-
-**1. Purview DSPM - Secure interactions for enterprise AI apps:**
-1. Sign in to [https://web.purview.azure.com](https://web.purview.azure.com)
-2. Navigate: **Data Security Posture Management for AI** > **Recommendations** > **Secure interactions for enterprise AI apps**
-3. Click **Enable**
-
-**2. Defender for Cloud - Enable data security for AI interactions:**
-1. Sign in to the [Azure portal](https://portal.azure.com)
-2. Navigate: **Microsoft Defender for Cloud** > **Environment settings** > Select your subscription
-3. Under **Defender plans**, locate **AI Services** > Click **Settings**
-4. Toggle **Enable data security for AI interactions** to **On** > Click **Save**
+After automation completes, you **MUST** manually enable several settings that cannot be automated via API:
+
+| Portal | Toggle | Navigation | Purpose |
+|--------|--------|------------|---------|
+| **Defender for Cloud** | Enable user prompt evidence | Azure portal → Defender for Cloud → Environment settings → [subscription] → AI services → Settings | Includes suspicious prompt segments in Defender alerts |
+| **Defender for Cloud** | Enable data security for AI interactions | Azure portal → Defender for Cloud → Environment settings → [subscription] → AI services → Settings | Connects Azure AI telemetry to Purview DSPM for AI |
+| **Microsoft Purview** | Activate Microsoft Purview Audit | Purview portal → DSPM for AI → Overview → Get Started | Required for audit log ingestion |
+| **Microsoft Purview** | Secure interactions from enterprise apps | Purview portal → DSPM for AI → Recommendations | KYD collection policy for enterprise AI apps |
 
 **Why this matters:** Without these manual toggles, AI interaction data (prompts/responses) will NOT be captured by Purview DSPM or Defender for AI for threat detection and compliance analysis.