From 3141bd781bdc8776866970de37c3c082de5df1e4 Mon Sep 17 00:00:00 2001
From: brandonwest-netwrix <brandon.west@netwrix.com>
Date: Thu, 8 Jan 2026 09:38:57 -0500
Subject: [PATCH 1/4] update permission configuration procedure

Updated configuration procedure. Adjusted formatting for clarity and consistency.
---
 .../filesystems/azureinformationprotection.md | 281 +++++++-----------
 1 file changed, 113 insertions(+), 168 deletions(-)

diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md
index a4e25ce623..92b6b4a022 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md
@@ -4,248 +4,193 @@ description: "Azure Information Protection Target Requirements"
 sidebar_position: 10
 ---
 
-# Azure Information Protection Target Requirements
+# **Azure Information Protection Target Requirements**
 
-Microsoft® Azure is a cloud-based computing platform that provides a range of services, such as
-file storage. Azure uses Azure Information Protection (AIP) labels, a Microsoft tool used to
-classify and protect stored files. Enterprise Auditor employs the File System Solution to execute
-Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing scans in order to find AIP
-Protection labels and scan protected (i.e. encrypted) files for sensitive data.
+Microsoft® Azure is a cloud-based computing platform that provides a range of services, such as file storage. Azure uses Azure Information Protection (AIP) labels, a Microsoft tool used to classify and protect stored files. Access Analyzer employs the File System Solution to execute Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing scans in order to find AIP Protection labels and scan protected (i.e. encrypted) files for sensitive data.
 
-This document provides information needed to properly configure access required by Enterprise
-Auditor to successfully scan for Azure Information Protection labels in a targeted environment.
+This document provides information needed to properly configure access required by Access Analyzer to successfully scan for Azure Information Protection labels in a targeted environment.
 
-:::note
-Enterprise Auditor does not scan for AIP Marking labels, only Protection labels.
-:::
 
+:::info
+**NOTE**
 
-## Workflow for Scanning AIP Labels
+Access Analyzer does not scan for AIP Marking labels, only Protection labels.
 
-Before the Enterprise Auditor File System solution can scan for Azure Information Protection (AIP)
-labels, certain prerequisites are required both in Enterprise Auditor and Azure environments.
+:::
 
-1. [Rights Management Service Client Installation](#rights-management-service-client-installation)
-2. [Create a Service Principal Account using PowerShell](#create-a-service-principal-account-using-powershell)
-3. [Enable the Account as an AIP Super User using PowerShell](#enable-the-account-as-an-aip-super-user-using-powershell)
-4. [Add User to the AIP Role in Microsoft® Azure](#add-user-to-the-aip-role-in-microsoft-azure)
-5. [Enterprise Auditor Configurations](#enterprise-auditor-configurations)
-6. Enable settings in FSAA Data Collector in Enterprise Auditor.
+## Workflow for Scanning AIP Labels
 
-    - See the FileSystemAccess Data Collector section in the
-      [File System Solution](/docs/accessanalyzer/11.6/solutions/filesystem/overview.md)
-      topic for additional information
+Before the Access Analyzer File System solution can scan for Azure Information Protection (AIP) labels, certain prerequisites are required both in Access Analyzer and Azure environments.
 
-## Prerequisites
 
-Ensure the following prerequisites are met before configuring AIP scanning:
+1. [Rights Management Service Client Installation](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#rights-management-service-client-installation)
+2. [Create a Service Principal Account](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#create-a-service-principal-account-using-powershell)
+3. [Enable the Account as an AIP Super User using PowerShell](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#enable-the-account-as-an-aip-super-user-using-powershell)
+4. [Add User to the AIP Role in Microsoft® Azure](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#add-user-to-the-aip-role-in-microsoft-azure)
+5. Azure Information Protection Target Requirements
+6. Enable settings in FSAA Data Collector in Access Analyzer.
+   * See the FileSystemAccess Data Collector section in the [File System Solution](https://docs.netwrix.com/docs/accessanalyzer/12_0/solutions/filesystem/overview) topic for additional information
 
-- Microsoft Entra ID Admin credentials
-- The PowerShell `Install-Module` command requires:
-
-    - PowerShell 5.0 (Run as Administrator)
-    - Windows Server 2016and later
+## Prerequisites
 
-- Active Directory Rights Management Services Client 2.1 installed on the server where the FSAA
-  applet or proxy is being run
+Ensure the following prerequisites are met before configuring AIP scanning:
 
-## Rights Management Service Client Installation
+* Microsoft Entra ID Admin credentials
+* The PowerShell `Install-Module` command requires:
+  * PowerShell 5.0 (Run as Administrator)
+  * Windows Server 2016and later
+* Active Directory Rights Management Services Client 2.1 installed on the server where the FSAA applet or proxy is being run
 
-The Rights Management Service Client must be installed on the applet servers where FSAA is running.
-This may be the local Enterprise Auditor server, a Proxy server, or a File Server running in applet
-mode.
+### Rights Management Service Client Installation
 
-- To install the Rights Management Service Client 2.1 on the server where the scan is taking place,
-  go to the Microsoft download center:
+The Rights Management Service Client must be installed on the applet servers where FSAA is running. This may be the local Access Analyzer server, a Proxy server, or a File Server running in applet mode.
 
-    [https://www.microsoft.com/en-us/download/details.aspx?id=38396](https://www.microsoft.com/en-us/download/details.aspx?id=38396)
+* To install the Rights Management Service Client 2.1 on the server where the scan is taking place, go to the Microsoft download center:
 
-:::info
-Read the System Requirements and Install Instructions provided by Microsoft to
-complete the installation.
-:::
+  <https://www.microsoft.com/en-us/download/details.aspx?id=38396>
 
 
-## Create a Service Principal Account using PowerShell
+:::info
+**info**
 
-Follow the steps to create a service principal account with a symmetric key to connect to AIP:
+Read the System Requirements and Install Instructions provided by Microsoft to complete the installation.
 
-:::note
-All PowerShell commands should be run in order through PowerShell as an Admin.
 :::
 
+## Create a Service Principal Account
 
-**Step 1 –** Open up PowerShell (Administrator).
-
-**Step 2 –** Install and import MsOnline module:
 
-```
-Install-Module MsOnline
-Import-Module MsOnline
-```
+1. Open the Azure Portal and sign in with an administrator account
 
-**Step 3 –** Connect to Azure with the `Connect-MsolService` command. Enter the Azure credentials in
-the **Sign in to your account** window that displays from Microsoft.
+   
+   1. <https://portal.azure.com/>
+2. Create a new app registration
 
-**Step 4 –** Once successfully connected to Azure, create a service principal with the following
-command:
+   
+   1. Navigate to Microsoft Entra ID → App registrations → New registration
+   2. Give the new application a distinguishable name
+3. Create a client secret
 
-```
-New-MsolServicePrincipal
-```
-
-> Enter the **DisplayName** of the new service principal name. (For example, AIP_EnterpriseAuditor)
-
-**Step 5 –** Take note and save the **Symmetric Key** and **AppPrincipalID** to be used in later
-steps.
+   
+   1. Open **Certificates & secrets** → Client secrets
+   2. Click **New client secret**
+   3. Provide a brief description & expiration date
+   4. Click **Add**
+   5. Record the **Secret Value** immediately
 
+      
 :::warning
-Do not lose the symmetric key. It is not retrievable again once the PowerShell window
-is closed.
-:::
+      This will disappear once you leave the page!
 
+      :::
+4. Add API permissions
 
-The service principal account with the proper key has been created.
+   
+   1. Open **API Permissions**
+   2. Click “Add a permission”
+   3. Select the **Microsoft Graph API** permission set > Application permissions
+   4. Add the “InformationProtectionPolicy.Read.All” permission
+5. After adding the required API permission, select “Grant admin consent”
+6. Record the AppID (from the Overview Page) and the tenantID with the secret value
 
-## Enable the Account as an AIP Super User using PowerShell
+## **Enable the Account as an AIP Super User using PowerShell**
 
 Follow the steps to enable the Service Principal Account in AIP as a Super User:
 
-:::note
+
+:::info
+**NOTE**
+
 All PowerShell commands should be run in order through PowerShell as an Admin.
-:::
 
+:::
 
-**Step 1 –** In PowerShell, install Microsoft Azure Active Directory Rights Manager (AIPService)
-module:
 
-```
-Install-Module AIPService
-Import-Module AIPService
-```
+1. In PowerShell, install Microsoft Azure Active Directory Rights Manager (AIPService) module:
 
-**Step 2 –** Connect to Azure using the `Connect-AIPService` command and supply Azure credentials in
-the **Sign in to your account** window that displays from Microsoft.
+`Install-Module AIPService`
+`Import-Module AIPService`
 
-**Step 3 –** Add the service principal to the Azure AD Rights Management service super users, using
-the AppPrincipalID saved from the steps in the
-[Create a Service Principal Account using PowerShell](#create-a-service-principal-account-using-powershell)
-section:
 
-```
-Add-AipServiceSuperUser-ServicePrincipalID <AppPrincipalID>
-```
+2. Connect to Azure using the `Connect-AIPService` command and supply Azure credentials in the **Sign in to your account** window that displays from Microsoft.
+3. Add the service principal to the Azure AD Rights Management service super users, using the AppID saved from the steps in the [Create a Service Principal Account](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#create-a-service-principal-account-using-powershell) section:
 
-**Step 4 –** Enable the DisplayName account using the following command:
+`Add-AipServiceSuperUser-ServicePrincipalID <AppID>`
 
-```
-Enable-AIPServiceSuperUserFeature
-```
 
-The Service Principal Account is now added to the Rights Management service as a Super User, and the
-Super User feature is enabled.
+4. Enable the DisplayName account using the following command:
 
-## Add User to the AIP Role in Microsoft® Azure
+`Enable-AIPServiceSuperUserFeature`
 
-In Microsoft Azure, add the Account to the Azure Information Protection Administrator Role.
+The Service Principal Account is now added to the Rights Management service as a Super User, and the Super User feature is enabled.
 
-**Step 1 –** Log into **http://portal.azure.com** with Azure credentials and select **Microsoft
-Entra ID** from the list of resources on the left-hand pane.
+## Add App Registration to the AIP Role in Microsoft® Azure
 
-**Step 2 –** Navigate to **Roles and Administrators**. On the Administrative Roles page, select the
-**Azure Information Protection Administrator** role.
+In Microsoft Azure, add the Account to the Azure Information Protection Administrator Role.
 
-**Step 3 –** Use the **Add Assignment** button to display the Add assignments pane. Search for the
-name of the new service principal account (the **DisplayName** entered in PowerShell) and add it to
-the list of assignments.
 
-The Service Principal Account is now successfully added to the Azure Information Protection
-Administrator role.
+1. Log into **[http://portal.azure.com](http://portal.azure.com/)** with Azure credentials and select **Microsoft Entra ID** from the list of resources on the left-hand pane.
+2. Navigate to **Roles and Administrators**. On the Administrative Roles page, select the **Azure Information Protection Administrator** role.
+3. Use the **Add Assignment** button to display the Add assignments pane. Search for the name of the new service principal account (the **DisplayName** entered in PowerShell) and add it to the list of assignments.
 
-## Enterprise Auditor Configurations
+The Service Principal Account is now successfully added to the Azure Information Protection Administrator role.
 
-Before Enterprise Auditor can scan for AIP labels, two configurations must be done prior to the
-initial scan.
+## **Access Analyzer Configurations**
 
-- [Azure Connection Profile ](#azure-connection-profile)
-- [Configure FSAA Data Collector](#configure-fsaa-data-collector)
+Before Access Analyzer can scan for AIP labels, two configurations must be done prior to the initial scan.
 
-### Azure Connection Profile
+* [Azure Connection Profile](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#azure-connection-profile)
+* [Configure FSAA Data Collector](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#configure-fsaa-data-collector)
 
-To collect tags for files protected with Azure Information Protection, an Azure connection profile
-must be configured in Enterprise Auditor before an FSAA scan runs. See the
-[Global Settings](/docs/accessanalyzer/11.6/admin/settings/overview.md)
-topic for additional information on how to set up a connection profile at the global level.
+### **Azure Connection Profile**
 
-**Step 1 –** In Enterprise Auditor, add a credential for an Azure Active Directory account type to
-the existing Connection Profile used for File System scanning. Supply the Client ID field with the
-**AppPrincipalID** and the Key field with the **Symmetric key** created upon creation of the new
-service principal.
+To collect tags for files protected with Azure Information Protection, an Azure connection profile must be configured in Access Analyzer before an FSAA scan runs. See the [Global Settings](https://docs.netwrix.com/docs/accessanalyzer/12_0/admin/settings/overview) topic for additional information on how to set up a connection profile at the global level.
 
-**Step 2 –** At the job level, apply the connection profile that contains both the Microsoft Entra
-ID credential and credentials required for File System scanning under the **Jobs** > [__Job__] >
-**Settings** > **Connection** node.
 
-**Step 3 –** Ensure that the job is configured correctly before running a scan. See the
-[Configure FSAA Data Collector](#configure-fsaa-data-collector) topic for additional information.
+1. In Access Analyzer, add a credential for an Azure Active Directory account type to the existing Connection Profile used for File System scanning. Supply the Client ID field with the **AppID** and the Key field with the **Secret Value** created upon creation of the new service principal.
+2. At the job level, apply the connection profile that contains both the Microsoft Entra ID credential and credentials required for File System scanning under the **Jobs** > \[**Job**\] > **Settings** > **Connection** node.
+3. Ensure that the job is configured correctly before running a scan. See the [Configure FSAA Data Collector](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#configure-fsaa-data-collector) topic for additional information.
 
 An Azure Connection Profile has now been successfully created for an FSAA scan.
 
-### Configure FSAA Data Collector
+### **Configure FSAA Data Collector**
 
-In Enterprise Auditor, configure the FSAA Data Collector wizard pages to scan files protected by
-Azure Information Protection. This can be done for both FSAA System Scans and SEEK System Scans. In
-the FSAA Data Collector Wizard, configure the following menus to scan for AIP protection labels:
+In Access Analyzer, configure the FSAA Data Collector wizard pages to scan files protected by Azure Information Protection. This can be done for both FSAA System Scans and SEEK System Scans. In the FSAA Data Collector Wizard, configure the following menus to scan for AIP protection labels:
 
 For FSAA System Scans:
 
-- Scan Server Selection – Choose the server that scanning is executed on. Target the server that has
-  the Rights Management Service Client 2.1 installed where the applet is running.
+* Scan Server Selection – Choose the server that scanning is executed on. Target the server that has the Rights Management Service Client 2.1 installed where the applet is running.
+  * This may be a proxy server, file server (applet mode), or the local Access Analyzer console depending on scan configuration
+* Scan Settings – Select the **Enable scanning of files protected by Azure Information Protection** checkbox to add AIP files to the scan criteria
+* Azure Tenant Mapping page – Add the **AppID** and the **Domain Name** or **Tenant ID**
 
-    - This may be a proxy server, file server (applet mode), or the local Enterprise Auditor console
-      depending on scan configuration
+  
+:::tip
+  **TIP**
 
-- Scan Settings – Select the **Enable scanning of files protected by Azure Information Protection**
-  checkbox to add AIP files to the scan criteria
-- Azure Tenant Mapping page – Add the **AppPrincipalID** (App ID) and the **Domain Name** or
-  **Tenant ID**
+  Remember, the Azure Tenant Mapping page is only visible when the **Enable scanning of files protected by Azure Information Protection** checkbox is selected on the Scan Settings page.
 
-    :::tip
-        Remember, the Azure Tenant Mapping page is only visible when the **Enable scanning of files
-    protected by Azure Information Protection** checkbox is selected on the Scan Settings page.
-    :::
-
-
-- Default Scoping Options
-
-    - File Details tab – **Include files protected by Azure Information Protection (AIP)**
-    - File Properties (Folder Summary) – **Include AIP Protected Files**
-
-- Scoping Options – if needed, scope to a specific subset of resources on a selected host
+  :::
+* Default Scoping Options
+  * File Details tab – **Include files protected by Azure Information Protection (AIP)**
+  * File Properties (Folder Summary) – **Include AIP Protected Files**
+* Scoping Options – if needed, scope to a specific subset of resources on a selected host
 
 For SEEK System Scans:
 
-- Scan Server Selection – Choose the server that scanning is executed on. Target the server that has
-  the Rights Management Service Client 2.1 installed where the applet is running.
-
-    - This may be a proxy server, file server (applet mode), or the local Enterprise Auditor console
-      depending on scan configuration
-
-- Scan Settings – Select the **Enable scanning of files protected by Azure Information Protection**
-  checkbox to add AIP files to the scan criteria
-- Azure Tenant Mapping page – Add the **AppPrincipalID** (App ID) and the **Domain Name** or
-  **Tenant ID**
+* Scan Server Selection – Choose the server that scanning is executed on. Target the server that has the Rights Management Service Client 2.1 installed where the applet is running.
+  * This may be a proxy server, file server (applet mode), or the local Access Analyzer console depending on scan configuration
+* Scan Settings – Select the **Enable scanning of files protected by Azure Information Protection** checkbox to add AIP files to the scan criteria
+* Azure Tenant Mapping page – Add the **AppID** and the **Domain Name** or **Tenant ID**
 
-    :::tip
-        Remember, the Azure Tenant Mapping page is only visible when the **Enable scanning of files
-    protected by Azure Information Protection** checkbox is selected on the Scan Settings page.
-    :::
+  
+:::tip
+  **TIP**
 
+  Remember, the Azure Tenant Mapping page is only visible when the **Enable scanning of files protected by Azure Information Protection** checkbox is selected on the Scan Settings page.
 
-- Scoping Options – if needed, scope to a specific subset of resources on a selected host
-- Sensitive Data Settings – Select **Decrypt Files Protected by Azure Information Protection**. This
-  page only applies for SEEK scans.
+  :::
+* Scoping Options – if needed, scope to a specific subset of resources on a selected host
+* Sensitive Data Settings – Select **Decrypt Files Protected by Azure Information Protection**. This page only applies for SEEK scans.
 
-See the FileSystemAccess Data Collector section in the
-[File System Solution](/docs/accessanalyzer/11.6/solutions/filesystem/overview.md)
-topic for additional information on these scoping options.
+See the FileSystemAccess Data Collector section in the [File System Solution](https://docs.netwrix.com/docs/accessanalyzer/12_0/solutions/filesystem/overview) topic for additional information on these scoping options.

From e05ec0dd1267a6e1e3e210262ede706d0cb32abd Mon Sep 17 00:00:00 2001
From: brandonwest-netwrix <brandon.west@netwrix.com>
Date: Thu, 8 Jan 2026 09:39:48 -0500
Subject: [PATCH 2/4] Refactor Azure Information Protection documentation

Updated formatting and improved clarity in the Azure Information Protection Target Requirements document. Added links for better navigation and ensured consistent use of headings.
---
 .../filesystems/azureinformationprotection.md | 275 +++++++-----------
 1 file changed, 110 insertions(+), 165 deletions(-)

diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md
index 6e18e88120..17e6aebc6b 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md
@@ -4,248 +4,193 @@ description: "Azure Information Protection Target Requirements"
 sidebar_position: 20
 ---
 
-# Azure Information Protection Target Requirements
+# **Azure Information Protection Target Requirements**
 
-Microsoft® Azure is a cloud-based computing platform that provides a range of services, such as
-file storage. Azure uses Azure Information Protection (AIP) labels, a Microsoft tool used to
-classify and protect stored files. Access Analyzer employs the File System Solution to execute
-Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing scans in order to find AIP
-Protection labels and scan protected (i.e. encrypted) files for sensitive data.
+Microsoft® Azure is a cloud-based computing platform that provides a range of services, such as file storage. Azure uses Azure Information Protection (AIP) labels, a Microsoft tool used to classify and protect stored files. Access Analyzer employs the File System Solution to execute Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing scans in order to find AIP Protection labels and scan protected (i.e. encrypted) files for sensitive data.
 
-This document provides information needed to properly configure access required by Access Analyzer
-to successfully scan for Azure Information Protection labels in a targeted environment.
+This document provides information needed to properly configure access required by Access Analyzer to successfully scan for Azure Information Protection labels in a targeted environment.
+
+
+:::info
+**NOTE**
 
-:::note
 Access Analyzer does not scan for AIP Marking labels, only Protection labels.
+
 :::
 
+## Workflow for Scanning AIP Labels
 
-## Workflow for Scanning AIP Labels
+Before the Access Analyzer File System solution can scan for Azure Information Protection (AIP) labels, certain prerequisites are required both in Access Analyzer and Azure environments.
 
-Before the Access Analyzer File System solution can scan for Azure Information Protection (AIP)
-labels, certain prerequisites are required both in Access Analyzer and Azure environments.
 
-1. [Rights Management Service Client Installation](#rights-management-service-client-installation)
-2. [Create a Service Principal Account using PowerShell](#create-a-service-principal-account-using-powershell)
-3. [Enable the Account as an AIP Super User using PowerShell](#enable-the-account-as-an-aip-super-user-using-powershell)
-4. [Add User to the AIP Role in Microsoft® Azure](#add-user-to-the-aip-role-in-microsoft-azure)
+1. [Rights Management Service Client Installation](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#rights-management-service-client-installation)
+2. [Create a Service Principal Account](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#create-a-service-principal-account-using-powershell)
+3. [Enable the Account as an AIP Super User using PowerShell](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#enable-the-account-as-an-aip-super-user-using-powershell)
+4. [Add User to the AIP Role in Microsoft® Azure](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#add-user-to-the-aip-role-in-microsoft-azure)
 5. Azure Information Protection Target Requirements
 6. Enable settings in FSAA Data Collector in Access Analyzer.
-
-    - See the FileSystemAccess Data Collector section in the
-      [File System Solution](/docs/accessanalyzer/12.0/solutions/filesystem/overview.md) topic for additional
-      information
+   * See the FileSystemAccess Data Collector section in the [File System Solution](https://docs.netwrix.com/docs/accessanalyzer/12_0/solutions/filesystem/overview) topic for additional information
 
 ## Prerequisites
 
-Ensure the following prerequisites are met before configuring AIP scanning:
-
-- Microsoft Entra ID Admin credentials
-- The PowerShell `Install-Module` command requires:
+Ensure the following prerequisites are met before configuring AIP scanning:
 
-    - PowerShell 5.0 (Run as Administrator)
-    - Windows Server 2016and later
+* Microsoft Entra ID Admin credentials
+* The PowerShell `Install-Module` command requires:
+  * PowerShell 5.0 (Run as Administrator)
+  * Windows Server 2016and later
+* Active Directory Rights Management Services Client 2.1 installed on the server where the FSAA applet or proxy is being run
 
-- Active Directory Rights Management Services Client 2.1 installed on the server where the FSAA
-  applet or proxy is being run
+### Rights Management Service Client Installation
 
-## Rights Management Service Client Installation
+The Rights Management Service Client must be installed on the applet servers where FSAA is running. This may be the local Access Analyzer server, a Proxy server, or a File Server running in applet mode.
 
-The Rights Management Service Client must be installed on the applet servers where FSAA is running.
-This may be the local Access Analyzer server, a Proxy server, or a File Server running in applet
-mode.
+* To install the Rights Management Service Client 2.1 on the server where the scan is taking place, go to the Microsoft download center:
 
-- To install the Rights Management Service Client 2.1 on the server where the scan is taking place,
-  go to the Microsoft download center:
+  <https://www.microsoft.com/en-us/download/details.aspx?id=38396>
 
-    [https://www.microsoft.com/en-us/download/details.aspx?id=38396](https://www.microsoft.com/en-us/download/details.aspx?id=38396)
 
 :::info
-Read the System Requirements and Install Instructions provided by Microsoft to
-complete the installation.
-:::
+**info**
 
+Read the System Requirements and Install Instructions provided by Microsoft to complete the installation.
 
-## Create a Service Principal Account using PowerShell
-
-Follow the steps to create a service principal account with a symmetric key to connect to AIP:
-
-:::note
-All PowerShell commands should be run in order through PowerShell as an Admin.
 :::
 
+## Create a Service Principal Account
 
-**Step 1 –** Open up PowerShell (Administrator).
-
-**Step 2 –** Install and import MsOnline module:
 
-```
-Install-Module MsOnline
-Import-Module MsOnline
-```
+1. Open the Azure Portal and sign in with an administrator account
 
-**Step 3 –** Connect to Azure with the `Connect-MsolService` command. Enter the Azure credentials in
-the **Sign in to your account** window that displays from Microsoft.
+   
+   1. <https://portal.azure.com/>
+2. Create a new app registration
 
-**Step 4 –** Once successfully connected to Azure, create a service principal with the following
-command:
+   
+   1. Navigate to Microsoft Entra ID → App registrations → New registration
+   2. Give the new application a distinguishable name
+3. Create a client secret
 
-```
-New-MsolServicePrincipal
-```
-
-> Enter the **DisplayName** of the new service principal name. (For example, AIP_EnterpriseAuditor)
-
-**Step 5 –** Take note and save the **Symmetric Key** and **AppPrincipalID** to be used in later
-steps.
+   
+   1. Open **Certificates & secrets** → Client secrets
+   2. Click **New client secret**
+   3. Provide a brief description & expiration date
+   4. Click **Add**
+   5. Record the **Secret Value** immediately
 
+      
 :::warning
-Do not lose the symmetric key. It is not retrievable again once the PowerShell window
-is closed.
-:::
+      This will disappear once you leave the page!
 
+      :::
+4. Add API permissions
 
-The service principal account with the proper key has been created.
+   
+   1. Open **API Permissions**
+   2. Click “Add a permission”
+   3. Select the **Microsoft Graph API** permission set > Application permissions
+   4. Add the “InformationProtectionPolicy.Read.All” permission
+5. After adding the required API permission, select “Grant admin consent”
+6. Record the AppID (from the Overview Page) and the tenantID with the secret value
 
-## Enable the Account as an AIP Super User using PowerShell
+## **Enable the Account as an AIP Super User using PowerShell**
 
 Follow the steps to enable the Service Principal Account in AIP as a Super User:
 
-:::note
+
+:::info
+**NOTE**
+
 All PowerShell commands should be run in order through PowerShell as an Admin.
-:::
 
+:::
 
-**Step 1 –** In PowerShell, install Microsoft Azure Active Directory Rights Manager (AIPService)
-module:
 
-```
-Install-Module AIPService
-Import-Module AIPService
-```
+1. In PowerShell, install Microsoft Azure Active Directory Rights Manager (AIPService) module:
 
-**Step 2 –** Connect to Azure using the `Connect-AIPService` command and supply Azure credentials in
-the **Sign in to your account** window that displays from Microsoft.
+`Install-Module AIPService`
+`Import-Module AIPService`
 
-**Step 3 –** Add the service principal to the Azure AD Rights Management service super users, using
-the AppPrincipalID saved from the steps in the
-[Create a Service Principal Account using PowerShell](#create-a-service-principal-account-using-powershell)
-section:
 
-```
-Add-AipServiceSuperUser-ServicePrincipalID <AppPrincipalID>
-```
+2. Connect to Azure using the `Connect-AIPService` command and supply Azure credentials in the **Sign in to your account** window that displays from Microsoft.
+3. Add the service principal to the Azure AD Rights Management service super users, using the AppID saved from the steps in the [Create a Service Principal Account](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#create-a-service-principal-account-using-powershell) section:
 
-**Step 4 –** Enable the DisplayName account using the following command:
+`Add-AipServiceSuperUser-ServicePrincipalID <AppID>`
 
-```
-Enable-AIPServiceSuperUserFeature
-```
 
-The Service Principal Account is now added to the Rights Management service as a Super User, and the
-Super User feature is enabled.
+4. Enable the DisplayName account using the following command:
 
-## Add User to the AIP Role in Microsoft® Azure
+`Enable-AIPServiceSuperUserFeature`
 
-In Microsoft Azure, add the Account to the Azure Information Protection Administrator Role.
+The Service Principal Account is now added to the Rights Management service as a Super User, and the Super User feature is enabled.
 
-**Step 1 –** Log into **http://portal.azure.com** with Azure credentials and select **Microsoft
-Entra ID** from the list of resources on the left-hand pane.
+## Add App Registration to the AIP Role in Microsoft® Azure
 
-**Step 2 –** Navigate to **Roles and Administrators**. On the Administrative Roles page, select the
-**Azure Information Protection Administrator** role.
+In Microsoft Azure, add the Account to the Azure Information Protection Administrator Role.
 
-**Step 3 –** Use the **Add Assignment** button to display the Add assignments pane. Search for the
-name of the new service principal account (the **DisplayName** entered in PowerShell) and add it to
-the list of assignments.
 
-The Service Principal Account is now successfully added to the Azure Information Protection
-Administrator role.
+1. Log into **[http://portal.azure.com](http://portal.azure.com/)** with Azure credentials and select **Microsoft Entra ID** from the list of resources on the left-hand pane.
+2. Navigate to **Roles and Administrators**. On the Administrative Roles page, select the **Azure Information Protection Administrator** role.
+3. Use the **Add Assignment** button to display the Add assignments pane. Search for the name of the new service principal account (the **DisplayName** entered in PowerShell) and add it to the list of assignments.
 
-## Access Analyzer Configurations
+The Service Principal Account is now successfully added to the Azure Information Protection Administrator role.
 
-Before Access Analyzer can scan for AIP labels, two configurations must be done prior to the initial
-scan.
+## **Access Analyzer Configurations**
 
-- [Azure Connection Profile ](#azure-connection-profile)
-- [Configure FSAA Data Collector](#configure-fsaa-data-collector)
+Before Access Analyzer can scan for AIP labels, two configurations must be done prior to the initial scan.
 
-### Azure Connection Profile
+* [Azure Connection Profile](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#azure-connection-profile)
+* [Configure FSAA Data Collector](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#configure-fsaa-data-collector)
 
-To collect tags for files protected with Azure Information Protection, an Azure connection profile
-must be configured in Access Analyzer before an FSAA scan runs. See the
-[Global Settings](/docs/accessanalyzer/12.0/admin/settings/overview.md) topic for additional information on how to
-set up a connection profile at the global level.
+### **Azure Connection Profile**
 
-**Step 1 –** In Access Analyzer, add a credential for an Azure Active Directory account type to the
-existing Connection Profile used for File System scanning. Supply the Client ID field with the
-**AppPrincipalID** and the Key field with the **Symmetric key** created upon creation of the new
-service principal.
+To collect tags for files protected with Azure Information Protection, an Azure connection profile must be configured in Access Analyzer before an FSAA scan runs. See the [Global Settings](https://docs.netwrix.com/docs/accessanalyzer/12_0/admin/settings/overview) topic for additional information on how to set up a connection profile at the global level.
 
-**Step 2 –** At the job level, apply the connection profile that contains both the Microsoft Entra
-ID credential and credentials required for File System scanning under the **Jobs** > [__Job__] >
-**Settings** > **Connection** node.
 
-**Step 3 –** Ensure that the job is configured correctly before running a scan. See the
-[Configure FSAA Data Collector](#configure-fsaa-data-collector) topic for additional information.
+1. In Access Analyzer, add a credential for an Azure Active Directory account type to the existing Connection Profile used for File System scanning. Supply the Client ID field with the **AppID** and the Key field with the **Secret Value** created upon creation of the new service principal.
+2. At the job level, apply the connection profile that contains both the Microsoft Entra ID credential and credentials required for File System scanning under the **Jobs** > \[**Job**\] > **Settings** > **Connection** node.
+3. Ensure that the job is configured correctly before running a scan. See the [Configure FSAA Data Collector](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#configure-fsaa-data-collector) topic for additional information.
 
 An Azure Connection Profile has now been successfully created for an FSAA scan.
 
-### Configure FSAA Data Collector
+### **Configure FSAA Data Collector**
 
-In Access Analyzer, configure the FSAA Data Collector wizard pages to scan files protected by Azure
-Information Protection. This can be done for both FSAA System Scans and SEEK System Scans. In the
-FSAA Data Collector Wizard, configure the following menus to scan for AIP protection labels:
+In Access Analyzer, configure the FSAA Data Collector wizard pages to scan files protected by Azure Information Protection. This can be done for both FSAA System Scans and SEEK System Scans. In the FSAA Data Collector Wizard, configure the following menus to scan for AIP protection labels:
 
 For FSAA System Scans:
 
-- Scan Server Selection – Choose the server that scanning is executed on. Target the server that has
-  the Rights Management Service Client 2.1 installed where the applet is running.
+* Scan Server Selection – Choose the server that scanning is executed on. Target the server that has the Rights Management Service Client 2.1 installed where the applet is running.
+  * This may be a proxy server, file server (applet mode), or the local Access Analyzer console depending on scan configuration
+* Scan Settings – Select the **Enable scanning of files protected by Azure Information Protection** checkbox to add AIP files to the scan criteria
+* Azure Tenant Mapping page – Add the **AppID** and the **Domain Name** or **Tenant ID**
 
-    - This may be a proxy server, file server (applet mode), or the local Access Analyzer console
-      depending on scan configuration
+  
+:::tip
+  **TIP**
 
-- Scan Settings – Select the **Enable scanning of files protected by Azure Information Protection**
-  checkbox to add AIP files to the scan criteria
-- Azure Tenant Mapping page – Add the **AppPrincipalID** (App ID) and the **Domain Name** or
-  **Tenant ID**
+  Remember, the Azure Tenant Mapping page is only visible when the **Enable scanning of files protected by Azure Information Protection** checkbox is selected on the Scan Settings page.
 
-    :::tip
-        Remember, the Azure Tenant Mapping page is only visible when the **Enable scanning of files
-    protected by Azure Information Protection** checkbox is selected on the Scan Settings page.
-    :::
-
-
-- Default Scoping Options
-
-    - File Details tab – **Include files protected by Azure Information Protection (AIP)**
-    - File Properties (Folder Summary) – **Include AIP Protected Files**
-
-- Scoping Options – if needed, scope to a specific subset of resources on a selected host
+  :::
+* Default Scoping Options
+  * File Details tab – **Include files protected by Azure Information Protection (AIP)**
+  * File Properties (Folder Summary) – **Include AIP Protected Files**
+* Scoping Options – if needed, scope to a specific subset of resources on a selected host
 
 For SEEK System Scans:
 
-- Scan Server Selection – Choose the server that scanning is executed on. Target the server that has
-  the Rights Management Service Client 2.1 installed where the applet is running.
-
-    - This may be a proxy server, file server (applet mode), or the local Access Analyzer console
-      depending on scan configuration
-
-- Scan Settings – Select the **Enable scanning of files protected by Azure Information Protection**
-  checkbox to add AIP files to the scan criteria
-- Azure Tenant Mapping page – Add the **AppPrincipalID** (App ID) and the **Domain Name** or
-  **Tenant ID**
+* Scan Server Selection – Choose the server that scanning is executed on. Target the server that has the Rights Management Service Client 2.1 installed where the applet is running.
+  * This may be a proxy server, file server (applet mode), or the local Access Analyzer console depending on scan configuration
+* Scan Settings – Select the **Enable scanning of files protected by Azure Information Protection** checkbox to add AIP files to the scan criteria
+* Azure Tenant Mapping page – Add the **AppID** and the **Domain Name** or **Tenant ID**
 
-    :::tip
-        Remember, the Azure Tenant Mapping page is only visible when the **Enable scanning of files
-    protected by Azure Information Protection** checkbox is selected on the Scan Settings page.
-    :::
+  
+:::tip
+  **TIP**
 
+  Remember, the Azure Tenant Mapping page is only visible when the **Enable scanning of files protected by Azure Information Protection** checkbox is selected on the Scan Settings page.
 
-- Scoping Options – if needed, scope to a specific subset of resources on a selected host
-- Sensitive Data Settings – Select **Decrypt Files Protected by Azure Information Protection**. This
-  page only applies for SEEK scans.
+  :::
+* Scoping Options – if needed, scope to a specific subset of resources on a selected host
+* Sensitive Data Settings – Select **Decrypt Files Protected by Azure Information Protection**. This page only applies for SEEK scans.
 
-See the FileSystemAccess Data Collector section in the
-[File System Solution](/docs/accessanalyzer/12.0/solutions/filesystem/overview.md) topic for additional information
-on these scoping options.
+See the FileSystemAccess Data Collector section in the [File System Solution](https://docs.netwrix.com/docs/accessanalyzer/12_0/solutions/filesystem/overview) topic for additional information on these scoping options.

From 39c872ffe90747444942280c7456a6a89446e76e Mon Sep 17 00:00:00 2001
From: Brandon West <Brandon.West@Netwrix.com>
Date: Fri, 16 Jan 2026 16:53:57 -0500
Subject: [PATCH 3/4] added image demonstrating correct permissions for AIP APP
 Permissions.

---
 .../filesystems/azureinformationprotection.md    |   3 +++
 .../filesystems/azureinformationprotection.md    |   3 +++
 .../target/config/AIP_APP_Permissions.webp       | Bin 0 -> 8126 bytes
 .../target/config/AIP_APP_Permissions.webp       | Bin 0 -> 8126 bytes
 4 files changed, 6 insertions(+)
 create mode 100644 static/images/accessanalyzer/11.6/requirements/target/config/AIP_APP_Permissions.webp
 create mode 100644 static/images/accessanalyzer/12.0/requirements/target/config/AIP_APP_Permissions.webp

diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md
index 92b6b4a022..bb25eaea2e 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md
@@ -90,6 +90,9 @@ Read the System Requirements and Install Instructions provided by Microsoft to c
    2. Click “Add a permission”
    3. Select the **Microsoft Graph API** permission set > Application permissions
    4. Add the “InformationProtectionPolicy.Read.All” permission
+
+![Azure App Permissions](/images/accessanalyzer/11.6/requirements/target/config/AIP_APP_Permissions.webp)
+
 5. After adding the required API permission, select “Grant admin consent”
 6. Record the AppID (from the Overview Page) and the tenantID with the secret value
 
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md
index 17e6aebc6b..2f0ffb055d 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md
@@ -90,6 +90,9 @@ Read the System Requirements and Install Instructions provided by Microsoft to c
    2. Click “Add a permission”
    3. Select the **Microsoft Graph API** permission set > Application permissions
    4. Add the “InformationProtectionPolicy.Read.All” permission
+
+   ![Azure App Permissions](/images/accessanalyzer/12.0/requirements/target/config/AIP_APP_Permissions.webp)
+
 5. After adding the required API permission, select “Grant admin consent”
 6. Record the AppID (from the Overview Page) and the tenantID with the secret value
 
diff --git a/static/images/accessanalyzer/11.6/requirements/target/config/AIP_APP_Permissions.webp b/static/images/accessanalyzer/11.6/requirements/target/config/AIP_APP_Permissions.webp
new file mode 100644
index 0000000000000000000000000000000000000000..6b60a1e99192f1804c8723f8311a1699445141fa
GIT binary patch
literal 8126
zcmV;vA3@+!Nk&Gt9{>PXMM6+kP&go}9{>Q5egK^TDr*B`06uLrmq(-{BB3c08E}9N
ziDPd3W7!(y(Ep(F=lC`j@!VX)*!d~i=lvh3U-&+p-kbdc`G@_g^?CoB`;qQ1{Kra%
z`%nM=;UC!l&j0`S0R3bC|Lsfvx7hRikEHLQ2mTLG5B<G%{UZLG;5YIw>pziRYyJ=N
zU)TRCf4u+Y<!8;`-+c%ECH156AJ~7yf8O<T{s;8W8GY@4JNZHI3;5^pukIh%{~*0E
z|Azdd@T9Ll?tMXhdih`Zf9wCe|Kq&u|6csh{>$(e;NR1~#eQx7Ir{+qGyJFg_xEq!
z-|rs%|90@M`iJ@-_@Cas0DqBxQU7KB3;fUiuk-&%pR0ev{}ujA_aoWI<)7OB=zoOx
z1pZ0=8~vyEuk$~(A2xsez0H2ufB*MH{fPhiRYU`Rzu6M1aRJNOdayZZWk6ioApt};
zv(JkCSlhZLM$K)YUW8;(FiN%C(SM3CJAsI5hstu1V@Jrm(17YQnUf|4#Idj68GE*!
ze=TYGpj?U{X*k1v7MkSP!XF-j?gMJnq-m^Gsw*>3Ot|TaR8TM@DYhz*mE03yfu_;T
zQ^=TV!}~itD;9v=&!js_uLSEZ$!962sLNlQRVC}6Tg~{i-&$YZ54~iM$rK}_N!yrV
zr>&ua>+>wnZa>ZPHv5ka?{1mfqHv{6!d#EQQTk`Wr|6CNT#M&drACmDDH~0l4hkaX
z`}omarfX4=DVSI9)mM4NDs?vL*HHLrn8RYNj@v!KqGKhgNYhxWW3}_5V<o9b(^aw|
zef8hFb~r*!61Ax+#PmuF2Vf`59lPn^*Xu@XV`+%T$b*l-QTk`Ws0G*NWUs(c`e(tY
z1=r?eufS3IXTheZah=Uushc4WG){S=PFL}vIdzKRoS!WOpA8utqGDrye<p1bb=J<h
zbao}&QaWkByiZ%D>Po}1(&e05OyQ{h8Hn21V7dSUvS%K3bzYy-s6ow}U`tM#OvHCc
z_A(&Aol1+4<Y1Xj2#%UUvM(2@>YBP9<SwAh00_A^VHu=OB>n!PcSTkParr+jYEf`+
z2ibIdj!}K1(OsRjOZ6Znsds0D^2+2x9!&PU_TrEC=MMp-8a4aSQpHhUyL7dk`iO_h
zeVHpjv(Z{cZY1llI7Gm<pSTv|t`n{`ZmYeQ7R`1}d#zZphC~p}YH12XH<on^t@*-0
z_BlJ^^!6|3XNv1XUM2k9G#n7%u0({eevDZpy=bHEk}1nvm_$d<4g>fUIIX%Oc}vE)
zRdEetb}Zy8Z<P7rKnt(TvB)A6iW2J;`a7e_O83+7Xqd@vnJY#x)=Rt)W~g_=nUHAv
z%o-*#T9_^X0RHw6YRdPqizC{y2A#+rg0MEHe<5q4@Q5RpW20w3LOuo?FqtqQ6zt{r
z?c=A12S5EGVd*nkPhZ7MJe_ek46av@wCt4pQX|Ir<6#Q%>&+UsMZ~<5l8S_i2Fd`G
zRrJ@UC3T(qBFa(b4*Tp6cdqHheh@B6%$k0CB@1m1v70>|fZ$JPd_ZbU1l%Z}k_8u=
ztuPA!72zRnimy2Q2fiGL&O-T{IbDdYujPtxvs7!d_w%)26?VO#%D;-C!KnTuaSkF4
zuvkafRz+5t#aTa8%UYk=ZR@rE=a}%D1P_D4KCGdLhWtys%o(F-HhdGjaD!wqXz~01
zoe)}PvZ?x_Io8>!ZdRg=WXuAQn^YiC9t#)9kwlb1`fy#!zJlC@!^^c9Gyb3us4Gas
z-iI}#S!VmefRWv`CsB=-DFVTwuz!tKp+O8q8QDhpp5M6oly-w-WmSIg$n)OrE2v)2
zB}5c=PrY?!Ec<o3gQzcPiyqYSisQSk^fxdDTiFljd`!`Ss}@r$E;0sMM91O^zq7$t
zF0bT%zKs?tw_w4>47|gNh1WJVHh^#DY+CP9t+;|(ySN0K`XDRY$6$0vXD2faB*R)N
zRL?x=<RewT$5&_hTQ!LRso!uEIFEuYqSK1JA$x7u_b$;+8SI?SwG8n%1yNViKh@nA
z>45u!?Q<EXCh#&*<N*5Q6+%eMlA|w{qzF@G&vd6s&$Bpq(cH%AvYe+OB*vzBiAiwg
z1(Dj38s)cN;_>ns>P`Hn7)+Zocncc8rV@>garxqSp+33xDBya%p;&QZhu0d^D@^vs
z;qUG2WsJq-m($@Sn@(r;+TaNuKO|q5QDd8Fm4=Y6gff|zX0TUoyX1B>+TLBXVX^0j
z<#^5Xmi{|2p05WpKz(nu1z2vKQPoZb2?cT0Y!%>Ka^>Rj@S@>Dwi6&9_@Hw-f?SgV
zO?&5(n?yt-L_kaP$fX<zh9e6OvBmi+W6w>85*y78vYR_p3{Pp@e&nHinIgQ9rGY8{
zcNytAn{V?zmP|nS8Nlyi_y`#XnBywSSpgjCuh9@Yq4s%L1!Bb27?hmG*SazyF>~<}
z%?DH!ME<xqh=K2?eDmN#DiVeMnyycLD|T$hgScIXg?tQ5U1o}fhBfJV<Hst}IO>=X
zXP2>tMTiSkdj(IZK%6xJk(NX-Xpg2}k5n+3SjkPGtN&;>X+cEuH4<MvZNn2HmfW-S
zLoCyOQZj<!H(N3=GTJOzw<&1`96ns57^lo+%K*P6nu7%!j;3rL@Y8W)hqrC?k6(Y^
zLjb2oXR5&KVS><$PL&xCNQy82eEV-^A8Hw}!*7TXLlp96ifunv71J*effP>*TQeI;
z75A)-K|@vRO6$I1ym8-}0L9^BfvxZg_WOp_*lOb2-^oxX9d{@wYqb0Cy@rFxu;P>V
z?#|oFGAC+2yDp7cnO}&onmZmg+Ja`HjOw{ibAUne5-!&O-#d~kqK1d$dqYyzn&n($
zr0lr^Syn0ii3S)CFHAjLpg6O(t_E`bsC&>Xwq`E(eJ|wU58c*P#eTqhu}G?m94f7}
zH@q7UmX3=QPV`H4f^uo$xoA@IE7G?EQ(hDMsg8hpJa?RkGc*F{v<*$bcc`VhdQWlX
zUn7NEzq~~;Diha8hKjAwc_VJ=wFb;gSD~mjl_A?u3FdoPhiqg0?~lPMei1J)vJETi
zwz6yPgdHV0qnXKNk_vm<?OO9}EUmT19{vNvtg7^1b%?a>?ut0vb2j3haDVy6t0_<m
z%iH|R;{t+}`1uwCh-u^Z<P~cZ_d|QZUB*``CvS)QLn}3<HFlfeVyDg*mChnh%}ize
ziIY;l)AH>X$Kwmz{3ICqAzHI53a2xi?x1*X`nObpjlPqRgyFv{#3sVWYv{&gRejVm
zN0#qMrtS3N?v0u>VR1f50Y4vAaKluF18Vy=m-N#e;eS(EvVVdM0sfCT@1k%t{7{Lw
z6=K&`oFfHQgM_~ac&@(p5b8sx3RB5&iDD8dtj2|pC0sW*3wiXcAL6pK_~voX_GPU`
zy;W~fxN=2y582IXRgC;wV|j`9g0p)w1{if~!LN3rraU2pQ<6wd2fCeX+a`5{dxAO!
z002delH1>VKFjViF)x-^Frt-HWdBz-emY#=gg%5o;<l%#hgMlcV=zTtNOQ|JGovR>
z5TwWXSn1P$zX6LRb*$)>Kc`+ccFDNy1&kFi%NSJ=F4kF3i$O!(*n3=={nH<ny=MqR
zwt-#>9<Elb#ah7;VHjNq`lkIvHd$ls6zffez5iwMXwOR<7OL2jK5tfapU5-cXq4?=
zSfNY;muUUe-p3DaWwZP0*~_Z7X*f*LiaUIt#=$LeY-(SGdz5Fr!@7CHI)Ar5Rvz!P
zt)!g*6%)D#N*!$X^~0P(PhS+@rF`j2r*4^4S%U%}?}M+8!eM%cUHti<&P=qGbs|A2
z%9>1jFaq3|NVgJFhe=BdAB|PJ#}tz(DO2R**H;%J6jCEIDnyI%BI(0-oc27=vIn^d
zyzW4zKmzop?<sj?%Yx9e5>B=z9-2Rqt~skEmv=;(IbYh&qwX+^wsou+oiO6P)c{F_
z`})r<`3+?{qrq*O)UYu~IwJk{BFYZb$Z>)~4r0v1MI%6rT)}3<7NV`EL5S>rT`9mk
zvqSe+(>hxhz%4e)o9k;7Km9b-MV<<nUe4+PAML$^zBoXg!nEsyt%JR%#kz;&mZQXJ
zpE_KcbVfwtKm|&RPmf&mQqYzRSpN>;r^nNzR`3RR;%S=6@pxD&gXlr`Am+im)<*zh
zi!bUyOdW6FABDvdVywuHVab_z;Ow%4Ti8w#K5zg400I6ojljXmG$NUz+w<@N&%s~;
zzuV>aZQZne^}a)`gul}zfRu@_3p&(>?7WhW6Sz_*EO}@<XEjeUm|~$8I*pW)fD|uv
zfDf3RCu`~339=RFTwP_CjU5(&tCon_aQAoSmAas@QRyfy^NTU12R)19Z+~YxUQfT3
zxlp56jo8Mtjz4}!vO;qzPu1?lF82uVAtLfLYcXnXYlEkit~utz%gBU-Ou@v0SV(Tb
za6X?3dARF|Fkpoe-JNGlm=Po=#Cu-Gc#2~?WlXVSG@;UoaAw){vj*gkCpD^VFJZjM
zssHEC2ocJIi;}%47DzjNP&a{_2EC;XdBXqWI2*v8N3p2>i_p|HPyU4hkeQiw!`#0}
z53M&VDjo{poCeMmYM%ZiDm}l7I?=v)%E2B<Fdm)7$bFWLMz8y<K4G1rE-0dbV`HBd
zQLOfqd5Ys#P{F(~;@h{$(d!Yhy2+pe<O`;yBTMd?e*U*?Crapz8TA4Cn1-<wW(HFL
z(l4z!^tasrTUOK%*sOhRtdF&sGJftCQlPFac${<JW1r`z+xI6J1{Dij!&T!q2iuK6
z3at^TOQEwS$nI(-tmT)N+LYiO2vY1kum~uC00005Hz1Vs<DMO9g!D*IVrPUedELY<
zY8SJDFyw#&+mD!o)n49<Cd!8|HLz1j+~n?oEBY5x|J;9#i4vkre)oNI@L;Jwh0`Rr
zk~-^YK&oo8z8}%kq135|en`c{SK^x3&Ow=jZ-E|kiehZY-)??v%c2mMz~zH+rBwbD
z%xvqcNq6e%DoliX$oe?RaAbQUU?Q2?*$XQVeX;T>dHrY0(3PjVYR4HjlVs5NKBn=*
zS4HP%pU*~tWo0^5iiyG9nwMhdH2bms;6d#<%s|PHjk2dH8)(?=OwHtwC3>o2d%DZ4
zoZ^m|_Bf}Ag(d*H7s|Z~u{2d;A%N1l)Ko%z=Dj0|67kE#+dq!w&VKw**azF}Sd2Gw
zV5JlnD_E|%UjP6A01co;;65LLZ%ZYIb1;>q`ARZ)S#{uZOc;=0hd=W2w+!8a$u<k1
z$KS?5#p>-aJj~3Zjbf4|j-|BzHlw$*OLls<=?r|#yi^mc_uwS+Kdt~4r6B0%)Nfis
zy)4+P=wjKq(%Ep3@_?UcX71FpzImF&Ds)X~gKJDX`O4j;9#byxI2NI+?HXeLvAWvd
z4ZTss9Zb%G9RY{dB20+xvo^rL?DE}aWQu6uuAzhJ^iTn%%SuUaTFO!>L0KM%u+QUN
zF$=c?o*9>h8@23Xea%VbRsgvMP7e1!ZtwcJ#toW)$JfZa`cfId5l)NvL^*GO)%1a)
zQk#@mb=eO?VGb`_Bg{VKV1Mtc&c3EJTBdZ48*dA&N07k^Ti_cf5y=i$2@oQ{2edPQ
z4|Lo4<-S8LZOR+IH!m(P&Q4ZlzTi6RL*;)YUR;o!%KKH)BBsMvp*5^14W-RVr|<P(
z<9+qnqZ0%ceRQ1W7H>^1%xakN8Ugp(dE>Iy>}JK-6;#r<^Qm-r;=(5ECDOxJz&<T_
zIX)O)Ysu^Og3)?DWTlB~{UDQl$MRSmECEutFn<0!jdk$|O;d&8X!4|pruK#${2#sx
zk_TJTI>shL5_`Z*cy%(~qQatJF{s_8mvqmb7JfNy?=g0eXi%%A`aNnIqvh)gUIDg8
zP1nUSme(O2@zcSWeHA6`Bp+Q$c>GEInnBbr;!lWs|6+ZKQ6iT&+wauggIk>alz)7w
z5@vkM3RCuBR8uD3p_4#pD1#8L@l`tS7z5q_%br*bz3;FQpu_`KQ1JEDJx)de@wvVN
z5+)L#_>52)Q@^_gvm8*kn~vweYq!7)tFl)rx$Xr@AmfQS+zlg`e<$tm`FeN=to)!S
z3Nzsg6(3Q-`qp&at;@FLxAH5RHdmg*QbXI|E_2}!JhEXK@>h&~hD91w&lhOa$@v~A
z&l!v4U!|4$k6tQi1uRITG}}P8_k`S*PKPbPgel|-EsOln!!}fS>E`NyrZT<@U5pt8
zO1%LX(IJaRXS^OQE*3Ck`{XK;daz|NNAa@;sm6p*o$|93=0-{MqpUx}qD0>{$Ekv$
zcruvnVeB^q6D;XSZul}84|E|>js*sO;x0$96kq_Jka;<owWf4Z$@14GlLJbSLfie;
z_ST(2gnlc;Bt$~l5yaSwUaJr>Qe|!xk!msKZ^m_aGWERzy-85IgGA5r^nRVWh`c3+
zvyo*~D(%dq05x4H@~FM&|LKm*&UJg_9PMW^upYTHAfjq<hoq33BEw&|N`Xa2Z{Sp(
z7YXHSy@IyQAjffQ`wvS^katZ{CGmXrjgwC27H__Pw->Hjex!Cx7Hn%yC~mm^*GJt-
zRU;>p<@sZ9=8vyL)Hm~TVT+OPv)nG@6EWGh_IAQvW8nXZST1g7LEh$n6o*PBg5LA(
zam4%H)+B$`yaY&F)5w}d=g1L47_g6NlRuA&D{4;;RIsZ*xg}$~j@RL&w@Vh)`6s5T
zK#%b-#!iR0@`E8D<EQZhIfcdwzn2Z`FcO9e*UwaGIg|=>gckk0H>B~zbbgoj9Y?Jo
z^Axd?{iSKwNQ_T{k;}3MLrl}1$U7aX{{2gy9RT(6S{|3yB_r|_0ZYX<u(T$~Q63}b
zFk~(-lkjXKqB~5)3k&TR8x-m~TL0L}B$^6N2??dTMNhfR#UiYaP3Rb0hDP)M>*#S@
zQA`r12zsteNeed_t!&vvkuMZf=P8a_X?-a(*_q?`rUadZ=7LGJrFJXLaFFZL$~Dg9
zK++7OWMcw|nyq~ioR>yH_xSVrc|gbnd3h$^S_!?#B#>IOFmJBIC;ky6C=BY|j*r`W
zcx|aaULo>Z;Qn{x1n%bAcK$ijMhHqx)p-yX+P}bL$R>)*r2(@+93s=!)0apY_Z!|d
zSm6z2HGthLl6?9v54<*MFb!>4_=pe)PFx+!q5{p!xy&LUxngNl#^Ua<QZisrWBVH|
zdTM(i12q|yMx6!3cVA>QV5U$Fl1udgR+V3Z!+DKDMO$M|0RXe$wyU^o^vRN1<((bW
zAqLLC5j?T#5f87;fVZ<aQ!%hfphQL!vr-!z5i@8y(I2S{f687p?0#3bg`1lTWRp<7
z6AhRis6kC?P=FuYCg=L=)9`I1Abv5x$F5nNJEy>@9@Wag1e7mj7(nI=ecZ+eiW-42
z&sb*|y1IAY!yxFtxPTAv&$S)lP-RnCb#w&%0snqzXFKh-T{7&xGw|P4nJ13l!99vk
zv?y1+9X1>Vu!G-hcKx7tD;o7~_f*QleWT8y8H6`S*KzdM76Q_K4LR*?MWIlw3RYix
z{=l`u7Z3x9n9<)$v4z~aUx{ODaxI*X2cP0z5-yipwAmXo2y$dFUnjvP%YU@;)%ikP
z<=<ErT?#oM6(NOi9_+IctZ~bc%*q=VJ4U*XURjrjwssBTBr5jQ;XIOi+c*5XkHoVB
zpe||9)((~zqDLnx<#_|LE@CdY8k<#>2`XrR-MKs>Ze4q2a&dGSE*te(#qxBa3m@bW
zrB2*Y!(cRB)xtw|Jj0>EVs$Cd#8qU62%j^PdcbKT6$u)8-DEfEipytvf^#<JU}lH~
zq^Icg)US#%pI;VeZ|3B{b2}Y?s)q>Og7qFZWOCt`tyDU_=@~z^Pj#x0h-$FU7{nMT
zKEJyVRzGCkB(g>Bd=87wh1c8(e?DkcDt6mNz3yoZJ5XMDFBDaal;#v(;CqyW+*`Ci
zaSkgnPY5@LW$vN$jNvLpP=WM1HEB>i<`XhP7evB$JeLCMPr1p{3h?b-#;E7}{%UB&
zMsy@wLk;u@+fCua=w9%vAs(Cgbdr$~gpaJyfp@UR$^gRW9O6{VSf&3xnXxf^dFFN^
zHc;7`$;x(Qk&1|Sa$7KbkFIBv3MtXUbbJnbA@{l}h|hSjsJ9CV;7DyeWZ;$B#1U1`
zg(8Q($vAe)Hx#~ZfLelQ*)(~;>7DXS{?l^M+lGZ^^ARQEJynjJ>HX1M;{k!_XS!rf
zYd3*PhxTw?)Jf-Cw9~FJ3AvQbclDMj-}a-(Nt$%n232_ttMszJPW9dsPxD%X(h)mF
z1`Mi8-HmAdW_Q7lE^|Y8qaB)Nh2Oz(tf08W0~o+?qic1`W-hruH~oG5Nw@v_y67k8
z6m_@RGnV^9-H!cK+Ka0|Q_KTccd!zXHUtyqo+XHCa&8un>Q3N<`zr#J=PxWuVPbW)
zL=lgKWIr@ivVfR1S^vvurVJpv)P@txwkGJSD>@k;%;3~JO-#>B&U#e)kZ~L!lSt<)
zA`;r`6^AXHJPFx%rM?ylR)>p`2W!k#u3pk;92gm+^Rk{m@+Qydu*Qqk4V=h>7FeCm
zi{o8DW&B}p)}e^#qCDCVHPC402(KEOs~0wNRf9xd^DdF{-mrD$mDYuY1C>WNw9&U0
z(=-eJQw`a1PR3TzwLFO%WIER|JFqa<jl0(|cJql*$a&6;S<cyXgH&}$jcQ*agcXt<
z_41Q^F~tdBU)STGaV*;Qv+PrEgq)#+Z<Fo@3+WwkTW5G{Zd-v36?mQ-E+USxM<0tc
zh0Dj6hqfHd*w0ek!XwAw=b#LU>YiV3=_(vod&rGRICvLk5?=~`N4(wz+Nhu)A0)yC
z$sHQADLG*v+X~ptWqVzE@${vhM124mx&jZ!UN*jw!neQnKej%zW$rd{!<ZZ5DceKW
z@eH{@7Hfq|UR_O69p6Q))PfAA_{jV31x4=nafyjq>))GJr?hj#01pV3l+kWQa}5cP
zBV5=Nr;Sc?`18Bdl~3*Sy<$6#t2}B;H4lhT_O*j;8R8zQNTH1{do9YPe3JqNqvD_1
zD&W8l6Q`R#YM{bJxIZoI#8Jb)PGv4tIT@X9-8y(@vn6pny{1GC5}I;7r-3uA<G;$%
zFlI{DyD_;xQ7(~uPRc4rHyKLUp^52ZjpR}0`-kx=yv5LO>nL*}H0@D53kpBBtFet&
zUa;OdPn&2odHVT*N}XKPWStC~Ym(@pZN{Pe;e+%kYLqP{frXC|M#7{?<}ukicTTte
z2Q)CxejFWTzXvg7Mc{U*YllaLQ)TG`qH>h{PR8-4l2ygJze{C=JS3)6$#TcjzE@OY
z8VYA|@F+<LAf2iRI>^W@-)0EBQkD!73Uc5O@SRAgVR#K#8^mNIPWQ7DUW86Busu4S
zmd$VwA;C#GS(dQ>B_l-v1iwZ6G(a%elt5p>1!i+ddcL5)ME2&)D0A~fL`*Od!)!7n
zDU!o&*#^&WNTF7=)jr!&4%x@wRwNjcg?3^AM4U)eb7gj)9~j3XX=RWxB-W#%_G6D;
zG@mLKXPr$6wiZusctBupqbZnPyVsM4Z+>ZL{J>tT#ENRYVrM=KCJORFOQ_!18(HX?
z)qVbQrTqZ0ml97sC*D805<W5AOO{XKC6CuB=$y#G*#`(8U!sy|G)U#KE#H45(3fz>
zO{=*MHGCwBgS($pQi|)KIIZ}r3h2R`8n}41FNxsd(<LR&rVZe?HhmfdhfH9=x`Arf
zHJ^IDr55{eFKHZZ%)C_MoSU0KW%$SH48a;G?ChnQ*R}GApWoSPk4D5cr}FEvup!?V
zT;r;)Udp?j0h|e|yFMq)(~HTR2ENP1DJXY_`AmZ(0S$g72eF=jh*C7YZHEEh5r_hR
zg~UPQ3CFMAmj5@<B<8_GF#cwmUE)4Yr0(Vcj&0UedBEVMUj!<+KZwz~?XSspXYQ$$
zReV^fUn}uve^lr~i&VPzWFQG&%OV56ckV?q5{W_e-`sLnBl2@6A0hQLh7eA_h$yMU
zl2fu=Cui)G%s*LR99J$Wj-><yeTz*BTen){1>=CS=T!foOMqkMA~(HH=Jqw_+8*0z
zz$fv8Im%IBflh&FTSCnN(kCzl{~&qxVBk~;Er_X6;4o`cOH`Vxt6@*oyu+gOWNP*x
zd(y-ifi=6&<?>qw+3DFHU!{sV-3ONQpNRiTuM>yvKnFk*x(*qAbK%EcRHecvojJ#y
zqmD~qpiAxmc(B4g$Z`sscbdpK`&sMhd4p|1nQd0+&&SyDOmsa3sF9C7lUY<&gm^8>
zr$(A*Ui9~6-@jdG`(Eo=1WsPXK$e<8lh+->!g=GgmrHn=cvC|Nj<5`<DKJ&2wFD&C
zfhIk^GM$%bjaD+8aDVB?i~>wT)d|HuXf`SUE1cpN6tlYdC6$D#6(~GucAdc6>0Gko
zQy7H{FFpmNWJAx0g$N61#9~VYRHw^8SQ9FtIiTNXQ=fvZ%KS(l1(xeTrAs+%_&aGz
zJt;!*7p#5rWDC`pw=hNrADFIQifn^21p)-k&9~1^QC5=6VAwn+*}Ca=@P|ry(X3j5
zvMtR=G=5moOouKwCIH)o<QwPXgaGx&UxoQ%)6-9ge)V*Q@x=aH!KHqzY`MV-*MYBV
zQDAibG|_{^9Q7{P!Jj~5uUP;>bS4`r$`z4%;1ajGJ8AFa(q_X)kfB%)N(oA!rO-lZ
YLf0yuTfo)8T{8dx00000000000HWXQT>t<8

literal 0
HcmV?d00001

diff --git a/static/images/accessanalyzer/12.0/requirements/target/config/AIP_APP_Permissions.webp b/static/images/accessanalyzer/12.0/requirements/target/config/AIP_APP_Permissions.webp
new file mode 100644
index 0000000000000000000000000000000000000000..6b60a1e99192f1804c8723f8311a1699445141fa
GIT binary patch
literal 8126
zcmV;vA3@+!Nk&Gt9{>PXMM6+kP&go}9{>Q5egK^TDr*B`06uLrmq(-{BB3c08E}9N
ziDPd3W7!(y(Ep(F=lC`j@!VX)*!d~i=lvh3U-&+p-kbdc`G@_g^?CoB`;qQ1{Kra%
z`%nM=;UC!l&j0`S0R3bC|Lsfvx7hRikEHLQ2mTLG5B<G%{UZLG;5YIw>pziRYyJ=N
zU)TRCf4u+Y<!8;`-+c%ECH156AJ~7yf8O<T{s;8W8GY@4JNZHI3;5^pukIh%{~*0E
z|Azdd@T9Ll?tMXhdih`Zf9wCe|Kq&u|6csh{>$(e;NR1~#eQx7Ir{+qGyJFg_xEq!
z-|rs%|90@M`iJ@-_@Cas0DqBxQU7KB3;fUiuk-&%pR0ev{}ujA_aoWI<)7OB=zoOx
z1pZ0=8~vyEuk$~(A2xsez0H2ufB*MH{fPhiRYU`Rzu6M1aRJNOdayZZWk6ioApt};
zv(JkCSlhZLM$K)YUW8;(FiN%C(SM3CJAsI5hstu1V@Jrm(17YQnUf|4#Idj68GE*!
ze=TYGpj?U{X*k1v7MkSP!XF-j?gMJnq-m^Gsw*>3Ot|TaR8TM@DYhz*mE03yfu_;T
zQ^=TV!}~itD;9v=&!js_uLSEZ$!962sLNlQRVC}6Tg~{i-&$YZ54~iM$rK}_N!yrV
zr>&ua>+>wnZa>ZPHv5ka?{1mfqHv{6!d#EQQTk`Wr|6CNT#M&drACmDDH~0l4hkaX
z`}omarfX4=DVSI9)mM4NDs?vL*HHLrn8RYNj@v!KqGKhgNYhxWW3}_5V<o9b(^aw|
zef8hFb~r*!61Ax+#PmuF2Vf`59lPn^*Xu@XV`+%T$b*l-QTk`Ws0G*NWUs(c`e(tY
z1=r?eufS3IXTheZah=Uushc4WG){S=PFL}vIdzKRoS!WOpA8utqGDrye<p1bb=J<h
zbao}&QaWkByiZ%D>Po}1(&e05OyQ{h8Hn21V7dSUvS%K3bzYy-s6ow}U`tM#OvHCc
z_A(&Aol1+4<Y1Xj2#%UUvM(2@>YBP9<SwAh00_A^VHu=OB>n!PcSTkParr+jYEf`+
z2ibIdj!}K1(OsRjOZ6Znsds0D^2+2x9!&PU_TrEC=MMp-8a4aSQpHhUyL7dk`iO_h
zeVHpjv(Z{cZY1llI7Gm<pSTv|t`n{`ZmYeQ7R`1}d#zZphC~p}YH12XH<on^t@*-0
z_BlJ^^!6|3XNv1XUM2k9G#n7%u0({eevDZpy=bHEk}1nvm_$d<4g>fUIIX%Oc}vE)
zRdEetb}Zy8Z<P7rKnt(TvB)A6iW2J;`a7e_O83+7Xqd@vnJY#x)=Rt)W~g_=nUHAv
z%o-*#T9_^X0RHw6YRdPqizC{y2A#+rg0MEHe<5q4@Q5RpW20w3LOuo?FqtqQ6zt{r
z?c=A12S5EGVd*nkPhZ7MJe_ek46av@wCt4pQX|Ir<6#Q%>&+UsMZ~<5l8S_i2Fd`G
zRrJ@UC3T(qBFa(b4*Tp6cdqHheh@B6%$k0CB@1m1v70>|fZ$JPd_ZbU1l%Z}k_8u=
ztuPA!72zRnimy2Q2fiGL&O-T{IbDdYujPtxvs7!d_w%)26?VO#%D;-C!KnTuaSkF4
zuvkafRz+5t#aTa8%UYk=ZR@rE=a}%D1P_D4KCGdLhWtys%o(F-HhdGjaD!wqXz~01
zoe)}PvZ?x_Io8>!ZdRg=WXuAQn^YiC9t#)9kwlb1`fy#!zJlC@!^^c9Gyb3us4Gas
z-iI}#S!VmefRWv`CsB=-DFVTwuz!tKp+O8q8QDhpp5M6oly-w-WmSIg$n)OrE2v)2
zB}5c=PrY?!Ec<o3gQzcPiyqYSisQSk^fxdDTiFljd`!`Ss}@r$E;0sMM91O^zq7$t
zF0bT%zKs?tw_w4>47|gNh1WJVHh^#DY+CP9t+;|(ySN0K`XDRY$6$0vXD2faB*R)N
zRL?x=<RewT$5&_hTQ!LRso!uEIFEuYqSK1JA$x7u_b$;+8SI?SwG8n%1yNViKh@nA
z>45u!?Q<EXCh#&*<N*5Q6+%eMlA|w{qzF@G&vd6s&$Bpq(cH%AvYe+OB*vzBiAiwg
z1(Dj38s)cN;_>ns>P`Hn7)+Zocncc8rV@>garxqSp+33xDBya%p;&QZhu0d^D@^vs
z;qUG2WsJq-m($@Sn@(r;+TaNuKO|q5QDd8Fm4=Y6gff|zX0TUoyX1B>+TLBXVX^0j
z<#^5Xmi{|2p05WpKz(nu1z2vKQPoZb2?cT0Y!%>Ka^>Rj@S@>Dwi6&9_@Hw-f?SgV
zO?&5(n?yt-L_kaP$fX<zh9e6OvBmi+W6w>85*y78vYR_p3{Pp@e&nHinIgQ9rGY8{
zcNytAn{V?zmP|nS8Nlyi_y`#XnBywSSpgjCuh9@Yq4s%L1!Bb27?hmG*SazyF>~<}
z%?DH!ME<xqh=K2?eDmN#DiVeMnyycLD|T$hgScIXg?tQ5U1o}fhBfJV<Hst}IO>=X
zXP2>tMTiSkdj(IZK%6xJk(NX-Xpg2}k5n+3SjkPGtN&;>X+cEuH4<MvZNn2HmfW-S
zLoCyOQZj<!H(N3=GTJOzw<&1`96ns57^lo+%K*P6nu7%!j;3rL@Y8W)hqrC?k6(Y^
zLjb2oXR5&KVS><$PL&xCNQy82eEV-^A8Hw}!*7TXLlp96ifunv71J*effP>*TQeI;
z75A)-K|@vRO6$I1ym8-}0L9^BfvxZg_WOp_*lOb2-^oxX9d{@wYqb0Cy@rFxu;P>V
z?#|oFGAC+2yDp7cnO}&onmZmg+Ja`HjOw{ibAUne5-!&O-#d~kqK1d$dqYyzn&n($
zr0lr^Syn0ii3S)CFHAjLpg6O(t_E`bsC&>Xwq`E(eJ|wU58c*P#eTqhu}G?m94f7}
zH@q7UmX3=QPV`H4f^uo$xoA@IE7G?EQ(hDMsg8hpJa?RkGc*F{v<*$bcc`VhdQWlX
zUn7NEzq~~;Diha8hKjAwc_VJ=wFb;gSD~mjl_A?u3FdoPhiqg0?~lPMei1J)vJETi
zwz6yPgdHV0qnXKNk_vm<?OO9}EUmT19{vNvtg7^1b%?a>?ut0vb2j3haDVy6t0_<m
z%iH|R;{t+}`1uwCh-u^Z<P~cZ_d|QZUB*``CvS)QLn}3<HFlfeVyDg*mChnh%}ize
ziIY;l)AH>X$Kwmz{3ICqAzHI53a2xi?x1*X`nObpjlPqRgyFv{#3sVWYv{&gRejVm
zN0#qMrtS3N?v0u>VR1f50Y4vAaKluF18Vy=m-N#e;eS(EvVVdM0sfCT@1k%t{7{Lw
z6=K&`oFfHQgM_~ac&@(p5b8sx3RB5&iDD8dtj2|pC0sW*3wiXcAL6pK_~voX_GPU`
zy;W~fxN=2y582IXRgC;wV|j`9g0p)w1{if~!LN3rraU2pQ<6wd2fCeX+a`5{dxAO!
z002delH1>VKFjViF)x-^Frt-HWdBz-emY#=gg%5o;<l%#hgMlcV=zTtNOQ|JGovR>
z5TwWXSn1P$zX6LRb*$)>Kc`+ccFDNy1&kFi%NSJ=F4kF3i$O!(*n3=={nH<ny=MqR
zwt-#>9<Elb#ah7;VHjNq`lkIvHd$ls6zffez5iwMXwOR<7OL2jK5tfapU5-cXq4?=
zSfNY;muUUe-p3DaWwZP0*~_Z7X*f*LiaUIt#=$LeY-(SGdz5Fr!@7CHI)Ar5Rvz!P
zt)!g*6%)D#N*!$X^~0P(PhS+@rF`j2r*4^4S%U%}?}M+8!eM%cUHti<&P=qGbs|A2
z%9>1jFaq3|NVgJFhe=BdAB|PJ#}tz(DO2R**H;%J6jCEIDnyI%BI(0-oc27=vIn^d
zyzW4zKmzop?<sj?%Yx9e5>B=z9-2Rqt~skEmv=;(IbYh&qwX+^wsou+oiO6P)c{F_
z`})r<`3+?{qrq*O)UYu~IwJk{BFYZb$Z>)~4r0v1MI%6rT)}3<7NV`EL5S>rT`9mk
zvqSe+(>hxhz%4e)o9k;7Km9b-MV<<nUe4+PAML$^zBoXg!nEsyt%JR%#kz;&mZQXJ
zpE_KcbVfwtKm|&RPmf&mQqYzRSpN>;r^nNzR`3RR;%S=6@pxD&gXlr`Am+im)<*zh
zi!bUyOdW6FABDvdVywuHVab_z;Ow%4Ti8w#K5zg400I6ojljXmG$NUz+w<@N&%s~;
zzuV>aZQZne^}a)`gul}zfRu@_3p&(>?7WhW6Sz_*EO}@<XEjeUm|~$8I*pW)fD|uv
zfDf3RCu`~339=RFTwP_CjU5(&tCon_aQAoSmAas@QRyfy^NTU12R)19Z+~YxUQfT3
zxlp56jo8Mtjz4}!vO;qzPu1?lF82uVAtLfLYcXnXYlEkit~utz%gBU-Ou@v0SV(Tb
za6X?3dARF|Fkpoe-JNGlm=Po=#Cu-Gc#2~?WlXVSG@;UoaAw){vj*gkCpD^VFJZjM
zssHEC2ocJIi;}%47DzjNP&a{_2EC;XdBXqWI2*v8N3p2>i_p|HPyU4hkeQiw!`#0}
z53M&VDjo{poCeMmYM%ZiDm}l7I?=v)%E2B<Fdm)7$bFWLMz8y<K4G1rE-0dbV`HBd
zQLOfqd5Ys#P{F(~;@h{$(d!Yhy2+pe<O`;yBTMd?e*U*?Crapz8TA4Cn1-<wW(HFL
z(l4z!^tasrTUOK%*sOhRtdF&sGJftCQlPFac${<JW1r`z+xI6J1{Dij!&T!q2iuK6
z3at^TOQEwS$nI(-tmT)N+LYiO2vY1kum~uC00005Hz1Vs<DMO9g!D*IVrPUedELY<
zY8SJDFyw#&+mD!o)n49<Cd!8|HLz1j+~n?oEBY5x|J;9#i4vkre)oNI@L;Jwh0`Rr
zk~-^YK&oo8z8}%kq135|en`c{SK^x3&Ow=jZ-E|kiehZY-)??v%c2mMz~zH+rBwbD
z%xvqcNq6e%DoliX$oe?RaAbQUU?Q2?*$XQVeX;T>dHrY0(3PjVYR4HjlVs5NKBn=*
zS4HP%pU*~tWo0^5iiyG9nwMhdH2bms;6d#<%s|PHjk2dH8)(?=OwHtwC3>o2d%DZ4
zoZ^m|_Bf}Ag(d*H7s|Z~u{2d;A%N1l)Ko%z=Dj0|67kE#+dq!w&VKw**azF}Sd2Gw
zV5JlnD_E|%UjP6A01co;;65LLZ%ZYIb1;>q`ARZ)S#{uZOc;=0hd=W2w+!8a$u<k1
z$KS?5#p>-aJj~3Zjbf4|j-|BzHlw$*OLls<=?r|#yi^mc_uwS+Kdt~4r6B0%)Nfis
zy)4+P=wjKq(%Ep3@_?UcX71FpzImF&Ds)X~gKJDX`O4j;9#byxI2NI+?HXeLvAWvd
z4ZTss9Zb%G9RY{dB20+xvo^rL?DE}aWQu6uuAzhJ^iTn%%SuUaTFO!>L0KM%u+QUN
zF$=c?o*9>h8@23Xea%VbRsgvMP7e1!ZtwcJ#toW)$JfZa`cfId5l)NvL^*GO)%1a)
zQk#@mb=eO?VGb`_Bg{VKV1Mtc&c3EJTBdZ48*dA&N07k^Ti_cf5y=i$2@oQ{2edPQ
z4|Lo4<-S8LZOR+IH!m(P&Q4ZlzTi6RL*;)YUR;o!%KKH)BBsMvp*5^14W-RVr|<P(
z<9+qnqZ0%ceRQ1W7H>^1%xakN8Ugp(dE>Iy>}JK-6;#r<^Qm-r;=(5ECDOxJz&<T_
zIX)O)Ysu^Og3)?DWTlB~{UDQl$MRSmECEutFn<0!jdk$|O;d&8X!4|pruK#${2#sx
zk_TJTI>shL5_`Z*cy%(~qQatJF{s_8mvqmb7JfNy?=g0eXi%%A`aNnIqvh)gUIDg8
zP1nUSme(O2@zcSWeHA6`Bp+Q$c>GEInnBbr;!lWs|6+ZKQ6iT&+wauggIk>alz)7w
z5@vkM3RCuBR8uD3p_4#pD1#8L@l`tS7z5q_%br*bz3;FQpu_`KQ1JEDJx)de@wvVN
z5+)L#_>52)Q@^_gvm8*kn~vweYq!7)tFl)rx$Xr@AmfQS+zlg`e<$tm`FeN=to)!S
z3Nzsg6(3Q-`qp&at;@FLxAH5RHdmg*QbXI|E_2}!JhEXK@>h&~hD91w&lhOa$@v~A
z&l!v4U!|4$k6tQi1uRITG}}P8_k`S*PKPbPgel|-EsOln!!}fS>E`NyrZT<@U5pt8
zO1%LX(IJaRXS^OQE*3Ck`{XK;daz|NNAa@;sm6p*o$|93=0-{MqpUx}qD0>{$Ekv$
zcruvnVeB^q6D;XSZul}84|E|>js*sO;x0$96kq_Jka;<owWf4Z$@14GlLJbSLfie;
z_ST(2gnlc;Bt$~l5yaSwUaJr>Qe|!xk!msKZ^m_aGWERzy-85IgGA5r^nRVWh`c3+
zvyo*~D(%dq05x4H@~FM&|LKm*&UJg_9PMW^upYTHAfjq<hoq33BEw&|N`Xa2Z{Sp(
z7YXHSy@IyQAjffQ`wvS^katZ{CGmXrjgwC27H__Pw->Hjex!Cx7Hn%yC~mm^*GJt-
zRU;>p<@sZ9=8vyL)Hm~TVT+OPv)nG@6EWGh_IAQvW8nXZST1g7LEh$n6o*PBg5LA(
zam4%H)+B$`yaY&F)5w}d=g1L47_g6NlRuA&D{4;;RIsZ*xg}$~j@RL&w@Vh)`6s5T
zK#%b-#!iR0@`E8D<EQZhIfcdwzn2Z`FcO9e*UwaGIg|=>gckk0H>B~zbbgoj9Y?Jo
z^Axd?{iSKwNQ_T{k;}3MLrl}1$U7aX{{2gy9RT(6S{|3yB_r|_0ZYX<u(T$~Q63}b
zFk~(-lkjXKqB~5)3k&TR8x-m~TL0L}B$^6N2??dTMNhfR#UiYaP3Rb0hDP)M>*#S@
zQA`r12zsteNeed_t!&vvkuMZf=P8a_X?-a(*_q?`rUadZ=7LGJrFJXLaFFZL$~Dg9
zK++7OWMcw|nyq~ioR>yH_xSVrc|gbnd3h$^S_!?#B#>IOFmJBIC;ky6C=BY|j*r`W
zcx|aaULo>Z;Qn{x1n%bAcK$ijMhHqx)p-yX+P}bL$R>)*r2(@+93s=!)0apY_Z!|d
zSm6z2HGthLl6?9v54<*MFb!>4_=pe)PFx+!q5{p!xy&LUxngNl#^Ua<QZisrWBVH|
zdTM(i12q|yMx6!3cVA>QV5U$Fl1udgR+V3Z!+DKDMO$M|0RXe$wyU^o^vRN1<((bW
zAqLLC5j?T#5f87;fVZ<aQ!%hfphQL!vr-!z5i@8y(I2S{f687p?0#3bg`1lTWRp<7
z6AhRis6kC?P=FuYCg=L=)9`I1Abv5x$F5nNJEy>@9@Wag1e7mj7(nI=ecZ+eiW-42
z&sb*|y1IAY!yxFtxPTAv&$S)lP-RnCb#w&%0snqzXFKh-T{7&xGw|P4nJ13l!99vk
zv?y1+9X1>Vu!G-hcKx7tD;o7~_f*QleWT8y8H6`S*KzdM76Q_K4LR*?MWIlw3RYix
z{=l`u7Z3x9n9<)$v4z~aUx{ODaxI*X2cP0z5-yipwAmXo2y$dFUnjvP%YU@;)%ikP
z<=<ErT?#oM6(NOi9_+IctZ~bc%*q=VJ4U*XURjrjwssBTBr5jQ;XIOi+c*5XkHoVB
zpe||9)((~zqDLnx<#_|LE@CdY8k<#>2`XrR-MKs>Ze4q2a&dGSE*te(#qxBa3m@bW
zrB2*Y!(cRB)xtw|Jj0>EVs$Cd#8qU62%j^PdcbKT6$u)8-DEfEipytvf^#<JU}lH~
zq^Icg)US#%pI;VeZ|3B{b2}Y?s)q>Og7qFZWOCt`tyDU_=@~z^Pj#x0h-$FU7{nMT
zKEJyVRzGCkB(g>Bd=87wh1c8(e?DkcDt6mNz3yoZJ5XMDFBDaal;#v(;CqyW+*`Ci
zaSkgnPY5@LW$vN$jNvLpP=WM1HEB>i<`XhP7evB$JeLCMPr1p{3h?b-#;E7}{%UB&
zMsy@wLk;u@+fCua=w9%vAs(Cgbdr$~gpaJyfp@UR$^gRW9O6{VSf&3xnXxf^dFFN^
zHc;7`$;x(Qk&1|Sa$7KbkFIBv3MtXUbbJnbA@{l}h|hSjsJ9CV;7DyeWZ;$B#1U1`
zg(8Q($vAe)Hx#~ZfLelQ*)(~;>7DXS{?l^M+lGZ^^ARQEJynjJ>HX1M;{k!_XS!rf
zYd3*PhxTw?)Jf-Cw9~FJ3AvQbclDMj-}a-(Nt$%n232_ttMszJPW9dsPxD%X(h)mF
z1`Mi8-HmAdW_Q7lE^|Y8qaB)Nh2Oz(tf08W0~o+?qic1`W-hruH~oG5Nw@v_y67k8
z6m_@RGnV^9-H!cK+Ka0|Q_KTccd!zXHUtyqo+XHCa&8un>Q3N<`zr#J=PxWuVPbW)
zL=lgKWIr@ivVfR1S^vvurVJpv)P@txwkGJSD>@k;%;3~JO-#>B&U#e)kZ~L!lSt<)
zA`;r`6^AXHJPFx%rM?ylR)>p`2W!k#u3pk;92gm+^Rk{m@+Qydu*Qqk4V=h>7FeCm
zi{o8DW&B}p)}e^#qCDCVHPC402(KEOs~0wNRf9xd^DdF{-mrD$mDYuY1C>WNw9&U0
z(=-eJQw`a1PR3TzwLFO%WIER|JFqa<jl0(|cJql*$a&6;S<cyXgH&}$jcQ*agcXt<
z_41Q^F~tdBU)STGaV*;Qv+PrEgq)#+Z<Fo@3+WwkTW5G{Zd-v36?mQ-E+USxM<0tc
zh0Dj6hqfHd*w0ek!XwAw=b#LU>YiV3=_(vod&rGRICvLk5?=~`N4(wz+Nhu)A0)yC
z$sHQADLG*v+X~ptWqVzE@${vhM124mx&jZ!UN*jw!neQnKej%zW$rd{!<ZZ5DceKW
z@eH{@7Hfq|UR_O69p6Q))PfAA_{jV31x4=nafyjq>))GJr?hj#01pV3l+kWQa}5cP
zBV5=Nr;Sc?`18Bdl~3*Sy<$6#t2}B;H4lhT_O*j;8R8zQNTH1{do9YPe3JqNqvD_1
zD&W8l6Q`R#YM{bJxIZoI#8Jb)PGv4tIT@X9-8y(@vn6pny{1GC5}I;7r-3uA<G;$%
zFlI{DyD_;xQ7(~uPRc4rHyKLUp^52ZjpR}0`-kx=yv5LO>nL*}H0@D53kpBBtFet&
zUa;OdPn&2odHVT*N}XKPWStC~Ym(@pZN{Pe;e+%kYLqP{frXC|M#7{?<}ukicTTte
z2Q)CxejFWTzXvg7Mc{U*YllaLQ)TG`qH>h{PR8-4l2ygJze{C=JS3)6$#TcjzE@OY
z8VYA|@F+<LAf2iRI>^W@-)0EBQkD!73Uc5O@SRAgVR#K#8^mNIPWQ7DUW86Busu4S
zmd$VwA;C#GS(dQ>B_l-v1iwZ6G(a%elt5p>1!i+ddcL5)ME2&)D0A~fL`*Od!)!7n
zDU!o&*#^&WNTF7=)jr!&4%x@wRwNjcg?3^AM4U)eb7gj)9~j3XX=RWxB-W#%_G6D;
zG@mLKXPr$6wiZusctBupqbZnPyVsM4Z+>ZL{J>tT#ENRYVrM=KCJORFOQ_!18(HX?
z)qVbQrTqZ0ml97sC*D805<W5AOO{XKC6CuB=$y#G*#`(8U!sy|G)U#KE#H45(3fz>
zO{=*MHGCwBgS($pQi|)KIIZ}r3h2R`8n}41FNxsd(<LR&rVZe?HhmfdhfH9=x`Arf
zHJ^IDr55{eFKHZZ%)C_MoSU0KW%$SH48a;G?ChnQ*R}GApWoSPk4D5cr}FEvup!?V
zT;r;)Udp?j0h|e|yFMq)(~HTR2ENP1DJXY_`AmZ(0S$g72eF=jh*C7YZHEEh5r_hR
zg~UPQ3CFMAmj5@<B<8_GF#cwmUE)4Yr0(Vcj&0UedBEVMUj!<+KZwz~?XSspXYQ$$
zReV^fUn}uve^lr~i&VPzWFQG&%OV56ckV?q5{W_e-`sLnBl2@6A0hQLh7eA_h$yMU
zl2fu=Cui)G%s*LR99J$Wj-><yeTz*BTen){1>=CS=T!foOMqkMA~(HH=Jqw_+8*0z
zz$fv8Im%IBflh&FTSCnN(kCzl{~&qxVBk~;Er_X6;4o`cOH`Vxt6@*oyu+gOWNP*x
zd(y-ifi=6&<?>qw+3DFHU!{sV-3ONQpNRiTuM>yvKnFk*x(*qAbK%EcRHecvojJ#y
zqmD~qpiAxmc(B4g$Z`sscbdpK`&sMhd4p|1nQd0+&&SyDOmsa3sF9C7lUY<&gm^8>
zr$(A*Ui9~6-@jdG`(Eo=1WsPXK$e<8lh+->!g=GgmrHn=cvC|Nj<5`<DKJ&2wFD&C
zfhIk^GM$%bjaD+8aDVB?i~>wT)d|HuXf`SUE1cpN6tlYdC6$D#6(~GucAdc6>0Gko
zQy7H{FFpmNWJAx0g$N61#9~VYRHw^8SQ9FtIiTNXQ=fvZ%KS(l1(xeTrAs+%_&aGz
zJt;!*7p#5rWDC`pw=hNrADFIQifn^21p)-k&9~1^QC5=6VAwn+*}Ca=@P|ry(X3j5
zvMtR=G=5moOouKwCIH)o<QwPXgaGx&UxoQ%)6-9ge)V*Q@x=aH!KHqzY`MV-*MYBV
zQDAibG|_{^9Q7{P!Jj~5uUP;>bS4`r$`z4%;1ajGJ8AFa(q_X)kfB%)N(oA!rO-lZ
YLf0yuTfo)8T{8dx00000000000HWXQT>t<8

literal 0
HcmV?d00001


From 615d6b820f508bb488a2137e4e64454f91f46329 Mon Sep 17 00:00:00 2001
From: Brandon West <Brandon.West@Netwrix.com>
Date: Fri, 16 Jan 2026 17:08:42 -0500
Subject: [PATCH 4/4] fixed broken image link

---
 .../filesystem/filesystems/azureinformationprotection.md        | 2 +-
 .../filesystem/filesystems/azureinformationprotection.md        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md
index bb25eaea2e..912b3c7dde 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md
@@ -91,7 +91,7 @@ Read the System Requirements and Install Instructions provided by Microsoft to c
    3. Select the **Microsoft Graph API** permission set > Application permissions
    4. Add the “InformationProtectionPolicy.Read.All” permission
 
-![Azure App Permissions](/images/accessanalyzer/11.6/requirements/target/config/AIP_APP_Permissions.webp)
+![Azure App Permissions](/static/images/accessanalyzer/11.6/requirements/target/config/AIP_APP_Permissions.webp)
 
 5. After adding the required API permission, select “Grant admin consent”
 6. Record the AppID (from the Overview Page) and the tenantID with the secret value
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md
index 2f0ffb055d..75c0954c6c 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md
@@ -91,7 +91,7 @@ Read the System Requirements and Install Instructions provided by Microsoft to c
    3. Select the **Microsoft Graph API** permission set > Application permissions
    4. Add the “InformationProtectionPolicy.Read.All” permission
 
-   ![Azure App Permissions](/images/accessanalyzer/12.0/requirements/target/config/AIP_APP_Permissions.webp)
+![Azure App Permissions](/static/images/accessanalyzer/12.0/requirements/target/config/AIP_APP_Permissions.webp)
 
 5. After adding the required API permission, select “Grant admin consent”
 6. Record the AppID (from the Overview Page) and the tenantID with the secret value