docs(accessanalyzer): note effective permissions limitation for AD trusts

docs/accessanalyzer/2601/connectors/activedirectory.md

@@ -43,6 +43,10 @@ Open the following ports on all domain controllers you want to scan:
 | 135–139 | TCP | RPC |
 | 49152–65535 | TCP | RPC dynamic ports |
 
+## Limitations
+
+Effective permission calculations that rely on a trust relationship between domains or forests aren't always fully accurate. When a group contains members from a trusted domain in another forest, Access Analyzer can't guarantee the same accuracy for that group's membership and effective access as it can within a single domain.
+
 ## Next steps
 
 Once requirements are met, see [Set Up Active Directory Source Group](../gettingstarted/active-directory/set-up-source-group.md) to configure your first scan.

docs/accessanalyzer/2601/overview/keyconcepts.md

@@ -87,6 +87,10 @@ For a full list of execution statuses and how they affect other operations, see
 
 Access Analyzer maps identities to entitlements to show effective permissions and identify overly permissive access.
 
+:::note
+Effective permission calculations that depend on a trust relationship between Active Directory domains or forests aren't always fully accurate. Access Analyzer can't guarantee the same accuracy for group membership and effective access across a trust relationship as it can within a single domain.
+:::
+
 ## Sensitive Data Patterns
 
 A **pattern** is a detection rule used during sensitive data scans. Patterns match file content against regular expressions or classification models. Built-in patterns cover:

docs/auditor/10.9/admin/monitoringplans/azurefiles.md

@@ -22,8 +22,8 @@ Create monitoring plans for Azure Files to track file and folder changes across
 1. In the **Netwrix Auditor**, go to **Home > Monitoring Plans > + Add Plan**
 2. Select **Azure Files**
 3. Configure:
- - [Audit database (SQL)](/docs/auditor/10_8/admin/settings/auditdatabase)
- - [Notifications (SMTP or Exchange Online)](/docs/auditor/10_8/admin/settings/notifications)
+ - [Audit database (SQL)](/docs/auditor/10.9/admin/settings/auditdatabase)
+ - [Notifications (SMTP or Exchange Online)](/docs/auditor/10.9/admin/settings/notifications)
  - Plan name and description
  - Select **Add item now**
 
@@ -49,32 +49,32 @@ Create monitoring plans for Azure Files to track file and folder changes across
 
    - **Read Access (Success/Fail)** → Track file reads and unauthorized read attempts
      - **Successful** - Show successful attempts to read files
-     - **Failed** - Use this option to track suspicious activity. Helps find out who was trying to access your private data without proper justification.Enabling this option on public shares will result in a high number of events generated on Azure Files and the amount of data written to the Long-Term Archive
+     - **Failed** - Use this option to detect unauthorized attempts to read your data. Enabling this option on public shares generates a high volume of events on Azure Files and increases the amount of data written to the Long-Term Archive
 
 **Note:** Enabling read access auditing on public shares may generate high event volume
 
 **Tip:** Only enable read auditing where compliance requires it (e.g., HR, Finance)
 
-4. Add exclusions → e.g., service accounts that produce excessive logs
-
-- **Monitored object types** - Select from:
+4. **Monitored object types** - Select from:
  - Files
  - Folders
  - Shares
-- **Monitored actions** - Configure which file operations to track
+5. **Monitored actions** - Configure which file operations to track
+6. **Collect data for state-in-time reports** – Enable this option to have Netwrix Auditor store periodic snapshots of your Azure Files permissions. State-in-Time reports, including permission and effective access reports, require these snapshots. See [Configuring State-in-Time Data Collection for Azure Files](/docs/auditor/10.9/configuration/azurefiles/stateintime.md) for the snapshot schedule, historical snapshot import, and optional Active Directory integration for on-premises accounts and groups.
+7. Click **Save**
+
+### Step 4: Configure Exclusions (optional)
 
-### Step 5: Test Connection
+What you can exclude depends on the monitored item type:
 
-Click **Test Connection** to verify:
-- Microsoft Entra ID authentication
-- Storage account access
-- Audit log collection
+- **Azure Subscription items** – On the item's **Scope** tab, exclude specific **storage accounts** by name so Netwrix Auditor skips them entirely for this subscription.
+- **Azure Storage Account items** – On the item's **Scope** tab, use the **Omit List** to exclude specific shares, folders, or files (Universal Naming Convention (UNC) paths). Choose **All** to exclude an object from all data collection, or **SiT** to exclude it from State-in-Time snapshots only. See [Configuring the monitoring scope (omit lists)](/docs/auditor/10.9/configuration/azurefiles/stateintime.md#configuring-the-monitoring-scope-omit-lists) for details.
 
 ## Next Steps
 
 After creating the monitoring plan:
 1. **Verify data collection** is working
-2. **[Configure reports](/docs/auditor/10_8/admin/reports/overview)** as needed
-3. **[Set up alerts](/docs/auditor/10_8/admin/alertsettings/create/)** for important events
+2. **[Configure reports](/docs/auditor/10.9/admin/reports/overview)** as needed
+3. **[Set up alerts](/docs/auditor/10.9/admin/alertsettings/create/)** for important events
 
 For configuration requirements, see [Azure Files Configuration](/docs/auditor/10.9/configuration/azurefiles/overview.md)