Hello Mike, it gives up immense pleasure when we see such deep insightful feedback on our videos. Thank you so much for giving us your time and watching our content. Let me help you understand couple of things. When you create DCR just to capture logs, which in our case windows performance and events, then the data ingestion happens to Events table in the log analytics workspace. However, when you talk about Monitoring coverage, there is a default DCR which is created and it has a different mapping altogether for data ingestion, in this scenario the data ingestion takes place in the table named as "InsightsMetrics". Similarly, when you create a DCR from sentinel console the data will be ingested to "SecurityEvents" table. The behavior of DCR and data ingestion is completely different for all the services. As the video suggests, advanced logging for windows, which means you are capturing data which is not related to performance. I hope this helps. However, there are still three videos pending, I will try to showcase this. Here are some references for data flow section for all the three scenarios. If you get some time, please watch our DCR structure video as well, which we will be releasing this weekend. Data flow for event table (DCR created directly) "dataFlows": [ { "streams": [ "Microsoft-Perf" ], "destinations": [ "la-257108454" ] }, { "streams": [ "Microsoft-Event" ], "destinations": [ "la-129300856" ] } ], Data flow for DCR created from Monitoring settings blade. "dataFlows": [ { "streams": [ "Microsoft-InsightsMetrics" ], "destinations": [ "VMInsightsPerf-Logs-Dest" ] } ] Data flow for DCR created from sentinel console. "dataFlows": [ { "streams": [ "Microsoft-SecurityEvent" ], "destinations": [ "DataCollectionEvent" ] } ], Thank you once again, for watching our content so closely, much appreciated.

Thanks for watching!

Refesh token is identity specific, however PRT is binded to each device.

@@ConceptsWork: Perfect.. thanks for your quick answer. love your videos. you way to explain is excellent. I will join again to the community you are very very good.

Glad it was helpful! Microsoft has confirmed this as by design, based on a vulnerability we reported.

Thanks for watching our content.

Thanks 😄

Glad it was helpful!

Glad it was helpful!

Thanks for the request we will create one.

This video is created while using older endpoints, where the scope was not required.

Thank you :-)

Can you please share some more details on this.