[pull] master from DataDog:master

.vscode/markdoc.code-snippets

@@ -235,5 +235,64 @@
             "{% /agent-only %}"
         ],
         "description": "Markdoc agent-only block for content intended for AI agents"
+    },
+
+    "Line break": {
+        "scope": "markdoc",
+        "prefix": ";;br",
+        "body": "{% br /%}",
+        "description": "Markdoc line break (self-closing)"
+    },
+
+    "Non-breaking space": {
+        "scope": "markdoc",
+        "prefix": ";;nbsp",
+        "body": "{% nbsp /%}",
+        "description": "Markdoc non-breaking space (self-closing)"
+    },
+
+    "Icon": {
+        "scope": "markdoc",
+        "prefix": ";;icon",
+        "body": "{% icon name=\"${1:icon-name}\" /%}",
+        "description": "Markdoc icon tag (self-closing) with a required name attribute"
+    },
+
+    "Keyboard key": {
+        "scope": "markdoc",
+        "prefix": ";;kbd",
+        "body": "{% kbd %}${1:Ctrl+C}{% /kbd %}",
+        "description": "Markdoc kbd tag for styling keyboard shortcuts"
+    },
+
+    "What's next": {
+        "scope": "markdoc",
+        "prefix": ";;whatsnext",
+        "body": [
+            "{% whatsnext desc=\"${1:Additional helpful documentation:}\" %}",
+            "{% nextlink href=\"${2:/path/to/page}\" %}${3:Link text}{% /nextlink %}",
+            "{% nextlink href=\"${4:/path/to/page}\" %}${5:Link text}{% /nextlink %}",
+            "{% /whatsnext %}"
+        ],
+        "description": "Markdoc whatsnext block with nextlink children"
+    },
+
+    "Glossary tooltip": {
+        "scope": "markdoc",
+        "prefix": ";;glossary-tooltip",
+        "body": "{% glossary-tooltip term=\"${1:term-id}\" /%}",
+        "description": "Markdoc glossary-tooltip that renders a term with its definition on hover"
+    },
+
+    "Card grid": {
+        "scope": "markdoc",
+        "prefix": ";;card-grid",
+        "body": [
+            "{% card-grid card_width=${1:300} %}",
+            "{% image-card href=\"${2:/path/to/page}\" src=\"${3:path/to/image.png}\" alt=\"${4:Alt text}\" title=\"${5:Card title}\" /%}",
+            "{% image-card href=\"${6:/path/to/page}\" src=\"${7:path/to/image.png}\" alt=\"${8:Alt text}\" title=\"${9:Card title}\" /%}",
+            "{% /card-grid %}"
+        ],
+        "description": "Markdoc card-grid with image-card children"
     }
 }

hugo/config/_default/menus/main.en.yaml

@@ -3317,6 +3317,11 @@ menu:
       parent: containers
       identifier: containers_autoscaling
       weight: 2
+    - name: Manifest Reference
+      url: containers/autoscaling/manifest
+      parent: containers_autoscaling
+      identifier: containers_autoscaling_manifest
+      weight: 200
     - name: Cluster
       url: containers/autoscaling/cluster
       parent: containers_autoscaling
@@ -7800,6 +7805,11 @@ menu:
       parent: security_platform
       identifier: security_assignee_management
       weight: 11
+    - name: Severity Adjustment
+      url: security/manual_severity_adjustment
+      parent: security_platform
+      identifier: security_manual_severity_adjustment
+      weight: 12
     - name: Research Feed
       url: security/research_feed
       parent: security_platform

hugo/content/en/account_management/org_settings/cross_app_access.md

@@ -15,10 +15,6 @@ further_reading:
       text: 'Configure SAML single sign-on'
 ---
 
-{{< callout url="#" btn_hidden="true" header="false">}}
-  Cross-App Access is in Preview. Okta gates access to the preview and enables it for your tenant, and the Okta capabilities this setup depends on are not generally available yet. Any Datadog organization can enable Cross-App Access on the Datadog side today.
-{{< /callout >}}
-
 ## Overview
 
 Cross-App Access (XAA) lets AI agents call the Datadog API on behalf of users your organization already authorized in Okta. Without it, every user authorizes the agent individually through a browser consent screen. With it, your Okta administrator grants that access once, centrally, and users skip the per-user consent step.
@@ -43,7 +39,7 @@ Setup moves values in both directions between Datadog and Okta. Two of them are
 - Your organization uses Okta for SAML single sign-on to Datadog. Cross-App Access resolves users through your existing SAML connection, so it does not work without one. See [Configure SAML single sign-on](/account_management/saml/).
 - Each user who uses Claude exists in your Datadog organization and is assigned to both the Claude application and the Datadog application in Okta.
 - You have the `org_management` permission in Datadog. To configure Cross-App Access through the API instead of the UI, you also need a [Personal Access Token](/account_management/personal-access-tokens/) (PAT), used as `DD_TOKEN` in the examples.
-- Your Okta tenant has the {{< ui >}}AI Agent Identity Assertion{{< /ui >}} and {{< ui >}}Agent to Agent Connections{{< /ui >}} Early Access features enabled, and you have Okta Super Administrator access.
+- Your Okta tenant has the {{< ui >}}AI Agent Identity Assertion{{< /ui >}} and {{< ui >}}Agent to Agent Connections{{< /ui >}} features enabled, and you have Okta Super Administrator access.
 
 ## Configure Cross-App Access in Datadog
 

hugo/content/en/account_management/org_settings/mobile_third_party_access.md

@@ -49,17 +49,26 @@ Revoking a user's OAuth access to an application removes all access to that appl
 
 ### Application Scope Management
 
-Enable Application Scope Management to modify the allowed scopes for an application. Adding or removing a scope affects access to this application for all users in your organization. Disabling a scope revokes any existing authorizations for applications that have the scope granted.
+Enable Application Scope Management to modify the allowed scopes for an application.
 
-Only MCP applications support Application Scope Management.
+Adding or removing a scope affects access to the application for all users in your organization. Disabling a scope revokes existing authorizations that include that scope. Affected users must re-authorize the application to regain access with the remaining allowed scopes. Enabling a scope does not add it to existing authorizations. Users must re-authorize the application to grant the newly allowed scope.
+
+Use {{< ui >}}Automatically allow new scopes{{< /ui >}} to choose how Datadog handles scopes that the application starts requesting after you save the configuration:
+
+- When selected, Datadog allows newly requested scopes automatically. Scopes that you explicitly disable remain blocked.
+- When cleared, Datadog blocks newly requested scopes until an administrator allows them.
+
+For the Datadog Mobile App, required scopes are always allowed and cannot be disabled.
 
 1. On the {{< ui >}}Mobile and Third-Party Access{{< /ui >}} page, click an application to open its detail view.
 
 2. Select the {{< ui >}}Scopes{{< /ui >}} tab and use the {{< ui >}}Allowed{{< /ui >}} checkbox for each scope to control whether to grant the application that scope.
 
-3. Click {{< ui >}}Enable{{< /ui >}} to save the scope configuration.
+3. Select or clear {{< ui >}}Automatically allow new scopes{{< /ui >}} to choose whether Datadog automatically allows new scopes that the application requests after you save.
+
+4. Click {{< ui >}}Enable{{< /ui >}} or {{< ui >}}Save{{< /ui >}} to save the scope configuration.
 
-{{< img src="account_management/mobile_third_party_access/scope-restrictions-enable.png" alt="Application Scope Management view with Enable and Restore to Full Access buttons" style="width:100%;">}}
+{{< img src="account_management/mobile_third_party_access/scope-restrictions-enable-2.png" alt="Application Scope Management view showing Automatically allow new scopes and allowed scope controls" style="width:100%;">}}
 
 ## Further Reading
 

hugo/content/en/agent/configuration/network.md

@@ -98,8 +98,13 @@ API test results for the Synthetics Worker < v0.1.5: `api.`{{< region-param key=
 : `dbm-metrics-intake.`{{< region-param key="dd_site" code="true" >}}<br>
 `dbquery-intake.`{{< region-param key="dd_site" code="true" >}}
 
+[End User Device Monitoring][103]
+: `softinv-intake.`{{< region-param key="dd_site" code="true" >}}<br>
+`eudm-intake.`{{< region-param key="dd_site" code="true" >}}
+
 [101]: /remote_configuration
 [102]: /database_monitoring/
+[103]: /infrastructure/end_user_device_monitoring/
 
 {{% /site-region %}}
 

hugo/content/en/bits_ai/bits_code/_index.md

@@ -54,9 +54,10 @@ Click a session to view its details and continue working with Bits Code. To remo
 Bits Code supports the following source code providers:
 - **GitHub**: GitHub.com, [GitHub Enterprise Cloud][30], [GitHub Enterprise Cloud with data residency][31], and [GitHub Enterprise Server][38].
 - **GitLab**: GitLab.com and GitLab Self-Managed.
+- **Azure DevOps Cloud**: [dev.azure.com and *.visualstudio.com][39].
 
 The following plans are not supported:
-- **Azure DevOps**: Neither Azure DevOps Cloud nor Azure DevOps Server (On-Prem) is supported by Bits Code. Datadog [Source Code Integration][37] does not support Azure DevOps Server (On-Prem).
+- **Azure DevOps Server**: On-premises instances are not supported by Bits Code or Datadog [Source Code Integration][37].
 - **Bitbucket**: Neither Bitbucket.org, Bitbucket Data Center, nor Bitbucket Data Server (On-Prem) are supported by Bits Code. Datadog [Source Code Integration][37] does not support On-Prem Bitbucket deployments.
 
 ## Supported Datadog products
@@ -157,3 +158,4 @@ Bits Code never auto-merges PRs or MRs. See all the PRs or MRs that Bits Code is
 [33]: /bits_ai/bits_code/setup/#configure-custom-instructions
 [37]: /source_code/source-code-management#source-code-management-providers
 [38]: https://docs.github.com/en/enterprise-server@3.17/admin/overview/about-github-enterprise-server
+[39]: https://learn.microsoft.com/en-us/azure/devops/?view=azure-devops

hugo/content/en/bits_ai/bits_code/setup.md

@@ -65,6 +65,22 @@ Set up Bits Code for one of the [supported source code providers][11].
 [7]: https://docs.gitlab.com/user/profile/personal_access_tokens/
 {{% /tab %}}
 
+{{% tab "Azure DevOps" %}}
+1. Install the [Azure DevOps Source Code integration][101]. For full installation and configuration steps, see the [Azure DevOps Source Code integration guide][102].
+2. Verify that the Microsoft Entra app's service principal is a Project Contributor on each project, or belongs to a custom group with the following [repository permissions][103]:
+   - Contribute
+   - Contribute to pull requests
+   - Create branch
+   - Read
+
+If [commit author email validation][104] is enabled, add `no-reply@dtdg.co` to the allowed email addresses. Bits Code uses this address for commits it creates.
+
+[101]: https://app.datadoghq.com/integrations/azure-devops-source-code
+[102]: /integrations/azure-devops-source-code/
+[103]: https://learn.microsoft.com/en-us/azure/devops/repos/git/set-git-repository-permissions
+[104]: https://learn.microsoft.com/en-us/azure/devops/repos/git/repository-settings#commit-author-email-validation-policy
+{{% /tab %}}
+
 {{< /tabs >}}
 
 ## Additional configuration  

hugo/content/en/bits_ai/bits_detection.md

@@ -25,7 +25,15 @@ After you enable Bits Detection, it initializes monitoring for the 100 most crit
 
 Your team's existing monitors stay in place. Bits Detection works alongside them, adding adaptive coverage for the parts of your system that change too quickly to model by hand.
 
-To enable Bits Detection for additional services:
+You can enable Bits Detection for additional services from several entry points:
+
+### Option 1: Bits Detection Coverage Page {#enable-from-bits-ai}
+1. In Datadog, go to [{{< ui >}}Bits AI{{< /ui >}} > {{< ui >}}Bits Detection{{< /ui >}}][5] and click {{< ui >}}Enable New Detection Coverage{{< /ui >}}.
+1. Filter the service list to find services you'd like to enable, and select one or more services from the list.
+1. Set up a notification destination so the team knows when Bits finds a critical degradation.
+1. Review the managed coverage after initialization completes. You receive an email when your new health posture is ready.
+
+### Option 2: Service Page {#enable-from-service-page}
 
 1. In Datadog, go to [{{< ui >}}APM{{< /ui >}} > {{< ui >}}Services{{< /ui >}}][2] and select a service.
 1. Open the service's monitoring overview from the monitor status bar or the Bits Detection card.
@@ -44,7 +52,20 @@ Use the sections below to review coverage, configure alert routing, and provide
 
 ### Review Bits Detection monitoring
 
-Use the Service Page or Monitor List to review how Bits Detection is monitoring your system.
+Use the Bits Detection Coverage Page, Service Page, or Monitor List to review how Bits Detection is monitoring your system.
+
+**Bits Detection Coverage Page**
+
+To review all scopes where Bits Detection is active, go to [{{< ui >}}Bits AI{{< /ui >}} > {{< ui >}}Bits Detection{{< /ui >}}][5]. Each row is a detection scope showing the number of critical endpoints and managed monitors Bits maintains, when the scope last alerted, whether alert notifications are configured, and whether auto-investigate is enabled. Select a scope to open its Bits Detection Details, where you can review the health status over a chosen time window, the endpoints Bits considers critical (each with a justification explaining why it was selected), the monitors Bits manages, and the scope's alert history.
+
+From the Coverage page, you can:
+
+- Review Bits Detection health status for all covered services.
+- Enable new detection coverage by selecting the services you want Bits to monitor.
+- View details for a managed scope.
+- Review the critical endpoints covered by Bits Detection.
+- Mark an endpoint as not critical.
+- Manage alert notification rules.
 
 **Service Page**
 
@@ -104,6 +125,7 @@ Bits Detection uses criticality to determine which resources should have managed
 {{< partial name="whats-next/whats-next.html" >}}
 
 [1]: /help
-[2]: https://www.app.datadoghq.com/apm/services
+[2]: https://app.datadoghq.com/apm/services
 [3]: https://app.datadoghq.com/monitors/manage?bits_monitors=true
 [4]: /bits_ai/bits_investigation/
+[5]: https://app.datadoghq.com/bits-ai/detection/scopes

hugo/content/en/cloud_cost_management/_index.md

@@ -130,13 +130,15 @@ For a detailed breakdown of requirements by page, see [Permissions][9].
 
 Monitor the freshness and processing status of your cloud cost data on the {{< ui >}}Cloud Cost{{< /ui >}} > {{< ui >}}Settings{{< /ui >}} > {{< ui >}}Data History{{< /ui >}} page.
 
-- {{< ui >}}Last Bill Received{{< /ui >}}: When your cloud or SaaS provider generated the billing data visible in CCM.
+- {{< ui >}}Last Bill Received{{< /ui >}}: When Datadog last received billing data from your cloud or SaaS provider. This timestamp does not indicate the latest usage or cost date in that data.
 - {{< ui >}}Last Processed{{< /ui >}}: When Datadog last processed billing data from your cloud provider, including:
   - Tag pipeline rules (retroactively processes up to 3 months of historical data by default)
   - Cost allocation rules (retroactively processes up to 1 month of historical data by default)
 
 Use this page to troubleshoot data delays or confirm that recent tag pipelines and cost allocation changes have taken effect.
 
+Cloud cost data can only be as recent as the data supplied by your provider. If costs are missing for an expected date, compare your provider's bill or export with CCM. Contact your provider if the source does not contain costs for the expected date. Contact [Datadog Support][11] if the source contains those costs but CCM does not.
+
 ## Use AI for cost analysis
 
 Use the [Cloud Cost Skill in Bits Chat][10] to investigate cost changes, identify likely owners, compare spend against budgets, correlate cost with observability metrics, and create handoff notebooks for engineering teams.
@@ -157,3 +159,4 @@ Use the [Cloud Cost Skill in Bits Chat][10] to investigate cost changes, identif
 [8]: /cloud_cost_management/datadog_costs
 [9]: /cloud_cost_management/setup/permissions
 [10]: /cloud_cost_management/cloud_cost_skill/
+[11]: /help/