diff --git a/windows/security/threat-protection/microsoft-defender-atp/improve-request-performance.md b/windows/security/includes/improve-request-performance.md
similarity index 100%
rename from windows/security/threat-protection/microsoft-defender-atp/improve-request-performance.md
rename to windows/security/includes/improve-request-performance.md
diff --git a/windows/security/threat-protection/microsoft-defender-atp/machineactionsnote.md b/windows/security/includes/machineactionsnote.md
similarity index 100%
rename from windows/security/threat-protection/microsoft-defender-atp/machineactionsnote.md
rename to windows/security/includes/machineactionsnote.md
diff --git a/windows/security/threat-protection/microsoft-defender-atp/prerelease.md b/windows/security/includes/prerelease.md
similarity index 100%
rename from windows/security/threat-protection/microsoft-defender-atp/prerelease.md
rename to windows/security/includes/prerelease.md
diff --git a/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags.md b/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags.md
index 2dd101cbc1..d619963f4f 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags.md
@@ -67,7 +67,7 @@ If successful, this method returns 200 - Ok response code and the updated Machin
 
 Here is an example of a request that adds machine tag.
 
-[!include[Improve request performance](improve-request-performance.md)]
+[!include[Improve request performance](../../includes/improve-request-performance.md)]
 
 ```
 POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/tags