diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md b/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md
index 87146fc807..22b92d8e46 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md
@@ -44,6 +44,9 @@ If you can reproduce a problem, increase the logging level, run the system for s
 
 3. Run `sudo mdatp diagnostic create` to back up Microsoft Defender ATP's logs. The files will be stored inside a .zip archive. This command will also print out the file path to the backup after the operation succeeds.
 
+  > [!TIP]
+  > By default, diagnostic logs are saved to `/Library/Application Support/Microsoft/Defender/wdavdiag/`. To change the location where diagnostic logs are saved, pass `--path [path]` to the below command.
+
    ```bash
    sudo mdatp diagnostic create
    ```