update note on expedite mode

windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md

@@ -80,7 +80,7 @@ Windows Defender ATP reporting frequency was tested over a large number of machi
 In cases where high-value assets or machines are at high risk, you can configure the reporting frequency to expedite mode, allowing the machine to report at a higher frequency.
 
 > [!NOTE]
-> Setting a machine to expedite mode is not the Windows Defender ATP recommended setting. Performance degradation should be taken into consideration when using this setting.
+> Using the Expedite mode might have an impact on the machine's battery usage and actual bandwidth used for sensor data. You should consider this when these measure are critical.
 
 For each endpoint, you can configure a registry key value that determines how frequent a machine reports sensor data to the portal.
 
@@ -89,15 +89,15 @@ The configuration is set through the following registry key entry:
 ```
 Path: “HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection”
 Name: "latency"
-Value: Normal or expedite
+Value: Normal or Expedite
 ```
 Where:<br>
 Key type is a string. <br>
 Possible values are:
-- Normal - sets reporting frequency from the endpoint to normal mode for the optimal speed and performance balance
-- Expedite - sets reporting frequency from the endpoint to expedite mode
+- Normal - sets reporting frequency from the endpoint to Normal mode for the optimal speed and performance balance
+- Expedite - sets reporting frequency from the endpoint to Expedite mode
 
-The default value in case the registry key doesn’t exist is normal.
+The default value in case the registry key doesn’t exist is Normal.
 
 ### Offboard endpoints
 For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.

windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md

@@ -99,7 +99,7 @@ Configuration for onboarded machines: telemetry reporting frequency | ./Device/V
 > [!NOTE]
 > - The **Health Status for onboarded machines** policy uses read-only properties and can't be remediated.
 > - Configuration of telemetry reporting frequency is only available for machines on Windows 10, version 1703.
-> - Setting a machine to expedite mode is not the Windows Defender ATP recommended setting. Performance degradation should be taken into consideration when using this setting.
+> - Using the Expedite mode might have an impact on the machine's battery usage and actual bandwidth used for sensor data. You should consider this when these measure are critical.
 
 ### Using the Azure Intune Portal to deploy Windows Defender Advanced Threat Protection policies on Windows 10 1607 and higher
 

windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md

@@ -82,7 +82,7 @@ Windows Defender ATP reporting frequency was tested over a large number of machi
 In cases where high-value assets or machines are at high risk, you can configure the reporting frequency to expedite mode, allowing the machine to report at a higher frequency.
 
 > [!NOTE]
-> Setting a machine to expedite mode is not the Windows Defender ATP recommended setting. Performance degradation should be taken into consideration when using this setting.
+> Using the Expedite mode might have an impact on the machine's battery usage and actual bandwidth used for sensor data. You should consider this when these measure are critical.
 
 For each endpoint, you can configure a registry key value that determines how frequent a machine reports sensor data to the portal.
 
@@ -91,15 +91,15 @@ The configuration is set through the following registry key entry:
 ```
 Path: “HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection”
 Name: "latency"
-Value: Normal or expedite
+Value: Normal or Expedite
 ```
 Where:<br>
 Key type is a string. <br>
 Possible values are:
-- Normal - sets reporting frequency from the endpoint to normal mode for the optimal speed and performance balance
-- Expedite - sets reporting frequency from the endpoint to expedite mode
+- Normal - sets reporting frequency from the endpoint to Normal mode for the optimal speed and performance balance
+- Expedite - sets reporting frequency from the endpoint to Expedite mode
 
-The default value in case the registry key doesn’t exist is normal.
+The default value in case the registry key doesn’t exist is Normal.
 
 
 ### Offboard endpoints