chore(ms-ai-architect): refresh KB high-bucket — 49 files [skip-docs]

KB-currency refresh (high priority, 2026-06-19) via /architect:kb-update.
49 high-prioritets governance/security/monitoring-filer re-verifisert mot
Microsoft Learn (MCP) — delegert til 8 parallelle Opus-subagenter gruppert
etter delt kilde, verifisert i hovedkontekst (diff-review + tester).

Hovedendringer (faktuelle korreksjoner + currency):
- MITRE ATLAS-IDer korrigert (supply-chain): AML.T0050 -> AML.T0018.000
  (Poison AI Model); AML.T0020 = Poison Training Data; T1195 Supply Chain
  Compromise. Gamle IDer var utdaterte (verifisert mot MCSB v2 AI-1).
- OTel-sampling presisert (distributed-tracing): adaptive sampling = klassisk
  App Insights SDK; OTel-distroen sampler IKKE by default (fixed-rate/
  rate-limited maa konfigureres); Functions parent-based sampling er default.
- MCSB v2 AI-kontroller AI-1 -> AI-7 (risk-taxonomy three-pillar, scoring-
  framework, rubrics, red-team, adversarial); Defender for Cloud AI threat
  protection + AI-SPM (GA).
- AI gateway (APIM) multi-provider: Anthropic Messages API v2-tiers, Google
  Vertex, unified model API (preview), MCP/A2A, Foundry-integrasjon; eksakte
  policy-navn (llm-emit-token-metric maks 5 dims, llm-semantic-cache-*,
  score-threshold = avstand, MS-eks. 0.15).
- Purview Enterprise AI apps inkl. Anthropic Claude (Enterprise) + ChatGPT
  Enterprise; Security Dashboard for AI (Agent 365-inventar, MCP-servere,
  tredjepartsmodeller; Security Reader minimumsrolle).
- Entra Agent ID: CA-lisenskrav (Entra ID P1/P2 + Agent 365), CA-scoping per
  tilgangsmoenster (on-behalf-of/app-only/agent-as-user), CA-grenser,
  connector-permissions som API-permissions.
- Copilot DLP: Block SITs in web search (GA, Performing Web Searches) + Block
  external email (preview) som prompt injection-vern.
- Azure AI Language PII: tre feature-typer, GA-API 2026-05-01; NOIdentityNumber
  bekreftet dedikert kategori for norske foedselsnummer.
- Foundry Tools-rename forsterket paa tvers; alle 49 Last updated -> 2026-06-19.

Discovery: 500 kandidater (alle Databricks-stoey) -> kun registry-kandidater,
ingen nye skills/-filer -> 389-telling uendret. validate 239 PASS,
kb-integrity 115/115 (262 orphan-warnings uendret), gitleaks clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01REiKFhP4w6xGXXqWKpPCJJ

skills/ms-ai-governance/references/monitoring-observability/token-usage-tracking-attribution.md

@@ -1,7 +1,7 @@
 # Token Usage Tracking and Attribution
 
 **Kategori:** Monitoring & Observability
-**Dato:** 2026-04-09
+**Dato:** 2026-06-19
 **Versjon:** 1.0
 
 ## Introduksjon
@@ -505,9 +505,14 @@ Owner: <email>
 
 **3. Budgets:**
 - Opprett per resource group eller subscription
-- Sett alert thresholds (50%, 80%, 100%, 120%)
+- Sett alert thresholds (50%, 80%, 100%, 120%). WAF anbefaler som minimum 90% (ideelt forbruk), 100% (mål) og 110% (mindre ideelt) for budget alerts, og 110% for forecast alerts. *(Verified MCP 2026-06-19)*
 - Action groups for automated response (webhook, Logic App)
 
+**4. FOCUS-basert eksport og analyse** *(Verified MCP 2026-06-19)*:
+- Azure Cost Management beholder kostnadsdata i **13 måneder**. For lengre historikk: planlegg Cost Management-eksport til et Azure Data Lake Storage Gen2-lager (daglig/månedlig) med **FOCUS**-malen (FinOps Open Cost and Usage Specification — leverandøragnostisk, standardisert skjema).
+- Skill mellom **actual costs** (som fakturert, 24–72 t ingestion-forsinkelse) og **amortized costs** (commitment-baserte kjøp fordelt jevnt over perioden). Samle inn begge for å avstemme faktura mot effektiv kostnad.
+- Avansert rapportering: pipeline **Cost Management exports → ADLS Gen2 → Fabric Lakehouse → Power BI** skalerer til store datasett og muliggjør egendefinert FOCUS-rapportering. For høyvolum-tjenester: bruk ingestion-time transformation i Log Analytics for å redusere loggvolum.
+
 ## Best Practices
 
 ### 1. Data Store Selection
@@ -574,7 +579,7 @@ Owner: <email>
 4. [Token usage estimation for Azure OpenAI On Your Data](https://learn.microsoft.com/en-us/azure/foundry-classic/openai/concepts/use-your-data#token-usage-estimation-for-azure-openai-on-your-data) — RAG-specific token calculations
 5. [Understanding costs associated with PTU](https://learn.microsoft.com/en-us/azure/foundry/openai/concepts/provisioned-throughput-billing) — PTU billing model
 6. [Application design for AI workloads](https://learn.microsoft.com/en-us/azure/well-architected/ai/application-design#consider-nonfunctional-requirements) — Cost and chargeback scenarios
-7. [Architecture strategies for cost data](https://learn.microsoft.com/en-us/azure/well-architected/cost-optimization/collect-review-cost-data#generate-cost-reports) — Chargeback vs. showback
+7. [Architecture strategies for cost data](https://learn.microsoft.com/en-us/azure/well-architected/cost-optimization/collect-review-cost-data#generate-cost-reports) — Chargeback vs. showback. *(Verified MCP 2026-06-19 — FOCUS-eksport, actual vs amortized costs, Cost Management 13-mnd retention, Fabric/Power BI-pipeline, budget/forecast alert-terskler)*
 
 ## For Cosmo