Docs update tracker

Updates from: 01/11/2022 02:11:03

Category	Microsoft Docs article	Related commit history on GitHub	Change details
compliance	Alert Policies	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/alert-policies.md	description: "Create alert policies in the Microsoft 365 compliance center or th # Alert policies in Microsoft 365 -You can use the alert policy and alert dashboard tools in the Microsoft 365 compliance center or the Microsoft 365 Defender portal to create alert policies and then view the alerts generated when users perform activities that match the conditions of an alert policy. There are several default alert policies that help you monitor activities such as assigning admin privileges in Exchange Online, malware attacks, phishing campaigns, and unusual levels of file deletions and external sharing. +You can use alert policies and the alert dashboard in the Microsoft 365 compliance center or the Microsoft 365 Defender portal to create alert policies and then view the alerts generated when users perform activities that match the conditions of an alert policy. There are several default alert policies that help you monitor activities such as assigning admin privileges in Exchange Online, malware attacks, phishing campaigns, and unusual levels of file deletions and external sharing. + +> [!TIP] +> Go to the [Default alert policies](#default-alert-policies) section in this article for a list and description of the available alert policies. Alert policies let you categorize the alerts that are triggered by a policy, apply the policy to all users in your organization, set a threshold level for when an alert is triggered, and decide whether to receive email notifications when alerts are triggered. There's also a Alerts page where you can view and filter alerts, set an alert status to help you manage alerts, and then dismiss alerts after you've addressed or resolved the underlying incident. Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_b ### Microsoft 365 Defender portal -Go to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> and under Email & collaboration select Policies & rules > Alert policy. Alternatively, you can go directly to <https://security.microsoft.com/alertpolicies>. +Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> and under Email & collaboration select Policies & rules > Alert policy. Alternatively, you can go directly to <https://security.microsoft.com/alertpolicies>. ![In the Defender portal, select Policies & rules under Email & collaboration, and then select Alert policy to view and create alert policies.](../media/LaunchAlertPoliciesDefenderPortal.png)
compliance	Apply Sensitivity Label Automatically	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/apply-sensitivity-label-automatically.md	Make sure you're aware of the prerequisites before you configure auto-labeling p - Simulation mode: - Auditing for Microsoft 365 must be turned on. If you need to turn on auditing or you're not sure whether auditing is already on, see [Turn audit log search on or off](turn-audit-log-search-on-or-off.md). - - To view file or email contents in the source view, you must have the Content Explorer Content Viewer role. Global admins don't have this role by default. If you don't have this permission, you don't see the preview pane when you select an item from the Matched Items tab. + - To view file or email contents in the source view, you must have the Data Classification Content Viewer role, which is included in the Content Explorer Content Viewer role group, or Information Protection and Information Protection Investigators role groups (currently in preview). Without the required role, you don't see the preview pane when you select an item from the Matched Items tab. Global admins don't have this role by default. - To auto-label files in SharePoint and OneDrive: - You have [enabled sensitivity labels for Office files in SharePoint and OneDrive](sensitivity-labels-sharepoint-onedrive-files.md). You can modify your policy directly from this interface: When you're ready to run the policy without simulation, select the Turn on policy option. -Your auto-policies run continuously until they are deleted. For example, new and modified documents will be included with the current policy settings. +Auto-policies run continuously until they are deleted. For example, new and modified files will be included with the current policy settings. + +### Monitoring your auto-labeling policy + +After your auto-labeling policy is turned on, you can view the labeling progress for files in your chosen SharePoint and OneDrive locations. Emails are not included in the labeling progress because they are automatically labeled as they are sent. + +The labeling progress includes the files to be labeled by the policy, the files labeled in the last 7 days, and the total files labeled. Because of the maximum of labeling 25,000 files a day, this information provides you with visibility into the current labeling progress for your policy and how many files are still to be labeled. + +When you first turn on your policy, you will initially see a value of 0 for files to be labeled until the latest data is retrieved. This progress information updates every 48 hours, so you can expect to see the most current data about every other day. When you select an auto-labeling policy, you can see more details about the policy in a flyout pane, which includes the labeling progress by the top 10 sites. The information on this flyout pane might be more current than the aggregated policy information displayed on the Auto-labeling main page. You can also see the results of your auto-labeling policy by using [content explorer](data-classification-content-explorer.md) when you have the appropriate [permissions](data-classification-content-explorer.md#permissions): -- Content Explorer List Viewer lets you see a file's label but not the file's contents.-- Content Explorer Content Viewer lets you see the file's contents. +- Content Explorer List Viewer role group lets you see a file's label but not the file's contents. +- Content Explorer Content Viewer role group, and Information Protection and Information Protection Investigators role groups (currently in preview) let you see the file's contents. > [!TIP] > You can also use content explorer to identify locations that have documents with sensitive information, but are unlabeled. Using this information, consider adding these locations to your auto-labeling policy, and include the identified sensitive information types as rules.
compliance	Compliance Manager Templates List	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-manager-templates-list.md	Templates are added to Compliance Manager as new laws and regulations are enacte ## List of templates and where to find them -Below is the complete list of templates in Compliance Manager. The links in the template names below take you to related documentation about that standard, regulation, or law. +Below is the complete list of templates in Compliance Manager. Links in the template names below take you to related documentation where available about that standard, regulation, or law. + +You can also select individual templates in Compliance Manager to view more information about them, including a description of the regulation and properties of the template. Read the About section for a summary. ### Where to find your templates
compliance	Create A Dlp Policy From A Template	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-a-dlp-policy-from-a-template.md	You can fine tune a template by modifying any of its existing rules or adding ne You can also choose the Custom template, which has no default rules, and configure your DLP policy from scratch, to meet the specific compliance requirements for your organization. +## Permissions + +Members of your compliance team who will create DLP policies need permissions to the Compliance Center. By default, your tenant admin will have access can give compliance officers and other people access. Follow these steps: + +1. Create a group in Microsoft 365 and add compliance officers to it. + +2. Create a role group on the Permissions page of the Security & Compliance Center. + +3. While creating the role group, use the Choose Roles section to add the following role to the role group: DLP Compliance Management. + +4. Use the Choose Members section to add the Microsoft 365 group you created before to the role group. + +Use the View-Only DLP Compliance Management role to create role group with view-only privileges to the DLP policies and DLP reports. + +For more information, see [Give users access to the Office 365 Compliance Center](../security/office-365-security/grant-access-to-the-security-and-compliance-center.md). + +These permissions are required to create and apply a DLP policy not to enforce policies. + +### Roles and Role Groups in preview + +There are roles and role groups in preview that you can test out to fine tune your access controls. + +Here's a list of Microsoft Information Protection (MIP) roles that are in preview. To learn more about them, see [Roles in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center) + +- Information Protection Admin +- Information Protection Analyst +- Information Protection Investigator +- Information Protection Reader + +Here's a list of MIP role groups that are in preview. To learn more about the, see [Role groups in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#role-groups-in-the-security--compliance-center) + +- Information Protection +- Information Protection Admins +- Information Protection Analysts +- Information Protection Investigators +- Information Protection Readers + ### Create the DLP policy from a template 1. Sign in to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft 365 compliance center</a>.
compliance	Create Test Tune Dlp Policy	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-test-tune-dlp-policy.md	For more information, see [Give users access to the Office 365 Compliance Center These permissions are required to create and apply a DLP policy not to enforce policies. +### Roles and Role Groups in preview + +There are roles and role groups in preview that you can test out to fine tune your access controls. + +Here's a list of Microsoft Information Protection (MIP) roles that are in preview. To learn more about them, see [Roles in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center) + +- Information Protection Admin +- Information Protection Analyst +- Information Protection Investigator +- Information Protection Reader + +Here's a list of MIP role groups that are in preview. To learn more about the, see [Role groups in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#role-groups-in-the-security--compliance-center) + +- Information Protection +- Information Protection Admins +- Information Protection Analysts +- Information Protection Investigators +- Information Protection Readers + ## How sensitive information is detected by DLP DLP finds sensitive information by regular expression (RegEx) pattern matching, in combination with other indicators such as the proximity of certain keywords to the matching patterns. For example, a VISA credit card number has 16 digits. But, those digits can be written in different ways, such as 1111-1111-1111-1111, 1111 1111 1111 1111, or 1111111111111111.
compliance	Data Classification Activity Explorer	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/data-classification-activity-explorer.md	search.appverid: - MOE150 - MET150 -description: "Activity explorer rounds out the functionality of the data classification feature by letting you see and filter on the actions users are taking on your labeled content." +description: "Activity explorer lets you see and filter on the actions users are taking on your labeled content." # Get started with activity explorer Every account that accesses and uses data classification must have a license ass ### Permissions - In order to get access to the activity explorer tab, an account must be explicitly assigned membership in any one of these role groups or explicitly granted the role. +An account must be explicitly assigned membership in any one of these role groups or explicitly granted the role. + +### Roles and Role Groups in preview + +There are roles and role groups in preview that you can test out to fine-tune your access controls. + +Here's a list of Microsoft Information Protection (MIP) roles that are in preview. To learn more about them, see [Roles in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center) + +- Information Protection Admin +- Information Protection Analyst +- Information Protection Investigator +- Information Protection Reader + +Here's a list of MIP role groups that are in preview. To learn more about the, see [Role groups in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#role-groups-in-the-security--compliance-center) + +- Information Protection +- Information Protection Admins +- Information Protection Analysts +- Information Protection Investigators +- Information Protection Readers <!-- > [!IMPORTANT] Every account that accesses and uses data classification must have a license ass Activity explorer gathers activity information from the audit logs on multiple sources of activities. For more detailed information on what labeling activity makes it to Activity explorer, see [Labeling events available in Activity explorer](data-classification-activity-explorer-available-events.md). -Sensitivity label activities and Retention labeling activities from Office native applications, Azure Information Protection add-in, SharePoint Online, Exchange Online (sensitivity labels only) and OneDrive. Some examples are: +Sensitivity label activities and Retention labeling activities from Office native applications, Azure Information Protection add-in, SharePoint Online, Exchange Online (sensitivity labels only), and OneDrive. Some examples are: - label applied - label changed (upgraded, downgraded, or removed) Activity explorer also gathers DLP policy matches events from Exchange Onlin - copied to network share - accessed by unallowed app -The value of understanding what actions are being taken with your sensitive labeled content is that you can see if the controls that you have already put into place, such as [data loss prevention](dlp-learn-about-dlp.md) are effective or not. If not, or if you discover something unexpected, such as a large number of items that are labeled `highly confidential` and are downgraded `general`, you can manage your various policies and take new actions to restrict the undesired behavior. +Understanding what actions are being taken with your sensitive labeled content helps you see if the controls that you have in place, such as [data loss prevention](dlp-learn-about-dlp.md) policies are effective or not. If not, or if you discover something unexpected, such as a large number of items that are labeled `highly confidential` and are downgraded `general`, you can manage your various policies and take new actions to restrict the undesired behavior. > [!NOTE] > Activity explorer doesn't currently monitor retention activities for Exchange Online.
compliance	Data Classification Content Explorer	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/data-classification-content-explorer.md	You can also assign either or both of the roles to a custom role group to tailor A Global admin, can assign the necessary Content Explorer List Viewer, and Content Explorer Content Viewer role group membership. +#### Roles and Role Groups in preview + +There are roles and role groups in preview that you can test out to fine tune your access controls. + +Here's a list of Microsoft Information Protection (MIP) roles that are in preview. To learn more about them, see [Roles in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center) + +- Information Protection Admin +- Information Protection Analyst +- Information Protection Investigator +- Information Protection Reader + +Here's a list of MIP role groups that are in preview. To learn more about the, see [Role groups in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#role-groups-in-the-security--compliance-center) + +- Information Protection +- Information Protection Admins +- Information Protection Analysts +- Information Protection Investigators +- Information Protection Readers + ## Content explorer Content explorer shows a current snapshot of the items that have a sensitivity label, a retention label or have been classified as a sensitive information type in your organization.
compliance	Data Classification Overview	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/data-classification-overview.md	Data classification will scan your sensitive content and labeled content before > [!NOTE] > As a best practice, always use the role with least privilege to grant access to Microsoft 365 data classification. +#### Roles and Role Groups in preview + +There are roles and role groups in preview that you can test out to fine tune your access controls. + +Here's a list of Microsoft Information Protection (MIP) roles that are in preview. To learn more about them, see [Roles in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center) + +- Information Protection Admin +- Information Protection Analyst +- Information Protection Investigator +- Information Protection Reader + +Here's a list of MIP role groups that are in preview. To learn more about the, see [Role groups in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#role-groups-in-the-security--compliance-center) + +- Information Protection +- Information Protection Admins +- Information Protection Analysts +- Information Protection Investigators +- Information Protection Readers + ## Sensitive information types used most in your content Microsoft 365 comes with many definitions of sensitive information types, such as an item containing a social security number or a credit card number. For more information on sensitive information types, see [Sensitive information type entity definitions](sensitive-information-type-entity-definitions.md).
compliance	Dlp Alerts Dashboard Get Started	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-alerts-dashboard-get-started.md	The content preview feature is available only for these licenses: ### Roles - If you want to view the DLP alert management dashboard or to edit the alert configuration options in a DLP policy, you must be a member of one of these role groups: - Compliance Administrator To access the Content preview feature and the Matched sensitive content and cont which has the data classification content viewer role pre-assigned. +### Roles and Role Groups in preview + +There are roles and role groups in preview that you can test out to fine tune your access controls. + +Here's a list of Microsoft Information Protection (MIP) roles that are in preview. To learn more about them, see [Roles in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center) + +- Information Protection Admin +- Information Protection Analyst +- Information Protection Investigator +- Information Protection Reader + +Here's a list of MIP role groups that are in preview. To learn more about the, see [Role groups in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#role-groups-in-the-security--compliance-center) + +- Information Protection +- Information Protection Admins +- Information Protection Analysts +- Information Protection Investigators +- Information Protection Readers + ## DLP alert configuration To learn how to configure an alert in your DLP policy, see [Where to start with data loss prevention](create-test-tune-dlp-policy.md#where-to-start-with-data-loss-prevention).
compliance	Dlp Chrome Get Started	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-chrome-get-started.md	Data from Endpoint DLP can be viewed in [Activity explorer](data-classification- - Security reader - Reports reader +#### Roles and Role Groups in preview + +There are roles and role groups in preview that you can test out to fine tune your access controls. + +Here's a list of Microsoft Information Protection (MIP) roles that are in preview. To learn more about them, see [Roles in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center) + +- Information Protection Admin +- Information Protection Analyst +- Information Protection Investigator +- Information Protection Reader + +Here's a list of MIP role groups that are in preview. To learn more about the, see [Role groups in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#role-groups-in-the-security--compliance-center) + +- Information Protection +- Information Protection Admins +- Information Protection Analysts +- Information Protection Investigators +- Information Protection Readers + ### Overall installation workflow Deploying Microsoft Compliance Extension is a multi-phase process. You can choose to install on one machine at a time, or use Microsoft Endpoint Manager or Group Policy for organization-wide deployments.
compliance	Dlp On Premises Scanner Get Started	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-on-premises-scanner-get-started.md	For full licensing details see: [Microsoft 365 licensing guidance for security & ### Permissions - Data from DLP on-premises scanner can be viewed in [Activity explorer](data-classification-activity-explorer.md). There are four roles that grant permission to activity explorer, the account you use for accessing the data must be a member of any one of them. - Global administrator Data from DLP on-premises scanner can be viewed in [Activity explorer](data-clas - Security administrator - Compliance data administrator +#### Roles and Role Groups in preview + +There are roles and role groups in preview that you can test out to fine tune your access controls. + +Here's a list of Microsoft Information Protection (MIP) roles that are in preview. To learn more about them, see [Roles in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center) + +- Information Protection Admin +- Information Protection Analyst +- Information Protection Investigator +- Information Protection Reader + +Here's a list of MIP role groups that are in preview. To learn more about the, see [Role groups in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#role-groups-in-the-security--compliance-center) + +- Information Protection +- Information Protection Admins +- Information Protection Analysts +- Information Protection Investigators +- Information Protection Readers + ### DLP on-premises scanner prerequisites - The Azure Information Protection (AIP) scanner implements DLP policy matching and policy enforcement. The scanner is installed as part of the AIP client so your installation must meet all the prerequisites for AIP, the AIP client, and the AIP unified labeling scanner.
compliance	Get Started With Sensitivity Labels	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/get-started-with-sensitivity-labels.md	By default, global administrators for your tenant have access to this admin cent Alternatively to using the default roles, you can create a new role group and add either Sensitivity Label Administrator or Organization Configuration roles to this group. For a read-only role, use Sensitivity Label Reader. -For instructions to add users to the default roles or create your own role groups, see [Permissions in the Microsoft 365 compliance center](microsoft-365-compliance-center-permissions.md). +> [!NOTE] +> Now in preview, you can use the following role groups: +> - Information Protection +> - Information Protection Admins +> - Information Protection Analysts +> - Information Protection Investigators +> - Information Protection Readers +> +> For an explanation of each one, and the new roles that they contain, select a role group in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft 365 compliance center</a> > Permissions & roles > Compliance center > Roles, and then review the description in the flyout pane. Or, see [Role groups in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#role-groups-in-the-security--compliance-center). + +For instructions to add users to the default role group, roles, or create your own role groups, see [Permissions in the Microsoft 365 compliance center](microsoft-365-compliance-center-permissions.md). These permissions are required only to create and configure sensitivity labels and their label policies. They are not required to apply the labels in apps or services. If additional permissions are needed for specific configurations that relate to sensitivity labels, those permissions will be listed in their respective documentation instructions.
compliance	Import Physical Badging Data	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/import-physical-badging-data.md	After you create the physical badging connector and push your physical badging d ![Status flyout page for physical badging connector.](..\media\PhysicalBadgingStatusFlyout.png) -3. Under Last import, click the Download log link to open (or save) the status log for the connector. This log contains information about each time the script runs and uploads the data from the CSV file to the Microsoft cloud. +3. Under Last import, click the Download log link to open (or save) the status log for the connector. This log contains information about each time the script runs and uploads the data from the JSON file to the Microsoft cloud. - ![Physical badging connector log file displays number rows from JSON file that were uploaded.](..\media\PhysicalBadgingConnectorLogFile.png) + ![Physical badging connector log file displays number of objects from the JSON file that were uploaded.](..\media\PhysicalBadgingConnectorLogFile.png) - The RecordsSaved field indicates the number of rows in the CSV file that uploaded. For example, if the CSV file contains four rows, then the value of the RecordsSaved fields is 4, if the script successfully uploaded all the rows in the CSV file. + The RecordsSaved field indicates the number of objects in the JSON file that uploaded. For example, if the JSON file contains four objects, then the value of the RecordsSaved fields is 4, if the script successfully uploaded all the objects in the JSON file. If you've haven't run the script in Step 4, a link to download the script is displayed under Last import. You can download the script and then follow the steps in Step 4 to run it.
includes	Microsoft 365 Content Updates	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-365-content-updates.md	+## Week of January 03, 2022 ++ +\| Published On \|Topic title \| Change \| +\|\|\|--\| +\| 1/3/2022 \| [Microsoft 365 compliance documentation # < 60 chars](/microsoft-365/compliance/index?view=o365-21vianet) \| modified \| +\| 1/3/2022 \| [Licensing for SharePoint Syntex](/microsoft-365/contentunderstanding/syntex-licensing) \| modified \| +\| 1/3/2022 \| [Microsoft 365 guest sharing settings reference](/microsoft-365/solutions/microsoft-365-guest-settings?view=o365-21vianet) \| modified \| +\| 1/3/2022 \| [Limit sharing in Microsoft 365](/microsoft-365/solutions/microsoft-365-limit-sharing?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [MRS service alerts](/microsoft-365/enterprise/microsoft-365-mrs-source-delays-service-alerts?view=o365-21vianet) \| added \| +\| 1/4/2022 \| [View or edit policies in Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-view-edit-create-policies?view=o365-21vianet) \| renamed \| +\| 1/4/2022 \| [Train your security staff for Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-defender-train-security-staff?view=o365-21vianet) \| added \| +\| 1/4/2022 \| [Learn about the default labels and policies for Microsoft Information Protection](/microsoft-365/compliance/mip-easy-trials?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Learn about sensitivity labels](/microsoft-365/compliance/sensitivity-labels?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [How to configure Exchange Server on-premises to use Hybrid Modern Authentication](/microsoft-365/enterprise/configure-exchange-server-for-hybrid-modern-authentication?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Exchange Online monitoring for Microsoft 365](/microsoft-365/enterprise/microsoft-365-exchange-monitoring?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Microsoft 365 Lighthouse Users page overview](/microsoft-365/lighthouse/m365-lighthouse-users-page-overview?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Microsoft Defender for Business](/microsoft-365/security/defender-business/index?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| Create a new policy in Microsoft Defender for Business \| removed \| +\| 1/4/2022 \| [Attack surface reduction frequently asked questions (FAQ)](/microsoft-365/security/defender-endpoint/attack-surface-reduction-faq?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [ASR rules deployment phase 2 - test](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-phase-2?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [ASR rules deployment phase 3 - implement](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-phase-3?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Use attack surface reduction rules to prevent malware infection](/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Onboard Windows devices to Microsoft Defender for Endpoint via Group Policy](/microsoft-365/security/defender-endpoint/configure-endpoints-gp?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Onboarding tools and methods for Windows devices](/microsoft-365/security/defender-endpoint/configure-endpoints?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Configure device proxy and Internet connection settings](/microsoft-365/security/defender-endpoint/configure-proxy-internet?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Onboard Windows servers to the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/configure-server-endpoints?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Protect important folders from ransomware from encrypting your files with controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| Customize attack surface reduction rules \| removed \| +\| 1/4/2022 \| [Compare Microsoft Defender for Endpoint Plan 1 to Plan 2](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Overview of Microsoft Defender for Endpoint Plan 1](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| Evaluate attack surface reduction rules \| removed \| +\| 1/4/2022 \| [Apply mitigations to help prevent attacks through vulnerabilities](/microsoft-365/security/defender-endpoint/exploit-protection?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [App-based deployment for Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-install?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [What's new in Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-whatsnew?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Manage Microsoft Defender for Endpoint Plan 1](/microsoft-365/security/defender-endpoint/mde-p1-maintenance-operations?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Set up and configure Microsoft Defender for Endpoint Plan 1](/microsoft-365/security/defender-endpoint/mde-p1-setup-configuration?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Get started with Microsoft Defender for Endpoint Plan 1](/microsoft-365/security/defender-endpoint/mde-plan1-getting-started?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-ios?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Microsoft Defender for Endpoint - Mobile Threat Defense](/microsoft-365/security/defender-endpoint/mtd?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Use network protection to help prevent connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Troubleshoot problems with attack surface reduction rules](/microsoft-365/security/defender-endpoint/troubleshoot-asr?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Vulnerabilities in my organization - threat and vulnerability management](/microsoft-365/security/defender-endpoint/tvm-weaknesses?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Configure Microsoft Defender Antivirus with Group Policy](/microsoft-365/security/defender-endpoint/use-group-policy-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [What's new in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Quarantine policies](/microsoft-365/security/office-365-security/quarantine-policies?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Complete Safe Links overview for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/safe-links?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [View email security reports](/microsoft-365/security/office-365-security/view-email-security-reports?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [View mail flow reports in the Reports dashboard](/microsoft-365/security/office-365-security/view-mail-flow-reports?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Manage who can create Microsoft 365 Groups](/microsoft-365/solutions/manage-creation-of-groups?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Use Microsoft OneDrive Learning Tools Interoperability](/microsoft-365/lti/onedrive-lti?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [DeviceInfo table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-deviceinfo-table?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [View your bill or invoice](/microsoft-365/commerce/billing-and-payments/view-your-bill-or-invoice?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Device management roadmap for Microsoft 365](/microsoft-365/enterprise/device-management-roadmap-microsoft-365?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Windows security updates report](/microsoft-365/managed-desktop/working-with-managed-desktop/security-updates-report?view=o365-21vianet) \| modified \| +\| 1/4/2022 \| [Step 4. Deploy endpoint management for your devices, PCs, and other endpoints](/microsoft-365/solutions/empower-people-to-work-remotely-manage-endpoints?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Capabilities of Basic Mobility and Security](/microsoft-365/admin/basic-mobility-security/capabilities?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Learn about Microsoft 365 Endpoint data loss prevention](/microsoft-365/compliance/endpoint-dlp-learn-about?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Get started with insider risk management](/microsoft-365/compliance/insider-risk-management-configure?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Insider risk management in Microsoft 365](/microsoft-365/compliance/insider-risk-management-solution-overview?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Microsoft 365 Lighthouse and Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-lighthouse-integration?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [DeviceInfo table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-deviceinfo-table?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [About the Microsoft Defender for Office 365 trial](/microsoft-365/security/office-365-security/about-defender-for-office-365-trial?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Simulation automations for Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-simulation-automations?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Simulate a phishing attack with Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/attack-simulation-training?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Configure anti-malware policies](/microsoft-365/security/office-365-security/configure-anti-malware-policies?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Configure the default connection filter policy](/microsoft-365/security/office-365-security/configure-the-connection-filter-policy?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Configure outbound spam filtering](/microsoft-365/security/office-365-security/configure-the-outbound-spam-policy?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Configure spam filter policies](/microsoft-365/security/office-365-security/configure-your-spam-filter-policies?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Create blocked sender lists](/microsoft-365/security/office-365-security/create-block-sender-lists-in-office-365?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Email authentication in Microsoft 365](/microsoft-365/security/office-365-security/email-validation-and-authentication?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Common Zero Trust identity and device access policies - Microsoft 365 for enterprise \\| Microsoft Docs](/microsoft-365/security/office-365-security/identity-access-policies?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [New domains being forwarded email insight](/microsoft-365/security/office-365-security/mfi-new-domains-being-forwarded-email?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Step-by-step threat protection stack in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/protection-stack-microsoft-defender-for-office365?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Quarantined messages FAQ](/microsoft-365/security/office-365-security/quarantine-faq?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Complete Safe Links overview for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/safe-links?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Secure email recommended policies - Microsoft 365 for enterprise \\| Microsoft Docs](/microsoft-365/security/office-365-security/secure-email-recommended-policies?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Anti-phishing policies](/microsoft-365/security/office-365-security/set-up-anti-phishing-policies?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [User reported message settings](/microsoft-365/security/office-365-security/user-submission?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [View email security reports](/microsoft-365/security/office-365-security/view-email-security-reports?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Zero-hour auto purge in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Microsoft 365 Reports in the admin center - OneDrive for Business usage](/microsoft-365/admin/activity-reports/onedrive-for-business-usage-ww?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Set an individual user's password to never expire](/microsoft-365/admin/add-users/set-password-to-never-expire?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Manage add-ins in the admin center](/microsoft-365/admin/manage/manage-addins-in-the-admin-center?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Message center](/microsoft-365/admin/manage/message-center?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Add staff to Bookings](/microsoft-365/bookings/add-staff?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Flowchart to determine when an item will be retained or permanently deleted](/microsoft-365/compliance/retention-flowchart?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Learn about retention for Teams](/microsoft-365/compliance/retention-policies-teams?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Learn about retention for Yammer](/microsoft-365/compliance/retention-policies-yammer?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Search the audit log in the Microsoft 365 compliance center](/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [What's new in Microsoft 365 compliance](/microsoft-365/compliance/whats-new?view=o365-21vianet) \| modified \| +\| 1/5/2022 \| [Cross-tenant mailbox migration](/microsoft-365/enterprise/cross-tenant-mailbox-migration?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Download documents from a review set](/microsoft-365/compliance/download-documents-from-review-set?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Use Advanced Audit to investigate compromised accounts](/microsoft-365/compliance/mailitemsaccessed-forensics-investigations?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Work with communications in Advanced eDiscovery](/microsoft-365/compliance/managing-custodian-communications?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Get help and support for Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-get-help?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Get started using Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-get-started?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Manage devices in Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-manage-devices?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Overview of Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-overview?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Reports in Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-reports?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Respond to and mitigate threats in Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-respond-mitigate-threats?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Review remediation actions in Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-review-remediation-actions?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Assign roles and permissions in Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-roles-permissions?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Set up and configure Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-setup-configuration?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [The simplified configuration process in Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-simplified-configuration?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Tutorials and simulations in Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-tutorials?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [View or edit policies in Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-view-edit-create-policies?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [View and manage incidents in Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-view-manage-incidents?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Onboard Windows devices to Microsoft Defender for Endpoint via Group Policy](/microsoft-365/security/defender-endpoint/configure-endpoints-gp?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Onboard Windows devices using a local script](/microsoft-365/security/defender-endpoint/configure-endpoints-script?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Onboard Windows servers to the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/configure-server-endpoints?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Enable SIEM integration in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/enable-siem-integration?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Create indicators for IPs and URLs/domains](/microsoft-365/security/defender-endpoint/indicator-ip-domain?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Manage indicators](/microsoft-365/security/defender-endpoint/indicator-manage?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Deploy Microsoft Defender for Endpoint on Linux with Ansible](/microsoft-365/security/defender-endpoint/linux-install-with-ansible?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Investigate entities on devices using live response in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/live-response?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Set up the Microsoft Defender for Endpoint on macOS policies in Jamf Pro](/microsoft-365/security/defender-endpoint/mac-jamfpro-policies?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-linux?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-mac?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Minimum requirements for Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/minimum-requirements?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Troubleshoot onboarding issues related to Security Management for Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/troubleshoot-security-config-mgt?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Microsoft 365 Defender prerequisites](/microsoft-365/security/defender/prerequisites?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Address compromised user accounts with automated investigation and response](/microsoft-365/security/office-365-security/address-compromised-users-quickly?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Admin review for reported messages](/microsoft-365/security/office-365-security/admin-review-reported-message?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Manage submissions](/microsoft-365/security/office-365-security/admin-submission?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [How to report false positives or false negatives following automated investigation in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/air-report-false-positives-negatives?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Review and manage remediation actions in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/air-review-approve-pending-completed-actions?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Alerts in the Microsoft 365 Defender portal](/microsoft-365/security/office-365-security/alerts?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Get started using Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-get-started?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Insights and reports Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-insights?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Create custom payloads for Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-payloads?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Simulate a phishing attack with Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/attack-simulation-training?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Campaign Views in Microsoft Defender for Office 365 Plan](/microsoft-365/security/office-365-security/campaigns?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Configuration analyzer for security policies](/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Configure the delivery of third-party phishing simulations to users and unfiltered messages to SecOps mailboxes](/microsoft-365/security/office-365-security/configure-advanced-delivery?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Configure anti-malware policies](/microsoft-365/security/office-365-security/configure-anti-malware-policies?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Configure anti-phishing policies in EOP](/microsoft-365/security/office-365-security/configure-anti-phishing-policies-eop?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Configure global settings for Safe Links settings in Defender for Office 365](/microsoft-365/security/office-365-security/configure-global-settings-for-safe-links?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Configure anti-phishing policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/configure-mdo-anti-phishing-policies?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Configure the default connection filter policy](/microsoft-365/security/office-365-security/configure-the-connection-filter-policy?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Configure outbound spam filtering](/microsoft-365/security/office-365-security/configure-the-outbound-spam-policy?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Configure spam filter policies](/microsoft-365/security/office-365-security/configure-your-spam-filter-policies?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/defender-for-office-365?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Detect and Remediate Illicit Consent Grants](/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Email security with Threat Explorer in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/email-security-in-microsoft-defender?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Find and release quarantined messages as a user](/microsoft-365/security/office-365-security/find-and-release-quarantined-messages-as-a-user?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Impersonation insight](/microsoft-365/security/office-365-security/impersonation-insight?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Use Microsoft Defender for Office 365 together with Microsoft Defender for Endpoint](/microsoft-365/security/office-365-security/integrate-office-365-ti-with-mde?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Investigate malicious email that was delivered in Microsoft 365, Find and investigate malicious email](/microsoft-365/security/office-365-security/investigate-malicious-email-that-was-delivered?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Spoof intelligence insight](/microsoft-365/security/office-365-security/learn-about-spoof-intelligence?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Mail flow intelligence](/microsoft-365/security/office-365-security/mail-flow-intelligence-in-office-365?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Manage quarantined messages and files as an admin](/microsoft-365/security/office-365-security/manage-quarantined-messages-and-files?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [The Microsoft Defender for Office 365 email entity page](/microsoft-365/security/office-365-security/mdo-email-entity-page?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Message trace in the Microsoft 365 Defender portal](/microsoft-365/security/office-365-security/message-trace-scc?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Queues insight in the Mail flow dashboard](/microsoft-365/security/office-365-security/mfi-queue-alerts-and-queues?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Fix slow mail flow rules insight](/microsoft-365/security/office-365-security/mfi-slow-mail-flow-rules-insight?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Automated investigation and response in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/office-365-air?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Evaluate Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/office-365-evaluation?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Threat investigation & response capabilities - Microsoft Defender for Office 365 Plan 2](/microsoft-365/security/office-365-security/office-365-ti?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Permissions - Security & Compliance Center](/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Permissions in the Microsoft 365 Defender portal](/microsoft-365/security/office-365-security/permissions-microsoft-365-security-center?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Preset security policies](/microsoft-365/security/office-365-security/preset-security-policies?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Threat Explorer and Real-time detections basics in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/real-time-detections?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Remove blocked users from the Restricted users portal](/microsoft-365/security/office-365-security/removing-user-from-restricted-users-portal-after-spam?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Responding to a Compromised Email Account](/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Safe Documents in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/safe-docs?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Security recommendations for priority accounts in Microsoft 365, priority accounts, priority accounts in Office 365, priority accounts in Microsoft 365](/microsoft-365/security/office-365-security/security-recommendations-for-priority-accounts?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Set up Safe Attachments policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/set-up-safe-attachments-policies?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Set up Safe Links policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/set-up-safe-links-policies?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Manage your allows and blocks in the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Threat Explorer and Real-time detections](/microsoft-365/security/office-365-security/threat-explorer?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Threat hunting in Threat Explorer for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/threat-hunting-in-threat-explorer?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Threat Trackers - New and Noteworthy](/microsoft-365/security/office-365-security/threat-trackers?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Microsoft Defender for Office 365 trial playbook](/microsoft-365/security/office-365-security/trial-playbook-defender-for-office-365?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](/microsoft-365/security/office-365-security/turn-on-mdo-for-spo-odb-and-teams?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [How to use DKIM for email in your custom domain](/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Use Azure Privileged Identity Management (PIM) in Microsoft Defender for Office 365 to limit admin access to cyber security tools.](/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [User reported message settings](/microsoft-365/security/office-365-security/user-submission?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [User tags in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/user-tags?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [View email security reports](/microsoft-365/security/office-365-security/view-email-security-reports?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [View mail flow reports in the Reports dashboard](/microsoft-365/security/office-365-security/view-mail-flow-reports?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [View Defender for Office 365 reports](/microsoft-365/security/office-365-security/view-reports-for-mdo?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Manage spoofed senders using the spoof intelligence policy and spoof intelligence insight](/microsoft-365/security/office-365-security/walkthrough-spoof-intelligence-insight?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Overview of importing your organization's PST files](/microsoft-365/compliance/importing-pst-files-to-office-365?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Learn about retention for Yammer](/microsoft-365/compliance/retention-policies-yammer?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Explanation types in Microsoft SharePoint Syntex](/microsoft-365/contentunderstanding/explanation-types-overview) \| modified \| +\| 1/6/2022 \| Batch apply model \| removed \| +\| 1/6/2022 \| BatchDelete \| removed \| +\| 1/6/2022 \| Create file classification request \| removed \| +\| 1/6/2022 \| Create folder classification request \| removed \| +\| 1/6/2022 \| Create model \| removed \| +\| 1/6/2022 \| GetByTitle \| removed \| +\| 1/6/2022 \| GetByUniqueId \| removed \| +\| 1/6/2022 \| Get model and library info \| removed \| +\| 1/6/2022 \| UpdateModelSettings \| removed \| +\| 1/6/2022 \| SharePoint Syntex document understanding model REST API \| removed \| +\| 1/6/2022 \| [Data move general FAQ](/microsoft-365/enterprise/data-move-faq?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| +\| 1/6/2022 \| [Microsoft Defender Antivirus compatibility with other security products](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Microsoft 365 alert policies](/microsoft-365/compliance/alert-policies?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [How to retrain a classifier in content explorer](/microsoft-365/compliance/classifier-how-to-retrain-content-explorer?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Learn about trainable classifiers](/microsoft-365/compliance/classifier-learn-about?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [DLP policy conditions, exceptions, and actions](/microsoft-365/compliance/dlp-conditions-and-exceptions?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Insider risk management settings](/microsoft-365/compliance/insider-risk-management-settings?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Onboard Windows servers to the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/configure-server-endpoints?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Become a Microsoft Defender for Endpoint partner](/microsoft-365/security/defender-endpoint/get-started-partner-integration?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| Get user information API \| removed \| +\| 1/7/2022 \| [Microsoft Defender Antivirus on Windows Server](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-on-windows-server?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Minimum requirements for Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/minimum-requirements?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Server migration scenarios for the new version of Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/server-migration?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Switch to Microsoft Defender for Endpoint - Setup](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Microsoft Defender Antivirus event IDs and error codes](/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Track your Microsoft Secure Score history and meet goals](/microsoft-365/security/defender/microsoft-secure-score-history-metrics-trends?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Microsoft 365 productivity illustrations](/microsoft-365/solutions/productivity-illustrations?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Determine if Centralized Deployment of add-ins works for your organization](/microsoft-365/admin/manage/centralized-deployment-of-add-ins?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Advanced Audit in Microsoft 365](/microsoft-365/compliance/advanced-audit?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Set up historical versions in Advanced eDiscovery](/microsoft-365/compliance/advanced-ediscovery-historical-versions?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Assign eDiscovery permissions in the Microsoft 365 compliance center](/microsoft-365/compliance/assign-ediscovery-permissions?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Set up attorney-client privilege detection in Advanced eDiscovery](/microsoft-365/compliance/attorney-privilege-detection?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Review conversations in Advanced eDiscovery](/microsoft-365/compliance/conversation-review-sets?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Create a Litigation hold](/microsoft-365/compliance/create-a-litigation-hold?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [De-duplication in eDiscovery search results](/microsoft-365/compliance/de-duplication-in-ediscovery-search-results?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Detailed properties in the audit log](/microsoft-365/compliance/detailed-properties-in-the-office-365-audit-log?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Differences between estimated and actual eDiscovery search results](/microsoft-365/compliance/differences-between-estimated-and-actual-ediscovery-search-results?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Document metadata fields in Advanced eDiscovery](/microsoft-365/compliance/document-metadata-fields-in-advanced-ediscovery?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [CJK/Double Byte support for Advanced eDiscovery](/microsoft-365/compliance/ediscovery-cjk-support?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Decryption in eDiscovery](/microsoft-365/compliance/ediscovery-decryption?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Collect eDiscovery diagnostic information](/microsoft-365/compliance/ediscovery-diagnostic-info?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Investigating partially indexed items in eDiscovery](/microsoft-365/compliance/investigating-partially-indexed-items-in-ediscovery?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Limits in core eDiscovery case](/microsoft-365/compliance/limits-core-ediscovery?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Limits for Content search and Core eDiscovery in the compliance center](/microsoft-365/compliance/limits-for-content-search?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Manage jobs in Advanced eDiscovery](/microsoft-365/compliance/managing-jobs-ediscovery20?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Partially indexed items in Content Search and other eDiscovery tools](/microsoft-365/compliance/partially-indexed-items-in-content-search?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Configure permissions filtering for eDiscovery](/microsoft-365/compliance/permissions-filtering-for-content-search?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Preserve Bcc and expanded distribution group recipients for eDiscovery](/microsoft-365/compliance/preserve-bcc-and-expanded-distribution-group-recipients-for-ediscovery?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Search for Teams chat data for on-premises users](/microsoft-365/compliance/search-cloud-based-mailboxes-for-on-premises-users?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Search for content](/microsoft-365/compliance/search-for-content?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Search for eDiscovery activities in the audit log](/microsoft-365/compliance/search-for-ediscovery-activities-in-the-audit-log?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Search statistics in Advance eDiscovery](/microsoft-365/compliance/search-statistics-in-advanced-ediscovery?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Supported file types in Advanced eDiscovery](/microsoft-365/compliance/supported-filetypes-ediscovery20?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [View documents in a review set in Advanced eDiscovery](/microsoft-365/compliance/view-documents-in-review-set?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [View statistics for eDiscovery search results](/microsoft-365/compliance/view-keyword-statistics-for-content-search?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Access the Admin portal](/microsoft-365/managed-desktop/get-started/access-admin-portal?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Microsoft 365 Zero Trust deployment plan](/microsoft-365/security/microsoft-365-zero-trust?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Email security with Threat Explorer in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/email-security-in-microsoft-defender?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [The Microsoft Defender for Office 365 email entity page](/microsoft-365/security/office-365-security/mdo-email-entity-page?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Threat Explorer and Real-time detections basics in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/real-time-detections?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Threat hunting in Threat Explorer for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/threat-hunting-in-threat-explorer?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Step 1. Implement App Protection Policies](/microsoft-365/solutions/manage-devices-with-intune-app-protection?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Step 3. Set up compliance policies for devices with Intune](/microsoft-365/solutions/manage-devices-with-intune-compliance-policies?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Step 5. Deploy device profiles in Microsoft Intune](/microsoft-365/solutions/manage-devices-with-intune-configuration-profiles?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Step 7. Implement data loss prevention (DLP) with information protection capabilities](/microsoft-365/solutions/manage-devices-with-intune-dlp-mip?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Step 2. Enroll devices into management with Intune](/microsoft-365/solutions/manage-devices-with-intune-enroll?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Step 6. Monitor device risk and compliance to security baselines](/microsoft-365/solutions/manage-devices-with-intune-monitor-risk?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Manage devices with Intune](/microsoft-365/solutions/manage-devices-with-intune-overview?view=o365-21vianet) \| modified \| +\| 1/7/2022 \| [Step 4. Require healthy and compliant devices with Intune](/microsoft-365/solutions/manage-devices-with-intune-require-compliance?view=o365-21vianet) \| modified \| ++ ## Week of December 20, 2021 \| 12/10/2021 \| [View Defender for Office 365 reports](/microsoft-365/security/office-365-security/view-reports-for-mdo?view=o365-21vianet) \| modified \| \| 12/10/2021 \| [Allow members to send as or send on behalf of a group](/microsoft-365/solutions/allow-members-to-send-as-or-send-on-behalf-of-group?view=o365-21vianet) \| modified \| \| 12/10/2021 \| [Manage who can create Microsoft 365 Groups](/microsoft-365/solutions/manage-creation-of-groups?view=o365-21vianet) \| modified \|-- -## Week of November 29, 2021 -- -\| Published On \|Topic title \| Change \| -\|\|\|--\| -\| 11/29/2021 \| [Archive third-party data](/microsoft-365/compliance/archiving-third-party-data?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Document metadata fields in Advanced eDiscovery](/microsoft-365/compliance/document-metadata-fields-in-advanced-ediscovery?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Microsoft 365 data locations](/microsoft-365/enterprise/o365-data-locations?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [ASR rules deployment phase 1 - plan](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-phase-1?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [ASR rules deployment phase 2 - test](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-phase-2?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [ASR rules deployment phase 3 - implement](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-phase-3?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [ASR rules deployment phase 4 - operationalize](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-phase-4?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Deploy attack surface reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Configure and manage Microsoft Threat Experts capabilities](/microsoft-365/security/defender-endpoint/configure-microsoft-threat-experts?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Configure alert notifications that are sent to MSSPs](/microsoft-365/security/defender-endpoint/configure-mssp-notifications?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Configure managed security service provider support](/microsoft-365/security/defender-endpoint/configure-mssp-support?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Configure and validate Microsoft Defender Antivirus network connections](/microsoft-365/security/defender-endpoint/configure-network-connections-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Configure Microsoft Defender Antivirus notifications](/microsoft-365/security/defender-endpoint/configure-notifications-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Configure exclusions for files opened by specific processes](/microsoft-365/security/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Enable and configure Microsoft Defender Antivirus protection features](/microsoft-365/security/defender-endpoint/configure-protection-features-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Configure device proxy and Internet connection settings](/microsoft-365/security/defender-endpoint/configure-proxy-internet?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Enable and configure Microsoft Defender Antivirus protection capabilities](/microsoft-365/security/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Configure remediation for Microsoft Defender Antivirus detections](/microsoft-365/security/defender-endpoint/configure-remediation-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Onboard Windows servers to the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/configure-server-endpoints?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Configure Microsoft Defender Antivirus exclusions on Windows Server](/microsoft-365/security/defender-endpoint/configure-server-exclusions-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Integrate your SIEM tools with Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/configure-siem?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Create a custom gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/configure-updates?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Configure vulnerability email notifications in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/configure-vulnerability-email-notifications?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Connected applications in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/connected-applications?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Contact Microsoft Defender for Endpoint support](/microsoft-365/security/defender-endpoint/contact-support?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Protect important folders from ransomware from encrypting your files with controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Create alert from event API](/microsoft-365/security/defender-endpoint/create-alert-by-reference?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Customize attack surface reduction rules](/microsoft-365/security/defender-endpoint/customize-attack-surface-reduction?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Customize controlled folder access](/microsoft-365/security/defender-endpoint/customize-controlled-folders?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Customize exploit protection](/microsoft-365/security/defender-endpoint/customize-exploit-protection?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Run and customize scheduled and on-demand scans.](/microsoft-365/security/defender-endpoint/customize-run-review-remediate-scans-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Data collection for advanced troubleshooting on Windows](/microsoft-365/security/defender-endpoint/data-collection-analyzer?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Verify data storage location and update data retention settings](/microsoft-365/security/defender-endpoint/data-retention-settings?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Endpoint detection and response in block mode](/microsoft-365/security/defender-endpoint/edr-in-block-mode?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Turn on network protection](/microsoft-365/security/defender-endpoint/enable-network-protection?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Create indicators for IPs and URLs/domains](/microsoft-365/security/defender-endpoint/indicator-ip-domain?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Manage indicators](/microsoft-365/security/defender-endpoint/indicator-manage?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Use sensitivity labels to prioritize incident response](/microsoft-365/security/defender-endpoint/information-protection-investigation?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Start Investigation API](/microsoft-365/security/defender-endpoint/initiate-autoir-investigation?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Investigate Microsoft Defender for Endpoint alerts](/microsoft-365/security/defender-endpoint/investigate-alerts?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Investigate connection events that occur behind forward proxies](/microsoft-365/security/defender-endpoint/investigate-behind-proxy?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Investigate Microsoft Defender for Endpoint domains](/microsoft-365/security/defender-endpoint/investigate-domain?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Investigate Microsoft Defender for Endpoint files](/microsoft-365/security/defender-endpoint/investigate-files?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Investigate incidents in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/investigate-incidents?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Investigate an IP address associated with an alert](/microsoft-365/security/defender-endpoint/investigate-ip?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Investigate devices in the Defender for Endpoint Devices list](/microsoft-365/security/defender-endpoint/investigate-machines?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Investigate a user account in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/investigate-user?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Investigation resource type](/microsoft-365/security/defender-endpoint/investigation?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Configure Microsoft Defender for Endpoint on iOS features](/microsoft-365/security/defender-endpoint/ios-configure-features?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Deploy Microsoft Defender for Endpoint on iOS features](/microsoft-365/security/defender-endpoint/ios-install-unmanaged?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [App-based deployment for Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-install?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Privacy information - Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-privacy?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Microsoft Defender for Endpoint on iOS Application license terms](/microsoft-365/security/defender-endpoint/ios-terms?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Troubleshoot issues and find answers on FAQs related to Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-troubleshoot?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [What's new in Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-whatsnew?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Isolate machine API](/microsoft-365/security/defender-endpoint/isolate-machine?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Enable the limited periodic Microsoft Defender Antivirus scanning feature](/microsoft-365/security/defender-endpoint/limited-periodic-scanning-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [How to Deploy Defender for Endpoint on Linux with Chef](/microsoft-365/security/defender-endpoint/linux-deploy-defender-for-endpoint-with-chef?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Configure and validate exclusions for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-exclusions?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Enable the Report Message or the Report Phishing add-ins](/microsoft-365/security/office-365-security/enable-the-report-message-add-in?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Report false positives and false negatives in Outlook](/microsoft-365/security/office-365-security/report-false-positives-and-false-negatives?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Manage Microsoft Defender for Endpoint using Configuration Manager](/microsoft-365/security/defender-endpoint/manage-mde-post-migration-configuration-manager?view=o365-21vianet) \| renamed \| -\| 11/29/2021 \| [Manage Microsoft Defender for Endpoint using Group Policy Objects](/microsoft-365/security/defender-endpoint/manage-mde-post-migration-group-policy-objects?view=o365-21vianet) \| renamed \| -\| 11/29/2021 \| [Manage Microsoft Defender for Endpoint using Intune](/microsoft-365/security/defender-endpoint/manage-mde-post-migration-intune?view=o365-21vianet) \| renamed \| -\| 11/29/2021 \| [Manage Microsoft Defender for Endpoint using PowerShell, WMI, and MPCmdRun.exe](/microsoft-365/security/defender-endpoint/manage-mde-post-migration-other-tools?view=o365-21vianet) \| renamed \| -\| 11/29/2021 \| [Manage Microsoft Defender for Endpoint post migration](/microsoft-365/security/defender-endpoint/manage-mde-post-migration?view=o365-21vianet) \| renamed \| -\| 11/29/2021 \| [Make the switch from non-Microsoft endpoint protection to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/switch-to-mde-overview?view=o365-21vianet) \| renamed \| -\| 11/29/2021 \| [Switch to Microsoft Defender for Endpoint - Prepare](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-1?view=o365-21vianet) \| renamed \| -\| 11/29/2021 \| [Switch to Microsoft Defender for Endpoint - Setup](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2?view=o365-21vianet) \| renamed \| -\| 11/29/2021 \| [Switch to Microsoft Defender for Endpoint - Onboard](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-3?view=o365-21vianet) \| renamed \| -\| 11/29/2021 \| [Troubleshooting issues when switching to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/switch-to-mde-troubleshooting?view=o365-21vianet) \| added \| -\| 11/29/2021 \| [Manage active content in Office documents for IT admins](/microsoft-365/security/active-content-in-trusted-docs?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Use the command line to manage Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/command-line-arguments-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Address false positives/negatives in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/defender-endpoint-false-positives-negatives?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Microsoft Defender for Endpoint evaluation lab](/microsoft-365/security/defender-endpoint/evaluation-lab?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Manage Microsoft Defender for Endpoint Plan 1](/microsoft-365/security/defender-endpoint/mde-p1-maintenance-operations?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Migration guides to make the switch to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/migration-guides?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Advanced hunting query best practices in Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-best-practices?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Advanced hunting example for Microsoft Defender for Office 365](/microsoft-365/security/defender/advanced-hunting-example?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Find ransomware with advanced hunting](/microsoft-365/security/defender/advanced-hunting-find-ransomware?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Get relevant info about an entity with go hunt](/microsoft-365/security/defender/advanced-hunting-go-hunt?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Link query results to an incident](/microsoft-365/security/defender/advanced-hunting-link-to-incident?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Migrate advanced hunting queries from Microsoft Defender for Endpoint](/microsoft-365/security/defender/advanced-hunting-migrate-from-mde?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Learn the advanced hunting query language in Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-query-language?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Microsoft 365 Defender incidents APIs and the incidents resource type](/microsoft-365/security/defender/api-incident?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Microsoft 365 solution and architecture center # < 60 chars](/microsoft-365/solutions/index?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Step 1. Implement App Protection Policies](/microsoft-365/solutions/manage-devices-with-intune-app-protection?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Step 7. Implement data loss prevention (DLP) with information protection capabilities](/microsoft-365/solutions/manage-devices-with-intune-dlp-mip?view=o365-21vianet) \| modified \| -\| 11/29/2021 \| [Step 6. Monitor device risk and compliance to security baselines](/microsoft-365/solutions/manage-devices-with-intune-monitor-risk?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Set up a connector to import Epic EHR data](/microsoft-365/compliance/import-epic-data?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Set up a connector to import generic healthcare audit data](/microsoft-365/compliance/import-healthcare-data?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Learn about retention policies & labels to automatically retain or delete content](/microsoft-365/compliance/retention?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Switch to Microsoft Defender for Endpoint - Prepare](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-1?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Switch to Microsoft Defender for Endpoint - Setup](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Switch to Microsoft Defender for Endpoint - Onboard](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-3?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Troubleshooting issues when switching to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/switch-to-mde-troubleshooting?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Case study - Contoso quickly configures an inappropriate content policy for Microsoft Teams, Exchange, and Yammer communications](/microsoft-365/compliance/communication-compliance-case-study?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Get started with communication compliance](/microsoft-365/compliance/communication-compliance-configure?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Investigate and remediate communication compliance alerts](/microsoft-365/compliance/communication-compliance-investigate-remediate?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Create retention labels and apply them in apps to retain or delete content](/microsoft-365/compliance/create-apply-retention-labels?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Advanced indexing of custodian data](/microsoft-365/compliance/indexing-custodian-data?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Investigate insider risk management activities](/microsoft-365/compliance/insider-risk-management-activities?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Insider risk management cases](/microsoft-365/compliance/insider-risk-management-cases?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Get started with insider risk management](/microsoft-365/compliance/insider-risk-management-configure?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Insider risk management notice templates](/microsoft-365/compliance/insider-risk-management-notices?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Plan for insider risk management](/microsoft-365/compliance/insider-risk-management-plan?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Insider risk management policies](/microsoft-365/compliance/insider-risk-management-policies?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Insider risk management settings](/microsoft-365/compliance/insider-risk-management-settings?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Insider risk management Users dashboard](/microsoft-365/compliance/insider-risk-management-users?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Learn about retention for SharePoint and OneDrive](/microsoft-365/compliance/retention-policies-sharepoint?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Learn about retention for Teams](/microsoft-365/compliance/retention-policies-teams?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Configure retention settings to automatically retain or delete content](/microsoft-365/compliance/retention-settings?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| Adoption resources for Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Create a new topic in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Edit an existing topic in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Frequently asked questions about Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Get started with Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Introduction to Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Manage topics in the topic center in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Plan for Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Restrict access to topics in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Save a topic as a draft in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Manage topics at scale in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Use Microsoft Search to find topics in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Set up Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Use SharePoint taxonomy terms to create topics in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Topic center overview in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Change the name of the topic center in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Topic discovery and curation in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Manage topic discovery in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Get your environment ready for Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Manage topic visibility in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Microsoft Viva Topics overview \| removed \| -\| 11/30/2021 \| Roles in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Security and privacy in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Security trimming in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Manage topic permissions in Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Get started driving adoption of Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Run a trial of Microsoft Viva Topics \| removed \| -\| 11/30/2021 \| Configure Cornerstone OnDemand as a content source for Microsoft Viva Learning \| removed \| -\| 11/30/2021 \| Configure Go1 as a content source for Microsoft Viva Learning \| removed \| -\| 11/30/2021 \| Add learning management systems for Microsoft Viva Learning \| removed \| -\| 11/30/2021 \| Add other content providers for Microsoft Viva Learning \| removed \| -\| 11/30/2021 \| Configure Saba as a content source for Microsoft Viva Learning \| removed \| -\| 11/30/2021 \| Add SharePoint as a learning content source for Microsoft Viva Learning \| removed \| -\| 11/30/2021 \| Configure Skillsoft as a content source for Microsoft Viva Learning \| removed \| -\| 11/30/2021 \| Configure SAP SuccessFactors as a content source for Microsoft Viva Learning \| removed \| -\| 11/30/2021 \| Configure Udemy as a content source for Microsoft Viva Learning \| removed \| -\| 11/30/2021 \| Manage content sources for Microsoft Viva Learning in the Microsoft 365 admin center \| removed \| -\| 11/30/2021 \| Help and support \| removed \| -\| 11/30/2021 \| Introduction to Microsoft Viva Learning \| removed \| -\| 11/30/2021 \| Overview of Microsoft Viva Learning \| removed \| -\| 11/30/2021 \| Set up Microsoft Viva Learning in the Teams admin center \| removed \| -\| 11/30/2021 \| Understand terms and conditions \| removed \| -\| 11/30/2021 \| Manage content in the admin tab \| removed \| -\| 11/30/2021 \| [Manage quarantined messages and files as an admin](/microsoft-365/security/office-365-security/manage-quarantined-messages-and-files?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| [Set your test tasks](/microsoft-365/test-base/testtask?view=o365-21vianet) \| modified \| -\| 11/30/2021 \| Microsoft Viva # < 60 chars \| removed \| -\| 11/30/2021 \| Set up Microsoft Viva) \| removed \| -\| 11/30/2021 \| [Block user sign-in](/microsoft-365/lighthouse/m365-lighthouse-block-user-signin?view=o365-21vianet) \| added \| -\| 11/30/2021 \| [Reset user password](/microsoft-365/lighthouse/m365-lighthouse-reset-user-password?view=o365-21vianet) \| added \| -\| 11/30/2021 \| [Search for users](/microsoft-365/lighthouse/m365-lighthouse-search-for-users?view=o365-21vianet) \| added \| -\| 12/1/2021 \| [Sign up for Microsoft 365 Apps for business](/microsoft-365/admin/setup/signup--apps-business?view=o365-21vianet) \| added \| -\| 12/1/2021 \| [Sign up for Microsoft Teams as part of a business subscription](/microsoft-365/admin/simplified-signup/signup-teams-business-subscription?view=o365-21vianet) \| added \| -\| 12/1/2021 \| [Set up Microsoft 365 Business Standard with a new or existing domain](/microsoft-365/admin/setup/setup-business-standard?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [Invite users to Microsoft 365 Business Standard subscription](/microsoft-365/admin/simplified-signup/admin-invite-business-standard?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [Sign up for a Microsoft 365 Business Standard](/microsoft-365/admin/simplified-signup/signup-business-standard?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [Manage sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [Learn about sensitivity labels](/microsoft-365/compliance/sensitivity-labels?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [Manage your tenant list](/microsoft-365/lighthouse/m365-lighthouse-manage-tenant-list?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [Archive third-party data](/microsoft-365/compliance/archiving-third-party-data?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [Give mailbox permissions to another user - Admin Help](/microsoft-365/admin/add-users/give-mailbox-permissions-to-another-user?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [Determine if Centralized Deployment of add-ins works for your organization](/microsoft-365/admin/manage/centralized-deployment-of-add-ins?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [Add more SharePoint storage to your subscription](/microsoft-365/commerce/add-storage-space?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [IPv6 support in Microsoft 365 services](/microsoft-365/enterprise/ipv6-support?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [Microsoft Defender for Endpoint Device Control Removable Storage Access Control, removable storage media](/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [Manage Microsoft Defender for Endpoint configuration settings on devices with Microsoft Endpoint Manager](/microsoft-365/security/defender-endpoint/security-config-management?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [Safe Documents in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/safe-docs?view=o365-21vianet) \| modified \| -\| 12/1/2021 \| [Microsoft 365 solutions for the healthcare industry](/microsoft-365/solutions/healthcare-overview?view=o365-21vianet) \| added \| -\| 12/1/2021 \| [What's new in Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-whatsnew?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Sign up for a Microsoft 365 Business Standard](/microsoft-365/admin/simplified-signup/signup-business-standard?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Create and manage inactive mailboxes](/microsoft-365/compliance/create-and-manage-inactive-mailboxes?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Learn about inactive mailboxes](/microsoft-365/compliance/inactive-mailboxes-in-office-365?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Microsoft Information Governance in Microsoft 365](/microsoft-365/compliance/manage-information-governance?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Configure retention settings to automatically retain or delete content](/microsoft-365/compliance/retention-settings?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Use drive shipping to import your organization's PST files](/microsoft-365/compliance/use-drive-shipping-to-import-pst-files-to-office-365?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Use network upload to import your organization's PST files](/microsoft-365/compliance/use-network-upload-to-import-pst-files?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Microsoft 365 data locations](/microsoft-365/enterprise/o365-data-locations?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Microsoft 365 Security for Business Decision Makers (BDMs)](/microsoft-365/security/microsoft-365-security-for-bdm?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Microsoft 365 Zero Trust deployment plan](/microsoft-365/security/microsoft-365-zero-trust?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get alerts API](/microsoft-365/security/defender-endpoint/alerts?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Hello World for Microsoft Defender for Endpoint API](/microsoft-365/security/defender-endpoint/api-hello-world?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Microsoft Defender for Endpoint API release notes](/microsoft-365/security/defender-endpoint/api-release-notes?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Microsoft Defender for Endpoint API license and terms of use](/microsoft-365/security/defender-endpoint/api-terms-of-use?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Access the Microsoft Defender for Endpoint APIs](/microsoft-365/security/defender-endpoint/apis-intro?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Batch Update alert entities API](/microsoft-365/security/defender-endpoint/batch-update-alerts?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Common Microsoft Defender for Endpoint API errors](/microsoft-365/security/defender-endpoint/common-errors?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Configure Conditional Access in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Create alert from event API](/microsoft-365/security/defender-endpoint/create-alert-by-reference?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Delete Indicator API.](/microsoft-365/security/defender-endpoint/delete-ti-indicator-by-id?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Use Microsoft Defender for Endpoint APIs](/microsoft-365/security/defender-endpoint/exposed-apis-create-app-nativeapp?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Create an app to access Microsoft Defender for Endpoint without a user](/microsoft-365/security/defender-endpoint/exposed-apis-create-app-webapp?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Supported Microsoft Defender for Endpoint APIs](/microsoft-365/security/defender-endpoint/exposed-apis-list?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [File resource type](/microsoft-365/security/defender-endpoint/files?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get alert information by ID API](/microsoft-365/security/defender-endpoint/get-alert-info-by-id?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get alert related domains information](/microsoft-365/security/defender-endpoint/get-alert-related-domain-info?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get alert related files information](/microsoft-365/security/defender-endpoint/get-alert-related-files-info?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get alert-related IPs' information](/microsoft-365/security/defender-endpoint/get-alert-related-ip-info?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get alert related machine information](/microsoft-365/security/defender-endpoint/get-alert-related-machine-info?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get alert related user information](/microsoft-365/security/defender-endpoint/get-alert-related-user-info?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [List alerts API](/microsoft-365/security/defender-endpoint/get-alerts?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Export assessment methods and properties per device](/microsoft-365/security/defender-endpoint/get-assessment-methods-properties?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Export secure configuration assessment per device](/microsoft-365/security/defender-endpoint/get-assessment-secure-config?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Export software inventory assessment per device](/microsoft-365/security/defender-endpoint/get-assessment-software-inventory?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Export software vulnerabilities assessment per device](/microsoft-365/security/defender-endpoint/get-assessment-software-vulnerabilities?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get domain-related alerts API](/microsoft-365/security/defender-endpoint/get-domain-related-alerts?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get domain-related machines API](/microsoft-365/security/defender-endpoint/get-domain-related-machines?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get domain statistics API](/microsoft-365/security/defender-endpoint/get-domain-statistics?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get file information API](/microsoft-365/security/defender-endpoint/get-file-information?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get file-related alerts API](/microsoft-365/security/defender-endpoint/get-file-related-alerts?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get file-related machines API](/microsoft-365/security/defender-endpoint/get-file-related-machines?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get file statistics API](/microsoft-365/security/defender-endpoint/get-file-statistics?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get installed software](/microsoft-365/security/defender-endpoint/get-installed-software?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [List Investigations API](/microsoft-365/security/defender-endpoint/get-investigation-collection?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get Investigation object API](/microsoft-365/security/defender-endpoint/get-investigation-object?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get IP related alerts API](/microsoft-365/security/defender-endpoint/get-ip-related-alerts?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get IP statistics API](/microsoft-365/security/defender-endpoint/get-ip-statistics?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get machine by ID API](/microsoft-365/security/defender-endpoint/get-machine-by-id?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get machine logon users API](/microsoft-365/security/defender-endpoint/get-machine-log-on-users?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get machine related alerts API](/microsoft-365/security/defender-endpoint/get-machine-related-alerts?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [List machines API](/microsoft-365/security/defender-endpoint/get-machines?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [List Indicators API](/microsoft-365/security/defender-endpoint/get-ti-indicators-collection?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Import Indicators API](/microsoft-365/security/defender-endpoint/import-ti-indicators?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Start Investigation API](/microsoft-365/security/defender-endpoint/initiate-autoir-investigation?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Investigation resource type](/microsoft-365/security/defender-endpoint/investigation?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Machine resource type](/microsoft-365/security/defender-endpoint/machine?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Overview of management and APIs](/microsoft-365/security/defender-endpoint/management-apis?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Configure Microsoft Defender for Cloud Apps integration](/microsoft-365/security/defender-endpoint/microsoft-cloud-app-security-config?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-mac?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Supported managed security service providers](/microsoft-365/security/defender-endpoint/mssp-list?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Submit or Update Indicator API](/microsoft-365/security/defender-endpoint/post-ti-indicator?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Advanced Hunting API](/microsoft-365/security/defender-endpoint/run-advanced-query-api?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Indicator resource type](/microsoft-365/security/defender-endpoint/ti-indicator?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Update alert entity API](/microsoft-365/security/defender-endpoint/update-alert?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Create safe sender lists](/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Terms of use for the Microsoft Defender for Office 365 trial](/microsoft-365/security/office-365-security/defender-for-office-365-trial-terms-and-conditions?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Common Zero Trust identity and device access policies - Microsoft 365 for enterprise \\| Microsoft Docs](/microsoft-365/security/office-365-security/identity-access-policies?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Sending mail to Microsoft 365](/microsoft-365/security/office-365-security/sending-mail-to-office-365?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Microsoft cloud architecture models - enterprise resource planning](/microsoft-365/solutions/cloud-architecture-models?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Enable archive mailboxes in the Microsoft 365 compliance center](/microsoft-365/compliance/enable-archive-mailboxes?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Microsoft 365 Client App Support: Certificate-based Authentication](/microsoft-365/enterprise/microsoft-365-client-support-certificate-based-authentication?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Network configuration for Microsoft Managed Desktop](/microsoft-365/managed-desktop/get-ready/network?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Prerequisites for Microsoft Managed Desktop](/microsoft-365/managed-desktop/get-ready/prerequisites?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Address false positives/negatives in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/defender-endpoint-false-positives-negatives?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Protect security settings with tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Switch to Microsoft Defender for Endpoint - Onboard](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-3?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Configure spam filter policies](/microsoft-365/security/office-365-security/configure-your-spam-filter-policies?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Use Microsoft Defender for Office 365 together with Microsoft Defender for Endpoint](/microsoft-365/security/office-365-security/integrate-office-365-ti-with-mde?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Quarantined email messages](/microsoft-365/security/office-365-security/quarantine-email-messages?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Quarantine policies](/microsoft-365/security/office-365-security/quarantine-policies?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get started with communication compliance](/microsoft-365/compliance/communication-compliance-configure?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Plan for communication compliance](/microsoft-365/compliance/communication-compliance-plan?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Get started with insider risk management](/microsoft-365/compliance/insider-risk-management-configure?view=o365-21vianet) \| modified \| -\| 12/2/2021 \| [Plan for insider risk management](/microsoft-365/compliance/insider-risk-management-plan?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Review partner administrative privileges](/microsoft-365/commerce/review-partner-admin-privileges?view=o365-21vianet) \| added \| -\| 12/3/2021 \| [How to schedule scans with Microsoft Defender for Endpoint (Linux)](/microsoft-365/security/defender-endpoint/linux-schedule-scan-mde?view=o365-21vianet) \| renamed \| -\| 12/3/2021 \| [What's new in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint?view=o365-21vianet) \| renamed \| -\| 12/3/2021 \| [Learn about trainable classifiers](/microsoft-365/compliance/classifier-learn-about?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Other endpoints not included in the Office 365 IP Address and URL Web service](/microsoft-365/enterprise/additional-office365-ip-addresses-and-urls?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [How to configure Skype for Business on-premises to use Hybrid Modern Authentication](/microsoft-365/enterprise/configure-skype-for-business-for-hybrid-modern-authentication?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Hybrid Modern Authentication overview and prerequisites for use with on-premises Skype for Business and Exchange servers](/microsoft-365/enterprise/hybrid-modern-auth-overview?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [IPv6 support in Microsoft 365 services](/microsoft-365/enterprise/ipv6-support?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Microsoft 365 data locations](/microsoft-365/enterprise/o365-data-locations?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Microsoft 365 Lighthouse Device compliance page overview](/microsoft-365/lighthouse/m365-lighthouse-device-compliance-page-overview?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Microsoft 365 Zero Trust deployment plan](/microsoft-365/security/microsoft-365-zero-trust?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Add or Remove Machine Tags API](/microsoft-365/security/defender-endpoint/add-or-remove-machine-tags?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [API Explorer in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/api-explorer?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Microsoft Defender for Endpoint Flow connector](/microsoft-365/security/defender-endpoint/api-microsoft-flow?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Cancel machine action API](/microsoft-365/security/defender-endpoint/cancel-machine-action?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Collect investigation package API](/microsoft-365/security/defender-endpoint/collect-investigation-package?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Connected applications in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/connected-applications?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Enable SIEM integration in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/enable-siem-integration?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [OData queries with Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/exposed-apis-odata-samples?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Fetch alerts from MSSP customer tenant](/microsoft-365/security/defender-endpoint/fetch-alerts-mssp?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Find devices by internal IP API](/microsoft-365/security/defender-endpoint/find-machines-by-ip?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Find devices by tag API](/microsoft-365/security/defender-endpoint/find-machines-by-tag?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [List all recommendations](/microsoft-365/security/defender-endpoint/get-all-recommendations?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get all vulnerabilities by machine and software](/microsoft-365/security/defender-endpoint/get-all-vulnerabilities-by-machines?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get all vulnerabilities](/microsoft-365/security/defender-endpoint/get-all-vulnerabilities?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get device secure score](/microsoft-365/security/defender-endpoint/get-device-secure-score?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get discovered vulnerabilities](/microsoft-365/security/defender-endpoint/get-discovered-vulnerabilities?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get exposure score](/microsoft-365/security/defender-endpoint/get-exposure-score?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get live response results](/microsoft-365/security/defender-endpoint/get-live-response-result?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [List exposure score by device group](/microsoft-365/security/defender-endpoint/get-machine-group-exposure-score?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get MachineAction object API](/microsoft-365/security/defender-endpoint/get-machineaction-object?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [List machineActions API](/microsoft-365/security/defender-endpoint/get-machineactions-collection?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [List devices by software](/microsoft-365/security/defender-endpoint/get-machines-by-software?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [List devices by vulnerability](/microsoft-365/security/defender-endpoint/get-machines-by-vulnerability?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get missing KBs by device ID](/microsoft-365/security/defender-endpoint/get-missing-kbs-machine?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get missing KBs by software ID](/microsoft-365/security/defender-endpoint/get-missing-kbs-software?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get package SAS URI API](/microsoft-365/security/defender-endpoint/get-package-sas-uri?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get recommendation by Id](/microsoft-365/security/defender-endpoint/get-recommendation-by-id?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [List devices by recommendation](/microsoft-365/security/defender-endpoint/get-recommendation-machines?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [List vulnerabilities by recommendation](/microsoft-365/security/defender-endpoint/get-recommendation-vulnerabilities?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [List all remediation activities](/microsoft-365/security/defender-endpoint/get-remediation-all-activities?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [List exposed devices of one remediation activity](/microsoft-365/security/defender-endpoint/get-remediation-exposed-devices-activities?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Remediation activity methods and properties](/microsoft-365/security/defender-endpoint/get-remediation-methods-properties?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get one remediation activity by ID](/microsoft-365/security/defender-endpoint/get-remediation-one-activity?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get security recommendations](/microsoft-365/security/defender-endpoint/get-security-recommendations?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get software by ID](/microsoft-365/security/defender-endpoint/get-software-by-id?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [List software version distribution](/microsoft-365/security/defender-endpoint/get-software-ver-distribution?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [List software](/microsoft-365/security/defender-endpoint/get-software?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get user-related alerts API](/microsoft-365/security/defender-endpoint/get-user-related-alerts?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get user-related machines API](/microsoft-365/security/defender-endpoint/get-user-related-machines?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [List vulnerabilities by software](/microsoft-365/security/defender-endpoint/get-vuln-by-software?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Get vulnerability by ID](/microsoft-365/security/defender-endpoint/get-vulnerability-by-id?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Microsoft Defender for Endpoint documentation # < 60 chars](/microsoft-365/security/defender-endpoint/index?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Isolate machine API](/microsoft-365/security/defender-endpoint/isolate-machine?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [How to schedule an update of the Microsoft Defender for Endpoint (Linux)](/microsoft-365/security/defender-endpoint/linux-update-mde-linux?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [List software by recommendation](/microsoft-365/security/defender-endpoint/list-recommendation-software?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [machineAction resource type](/microsoft-365/security/defender-endpoint/machineaction?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Manage Microsoft Defender for Endpoint Plan 1](/microsoft-365/security/defender-endpoint/mde-p1-maintenance-operations?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-mac?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Offboard machine API](/microsoft-365/security/defender-endpoint/offboard-machine-api?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Partner applications in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/partner-applications?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Microsoft Defender for Endpoint preview features](/microsoft-365/security/defender-endpoint/preview?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Pull Microsoft Defender for Endpoint detections using REST API](/microsoft-365/security/defender-endpoint/pull-alerts-using-rest-api?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Stream Microsoft Defender for Endpoint events to Azure Event Hubs](/microsoft-365/security/defender-endpoint/raw-data-export-event-hub?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Stream Microsoft Defender for Endpoint events to your Storage account](/microsoft-365/security/defender-endpoint/raw-data-export-storage?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Stream Microsoft Defender for Endpoint event](/microsoft-365/security/defender-endpoint/raw-data-export?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Recommendation methods and properties](/microsoft-365/security/defender-endpoint/recommendation?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Restrict app execution API](/microsoft-365/security/defender-endpoint/restrict-code-execution?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Advanced Hunting with PowerShell API Basics](/microsoft-365/security/defender-endpoint/run-advanced-query-sample-powershell?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Advanced Hunting with Python API Guide](/microsoft-365/security/defender-endpoint/run-advanced-query-sample-python?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Run antivirus scan API](/microsoft-365/security/defender-endpoint/run-av-scan?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Run live response commands on a device](/microsoft-365/security/defender-endpoint/run-live-response?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Score methods and properties](/microsoft-365/security/defender-endpoint/score?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Set device value API](/microsoft-365/security/defender-endpoint/set-device-value?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Software methods and properties](/microsoft-365/security/defender-endpoint/software?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Specify the cloud protection level for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/specify-cloud-protection-level-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Stop and quarantine file API](/microsoft-365/security/defender-endpoint/stop-and-quarantine-file?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Understand threat intelligence concepts in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/threat-indicator-concepts?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Troubleshoot SIEM tool integration issues in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/troubleshoot-siem?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Update machine entity API](/microsoft-365/security/defender-endpoint/update-machine-method?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [User resource type](/microsoft-365/security/defender-endpoint/user?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Vulnerability methods and properties](/microsoft-365/security/defender-endpoint/vulnerability?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [What's new in Microsoft 365 Defender](/microsoft-365/security/defender/whats-new?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Safe Attachments](/microsoft-365/security/office-365-security/safe-attachments?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [What's new in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/whats-new-in-defender-for-office-365?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Top 12 tasks for security teams to support working from home](/microsoft-365/security/top-security-tasks-for-remote-work?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Step 1. Implement App Protection Policies](/microsoft-365/solutions/manage-devices-with-intune-app-protection?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Step 3. Set up compliance policies for devices with Intune](/microsoft-365/solutions/manage-devices-with-intune-compliance-policies?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Step 5. Deploy device profiles in Microsoft Intune](/microsoft-365/solutions/manage-devices-with-intune-configuration-profiles?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Step 7. Implement data loss prevention (DLP) with information protection capabilities](/microsoft-365/solutions/manage-devices-with-intune-dlp-mip?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Step 2. Enroll devices into management with Intune](/microsoft-365/solutions/manage-devices-with-intune-enroll?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Step 6. Monitor device risk and compliance to security baselines](/microsoft-365/solutions/manage-devices-with-intune-monitor-risk?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Manage devices with Intune](/microsoft-365/solutions/manage-devices-with-intune-overview?view=o365-21vianet) \| modified \| -\| 12/3/2021 \| [Step 4. Require healthy and compliant devices with Intune](/microsoft-365/solutions/manage-devices-with-intune-require-compliance?view=o365-21vianet) \| modified \| -- -## Week of November 22, 2021 -- -\| Published On \|Topic title \| Change \| -\|\|\|--\| -\| 11/22/2021 \| [New case format in Advanced eDiscovery](/microsoft-365/compliance/advanced-ediscovery-new-case-format?view=o365-21vianet) \| added \| -\| 11/22/2021 \| [Set the password expiration policy for your organization](/microsoft-365/admin/manage/set-password-expiration-policy?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Use a QR code to sign-in to the Outlook mobile apps](/microsoft-365/admin/manage/use-qr-code-download-outlook?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Collect cloud attachments in Advanced eDiscovery](/microsoft-365/compliance/advanced-ediscovery-cloud-attachments?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| Large cases in Advanced eDiscovery \| removed \| -\| 11/22/2021 \| [Analyze data in a review set in Advanced eDiscovery](/microsoft-365/compliance/analyzing-data-in-review-set?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Microsoft 365 compliance solutions trial playbook](/microsoft-365/compliance/compliance-easy-trials-compliance-playbook?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Create and manage Advanced eDiscovery cases in Microsoft 365](/microsoft-365/compliance/create-and-manage-advanced-ediscoveryv2-case?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Teams workflow in Advanced eDiscovery](/microsoft-365/compliance/teams-workflow-in-advanced-ediscovery?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [What's new in Microsoft 365 compliance](/microsoft-365/compliance/whats-new?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Cross-tenant mailbox migration](/microsoft-365/enterprise/cross-tenant-mailbox-migration?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Setup guides for Microsoft 365 and Office 365 services](/microsoft-365/enterprise/setup-guides-for-microsoft-365?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Protect information subject to data privacy regulation](/microsoft-365/solutions/information-protection-deploy-protect-information?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Adoption resources for Microsoft Viva Topics](/microsoft-365/knowledge/adoption-resources) \| added \| -\| 11/22/2021 \| [Save a topic as a draft in Microsoft Viva Topics](/microsoft-365/knowledge/save-topic-as-draft) \| added \| -\| 11/22/2021 \| [Onboard Windows servers to the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/configure-server-endpoints?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Microsoft Defender for Endpoint evaluation lab](/microsoft-365/security/defender-endpoint/evaluation-lab?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Manage indicators](/microsoft-365/security/defender-endpoint/indicator-manage?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Troubleshoot issues and find answers on FAQs related to Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-troubleshoot?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Set preferences for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-preferences?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-linux?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Minimum requirements for Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/minimum-requirements?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Submit or Update Indicator API](/microsoft-365/security/defender-endpoint/post-ti-indicator?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Overview of Microsoft Defender Security Center](/microsoft-365/security/defender-endpoint/use?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Microsoft Defender Antivirus on Windows Server](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-on-windows-server?view=o365-21vianet) \| added \| -\| 11/22/2021 \| [Import custodians to an Advanced eDiscovery case](/microsoft-365/compliance/bulk-add-custodians?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Advanced indexing of custodian data](/microsoft-365/compliance/indexing-custodian-data?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Manage custodians in an Advanced eDiscovery case](/microsoft-365/compliance/manage-new-custodians?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Manage holds in Advanced eDiscovery](/microsoft-365/compliance/managing-holds?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Configure and validate exclusions based on extension, name, or location](/microsoft-365/security/defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Block potentially unwanted applications with Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [See how Exploit protection works in a demo](/microsoft-365/security/defender-endpoint/evaluate-exploit-protection?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Apply Microsoft Defender Antivirus updates after certain events](/microsoft-365/security/defender-endpoint/manage-event-based-updates-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Apply Microsoft Defender AV protection updates to out of date endpoints](/microsoft-365/security/defender-endpoint/manage-outdated-endpoints-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Schedule Microsoft Defender Antivirus protection updates](/microsoft-365/security/defender-endpoint/manage-protection-update-schedule-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Manage how and where Microsoft Defender Antivirus receives updates](/microsoft-365/security/defender-endpoint/manage-protection-updates-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Microsoft Defender Offline in Windows](/microsoft-365/security/defender-endpoint/microsoft-defender-offline?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Review the results of Microsoft Defender Antivirus scans](/microsoft-365/security/defender-endpoint/review-scan-results-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Run and customize on-demand scans in Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/run-scan-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Schedule antivirus scans using PowerShell](/microsoft-365/security/defender-endpoint/schedule-antivirus-scans-powershell?view=o365-21vianet) \| modified \| -\| 11/22/2021 \| [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/use-powershell-cmdlets-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/23/2021 \| [Learn about Office 365 Germany](/microsoft-365/admin/admin-overview/learn-about-office-365-germany?view=o365-germany) \| modified \| -\| 11/23/2021 \| [Microsoft 365 alert policies](/microsoft-365/compliance/alert-policies?view=o365-21vianet) \| modified \| -\| 11/23/2021 \| [Manage custodians in an Advanced eDiscovery case](/microsoft-365/compliance/manage-new-custodians?view=o365-21vianet) \| modified \| -\| 11/23/2021 \| [Windows and Office 365 deployment lab kit](/microsoft-365/enterprise/modern-desktop-deployment-and-management-lab?view=o365-21vianet) \| modified \| -\| 11/23/2021 \| [Overview of Microsoft Defender for Endpoint Plan 1](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1?view=o365-21vianet) \| modified \| -\| 11/23/2021 \| [Manage content in the admin tab](/microsoft-365/learning/use-tabs?view=o365-21vianet) \| added \| -\| 11/23/2021 \| [Document understanding overview in Microsoft SharePoint Syntex](/microsoft-365/contentunderstanding/document-understanding-overview) \| modified \| -\| 11/23/2021 \| [Introduction to Microsoft SharePoint Syntex](/microsoft-365/contentunderstanding/index) \| modified \| -\| 11/23/2021 \| [Learn about document understanding models through the sample model in Microsoft SharePoint Syntex](/microsoft-365/contentunderstanding/learn-about-document-understanding-models-through-the-sample-model) \| modified \| -\| 11/23/2021 \| [Connect to all Microsoft 365 services in a single PowerShell window](/microsoft-365/enterprise/connect-to-all-microsoft-365-services-in-a-single-windows-powershell-window?view=o365-21vianet) \| modified \| -\| 11/23/2021 \| [Introduction to Microsoft Viva Topics](/microsoft-365/knowledge/index) \| modified \| -\| 11/23/2021 \| [Get your environment ready for Microsoft Viva Topics](/microsoft-365/knowledge/topic-experiences-get-ready) \| modified \| -\| 11/23/2021 \| [Microsoft Viva Topics overview](/microsoft-365/knowledge/topic-experiences-overview) \| modified \| -\| 11/23/2021 \| [Set up Microsoft Viva Learning in the Teams admin center](/microsoft-365/learning/set-up-viva-learning?view=o365-21vianet) \| modified \| -\| 11/23/2021 \| Information protection in Windows overview \| removed \| -\| 11/24/2021 \| [Give mailbox permissions to another user - Admin Help](/microsoft-365/admin/add-users/give-mailbox-permissions-to-another-user?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Records Management in Microsoft 365](/microsoft-365/compliance/records-management?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Learn about retention for SharePoint and OneDrive](/microsoft-365/compliance/retention-policies-sharepoint?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [During and after your data move](/microsoft-365/enterprise/during-and-after-your-data-move?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Moving core data to new Microsoft 365 datacenter geos](/microsoft-365/enterprise/moving-data-to-new-datacenter-geos?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft 365 data locations](/microsoft-365/enterprise/o365-data-locations?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [How to request your data move](/microsoft-365/enterprise/request-your-data-move?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Access the Microsoft 365 Defender MSSP customer portal](/microsoft-365/security/defender-endpoint/access-mssp-portal?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Add or Remove Machine Tags API](/microsoft-365/security/defender-endpoint/add-or-remove-machine-tags?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure advanced features in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/advanced-features?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [DeviceAlertEvents table in the advanced hunting schema](/microsoft-365/security/defender-endpoint/advanced-hunting-devicealertevents-table?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Overview of advanced hunting in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/advanced-hunting-overview?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Advanced hunting schema reference](/microsoft-365/security/defender-endpoint/advanced-hunting-schema-reference?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Alerts queue in Microsoft 365 Defender](/microsoft-365/security/defender-endpoint/alerts-queue-endpoint-detection-response?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [View and organize the Microsoft Defender for Endpoint Alerts queue](/microsoft-365/security/defender-endpoint/alerts-queue?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get alerts API](/microsoft-365/security/defender-endpoint/alerts?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Provide feedback on the Microsoft Defender for Endpoint Client Analyzer tool](/microsoft-365/security/defender-endpoint/analyzer-feedback?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Understand the client analyzer HTML report](/microsoft-365/security/defender-endpoint/analyzer-report?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure Microsoft Defender for Endpoint risk signals using App Protection Policies (MAM)](/microsoft-365/security/defender-endpoint/android-configure-mam?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure Microsoft Defender for Endpoint on Android features](/microsoft-365/security/defender-endpoint/android-configure?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](/microsoft-365/security/defender-endpoint/android-intune?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint on Android - Privacy information](/microsoft-365/security/defender-endpoint/android-privacy?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot issues on Microsoft Defender for Endpoint on Android](/microsoft-365/security/defender-endpoint/android-support-signin?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint on Android Application license terms](/microsoft-365/security/defender-endpoint/android-terms?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [API Explorer in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/api-explorer?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Hello World for Microsoft Defender for Endpoint API](/microsoft-365/security/defender-endpoint/api-hello-world?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint Flow connector](/microsoft-365/security/defender-endpoint/api-microsoft-flow?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint alert fields](/microsoft-365/security/defender-endpoint/api-portal-mapping?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint APIs connection to Power BI](/microsoft-365/security/defender-endpoint/api-power-bi?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint API release notes](/microsoft-365/security/defender-endpoint/api-release-notes?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint API license and terms of use](/microsoft-365/security/defender-endpoint/api-terms-of-use?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Access the Microsoft Defender for Endpoint APIs](/microsoft-365/security/defender-endpoint/apis-intro?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Assign user access to Microsoft Defender Security Center](/microsoft-365/security/defender-endpoint/assign-portal-access?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Use automated investigations to investigate and remediate threats](/microsoft-365/security/defender-endpoint/automated-investigations?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage Microsoft Defender Antivirus in your business](/microsoft-365/security/defender-endpoint/configuration-management-reference-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure scanning options for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/configure-advanced-scan-types-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure attack surface reduction capabilities](/microsoft-365/security/defender-endpoint/configure-attack-surface-reduction?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure automated investigation and remediation capabilities](/microsoft-365/security/defender-endpoint/configure-automated-investigations-remediation?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Enable block at first sight to detect malware in seconds](/microsoft-365/security/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure the Microsoft Defender Antivirus cloud block timeout period](/microsoft-365/security/defender-endpoint/configure-cloud-block-timeout-period-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure Conditional Access in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure device discovery](/microsoft-365/security/defender-endpoint/configure-device-discovery?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure alert notifications in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/configure-email-notifications?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboard Windows devices to Microsoft Defender for Endpoint via Group Policy](/microsoft-365/security/defender-endpoint/configure-endpoints-gp?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboard Windows devices using Mobile Device Management tools](/microsoft-365/security/defender-endpoint/configure-endpoints-mdm?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboard non-Windows devices to the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/configure-endpoints-non-windows?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboard Windows devices using Configuration Manager](/microsoft-365/security/defender-endpoint/configure-endpoints-sccm?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboard Windows devices using a local script](/microsoft-365/security/defender-endpoint/configure-endpoints-script?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboard non-persistent virtual desktop infrastructure (VDI) devices](/microsoft-365/security/defender-endpoint/configure-endpoints-vdi?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboarding tools and methods for Windows devices](/microsoft-365/security/defender-endpoint/configure-endpoints?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Set up exclusions for Microsoft Defender Antivirus scans](/microsoft-365/security/defender-endpoint/configure-exclusions-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure and validate exclusions based on extension, name, or location](/microsoft-365/security/defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure local overrides for Microsoft Defender Antivirus settings](/microsoft-365/security/defender-endpoint/configure-local-policy-overrides-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Optimize ASR rule deployment and detections](/microsoft-365/security/defender-endpoint/configure-machines-asr?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get devices onboarded to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/configure-machines-onboarding?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Increase compliance to the Microsoft Defender for Endpoint security baseline](/microsoft-365/security/defender-endpoint/configure-machines-security-baseline?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Ensure your devices are configured properly](/microsoft-365/security/defender-endpoint/configure-machines?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure Microsoft Defender Antivirus features](/microsoft-365/security/defender-endpoint/configure-microsoft-defender-antivirus-features?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboard Windows servers to the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/configure-server-endpoints?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint data storage and privacy](/microsoft-365/security/defender-endpoint/data-storage-privacy?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Antivirus solution compatibility with Defender for Endpoint](/microsoft-365/security/defender-endpoint/defender-compatibility?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Address false positives/negatives in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/defender-endpoint-false-positives-negatives?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Compare Microsoft Defender for Endpoint Plan 1 to Plan 2](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Overview of Microsoft Defender for Endpoint Plan 1](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Delete Indicator API.](/microsoft-365/security/defender-endpoint/delete-ti-indicator-by-id?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Deploy, manage, and report on Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/deploy-manage-report-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Deploy and enable Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/deploy-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Deployment phases](/microsoft-365/security/defender-endpoint/deployment-phases?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Deploy Microsoft Defender for Endpoint in rings](/microsoft-365/security/defender-endpoint/deployment-rings?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Plan your Microsoft Defender for Endpoint deployment](/microsoft-365/security/defender-endpoint/deployment-strategy?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender Antivirus Virtual Desktop Infrastructure deployment guide](/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Block potentially unwanted applications with Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint Device Control Removable Storage Access Control, removable storage media](/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint Device Control Removable Storage Protection](/microsoft-365/security/defender-endpoint/device-control-removable-storage-protection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Protect your organization's data with device control](/microsoft-365/security/defender-endpoint/device-control-report?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Device discovery frequently asked questions](/microsoft-365/security/defender-endpoint/device-discovery-faq?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Device discovery overview](/microsoft-365/security/defender-endpoint/device-discovery?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint device timeline event flags](/microsoft-365/security/defender-endpoint/device-timeline-event-flag?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Download the Microsoft Defender for Endpoint client analyzer](/microsoft-365/security/defender-endpoint/download-client-analyzer?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Endpoint detection and response in block mode](/microsoft-365/security/defender-endpoint/edr-in-block-mode?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Enable attack surface reduction rules](/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Turn on cloud protection in Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Enable controlled folder access](/microsoft-365/security/defender-endpoint/enable-controlled-folders?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Turn on exploit protection to help mitigate against attacks](/microsoft-365/security/defender-endpoint/enable-exploit-protection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Turn on network protection](/microsoft-365/security/defender-endpoint/enable-network-protection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Enable SIEM integration in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/enable-siem-integration?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Evaluate attack surface reduction rules](/microsoft-365/security/defender-endpoint/evaluate-attack-surface-reduction?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Evaluate controlled folder access](/microsoft-365/security/defender-endpoint/evaluate-controlled-folder-access?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Pilot Defender for Endpoint evaluation](/microsoft-365/security/defender-endpoint/evaluate-defender-endpoint-enable?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Evaluate Microsoft 365 Defender for Endpoint overview](/microsoft-365/security/defender-endpoint/evaluate-defender-endpoint-overview?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Experience Microsoft Defender for Endpoint (MDE) through simulated attacks](/microsoft-365/security/defender-endpoint/evaluate-defender-endpoint-pilot?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [See how Exploit protection works in a demo](/microsoft-365/security/defender-endpoint/evaluate-exploit-protection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Evaluate Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/evaluate-mde?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Evaluate Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/evaluate-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Evaluate network protection](/microsoft-365/security/defender-endpoint/evaluate-network-protection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint evaluation lab](/microsoft-365/security/defender-endpoint/evaluation-lab?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Review events and errors using Event Viewer](/microsoft-365/security/defender-endpoint/event-error-codes?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [View attack surface reduction events](/microsoft-365/security/defender-endpoint/event-views?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Exploit protection reference](/microsoft-365/security/defender-endpoint/exploit-protection-reference?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Apply mitigations to help prevent attacks through vulnerabilities](/microsoft-365/security/defender-endpoint/exploit-protection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Use Microsoft Defender for Endpoint APIs](/microsoft-365/security/defender-endpoint/exposed-apis-create-app-nativeapp?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Create an Application to access Microsoft Defender for Endpoint without a user](/microsoft-365/security/defender-endpoint/exposed-apis-create-app-partners?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Create an app to access Microsoft Defender for Endpoint without a user](/microsoft-365/security/defender-endpoint/exposed-apis-create-app-webapp?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Advanced Hunting with PowerShell API Guide](/microsoft-365/security/defender-endpoint/exposed-apis-full-sample-powershell?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Supported Microsoft Defender for Endpoint APIs](/microsoft-365/security/defender-endpoint/exposed-apis-list?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [OData queries with Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/exposed-apis-odata-samples?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Feedback-loop blocking](/microsoft-365/security/defender-endpoint/feedback-loop-blocking?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Fetch alerts from MSSP customer tenant](/microsoft-365/security/defender-endpoint/fetch-alerts-mssp?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [File resource type](/microsoft-365/security/defender-endpoint/files?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Find device information by internal IP API](/microsoft-365/security/defender-endpoint/find-machine-info-by-ip?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Find devices by internal IP API](/microsoft-365/security/defender-endpoint/find-machines-by-ip?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Find devices by tag API](/microsoft-365/security/defender-endpoint/find-machines-by-tag?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Fix unhealthy sensors in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/fix-unhealthy-sensors?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get alert information by ID API](/microsoft-365/security/defender-endpoint/get-alert-info-by-id?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get alert related domains information](/microsoft-365/security/defender-endpoint/get-alert-related-domain-info?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get alert related files information](/microsoft-365/security/defender-endpoint/get-alert-related-files-info?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get alert-related IPs' information](/microsoft-365/security/defender-endpoint/get-alert-related-ip-info?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get alert related machine information](/microsoft-365/security/defender-endpoint/get-alert-related-machine-info?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get alert related user information](/microsoft-365/security/defender-endpoint/get-alert-related-user-info?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List alerts API](/microsoft-365/security/defender-endpoint/get-alerts?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List all recommendations](/microsoft-365/security/defender-endpoint/get-all-recommendations?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get all vulnerabilities by machine and software](/microsoft-365/security/defender-endpoint/get-all-vulnerabilities-by-machines?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get all vulnerabilities](/microsoft-365/security/defender-endpoint/get-all-vulnerabilities?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Export assessment methods and properties per device](/microsoft-365/security/defender-endpoint/get-assessment-methods-properties?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Export secure configuration assessment per device](/microsoft-365/security/defender-endpoint/get-assessment-secure-config?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Export software inventory assessment per device](/microsoft-365/security/defender-endpoint/get-assessment-software-inventory?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Export software vulnerabilities assessment per device](/microsoft-365/security/defender-endpoint/get-assessment-software-vulnerabilities?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get CVE-KB map API](/microsoft-365/security/defender-endpoint/get-cvekbmap-collection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get device secure score](/microsoft-365/security/defender-endpoint/get-device-secure-score?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get discovered vulnerabilities](/microsoft-365/security/defender-endpoint/get-discovered-vulnerabilities?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get domain-related alerts API](/microsoft-365/security/defender-endpoint/get-domain-related-alerts?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get domain-related machines API](/microsoft-365/security/defender-endpoint/get-domain-related-machines?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get domain statistics API](/microsoft-365/security/defender-endpoint/get-domain-statistics?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get exposure score](/microsoft-365/security/defender-endpoint/get-exposure-score?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get file information API](/microsoft-365/security/defender-endpoint/get-file-information?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get file-related alerts API](/microsoft-365/security/defender-endpoint/get-file-related-alerts?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get file-related machines API](/microsoft-365/security/defender-endpoint/get-file-related-machines?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get file statistics API](/microsoft-365/security/defender-endpoint/get-file-statistics?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get installed software](/microsoft-365/security/defender-endpoint/get-installed-software?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List Investigations API](/microsoft-365/security/defender-endpoint/get-investigation-collection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get Investigation object API](/microsoft-365/security/defender-endpoint/get-investigation-object?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get IP related alerts API](/microsoft-365/security/defender-endpoint/get-ip-related-alerts?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get IP statistics API](/microsoft-365/security/defender-endpoint/get-ip-statistics?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get KB collection API](/microsoft-365/security/defender-endpoint/get-kbinfo-collection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get live response results](/microsoft-365/security/defender-endpoint/get-live-response-result?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get machine by ID API](/microsoft-365/security/defender-endpoint/get-machine-by-id?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List exposure score by device group](/microsoft-365/security/defender-endpoint/get-machine-group-exposure-score?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get machine logon users API](/microsoft-365/security/defender-endpoint/get-machine-log-on-users?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get machine related alerts API](/microsoft-365/security/defender-endpoint/get-machine-related-alerts?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get MachineAction object API](/microsoft-365/security/defender-endpoint/get-machineaction-object?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List machineActions API](/microsoft-365/security/defender-endpoint/get-machineactions-collection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get RBAC machine groups collection API](/microsoft-365/security/defender-endpoint/get-machinegroups-collection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List devices by software](/microsoft-365/security/defender-endpoint/get-machines-by-software?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List devices by vulnerability](/microsoft-365/security/defender-endpoint/get-machines-by-vulnerability?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List machines API](/microsoft-365/security/defender-endpoint/get-machines?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get machines security states collection API](/microsoft-365/security/defender-endpoint/get-machinesecuritystates-collection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get missing KBs by device ID](/microsoft-365/security/defender-endpoint/get-missing-kbs-machine?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get missing KBs by software ID](/microsoft-365/security/defender-endpoint/get-missing-kbs-software?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get package SAS URI API](/microsoft-365/security/defender-endpoint/get-package-sas-uri?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get recommendation by Id](/microsoft-365/security/defender-endpoint/get-recommendation-by-id?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List devices by recommendation](/microsoft-365/security/defender-endpoint/get-recommendation-machines?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List vulnerabilities by recommendation](/microsoft-365/security/defender-endpoint/get-recommendation-vulnerabilities?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List all remediation activities](/microsoft-365/security/defender-endpoint/get-remediation-all-activities?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List exposed devices of one remediation activity](/microsoft-365/security/defender-endpoint/get-remediation-exposed-devices-activities?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Remediation activity methods and properties](/microsoft-365/security/defender-endpoint/get-remediation-methods-properties?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get one remediation activity by ID](/microsoft-365/security/defender-endpoint/get-remediation-one-activity?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get security recommendations](/microsoft-365/security/defender-endpoint/get-security-recommendations?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get software by ID](/microsoft-365/security/defender-endpoint/get-software-by-id?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List software version distribution](/microsoft-365/security/defender-endpoint/get-software-ver-distribution?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List software](/microsoft-365/security/defender-endpoint/get-software?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Become a Microsoft Defender for Endpoint partner](/microsoft-365/security/defender-endpoint/get-started-partner-integration?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List Indicators API](/microsoft-365/security/defender-endpoint/get-ti-indicators-collection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get user information API](/microsoft-365/security/defender-endpoint/get-user-information?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get user-related alerts API](/microsoft-365/security/defender-endpoint/get-user-related-alerts?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get user-related machines API](/microsoft-365/security/defender-endpoint/get-user-related-machines?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List vulnerabilities by software](/microsoft-365/security/defender-endpoint/get-vuln-by-software?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Get vulnerability by ID](/microsoft-365/security/defender-endpoint/get-vulnerability-by-id?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint for US Government customers](/microsoft-365/security/defender-endpoint/gov?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Grant access to managed security service provider (MSSP)](/microsoft-365/security/defender-endpoint/grant-mssp-access?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Investigate agent health issues](/microsoft-365/security/defender-endpoint/health-status?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Helpful Microsoft Defender for Endpoint resources](/microsoft-365/security/defender-endpoint/helpful-resources?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Host firewall reporting in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/host-firewall-reporting?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Import, export, and deploy exploit protection configurations](/microsoft-365/security/defender-endpoint/import-export-exploit-protection-emet-xml?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Import Indicators API](/microsoft-365/security/defender-endpoint/import-ti-indicators?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Create indicators based on certificates](/microsoft-365/security/defender-endpoint/indicator-certificates?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Create indicators for files](/microsoft-365/security/defender-endpoint/indicator-file?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Investigate a user account in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/investigate-user?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Deploy Microsoft Defender for Endpoint on Linux manually](/microsoft-365/security/defender-endpoint/linux-install-manually?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Deploy Microsoft Defender for Endpoint on Linux with Ansible](/microsoft-365/security/defender-endpoint/linux-install-with-ansible?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Deploy Microsoft Defender for Endpoint on Linux with Puppet](/microsoft-365/security/defender-endpoint/linux-install-with-puppet?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Set preferences for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-preferences?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Privacy for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-privacy?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Detect and block potentially unwanted applications with Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-pua?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint on Linux resources](/microsoft-365/security/defender-endpoint/linux-resources?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [How to schedule scans with Microsoft Defender for Endpoint (Linux)](/microsoft-365/security/defender-endpoint/linux-schedule-scan-atp?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint on Linux static proxy discovery](/microsoft-365/security/defender-endpoint/linux-static-proxy-configuration?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot cloud connectivity issues for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-support-connectivity?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot missing events or alerts issues for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-support-events?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot installation issues for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-support-install?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot performance issues for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-support-perf?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot issues for Microsoft Defender for Endpoint on Linux RHEL6](/microsoft-365/security/defender-endpoint/linux-support-rhel?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [How to schedule an update of the Microsoft Defender for Endpoint (Linux)](/microsoft-365/security/defender-endpoint/linux-update-mde-linux?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Deploy updates for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-updates?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [What's new in Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-whatsnew?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [List software by recommendation](/microsoft-365/security/defender-endpoint/list-recommendation-software?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Live response command examples](/microsoft-365/security/defender-endpoint/live-response-command-examples?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Investigate entities on devices using live response in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/live-response?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Examples of device control policies for Intune](/microsoft-365/security/defender-endpoint/mac-device-control-intune?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Examples of device control policies for JAMF](/microsoft-365/security/defender-endpoint/mac-device-control-jamf?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Device control for macOS](/microsoft-365/security/defender-endpoint/mac-device-control-overview?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure and validate exclusions for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-exclusions?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Log in to Jamf Pro](/microsoft-365/security/defender-endpoint/mac-install-jamfpro-login?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [View and organize the Microsoft Defender for Endpoint devices list](/microsoft-365/security/defender-endpoint/machines-view-overview?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage Microsoft Defender for Endpoint alerts](/microsoft-365/security/defender-endpoint/manage-alerts?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage Microsoft Defender for Endpoint using Configuration Manager](/microsoft-365/security/defender-endpoint/manage-atp-post-migration-configuration-manager?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage Microsoft Defender for Endpoint using Group Policy Objects](/microsoft-365/security/defender-endpoint/manage-atp-post-migration-group-policy-objects?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage Microsoft Defender for Endpoint using Intune](/microsoft-365/security/defender-endpoint/manage-atp-post-migration-intune?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage Microsoft Defender for Endpoint using PowerShell, WMI, and MPCmdRun.exe](/microsoft-365/security/defender-endpoint/manage-atp-post-migration-other-tools?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage Microsoft Defender for Endpoint post migration](/microsoft-365/security/defender-endpoint/manage-atp-post-migration?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Review remediation actions following automated investigations](/microsoft-365/security/defender-endpoint/manage-auto-investigation?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage automation file uploads](/microsoft-365/security/defender-endpoint/manage-automation-file-uploads?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage automation folder exclusions](/microsoft-365/security/defender-endpoint/manage-automation-folder-exclusions?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage endpoint detection and response capabilities](/microsoft-365/security/defender-endpoint/manage-edr?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Apply Microsoft Defender Antivirus updates after certain events](/microsoft-365/security/defender-endpoint/manage-event-based-updates-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage the gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/manage-gradual-rollout?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage Microsoft Defender for Endpoint incidents](/microsoft-365/security/defender-endpoint/manage-incidents?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Create indicators](/microsoft-365/security/defender-endpoint/manage-indicators?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Apply Microsoft Defender AV protection updates to out of date endpoints](/microsoft-365/security/defender-endpoint/manage-outdated-endpoints-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Schedule Microsoft Defender Antivirus protection updates](/microsoft-365/security/defender-endpoint/manage-protection-update-schedule-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage how and where Microsoft Defender Antivirus receives updates](/microsoft-365/security/defender-endpoint/manage-protection-updates-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage Microsoft Defender for Endpoint suppression rules](/microsoft-365/security/defender-endpoint/manage-suppression-rules?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Define how mobile devices are updated by Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/manage-updates-mobile-devices-vms-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Overview of management and APIs](/microsoft-365/security/defender-endpoint/management-apis?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint Device Control Device Installation](/microsoft-365/security/defender-endpoint/mde-device-control-device-installation?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manage Microsoft Defender for Endpoint Plan 1](/microsoft-365/security/defender-endpoint/mde-p1-maintenance-operations?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Set up and configure Microsoft Defender for Endpoint Plan 1](/microsoft-365/security/defender-endpoint/mde-p1-setup-configuration?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Minimum requirements for Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/minimum-requirements?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Use network protection to help prevent connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Threat and vulnerability management](/microsoft-365/security/defender-endpoint/next-gen-threat-and-vuln-mgt?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Overview of next-generation protection in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/next-generation-protection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint for non-Windows platforms](/microsoft-365/security/defender-endpoint/non-windows?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Offboard machine API](/microsoft-365/security/defender-endpoint/offboard-machine-api?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Offboard devices from the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/offboard-machines?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Better together - Microsoft Defender Antivirus and Office 365 (including OneDrive) - better protection from ransomware and cyberthreats](/microsoft-365/security/defender-endpoint/office-365-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Threat Protection (Windows 10)](/microsoft-365/security/defender-endpoint/old-index?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboard devices and configure Microsoft Defender for Endpoint capabilities](/microsoft-365/security/defender-endpoint/onboard-configure?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboard previous versions of Windows on Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboard-downlevel?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboard devices without Internet access to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboard-offline-machines?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboard Windows multi-session devices in Azure Virtual Desktop](/microsoft-365/security/defender-endpoint/onboard-windows-multi-session-device?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure and manage Microsoft Defender for Endpoint capabilities](/microsoft-365/security/defender-endpoint/onboard?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboarding using Microsoft Endpoint Configuration Manager](/microsoft-365/security/defender-endpoint/onboarding-endpoint-configuration-manager?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboarding using Microsoft Endpoint Manager](/microsoft-365/security/defender-endpoint/onboarding-endpoint-manager?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Create an onboarding or offboarding notification rule](/microsoft-365/security/defender-endpoint/onboarding-notification?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Onboard to the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/onboarding?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Overview of attack surface reduction](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot sensor health using Microsoft Defender for Endpoint Client Analyzer](/microsoft-365/security/defender-endpoint/overview-client-analyzer?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Overview of endpoint detection and response capabilities](/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Partner applications in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/partner-applications?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint partner opportunities and scenarios](/microsoft-365/security/defender-endpoint/partner-integration?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint portal overview](/microsoft-365/security/defender-endpoint/portal-overview?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Submit or Update Indicator API](/microsoft-365/security/defender-endpoint/post-ti-indicator?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure Microsoft Defender Security Center settings](/microsoft-365/security/defender-endpoint/preferences-setup?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Prepare Microsoft Defender for Endpoint deployment](/microsoft-365/security/defender-endpoint/prepare-deployment?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Protect security settings with tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Hide the Microsoft Defender Antivirus interface](/microsoft-365/security/defender-endpoint/prevent-end-user-interaction-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Turn on the preview experience in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/preview-settings?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint preview features](/microsoft-365/security/defender-endpoint/preview?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender for Endpoint Device Control Printer Protection](/microsoft-365/security/defender-endpoint/printer-protection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Set up Microsoft Defender for Endpoint deployment](/microsoft-365/security/defender-endpoint/production-deployment?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Pull Microsoft Defender for Endpoint detections using REST API](/microsoft-365/security/defender-endpoint/pull-alerts-using-rest-api?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Stream Microsoft Defender for Endpoint events to Azure Event Hubs](/microsoft-365/security/defender-endpoint/raw-data-export-event-hub?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Stream Microsoft Defender for Endpoint events to your Storage account](/microsoft-365/security/defender-endpoint/raw-data-export-storage?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Stream Microsoft Defender for Endpoint event](/microsoft-365/security/defender-endpoint/raw-data-export?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Use role-based access control to grant fine-grained access to Microsoft 365 Defender portal](/microsoft-365/security/defender-endpoint/rbac?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Recommendation methods and properties](/microsoft-365/security/defender-endpoint/recommendation?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Monitor and report on Microsoft Defender Antivirus protection](/microsoft-365/security/defender-endpoint/report-monitor-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Take response actions on a file in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/respond-file-alerts?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Take response actions on a device in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/respond-machine-alerts?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Restore quarantined files in Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/restore-quarantined-files-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Restrict app execution API](/microsoft-365/security/defender-endpoint/restrict-code-execution?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Review alerts in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/review-alerts?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Review the results of Microsoft Defender Antivirus scans](/microsoft-365/security/defender-endpoint/review-scan-results-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Advanced Hunting API](/microsoft-365/security/defender-endpoint/run-advanced-query-api?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Advanced Hunting with PowerShell API Basics](/microsoft-365/security/defender-endpoint/run-advanced-query-sample-powershell?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Advanced Hunting with Python API Guide](/microsoft-365/security/defender-endpoint/run-advanced-query-sample-python?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Run the client analyzer on macOS or Linux](/microsoft-365/security/defender-endpoint/run-analyzer-macos-linux?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Run the client analyzer on Windows](/microsoft-365/security/defender-endpoint/run-analyzer-windows?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Run antivirus scan API](/microsoft-365/security/defender-endpoint/run-av-scan?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Run a detection test on a device to verify it has been properly onboarded to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/run-detection-test?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Run live response commands on a device](/microsoft-365/security/defender-endpoint/run-live-response?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Run and customize on-demand scans in Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/run-scan-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Schedule antivirus scans using Group Policy](/microsoft-365/security/defender-endpoint/schedule-antivirus-scans-group-policy?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Schedule antivirus scans using PowerShell](/microsoft-365/security/defender-endpoint/schedule-antivirus-scans-powershell?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Schedule antivirus scans using Windows Management Instrumentation](/microsoft-365/security/defender-endpoint/schedule-antivirus-scans-wmi?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Schedule regular quick and full scans with Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/schedule-antivirus-scans?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Score methods and properties](/microsoft-365/security/defender-endpoint/score?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender Security Center Security operations dashboard](/microsoft-365/security/defender-endpoint/security-operations-dashboard?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Server migration scenarios for the new version of Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/server-migration?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Check the Microsoft Defender for Endpoint service health](/microsoft-365/security/defender-endpoint/service-status?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Set device value API](/microsoft-365/security/defender-endpoint/set-device-value?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Software methods and properties](/microsoft-365/security/defender-endpoint/software?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Specify additional definition sets for network traffic inspection for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/specify-additional-definitions-network-traffic-inspection-mdav?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Specify the cloud protection level for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/specify-cloud-protection-level-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Stop and quarantine file API](/microsoft-365/security/defender-endpoint/stop-and-quarantine-file?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Supported Microsoft Defender for Endpoint response APIs](/microsoft-365/security/defender-endpoint/supported-response-apis?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Make the switch from non-Microsoft endpoint protection to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-migration?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Switch to Microsoft Defender for Endpoint - Onboard](/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-onboard?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Switch to Microsoft Defender for Endpoint - Prepare](/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-prepare?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Switch to Microsoft Defender for Endpoint - Setup](/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-setup?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Techniques in the device timeline](/microsoft-365/security/defender-endpoint/techniques-device-timeline?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Understand the analyst report section in threat analytics.](/microsoft-365/security/defender-endpoint/threat-analytics-analyst-reports?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Track and respond to emerging threats with Microsoft Defender for Endpoint threat analytics](/microsoft-365/security/defender-endpoint/threat-analytics?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Event timeline in threat and vulnerability management](/microsoft-365/security/defender-endpoint/threat-and-vuln-mgt-event-timeline?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Understand threat intelligence concepts in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/threat-indicator-concepts?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Integrate Microsoft Defender for Endpoint with other Microsoft solutions](/microsoft-365/security/defender-endpoint/threat-protection-integration?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Threat protection report in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/threat-protection-reports?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Indicator resource type](/microsoft-365/security/defender-endpoint/ti-indicator?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft 365 Defender time zone settings](/microsoft-365/security/defender-endpoint/time-settings?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Report and troubleshoot Microsoft Defender for Endpoint ASR Rules](/microsoft-365/security/defender-endpoint/troubleshoot-asr-rules?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot problems with attack surface reduction rules](/microsoft-365/security/defender-endpoint/troubleshoot-asr?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot cloud connectivity issues for Microsoft Defender for Endpoint on macOS](/microsoft-365/security/defender-endpoint/troubleshoot-cloud-connect-mdemac?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Collect support logs in Microsoft Defender for Endpoint using live response](/microsoft-365/security/defender-endpoint/troubleshoot-collect-support-log?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot exploit protection mitigations](/microsoft-365/security/defender-endpoint/troubleshoot-exploit-protection-mitigations?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot Microsoft Defender for Endpoint live response issues](/microsoft-365/security/defender-endpoint/troubleshoot-live-response?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot Microsoft Defender for Endpoint service issues](/microsoft-365/security/defender-endpoint/troubleshoot-mdatp?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot Microsoft Defender Antivirus while migrating from a third-party solution](/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus-when-migrating?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Defender Antivirus event IDs and error codes](/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot problems with Network protection](/microsoft-365/security/defender-endpoint/troubleshoot-np?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot onboarding issues and error messages](/microsoft-365/security/defender-endpoint/troubleshoot-onboarding-error-messages?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot Microsoft Defender for Endpoint onboarding issues](/microsoft-365/security/defender-endpoint/troubleshoot-onboarding?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot performance issues](/microsoft-365/security/defender-endpoint/troubleshoot-performance-issues?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot problems with reporting tools for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/troubleshoot-reporting?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot SIEM tool integration issues in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/troubleshoot-siem?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Performance analyzer for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/tune-performance-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Turn on definition retirement for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/turn-on-definition-retirement?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Turn on protocol recognition for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/turn-on-protocol-recognition?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Assign device value - threat and vulnerability management](/microsoft-365/security/defender-endpoint/tvm-assign-device-value?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Dashboard insights - threat and vulnerability management](/microsoft-365/security/defender-endpoint/tvm-dashboard-insights?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Plan for end-of-support software and software versions](/microsoft-365/security/defender-endpoint/tvm-end-of-support-software?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Create and view exceptions for security recommendations - threat and vulnerability management](/microsoft-365/security/defender-endpoint/tvm-exception?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Exposure score in threat and vulnerability management](/microsoft-365/security/defender-endpoint/tvm-exposure-score?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Hunt for exposed devices](/microsoft-365/security/defender-endpoint/tvm-hunt-exposed-devices?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Microsoft Secure Score for Devices](/microsoft-365/security/defender-endpoint/tvm-microsoft-secure-score-devices?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Prerequisites & permissions - threat and vulnerability management](/microsoft-365/security/defender-endpoint/tvm-prerequisites?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Remediate vulnerabilities with threat and vulnerability management](/microsoft-365/security/defender-endpoint/tvm-remediation?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Security recommendations by threat and vulnerability management](/microsoft-365/security/defender-endpoint/tvm-security-recommendation?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Software inventory in threat and vulnerability management](/microsoft-365/security/defender-endpoint/tvm-software-inventory?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Supported operating systems platforms and capabilities](/microsoft-365/security/defender-endpoint/tvm-supported-os?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Vulnerable devices report - threat and vulnerability management](/microsoft-365/security/defender-endpoint/tvm-vulnerable-devices-report?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Vulnerabilities in my organization - threat and vulnerability management](/microsoft-365/security/defender-endpoint/tvm-weaknesses?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Mitigate zero-day vulnerabilities - threat and vulnerability management](/microsoft-365/security/defender-endpoint/tvm-zero-day-vulnerabilities?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Release device from isolation API](/microsoft-365/security/defender-endpoint/unisolate-machine?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Remove app restriction API](/microsoft-365/security/defender-endpoint/unrestrict-code-execution?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Update alert entity API](/microsoft-365/security/defender-endpoint/update-alert?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Update machine entity API](/microsoft-365/security/defender-endpoint/update-machine-method?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure Microsoft Defender Antivirus with Group Policy](/microsoft-365/security/defender-endpoint/use-group-policy-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure Microsoft Defender Antivirus using Microsoft Endpoint Manager](/microsoft-365/security/defender-endpoint/use-intune-config-manager-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/use-powershell-cmdlets-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configure Microsoft Defender Antivirus with WMI](/microsoft-365/security/defender-endpoint/use-wmi-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Overview of Microsoft Defender Security Center](/microsoft-365/security/defender-endpoint/use?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Create and manage roles for role-based access control](/microsoft-365/security/defender-endpoint/user-roles?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [User resource type](/microsoft-365/security/defender-endpoint/user?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [View and organize the Incidents queue](/microsoft-365/security/defender-endpoint/view-incidents-queue?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Vulnerability methods and properties](/microsoft-365/security/defender-endpoint/vulnerability?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Web content filtering](/microsoft-365/security/defender-endpoint/web-content-filtering?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Monitoring web browsing security in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/web-protection-monitoring?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Web protection](/microsoft-365/security/defender-endpoint/web-protection-overview?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Respond to web threats in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/web-protection-response?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Protect your organization against web threats](/microsoft-365/security/defender-endpoint/web-threat-protection?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [What's new in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-atp?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Why cloud protection should be enabled for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/why-cloud-protection-should-be-on-mdav?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Why you should use Microsoft Defender Antivirus together with Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/why-use-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Configuring and controlling external email forwarding in Microsoft 365.](/microsoft-365/security/office-365-security/external-email-forwarding?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Attack surface reduction rules deployment phase 1 - plan](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-phase-1?view=o365-21vianet) \| added \| -\| 11/24/2021 \| [Attack surface reduction rules deployment phase 2 - test](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-phase-2?view=o365-21vianet) \| added \| -\| 11/24/2021 \| [Attack surface reduction rules deployment phase 3 - implement](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-phase-3?view=o365-21vianet) \| added \| -\| 11/24/2021 \| [Attack surface reduction rules deployment phase 4 - operationalize](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-phase-4?view=o365-21vianet) \| added \| -\| 11/24/2021 \| [Deploy attack surface reduction rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Attack surface reduction rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Use attack surface reduction rules to prevent malware infection](/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Test how Microsoft Defender for Endpoint features work in audit mode](/microsoft-365/security/defender-endpoint/audit-windows-defender?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Visit the Action center to see remediation actions](/microsoft-365/security/defender-endpoint/auto-investigation-action-center?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [View the details and results of an automated investigation](/microsoft-365/security/defender-endpoint/autoir-investigation-results?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Automation levels in automated investigation and remediation](/microsoft-365/security/defender-endpoint/automation-levels?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Integration with Microsoft Defender for Cloud](/microsoft-365/security/defender-endpoint/azure-server-integration?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Use basic permissions to access Microsoft Defender Security Center](/microsoft-365/security/defender-endpoint/basic-permissions?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Batch Update alert entities API](/microsoft-365/security/defender-endpoint/batch-update-alerts?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Behavioral blocking and containment](/microsoft-365/security/defender-endpoint/behavioral-blocking-containment?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Cancel machine action API](/microsoft-365/security/defender-endpoint/cancel-machine-action?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Check the health state of the sensor in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/check-sensor-status?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Client behavioral blocking](/microsoft-365/security/defender-endpoint/client-behavioral-blocking?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Cloud protection and sample submission in Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Cloud protection and Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Collect diagnostic data for Update Compliance and Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/collect-diagnostic-data-update-compliance?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Collect diagnostic data of Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/collect-diagnostic-data?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Collect investigation package API](/microsoft-365/security/defender-endpoint/collect-investigation-package?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Use the command line to manage Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/command-line-arguments-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Common Microsoft Defender for Endpoint API errors](/microsoft-365/security/defender-endpoint/common-errors?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Common mistakes to avoid when defining exclusions](/microsoft-365/security/defender-endpoint/common-exclusion-mistakes-microsoft-defender-antivirus?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Access the Microsoft Defender for Endpoint Community Center](/microsoft-365/security/defender-endpoint/community?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Enable Conditional Access to better protect users, devices, and data](/microsoft-365/security/defender-endpoint/conditional-access?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Manual deployment for Microsoft Defender for Endpoint on macOS](/microsoft-365/security/defender-endpoint/mac-install-manually?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Intune-based deployment for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-install-with-intune?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Deploying Microsoft Defender for Endpoint on macOS with Jamf Pro](/microsoft-365/security/defender-endpoint/mac-install-with-jamf?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Deployment with a different Mobile Device Management (MDM) system for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-install-with-other-mdm?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Set up device groups in Jamf Pro](/microsoft-365/security/defender-endpoint/mac-jamfpro-device-groups?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Enroll Microsoft Defender for Endpoint on macOS devices into Jamf Pro](/microsoft-365/security/defender-endpoint/mac-jamfpro-enroll-devices?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Set up the Microsoft Defender for Endpoint on macOS policies in Jamf Pro](/microsoft-365/security/defender-endpoint/mac-jamfpro-policies?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Set preferences for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-preferences?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Privacy for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-privacy?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Detect and block potentially unwanted applications with Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-pua?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Resources for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-resources?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [How to schedule scans with Microsoft Defender for Endpoint on macOS](/microsoft-365/security/defender-endpoint/mac-schedule-scan?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot installation issues for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-support-install?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot kernel extension issues in Microsoft Defender for Endpoint on macOS](/microsoft-365/security/defender-endpoint/mac-support-kext?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot license issues for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-support-license?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Troubleshoot performance issues for Microsoft Defender for Endpoint on macOS](/microsoft-365/security/defender-endpoint/mac-support-perf?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [New configuration profiles for macOS Catalina and newer versions of macOS](/microsoft-365/security/defender-endpoint/mac-sysext-policies?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Deploy updates for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-updates?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [What's new in Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-whatsnew?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Create and manage device groups in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/machine-groups?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Device health and compliance report in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/machine-reports?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Create and manage device tags](/microsoft-365/security/defender-endpoint/machine-tags?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [Machine resource type](/microsoft-365/security/defender-endpoint/machine?view=o365-21vianet) \| modified \| -\| 11/24/2021 \| [machineAction resource type](/microsoft-365/security/defender-endpoint/machineaction?view=o365-21vianet) \| modified \|
security	Microsoft 365 Zero Trust	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/Microsoft-365-zero-trust.md	Title: "Microsoft 365 Zero Trust deployment plan" f1.keywords:-- CSH +- deploy zero trust +- zero trust strategy Microsoft Information Protection provides a framework, process, and capabilities ![Microsoft Information Protection (MIP) framework](../media/zero-trust/mip-solution-overview.png) -For more information, see [Microsoft Information Protection in Microsoft 365](../compliance/information-protection.md). +For more information, see [Deploy a Microsoft Information Protection solution](../compliance/information-protection-solution.md).
security	Advanced Hunting Devicealertevents Table	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/advanced-hunting-devicealertevents-table.md	ms.technology: mde > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The `DeviceAlertEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about alerts in Microsoft Defender Security Center. Use this reference to construct queries that return information from the table. +The `DeviceAlertEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about alerts in Microsoft 365 Defender. Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
security	Advanced Hunting Schema Reference	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/advanced-hunting-schema-reference.md	To quickly access the schema reference, select the View reference action nex The following reference lists all the tables in the advanced hunting schema. Each table name links to a page describing the column names for that table. -Table and column names are also listed within the Microsoft Defender Security Center, in the schema representation on the advanced hunting screen. +Table and column names are also listed within the Microsoft 365 Defender portal, in the schema representation on the advanced hunting screen. <br> Table and column names are also listed within the Microsoft Defender Security Ce \|Table name\|Description\| \|\|\| -\|[DeviceAlertEvents](advanced-hunting-devicealertevents-table.md)\|Alerts on Microsoft Defender Security Center\| +\|[DeviceAlertEvents](advanced-hunting-devicealertevents-table.md)\|Alerts on Microsoft 365 Defender \| \|[DeviceInfo](advanced-hunting-deviceinfo-table.md)\|Device information, including OS information\| \|[DeviceNetworkInfo](advanced-hunting-devicenetworkinfo-table.md)\|Network properties of devices, including adapters, IP and MAC addresses, as well as connected networks and domains\| \|[DeviceProcessEvents](advanced-hunting-deviceprocessevents-table.md)\|Process creation and related events\|
security	Android Intune	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/android-intune.md	Learn how to deploy Defender for Endpoint on Android on Intune Company Portal - 2. Tap the Microsoft Defender for Endpoint app icon and follow the on-screen instructions to complete onboarding the app. The details include end-user acceptance of Android permissions required by Defender for Endpoint on Android. -3. Upon successful onboarding, the device will start showing up on the Devices list in Microsoft Defender Security Center. +3. Upon successful onboarding, the device will start showing up on the Devices list in the Microsoft 365 Defender portal. :::image type="content" alt-text="Image of device in Defender for Endpoint portal." source="images/9fe378a1dce0f143005c3aa53d8c4f51.png" lightbox="images/9fe378a1dce0f143005c3aa53d8c4f51.png":::
security	Azure Server Integration	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/azure-server-integration.md	The following capabilities are included in this integration: > The integration between Microsoft Defender for servers and Microsoft Defender for Endpoint has been expanded to support [Windows Server 2019 and Windows Virtual Desktop (WVD)](/azure/security-center/release-notes#microsoft-defender-for-endpoint-integration-with-azure-defender-now-supports-windows-server-2019-and-windows-10-virtual-desktop-wvd-in-preview). - Windows servers monitored by Microsoft Defender for Cloud will also be available in Defender for Endpoint - Microsoft Defender for Cloud seamlessly connects to the Defender for Endpoint tenant, providing a single view across clients and servers. In addition, Defender for Endpoint alerts will be available in the Microsoft Defender for Cloud console.-- Server investigation - Microsoft Defender for Cloud customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach. +- Server investigation - Microsoft Defender for Cloud customers can access the Microsoft 365 Defender portal to perform detailed investigation to uncover the scope of a potential breach. > [!IMPORTANT] > - When you use Microsoft Defender for Cloud to monitor servers, a Defender for Endpoint tenant is automatically created (in the US for US users, in the EU for European and UK users).<br>
security	Configure Automated Investigations Remediation	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-automated-investigations-remediation.md	To configure automated investigation and remediation: ## Turn on automated investigation and remediation -1. As a global administrator or security administrator, go to the Microsoft Defender Security Center (<https://securitycenter.windows.com>) and sign in. +1. As a global administrator or security administrator, go to the Microsoft 365 Defender portal (<https://security.microsoft.com>) and sign in. 2. In the navigation pane, choose Settings. 3. In the General section, select Advanced features. 4. Turn on both Automated Investigation and Automatically resolve alerts. ## Set up device groups -1. In the Microsoft Defender Security Center (<https://securitycenter.windows.com>), on the Settings page, under Permissions, select Device groups. +1. In the Microsoft 365 Defender portal (<https://security.microsoft.com>), on the Settings page, under Permissions, select Device groups. 2. Select + Add device group. 3. Create at least one device group, as follows: - Specify a name and description for the device group.
security	Configure Microsoft Threat Experts	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-microsoft-threat-experts.md	If you're a Defender for Endpoint customer, you need to apply for Microsoft Th ## Apply for Microsoft Threat Experts - Targeted Attack Notifications service -If you're already a Defender for Endpoint customer, you can apply through the Microsoft Defender Security Center. +If you're already a Defender for Endpoint customer, you can apply through the Microsoft 365 Defender portal. 1. From the navigation pane, go to Settings > General > Advanced features > Microsoft Threat Experts - Targeted Attack Notifications**. This is available as a subscription service. If you're already a Defender for En ## Consult a Microsoft threat expert about suspicious cybersecurity activities in your organization -You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised device, or a threat intelligence context that you see on your portal dashboard. +You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft 365 Defender portal for timely and accurate response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised device, or a threat intelligence context that you see on your portal dashboard. > [!NOTE] >
security	Configure Server Endpoints	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-server-endpoints.md	The onboarding package contains the following files: Use the following steps to download the packages: -1. In Microsoft Defender Security Center, go to Settings > Device Management > Onboarding. +1. In Microsoft 365 Defender, go to Settings > Device Management > Onboarding. 2. Select Windows Server 2012 R2 and 2016. You can use the [installer script](server-migration.md#installer-script) to help 10. To link the GPO to an Organization Unit (OU), right-click and select Link an existing GPO. In the dialogue box that is displayed, select the Group Policy Object that you wish to link. Click OK. -For additional configuration setttings, see [Configure sample collection settings](configure-endpoints-gp.md#configure-sample-collection-settings) and [Other recommended configuration settings](configure-endpoints-gp.md#other-recommended-configuration-settings). +For additional configuration settings, see [Configure sample collection settings](configure-endpoints-gp.md#configure-sample-collection-settings) and [Other recommended configuration settings](configure-endpoints-gp.md#other-recommended-configuration-settings). ### STEP 3: Complete the onboarding steps The onboarding package for Windows Server 2019 and Windows Server 2022 through M ### Download package -1. In Microsoft Defender Security Center, go to Settings > Device Management > Onboarding. +1. In Microsoft 365 Defender, go to Settings > Device Management > Onboarding. 2. Select Windows Server 1803 and 2019.
security	Device Control Removable Storage Access Control	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control.md	ms.technology: mde Previously updated : 12/01/2021 Last updated : 01/10/2022 # Microsoft Defender for Endpoint Device Control Removable Storage Access Control Microsoft Defender for Endpoint Device Control Removable Storage Access Control \|User-based Support\|Yes\| \|Machine-based Support\|Yes\| +<br/><br/> + +\|Capability\|Description\|Deploy through Intune\|Deploy through Group Policy\| +\|\|\|\|\| +\|Removable Media Group Creation\|Allows you to create reusable removable media group\|Step 1 and step 3 in the section, [Deploying policy via OMA-URI](#deploying-policy-via-oma-uri) \| Step 1 in the section, [Deploying policy via Group Policy](#deploying-policy-via-group-policy)\| +\|Policy Creation\|Allows you to create policy to enforce each removable media group\|Steps 2 and 3 in the section, [Deploying policy via OMA-URI](#deploying-policy-via-oma-uri) \| Step 2 in the section, [Deploying policy via Group Policy](#deploying-policy-via-group-policy) \| +\|Default Enforcement\|Allows you to set default access (Deny or Allow) to removable media if there is no policy\|Step 4 in the section, [Deploying policy via OMA-URI](#deploying-policy-via-oma-uri) \| Step 3 in the section, [Deploying policy via Group Policy](#deploying-policy-via-group-policy) \| +\|Enable or Disable Removable Storage Access Control\|If you set Disable, it will disable the Removable Storage Access Control policy on this machine\| Step 5 in the section, [Deploying policy via OMA-URI](#deploying-policy-via-oma-uri) \| Step 4 in the section, [Deploying policy via Group Policy](#deploying-policy-via-group-policy) \| + ## Prepare your endpoints Deploy Removable Storage Access Control on Windows 10 and Windows 11 devices that have antimalware client version 4.18.2103.3 or later. - 4.18.2104 or later: Add SerialNumberId, VID_PID, filepath-based GPO support, ComputerSid+ - 4.18.2105 or later: Add Wildcard support for HardwareId/DeviceId/InstancePathId/FriendlyNameId/SerialNumberId, the combination of specific user on specific machine, removeable SSD (a SanDisk Extreme SSD)/USB Attached SCSI (UAS) support+ - 4.18.2107 or later: Add Windows Portable Device (WPD) support (for mobile devices, such as tablets); add AccountName into [advanced hunting](device-control-removable-storage-access-control.md#view-device-control-removable-storage-access-control-data-in-microsoft-defender-for-endpoint) +- 4.18.2111 or later: Add 'Enable or Disable Removable Storage Access Control', 'Default Enforcement', client machine policy update time through PowerShell. + :::image type="content" source="images/powershell.png" alt-text="The PowerShell interface."::: > [!NOTE] You can use the following properties to create a removable storage group: \|Property Name\|Description\|Options\| \|\|\|\| \|GroupId\|GUID, a unique ID, represents the group and will be used in the policy.\|\| -\|DescriptorIdList\|List the device properties you want to use to cover in the group. For each device property, see [Device Properties](device-control-removable-storage-protection.md) for more detail. All properties are case sensitive. \|PrimaryId: RemovableMediaDevices, CdRomDevices, WpdDevices<p>BusId: For example, USB, SCSI<p>DeviceId<p>HardwareId<p>InstancePathId: InstancePathId is a string that uniquely identifies the device in the system, for example, `USBSTOR\DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07\8735B611&0`. The number at the end (for example &0) represents the available slot and may change from device to device. For best results, use a wildcard at the end. For example, `USBSTOR\DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07\8735B611`.<p>FriendlyNameId<p>SerialNumberId<p>VID<p>PID<p>VID_PID<p>0751_55E0: match this exact VID/PID pair<p>55E0: match any media with PID=55E0 <p>0751: match any media with VID=0751\| -\|MatchType\|When there are multiple device properties being used in the DescriptorIDList, MatchType defines the relationship.\|MatchAll: Any attributes under the DescriptorIdList will be And* relationship; for example, if administrator puts DeviceID and InstancePathID, for every connected USB, system will check to see whether the USB meets both values. <p> MatchAny: The attributes under the DescriptorIdList will be Or relationship; for example, if administrator puts DeviceID and InstancePathID, for every connected USB, system will do the enforcement as long as the USB has either an identical DeviceID or InstanceID value. \| +\|DescriptorIdList\|List the device properties you want to use to cover in the group. For each device property, see [Device Properties](device-control-removable-storage-protection.md) for more detail. All properties are case sensitive. \|PrimaryId: `RemovableMediaDevices`, `CdRomDevices`, `WpdDevices`<p>BusId: For example, USB, SCSI<p>DeviceId<p>HardwareId<p>InstancePathId: InstancePathId is a string that uniquely identifies the device in the system, for example, `USBSTOR\DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07\8735B611&0`. The number at the end (for example &0) represents the available slot and may change from device to device. For best results, use a wildcard at the end. For example, `USBSTOR\DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07\8735B611`.<p>FriendlyNameId<p>SerialNumberId<p>VID<p>PID<p>VID_PID<p>0751_55E0: match this exact VID/PID pair<p>55E0: match any media with PID=55E0 <p>0751: match any media with VID=0751\| +\|MatchType\|When there are multiple device properties being used in the `DescriptorIDList`, MatchType defines the relationship.\|MatchAll: Any attributes under the `DescriptorIdList` will be And* relationship; for example, if administrator puts `DeviceID` and `InstancePathID`, for every connected USB, system will check to see whether the USB meets both values. <p> MatchAny: The attributes under the DescriptorIdList will be Or relationship; for example, if administrator puts `DeviceID` and `InstancePathID`, for every connected USB, system will do the enforcement as long as the USB has either an identical DeviceID or InstanceID value. \| ### Access Control Policy To help familiarize you with Microsoft Defender for Endpoint Removable Storage A 1. Create groups 1. Group 1: Any removable storage and CD/DVD. An example of a removable storage and CD/DVD is: Group 9b28fae8-72f7-4267-a1a5-685f747a7146 in the sample [Any Removable Storage and CD-DVD Group.xml](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Removable%20Storage%20Access%20Control%20Samples) file. + 2. Group 2: Approved USBs based on device properties. An example for this use case is: Instance ID - Group 65fa649a-a111-4912-9294-fb6337a25038 in the sample [Approved USBs Group.xml](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Removable%20Storage%20Access%20Control%20Samples) file. To help familiarize you with Microsoft Defender for Endpoint Removable Storage A 2. Create policy 1. Policy 1: Block Write and Execute Access but allow approved USBs. An example for this use case is: PolicyRule c544a991-5786-4402-949e-a032cb790d0e in the sample [Scenario 1 Block Write and Execute Access but allow approved USBs.xml](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Removable%20Storage%20Access%20Control%20Samples) file. + 2. Policy 2: Audit Write and Execute access to allowed USBs. An example for this use case is: PolicyRule 36ae1037-a639-4cff-946b-b36c53089a4c in the sample [Scenario 1 Audit Write and Execute access to approved USBs.xml](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Removable%20Storage%20Access%20Control%20Samples) file. ### Scenario 2: Audit Write and Execute access to all but block specific unapproved USBs To help familiarize you with Microsoft Defender for Endpoint Removable Storage A 1. Group 1: Any removable storage and CD/DVD. An example for this use case is: Group 9b28fae8-72f7-4267-a1a5-685f747a7146 in the sample [Any Removable Storage and CD-DVD Group.xml](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Removable%20Storage%20Access%20Control%20Samples) file. + 2. Group 2: Unapproved USBs based on device properties, for example, Vendor ID / Product ID, Friendly Name ΓÇô Group 65fa649a-a111-4912-9294-fb6337a25038 in the sample [Unapproved USBs Group.xml](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Removable%20Storage%20Access%20Control%20Samples) file. > [!TIP] To help familiarize you with Microsoft Defender for Endpoint Removable Storage A 2. Create policy 1. Policy 1: Block Write and Execute access to all but block specific unapproved USBs. An example of this use case is: PolicyRule 23b8e437-66ac-4b32-b3d7-24044637fc98 in the sample [Scenario 2 Audit Write and Execute access to all but block specific unapproved USBs.xml](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Removable%20Storage%20Access%20Control%20Samples) file. + 2. Policy 2: Audit Write and Execute access to others. An example of this use case is: PolicyRule b58ab853-9a6f-405c-a194-740e69422b48 in the sample [Scenario 2 Audit Write and Execute access to others.xml](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Removable%20Storage%20Access%20Control%20Samples) file. ## Deploying and managing policy via Group Policy Before you get started with Removable Storage Access Control, you must confirm y :::image type="content" source="images/device-control.png" alt-text="The Device Control screen."::: +4. Default enforcement: allows you to set default access (Deny or Allow) to removable media if there is no policy. For example, you only have policy (either Deny or Allow) for RemovableMediaDevices, but do not have any policy for CdRomDevices or WpdDevices, and you set default Deny through this policy, Read/Write/Execute access to CdRomDevices or WpdDevices will be blocked. + + - Once you deploy this setting, you will see Default Allow or Default Deny. + + :::image type="content" source="images/148609579-a7df650b-7792-4085-b552-500b28a35885.png" alt-text="Default Allow or Default Deny PowerShell code"::: + +5. Enable or Disable Removable Storage Access Control: you can set this value to temporarily disable Removable Storage Access Control. + + :::image type="content" source="images/148608318-5cda043d-b996-4146-9642-14fccabcb017.png" alt-text="Device Control settings"::: + + - Once you deploy this setting, you will see ΓÇÿEnabledΓÇÖ or ΓÇÿDisabledΓÇÖ - Disabled means this machine does not have Removable Storage Access Control policy running. + + :::image type="content" source="images/148609685-4c05f002-5cbe-4aab-9245-83e730c5449e.png" alt-text="Enabled or Disabled device control in PowerShell code"::: + + ## Deploying and managing policy via Intune OMA-URI The Removable Storage Access Control feature enables you to apply policy via OMA-URI to either user or device, or both. Before you get started with Removable Storage Access Control, you must confirm For policy deployment in Intune, the account must have permissions to create, edit, update, or delete device configuration profiles. You can create custom roles or use any of the built-in roles with these permissions. - Policy and profile Manager role+ - Custom role with Create/Edit/Update/Read/Delete/View Reports permissions turned on for Device Configuration profiles+ - Global administrator ### Deploying policy via OMA-URI Microsoft Endpoint Manager admin center (<https://endpoint.microsoft.com/>) \> * - Data Type: String (XML file) + +3. Default enforcement: allows you to set default access (Deny or Allow) to removable media if there is no policy. For example, you only have policy (either Deny or Allow) for RemovableMediaDevices, but do not have any policy for CdRomDevices or WpdDevices, and you set default Deny through this policy, Read/Write/Execute access to CdRomDevices or WpdDevices will be blocked. + + - OMA-URI: `./Vendor/MSFT/Defender/Configuration/DefaultEnforcement` + + - Data Type: Int + `DefaultEnforcementAllow = 1 + `DefaultEnforcementDeny = 2 + + - Once you deploy this setting, you will see Default Allow or Default Deny + + :::image type="content" source="images/148609590-c67cfab8-8e2c-49f8-be2b-96444e9dfc2c.png" alt-text="Default Enforcement Allow PowerShell code"::: + + +4. Enable or Disable Removable Storage Access Control: you can set this value to temporarily disable Removable Storage Access Control. + + - OMA-URI: `./Vendor/MSFT/Defender/Configuration/DeviceControlEnabled` + + - Data Type: Int + `Disable: 0` + `Enable: 1` + + - Once you deploy this setting, you will see Enabled or Disabled + + Disabled means this machine does not have Removable Storage Access Control policy running + + :::image type="content" source="images/148609770-3e555883-f26f-45ab-9181-3fb1ff7a38ac.png" alt-text="Removeable Storage Access Control in PowerShell code"::: + + + ## Deploying and managing policy by using Intune user interface This capability is available in the Microsoft Endpoint Manager admin center (<https://endpoint.microsoft.com/>). Go to Endpoint Security > Attack Surface Reduction > Create Policy. Choose Platform: Windows 10 and later with Profile: Device Control. If you are deploying and managing the policy via Group Policy, please make sure We don't backport the Group Policy configuration UX, but you can still get the related adml and admx files by clicking 'Raw' and 'Save as' at the [WindowsDefender.adml](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/WindowsDefender.adml) and [WindowsDefender.admx](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/WindowsDefender.admx) files. + +### How can I know whether the latest policy has been deployed to the target machine? + +You can run ΓÇÿGet-MpComputerStatusΓÇÖ on PowerShell as an Administrator. The following value will show whether the latest policy has been applied to the target machine. + + + ### How can I know which machine is using out of date antimalware client version in the organization? You can use following query to get antimalware client version on the Microsoft 365 security portal:
security	Enable Cloud Protection Microsoft Defender Antivirus	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus.md	ms.localizationpriority: medium Previously updated : 10/18/2021 Last updated : 01/10/2022 For more information about allowed parameters, see [Windows Defender WMIv2 APIs] 1. Open the Windows Security app by selecting the shield icon in the task bar, or by searching the start menu for Windows Security. -2. Select the Virus & threat protection tile (or the shield icon on the left menu bar) and then the Virus & threat protection settings label: +2. Select the Virus & threat protection tile (or the shield icon on the left menu bar), and then, under Virus & threat protection settings, select Manage settings. - :::image type="content" source="../../media/wdav-protection-settings-wdsc.png" alt-text="Screenshot of the Virus & threat protection settings"::: - -3. Confirm that Cloud-based Protection and Automatic sample submission are switched to On. +3. Confirm that Cloud-based Protection and Automatic sample submission are both switched to On. > [!NOTE] > If automatic sample submission has been configured with Group Policy then the setting will be greyed-out and unavailable.
security	Fix Unhealthy Sensors	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/fix-unhealthy-sensors.md	ms.technology: mde > Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-fixsensor-abovefoldlink) -Devices that are categorized as misconfigured or inactive can be flagged due to varying causes. This section provides some explanations as to what might have caused a device to be categorized as inactive or misconfigured. +Devices can be categorized as misconfigured or inactive are flagged for varying causes. This section provides some explanations as to what might have caused a device to be categorized as inactive or misconfigured. ## Inactive devices -An inactive device is not necessarily flagged due to an issue. The following actions taken on a device can cause a device to be categorized as inactive: +An inactive device is not necessarily flagged because of an issue. The following actions taken on a device can cause a device to be categorized as inactive: ### Device is not in use -If the device has not been in use for more than seven days for any reason, it will remain in an 'Inactive' status in the portal. +Any device that is not in use for more than seven days will retain 'Inactive' status in the portal. ### Device was reinstalled or renamed -A reinstalled or renamed device will generate a new device entity in the Microsoft Defender Security Center. The previous device entity will remain with an 'Inactive' status in the portal. If you reinstalled a device and deployed the Defender for Endpoint package, search for the new device name to verify that the device is reporting normally. +A new device entity is generated in Microsoft 365 Defender for reinstalled or renamed devices. The previous device entity remains, with an 'Inactive' status in the portal. If you reinstalled a device and deployed the Defender for Endpoint package, search for the new device name to verify that the device is reporting normally. ### Device was offboarded If the device was offboarded, it will still appear in devices list. After seven days, the device health state should change to inactive. ### Device is not sending signals -If the device is not sending any signals for more than seven days to any of the Microsoft Defender for Endpoint channels for any reason, including conditions that fall under misconfigured devices classification, a device can be considered inactive. +If the device is not sending any signals to any Microsoft Defender for Endpoint channels for more than seven days for any reason, a device can be considered inactive; this includes conditions that fall under misconfigured devices classification. Do you expect a device to be in 'Active' status? [Open a support ticket](https://support.microsoft.com/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636206786382823561). Misconfigured devices can further be classified to: - No sensor data ### Impaired communications -This status indicates that there's limited communication between the device and the service. +This status indicates that there is limited communication between the device and the service. The following suggested actions can help fix issues related to a misconfigured device with impaired communications: Follow theses actions to correct known issues related to a misconfigured device Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Microsoft Defender for Endpoint service URLs. - [Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-the-diagnostics-service-is-enabled)</br> -If the devices aren't reporting correctly, you might need to check that the Windows diagnostic data service is set to automatically start and is running on the endpoint. +If the devices aren't reporting correctly, you should verify that the Windows diagnostic data service is set to automatically start. Also verify that the Windows diagnostic data service is running on the endpoint. - [Ensure that Microsoft Defender Antivirus is not disabled by policy](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy)</br> -If your devices are running a third-party antimalware client, the Defender for Endpoint agent needs the Microsoft Defender Antivirus Early Launch Antimalware (ELAM) driver to be enabled. +If your devices are running a third-party antimalware client, Defender for Endpoint agent requires that the Microsoft Defender Antivirus Early Launch Antimalware (ELAM) driver is enabled. If you took corrective actions and the device status is still misconfigured, [open a support ticket](https://go.microsoft.com/fwlink/?LinkID=761093&clcid=0x409).
security	Grant Mssp Access	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/grant-mssp-access.md	To implement a multi-tenant delegated access solution, take the following steps: 2. Create Defender for Endpoint roles for appropriate access levels in Customer Defender for Endpoint. - To enable RBAC in the customer Microsoft Defender Security Center, access Settings > Permissions > Roles and "Turn on roles", from a user account with Global Administrator or Security Administrator rights. + To enable RBAC in the customer Microsoft 365 Defender portal, access Settings > Permissions > Roles and "Turn on roles", from a user account with Global Administrator or Security Administrator rights. ![Image of MSSP access.](images/mssp-access.png) To implement a multi-tenant delegated access solution, take the following steps: 2. Approve or deny requests in the Approvals section of the UI. - At this point, analyst access has been provisioned, and each analyst should be able to access the customer's Microsoft Defender Security Center: `https://securitycenter.Microsoft.com/?tid=<CustomerTenantId>` + At this point, analyst access has been provisioned, and each analyst should be able to access the customer's Microsoft 365 Defender portal: `https://security.microsoft.com/?tid=<CustomerTenantId>` ## Related topics
security	Health Status	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/health-status.md	The following table provides information on the values returned when you run the \|edr_configuration_version\|EDR configuration version.\| \|edr_device_tags\|List of tags associated with the device.\| \|edr_group_ids\|Group ID that the device is associated with.\| -\|edr_machine_id\|Device identifier used in Microsoft Defender Security Center.\| +\|edr_machine_id\|Device identifier used in Microsoft 365 Defender.\| \|engine_version\|Version of the antivirus engine.\| \|healthy\|True if the product is healthy, false otherwise.\| \|licensed\|True if the device is onboarded to a tenant, false otherwise.\|
security	Helpful Resources	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/helpful-resources.md	Title: Helpful Microsoft Defender for Endpoint resources description: Access helpful resources such as links to blogs and other resources related to Microsoft Defender for Endpoint -keywords: Microsoft Defender Security Center, product brief, brief, capabilities, licensing +keywords: Microsoft 365 Defender, product brief, brief, capabilities, licensing ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library
security	Indicator Ip Domain	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/indicator-ip-domain.md	It's important to understand the following prerequisites prior to creating indic >[!NOTE] >Windows Server 2016 and Windows Server 2012 R2 will need to be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016) for this feature to work. -- Ensure that Custom network indicators is enabled in Microsoft Defender Security CenterΓÇ»> Settings > Advanced features. For more information, see [Advanced features](advanced-features.md). +- Ensure that Custom network indicators is enabled in Microsoft 365 DefenderΓÇ»> Settings > Advanced features. For more information, see [Advanced features](advanced-features.md). - For support of indicators on iOS, see [Configure custom indicators](/microsoft-365/security/defender-endpoint/ios-configure-features#configure-custom-indicators). > [!IMPORTANT]
security	Investigate Behind Proxy	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/investigate-behind-proxy.md	Monitoring network connection behind a forward proxy is possible due to other ne Network protection can be controlled using the following modes: -- Block: Users or apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Microsoft Defender Security Center.-- Audit: Users or apps will not be blocked from connecting to dangerous domains. However, you will still see this activity in Microsoft Defender Security Center. +- Block: Users or apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Microsoft 365 Defender. +- Audit: Users or apps will not be blocked from connecting to dangerous domains. However, you will still see this activity in Microsoft 365 Defender. -If you turn off network protection, users or apps will not be blocked from connecting to dangerous domains. You will not see any network activity in Microsoft Defender Security Center. +If you turn off network protection, users or apps will not be blocked from connecting to dangerous domains. You will not see any network activity in Microsoft 365 Defender. If you do not configure it, network blocking will be turned off by default.
security	Linux Deploy Defender For Endpoint With Chef	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-deploy-defender-for-endpoint-with-chef.md	After the cookbook is created, create a files folder inside the cookbook folder mkdir mdatp/files ``` -Transfer the Linux Server Onboarding zip file that can be downloaded from the Microsoft Defender Security Center portal to this new files folder. +Transfer the Linux Server Onboarding zip file that can be downloaded from the Microsoft 365 Defender portal to this new files folder. On the Chef Workstation, navigate to the mdatp/recipes folder. This folder is created when the cookbook was generated. Use your preferred text editor (like vi or nano) to add the following instructions to the end of the default.rb file:
security	Linux Whatsnew	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-whatsnew.md	ms.technology: mde Applies to: - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) +## 101.53.02 (30.121112.15302.0) + +- Performance improvements & bug fixes + ## 101.52.57 (30.121092.15257.0) - Added a capability to detect vulnerable log4j jars in use by Java applications. The machine is periodically inspected for running Java processes with loaded log4j jars. The information is reported to the Microsoft Defender for Endpoint backend and is exposed in the Vulnerability Management area of the portal.
security	Mac Jamfpro Policies	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-jamfpro-policies.md	Alternatively, you can download [kext.mobileconfig](https://github.com/microsoft ## Step 9: Configure Network Extension -As part of the Endpoint Detection and Response capabilities, Microsoft Defender for Endpoint on macOS inspects socket traffic and reports this information to the Microsoft Defender Security Center portal. The following policy allows the network extension to perform this functionality. +As part of the Endpoint Detection and Response capabilities, Microsoft Defender for Endpoint on macOS inspects socket traffic and reports this information to the Microsoft 365 Defender portal. The following policy allows the network extension to perform this functionality. These steps are applicable of macOS 10.15 (Catalina) or newer.
security	Manage Alerts	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-alerts.md	If an alert is not yet assigned, you can select Assign to me to assign the a ## Suppress alerts -There might be scenarios where you need to suppress alerts from appearing in Microsoft Defender Security Center. Defender for Endpoint lets you create suppression rules for specific alerts that are known to be innocuous such as known tools or processes in your organization. +There might be scenarios where you need to suppress alerts from appearing in Microsoft 365 Defender. Defender for Endpoint lets you create suppression rules for specific alerts that are known to be innocuous such as known tools or processes in your organization. Suppression rules can be created from an existing alert. They can be disabled and reenabled if needed.
security	Manage Edr	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-edr.md	Manage the alerts queue, investigate devices in the devices list, take response ## In this section Topic \| Description :\|: -[Alerts queue](alerts-queue-endpoint-detection-response.md)\| View the alerts surfaced in Microsoft Defender Security Center. +[Alerts queue](alerts-queue-endpoint-detection-response.md)\| View the alerts surfaced in Microsoft 365 Defender portal. [Devices list](machines-view-overview.md) \| Learn how you can view and manage the devices list, manage device groups, and investigate device related alerts. [Take response actions](respond-machine-alerts.md)\| Take response actions on devices and files to quickly respond to detected attacks and contain threats. [Query data using advanced hunting](advanced-hunting-query-language.md)\| Proactively hunt for possible threats across your organization using a powerful search and query tool.
security	Management Apis	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/management-apis.md	For more information, see [Microsoft 365 Defender Streaming API](../defender/str ## SIEM API -When you enable security information and event management (SIEM) integration, it allows you to pull detections from Microsoft Defender Security Center using your SIEM solution or by connecting directly to the detections REST API. This activates the SIEM connector access details section with pre-populated values and an application is created under your Azure Active Directory (Azure AD) tenant. For more information, see [SIEM integration](enable-siem-integration.md). +When you enable security information and event management (SIEM) integration, it allows you to pull detections from Microsoft 365 Defender using your SIEM solution or by connecting directly to the detections REST API. This activates the SIEM connector access details section with pre-populated values and an application is created under your Azure Active Directory (Azure AD) tenant. For more information, see [SIEM integration](enable-siem-integration.md). ## Related topics
security	Mde Device Control Device Installation	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mde-device-control-device-installation.md	ms.technology: mde Microsoft Defender for Endpoint Device Control Removable Storage Access Control enables you to do the following task: - Prevent people from installing specific devices.-- Allow people from installing specific devices but prevent others. +- Allow people to install specific devices but prevent other devices. > [!NOTE] > To find the difference between Device Installation and Removable storage access control, see [Microsoft Defender for Endpoint Device Control Removable Storage Protection](/microsoft-365/security/defender-endpoint/device-control-removable-storage-protection?view=o365-worldwide&preserve-view=true).
security	Microsoft Cloud App Security Integration	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-cloud-app-security-integration.md	The integration provides the following major improvements to the existing Defend - Available everywhere - Since the network activity is collected directly from the endpoint, it's available wherever the device is, on or off corporate network, as it's no longer depended on traffic routed through the enterprise firewall or proxy servers. -- Works out of the box, no configuration required - Forwarding cloud traffic logs to Defender for Cloud Apps requires firewall and proxy server configuration. With the Defender for Endpoint and Defender for Cloud Apps integration, there's no configuration required. Just switch it on in Microsoft Defender Security Center settings and you're good to go.\ +- Works out of the box, no configuration required - Forwarding cloud traffic logs to Defender for Cloud Apps requires firewall and proxy server configuration. With the Defender for Endpoint and Defender for Cloud Apps integration, there's no configuration required. Just switch it on in Microsoft 365 Defender settings and you're good to go. - Device context - Cloud traffic logs lack device context. Defender for Endpoint network activity is reported with the device context (which device accessed the cloud app), so you are able to understand exactly where (device) the network activity took place, in addition to who (user) performed it.
security	Microsoft Defender Endpoint Ios	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-ios.md	ms.technology: mde > Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) -Microsoft Defender for Endpoint on iOS offers protection against phishing and unsafe network connections from websites, emails, and apps. All alerts will be available through a single pane of glass in the Microsoft Defender Security Center. The portal gives security teams a centralized view of threats on iOS devices along with other platforms. +Microsoft Defender for Endpoint on iOS offers protection against phishing and unsafe network connections from websites, emails, and apps. All alerts will be available through a single pane of glass in the Microsoft 365 Defender portal. The portal gives security teams a centralized view of threats on iOS devices along with other platforms. > [!CAUTION] > Running other third-party endpoint protection products alongside Defender for Endpoint on iOS is likely to cause performance problems and unpredictable system errors. ms.technology: mde For Administrators -- Access to the Microsoft Defender Security Center portal. +- Access to the Microsoft 365 Defender portal. - Access to [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), to: - Deploy the app to enrolled user groups in your organization.
security	Microsoft Defender Security Center Antivirus	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-security-center-antivirus.md	Settings that were previously part of the Windows Defender client and main Windo See the [Windows Security article](/windows/threat-protection/windows-defender-security-center/windows-defender-security-center) for more information on other Windows security features that can be monitored in the app. -The Windows Security app is a client interface on Windows 10, version 1703 and later. It is not the Microsoft Defender Security Center web portal that is used to review and manage [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint). +The Windows Security app is a client interface on Windows 10, version 1703 and later. It is not the Microsoft 365 Defender web portal that is used to review and manage [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint). ## Review virus and threat protection settings in the Windows Security app
security	Microsoft Threat Experts	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-threat-experts.md	Microsoft Threat Experts - Targeted attack notification provides proactive hunti ## Microsoft Threat Experts - Experts on Demand -Customers can engage our security experts directly from within Microsoft Defender Security Center for timely and accurate response. Experts provide insights needed to better understand the complex threats affecting your organization, from alert inquiries, potentially compromised devices, root cause of a suspicious network connection, to additional threat intelligence regarding ongoing advanced persistent threat campaigns. With this capability, you can: +Customers can engage our security experts directly from within Microsoft 365 Defender for timely and accurate response. Experts provide insights needed to better understand the complex threats affecting your organization, from alert inquiries, potentially compromised devices, root cause of a suspicious network connection, to additional threat intelligence regarding ongoing advanced persistent threat campaigns. With this capability, you can: - Get additional clarification on alerts including root cause or scope of the incident - Gain clarity into suspicious device behavior and next steps if faced with an advanced attacker
security	Mssp Support	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mssp-support.md	To address this demand, managed security service providers (MSSP) offer to deliv Defender for Endpoint adds partnership opportunities for this scenario and allows MSSPs to take the following actions: -- Get access to MSSP customer's Microsoft Defender Security Center portal +- Get access to MSSP customer's Microsoft 365 Defender portal - Get email notifications, and - Fetch alerts through security information and event management (SIEM) tools
security	Non Windows	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/non-windows.md	Microsoft has been on a journey to extend its industry leading endpoint security Organizations face threats across a variety of platforms and devices. Our teams have committed to building security solutions not just for Microsoft, but also from Microsoft to enable our customers to protect and secure their heterogenous environments. We're listening to customer feedback and partnering closely with our customers to build solutions that meet their needs. -With Microsoft Defender for Endpoint, customers benefit from a unified view of all threats and alerts in the Microsoft Defender Security Center, across Windows and non-Windows platforms, enabling them to get a full picture of what's happening in their environment, which empowers them to more quickly assess and respond to threats. +With Microsoft Defender for Endpoint, customers benefit from a unified view of all threats and alerts in the Microsoft 365 Defender portal, across Windows and non-Windows platforms, enabling them to get a full picture of what's happening in their environment, which empowers them to more quickly assess and respond to threats. ## Microsoft Defender for Endpoint on macOS
security	Onboard Downlevel	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/onboard-downlevel.md	Once completed, you should see onboarded Windows servers in the portal within an ## Onboard Windows servers through Microsoft Defender for Cloud -1. In the Microsoft Defender Security Center navigation pane, select Settings > Device management > Onboarding. +1. In the Microsoft 365 Defender navigation pane, select Settings > Device management > Onboarding. 2. Select Windows Server 2008 R2 SP1 as the operating system.
security	Onboard Windows Multi Session Device	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/onboard-windows-multi-session-device.md	Follow the instructions for a single entry for each device. This scenario uses a centrally located script and runs it using a domain-based group policy. You can also place the script in the golden image and run it in the same way. -##### Download the WindowsDefenderATPOnboardingPackage.zip file from the Windows Defender Security Center +##### Download the WindowsDefenderATPOnboardingPackage.zip file from the Windows 365 Defender portal 1. Open the VDI configuration package .zip file (WindowsDefenderATPOnboardingPackage.zip)
security	Prevent Changes To Security Settings With Tamper Protection	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection.md	Tamper protection can be turned on or off for your tenant using the Microsoft 36 - When you use the Microsoft 365 Defender portal to manage tamper protection, you do not have to use Intune or the tenant attach method. -- When you manage tamper protection in the Microsoft Defender Security Center, the setting is applied tenant wide, affecting all of your devices that are running Windows 10, Windows 10 Enterprise multi-session, Windows 11, Windows 11 Enterprise multi-session, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 or Windows Server 2022. To fine-tune tamper protection (such as having tamper protection on for some devices but off for others), use either [Intune](#manage-tamper-protection-for-your-organization-using-intune) or [Configuration Manager with tenant attach](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006). +- When you manage tamper protection in the Microsoft 365 Defender portal, the setting is applied tenant wide, affecting all of your devices that are running Windows 10, Windows 10 Enterprise multi-session, Windows 11, Windows 11 Enterprise multi-session, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 or Windows Server 2022. To fine-tune tamper protection (such as having tamper protection on for some devices but off for others), use either [Intune](#manage-tamper-protection-for-your-organization-using-intune) or [Configuration Manager with tenant attach](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006). - If you have a hybrid environment, tamper protection settings configured in Intune take precedence over settings configured in the Microsoft 365 Defender portal.
security	Pull Alerts Using Rest Api	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/pull-alerts-using-rest-api.md	The _Client credential flow_ uses client credentials to authenticate against the Use the following method in the Microsoft Defender for Endpoint API to pull detections in JSON format. > [!NOTE] -> Microsoft Defender Security Center merges similar alert detections into a single alert. This API pulls alert detections in its raw form based on the query parameters you set, enabling you to apply your own grouping and filtering. +> Microsoft 365 Defender merges similar alert detections into a single alert. This API pulls alert detections in its raw form based on the query parameters you set, enabling you to apply your own grouping and filtering. ## Before you begin ago\|string\|Pulls alerts in the following time range: from `(current_time - ago)` limit\|int\|Defines the number of alerts to be retrieved. Most recent alerts will be retrieved based on the number defined.<p> NOTE: When not specified, all alerts available in the time range will be retrieved. machinegroups\|string\|Specifies device groups to pull alerts from. <p> NOTE: When not specified, alerts from all device groups will be retrieved. <p> Example: <br><br> `https://wdatp-alertexporter-eu.securitycenter.windows.com/api/alerts/?machinegroups=UKMachines&machinegroups=FranceMachines` DeviceCreatedMachineTags\|string\|Single device tag from the registry. -CloudCreatedMachineTags\|string\|Device tags that were created in Microsoft Defender Security Center. +CloudCreatedMachineTags\|string\|Device tags that were created in Microsoft 365 Defender. ### Request example
security	Respond Machine Alerts	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/respond-machine-alerts.md	When a device is being isolated, the following notification is displayed to info ## Consult a threat expert -You can consult a Microsoft threat expert for more insights regarding a potentially compromised device or already compromised ones. Microsoft Threat Experts can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights not just regarding a potentially compromised device, but also to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, or a threat intelligence context that you see on your portal dashboard. +You can consult a Microsoft threat expert for more insights regarding a potentially compromised device or already compromised ones. Microsoft Threat Experts can be engaged directly from within the Microsoft 365 Defender for timely and accurate response. Experts provide insights not just regarding a potentially compromised device, but also to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, or a threat intelligence context that you see on your portal dashboard. See [Consult a Microsoft Threat Expert](/microsoft-365/security/defender-endpoint/configure-microsoft-threat-experts#consult-a-microsoft-threat-expert-about-suspicious-cybersecurity-activities-in-your-organization) for details.
security	Server Migration	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/server-migration.md	Migration steps: 2. Uninstall SCEP. 3. Install the [prerequisites](configure-server-endpoints.md#prerequisites) where applicable. 4. Install Microsoft Defender for Endpoint (see [Configure server endpoints](configure-server-endpoints.md). - 5. Apply the onboarding script for use with Group Policy downloaded from [Microsoft Defender Security Center](https://securitycenter.microsoft.com). + 5. Apply the onboarding script for use with Group Policy downloaded from [Microsoft 365 Defender](https://security.microsoft.com). > [!TIP] > You can use the [installer script](server-migration.md#installer-script) as part of your application to automate the above steps. Value: 0 3. Uninstall System Center Endpoint Protection (Windows Server 2012 R2). 4. Install the [prerequisites](configure-server-endpoints.md#prerequisites) where applicable. 5. Install Microsoft Defender for Endpoint (see [Configure server endpoints](configure-server-endpoints.md).) -6. Apply the onboarding script for use with Group Policy downloaded from [Microsoft Defender Security Center](https://securitycenter.microsoft.com). +6. Apply the onboarding script for use with Group Policy downloaded from [Microsoft 365 Defender](https://security.microsoft.com). 7. Apply updates. 8. Create and apply policies using Group Policy, PowerShell, or a 3rd party management solution.
security	Tune Performance Defender Antivirus	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tune-performance-defender-antivirus.md	Microsoft Defender Antivirus performance analyzer has the following prerequisite - Supported Windows versions: Windows 10, Windows 11, and Windows Server 2016 and above - Platform Version: 4.18.2108.7+-- PowerShell Version: PowerShell Version 5.1 +- PowerShell Version: PowerShell Version 5.1, PowerShell ISE ## PowerShell reference There are two new PowerShell cmdlets used to tune performance of Microsoft Defender Antivirus:
security	Whats New In Microsoft Defender Endpoint	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint.md	For more information on Microsoft Defender for Endpoint on other operating syste ## March 2021-- [Manage tamper protection using the Microsoft Defender Security Center](prevent-changes-to-security-settings-with-tamper-protection.md#manage-tamper-protection-for-your-organization-using-the-microsoft-365-defender-portal) <br> You can manage tamper protection settings on Windows 10, Windows Server 2016, Windows Server 2019, and Windows Server 2022 by using a method called tenant attach. +- [Manage tamper protection using the Microsoft 365 Defender portal](prevent-changes-to-security-settings-with-tamper-protection.md#manage-tamper-protection-for-your-organization-using-the-microsoft-365-defender-portal) <br> You can manage tamper protection settings on Windows 10, Windows Server 2016, Windows Server 2019, and Windows Server 2022 by using a method called tenant attach. ## January 2021
security	Advanced Hunting Shared Queries	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-shared-queries.md	To generate a link that opens your query directly in the advanced hunting query Microsoft security researchers regularly share advanced hunting queries in a [designated public repository on GitHub](https://aka.ms/hunting-queries). This repository is open to contributions. To contribute, [join GitHub for free](https://github.com/). >[!tip] ->Microsoft security researchers also provide advanced hunting queries that you can use to locate activities and indicators associated with emerging threats. These queries are provided as part of the [threat analytics](/windows/security/threat-protection/microsoft-defender-atp/threat-analytics) reports in Microsoft Defender Security Center. +>Microsoft security researchers also provide advanced hunting queries that you can use to locate activities and indicators associated with emerging threats. These queries are provided as part of the [threat analytics](/windows/security/threat-protection/microsoft-defender-atp/threat-analytics) reports in Microsoft 365 Defender. ## Related topics
security	Custom Detection Rules	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/custom-detection-rules.md	You can also manage custom detections that apply to data from specific Microsoft To manage required permissions, a global administrator can: - Assign the security administrator or security operator role in [Microsoft 365 admin center](https://admin.microsoft.com/) under Roles > Security admin.-- Check RBAC settings for Microsoft Defender for Endpoint in [Microsoft Defender Security Center](https://securitycenter.windows.com/) under Settings > Permissions > Roles. Select the corresponding role to assign the manage security settings permission. +- Check RBAC settings for Microsoft Defender for Endpoint in [Microsoft 365 Defender](https://security.microsoft.com/) under Settings > Permissions > Roles. Select the corresponding role to assign the manage security settings permission. > [!NOTE] > To manage custom detections, security operators will need the manage security settings permission in Microsoft Defender for Endpoint if RBAC is turned on.
security	First Incident Remediate	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/first-incident-remediate.md	Microsoft 365 Defender offers several remediation actions that analysts can manu - Initiate automated investigation - You can start a new general purpose automated investigation on the device. While an investigation is running, any other alert generated from the device will be added to an ongoing automated investigation until that investigation is completed. In addition, if the same threat is seen on other devices, those devices are added to the investigation. - Initiate live response - Live response is a capability that gives you instantaneous access to a device by using a remote shell connection. This gives you the ability to do in-depth investigative work and take immediate response actions to promptly contain identified threats in real time. Live response is designed to enhance investigations by enabling you to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats. - Collect investigation package - As part of the investigation or response process, you can collect an investigation package from a device. By collecting the investigation package, you can identify the current state of the device and further understand the tools and techniques used by the attacker. -- Consult a threat expert (available in both Actions on devices and files) - You can consult a Microsoft threat expert for more insights regarding potentially compromised devices or devices that are already compromised. Microsoft threat experts can be engaged directly from within the Microsoft Defender Security Center for a timely and accurate response. +- Consult a threat expert (available in both Actions on devices and files) - You can consult a Microsoft threat expert for more insights regarding potentially compromised devices or devices that are already compromised. Microsoft threat experts can be engaged directly from within Microsoft 365 Defender for a timely and accurate response. ## Actions on files
security	M365d Autoir Results	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-autoir-results.md	With Microsoft 365 Defender, when an [automated investigation](m365d-autoir.md) The investigation page has recently been updated to include information across your devices, email, and collaboration content. The new, unified investigation page defines a common language and provides a unified experience for automatic investigations across [Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) and [Microsoft Defender for Office 365](../office-365-security/defender-for-office-365.md). To access the unified investigation page, select the link in the yellow banner you'll see on: - Any investigation page in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077143" target="_blank">Office 365 Security & Compliance Center</a>-- Any investigation page in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) +- Any investigation page in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) - Any incident or Action center experience in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> ## Open the investigation details view
security	M365d Configure Auto Investigation Response	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-configure-auto-investigation-response.md	Then, after you're all set up, you can [view and manage remediation actions in t Whether automated investigations run, and whether remediation actions are taken automatically or only upon approval for your devices depend on certain settings, such as your organization's device group policies. Review the configured automation level for your device group policies. -1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. +1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in. 2. Go to Settings > Permissions > Device groups.
security	Microsoft 365 Defender	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-defender.md	The cards fall into these categories: - Devices - Get up-to-date information on alerts, breach activity, and other threats on your devices. - Apps - Gain insight into how cloud apps are being used in your organization. [Learn more about discovered apps in Defender for Cloud Apps](/cloud-app-security/discovered-apps). + +#### Search across entities (Preview) + +>[!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +The search bar is located at the top of the page. As you type, suggestions are provided so that it's easier to find entities. The enhanced search results page centralizes the results from all entities. + +You can search across the following entities in Defender for Endpoint and Defender for Identity: + +- Devices - supported for both Defender for Endpoint and Defender for Identity. Supports use of search operators. +- Users - supported for Defender for Endpoint, Defender for Identity, and Defender for Cloud Apps. +- Files, IPs, and URLs - same capabilities as in Defender for Endpoint. + + >[!NOTE] + >IP and URL searches are exact match and donΓÇÖt appear in the search results page ΓÇô they lead directly to the entity page. + +- TVM - same capabilities as in Defender for Endpoint (vulnerabilities, software, and recommendations). + + +++++ ### Threat analytics with better data coverage Track and respond to emerging threats with the following Microsoft 365 Defender threat analytics integrated experience:
security	Microsoft 365 Security Center Mde	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-center-mde.md	This table is a quick reference of the changes between the Microsoft Defender Se \| Area \| Description of change \| \|\|\| -\|Search \| Instead of being in the heading, Microsoft Defender for Endpoint search bar is moving under the Endpoints section. You can continue to search for devices, files, users, URLs, IPs, vulnerabilities, software, and recommendations. \| +\|Search \| The search bar is located at the top of the page. Suggestions are provided as you type. You can search across the following entities in Defender for Endpoint and Defender for Identity: <br><br> - Devices - supported for both Defender for Endpoint and Defender for Identity. You can even use search operators, for example, you can use "contains" to search for part of a host name. <br><br> - Users - supported for both Defender for Endpoint and Defender for Identity. <br><br> - Files, IPs, and URLs - same capabilities as in Defender for Endpoint. <br> NOTE: IP and URL searches are exact match and donΓÇÖt appear in the search results page ΓÇô they lead directly to the entity page. <br><br> - TVM* - same capabilities as in Defender for Endpoint (vulnerabilities, software, and recommendations). <br><br> The enhanced search results page centralizes the results from all entities. \| \|[Dashboard](/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard) \| This is your security operations dashboard. See an overview of how many active alerts were triggered, which devices are at risk, which users are at risk, and severity level for alerts, devices, and users. You can also see if any devices have sensor issues, your overall service health, and how any unresolved alerts were detected. \| \|Device inventory \| No changes. \| \|[Vulnerability management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) \| Name was shortened to fit in the navigation pane. It's the same as the threat and vulnerability management section, with all the pages underneath. \|
security	Prerequisites	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/prerequisites.md	Currently, the Microsoft Defender for Office 365 integration into the unified Mi - Norway - Singapore - South Africa +- Sweden - Switzerland - United Arab Emirates
security	Identity Access Policies	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/identity-access-policies.md	To create a new app protection policy for each platform (iOS and Android) within ## Require approved apps and APP protection -To enforce the APP protection policies you applied in Intune, you must create a Conditional Access policy to require approved client apps and the conditions set in the APP protection policies. +To enforce the App protection policies you applied in Intune, you must create a Conditional Access policy to require approved client apps and the conditions set in the APP protection policies. -Enforcing APP protection policies requires a set of policies described in [Require app protection policy for cloud app access with Conditional Access](/azure/active-directory/conditional-access/app-protection-based-conditional-access). These policies are each included in this recommended set of identity and access configuration policies. +Enforcing App protection policies requires a set of policies described in [Require app protection policy for cloud app access with Conditional Access](/azure/active-directory/conditional-access/app-protection-based-conditional-access). These policies are each included in this recommended set of identity and access configuration policies. -To create the Conditional Access policy that requires approved apps and APP protection, follow "Step 1: Configure an Azure AD Conditional Access policy for Microsoft 365" in [Scenario 1: Microsoft 365 apps require approved apps with app protection policies](/azure/active-directory/conditional-access/app-protection-based-conditional-access#scenario-1-office-365-apps-require-approved-apps-with-app-protection-policies), which allows Outlook for iOS and Android, but blocks OAuth capable Exchange ActiveSync clients from connecting to Exchange Online. +To create the Conditional Access policy that requires approved apps and APP protection, follow the steps in [Conditional Access: Require approved client apps or app protection policy](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection), which only allows accounts within apps protected by App protection policies to access Microsoft 365 endpoints. > [!NOTE] - > This policy ensures mobile users can access all Office endpoints using the applicable apps. - -If you are enabling mobile access to Exchange Online, implement [Block ActiveSync clients](secure-email-recommended-policies.md#block-activesync-clients), which prevents Exchange ActiveSync clients leveraging basic authentication from connecting to Exchange Online. This policy is not pictured in the illustration at the top of this article. It is described and pictured in [Policy recommendations for securing email](secure-email-recommended-policies.md). + > This policy ensures mobile users can access all Microsoft 365 endpoints using the applicable apps. -To create the Conditional Access policy that requires Edge for iOS and Android, follow "Step 2: Configure an Azure AD Conditional Access policy for Microsoft 365" in [Scenario 2: Browser apps require approved apps with app protection policies](/azure/active-directory/conditional-access/app-protection-based-conditional-access#scenario-2-browser-apps-require-approved-apps-with-app-protection-policies), which allows Edge for iOS and Android, but blocks other mobile device web browsers from connecting to Microsoft 365 endpoints. +This policy also blocks Exchange ActiveSync clients from connecting to Exchange Online. However, you can create a separate policy for handling Exchange ActiveSync. For more information, see [Block ActiveSync clients](secure-email-recommended-policies.md#block-activesync-clients), which prevents Exchange ActiveSync clients leveraging basic authentication from connecting to Exchange Online. This policy is not pictured in the illustration at the top of this article. It is described and pictured in [Policy recommendations for securing email](secure-email-recommended-policies.md). These policies leverage the grant controls [Require approved client app](/azure/active-directory/conditional-access/concept-conditional-access-grant#require-approved-client-app) and [Require app protection policy](/azure/active-directory/conditional-access/concept-conditional-access-grant#require-app-protection-policy).
security	Office 365 Air	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/office-365-air.md	The new and improved Microsoft 365 Defender portal <https://security.microsoft.c > The new Microsoft 365 Defender portal replaces the following admin centers: > > - Security & Compliance Center (<https://protection.office.com>) -> - Microsoft Defender Security Center (<https://securitycenter.windows.com>) +> - Microsoft 365 Defender (<https://security.microsoft.com>) > > In addition to the URL changing, there's a new look and feel, designed to give your security team a more streamlined experience, with visibility to more threat detections in one place.
security	Permissions In The Security And Compliance Center	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center.md	To see how to grant access to the Security & Compliance Center, check out [Give \|Communication Compliance Analysts\|Analysts of communication compliance that can investigate policy matches, view message meta data, and take remediation actions.\|Communication Compliance Analysis <p> Communication Compliance Case Management\| \|Communication Compliance Investigators\|Analysts of communication compliance that can investigate policy matches, view message content, and take remediation actions.\|Case Management <p> Communication Compliance Analysis <p> Communication Compliance Case Management <p> Communication Compliance Investigation <p> Data Classification Feedback Provider <p> View-Only Case\| \|Communication Compliance Viewers\|Viewer of communication compliance that can access the available reports and widgets.\|Communication Compliance Case Management <p> Communication Compliance Viewer\| -\|Compliance Administrator<sup>1</sup>\|Members can manage settings for device management, data loss prevention, reports, and preservation.\|Case Management <p> Communication Compliance Admin <p> Communication Compliance Case Management <p> Compliance Administrator <p> Compliance Search <p> Data Classification Feedback Provider <p> Data Classification Feedback Reviewer <p> Data Investigation Management <p> Device Management <p> Disposition Management <p> DLP Compliance Management <p> Hold <p> IB Compliance Management <p> Insider Risk Management Admin <p> Manage Alerts <p> Organization Configuration <p> RecordManagement <p> Retention Management <p> View-Only Audit Logs <p> View-Only Case <p> View-Only Device Management <p> View-Only DLP Compliance Management <p> View-Only IB Compliance Management <p> View-Only Manage Alerts <p> View-Only Recipients <p> View-Only Record Management <p> View-Only Retention Management\| -\|Compliance Data Administrator\|Members can manage settings for device management, data protection, data loss prevention, reports, and preservation.\|Compliance Administrator <p> Compliance Search <p> Device Management <p> Disposition Management <p> DLP Compliance Management <p> IB Compliance Management <p> Manage Alerts <p> Organization Configuration <p> RecordManagement <p> Retention Management <p> Sensitivity Label Administrator <p> View-Only Audit Logs <p> View-Only Device Management <p> View-Only DLP Compliance Management <p> View-Only IB Compliance Management <p> View-Only Manage Alerts <p> View-Only Recipients <p> View-Only Record Management <p> View-Only Retention Management\| +\|Compliance Administrator<sup>1</sup>\|Members can manage settings for device management, data loss prevention, reports, and preservation.\|Case Management <p> Communication Compliance Admin <p> Communication Compliance Case Management <p> Compliance Administrator <p> Compliance Search <p> Data Classification Feedback Provider <p> Data Classification Feedback Reviewer <p> Data Investigation Management <p> Device Management <p> Disposition Management <p> DLP Compliance Management <p> Hold <p> IB Compliance Management <p> Information Protection Admin <p> Information Protection Analyst <p> Information Protection Investigator <p> Information Protection Reader <p> Insider Risk Management Admin <p> Manage Alerts <p> Organization Configuration <p> RecordManagement <p> Retention Management <p> View-Only Audit Logs <p> View-Only Case <p> View-Only Device Management <p> View-Only DLP Compliance Management <p> View-Only IB Compliance Management <p> View-Only Manage Alerts <p> View-Only Recipients <p> View-Only Record Management <p> View-Only Retention Management\| +\|Compliance Data Administrator\|Members can manage settings for device management, data protection, data loss prevention, reports, and preservation.\|Compliance Administrator <p> Compliance Search <p> Device Management <p> Disposition Management <p> DLP Compliance Management <p> IB Compliance Management <p> Information Protection Admin <p> Information Protection Analyst <p> Information Protection Investigator <p> Information Protection Reader <p> Manage Alerts <p> Organization Configuration <p> RecordManagement <p> Retention Management <p> Sensitivity Label Administrator <p> View-Only Audit Logs <p> View-Only Device Management <p> View-Only DLP Compliance Management <p> View-Only IB Compliance Management <p> View-Only Manage Alerts <p> View-Only Recipients <p> View-Only Record Management <p> View-Only Retention Management\| \|Compliance Manager Administrators\|Manage template creation and modification.\|Compliance Manager Administration <p> Compliance Manager Assessment <p> Compliance Manager Contribution <p> Compliance Manager Reader\| \|Compliance Manager Assessors\|Create assessments, implement improvement actions, and update test status for improvement actions.\|Compliance Manager Assessment <p> Compliance Manager Contribution <p> Compliance Manager Reader\| \|Compliance Manager Contributors\|Create assessments and perform work to implement improvement actions.\|Compliance Manager Contribution <p> Compliance Manager Reader\| To see how to grant access to the Security & Compliance Center, check out [Give \|Data Investigator\|Perform searches on mailboxes, SharePoint Online sites, and OneDrive for Business locations.\|Communication <p> Compliance Search <p> Custodian <p> Data Investigation Management <p> Export <p> Preview <p> Review <p> RMS Decrypt <p> Search And Purge\| \|eDiscovery Manager\|Members can perform searches and place holds on mailboxes, SharePoint Online sites, and OneDrive for Business locations. Members can also create and manage eDiscovery cases, add and remove members to a case, create and edit Content Searches associated with a case, and access case data in Advanced eDiscovery. <p> An eDiscovery Administrator is a member of the eDiscovery Manager role group who has been assigned additional permissions. In addition to the tasks that an eDiscovery Manager can perform, an eDiscovery Administrator can:<ul><li>View all eDiscovery cases in the organization.</li><li>Manage any eDiscovery case after they add themselves as a member of the case.</li></ul> <p> The primary difference between an eDiscovery Manager and an eDiscovery Administrator is that an eDiscovery Administrator can access all cases that are listed on the eDiscovery cases page in the Security & Compliance Center. An eDiscovery manager can only access the cases they created or cases they are a member of. For more information about making a user an eDiscovery Administrator, see [Assign eDiscovery permissions in the Security & Compliance Center](../../compliance/assign-ediscovery-permissions.md).\|Case Management <p> Communication <p> Compliance Search <p> Custodian <p> Export <p> Hold <p> Preview <p> Review <p> RMS Decrypt\| \|Global Reader\|Members have read-only access to reports, alerts, and can see all the configuration and settings.<p> The primary difference between Global Reader and Security Reader is that a Global Reader can access configuration and settings.\|Security Reader <p> Sensitivity Label Reader <p> Service Assurance View <p> View-Only Audit Logs <p> View-Only Device Management <p> View-Only DLP Compliance Management <p> View-Only IB Compliance Management <p> View-Only Manage Alerts <p> View-Only Recipients <p> View-Only Record Management <p> View-Only Retention Management\| +\|Information Protection\|Full control over all information protection features, including sensitivity labels and their policies, DLP, all classifier types, activity and content explorers, and all related reports.\|Data Classification Content Viewer <p> Information Protection Admin <p> Information Protection Analyst <p> Information Protection Investigator <p> Information Protection Reader\| +\|Information Protection Admins\|Create, edit, and delete DLP policies, sensitivity labels and their policies, and all classifier types. Manage endpoint DLP settings and simulation mode for auto-labeling policies.\|Information Protection Admin\| +\|Information Protection Analysts\|Access and manage DLP alerts and activity explorer. View-only access to DLP policies, sensitivity labels and their policies, and all classifier types.\|Data Classification List Viewer <p> Information Protection Analyst\| +\|Information Protection Investigators\|Access and manage DLP alerts, activity explorer, and content explorer. View-only access to DLP policies, sensitivity labels and their policies, and all classifier types.\|Data Classification Content Viewer <p> Information Protection Analyst <p> Information Protection Investigator\| +\|Information Protection Readers\|View-only access to reports for DLP polcies and sensitivity labels and their policies.\|Information Protection Reader\| \|Insider Risk Management\|Use this role group to manage insider risk management for your organization in a single group. By adding all user accounts for designated administrators, analysts, and investigators, you can configure insider risk management permissions in a single group. This role group contains all the insider risk management permission roles. This is the easiest way to quickly get started with insider risk management and is a good fit for organizations that do not need separate permissions defined for separate groups of users.\|Case Management <p> Insider Risk Management Admin <p> Insider Risk Management Analysis <p> Insider Risk Management Audit <p> Insider Risk Management Investigation <p> Insider Risk Management Sessions <p> View-Only Case\| \|Insider Risk Management Admins\|Use this role group to initially configure insider risk management and later to segregate insider risk administrators into a defined group. Users in this role group can create, read, update, and delete insider risk management policies, global settings, and role group assignments.\|Case Management <p> Insider Risk Management Admin <p> View-Only Case\| \|Insider Risk Management Analysts\|Use this group to assign permissions to users that will act as insider risk case analysts. Users in this role group can access all insider risk management alerts, cases, and notices templates. They cannot access the insider risk Content Explorer.\|Case Management <p> Insider Risk Management Analysis <p> View-Only Case\| Note that the following roles aren't assigned to the Organization Management rol - Data Investigation Management - Disposition Management - Export +- Information Protection Admin +- Information Protection Analyst +- Information Protection Investigator +- Information Protection Reader - Insider Risk Management Analysis - Insider Risk Management Audit - Insider Risk Management Investigation Note that the following roles aren't assigned to the Organization Management rol \|Compliance Manager Reader\|View all Compliance Manager content except for administrator functions.\|Compliance Manager Administrators <p> Compliance Manager Assessors <p> Compliance Manager Contributors <p> Compliance Manager Readers\| \|Compliance Search\|Perform searches across mailboxes and get an estimate of the results.\|Compliance Administrator <p> Compliance Data Administrator <p> Data Investigator <p> eDiscovery Manager <p> Organization Management <p> Security Operator\| \|Custodian\|Identify and manage custodians for Advanced eDiscovery cases and use the information from Azure Active Directory and other sources to find data sources associated with custodians. Associate other data sources such as mailboxes, SharePoint sites, and Teams with custodians in a case. Place a legal hold on the data sources associated with custodians to preserve content in the context of a case.\|Data Investigator <p> eDiscovery Manager\| -\|Data Classification Content Viewer\|View in-place rendering of files in Content explorer.\|Content Explorer Content Viewer <p> Privacy Management <p> Privacy Management Investigators\| +\|Data Classification Content Viewer\|View in-place rendering of files in Content explorer.\|Content Explorer Content Viewer <p> Information Protection <p> Information Protection Investigators <p> Privacy Management <p> Privacy Management Investigators\| \|Data Classification Feedback Provider\|Allows providing feedback to classifiers in content explorer.\|Communication Compliance <p> Communication Compliance Investigators <p> Compliance Administrator\| \|Data Classification Feedback Reviewer\|Allows reviewing feedback from classifiers in feedback explorer.\|Compliance Administrator\| -\|Data Classification List Viewer\|View the list of files in content explorer.\|Content Explorer List Viewer <p> Privacy Management <p> Privacy Management Analysts <p> Privacy Management Investigators <p> Privacy Management Viewers\| +\|Data Classification List Viewer\|View the list of files in content explorer.\|Content Explorer List Viewer <p> Information Protection Analysts <p> Privacy Management <p> Privacy Management Analysts <p> Privacy Management Investigators <p> Privacy Management Viewers\| \|Data Investigation Management\|Create, edit, delete, and control access to data investigation.\|Compliance Administrator <p> Data Investigator\| \|Device Management\|View and edit settings and reports for device management features.\|Compliance Administrator <p> Compliance Data Administrator <p> Organization Management <p> Security Administrator\| \|Disposition Management\|Control permissions for accessing Manual Disposition in the Security & Compliance Center.\|Compliance Administrator <p> Compliance Data Administrator <p> Records Management\| Note that the following roles aren't assigned to the Organization Management rol \|Export\|Export mailbox and site content that's returned from searches.\|Data Investigator <p> eDiscovery Manager\| \|Hold\|Place content in mailboxes, sites, and public folders on hold. When on hold, a copy of the content is stored in a secure location. Content owners will still be able to modify or delete the original content.\|Compliance Administrator <p>eDiscovery Manager <p> Organization Management\| \|IB Compliance Management\|View, create, remove, modify, and test Information Barrier policies.\|Compliance Administrator <p> Compliance Data Administrator <p> Organization Management <p> Security Administrator\| +\|Information Protection Admin\| Create, edit, and delete DLP policies, sensitivity labels and their policies, and all classifier types. Manage endpoint DLP settings and simulation mode for auto-labeling policies.\|Compliance Administrator <p> Compliance Data Administrator <p> Information Protection <p> Information Protection Admins\| +\|Information Protection Analyst\|Access and manage DLP alerts and activity explorer. View-only access to DLP policies, sensitivity labels and their policies, and all classifier types.\|Compliance Administrator <p> Compliance Data Administrator <p> Information Protection <p> Information Protection Analysts <p> Information Protection Investigators\| +\|Information Protection Investigator\|Access and manage DLP alerts, activity explorer, and content explorer. View-only access to DLP policies, sensitivity labels and their policies, and all classifier types.\|Compliance Administrator <p> Compliance Data Administrator <p> Information Protection <p> Information Protection Investigators\| +\|Information Protection Reader\|View-only access to reports for DLP policies and sensitivity labels and their policies.\|Compliance Administrator <p> Compliance Data Administrator <p> Information Protection <p> Information Protection Readers\| \|Insider Risk Management Admin\|Create, edit, delete, and control access to Insider Risk Management feature.\|Compliance Administrator <p> Insider Risk Management <p> Insider Risk Management Admins <p> Organization Management\| \|Insider Risk Management Analysis\|Access all insider risk management alerts, cases, and notices templates.\|Insider Risk Management <p> Insider Risk Management Analysts\| \|Insider Risk Management Audit\|Allow viewing Insider Risk audit trails.\|Insider Risk Management <p> Insider Risk Management Auditors\|
security	Threat Explorer	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/threat-explorer.md	This example uses Threat Explorer. ### Preview email header and download email body -You can now preview an email header and download the email body in Threat Explorer. Admins can analyze downloaded headers/email messages for threats. Because downloading email messages can risk exposure of information, this process is controlled by role-based access control (RBAC). A new role, Preview, must be added to another role group (such as Security Operations or Security Administrator) to grant the ability to download mails in all-email messages view. However, viewing the email header does not require any additional role (other than what is required to view messages in Threat Explorer). +You can now preview an email header and download the email body in Threat Explorer. Admins can analyze downloaded headers/email messages for threats. Because downloading email messages can risk exposure of information, this process is controlled by role-based access control (RBAC). A new role, Preview, is required to grant the ability to download mails in all-email messages view. However, viewing the email header does not require any additional role (other than what is required to view messages in Threat Explorer). To create a new role group with the Preview role: + +1. Select a built-in role group that only has the Preview role, such as Data Investigator or eDiscovery Manager. +2. Select Copy role group. +3. Choose a name and description for your new role group and select Next. +4. Modify the roles by adding and removing roles as necessary but leaving the Preview role. +5. Add members and then select Create role group. Explorer and Real-time detections will also get new fields that provide a more complete picture of where your email messages land. These changes make hunting easier for Security Ops. But the main result is you can know the location of problem email messages at a glance.
security	Use Dkim To Validate Outbound Email	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email.md	Since both 1024 and 2048 bitness are supported for DKIM keys, these directions w - When you already have DKIM configured, you rotate bitness by running the following command: ```powershell - Rotate-DkimSigningConfig -KeySize 2048 -Identity {Guid of the existing Signing Config} + Rotate-DkimSigningConfig -KeySize 2048 -Identity <DkimSigningConfigIdParameter> ``` or If you have provisioned custom domains in addition to the initial domain in Micr Use the following format for the CNAME records. > [!IMPORTANT] -> If you are one of our GCC High customers, we calculate _domainGuid_ differently! Instead of looking up the MX record for your _initialDomain_ to calculate _domainGuid_, instead we calculate it directly from the customized domain. For example, if your customized domain is "contoso.com" your domainGuid becomes "contoso-com", any periods are replaced with a dash. So, regardless of what MX record your initialDomain points to, you'll always use the above method to calculate the domainGuid to use in your CNAME records. +> If you are one of our GCC High customers, we calculate _customDomainIdentifier_ differently! Instead of looking up the MX record for your _initialDomain_ to calculate _customDomainIdentifier_, instead we calculate it directly from the customized domain. For example, if your customized domain is "contoso.com" your _customDomainIdentifier_ becomes "contoso-com", any periods are replaced with a dash. So, regardless of what MX record your _initialDomain_ points to, you'll always use the above method to calculate the _customDomainIdentifier_ to use in your CNAME records. ```console Host name: selector1._domainkey -Points to address or value: selector1-<domainGUID>._domainkey.<initialDomain> +Points to address or value: selector1-<customDomainIdentifier>._domainkey.<initialDomain> TTL: 3600 Host name: selector2._domainkey -Points to address or value: selector2-<domainGUID>._domainkey.<initialDomain> +Points to address or value: selector2-<customDomainIdentifier>._domainkey.<initialDomain> TTL: 3600 ``` Where: - For Microsoft 365, the selectors will always be "selector1" or "selector2".-- _domainGUID_ is the same as the _domainGUID_ in the customized MX record for your custom domain that appears before mail.protection.outlook.com. For example, in the following MX record for the domain contoso.com, the _domainGUID_ is contoso-com: +- _customDomainIdentifier_ is the same as the _customDomainIdentifier_ in the customized MX record for your custom domain that appears before mail.protection.outlook.com. For example, in the following MX record for the domain contoso.com, the _customDomainIdentifier_ is contoso-com: > contoso.com. 3600 IN MX 5 contoso-com.mail.protection.outlook.com
solutions	Empower People To Work Remotely Manage Endpoints	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-manage-endpoints.md	For more information, see this [overview of Configuration Manager](/mem/configmg ## Co-management -Co-management combines your existing on-premises Configuration Manager investment with the cloud using Intune and other Microsoft 365 cloud services. You choose whether Configuration Manager or Intune is the management authority for different workload. +Co-management combines your existing on-premises Configuration Manager investment with the cloud using Intune and other Microsoft 365 cloud services. You choose whether Configuration Manager or Intune is the management authority for different workloads. Co-management uses Intune-based cloud features, including Conditional Access and enforcing device compliance. You keep some tasks on-premises, while running other tasks in the cloud. For more information, see this [overview of co-management](/mem/configmgr/comanage/overview). -## Desktop Analytics +## Endpoint Analytics -Desktop Analytics is a cloud-based service that integrates with Configuration Manager and provides you with insight and intelligence so you can make informed decisions about your Windows clients. It combines data from your organization with data aggregated from millions of other devices connected to Microsoft cloud services. +Endpoint Analytics is a cloud-based service that integrates with Configuration Manager and provides you with insight and intelligence so you can make informed decisions about your Windows clients. It combines data from your organization with data aggregated from millions of other devices connected to Microsoft cloud services. -With Desktop Analytics, you can: +With Endpoint Analytics, you can: - Create an inventory of apps running in your organization. - Assess app compatibility with the latest Windows 10 feature updates. With Desktop Analytics, you can: - Create pilot groups that represent the entire application and driver estate across a minimal set of devices. - Deploy Windows 10 to pilot and production-managed devices. -For more information, see this [overview of Desktop Analytics](/mem/configmgr/desktop-analytics/overview) +For more information, see this [overview of Endpoint Analytics](/mem/configmgr/desktop-analytics/overview) ## Windows Autopilot
solutions	Empower People To Work Remotely Remote Access	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-remote-access.md	Here are the primary configurations for remote access: See this flowchart for the remote access configuration options discussed in this article. -![Remote access configuration flowchart.](../media/empower-people-to-work-remotely-remote-access/empower-people-to-work-remotely-remote-access-flowchart.png) With remote access connections, you can also use [Remote Desktop](https://support.microsoft.com/help/4028379/windows-10-how-to-use-remote-desktop) to connect your users to an on-premises PC. For example, a remote worker can use Remote Desktop to connect to the PC in their office from their Windows, iOS, or Android device. Once they are remotely connected, they can use it as if they were sitting in front of it. If your remote workers are using a traditional VPN client to obtain remote acces Without split tunneling, all of your remote work traffic gets sent across the VPN connection, where it must be forwarded to your organizationΓÇÖs edge devices, get processed, and then sent on the Internet. -![Network traffic from VPN clients without tunneling.](../media/empower-people-to-work-remotely-remote-access/empower-people-to-work-remotely-remote-access-before-tunneling.png) Microsoft 365 traffic must take an indirect route through your organization, which could be forwarded to a Microsoft network entry point far away from the VPN clientΓÇÖs physical location. This indirect path adds latency to the network traffic and decreases overall performance. To optimize access to Microsoft 365 cloud resources, configure your split tunnel Here is the resulting traffic flow, in which most of the traffic to Microsoft 365 cloud apps bypass the VPN connection. -![Network traffic from VPN clients with tunneling.](../media/empower-people-to-work-remotely-remote-access/empower-people-to-work-remotely-remote-access-after-tunneling.png) This allows the VPN client to send and receive crucial Microsoft 365 cloud service traffic directly over the Internet and to the nearest entry point into the Microsoft network. If your remote workers are not using a traditional VPN client and your on-premis Here are the components of Azure AD Application Proxy. -![Components of Azure AD Application Proxy.](../media/empower-people-to-work-remotely-remote-access/empower-people-to-work-remotely-remote-access-application-proxy.png) For more information, see this [overview of Azure AD Application Proxy](/azure/active-directory/manage-apps/application-proxy). If your remote workers are not using a traditional VPN client and you have apps A P2S VPN connection creates a secure connection from a remote workerΓÇÖs device to your organization network through an Azure virtual network. -![Components of Azure P2S VPN.](../media/empower-people-to-work-remotely-remote-access/empower-people-to-work-remotely-remote-access-p2s-vpn.png) For more information, see this [overview of P2S VPN](/azure/vpn-gateway/point-to-site-about). > [!NOTE] > Azure P2S VPN is not included with a Microsoft 365 subscription. You must pay for usage with a separate Azure subscription. -## Deploy Azure Virtual Desktop to provide remote access for remote workers using personal devices +## Deploy Windows 365 to provide remote access for remote workers using personal devices -To support remote workers who can only use their personal and unmanaged devices, use Azure Virtual Desktop to create and allocate virtual desktops for your users to use from home. Virtualized PCs can act just like PCs connected to your organization's network. +To support remote workers who can only use their personal and unmanaged devices, use Windows 365 to create and allocate virtual desktops for your users to use from home. With an on-premises network connection (OPNC), Windows 365 Cloud PCs can act just like PCs connected to your organization's network. -![Components of Azure Virtual Desktop.](../media/empower-people-to-work-remotely-remote-access/empower-people-to-work-remotely-remote-access-windows-virtual-desktop.png) -For more information, see this [overview of Azure Virtual Desktop](/azure/virtual-desktop/overview). +For more information, see this [overview of Windows 365](/windows-365/overview). > [!NOTE] -> Azure Virtual Desktop is not included with a Microsoft 365 subscription. You must pay for usage with a separate Azure subscription. +> Windows 365 is not included with a Microsoft 365 subscription. You must pay for usage with a separate subscription. ## Protect your Remote Desktop Services connections with the Remote Desktop Services Gateway If you are using Remote Desktop Services (RDS) to allow employees to connect into Windows-based computers on your on-premises network, you should use a Microsoft Remote Desktop Services gateway in your edge network. The gateway uses Transport Layer Security (TLS) to encrypt traffic and prevents the on-premises computer hosting RDS from being directly exposed to the Internet. -![Remote Desktop Services connections with the Remote Desktop Services Gateway.](../media/empower-people-to-work-remotely-remote-access/empower-people-to-work-remotely-remote-access-remote-desktop.png) See [this article](https://www.microsoft.com/security/blog/2020/04/16/security-guidance-remote-desktop-adoption/) for more information. After deployment of a remote access solution for your remote workers: \| A remote access VPN solution is in place \| You have configured your remote access VPN client for split tunneling and for the Optimize category of Microsoft 365 endpoints. \| \| No remote access VPN solution and you need remote access only to on-premises web-based apps \| You have configured Azure Application Proxy. \| \| No remote access VPN solution and you need access to on-premises apps, some of which are not web-based \| You have configured Azure P2S VPN. \| -\| Remote workers are using their personal devices from home \| You have configured Azure Virtual Desktop. \| +\| Remote workers are using their personal devices from home \| You have configured Windows 365. \| \| Remote workers are using RDS connections to on-premises systems \| You have deployed a Remote Desktop Services gateway in your edge network. \| \|\|\|
solutions	Empower People To Work Remotely Secure Sign In	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-secure-sign-in.md	Conditional Access policies are a set of rules that specify the conditions under This policy allows you to require MFA based on group membership, rather than trying to configure individual user accounts for MFA when they are assigned or unassigned from these administrator roles. -You can also use Conditional Access policies for more advanced capabilities, such as requiring that the sign-in is done from a compliant device, such as your laptop running Windows 10. +You can also use Conditional Access policies for more advanced capabilities, such as requiring that the sign-in is done from a compliant device, such as your laptop running Windows 11 or 10. Conditional Access requires Azure AD Premium P1 licenses, which are included with Microsoft 365 E3 and E5.
solutions	Empower People To Work Remotely Security Compliance	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-security-compliance.md	Remote work needs these elements of security and compliance: - Controlled access to the productivity apps that hybrid workers use, such as Microsoft Teams - Controlled access to and protection of the data that hybrid workers create and use, such as chat conversations or shared files-- Protection of Windows 10 devices from malware and other types of cyberattacks +- Protection of Windows 11 or 10 devices from malware and other types of cyberattacks - Protection of email, files, and site with consistent labeling for levels of sensitivity and protection - Prevention of leaked information - Adherence to regional data regulations For your hybrid workers, you have implemented: - Security - Controlled access to apps and data that hybrid workers use to communicate and collaborate - - Malware protection for cloud service data, email, and Windows 10 devices + - Malware protection for cloud service data, email, and Windows 11 or 10 devices - Compliance - Consistent labeling for levels of sensitivity and protection - Policies to prevention information leakage
solutions	Empower People To Work Remotely Train Monitor Usage	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-train-monitor-usage.md	Train your hybrid workers on: - Proper sign-in procedures using MFA, including registering an additional verification method. - The use of devices and how endpoint management policies can be used to block access for non-compliant or unmanaged devices. - The use of allowed apps and how endpoint management application polices can be used to block the use of some apps.-- Windows 10 Enterprise security features. +- Windows 11 or 10 Enterprise security features. - How to use [Teams](/microsoftteams/training-microsoft-teams-landing-page) for chat, video-based conferencing, document sharing, and threaded conversations. - How to use [Outlook](https://support.office.com/article/outlook-training-8a5b816d-9052-4190-a5eb-494512343cca) for email and scheduling. - How to use [SharePoint](https://support.office.com/article/sharepoint-online-video-training-cb8ef501-84db-4427-ac77-ec2009fb8e23) team or communication sites and [OneDrive](https://support.office.com/article/onedrive-video-training-1f608184-b7e6-43ca-8753-2ff679203132) folders to browse and collaborate on files in a user's library and those belonging to a group.
solutions	Empower People To Work Remotely	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely.md	For IT professionals managing onsite and cloud-based infrastructure to enable hy - Secure - Sign-ins are secured with multi-factor authentication (MFA) and built-in security features of Microsoft 365 and Windows 10 protect against malware, malicious attacks, and data loss. + Sign-ins are secured with multi-factor authentication (MFA) and built-in security features of Microsoft 365 and Windows 11 or 10 protect against malware, malicious attacks, and data loss. - Managed For IT professionals managing onsite and cloud-based infrastructure to enable hy - Shared tasks and workflows to divide up the work and get things done. -For a seamless sign-in experience, your on-premises Active Directory Domain Services (AD DS) user accounts should be synchronized with Azure Active Directory (Azure AD). To protect your Windows 10 devices, they should be enrolled in Intune. Here is a high-level view of the infrastructure. +For a seamless sign-in experience, your on-premises Active Directory Domain Services (AD DS) user accounts should be synchronized with Azure Active Directory (Azure AD). To protect your Windows 11 or 10 devices, they should be enrolled in Intune. Here is a high-level view of the infrastructure. ![The basic infrastructure for hybrid workers with Microsoft 365.](../media/empower-people-to-work-remotely/remote-workers-basic-infrastructure.png) To enable the capabilities of Microsoft 365 for your hybrid workers, use these M \|Self-Service Password Reset (SSPR)\|Allow your users to reset or unlock their passwords or accounts.\|Microsoft 365 E3 or E5\| \|Azure AD Application Proxy\|Provide secure remote access for web-based applications hosted on intranet servers.\|Requires separate paid Azure subscription\| \|Azure Point-to-Site VPN\|Create a secure connection from a remote workerΓÇÖs device to your intranet through an Azure virtual network.\|Requires separate paid Azure subscription\| -\|Windows Virtual Desktop\|Support remote workers who can only use their personal and unmanaged devices with virtual desktops running in Azure.\|Requires separate paid Azure subscription\| +\|Windows 365\|Support remote workers who can only use their personal and unmanaged devices with Windows 365 Cloud PCs.\|Requires separate paid Azure subscription\| \|Remote Desktop \|Allow employees to connect into Windows-based computers on your intranet.\|Microsoft 365 E3 or E5\| \|Remote Desktop Services Gateway\|Encrypt communications and prevent the RDS hosts from being directly exposed to the Internet.\|Requires separate Windows Server licenses\| \|Microsoft Intune\|Manage devices and applications.\|Microsoft 365 E3 or E5\| \|Configuration Manager\|Manage software installations, updates, and settings on your devices\|Requires separate Configuration Manager licenses\| -\|Desktop Analytics\|Determine the update readiness of your Windows clients.\|Requires separate Configuration Manager licenses\| -\|Windows Autopilot\|Set up and pre-configure new Windows 10 devices for productive use.\|Microsoft 365 E3 or E5\| +\|Endpoint Analytics\|Determine the update readiness of your Windows clients.\|Requires separate Configuration Manager licenses\| +\|Windows Autopilot\|Set up and pre-configure new Windows 11 or 10 devices for productive use.\|Microsoft 365 E3 or E5\| \|Microsoft Teams, Exchange Online, SharePoint Online and OneDrive, Microsoft 365 Apps, Microsoft Power Platform, and Yammer\|Create, communicate, and collaborate.\|Microsoft 365 E3 or E5\| \|\|\|\| For a 2-page summary of this solution, see the [Empower hybrid workers poster](h [![Empower hybrid workers poster.](../media/empower-people-to-work-remotely/empower-remote-workers-poster.png)](https://download.microsoft.com/download/9/b/b/9bb5fa79-74e9-497b-87c5-4021e53d9fc2/hybrid-worker-infrastructure.pdf) -You can also download this poster in [PowerPoint](https://download.microsoft.com/download/9/b/b/9bb5fa79-74e9-497b-87c5-4021e53d9fc2/hybrid-worker-infrastructure.pptx) format and print it on letter, legal, or tabloid (11 x 17) size paper. - ## Provide hybrid working for all of your workers You can enable all of your workers to stay productive from anywhere with these devices: -- A modern device, such as a Surface laptop and Windows 10, which has the features, security, and performance to access Microsoft 365 cloud apps and services directly over the web. +- A modern device, such as a Surface laptop and Windows 11 or 10, which has the features, security, and performance to access Microsoft 365 cloud apps and services directly over the web. -- Any device including older laptops or desktops used from home, which can access Microsoft 365 cloud apps and services indirectly through a quickly deployed [Windows 10-based virtual desktop](empower-people-to-work-remotely-remote-access.md#deploy-azure-virtual-desktop-to-provide-remote-access-for-remote-workers-using-personal-devices). This option provides high performance, strong security, and simplified IT management. +- Any device including older laptops or desktops used from home, which can access Microsoft 365 cloud apps and services indirectly through a [Windows 365 Cloud PC](empower-people-to-work-remotely-remote-access.md#deploy-windows-365-to-provide-remote-access-for-remote-workers-using-personal-devices). This option provides high performance, strong security, and simplified IT management. ## Next steps
solutions	Manage Devices With Intune App Protection	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-app-protection.md	Title: "Step 1. Implement App Protection Policies" f1.keywords:-- NOCSH +- Intune App Protection policies +- APP +- mobile application management +- MAM +- set up mobile ap protection audience: ITPro
solutions	Manage Devices With Intune Compliance Policies	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-compliance-policies.md	Title: "Step 3. Set up compliance policies for devices with Intune" f1.keywords:-- NOCSH +- Create compliance policies +- Intune device compliance policy audience: ITPro description: Learn how to create device compliance policies that specify the minimum requirements for a device to access your environment.
solutions	Manage Devices With Intune Configuration Profiles	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-configuration-profiles.md	Title: "Step 5. Deploy device profiles in Microsoft Intune" f1.keywords:-- NOCSH +- configuration profiles +- Windows security baselines for Intune +- customize configuration profiles audience: ITPro description: Get started with configuration profiles to enforce secure settings on devices using Intune to transition these security controls to the cloud.
solutions	Manage Devices With Intune Dlp Mip	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-dlp-mip.md	Title: "Step 7. Implement data loss prevention (DLP) with information protection f1.keywords:-- NOCSH +- Endpoint dlp +- data loss prevention +- dlp policies audience: ITPro
solutions	Manage Devices With Intune Enroll	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-enroll.md	Title: "Step 2. Enroll devices into management with Intune" f1.keywords:-- NOCSH +- enroll devices into management +- enroll devices with Intune +- Intune mobile device platforms audience: ITPro description: Use Intune and Autopilot to enroll devices into management to ensure the apps running on them are compliant and to prevent corporate data leaks.
solutions	Manage Devices With Intune Monitor Risk	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-monitor-risk.md	Title: "Step 6. Monitor device risk and compliance to security baselines" f1.keywords:-- NOCSH +- connect Intune to Defender +- monitor device risk +- monitor device compliance +- deploy security baselines audience: ITPro description: Learn how to connect Microsoft Intune to Defender for Endpoint and monitor device risk as a condition for access.
solutions	Manage Devices With Intune Overview	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-overview.md	Title: "Manage devices with Intune" f1.keywords:-- NOCSH +- enroll devices into Intune +- manage device endpoints +- zero trust deployment stack +- device management with zero trust audience: ITPro
solutions	Manage Devices With Intune Require Compliance	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-require-compliance.md	Title: "Step 4. Require healthy and compliant devices with Intune" f1.keywords:-- NOCSH +- Conditional access policy +- Microsoft Intune +- Intune device management audience: ITPro description: Create a conditional access policy in Azure AD to require compliant devices, keeping corporate data secure when users work from any device in any location.