| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| commerce | Cancel Your Subscription | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/cancel-your-subscription.md | If you're unable to cancel your subscription, [contact support](../../admin/get- Your subscription now appears in a **Disabled** state, and has reduced functionality until it's deleted. For information about what you can expect when you cancel a paid Microsoft 365 for business subscription, see [What happens to my data and access when my Microsoft 365 for business subscription ends?](what-if-my-subscription-expires.md) +> [!NOTE] +> If you're a partner who's an admin on behalf of (AOBO) a customer, and you've canceled a subscription, it can take up to 90 days for the admin center to reflect the status change. + > [!WARNING] > If you explicitly delete a subscription, it skips the **Expired** and **Disabled** states and the SharePoint Online data and content, including OneDrive content, is deleted immediately. |
| commerce | What If My Subscription Expires | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/what-if-my-subscription-expires.md | -If your subscription endsΓÇöeither because it expires, or because you decide to cancelΓÇöyour access to Microsoft 365 services, applications, and customer data go through multiple states before the subscription is fully turned off, or *deleted*. If you are aware of this progression, you'll be better equipped to return your subscription to an active state before it's too late, orΓÇöif you're leaving Microsoft 365ΓÇöback up your data before it is ultimately deleted. +If your subscription endsΓÇöeither because it expires, or because you decide to upgrade or cancel itΓÇöyour access to Microsoft 365 services, applications, and customer data go through multiple stages before the subscription is fully turned off, or *deleted*. If you're aware of this progression, you're better equipped to return your subscription to an active stage before it's too late, or, if you're leaving Microsoft 365, back up your data before it's ultimately deleted. Read through this important information before you contact [Microsoft 365 support](../../admin/get-help-support.md). -> [!NOTE] +> [!IMPORTANT] > For some subscriptions, you can only cancel during a limited window of time after you buy or renew your subscription. If the cancellation window has passed, turn off recurring billing to cancel the subscription at the end of its term. ## What happens to data when a subscription expires? -- If your subscription expires, it goes through the following stages: Expired / Disabled / Deleted. The Expired stage starts immediately after the subscription has reached its end date.-- If you turn off recurring billing on your annual subscription, it goes through the same stages as an expired subscription. The first-stage starts are the anniversary of the annual subscription, not starting on the date that you turned off the subscription's recurring billing setting.-- If you cancel your monthly subscription, it is disabled immediately (at the date of cancellation). This means your users lose access to the Microsoft 365 assets immediately and only admins have access to the data for the next 90 days.+When your subscription expires, it goes through the following stages: Expired > Disabled > Deleted. The Expired stage starts immediately after the subscription has reached its end date. ++- **Annual subscriptions.** If you turn off recurring billing on an annual subscription, it goes through the same stages as an expired subscription. The first stage starts on the anniversary of the annual subscription, not the date that you turned off the subscription's recurring billing setting. +- **Monthly subscriptions.** If you cancel a monthly subscription, it immediately moves to the Disabled stage on the date you cancel it. This means that your users immediately lose access to the Microsoft 365 assets, and only admins have access to the data for the next 90 days. The following table explains what you can expect when a paid Microsoft 365 for business subscription expires. The following table explains what you can expect when a paid Microsoft 365 for b ||||-| | *Data accessible to all* | *Data accessible to all* | *Data accessible to admins only* | **Data deleted<br/>Azure Active Directory is removed, if not in use by other services** | | Users have normal access to Microsoft 365, files, and applications | Users have normal access to Microsoft 365, files, and applications | Users can't access Microsoft 365, files, or applications | Users can't access Microsoft 365, files, or applications |-| Admins have normal access to Microsoft 365, data, and Office applications | Admins can access the admin center | Admins can access the admin center, but can't assign licenses to users | Admins can access the admin center to purchase and manage other subscriptions | +| Admins have normal access to Microsoft 365, data, and apps | Admins can access the admin center | Admins can access the admin center, but can't assign licenses to users | Admins can access the admin center to buy and manage other subscriptions | | | Global or billing admins can reactivate the subscription in the admin center | Global or billing admins can reactivate the subscription in the admin center | | *For most offers, in most countries and regions. The following table explains what you can expect when a paid Microsoft 365 for b ## What happens if I cancel a subscription? -If you cancel your subscription before its term end date, the subscription skips the Expired stage and moves directly into the Disabled stage, which is 90 days for most subscriptions, in most countries and regions. We recommend that you [back up your data](move-users-different-subscription.md) before canceling, but as an admin, you can still access and back up data for your organization while it is in the Disabled stage. Any customer data that you leave behind may be deleted after 90 days, and will be deleted no later than 180 days after cancellation. +If you cancel your subscription before its term end date, the subscription skips the Expired stage and moves directly into the Disabled stage, which is 90 days for most subscriptions, in most countries and regions. We recommend that you [back up your data](move-users-different-subscription.md) before canceling. As an admin, you can still access and back up data for your organization while it is in the Disabled stage. Any customer data that you leave behind might be deleted after 90 days and will be deleted no later than 180 days after cancellation. +If you're a partner who's an admin on behalf of (AOBO) a customer, and you've canceled a subscription, it can take up to 90 days for the admin center to reflect the status change. ++> [!NOTE] +> If you want your subscription data to be deleted before the typical Disabled stage is over, you can [close your account](../close-your-account.md). + Here's what to expect for you and your users if you cancel a subscription. - **Admin access** Admins can still sign in and access the admin center, and buy other subscriptions as needed. As a global or billing admin, you have 90 days to [reactivate the subscription](reactivate-your-subscription.md) with all data intact. -- **User access** Your users won't be able to use services like OneDrive for Business, or access customer dataΓÇöfor example, email or documents on team sites. Office applications, like Word and Excel, will eventually move into a read-only, reduced functionality mode and display [Unlicensed Product notifications](https://support.microsoft.com/office/0d23d3c0-c19c-4b2f-9845-5344fedc4380).+- **User access** Your users can't use services like OneDrive for Business, or access customer data like email or documents on team sites. Office applications, like Word and Excel, are eventually moved into a read-only, reduced functionality mode and display [Unlicensed Product notifications](https://support.microsoft.com/office/0d23d3c0-c19c-4b2f-9845-5344fedc4380). To learn how to cancel, see [Cancel your subscription](cancel-your-subscription.md). > [!IMPORTANT]-> If you want your subscription data to be deleted before the typical Disabled stage is over, you can [close your account](../close-your-account.md). - -> [!NOTE] -> -> If you explicitly delete a subscription, then it skips the Expired and Disabled stages and the SharePoint Online data and content, including OneDrive, is deleted immediately. +> If you explicitly delete a subscription, it skips the Expired and Disabled stages and the SharePoint Online data and content, including OneDrive, is immediately deleted. ## What are my options if my subscription is about to expire? -While a subscription is active, you and your end users have normal access to your data, services like email and OneDrive for Business, and Office applications. As the admin, you'll receive a series of notifications via email and in the admin center as your subscription nears its expiration date. +While a subscription is active, you and your users have normal access to your data, services like email and OneDrive for Business, and Office applications. As the admin, you'll receive a series of notifications via email and in the admin center as your subscription nears its expiration date. Before the subscription actually reaches its expiration date, you have a few options: - **Enable recurring billing for the subscription.**- - If **Recurring billing** is already turned on, you don't have to take any action. Your subscription is automatically billed, and you are charged for an additional year or month, depending on your current payment frequency. If for any reason you've turned **Recurring billing** off, you can always [turn Recurring billing back on](renew-your-subscription.md). - - If you purchased Microsoft 365 Apps for business with a prepaid card, you can [turn on Recurring billing](renew-your-subscription.md) for your subscription. - - If you're an Open Volume Licensing customer with a prepaid, one-year subscription, contact your partner to purchase a new product key. You'll receive instructions via email to activate your key in the [Volume Licensing Service Center](https://go.microsoft.com/fwlink/p/?LinkID=282016). To learn how to find a new partner, or the partner you've worked with in the past, see [Find your partner or reseller](../../admin/manage/find-your-partner-or-reseller.md). + - If **Recurring billing** is already turned on, you don't have to take any action. Your subscription is automatically billed, and you're charged for another year or month, depending on your current payment frequency. If for any reason you've turned **Recurring billing** off, you can always [turn Recurring billing back on](renew-your-subscription.md). + - If you bought Microsoft 365 Apps for business with a prepaid card, you can [turn on Recurring billing](renew-your-subscription.md) for your subscription. + - If you're an Open Volume Licensing customer with a prepaid, one-year subscription, contact your partner to buy a new product key. You'll receive instructions via email to activate your key in the [Volume Licensing Service Center](https://go.microsoft.com/fwlink/p/?LinkID=282016). To learn how to find a new partner, or the partner you've worked with in the past, see [Find your partner or reseller](../../admin/manage/find-your-partner-or-reseller.md). - If you have Microsoft 365 Apps for business, see [Manage recurring billing for your subscription](renew-your-subscription.md). - **Let the subscription expire.**- - If you're paying by credit card or invoice and you don't want to continue your subscription, [turn Recurring billing off](renew-your-subscription.md). Your subscription ends on its expiration date, and you can ignore all related email notifications. + - If you're paying by credit card or invoice and you don't want to continue your subscription, [turn off Recurring billing](renew-your-subscription.md). Your subscription ends on its expiration date, and you can ignore all related email notifications. - If you're an Open Volume Licensing customer working with a partner, you can let your subscription expire by taking no action. - If you're a Microsoft 365 Business Standard customer, and you prepaid for your subscription and activated it with a product key, you can let your subscription expire by taking no action. - **Cancel before the subscription expires.** For details, see [Cancel your subscription](cancel-your-subscription.md). ## What happens after my subscription expires? -If you let your subscription expire, it goes through multiple states before it is ultimately deleted. This gives you, as the admin, time to reactivate if you want to continue the service, or to back up your data if you decide you no longer want the subscription. +If you let your subscription expire, it goes through multiple stages before it's ultimately deleted. This gives you, as the admin, time to reactivate if you want to continue the service, or to back up your data if you decide you no longer want the subscription. -Here's what you can expect when your subscription is in each state. +Here's what you can expect when your subscription is in each stage. -### State: Expired +### Stage: Expired -**What to expect:** The Expired stage lasts for 30 days for most subscriptions, including subscriptions purchased through [Microsoft Open](https://go.microsoft.com/fwlink/p/?LinkID=613298), in most countries and regions. For Volume Licensing products, except for Microsoft Open, the Expired stage lasts 90 days. +**What to expect:** The Expired stage lasts for 30 days for most subscriptions, including subscriptions bought through [Microsoft Open](https://go.microsoft.com/fwlink/p/?LinkID=613298), in most countries and regions. For Volume Licensing products, except for Microsoft Open, the Expired stage lasts 90 days. -In this state, users have normal access to the Microsoft 365 portal, Office applications, and services such as email and SharePoint Online. +In this stage, users have normal access to the Microsoft 365 portal, Office applications, and services such as email and SharePoint Online. As an admin, you still have access to the admin center. Don't worryΓÇöglobal or billing admins can [reactivate the subscription](reactivate-your-subscription.md) and continue using Microsoft 365. If you don't reactivate, [back up your data](move-users-different-subscription.md). -### State: Disabled +### Stage: Disabled **What to expect:** If you don't reactivate your subscription while it is in the Expired stage, it moves into a Disabled stage, which lasts for 90 days for most subscriptions, in most countries and regions. For Volume Licensing products, the Disabled stage lasts 30 days. -In this state, your access decreases significantly. Your users can't sign in, or access services like email or SharePoint Online. Office applications eventually move into a read-only, reduced functionality mode and display [Unlicensed Product notifications](https://support.microsoft.com/office/0d23d3c0-c19c-4b2f-9845-5344fedc4380). You can still sign in and get to the admin center, but can't assign licenses to users. Your customer data, including all user data, email, and files on team sites, is available only to you and other admins. +In this stage, your access decreases significantly. Your users can't sign in, or access services like email or SharePoint Online. Office applications eventually move into a read-only, reduced functionality mode and display [Unlicensed Product notifications](https://support.microsoft.com/office/0d23d3c0-c19c-4b2f-9845-5344fedc4380). You can still sign in and get to the admin center, but can't assign licenses to users. Your customer data, including all user data, email, and files on team sites, is available only to you and other admins. As a global or billing admin, you can [reactivate the subscription](reactivate-your-subscription.md) and continue using Microsoft 365 with all of your customer data intact. If you choose not to reactivate, [back up your data](move-users-different-subscription.md). -### State: Deleted +### Stage: Deleted -**What to expect:** If you don't reactivate your subscription while it is expired or disabled, the subscription is deleted. +**What to expect:** If you don't reactivate your subscription while it's expired or disabled, the subscription is deleted. Admins and users no longer have access to the services or Office applications that came with the subscription. All customer dataΓÇöfrom user data to documents and emailΓÇöis permanently deleted and is unrecoverable. At this point, you can't reactivate the subscription. However, as a global or bi > [!NOTE] >-> - Adding a new subscription of the same type that has been deleted does not restore the data that was associated with the deleted subscription. -> - If a CSP license is suspended, there is no 30-day Expired stage, and services are disabled immediately. Data is deleted after 90 days if the tenant is not reactivated by adding a new license. +> - Adding a new subscription of the same type that was deleted doesn't restore the data that was associated with the deleted subscription. +> - If a Cloud Solution Provider (CSP) license is suspended, there's no 30-day Expired stage, and services are disabled immediately. Data is deleted after 90 days if the tenant isn't reactivated by adding a new license. ### What happens when my trial ends? When your trial ends, you can't continue using Microsoft 365 for free. You have a few options: -- **Buy Microsoft 365.** When your trial expires, it moves into the Expired stage, giving you another 30 days (for most trials, in most countries and regions) to purchase Microsoft 365. To learn how to convert your trial into a paid subscription, see [Buy a subscription from your free trial](../try-or-buy-microsoft-365.md#buy-a-subscription-from-your-free-trial).+- **Buy Microsoft 365.** When your trial expires, it moves into the Expired stage, which gives you another 30 days (for most trials, in most countries and regions) to buy a Microsoft 365 subscription. To learn how to convert your trial into a paid subscription, see [Buy a subscription from your free trial](../try-or-buy-microsoft-365.md#buy-a-subscription-from-your-free-trial). - **Extend your trial.** Need more time to evaluate Microsoft 365? In certain cases, you can [extend your trial](../extend-your-trial.md).-- **Cancel the trial or let it expire.** If you decide not to buy Microsoft 365, you can let your trial expire or [cancel it](cancel-your-subscription.md). Back up any data you want to keep. Soon after the 30-day Expired stage, your trial account information and data are permanently erased.+- **Cancel the trial or let it expire.** If you decide not to buy Microsoft 365, you can let your trial expire or [cancel it](cancel-your-subscription.md). Back up any data that you want to keep. After the 30-day Expired stage ends, your trial account information and data are permanently deleted. > [!NOTE] > |
| compliance | Communication Compliance Channels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-channels.md | Yammer must be configured in [Native Mode](/yammer/configure-your-yammer-network You can analyze communications for data imported into all mailboxes in your Microsoft 365 organization from third-party sources like [Instant Bloomberg](/microsoft-365/compliance/archive-instant-bloomberg-data), [Slack](/microsoft-365/compliance/archive-slack-data), [Zoom](/microsoft-365/compliance/archive-zoommeetings-data), SMS, and many others. For a full list of connectors supported in communication compliance, see [Learn about connectors for third-party data](/microsoft-365/compliance/archiving-third-party-data). You must configure a [third-party connector](/microsoft-365/compliance/archiving-third-party-data) for your Microsoft 365 organization before you can assign the connector to a communication compliance policy. The **Third-Party Sources** section of the communication compliance policy wizard only displays currently configured third-party connectors.++## Channel limits ++|**Channel**|**Current limit**| +|:-|:-| +| All channels | Maximum of 25 attachments per policy match | +| Teams | Maximum of 250 users for public channel messages for static scopes with users | +| Teams | No support or coverage for public channel messages for adaptive scopes with users | +||| |
| compliance | Double Key Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/double-key-encryption.md | We realize that for some customers in highly regulated industries, this standard - [Thales](https://cpl.thalesgroup.com/cloud-security/encryption/double-key-encryption) +- [Utimaco](https://utimaco.com/solutions/applications/double-key-encryption) + Reach out directly to these vendors for more information and guidance on their in-market DKE HSM solutions. |
| compliance | Retention Cmdlets | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention-cmdlets.md | Use the following sections to identify the main PowerShell cmdlets that are avai Before you use these cmdlets, you must first [connect to Security & Compliance PowerShell](/powershell/exchange/connect-to-scc-powershell). -In the descriptions that follow, a policy for retention can refer to a retention policy (no labels), or a retention label policy. Each policy defines whether it's static or adaptive and the locations for the policy to be applied. The policy then requires one rule to complete the configuration. +In the descriptions that follow, a policy for retention can refer to a retention policy (no labels), or a retention label policy. Each policy defines whether it's static or adaptive and the locations for the policy to be applied. -For example: -- A retention policy needs a rule that defines the retention settings, such as retain for five years and then delete.+When you use retention policies, the policy requires one rule to complete the configuration, for example, a rule that defines the retention settings, such as retain for five years and then delete. When you use retention labels, these contain the retention settings and their policies need different rules: - A retention label policy that you publish needs a rule that defines which labels should be displayed in apps. Don't use these cmdlets when the locations are for Teams private channel message |Cmdlet|Description|Applicable locations| |:--|:--|:--|:--|-|[Enable-ComplianceTagStorage](/powershell/module/exchange/enable-compliancetagstorage) <br /><br /> [Get-ComplianceTagStorage](/powershell/module/exchange/enable-compliancetagstorage) |A one-time operation to create storage, or view that storage for retention labels |Exchange email <br /><br />SharePoint sites <br /><br /> OneDrive accounts <br /><br /> Microsoft 365 Groups| -|[Get-ComplianceTag](/powershell/module/exchange/get-compliancetag)<br /><br> [New-ComplianceTag](/powershell/module/exchange/new-compliancetag) <br /><br> [Remove-ComplianceTag](/powershell/module/exchange/remove-compliancetag) <br /><br> [Set-ComplianceTag](/powershell/module/exchange/set-compliancetag) |View, create, delete, configure retention labels |Exchange email <br /><br /> SharePoint sites <br /><br /> OneDrive accounts<br /><br /> Microsoft 365 Groups| -|[Get-RecordReviewNotificationTemplateConfig](/powershell/module/exchange/get-recordreviewnotificationtemplateconfig) <br /><br /> [Set-RecordReviewNotificationTemplateConfig](/powershell/module/exchange/remove-retentioncompliancepolicy) |View or configure the configuration for disposition review notification and reminder settings |Exchange email <br /><br /> SharePoint sites <br /><br /> OneDrive accounts <br /><br /> Microsoft 365 Groups| -|[Get-RetentionCompliancePolicy](/powershell/module/exchange/get-retentioncompliancepolicy) <br /><br /> [New-RetentionCompliancePolicy](/powershell/module/exchange/new-retentioncompliancepolicy) <br /><br /> [Remove-RetentionCompliancePolicy](/powershell/module/exchange/remove-retentioncompliancepolicy) <br /><br /> [Set-RetentionCompliancePolicy](/powershell/module/exchange/set-retentioncompliancepolicy) |View, create, delete, configure policies for retention |Exchange email <br /><br /> SharePoint sites <br /><br /> OneDrive accounts<br /><br /> Microsoft 365 Groups <br /><br /> Skype for Business <br /><br /> Exchange public folders <br /><br /> Teams chat messages <br /><br /> Teams channel messages | -|[Get-RetentionComplianceRule](/powershell/module/exchange/get-retentioncompliancepolicy) <br /><br /> [New-RetentionComplianceRule](/powershell/module/exchange/get-retentioncompliancepolicy) <br /><br /> [Set-RetentionComplianceRule](/powershell/module/exchange/set-retentioncompliancerule) <br /><br /> [Remove-RetentionComplianceRule](/powershell/module/exchange/remove-retentioncompliancerule) | View, create, configure, delete settings for polices for retention or retention labels |Exchange email <br /><br /> SharePoint sites <br /><br /> OneDrive accounts <br /><br /> Microsoft 365 Groups <br /><br /> Skype for Business <br /><br /> Exchange public folders <br /><br /> Teams chat messages <br /><br /> Teams channel messages | +|[Enable-ComplianceTagStorage](/powershell/module/exchange/enable-compliancetagstorage) <br /><br /> [Get-ComplianceTagStorage](/powershell/module/exchange/get-compliancetagstorage) |A one-time operation to create storage, or view that storage for retention labels |Exchange email <br /><br />SharePoint sites <br /><br /> OneDrive accounts <br /><br /> Microsoft 365 Groups| +|[Get-ComplianceTag](/powershell/module/exchange/get-compliancetag)<br /><br> [New-ComplianceTag](/powershell/module/exchange/new-compliancetag) <br /><br> [Remove-ComplianceTag](/powershell/module/exchange/remove-compliancetag) <br /><br> [Set-ComplianceTag](/powershell/module/exchange/set-compliancetag) |View, create, delete, configure retention labels for use with a retention label policy |Exchange email <br /><br /> SharePoint sites <br /><br /> OneDrive accounts<br /><br /> Microsoft 365 Groups| +|[Get-RecordReviewNotificationTemplateConfig](/powershell/module/exchange/get-recordreviewnotificationtemplateconfig) <br /><br /> [Set-RecordReviewNotificationTemplateConfig](/powershell/module/exchange/set-recordreviewnotificationtemplateconfig) |View or configure the disposition review notification and reminder settings |Exchange email <br /><br /> SharePoint sites <br /><br /> OneDrive accounts <br /><br /> Microsoft 365 Groups| +|[Get-RetentionCompliancePolicy](/powershell/module/exchange/get-retentioncompliancepolicy) <br /><br /> [New-RetentionCompliancePolicy](/powershell/module/exchange/new-retentioncompliancepolicy) <br /><br /> [Remove-RetentionCompliancePolicy](/powershell/module/exchange/remove-retentioncompliancepolicy) <br /><br /> [Set-RetentionCompliancePolicy](/powershell/module/exchange/set-retentioncompliancepolicy) |View, create, delete, configure retention policies |Exchange email <br /><br /> SharePoint sites <br /><br /> OneDrive accounts<br /><br /> Microsoft 365 Groups <br /><br /> Skype for Business <br /><br /> Exchange public folders <br /><br /> Teams chat messages <br /><br /> Teams channel messages | +|[Get-RetentionComplianceRule](/powershell/module/exchange/get-retentioncompliancerule) <br /><br /> [New-RetentionComplianceRule](/powershell/module/exchange/new-retentioncompliancerule) <br /><br /> [Set-RetentionComplianceRule](/powershell/module/exchange/set-retentioncompliancerule) <br /><br /> [Remove-RetentionComplianceRule](/powershell/module/exchange/remove-retentioncompliancerule) | View, create, configure, delete settings (rules) for retention policies and retention labels |Exchange email <br /><br /> SharePoint sites <br /><br /> OneDrive accounts <br /><br /> Microsoft 365 Groups <br /><br /> Skype for Business <br /><br /> Exchange public folders <br /><br /> Teams chat messages <br /><br /> Teams channel messages | ## Retention cmdlets specific to Teams private channels and Yammer When the locations are for Teams chat messages, Teams channel messages, Exchange |Cmdlet|Description|Applicable locations| |:--|:--|:--|:--|-|[Get-AppRetentionCompliancePolicy](/powershell/module/exchange/get-appretentioncompliancepolicy) <br /><br> [New-AppRetentionCompliancePolicy](/powershell/module/exchange/new-appretentioncompliancepolicy) <br /><br> [Remove-AppRetentionCompliancePolicy](/powershell/module/exchange/remove-appretentioncompliancepolicy) <br /><br> [Set-AppRetentionCompliancePolicy](/powershell/module/exchange/remove-appretentioncompliancepolicy) | View, create, delete, configure retention policies |Teams private channel messages <br /><br /> Yammer user messages <br /><br /> Yammer community messages| -|[Get-AppRetentionComplianceRule](/powershell/module/exchange/get-appretentioncompliancerule) <br /><br /> [New-AppRetentionComplianceRule](/powershell/module/exchange/new-appretentioncompliancerule) <br /><br /> [Remove-AppRetentionComplianceRule](/powershell/module/exchange/remove-appretentioncompliancerule) <br /><br /> [Set-AppRetentionComplianceRule](/powershell/module/exchange/remove-appretentioncompliancerule) | View, create, delete, configure retention settings for retention policies |Teams private channel messages <br /><br /> Yammer user messages <br /><br /> Yammer community messages| +|[Get-AppRetentionCompliancePolicy](/powershell/module/exchange/get-appretentioncompliancepolicy) <br /><br> [New-AppRetentionCompliancePolicy](/powershell/module/exchange/new-appretentioncompliancepolicy) <br /><br> [Remove-AppRetentionCompliancePolicy](/powershell/module/exchange/remove-appretentioncompliancepolicy) <br /><br> [Set-AppRetentionCompliancePolicy](/powershell/module/exchange/set-appretentioncompliancepolicy) | View, create, delete, configure retention policies |Teams private channel messages <br /><br /> Yammer user messages <br /><br /> Yammer community messages| +|[Get-AppRetentionComplianceRule](/powershell/module/exchange/get-appretentioncompliancerule) <br /><br /> [New-AppRetentionComplianceRule](/powershell/module/exchange/new-appretentioncompliancerule) <br /><br /> [Remove-AppRetentionComplianceRule](/powershell/module/exchange/remove-appretentioncompliancerule) <br /><br /> [Set-AppRetentionComplianceRule](/powershell/module/exchange/set-appretentioncompliancerule) | View, create, configure, delete settings (rules) for retention policies |Teams private channel messages <br /><br /> Yammer user messages <br /><br /> Yammer community messages| ## Configuration guidance |
| security | Enable Attack Surface Reduction | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction.md | ms.pagetype: security ms.localizationpriority: medium audience: ITPro -+ You can also exclude ASR rules from triggering based on certificate and file has > Excluding files or folders can severely reduce the protection provided by ASR rules. Excluded files will be allowed to run, and no report or event will be recorded. > If ASR rules are detecting files that you believe shouldn't be detected, you should [use audit mode first to test the rule](attack-surface-reduction-rules-deployment-test.md#step-1-test-asr-rules-using-audit). -You can specify individual files or folders (using folder paths or fully qualified resource names), but you can't specify which rules the exclusions apply to. An exclusion is applied only when the excluded application or service starts. For example, if you add an exclusion for an update service that is already running, the update service will continue to trigger events until the service is stopped and restarted. +You can specify individual files or folders (using folder paths or fully qualified resource names). An exclusion is applied only when the excluded application or service starts. For example, if you add an exclusion for an update service that is already running, the update service will continue to trigger events until the service is stopped and restarted. ++For information about per-rule exclusions, see [Configure ASR rules per-rule exclusions](attack-surface-reduction-rules-deployment-test.md#configure-asr-rules-per-rule-exclusions). ASR rules support environment variables and wildcards. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](configure-extension-file-exclusions-microsoft-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists). You can use Microsoft Endpoint Manager (MEM) OMA-URI to configure custom ASR rul 1. Open the Microsoft Endpoint Manager (MEM) admin center. In the **Home** menu, click **Devices**, select **Configuration profiles**, and then click **Create profile**. - > [!div class="mx-imgBorder"] - > :::image type="content" source="images/mem01-create-profile.png" alt-text="The Create profile page in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem01-create-profile.png"::: + :::image type="content" source="images/mem01-create-profile.png" alt-text="The Create profile page in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem01-create-profile.png"::: 2. In **Create a profile**, in the following two drop-down lists, select the following: You can use Microsoft Endpoint Manager (MEM) OMA-URI to configure custom ASR rul Select **Custom**, and then select **Create**. - > [!div class="mx-imgBorder"] - > :::image type="content" source="images/mem02-profile-attributes.png" alt-text="The rule profile attributes in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem02-profile-attributes.png"::: + :::image type="content" source="images/mem02-profile-attributes.png" alt-text="The rule profile attributes in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem02-profile-attributes.png"::: 3. The Custom template tool opens to step **1 Basics**. In **1 Basics**, in **Name**, type a name for your template, and in **Description** you can type a description (optional). - > [!div class="mx-imgBorder"] - > :::image type="content" source="images/mem03-1-basics.png" alt-text="The basic attributes in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem03-1-basics.png"::: + :::image type="content" source="images/mem03-1-basics.png" alt-text="The basic attributes in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem03-1-basics.png"::: 4. Click **Next**. Step **2 Configuration settings** opens. For OMA-URI Settings, click **Add**. Two options now appear: **Add** and **Export**. - > [!div class="mx-imgBorder"] - > :::image type="content" source="images/mem04-2-configuration-settings.png" alt-text="The configuration settings in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem04-2-configuration-settings.png"::: + :::image type="content" source="images/mem04-2-configuration-settings.png" alt-text="The configuration settings in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem04-2-configuration-settings.png"::: 5. Click **Add** again. The **Add Row OMA-URI Settings** opens. In **Add Row**, do the following: You can use Microsoft Endpoint Manager (MEM) OMA-URI to configure custom ASR rul - 2 : Audit (Evaluate how the ASR rule would impact your organization if enabled) - 6 : Warn (Enable the ASR rule but allow the end-user to bypass the block) - > [!div class="mx-imgBorder"] - > :::image type="content" source="images/mem05-add-row-oma-uri.png" alt-text="The OMA URI configuration in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem05-add-row-oma-uri.png"::: + :::image type="content" source="images/mem05-add-row-oma-uri.png" alt-text="The OMA URI configuration in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem05-add-row-oma-uri.png"::: 6. Select **Save**. **Add Row** closes. In **Custom**, select **Next**. In step **3 Scope tags**, scope tags are optional. Do one of the following: You can use Microsoft Endpoint Manager (MEM) OMA-URI to configure custom ASR rul - **Add all users** - **Add all devices** - > [!div class="mx-imgBorder"] - > :::image type="content" source="images/mem06-4-assignments.png" alt-text="The assignments in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem06-4-assignments.png"::: + :::image type="content" source="images/mem06-4-assignments.png" alt-text="The assignments in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem06-4-assignments.png"::: 8. In **Excluded groups**, select any groups that you want to exclude from this rule, and then select **Next**. You can use Microsoft Endpoint Manager (MEM) OMA-URI to configure custom ASR rul - In **Property**, select the property to which you want this rule to apply - In **Value**, enter the applicable value or value range - > [!div class="mx-imgBorder"] - > :::image type="content" source="images/mem07-5-applicability-rules.png" alt-text="The applicability rules in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem07-5-applicability-rules.png"::: + :::image type="content" source="images/mem07-5-applicability-rules.png" alt-text="The applicability rules in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem07-5-applicability-rules.png"::: 10. Select **Next**. In step **6 Review + create**, review the settings and information you have selected and entered, and then select **Create**. - > [!div class="mx-imgBorder"] - > :::image type="content" source="images/mem08-6-review-create.png" alt-text="The Review and create option in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem08-6-review-create.png"::: + :::image type="content" source="images/mem08-6-review-create.png" alt-text="The Review and create option in the Microsoft Endpoint Manager admin center portal" lightbox="images/mem08-6-review-create.png"::: > [!NOTE] > Rules are active and live within minutes. Example: > "User Defined" allows a local admin user to configure the rule. > The User Defined option setting is shown in the following figure. -> [!div class="mx-imgBorder"] -> :::image type="content" source="images/asr-user-defined.png" alt-text="The Enable option for credential security" lightbox="images/asr-user-defined.png"::: 1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator**. |
| security | Mac Whatsnew | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-whatsnew.md | ms.pagetype: security ms.localizationpriority: medium Previously updated : 11/21/2022 Last updated : 01/11/2023 audience: ITPro For more information on Microsoft Defender for Endpoint on other operating syste **Known issues** -Apple has identified an issue on macOS [Ventura upgrade](<https://developer.apple.com/documentation/macos-release-notes/macos-13_1-release-notes>), and expected to be fixed in the next release. +Apple has fixed an issue on macOS [Ventura upgrade](<https://developer.apple.com/documentation/macos-release-notes/macos-13_1-release-notes>), which is fixed with the latest OS update. The issue impacts Microsoft Defender for endpoint security extensions, and might result in losing Full Disk Access Authorization, impacting its ability to function properly. -> To mitigate the risk with this issue, make sure that [Microsoft Defender for Endpoint has Full Disk Access Authorization](mac-install-manually.md). +<details> + <summary>Jan-2023 (Build: 101.94.13 | Release version: 20.122112.19413.0)</summary> ++ Build: **101.94.13**<br/> + Release version: **20.122112.19413.0**<br/> + Engine version: **1.1.19900.2**<br/> + Signature version: **1.381.2029.0**<br/> ++**What's new** ++- Performance improvement - Adding system exclusions during full scan and quick scan +- Bug and performance fixes ++<br/> +</details> + <details> <summary>Dec-2022 (Build: 101.90.97 | Release version: 20.122102.19097.0)</summary> |
| security | Manage Tamper Protection Microsoft Endpoint Manager | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-tamper-protection-microsoft-endpoint-manager.md | If your organization uses [Microsoft Intune](/mem/intune/fundamentals/what-is-in Tamper protection is part of anti-tampering capabilities that include [standard protection attack surface reduction rules](attack-surface-reduction-rules-reference.md). -> [!NOTE] +> [!IMPORTANT] > If you're using Microsoft Intune to manage Defender for Endpoint settings, we recommend setting [DisableLocalAdminMerge](/windows/client-management/mdm/defender-csp#configurationdisablelocaladminmerge) to true on devices.+> +> When tamper protection is turned on, tamper protected settings cannot be changed from their default value. Changes might appear to be successful in Intune, but will not actually be allowed by tamper protection. For the most current list of tamper protected settings, contact support. ## Requirements for managing tamper protection in Intune |
| security | Prevent Changes To Security Settings With Tamper Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection.md | During some kinds of cyber attacks, bad actors try to disable security features, > - [Tamper protection will be turned on for all enterprise customers](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/tamper-protection-will-be-turned-on-for-all-enterprise-customers/ba-p/3616478) (Tech Community blog post) > > Tamper protection is part of anti-tampering capabilities that include [standard protection attack surface reduction rules](attack-surface-reduction-rules-reference.md).+> > If you're using Microsoft Intune to manage Defender for Endpoint settings, we recommend setting [DisableLocalAdminMerge](/windows/client-management/mdm/defender-csp#configurationdisablelocaladminmerge) to true on devices.+> +> When tamper protection is turned on, tamper protected settings cannot be changed from their default value. Changes might appear to be successful in Intune, but will not actually be allowed by tamper protection. For the most current list of tamper protected settings, contact support. ### How it works |
| security | Tune Performance Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tune-performance-defender-antivirus.md | ms.localizationpriority: medium audience: ITPro Previously updated : 01/05/2023 Last updated : 01/11/2023 - m365-security To start recording system events, open PowerShell in administrative mode and per 1. Run the following command to start the recording: - `New-MpPerformanceRecording -RecordTo <recording.etl>` + ```powershell + New-MpPerformanceRecording -RecordTo <recording.etl> + ``` - where `-RecordTo` parameter specifies full path location in which the trace file is saved. For more cmdlet information, see [Microsoft Defender Antivirus cmdlets](/powershell/module/defender). + where `-RecordTo` parameter specifies full path location in which the trace file is saved. For more cmdlet information, see [Microsoft Defender Antivirus cmdlets](/powershell/module/defender). 2. If there are processes or services thought to be affecting performance, reproduce the situation by carrying out the relevant tasks. 3. Press **ENTER** to stop and save recording, or **Ctrl+C** to cancel recording. -4. Analyze the results using the performance analyzer's `Get-MpPerformanceReport`parameter. For example, on executing the command `Get-MpPerformanceReport -Path <recording.etl> -TopFiles 3 -TopScansPerFile 10`, the user is provided with a list of top-ten scans for the top 3 files affecting performance. +4. Analyze the results using the performance analyzer's `Get-MpPerformanceReport` parameter. For example, on executing the command `Get-MpPerformanceReport -Path <recording.etl> -TopFiles 3 -TopScansPerFile 10`, the user is provided with a list of top-ten scans for the top 3 files affecting performance. For more information on command-line parameters and options, see the [New-MpPerformanceRecording](#new-mpperformancerecording) and [Get-MpPerformanceReport](#get-mpperformancereport). > [!NOTE]-> When running a recording, if you get the error "Cannot start performance recording because Windows Performance Recorder is already recording", run the following command -> to stop the existing trace with the new command: +> When running a recording, if you get the error "Cannot start performance recording because Windows Performance Recorder is already recording", run the following command to stop the existing trace with the new command: > **wpr -cancel -instancename MSFT_MpPerformanceRecording** ## Performance tuning data and information Based on the query, the user will be able to view data for scan counts, duration The results of the performance analyzer can also be exported and converted to a CSV or JSON file. For examples that describe the process of "export" and "convert" through sample codes, see below. -Starting with Defender version 4.18.2206.X, users will be able to view scan skip reason information under "SkipReason" column. The possible values are: +Starting with Defender version 4.18.2206.X, users will be able to view scan skip reason information under "SkipReason" column. The possible values are: 1. Not Skipped-1. Optimization (typically due to performance reasons) +1. Optimization (typically due to performance reasons) 1. User skipped (typically due to user-set exclusions) ### For CSV - **To export**:-`(Get-MpPerformanceReport -Path .\Repro-Install.etl -Topscans 1000). TopScans | Export-CSV -Path .\Repro-Install-Scans.csv -Encoding UTF8 -NoTypeInformation` ++```powershell +(Get-MpPerformanceReport -Path .\Repro-Install.etl -Topscans 1000).TopScans | Export-CSV -Path .\Repro-Install-Scans.csv -Encoding UTF8 -NoTypeInformation +``` - **To convert**:-`(Get-MpPerformanceReport -Path .\Repro-Install.etl -Topscans 100). TopScans | ConvertTo-Csv -NoTypeInformation` +```powershell +(Get-MpPerformanceReport -Path .\Repro-Install.etl -Topscans 100).TopScans | ConvertTo-Csv -NoTypeInformation +``` ### For JSON - **To convert**:-`(Get-MpPerformanceReport -Path .\Repro-Install.etl -Topscans 1000). TopScans | ConvertTo-Json -Depth 1` +```powershell +(Get-MpPerformanceReport -Path .\Repro-Install.etl -Topscans 1000).TopScans | ConvertTo-Json -Depth 1 +``` -To ensure machine-readable output for exporting with other data processing systems, it is recommended to use -Raw parameter for Get-MpPerformanceReport. See below for details +To ensure machine-readable output for exporting with other data processing systems, it is recommended to use `-Raw` parameter for `Get-MpPerformanceReport`. See below for details. ## Requirements The following section describes the reference for the new PowerShell cmdlet New- #### Syntax: New-MpPerformanceRecording ```powershell-New-MpPerformanceRecording -RecordTo <String > +New-MpPerformanceRecording -RecordTo <String> ``` #### Description: New-MpPerformanceRecording The following section describes the Get-MpPerformanceReport PowerShell cmdlet. A #### Syntax: Get-MpPerformanceReport -```powershell -Get-MpPerformanceReport [-Path] <String> +```output +Get-MpPerformanceReport [-Path] <String> [-TopScans [<Int32>]] [-TopPaths [<Int32>] [-TopPathsDepth [<Int32>]]] [-TopScansPerPath [<Int32>]] Get-MpPerformanceReport [-Path] <String> ] [-MinDuration <String>] [-Raw]- ``` #### Description: Get-MpPerformanceReport Get-MpPerformanceReport -Path .\Defender-scans.etl -TopScans 100 -MinDuration 10 Get-MpPerformanceReport -Path .\Defender-scans.etl -TopFiles 10 -TopExtensions 10 -TopProcesses 10 -TopScans 10 -Raw | ConvertTo-Json ``` -Using \-Raw in the above command specifies that the output should be machine readable and readily convertible to serialization formats like JSON +Using \-Raw in the above command specifies that the output should be machine readable and readily convertible to serialization formats like JSON. #### Parameters: Get-MpPerformanceReport Using \-Raw in the above command specifies that the output should be machine rea Requests a top-paths report and specifies how many top paths to output, sorted by "Duration". Aggregates the scans based on their path and directory. User can specify how many directories should be displayed on each level and the depth of the selection. +```yaml - Type: Int32 - Position: Named - Default value: None - Accept pipeline input: False - Accept wildcard characters: False+``` ##### -TopPathsDepth Specifies recursive depth that will be used to group and display aggregated path This flag can accompany all other Top Path options. If missing, a default value of 3 is assumed. Value cannot be 0. +```yaml - Type: Int32 - Position: Named - Default value: 3 - Accept pipeline input: False - Accept wildcard characters: False+``` | flag | definition | |:|:| |
| security | Whats New In Microsoft Defender Endpoint | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint.md | For more information on Microsoft Defender for Endpoint on specific operating sy - [Live response API and library API for Linux and macos is now generally available](run-live-response.md) <br/> You can now run live response API commands on Linux and macos. +## December 2022 ++- Microsoft Defender for Endpoint Device control removable storage access control updates: + 1. Microsoft Endpoint Manager support for removable storage access control is now available in Intune. See [Deploy Removable Storage Access Control by using Intune user interface](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-user-interface) + 2. The new default enforcement policy of removable storage access control is designed for all device control features. Printer Protection is now available for this policy. If you create a Default Deny policy, printers will be blocked in your organization. + - Intune:*./Vendor/MSFT/Defender/Configuration/DefaultEnforcement* <br> See [Deploy and manage Removable Storage Access Control using Intune](deploy-manage-removable-storage-intune.md) + - Group policy: *Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Features > Device Control > Select Device Control Default Enforcement*<br> See [Deploy and manage Removable Storage Access Control using group policy](deploy-manage-removable-storage-group-policy.md) ++- Microsoft Defender for Endpoint Device control New Printer Protection solution to manage printer is now available. For more information, see +[Printer Protection Overview](printer-protection-overview.md) + ## November 2022 - [Built-in protection](built-in-protection.md) is now generally available. Built-in protection helps protect your organization from ransomware and other threats with default settings that help ensure your devices are protected. |
| security | Tvm Exposure Score | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-exposure-score.md | search.appverid: met150 >[!Note] > Want to experience Microsoft Defender Vulnerability Management? Learn more about how you can sign up to the [Microsoft Defender Vulnerability Management public preview trial](../defender-vulnerability-management/get-defender-vulnerability-management.md). -Your exposure score is visible in the [Defender Vulnerability Management dashboard](tvm-dashboard-insights.md) of the Microsoft 365 Defender portal. It reflects how vulnerable your organization is to cybersecurity threats. Low exposure score means your devices are less vulnerable from exploitation. +Your exposure score is visible in the [Defender Vulnerability Management dashboard](tvm-dashboard-insights.md) in the Microsoft 365 Defender portal. It reflects how vulnerable your organization is to cybersecurity threats. Low exposure score means your devices are less vulnerable to exploitation. - Quickly understand and identify high-level takeaways about the state of security in your organization. - Detect and respond to areas that require investigation or action to improve the current state. The card gives you a high-level view of your exposure score trend over time. Any :::image type="content" alt-text="Exposure score card." source="../../media/defender-vulnerability-management/exposure-score.png" lightbox="../../media/defender-vulnerability-management/exposure-score.png"::: -## How it works --The exposure score is broken down into the following levels: +Exposure score is broken down into the following levels: - 0-29: low exposure score - 30-69: medium exposure score - 70-100: high exposure score -You can remediate the issues based on prioritized [security recommendations](tvm-security-recommendation.md) to reduce the exposure score. Each software has weaknesses that are transformed into recommendations and prioritized based on risk to the organization. +## How to use exposure score to reduce your vulnerability exposure ++When software weaknesses are identified, they are transformed into recommendations and prioritized based on risk to the organization. By remediating vulnerabilities with [security recommendations](tvm-security-recommendation.md) prioritized to reduce your exposure score, you can reduce your overall vulnerability exposure. ++To view security recommendations prioritized to reduce your exposure score: ++1. Go to the **Vulnerability management** navigation menu and select **Dashboard** +2. Select **Improve score** on the **Exposure score** card -## Reduce your vulnerability exposure +The security recommendations page will open with a list of security recommendations prioritized by the potential impact on your exposure score. The higher the impact on lowering your exposure by implementing a recommendation, the less vulnerable you will be to exploitation. For more information see [security recommendations impact](tvm-security-recommendation.md#impact). -Lower your vulnerability exposure by remediating [security recommendations](tvm-security-recommendation.md). Make the most impact to your exposure score by remediating the top security recommendations, which can be viewed in the [Defender Vulnerability Management dashboard](tvm-dashboard-insights.md). +Using the top security recommendations, which can be viewed in the [Defender Vulnerability Management dashboard](tvm-dashboard-insights.md) can also help you achieve this goal. ## Related topics -- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) - [Security recommendations](tvm-security-recommendation.md) - [Event timeline](threat-and-vuln-mgt-event-timeline.md) |
| security | Tvm Security Recommendation | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-security-recommendation.md | The top security recommendations list the improvement opportunities prioritized ## Security recommendations overview -View recommendations, the number of weaknesses found, related components, threat insights, number of exposed devices, status, remediation type, remediation activities, impact to your exposure score and Microsoft Secure Score for Devices, and associated tags. +View recommendations, the number of weaknesses found, related components, threat insights, number of exposed devices, status, remediation type, remediation activities, impact to your exposure score and Secure Score for Devices once the recommendation is implemented, and associated tags. The color of the **Exposed devices** graph changes as the trend changes. If the number of exposed devices is on the rise, the color changes to red. If there's a decrease in the number of exposed devices, the color of the graph will change to green. > [!NOTE] > Vulnerability management shows devices that were in use up to **30 days** ago. This is different from the rest of Microsoft Defender for Endpoint, where if a device has not been in use for more than 7 days it has in an 'Inactive' status. ### Icons Useful icons also quickly call your attention to: -  associated public exploits -  recommendation insights +### Impact ++The impact column shows the potential impact on your exposure score and Secure Score for Devices once a recommendation is implemented. You should prioritize items that will lower your exposure score and raise your Secure Score for Devices. ++- The potential reduction in your exposure score is displayed as: :::image type="icon" source="../../media/defender-vulnerability-management/reduce-exposure-score.png" border="false":::. A lower exposure score means devices are less vulnerable to exploitation. Since the exposure score is based on a combination of factors, including new remediations or newly discovered vulnerabilities, the actual score reduction may be lower. ++- The projected increase to your Secure Score for Devices is displayed as: :::image type="icon" source="../../media/defender-vulnerability-management/increase-secure-score.png" border="false":::. A higher Secure Score for Devices means your endpoints are more resilient against cybersecurity attacks. + ### Explore security recommendation options Select the security recommendation that you want to investigate or process. From the flyout, you can choose any of the following options: ### Investigate changes in device exposure or impact -If there is a large jump in the number of exposed devices, or a sharp increase in the impact on your organization exposure score and Microsoft Secure Score for Devices, then that security recommendation is worth investigating. +If there is a large jump in the number of exposed devices, or a sharp increase in the impact on your organization exposure score and Secure Score for Devices, then that security recommendation is worth investigating. 1. Select the recommendation and **Open software page** 2. Select the **Event timeline** tab to view all the impactful events related to that software, such as new vulnerabilities or new public exploits. [Learn more about event timeline](threat-and-vuln-mgt-event-timeline.md) |
| security | Defender For Office 365 Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/defender-for-office-365-whats-new.md | f1.keywords: NOCSH ms.localizationpriority: medium Previously updated : 09/20/2022 Last updated : 01/10/2023 audience: ITPro For more information on what's new with other Microsoft Defender security produc ## September 2022 +- **Anti-spoofing enhancement for internal domains and senders:** + - For spoofing protection, the allowed senders or domains defined in the [anti-spam policy](anti-spam-policies-configure.md) and within user allow lists must now pass authentication in order for the allowed messages to be honored. The change only impacts messages that are considered to be internal (the sender or sender's domain is in an accepted domain in the organization). All other messages will continue to be handled as they are today. + **Automatic redirection from Office 365 Security & Compliance Center to Microsoft 365 Defender portal:** Automatic redirection begins for users accessing the security solutions in Office 365 Security & Compliance center (protection.office.com) to the appropriate solutions in Microsoft 365 Defender portal (security.microsoft.com). This is for all security workflows like: Alerts, Threat Management, and Reports. - Redirection URLs: |
| security | Review Allow Entries | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/review-allow-entries.md | + + Title: Review and remove unnecessary allow list entries with Advanced Hunting in Microsoft Defender for Office 365 +description: Steps and sample queries for advanced hunting to start reviewing your security configuration and removing unnecessary allow list entries. +search.product: ++ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +++ms.localizationpriority: medium ++audience: ITPro ++- m365-guidance-templates +- m365-security +- tier3 +++search.appverid: met150 +++# Introduction ++Historically, allow lists have told Exchange Online Protection to ignore the signals indicating an email is malicious. It is commonplace for vendors to request IPs, domains, and sender addresses be overridden unnecessarily. Attackers have been known to take advantage of this mistake and it is a pressing security loophole to have unnecessary allow list entries. This step-by-step guide will walk you through using advanced hunting to identify these misconfigured overrides and remove them, so you can increase your organization's security posture. ++## What you will need +- Microsoft Defender for Office 365 Plan 2 (Included in E5 plans, or trial available at aka.ms/trymdo) +- Sufficient permissions (Security reader role) +- 5-10 minutes to do the steps below. ++## Common steps for all the below queries ++1. [Login to the security portal and navigate to advanced hunting](https://security.microsoft.com/advanced-hunting) +2. Enter the KQL query into the query box, and press **Run Query**. +3. Pressing the **NetworkMessageId** hyperlink for individual emails when shown in the results will load a flyout, allowing easy access to the email entity page, where the **analysis** tab will provide further details, such as the transport rule(s) which that email matched. +4. The results can also be exported by pressing **Export** for manipulation / analysis offline. ++> [!TIP] +> Changing **OrgLevelAction** to **UserLevelAction** will allow you to search for emails getting overridden by users rather than administrators, and can also be a useful insight. ++## Queries ++### Top override source +Use this query to find where the most unnecessary overrides are located. This query looks for emails that have been overridden without any detection that needed an override. ++`EmailEvents +| where OrgLevelAction == "Allow" +| summarize count() by OrgLevelPolicy, ThreatTypes` ++### Top overridden threat type +Use this query to find the most overridden types of threat detected. This query looks for emails that had the detected threat overridden, DMARC, or Spoof indicates email authentication issues that can be fixed to remove the *need* for the override. ++`EmailEvents +| where OrgLevelAction == "Allow" and ThreatTypes != "" +|summarize count() by DetectionMethods ` ++### Top overridden IPs +This query looks for emails that have been overridden by IP, without any detection that called for an override. ++`EmailEvents +| where OrgLevelAction == "Allow" and ThreatTypes != "" +|summarize count() by SenderIPv4 +| top 10 by count_ ` ++### Top overridden domains +This query looks for emails that have been overridden by sending domain without any detection that called for an override. **(Change to SenderMailFromDomain to check the 5321.MailFrom)** ++`EmailEvents +| where OrgLevelAction == "Allow" and ThreatTypes != "" +|summarize count() by SenderFromDomain +| top 10 by count_ ` ++### Top overridden senders +This query looks for emails that have been overridden by sending address without any detection that requires an override. **(Change to SenderMailFromAddress to check the 5321.MailFrom)** ++`EmailEvents +| where OrgLevelAction == "Allow" and ThreatTypes != "" +|summarize count() by SenderFromAddress +| top 10 by count_ ` ++## Learn More +Hopefully you found this useful, with some basic queries to get you started with advanced hunting, to learn more check out the below articles ++Learn more about advanced hunting: [Overview - Advanced hunting](../../defender/advanced-hunting-overview.md) ++Learn more about authentication: [Email Authentication in Exchange Online Protection](../email-authentication-about.md) |
| solutions | Data Privacy Protection Assess | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/data-privacy-protection-assess.md | When you begin your data privacy journey, you'll want to first understand what t |Action|Description|Get details| |:|:-|:|-|Use Priva to understand your organization's personal data.| Priva evaluates your organization's Microsoft 365 environment to determine the types and amounts of sensitive information types and where they're stored. It then gives you insights and key analytics to help you understand the privacy issues and associated risks in your organization.<br><br>To get started with Priva, check to make sure your users are appropriately licensed and have the roles they need. It's also a good idea to confirm that the [Microsoft 365 audit log is enabled](../compliance/audit-log-enable-disable.md).<br><br> We recommend making some initial settings before you start. Visit Priva settings to turn [anonymization](/privacy/priva/priva-settings#anonymization) **On** for greater protection while reviewing sensitive data, and turn [user notification emails](/privacy/priva/priva-settings#user-notification-emails) **Off** while you're getting familiar with Privacy Risk Management policies. You can turn both on later.| [Learn more about Priva](/privacy/priva/priva-overview) <br><br> [Check Priva licensing guidance](/privacy/priva/priva-setup)<br><br>[Set user permissions for Priva](/privacy/priva/priva-permissions)<br><br>[Check Priva settings](/privacy/priva/priva-settings)<br><br>[Find and visualize personal data in your organization](/privacy/priva/priva-data-profile)| +|Use Priva to understand your organization's personal data.| Priva evaluates your organization's Microsoft 365 environment to determine the types and amounts of sensitive information types and where they're stored. It then gives you insights and key analytics to help you understand the privacy issues and associated risks in your organization.<br><br>To get started with Priva, check to make sure your users are appropriately licensed and have the roles they need. It's also a good idea to confirm that the [Microsoft 365 audit log is enabled](/privacy/priva/priva-setup#enable-the-microsoft-365-audit-log).<br><br> We recommend making some initial settings before you start. Visit Priva settings to turn [anonymization](/privacy/priva/priva-settings#anonymization) **On** for greater protection while reviewing sensitive data, and turn [user notification emails](/privacy/priva/priva-settings#user-notification-emails) **Off** while you're getting familiar with Privacy Risk Management policies. You can turn both on later.| [Learn more about Priva](/privacy/priva/priva-overview) <br><br> [Check Priva licensing guidance](/privacy/priva/priva-setup)<br><br>[Set user permissions for Priva](/privacy/priva/priva-permissions)<br><br>[Check Priva settings](/privacy/priva/priva-settings)<br><br>[Find and visualize personal data in your organization](/privacy/priva/priva-data-profile)| |Visit Compliance Manager to get your initial compliance score.| The next step is knowing which data protection regulations apply to your organization so you know what your obligations are.<p><p>Keeping up with new and updated laws and regulations can be a full-time job in itself, and many organizations struggle with manual processes for monitoring, updating, and reporting on their state of compliance. Compliance Manager helps manage the complexities of implementing controls through built-in control mapping, versioning, and continuous control assessments. This automation and continuous monitoring helps you to stay current with regulations and certifications, and eases reporting to auditors. <p><p>Use Compliance Manager to quickly assess your current environment and get an initial compliance score based on the Microsoft data protection baseline assessment. From there, you can provide information about your industry and location so Compliance Manager can recommend assessments for regulations that are most likely to apply to you. | [Learn more about Compliance Manager](../compliance/compliance-manager.md)<br><br>[Start a premium assessments trial for quick setup of recommended assessments](../compliance/compliance-manager-setup.md#start-a-premium-assessments-trial)<br><br>[Understand how your compliance score is calculated](../compliance/compliance-score-calculation.md)| ## Optimizing your initial setup |
| syntex | Difference Between Document Understanding And Form Processing Model | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/difference-between-document-understanding-and-form-processing-model.md | Use the following table to see differences in custom models to help identify the | Supported regions| Available in all regions. | Relies on Power Platform. For information about global availability for Power Platform and AI Builder, see [Power Platform availability](https://dynamics.microsoft.com/geographic-availability/). | Relies on Power Platform. For information about global availability for Power Platform and AI Builder, see [Power Platform availability](https://dynamics.microsoft.com/geographic-availability/). | | Transactional cost | Not applicable | Uses AI Builder credits.<br>3,500 credits are included for each Syntex license per month.<br>1 million credits will allow processing of 2,000 file pages. | Uses AI Builder credits.<br>3,500 credits are included for each Syntex license per month.<br>1 million credits will allow processing of 2,000 file pages. | | Capacity | No capacity restrictions. | Uses the default Power Platform environment (custom environments with Dataverse database supported). | Uses the default Power Platform environment (custom environments with Dataverse database supported). |-| Supported languages| Models work on all Latin alphabet languages. In addition to English: German, Swedish, French, Spanish, Italian, and Portuguese. | Current language support is for English. | Language support for [73 languages](/ai-builder/form-processing-model-requirements.md#languages-supported). | +| Supported languages| Models work on all Latin alphabet languages. In addition to English: German, Swedish, French, Spanish, Italian, and Portuguese. | Current language support is for English. | Language support for [more than 100 languages](/ai-builder/form-processing-model-requirements#languages-supported). | ## See also |