| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| compliance | Sensitivity Labels Teams Groups Sites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-teams-groups-sites.md | Get-Label | Format-Table -Property DisplayName, Name, Guid To remove either of these advanced settings from a sensitivity label, use the same AdvancedSettings parameter syntax, but specify a null string value. For example: ````powershell-Set-Label -Identity 8faca7b8-8d20-48a3-8ea2-0f96310a848e -AdvancedSettings @{DefaultSharingScop=""} +Set-Label -Identity 8faca7b8-8d20-48a3-8ea2-0f96310a848e -AdvancedSettings @{DefaultSharingScope=""} ```` ## Sensitivity label management |
| contentunderstanding | Apply A Model | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/apply-a-model.md | While an applied model processes all files and folder content uploaded to the do ### Classification Date field -When a SharePoint Syntex document understanding or form processing model is applied to a document library, the **Classification Date** field is included in the library schema. By default, this field is empty. However, when documents are processed and classified by a model, this field is updated with a date-time stamp of completion. +When a SharePoint Syntex document understanding model (or a form processing model) is applied to a document library, the **Classification Date** field is included in the library schema. By default, this field is empty. However, when documents are processed and classified by a model, this field is updated with a date-time stamp of completion.  -The **Classification Date** field is used by the [**When a file is classified by a content understanding model**](/connectors/sharepointonline/#when-a-file-is-classified-by-a-content-understanding-model) trigger to run a Power Automate flow after a Syntex content understanding model has finished processing a file or folder and updated the **Classification Date** field. +The **Classification Date** field is used by the [**When a file is classified by a content understanding model**](/connectors/sharepointonline/#when-a-file-is-classified-by-a-content-understanding-model) trigger to run a Power Automate flow after a model has finished processing the contents of a file or folder and has updated the **Classification Date** field.  -The **When a file is classified by a content understanding model** trigger can then be used to start another workflow using any extracted information from the file or folder. +The **When a file is classified by a content understanding model** trigger can then be used to start a flow using any extracted information from the file or folder. +As an example, when a model is stamped with the **Classification Date**, you can use the **Send an email after SharePoint Syntex processes a file** flow to notify users that a new file has been processed and classified by a model in the SharePoint document library. +To run the flow: ++1. Select a file, and then select **Integrate** > **Power Automate** > **Create a flow**. ++2. On the **Create a flow** panel, select **Send an email after SharePoint Syntex processes a file**. ++  ## See Also |
| contentunderstanding | Create A Form Processing Model | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/create-a-form-processing-model.md | You need to tag the documents to teach the model to understand the fields and ta  +### Use flows to extract information ++Two flows are available to process a selected file or batch of files in a library where a form processing model has been applied. ++- **Extract info from an image or PDF file with a form processing model** ΓÇö Use to extract text from a selected image or PDF file by running a form processing model. Supports a single selected file at a time, and supports only PDF files and image files (PNG, JPG, and JPEG). To run the flow, select a file, and then select **Automate** > **Extract info**. ++  ++- **Extract info from files with a form processing model** ΓÇö Use with form processing models to read and extract information from a batch of files. Processes up to 5,000 SharePoint files at a time. When you run this flow, there are certain parameters you can set. You can: ++ - Choose whether to include previously processed files (the default is not to include previously processed files). + - Select the number of files to process (the default is 100 files). + - Specify the order in which to process the files (choices are by file ID, file name, file created time, or last modified time). + - Specify how you want the order sorted (ascending or descending order). ++  ++### Classification Date field ++When a SharePoint Syntex form processing model (or a document understanding model) is applied to a document library, the **Classification Date** field is included in the library schema. By default, this field is empty. However, when documents are processed and classified by a model, this field is updated with a date-time stamp of completion. ++When a model is stamped with the **Classification Date**, you can use the **Send an email after SharePoint Syntex processes a file** flow to notify users that a new file has been processed and classified by a model in the SharePoint document library. ++To run the flow: ++1. Select a file, and then select **Integrate** > **Power Automate** > **Create a flow**. ++2. On the **Create a flow** panel, select **Send an email after SharePoint Syntex processes a file**. ++  + ## See Also [Power Automate documentation](/power-automate/) |
| managed-desktop | Profiles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/service-description/profiles.md | The following table summarizes the settings and their default values for each se |Feature|Sensitive Data|Power User|Standard| ||::|::|::| |**Block External Storage**|Yes|Yes|No|-|**[Cloud Block Level](/graph/api/resources/intune-deviceconfig-defendercloudblockleveltype)**|High|High|High| +|**[Cloud Block Level](/windows/client-management/mdm/policy-csp-defender#defender-cloudblocklevel)**|High|High|High| |**Disable Microsoft Accounts**|Yes|Yes|No| |**Disable personal OneDrive**|Yes|Yes|No|-|**Switch to secure desktop for elevation**|No|Yes|No| +|**[Switch to secure desktop for elevation](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-useraccountcontrol-switchtothesecuredesktopwhenpromptingforelevation)**|No|Yes|No| |**Microsoft Defender for Endpoint Device Tag**|M365Managed-SensitiveData|M365Managed-PowerUser|M365Managed-Standard| |**Admin on the device?**|No|Yes|No| |**Autopilot Profile**|MMD Standard|MMD Power User|MMD Standard| |
| managed-desktop | Change Device Profile | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/working-with-managed-desktop/change-device-profile.md | audience: Admin You can change the [Device profiles](../service-description/profiles.md) assigned to a device by using the Admin Portal. -> [!IMPORTANT] -> Changing a device's profile will erase all data on the device and cause it to restart. Make sure you’ve selected the right devices before proceeding and back up any data you might want to preserve. - The device profile you select will be applied to all devices you select in the first step. To move separate devices to different profiles, you’ll need to repeat this process for each device profile. 1. In Microsoft Endpoint Manager, select **Devices** in the left pane. In the **Microsoft Managed Desktop** section of the menu, select **Devices**. 2. Select the check boxes for the devices you want to modify. 3. Select **Change device profile**; a fly-in opens. 4. Use the drop-down menu to select the new device profile.-5. Select **Change profile**. +5. Check that the **Reset device** slider is set the way you want. +6. Select **Change profile**. |
| security | Attack Surface Reduction Rules Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference.md | The following table lists the supported operating systems for rules that are cu > - Unless otherwise indicated, the minimum Windows 10 build is version 1709 (RS3, build 16299) or later; the minimum Windows Server build is version is 1809 or later. > -|Rule name|Windows 10|Windows Server 2019|Windows Server|Windows Server 2016|Windows Server 2012 R2| -||::|::|::|::|::| -|[Block abuse of exploited vulnerable signed drivers](#block-abuse-of-exploited-vulnerable-signed-drivers) | Y | Y | Y version 1803 (Semi-Annual Channel) or later | | | -|[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | Y version 1809 or later | Y | Y <br><br> | | | -|[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | Y | Y | Y <br><br> | | | -|[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | Y version 1803 or later | Y <br><br> | Y <br><br> | | | -|[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | Y | Y <br><br> | Y <br><br> | | | -|[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | Y version 1803 or later | Y <br><br> | Y <br><br> | | | -|[Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | Y | Y <br><br> | Y <br><br> | | | -|[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | Y | Y <br><br> | Y <br><br> | | | -|[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | Y | Y <br><br> | Y <br><br> | | | -|[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | Y | Y <br><br> | Y <br><br> | | | -|[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | Y | Y <br><br> | Y <br><br> | | | -|[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) <br><br> \* _File and folder exclusions not supported._ | Y version 1903 (build 18362) or later| Y | Y <br><br> version 1903 (build 18362) or later | | | -|[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | Y version 1803 or later | Y <br><br> | Y <br><br> | | | -|[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | Y | Y <br><br> | Y <br><br> | | | -|[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | Y | Y <br><br> | Y <br><br> | | | -|[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | Y version 1803 or later | Y <br><br> | Y <br><br> | | | -| **Rule name** | **Windows 10** | **Windows Server 2019** | **Windows Server** | **Windows Server 2016** | **Windows Server 2012 R2** | +|Rule name|Windows 10|Windows Server 2019|Windows Server| +||::|::|::| +|[Block abuse of exploited vulnerable signed drivers](#block-abuse-of-exploited-vulnerable-signed-drivers) | Y | Y | Y version 1803 (Semi-Annual Channel) or later | +|[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | Y version 1809 or later | Y | Y <br><br> | +|[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | Y | Y | Y <br><br> | +|[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | Y version 1803 or later | Y <br><br> | Y <br><br> | +|[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | Y | Y <br><br> | Y <br><br> | +|[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | Y version 1803 or later | Y <br><br> | Y <br><br> | +|[Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | Y | Y <br><br> | Y <br><br> | +|[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | Y | Y <br><br> | Y <br><br> | +|[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | Y | Y <br><br> | Y <br><br> | +|[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | Y | Y <br><br> | Y <br><br> | +|[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | Y | Y <br><br> | Y <br><br> | +|[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) <br><br> \* _File and folder exclusions not supported._ | Y version 1903 (build 18362) or later| Y | Y <br><br> version 1903 (build 18362) or later | +|[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | Y version 1803 or later | Y <br><br> | Y <br><br> | +|[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | Y | Y <br><br> | Y <br><br> | +|[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | Y | Y <br><br> | Y <br><br> | +|[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | Y version 1803 or later | Y <br><br> | Y <br><br> | +| | | | | ## Supported configuration management systems Links to information about configuration management system versions referenced i |[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | Y | |Y <br><br> CB 1802 | Y | Y | |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | Y | | Y <br><br> CB 1710 | Y | Y | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | Y | | Y <br><br> CB 1802 | Y | Y |+| | | | | | | (<a id="fn1">1</a>) You can configure attack surface reduction rules on a per-rule basis by using any rule's GUID. |
| security | Configure Server Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-server-endpoints.md | Defender for Endpoint extends support to also include the Windows Server operati This topic describes how to onboard specific Windows servers to Microsoft Defender for Endpoint. ---For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Defender for Endpoint](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128). - For guidance on how to download and use Windows Security Baselines for Windows servers, see [Windows Security Baselines](/windows/device-security/windows-security-baselines). ## Windows Server onboarding overview |
| security | Linux Install Manually | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-install-manually.md | In order to preview new features and provide early feedback, it is recommended t sudo rpm --import http://packages.microsoft.com/keys/microsoft.asc ``` -- Download and make usable all the metadata for the currently enabled yum repositories:-- ```bash - yum makecache - ``` - ### SLES and variants > [!NOTE] |
| security | Server Migration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/server-migration.md | These instructions apply to the new unified solution and installer package of Mi > Operating system upgrades with Microsoft Defender for Endpoint installed are not supported. Please offboard then uninstall before proceeding with an upgrade. > [!NOTE]-> During preview, full Microsoft Endpoint Configuration Manager automation and integration to perform an automated upgrade will be available in the 2111 release of MECM. From the 2107 release, you CAN use the Endpoint Protection node for configuration as well as Group Policy, PowerShell, Microsoft Endpoint Manager tenant attach or local configuration. In addition, you can leverage existing functionality in Microsoft Endpoint Configuration Manager to automate manual upgrade steps; methods for which are described below. +> During preview, full Microsoft Endpoint Configuration Manager automation and integration to perform an automated upgrade will be available in a later release of MECM. From the 2107 release, you CAN use the Endpoint Protection node for configuration as well as Group Policy, PowerShell, Microsoft Endpoint Manager tenant attach or local configuration. In addition, you can leverage existing functionality in Microsoft Endpoint Configuration Manager to automate manual upgrade steps; methods for which are described below. ## Installer script |
| security | Tvm Supported Os | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tvm-supported-os.md | Windows Server 2016|Yes|Yes|Yes|Yes|Yes Windows Server 2019|Yes|Yes|Yes|Yes|Yes Windows Server 2022|Yes|Yes|Yes|Yes|Yes macOS 10.14 "Mojave" and above|Yes|Yes|Yes|Yes|Yes -Red Hat Enterprise Linux 7.2 or higher (\* See "Important" notice below)|Yes|Yes|Yes|Yes|Yes +Red Hat Enterprise Linux 7.2 or higher including matching EUS releases (\* See "Important" notice below)|Yes|Yes|Yes|Yes|Yes CentOS 7.2 or higher|Yes|Yes|Yes|Yes|Yes Ubuntu 16.04 LTS or higher LTS|Yes|Yes|Yes|Yes|Yes Oracle Linux 7.2 or higher|Yes|Yes|Yes|Yes|Yes |
| security | Identity Access Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/identity-access-policies.md | To enforce the App protection policies you applied in Intune, you must create a Enforcing App protection policies requires a set of policies described in [Require app protection policy for cloud app access with Conditional Access](/azure/active-directory/conditional-access/app-protection-based-conditional-access). These policies are each included in this recommended set of identity and access configuration policies. -To create the Conditional Access policy that requires approved apps and APP protection, follow the steps in [Conditional Access: Require approved client apps or app protection policy](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection), which only allows accounts within apps protected by App protection policies to access Microsoft 365 endpoints. +To create the Conditional Access policy that requires approved apps and APP protection, follow the steps in [Require approved client apps or app protection policy with mobile devices](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection#require-approved-client-apps-or-app-protection-policy-with-mobile-devices), which only allows accounts within mobile apps protected by App protection policies to access Microsoft 365 endpoints. > [!NOTE] > This policy ensures mobile users can access all Microsoft 365 endpoints using the applicable apps. -This policy also blocks Exchange ActiveSync clients from connecting to Exchange Online. However, you can create a separate policy for handling Exchange ActiveSync. For more information, see [Block ActiveSync clients](secure-email-recommended-policies.md#block-activesync-clients), which prevents Exchange ActiveSync clients leveraging basic authentication from connecting to Exchange Online. This policy is not pictured in the illustration at the top of this article. It is described and pictured in [Policy recommendations for securing email](secure-email-recommended-policies.md). +This policy also blocks Exchange ActiveSync clients on mobile devices from connecting to Exchange Online. However, you can create a separate policy for handling Exchange ActiveSync across all devices. For more information, see [Block ActiveSync clients](secure-email-recommended-policies.md#block-activesync-clients), which prevents Exchange ActiveSync clients leveraging basic authentication from connecting to Exchange Online. This policy is not pictured in the illustration at the top of this article. It is described and pictured in [Policy recommendations for securing email](secure-email-recommended-policies.md). - These policies leverage the grant controls [Require approved client app](/azure/active-directory/conditional-access/concept-conditional-access-grant#require-approved-client-app) and [Require app protection policy](/azure/active-directory/conditional-access/concept-conditional-access-grant#require-app-protection-policy). + This policy leverages the grant controls [Require approved client app](/azure/active-directory/conditional-access/concept-conditional-access-grant#require-approved-client-app) and [Require app protection policy](/azure/active-directory/conditional-access/concept-conditional-access-grant#require-app-protection-policy). Finally, blocking legacy authentication for other client apps on iOS and Android devices ensures that these clients cannot bypass Conditional Access policies. If you're following the guidance in this article, you've already configured [Block clients that don't support modern authentication](#block-clients-that-dont-support-multi-factor). |
| security | Secure Email Recommended Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/secure-email-recommended-policies.md | If you included Exchange Online and Outlook in the scope of the policies when yo ## Block ActiveSync clients -This policy prevents ActiveSync clients from bypassing other Conditional Access policies. The policy configuration applies only to ActiveSync clients. By selecting **[Require app protection policy](/azure/active-directory/conditional-access/concept-conditional-access-grant#require-app-protection-policy)**, this policy blocks ActiveSync clients. Details on creating this policy can be found in [Require app protection policy for cloud app access with Conditional Access](/azure/active-directory/conditional-access/app-protection-based-conditional-access). +Exchange ActiveSync can be used to synchronize messaging and calendaring data on desktop and mobile devices. -- Follow "Step 2: Configure an Azure AD Conditional Access policy for Exchange Online with ActiveSync (EAS)" in [Scenario 1: Office 365 apps require approved apps with app protection policies](/azure/active-directory/conditional-access/app-protection-based-conditional-access#scenario-1-office-365-apps-require-approved-apps-with-app-protection-policies), which prevents Exchange ActiveSync clients leveraging basic authentication from connecting to Exchange Online.+For mobile devices, modern authentication-capable Exchange ActiveSync clients that do not support Intune app protection policies (or supported clients that are not defined in the app protection policy) and Exchange ActiveSync clients that use basic authentication are blocked based on the Conditional Access policy created in [Require approved apps and APP protection](identity-access-policies.md#require-approved-apps-and-app-protection). ++To block Exchange ActiveSync using basic authentication on other devices, follow the steps in [Block Exchange ActiveSync on all devices](/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection#block-exchange-activesync-on-all-devices), which prevents Exchange ActiveSync clients using basic authentication on non-mobile devices from connecting to Exchange Online. You can also use authentication policies to [disable Basic authentication](/exchange/clients-and-mobile-in-exchange-online/disable-basic-authentication-in-exchange-online), which forces all client access requests to use modern authentication. |
| solutions | Allow Members To Send As Or Send On Behalf Of Group | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/allow-members-to-send-as-or-send-on-behalf-of-group.md | The **Send on Behalf** permission lets a user send email on behalf of a Microsof > [!IMPORTANT] > You can configure **Send as** or **Send on behalf** for a given user, but not both. If you configure both, it will default to **Send as**. -> [!TIP] -> See [Send email from or on behalf of a Microsoft 365 group](https://support.microsoft.com/office/0f4964af-aec6-484b-a65c-0434df8cdb6b) to learn how to use Outlook and Outlook on the Web to send email from a group. +> [!NOTE] +> **Send as** and **Send on behalf** are not supported on Outlook for Mac in hybrid Exchange configurations. ## Allow members to send email as a group This section explains how to allow users to send email on behalf of a group in t ## Related articles +[Send email from or on behalf of a Microsoft 365 group](https://support.microsoft.com/office/0f4964af-aec6-484b-a65c-0434df8cdb6b) + [Collaboration governance planning recommendations](collaboration-governance-overview.md#collaboration-governance-planning-recommendations) [Create your collaboration governance plan](collaboration-governance-first.md) This section explains how to allow users to send email on behalf of a group in t [Add-RecipientPermission](/powershell/module/exchange/add-recipientpermission) -[Set-UnifiedGroup](/powershell/module/exchange/set-unifiedgroup) +[Set-UnifiedGroup](/powershell/module/exchange/set-unifiedgroup) |