| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Email Apps Usage Ww | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/activity-reports/email-apps-usage-ww.md | The Microsoft 365 Reports dashboard shows you the activity overview across the p You can get a view into email apps activity by looking at the **Users** and **Clients** charts. - + The **Email apps usage** report can be viewed for trends over the last 7 days, 30 days, 90 days, or 180 days. However, if you select a particular day in the report, the table will show data for up to 28 days from the current date (not the date the report was generated). The data in each report usually covers up to the last 24 to 48 hours. |
| admin | Ownerless Groups Teams | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/ownerless-groups-teams.md | When creating the policy, you can specify: - If you want to limit who can be invited to be an owner by specifying a security group - The sender address of the notifications - The number of weeks that the notifications will be sent-- Which groups or teams are part of the policy+- Which groups or teams are part of the policy. A maximum of 50 groups can be selected. > [!Note] > Using a security group to limit who can be invited to be an owner requires that you possess but not necessarily assign an Azure AD Premium license for each Microsoft 365 group member in your organization. |
| admin | Assign Licenses To Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/assign-licenses-to-users.md | You can assign licenses to users on either the **Active users** page, or on the - You can [assign Microsoft 365 licenses to user accounts with PowerShell](../../enterprise/assign-licenses-to-user-accounts-with-microsoft-365-powershell.md). - To use group-based licensing, see [Assign licenses to users by group membership in Azure Active Directory](/azure/active-directory/users-groups-roles/licensing-groups-assign) - Some services, like Sway, are automatically assigned to users, and don't need to be assigned individually.+- If you're a Cloud Solution Provider (CSP) and you bought products on behalf of a customer, you can't use the **Your products** page to assign or unassign licenses for certain products, like perpetual software. To assign or unassign licenses for those products, [use the Licenses page](#use-the-licenses-page-to-assign-licenses-to-users). ## Use the Licenses page to assign licenses to users The **Licenses** page lets you assign or unassign licenses for up to 20 users at a time. The page shows the products you own, the number of available licenses for each product, and the number of assigned licenses out of the total licenses available. -The **Licenses** page shows an aggregate total of licenses for all subscriptions for the same product name. For example, you might have one subscription for Microsoft 365 Business Premium that has 5 licenses, and another subscription that has 8 licenses for the same product. The **Licenses** page shows that you have a total of 13 licenses for Microsoft 365 Business Premium across all your subscriptions. This is different from what you see on the **Your products** page, which displays a row for each subscription you own, even if they are for the same product. +The **Licenses** page shows an aggregate total of licenses for all subscriptions for the same product name. For example, you might have one subscription for Microsoft 365 Business Premium that has five licenses, and another subscription that has eight licenses for the same product. The **Licenses** page shows that you have a total of 13 licenses for Microsoft 365 Business Premium across all your subscriptions. This number is different from what you see on the **Your products** page, which displays a row for each subscription you own, even if they are for the same product. ::: moniker range="o365-worldwide" When you use the **Active users** page to assign licenses, you assign users lice By default, all services associated with those licenses are automatically assigned to the users. You can limit which services are available to the users. Deselect the boxes for the services that you don't want the users to have. 6. At the bottom of the pane, select **Save changes**. - You might have to buy additional licenses if you don't have enough licenses for everyone. + You might have to buy more licenses if you don't have enough licenses for everyone. > [!NOTE] > If you want to assign licenses for a large number of users, use [Assign licenses to users by group membership in Azure Active Directory](/azure/active-directory/enterprise-users/licensing-groups-assign). |
| admin | Remove Licenses From Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/remove-licenses-from-users.md | You can unassign licenses from users on either the **Active users** page, or on - You must be a Global, License, User admin to unassign licenses. For more information, see [About Microsoft 365 admin roles](../add-users/about-admin-roles.md). - You can [remove licenses from user accounts with Office 365 PowerShell](../../enterprise/remove-licenses-from-user-accounts-with-microsoft-365-powershell.md). - You can also [delete user accounts](../add-users/delete-a-user.md) that were assigned a license to make their license available to other users. When you delete a user account, their license is immediately available to assign to someone else.+- If you're a Cloud Solution Provider (CSP) and you bought products on behalf of a customer, you can't use the **Your products** page to assign or unassign licenses for certain products, like perpetual software. To assign or unassign licenses for those products, [use the Licenses page](#use-the-licenses-page-to-unassign-licenses). ## Use the Licenses page to unassign licenses |
| commerce | Pay For Subscription Billing Profile | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/pay-for-subscription-billing-profile.md | When you buy a subscription, you pay for it with a billing profile. The billing If you're not sure if your account has a billing profile, see [Understand billing profiles](manage-billing-profiles.md). If you don't have a billing profile, see [How to pay for your subscription](pay-for-your-subscription.md). +> [!IMPORTANT] +> Starting on April 1, 2023, we will stop accepting checks as a payment method for subscriptions paid by invoice. Beginning on that date, pay by check will no longer be available as a payment option, and check payment instructions will be removed from invoices. You can still pay for your invoice by electronic funds transfer (EFT). See your invoice for EFT payment information. If you're an existing customer who currently pays by check, you have until September 30, 2023 to change to paying by EFT, and avoid possible service disruption. + ## Paying with recurring billing turned on or off By default, recurring billing is automatically turned on for all paid subscriptions. Every billing period, we automatically charge the payment method associated with the billing profile to pay for any subscriptions that use that billing profile. If your payment method is declined, you can use the **Pay now** button on the invoice summary in the Microsoft 365 admin center to make a one-time payment for your subscription. |
| commerce | Pay For Your Subscription | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/pay-for-your-subscription.md | Last updated 12/08/2022 # Payment options for your Microsoft business subscription -> [!IMPORTANT] -> As of January 26, 2021, new bank accounts are no longer supported for customers in Belgium, France, Italy, Luxembourg, Portugal, Spain, and the United States. If you're an existing customer in one of those countries, you can continue paying for your subscription with an existing bank account that is in good standing. However, you can't add new subscriptions to the bank account. - You can use a credit or debit card, or bank account to pay for your Microsoft business subscription. For qualifying customers, you can pay by invoice, using check or electronic funds transfer (EFT). If you have a billing profile, your options are slightly different. For more information, see [How to pay for your subscription with a billing profile](pay-for-subscription-billing-profile.md). If you're not sure if your account has a billing profile, see [Understand billing profiles](manage-billing-profiles.md). **Just want to find out where to send your invoice payment?** If you currently pay your invoice by check or EFT, see [Where do I send my check or EFT payment?](#where-do-i-send-my-check-or-eft-payment) +> [!IMPORTANT] +> +> - Starting on April 1, 2023, we will stop accepting checks as a payment method for subscriptions paid by invoice. Beginning on that date, pay by check will no longer be available as a payment option, and check payment instructions will be removed from invoices. You can still pay for your invoice by electronic funds transfer (EFT). See your invoice for EFT payment information. If you're an existing customer who currently pays by check, you have until September 30, 2023 to change to paying by EFT, and avoid possible service disruption. +> - As of January 26, 2021, new bank accounts are no longer supported for customers in Belgium, France, Italy, Luxembourg, Portugal, Spain, and the United States. If you're an existing customer in one of those countries, you can continue paying for your subscription with an existing bank account that is in good standing. However, you can't add new subscriptions to the bank account. + > [!TIP] > If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. |
| commerce | Understand Your Invoice | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/understand-your-invoice.md | Last updated 08/08/2022 The invoice provides a summary of your charges and instructions for payment. You can [view your online invoice](#view-your-online-invoice) in the Microsoft 365 admin center. You can also download it in the Portable Document Format (.pdf) to send via email. +> [!IMPORTANT] +> Starting on April 1, 2023, we will stop accepting checks as a payment method for subscriptions paid by invoice. Beginning on that date, pay by check will no longer be available as a payment option, and check payment instructions will be removed from invoices. You can still pay for your invoice by electronic funds transfer (EFT). See your invoice for EFT payment information. If you're an existing customer who currently pays by check, you have until September 30, 2023 to change to paying by EFT, and avoid possible service disruption. + To view and print your invoice: 1. On the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=2102895" target="_blank">Bills & payments</a> page, select an invoice date range. |
| commerce | Understand Your Invoice2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/understand-your-invoice2.md | Last updated 05/24/2022 Your bill or invoice provides a summary of charges for your subscription and includes instructions for how to make a payment. +> [!IMPORTANT] +> Starting on April 1, 2023, we will stop accepting checks as a payment method for subscriptions paid by invoice. Beginning on that date, pay by check will no longer be available as a payment option, and check payment instructions will be removed from invoices. You can still pay for your invoice by electronic funds transfer (EFT). See your invoice for EFT payment information. If you're an existing customer who currently pays by check, you have until September 30, 2023 to change to paying by EFT, and avoid possible service disruption. + > [!NOTE] > If you have other subscriptions instead of or in addition to Microsoft 365, see [Understand your bill or invoice](understand-your-invoice.md). On page one of your invoice, the **Product** is "Online Services," the generic t **Billing Period** is the period since the last invoice date. -**Payment Terms** is the number of days from the invoice date when payment is due. The standard payment term is 30 days. +**Payment Terms** is the number of days from the invoice date when payment is due. **Due Date** is the date when the invoice payment is due. If your subscription is paid with a credit card or bank account, we charge your card or account the day after the Invoice Date. |
| commerce | Withholding Tax Credit Global | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/withholding-tax-credit-global.md | Last updated 05/27/2021 Some customers receive Web Direct (Azure and Microsoft 365) invoices billed by a Microsoft entity located in a foreign country. If your organization makes cross-border payments to that entity, the Tax Authority in your country might require you to withhold part of the cross-border payment as withholding tax (WHT). If you withheld taxes as required by your Tax Authority when remitting payments to Microsoft, this article explains the process for claiming a credit for the tax withheld. +> [!IMPORTANT] +> Starting on April 1, 2023, we will stop accepting checks as a payment method for subscriptions paid by invoice. Beginning on that date, pay by check will no longer be available as a payment option, and check payment instructions will be removed from invoices. You can still pay for your invoice by electronic funds transfer (EFT). See your invoice for EFT payment information. If you're an existing customer who currently pays by check, you have until September 30, 2023 to change to paying by EFT, and avoid possible service disruption. + ## For invoice pay customers who pay by check or wire If you withheld tax when remitting payment and deposited the withheld tax with the relevant Tax Authority, you must submit a WHT request to clear the outstanding balance in your account. |
| commerce | Withholding Tax Credit India | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/withholding-tax-credit-india.md | Last updated 05/03/2021 Customers in India receive Web Direct (Azure and Microsoft 365) invoices billed by Microsoft Regional Sales Pte Ltd. Singapore (MRS) and make cross-border payments to Singapore to settle the invoice. If you withheld taxes when remitting the payment, this article explains the process for claiming a credit for the Withholding Tax (WHT) in your account with MRS. +> [!IMPORTANT] +> Starting on April 1, 2023, we will stop accepting checks as a payment method for subscriptions paid by invoice. Beginning on that date, pay by check will no longer be available as a payment option, and check payment instructions will be removed from invoices. You can still pay for your invoice by electronic funds transfer (EFT). See your invoice for EFT payment information. If you're an existing customer who currently pays by check, you have until September 30, 2023 to change to paying by EFT, and avoid possible service disruption. + ## For invoice pay customers who pay by check or wire If you withheld tax when remitting payment to MRS and deposited the withheld tax with the Income Tax Department, you must submit a WHT request to settle the tax amount withheld in your account. |
| commerce | Volume Licensing Invoices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/volume-licensing-invoices.md | You can see two types of invoices: debit invoice and credit memo. ## Who receives VL invoices by email? -The **Bill To contact** for the contract receives invoices by email from microsoft-no-reply@microsoft.com. +The **Bill To contact** for the contract receives invoices by email from `microsoft-noreply@microsoft.com`. -Be sure to add microsoft-no-reply@microsoft.com to your safe senders list or modify any existing email rules to avoid emails landing in your junk folder. +Be sure to add `microsoft-noreply@microsoft.com` to your safe senders list or modify any existing email rules to avoid emails landing in your junk folder. ## How do I become a Volume Licensing Service Center (VLSC) user? |
| commerce | Manage Saas Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/manage-saas-apps.md | Last updated 04/15/2021 You can manage licenses and billing for third-party apps in the new <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>. Updated features include enhanced subscription management, improved access to billing information, and improved flexibility for managing bills. Subscription management is based on Microsoft's updated commerce platform. This applies to software-as-a-service apps that customers purchase directly, or from a third-party provider. +> [!IMPORTANT] +> Starting on April 1, 2023, we will stop accepting checks as a payment method for subscriptions paid by invoice. Beginning on that date, pay by check will no longer be available as a payment option, and check payment instructions will be removed from invoices. You can still pay for your invoice by electronic funds transfer (EFT). See your invoice for EFT payment information. If you're an existing customer who currently pays by check, you have until September 30, 2023 to change to paying by EFT, and avoid possible service disruption. + ## How to get software-as-a-service apps There are a few ways to purchase third-party apps. |
| commerce | Understand Proposal Workflow | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/understand-proposal-workflow.md | Last updated 07/11/2022 # Understand the Microsoft proposal workflow -A proposal is a formal offer from Microsoft for your organization to buy Microsoft products and services. Proposals represent large orders that your organizationΓÇÖs procurement or IT department place with Microsoft. +A proposal is a formal offer from Microsoft for your organization to buy Microsoft products and services. Proposals represent large orders that your organization's procurement or IT department place with Microsoft. Before the proposal workflow begins, your procurement department works directly with a designated Microsoft representative to determine the specific products and services your organization needs. Next, your Microsoft representative drafts a proposal and sends your procurement department an email with a link to accept the proposal in the Azure marketplace portal. The site contains the proposal prepared specifically for you and your organization. After you follow the link and sign in to the proposal site, you can start the proposal review process. After you complete the proposal review and check out, you receive an invoice for the purchased products as per the billing plan you selected. To learn how billing works for proposals, see [Understand invoicing](#understand-invoicing) below. +> [!IMPORTANT] +> Starting on April 1, 2023, we will stop accepting checks as a payment method for subscriptions paid by invoice. Beginning on that date, pay by check will no longer be available as a payment option, and check payment instructions will be removed from invoices. You can still pay for your invoice by electronic funds transfer (EFT). See your invoice for EFT payment information. If you're an existing customer who currently pays by check, you have until September 30, 2023 to change to paying by EFT, and avoid possible service disruption. + ## Prerequisites for buying items with a proposal Before you can buy items for a proposal, you must have a billing account and an agreement with Microsoft. The Microsoft Customer Agreement (MCA) lets an organization buy Microsoft produc ## Permissions needed to sign an agreement or pay for items -You must be a billing account owner or billing account contributor to successfully sign an agreement or buy products and services. If youΓÇÖre a Global admin but donΓÇÖt have one of those roles, you can assign the roles to yourself. If youΓÇÖre not a Global admin, ask your Global admin, or billing account owner to assign one of the roles to you. +You must be a billing account owner or billing account contributor to successfully sign an agreement or buy products and services. If you're a Global admin but don't have one of those roles, you can assign the roles to yourself. If you're not a Global admin, ask your Global admin, or billing account owner to assign one of the roles to you. The billing account owner and billing account contributor roles are assigned by using either of the following methods. |
| compliance | Communication Compliance Case Study | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-case-study.md | To access communication compliance when starting from the Microsoft 365 admin ce  -This action opens the **Office 365 Security and Compliance center**, and they must select the link to the **Microsoft Purview compliance portal** provided in the banner at the top of the page. -- - Once in the **Microsoft Purview compliance portal**, Contoso IT administrators select **Show all** to display the full list of compliance solutions.  |
| compliance | Compliance Manager Assessments | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-manager-assessments.md | To create an assessment, you'll use a guided process to select a template and de #### Create assessments based on recommendations for your org type -Compliance Manager can indicate which assessments may be most relevant to your organization. When you provide basic information about your organization's industry and locations, we'll recommend which templates to use from our library of over 300 templates. Simply choose among the recommended templates for quick setup of multiple assessments all at once. +Compliance Manager can indicate which assessments may be most relevant to your organization. When you provide basic information about your organization's industry and locations, we'll recommend which templates to use from our library of over 300 templates. Choose among the recommended templates for quick setup of multiple assessments all at once. To create one or more assessments based on our recommendations, select **Add Recommended Assessments** from your **Assessments** page and follow these steps: To create one or more assessments based on our recommendations, select **Add Rec #### Create an assessment using a guided process -1. From your **Assessments** page, select **Add assessment**. This will put you into the assessment creation wizard. +1. From your **Assessments** page, select **Add assessment** to begin the assessment creation wizard. 2. On the **Base template** screen, select **Select template** to choose the template for your assessment. To create one or more assessments based on our recommendations, select **Add Rec 4. **Product, name, and group:** Set these properties to identify your assessment, choose which product it will be evaluating, and assign it to a group. - - **Product**: Select the product you want your assessment to apply to. If you are using a Microsoft template, such as one designed for Microsoft 365, this field will be populated for you to indicate the appropriate product and cannot be changed. If you're using a universal template, select whether you're creating this assessment for a new product or a custom product you have already defined in Compliance Manager. If you choose a new product, enter its name. Note that you cannot select a pre-defined Microsoft product when using a universal template. + - **Product**: Select the product you want your assessment to apply to. If you're using a Microsoft template, such as one designed for Microsoft 365, this field will be populated for you to indicate the appropriate product and can't be changed. If you're using a universal template, select whether you're creating this assessment for a new product or a custom product you have already defined in Compliance Manager. If you choose a new product, enter its name. You can't select a pre-defined Microsoft product when using a universal template. - **Assessment name**: Enter a name for your assessment in the **Assessment name** field. Assessment names must be unique within groups. If the name of your assessment matches the name of another assessment in any given group, you'll receive an error asking you to create a different name. - **Group**: Assign your assessment to a group. You can either: - Select **Use existing group** to assign it to a group you've already created; or Learn more about [how controls and improvement actions are tracked and scored.]( When you assign users a Compliance Manager role in the Microsoft Purview compliance portal, they can view or edit data within all assessments by default (review the [Compliance Manager role types](compliance-manager-setup.md#role-types)). You can restrict user access to only certain assessments by managing user roles from within an assessment or assessment template. Restricting access in this way can help ensure that users who play a role in overseeing compliance with particular regulations or standards have access only to the data and information they need to perform their duties. -External users who need access for auditing or other purposes can also be assigned a role for viewing assessments and editing test data. You'll provide access to external individual by assigning them an Azure Active Directory (AD) role. Learn more about [assigning Azure AD roles](compliance-manager-setup.md#more-about-azure-ad). +External users who need access for auditing or other purposes can also be assigned a role for viewing assessments and editing test data. You'll provide access to external individual by assigning them an Azure Active Directory (AD) role. Learn more about [assigning Azure AD roles](compliance-manager-setup.md#setting-permissions-in-azure-ad). #### Steps for granting access Learn how to get a broad [view of all users with access to assessments](complian - For an individual assessment, one user can only hold one assessment-based role at a time. - For example, if a user holds a reader role for a GDPR assessment and you want to change them to a contributor role, you'll first need to remove their reader role, and then re-assign them the reader role. +> [!NOTE] +> Admins whose permissions for Compliance Manager were set in Azure AD won't appear on the **Manage user access** flyout pane. This means that if a user has access to one or more assessments, and their role is Global Administrator, Compliance Administrator, Compliance Data Administrator, or Security Administrator, they won't appear on this pane. Learn more about [setting Compliance Manager permissions and roles](compliance-manager-setup.md#set-user-permissions-and-assign-roles). + ## Accept updates to assessments When an update is available for an assessment, you'll see a notification and have the option to accept the update or defer it for a later time. |
| compliance | Compliance Manager Setup | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-manager-setup.md | -description: "Set Microsoft Purview Compliance Manager user permissions and roles, and configure automated testing of actions. Manage user history and filter your dashboard view." +description: "Set up user permissions and roles, and set up automated testing, for Microsoft Purview Compliance Manager." # Get started with Compliance Manager The direct link to access Compliance Manager is [https://compliance.microsoft.co Compliance Manager uses a role-based access control (RBAC) permission model. Only users who are assigned a role may access Compliance Manager, and the actions allowed by each user are restricted by [role type](#role-types). Our RBAC model also allows you to grant user access to individual assessments. See [role-based access to assessments](#role-based-access-to-assessments) below to learn more. -### Where to set permissions -The person holding the global admin role for your organization can set user permissions for Compliance Manager. Permissions can be set in the Microsoft Purview compliance portal as well as in Azure Active Directory (Azure AD). +The person holding the global admin role for your organization can set user permissions for Compliance Manager. Permissions can be set in either of the following places: ++- The Microsoft Purview compliance portal ([instructions](#setting-permissions-in-the-microsoft-purview-compliance-portal)) +- Azure Active Directory (Azure AD) ([instructions](#setting-permissions-in-azure-ad)) > [!NOTE] > Customers in US Government Community (GCC) High and Department of Defense (DoD) environments can only set user permissions and roles for Compliance Manager in Azure AD. See below for Azure AD instructions and role type definitions. -To set permissions and assign roles in the Microsoft Purview compliance portal, follow the steps below: +#### Setting permissions in the Microsoft Purview compliance portal 1. Go to the Microsoft Purview compliance portal, and select <a href="https://go.microsoft.com/fwlink/p/?linkid=2173597" target="_blank">**Permissions**</a>. To set permissions and assign roles in the Microsoft Purview compliance portal, 8. When youΓÇÖre done assigning users, select **Done**, then select **Save**, then **Close**. -#### More about Azure AD +#### Setting permissions in Azure AD -To assign roles and set permissions in Azure AD, see [Assign administrator and non-administrator roles to users with Azure Active Directory](/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). +To set permissions and assign roles in Azure AD, see [Assign administrator and non-administrator roles to users with Azure Active Directory](/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). Users with Azure AD identities who don't have Office 365 or Microsoft 365 subscriptions won't be able to access Compliance Manager in the Microsoft Purview compliance portal. To seek assistance in accessing Compliance Manager, contact [cmresearch@microsoft.com](mailto:cmresearch@microsoft.com). A user can only hold one role at a time. Any change in a user's role will overri ### Role-based access to assessments -You can assign roles to users in order to grant access to specific assessments. Granting access to individual assessments is useful when you need to ensure that only the people working on certain regulatory requirements have access to that data. You can grant access to individual assessments to users outside of your organization, which helps when you have external auditors. For users outside your organization, you'll need to assign them an Azure AD role. For instructions, see [More about Azure AD](#more-about-azure-ad). +You can assign roles to users in order to grant access to specific assessments. Granting access to individual assessments is useful when you need to ensure that only the people working on certain regulatory requirements have access to that data. You can grant access to individual assessments to users outside of your organization, which helps when you have external auditors. For users outside your organization, you'll need to assign them an Azure AD role. For instructions, see [More about Azure AD](#setting-permissions-in-azure-ad). The four roles listed in table above provide access to assessments: Compliance Manager Reader, Compliance Manager Contribution, Compliance Manager Assessor, and Compliance Manager Administration. What you can do with each assessment remains restricted based on which activities the role allows. -To grant users access to an assessment, open the assessment's details page and select **Manage users access** to add users by role. --If a user has a role assigned to them in the Microsoft Purview compliance portal for overall access to Compliance Manager, any role you assign them for a specific assessment will apply only to that assessment. +To grant users access to an assessment, open the assessment's details page and select **Manage users access** to add users by role. If a user has a role assigned to them in the Microsoft Purview compliance portal for overall access to Compliance Manager, any role you assign them for a specific assessment will apply only to that assessment. -See [Grant user access to assessments](compliance-manager-assessments.md#grant-user-access-to-individual-assessments) for more detailed information and instructions. +**More information**: +- See [Grant user access to assessments](compliance-manager-assessments.md#grant-user-access-to-individual-assessments) for more detailed information and instructions. +- Learn more about [managing all users' access to assessments](#user-access) in Compliance Manager settings. ## Start a premium assessments trial To delete a userΓÇÖs history, follow the steps below: ## User access -The **User access** section of **Settings** displays a list of all users who have a role that allows access to one or more assessments. This section is also where you can revoke access to an assessment by removing their assessment-specific role. --[Visit these instructions](compliance-manager-assessments.md#grant-user-access-to-individual-assessments) for assigning user roles from an assessment's details page. --To remove a user's access to an assessment: +The **User access** section of **Settings** displays a list of all users who have a role that allows access to one or more assessments. From this page, you can make changes to assessment-based role assignments. To add or remove such roles for users, follow the steps below: 1. In **Compliance Manager settings,** select **User access**. -1. Select the checkbox next to the name of the user whose role you want to edit. Only one user can be selected at a time. +1. Select the checkbox next to the name of one or more users whose role you want to edit. -1. Select **Manage assessments**. An **Edit assessment permissions** flyout pane will appear. +1. From the **Edit assessment roles** dropdown menu above the list of names, select **Add assessment permissions** or **Remove assessment permissions**. -1. Go to the tab that corresponds to the role you want to remove: Reader, Assessor, or Contributor. +1. **For adding a role**: From the flyout pane, go to the tab that corresponds to the role you want to add (Reader, Assessor, or Contributor), then select **Add assessments**. On the next flyout pane, choose the checkbox next to the assessments and select **Apply**, then select **Save**. -1. Select the button next to the assessment for which you want to remove access, and select **Remove assessment**. +1. **For removing a role**: From the flyout pane, go to the tab that corresponds to the role you want to remove (Reader, Assessor, or Contributor). Select the button next to the assessments for which you want to remove access, and select the X mark in the **Remove** column. -1. A **Remove access?** confirmation box appears. Select **Confirm** to remove the user's role for that assessment, or select **Cancel** to cancel. The name of the assessment will now be removed from the role tab. + 1. A **Remove access?** confirmation box appears. Select **Confirm** to remove the user's role, or select **Cancel** to cancel. The name of the assessments will now be removed from the role tab. -1. Select **Save** on the flyout pane. The role removal won't be completed until you select the Save button. Selecting **Close** will cancel out of the process without saving the role removal. + 1. Select **Save** on the flyout pane. The role removal won't be completed until you select the **Save** button. Selecting **Close** will cancel out of the process without saving the role removal. The user list on the **User access** page will now reflect the changes you made. +> [!NOTE] +> Admins whose permissions for Compliance Manager were set in Azure AD won't appear on the **User access** page. This means that if a user has access to one or more assessments, and their role is Global Administrator, Compliance Administrator, Compliance Data Administrator, or Security Administrator, they won't appear on this page. Learn more about [setting Compliance Manager permissions in Azure AD](#setting-permissions-in-azure-ad). ++**More information**: +- [Visit these instructions](compliance-manager-assessments.md#grant-user-access-to-individual-assessments) for assigning user roles from an assessment's details page. + ## Understand the Compliance Manager dashboard The Compliance Manager dashboard is designed to provide you an at-a-glance view of your current compliance posture. |
| compliance | Dlp Chrome Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-chrome-get-started.md | Title: "Get started with the Microsoft Purview Extension" + Title: "Get started with the Microsoft Purview Chrome Extension" f1.keywords: - CSH search.appverid: description: "Prepare for and deploy the Microsoft Purview Extension." -# Get started with Microsoft Purview Extension +# Get started with Microsoft Purview Chrome Extension -Use these procedures to roll out the Microsoft Purview Extension. +Use these procedures to roll out the Microsoft Purview Chrome Extension. [!INCLUDE [purview-preview](../includes/purview-preview.md)] Use these procedures to roll out the Microsoft Purview Extension. ## Before you begin -To use Microsoft Purview Extension, the device must be onboarded into endpoint DLP. Review these articles if you are new to DLP or endpoint DLP +To use Microsoft Purview Chrome Extension, the device must be onboarded into endpoint DLP. Review these articles if you are new to DLP or endpoint DLP -- [Learn about Microsoft Purview Extension](dlp-chrome-learn-about.md)+- [Learn about Microsoft Purview Chrome Extension](dlp-chrome-learn-about.md) - [Learn about Microsoft Purview Data Loss Prevention](dlp-learn-about-dlp.md) - [Create, test, and tune a DLP policy](create-test-tune-dlp-policy.md) - [Create a DLP policy from a template](create-a-dlp-policy-from-a-template.md) - [Learn about endpoint data loss prevention](endpoint-dlp-learn-about.md) - [Get started with Endpoint data loss prevention](endpoint-dlp-getting-started.md)-- [Onboarding tools and methods for Windows 10 devices](device-onboarding-overview.md)+- [Onboarding tools and methods for Windows 10/11 devices](device-onboarding-overview.md) - [Configure device proxy and internet connection settings for Information Protection](device-onboarding-configure-proxy.md#configure-device-proxy-and-internet-connection-settings-for-information-protection) - [Using Endpoint data loss prevention](endpoint-dlp-using.md) Here's a list of applicable roles. To learn more about them, see [Permissions in - Information Protection Investigator - Information Protection Reader -Here's a list of applicable role groups. To learn more about the, see [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md). +Here's a list of applicable role groups. To learn more about them, see [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md). - Information Protection - Information Protection Admins Deploying the extension is a multi-phase process. You can choose to install on o ### Prepare infrastructure -If you are rolling out the extension to all your monitored Windows 10 devices, you should remove Google Chrome from the unallowed app and unallowed browser lists. For more information, see [Unallowed browsers](dlp-configure-endpoint-settings.md#unallowed-browsers). If you are only rolling it out to a few devices, you can leave Chrome on the unallowed browser or unallowed app lists. The extension will bypass the restrictions of both lists for those computers where it is installed. +If you are rolling out the extension to all your monitored Windows 10/11 devices, you should remove Google Chrome from the unallowed app and unallowed browser lists. For more information, see [Unallowed browsers](dlp-configure-endpoint-settings.md#unallowed-browsers). If you are only rolling it out to a few devices, you can leave Chrome on the unallowed browser or unallowed app lists. The extension will bypass the restrictions of both lists for those computers where it is installed. ### Prepare your devices |
| compliance | Dlp Chrome Learn About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-chrome-learn-about.md | Title: "Learn about the Microsoft Purview Extension" + Title: "Learn about the Microsoft Purview Chrome Extension" f1.keywords: - CSH search.appverid: description: "The Microsoft Purview Extension extends monitoring and control of file activities and protective actions to the Google Chrome browser" -# Learn about the Microsoft Purview Extension +# Learn about the Microsoft Purview Chrome Extension -[Endpoint data loss prevention (endpoint DLP)](endpoint-dlp-learn-about.md) extends the activity monitoring and protection capabilities of [Microsoft Purview data loss prevention (DLP)](dlp-learn-about-dlp.md) to sensitive items that are on Windows 10 devices. Once devices are onboarded into the Microsoft Purview solutions, the information about what users are doing with sensitive items is made visible in [activity explorer](data-classification-activity-explorer.md) and you can enforce protective actions on those items via [DLP policies](create-test-tune-dlp-policy.md). +[Endpoint data loss prevention (endpoint DLP)](endpoint-dlp-learn-about.md) extends the activity monitoring and protection capabilities of [Microsoft Purview data loss prevention (DLP)](dlp-learn-about-dlp.md) to sensitive items that are on Windows 10/11 devices. Once devices are onboarded into the Microsoft Purview solutions, the information about what users are doing with sensitive items is made visible in [activity explorer](data-classification-activity-explorer.md) and you can enforce protective actions on those items via [DLP policies](create-test-tune-dlp-policy.md). -Once the Extension is installed on a Windows 10 device, organizations can monitor when a user attempts to access or upload a sensitive item to a cloud service using Google Chrome and enforce protective actions via DLP. +Once the Microsoft Purview Chrome Extension is installed on a Windows 10/11 device, organizations can monitor when a user attempts to access or upload a sensitive item to a cloud service using Google Chrome and enforce protective actions via DLP. [!INCLUDE [purview-preview](../includes/purview-preview.md)] ## Activities you can monitor and take action on -The extension enables you to audit and manage the following types of activities users take on sensitive items on devices running Windows 10. +The extension enables you to audit and manage the following types of activities users take on sensitive items on devices running Windows 10/11. activity |description | supported policy actions| |||| activity |description | supported policy actions| ## Deployment process 1. [Get started with endpoint data loss prevention](endpoint-dlp-getting-started.md)-2. [Onboarding tools and methods for Windows 10 devices](device-onboarding-overview.md) -3. [Install the extension on your Windows 10 devices](dlp-chrome-get-started.md) -4. [Create or edit DLP policies](create-test-tune-dlp-policy.md) that restrict upload to cloud service, or access by unallowed browsers actions and apply them to your Windows 10 devices +2. [Onboarding tools and methods for Windows 10/11 devices](device-onboarding-overview.md) +3. [Install the extension for Chrome on your Windows 10/11 devices](dlp-chrome-get-started.md) +4. [Create or edit DLP policies](create-test-tune-dlp-policy.md) that restrict upload to cloud service, or access by unallowed browsers actions and apply them to your Windows 10/11 devices ## Next steps -See [Get started with the Microsoft Purview Extension](dlp-chrome-get-started.md) for complete deployment procedures and scenarios. +See [Get started with the Microsoft Purview Chrome Extension](dlp-chrome-get-started.md) for complete deployment procedures and scenarios. ## See also -- [Get started with Microsoft Purview Extension](dlp-chrome-get-started.md)+- [Get started with Microsoft Purview Chrome Extension](dlp-chrome-get-started.md) - [Learn about Endpoint data loss prevention](endpoint-dlp-learn-about.md) - [Getting started with Endpoint data loss prevention](endpoint-dlp-getting-started.md) - [Using Endpoint data loss prevention](endpoint-dlp-using.md) |
| compliance | Dlp Configure Endpoint Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-configure-endpoint-settings.md | For macOS devices, you must add the full file path. To find the full path of Mac #### Service domains > [!NOTE]-> The **Service domains** setting only applies to files uploaded using Microsoft Edge or Google Chrome with the [Microsoft Purview Extension](dlp-chrome-learn-about.md#learn-about-the-microsoft-purview-extension) installed. +> The **Service domains** setting only applies to files uploaded using Microsoft Edge or Google Chrome with the [Microsoft Purview Chrome Extension](dlp-chrome-learn-about.md) installed. You can control whether sensitive files that are protected by your policies can be uploaded to specific service domains from Microsoft Edge. |
| compliance | Dlp Firefox Extension Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-firefox-extension-get-started.md | + + Title: "Get started with the Microsoft Purview Firefox Extension" +f1.keywords: +- CSH +++ Last updated :+audience: ITPro ++f1_keywords: +- 'ms.o365.cc.DLPLandingPage' ++ms.localizationpriority: high ++- tier2 +- purview-compliance +- m365solution-mip +- m365initiative-compliance ++search.appverid: +- MET150 +description: "Prepare for and deploy the Microsoft Purview Firefox Extension." +++# Get started with Microsoft Purview Firefox Extension (preview) ++Use these procedures to roll out the Microsoft Purview Firefox Extension. +++## Before you begin ++To use Microsoft Purview Extension, the device must be onboarded into endpoint DLP. Review these articles if you are new to DLP or endpoint DLP ++- [Learn about Microsoft Purview Firefox Extension](dlp-firefox-extension-learn.md) +- [Learn about Microsoft Purview Data Loss Prevention](dlp-learn-about-dlp.md) +- [Create, test, and tune a DLP policy](create-test-tune-dlp-policy.md) +- [Create a DLP policy from a template](create-a-dlp-policy-from-a-template.md) +- [Learn about endpoint data loss prevention](endpoint-dlp-learn-about.md) +- [Get started with Endpoint data loss prevention](endpoint-dlp-getting-started.md) +- [Onboarding tools and methods for Windows 10 devices](device-onboarding-overview.md) +- [Configure device proxy and internet connection settings for Information Protection](device-onboarding-configure-proxy.md#configure-device-proxy-and-internet-connection-settings-for-information-protection) +- [Using Endpoint data loss prevention](endpoint-dlp-using.md) ++### SKU/subscriptions licensing ++Before you get started, you should confirm your [Microsoft 365 subscription](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans?rtc=1) and any add-ons. To access and use Endpoint DLP functionality, you must have one of these subscriptions or add-ons. ++- Microsoft 365 E5 +- Microsoft 365 A5 (EDU) +- Microsoft 365 E5 compliance +- Microsoft 365 A5 compliance +- Microsoft 365 E5 information protection and governance +- Microsoft 365 A5 information protection and governance ++For detailed licensing guidance, see [Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#information-protection). ++- Your org must be licensed for Endpoint DLP +- Your devices must be running Windows 10 x64 build 1809 or later. +- The device must have Antimalware Client Version is 4.18.2202.x or later. Check your current version by opening **Windows Security** app, select the **Settings** icon, and then select **About**. +++### Permissions ++Data from Endpoint DLP can be viewed in [Activity explorer](data-classification-activity-explorer.md). There are seven roles that grant permission to activity explorer, the account you use for accessing the data must be a member of any one of them. ++- Global admin +- Compliance admin +- Security admin +- Compliance data admin +- Global reader +- Security reader +- Reports reader ++#### Roles and Role Groups ++There are roles and role groups that you can use to fine tune your access controls. ++Here's a list of applicable roles. To learn more about them, see [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md). ++- Information Protection Admin +- Information Protection Analyst +- Information Protection Investigator +- Information Protection Reader ++Here's a list of applicable role groups. To learn more about the, see [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md). ++- Information Protection +- Information Protection Admins +- Information Protection Analysts +- Information Protection Investigators +- Information Protection Readers ++### Overall installation workflow ++Deploying the extension is a multi-phase process. You can choose to install on one machine at a time, or use Microsoft Endpoint Manager or Group Policy for organization-wide deployments. ++1. [Prepare your devices](#prepare-your-devices). +2. [Basic Setup Single Machine Selfhost](#basic-setup-single-machine-selfhost) +3. [Deploy using Microsoft Endpoint Manager](#deploy-using-microsoft-endpoint-manager) +4. [Deploy using Group Policy](#deploy-using-group-policy) +5. [Test the extension](#test-the-extension) +6. [Use the Alerts Management Dashboard to view Firefox DLP alerts](#use-the-alerts-management-dashboard-to-view-firefox-dlp-alerts) +7. [Viewing Firefox DLP data in activity explorer](#viewing-firefox-dlp-data-in-activity-explorer) ++### Prepare infrastructure ++If you are rolling out the extension to all your monitored Windows 10 devices, you should remove Mozilla Firefox from the unallowed app and unallowed browser lists. For more information, see [Unallowed browsers](dlp-configure-endpoint-settings.md#unallowed-browsers). If you are only rolling it out to a few devices, you can leave Firefox on the unallowed browser or unallowed app lists. The extension will bypass the restrictions of both lists for those computers where it is installed. ++### Prepare your devices ++1. Use the procedures in these topics to onboard your devices: + 1. [Get started with Endpoint data loss prevention](endpoint-dlp-getting-started.md) + 1. [Onboarding Windows 10 and Windows 11 devices](device-onboarding-overview.md) + 1. [Configure device proxy and internet connection settings for Information Protection](device-onboarding-configure-proxy.md#configure-device-proxy-and-internet-connection-settings-for-information-protection) ++### Basic Setup Single Machine Selfhost ++This is the recommended method. ++1. Download the initial [XPI file](https://firefoxdlp.blob.core.windows.net/packages-prod/prod-1.1.0.210.xpi). ++2. Locate the extension in your file explorer and drag the file into an open Mozilla Firefox window. ++3. Confirm the installation. ++### Deploy using Microsoft Endpoint Manager ++Use this setup method for organization-wide deployments. ++#### Microsoft Endpoint Manager Force Install Steps ++Before adding the extension to the list of force-installed extensions, it is important to ingest the Firefox ADMX. Steps for this process in Microsoft Endpoint Manager are documented below. Before beginning these steps, please ensure you have downloaded the latest Firefox ADMX from the [Firefox GitHub](https://github.com/mozilla/policy-templates/releases). ++After ingesting the ADMX, the steps below can be followed to create a configuration profile for this extension. ++1. Sign in to the Microsoft Endpoint Manager Admin Center (https://endpoint.microsoft.com). ++2. Navigate to Configuration Profiles. ++3. Select **Create Profile**. ++4. Select **Windows 10** as the platform. ++5. Select **Custom** as profile type. ++6. Select the **Settings** tab. ++7. Select **Add**. ++8. Enter the following policy information. ++ OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettings`<br/> + Data type: `String`<br/> + Value: `<enabled/><data id="ExtensionSettings" value='{ + "microsoft.defender.browser_extension.native_message_host@microsoft.com": { + "installation_mode": "force_installed", + "install_url": ΓÇ£https://firefoxdlp.blob.core.windows.net/packages-prod/prod-1.1.0.210.xpiΓÇ¥, + ΓÇ£updates_disabledΓÇ¥: false + } + }'/> ` ++9. Note: It is critical that updates_disabled is set to false so that the extension can automatically update over time. ++10. Click create. ++### Deploy using Group Policy ++If you don't want to use Microsoft Endpoint Manager, you can use group policies to deploy the extension across your organization. ++#### Adding the Chrome Extension to the ForceInstall List ++1. In the Group Policy Management Editor, navigate to your OU. ++2. Expand the following path **Computer/User configuration** > **Policies** > **Administrative templates** > **Classic administrative templates** > **Firefox** > **Extensions**. This path may vary depending on your configuration. ++3. Select **Extensions to install**. ++4. Right click and select **Edit**. ++5. Select **Enabled**. ++6. Select **Show**. ++7. Under **Value**, add the following entry: `https://firefoxdlp.blob.core.windows.net/packages-prod/prod-1.1.0.210.xpi` ++8. Select **OK** and then **Apply**. ++### Test the Extension ++#### Upload to cloud service, or access by unallowed browsers Cloud Egress ++1. Create or get a sensitive item and, try to upload a file to one of your organizationΓÇÖs restricted service domains. The sensitive data must match one of our built-in [Sensitive Info Types](sensitive-information-type-entity-definitions.md), or one of your organizationΓÇÖs sensitive information types. You should get a DLP toast notification on the device you are testing from that shows that this action is not allowed when the file is open. ++#### Testing other DLP scenarios in Firefox ++Now that youΓÇÖve removed Firefox from the disallowed browsers/apps list, you can test the scenarios below to confirm the behavior meets your organizationΓÇÖs requirements: ++- Copy data from a sensitive item to another document using the Clipboard + - To test, open a file that is protected against copy to clipboard actions in the Firefox browser and attempt to copy data from the file. + - Expected Result: A DLP toast notification showing that this action is not allowed when the file is open. +- Print a document + - To test, open a file that is protected against print actions in the Firefox browser and attempt to print the file. + - Expected Result: A DLP toast notification showing that this action is not allowed when the file is open. +- Copy to USB Removeable Media + - To test, try to save the file to a removeable media storage. + - Expected Result: A DLP toast notification showing that this action is not allowed when the file is open. +- Copy to Network Share + - To test, try to save the file to a network share. + - Expected Result: A DLP toast notification showing that this action is not allowed when the file is open. ++### Use the Alerts Management Dashboard to view Firefox DLP alerts ++1. Open the **Data loss prevention** page in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft Purview compliance portal</a> and select **Alerts**. ++2. Refer to the procedures in [How to configure and view alerts for your DLP policies](dlp-configure-view-alerts-policies.md) to view alerts for your Endpoint DLP policies. ++### Viewing Firefox DLP data in activity explorer ++1. Open the [Data classification page](https://compliance.microsoft.com/dataclassification?viewid=overview) for your domain in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft Purview compliance portal</a> and choose **Activity explorer**. ++2. Refer to the procedures in [Get started with Activity explorer](data-classification-activity-explorer.md) to access and filter all the data for your Endpoint devices. ++ > [!div class="mx-imgBorder"] + >  ++### Known Issues and Limitations ++1. Incognito mode is not supported and must be disabled. ++## Next steps ++Now that you have onboarded devices and can view the activity data in Activity explorer, you are ready to move on to your next step where you create DLP policies that protect your sensitive items. ++- [Using Endpoint data loss prevention](endpoint-dlp-using.md) ++## See also ++- [Learn about Endpoint data loss prevention](endpoint-dlp-learn-about.md) +- [Using Endpoint data loss prevention](endpoint-dlp-using.md) +- [Learn about data loss prevention](dlp-learn-about-dlp.md) +- [Create, test, and tune a DLP policy](create-test-tune-dlp-policy.md) +- [Get started with Activity explorer](data-classification-activity-explorer.md) +- [Microsoft Defender for Endpoint](/windows/security/threat-protection/) +- [Onboarding tools and methods for Windows 10 machines](/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints) +- [Microsoft 365 subscription](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans?rtc=1) +- [Azure AD joined devices](/azure/active-directory/devices/concept-azure-ad-join) +- [Download the new Microsoft Edge based on Chromium](https://support.microsoft.com/help/4501095/download-the-new-microsoft-edge-based-on-chromium) |
| compliance | Dlp Firefox Extension Learn | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-firefox-extension-learn.md | + + Title: "Learn about the Microsoft Purview Firefox Extension" +f1.keywords: +- CSH +++ Last updated : +audience: ITPro ++f1_keywords: +- 'ms.o365.cc.DLPLandingPage' ++ms.localizationpriority: high ++- tier2 +- purview-compliance +- m365solution-mip +- m365initiative-compliance +search.appverid: +- MET150 +description: "The Microsoft Purview Firefox Extension extends monitoring and control of file activities and protective actions to the Firefox browser" +++# Learn about the Microsoft Purview Firefox Extension (preview) ++[Endpoint data loss prevention (endpoint DLP)](endpoint-dlp-learn-about.md) extends the activity monitoring and protection capabilities of [Microsoft Purview data loss prevention (DLP)](dlp-learn-about-dlp.md) to sensitive items that are on Windows 10 devices. Once devices are onboarded into the Microsoft Purview solutions, the information about what users are doing with sensitive items is made visible in [activity explorer](data-classification-activity-explorer.md) and you can enforce protective actions on those items via [DLP policies](create-test-tune-dlp-policy.md). ++Once the Firefox extension is installed on a Windows 10 device, organizations can monitor when a user attempts to access or upload a sensitive item to a cloud service using Mozilla Firefox and enforce protective actions via DLP. +++## Activities you can monitor and take action on ++The extension enables you to audit and manage the following types of activities users take on sensitive items on devices running Mozilla Firefox in Windows 10. ++activity |description | supported policy actions| +|||| +|file copied to cloud | Detects when a user attempts to upload a sensitive item to a restricted service domain through the Firefox browser |audit, block with override, block| +|file printed |Detects when a user attempts to print a sensitive item that is open in the Firefox browser to a local or network printer |audit, block with override, block| +|file copied to clipboard |Detects when a user attempts to copy information from a sensitive item that is being viewed in the Firefox browser and then paste it into another app, process, or item. |audit, block with override, block| +|file copied to removable storage | Detects when a user attempts to copy a sensitive item or information from a sensitive item that is open in the Firefox browser to removable media or USB device |audit, block with override, block| +|file copied to network share |Detects when a user attempts to copy a sensitive item or information from a sensitive item that is open in the Firefox browser to a network share or mapped network drive.|audit, block with override, block | ++## Deployment process +1. [Get started with endpoint data loss prevention](endpoint-dlp-getting-started.md) +2. [Onboarding tools and methods for Windows 10 devices](device-onboarding-overview.md) +3. [Install the Firefox extension on your Windows 10 devices](dlp-firefox-extension-get-started.md) +4. [Create or edit DLP policies](create-test-tune-dlp-policy.md) that restrict upload to cloud service, or access by unallowed browsers actions and apply them to your Windows 10 devices ++## Next steps ++See [Get started with the Microsoft Purview Firefox Extension](dlp-firefox-extension-get-started.md) for complete deployment procedures and scenarios. ++## See also ++- [Get started with Microsoft Purview Firefox Extension](dlp-firefox-extension-get-started.md) +- [Learn about Endpoint data loss prevention](endpoint-dlp-learn-about.md) +- [Getting started with Endpoint data loss prevention](endpoint-dlp-getting-started.md) +- [Using Endpoint data loss prevention](endpoint-dlp-using.md) +- [Learn about data loss prevention](dlp-learn-about-dlp.md) +- [Create, test, and tune a DLP policy](create-test-tune-dlp-policy.md) +- [Get started with Activity explorer](data-classification-activity-explorer.md) +- [Microsoft Defender for Endpoint](/windows/security/threat-protection/) +- [Insider risk management](insider-risk-management.md) |
| compliance | Dlp Migration Assistant For Symantec Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-migration-assistant-for-symantec-get-started.md | You can only install and run the migration assistant on these operating systems: ### 4. Install PowerShell -You must have PowerShell v7.2.6 or higher installed on your machine, before the migration assistant can be installed. [Download Powershell-7.2.6-win-x64.msi core on your machine](https://github.com/PowerShell/PowerShell/releases/download/v7.2.6/PowerShell-7.2.6-win-x64.msi). +You must have PowerShell v7.2.6 or higher installed on the host machine. [Download Powershell-7.2.6-win-x64.msi core on your machine](https://github.com/PowerShell/PowerShell/releases/download/v7.2.6/PowerShell-7.2.6-win-x64.msi). ### 5. Install .NET -You must have installed .NET v6.0.401 or higher on your machine, before the migration assistant can be installed. [Download .NET 6 core SDK on your machine](https://dotnet.microsoft.com/download/dotnet/thank-you/sdk-6.0.401-windows-x64-installer). --> [!IMPORTANT] -> If you don't already have .NET v6.0.401 installed and attempt to install it through the migration tool installation, you will be directed to the wrong version of .NET. You must have .net v6.0.401 installed. +You must have .NET desktop runtime v6.0.13 or higher installed on the host machine. [Download .NET 6.0 Desktop Runtime (v6.0.13) - Windows x64 Installer (microsoft.com)](https://dotnet.microsoft.com/download/dotnet/thank-you/runtime-desktop-6.0.13-windows-x64-installer?cid=getdotnetcore). ### Export Symantec DLP policies You need to export these policies as XML files from Symantec DLP. Export the pol Follow these steps to install the Microsoft Purview Data Loss Prevention migration assistant for Symantec: -1. Download and launch **[MigrationAssistantforMicrosoftPurviewDLP.msi](https://aka.ms/DLPMigrationAssistant)** file. +1. Download and launch the **[migration assistant](https://aka.ms/DLPMigrationAssistant)** file. 2. The following dialog box will open. Select **Next**. 3. Review the End-User License Agreement. 4. After reviewing, accept the License Agreement and select **Next**. Follow these steps to install the Microsoft Purview Data Loss Prevention migrati ## Next steps -Now that you have installed Microsoft Purview Data Loss Prevention migration assistant for Symantec (preview), you're ready to move on to your next step where you use the migration tool. +Now that you have installed Microsoft Purview Data Loss Prevention migration assistant for Symantec (preview), you're ready to move on to your next step where you use the migration assistant. - [Using the Microsoft Purview Data Loss Prevention migration assistant for Symantec](dlp-migration-assistant-for-symantec-use.md) |
| compliance | Dlp Migration Assistant For Symantec Learn | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-migration-assistant-for-symantec-learn.md | -description: "The migration assistant tool is a Windows based desktop application that will migrate your DLP policies from other DLP platforms to Microsoft DLP platform." +description: "The migration assistant is a Windows based desktop application that will migrate your DLP policies from other DLP platforms to Microsoft DLP platform." # Learn about the Microsoft Purview Data Loss Prevention migration assistant for Symantec (preview) This article helps you to learn about the Microsoft Purview Data Loss Prevention migration assistant for Symantec. -The migration assistant tool is a Windows-based desktop application that will migrate your Symantec data loss prevention (DLP) policies to Microsoft Purview Data Loss Prevention. This tool takes you through the five-step migration process. It accepts Symantec DLP policy XML exports, performs mapping, and creates equivalent DLP policies through PowerShell scripts. You can use the migration assistant tool to create DLP policies in test mode. Policies in test mode won't impact your live data or impact your existing business processes. +The migration assistant is a Windows-based desktop application that will migrate your Symantec data loss prevention (DLP) policies to Microsoft Purview Data Loss Prevention. This takes you through the five-step migration process. It accepts Symantec DLP policy XML exports, performs mapping, and creates equivalent DLP policies through PowerShell scripts. You can use the migration assistant to create DLP policies in test mode. Policies in test mode won't impact your live data or impact your existing business processes. ## What can the migration assistant help with? |
| compliance | Dlp Test Dlp Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-test-dlp-policies.md | + + Title: "Test your DLP policies" +f1.keywords: +- NOCSH ++++audience: Admin +++ms.localizationpriority: medium ++- M365-security-compliance +search.appverid: +- MOE150 +- MET150 +description: "Learn how to use the Test-DlpPolicies cmdlet on items in SharePoint Online and OneDrive for Business to see which DLP policies are matched" +++# Test your Data Loss Prevention policies (preview) + +You should test and tune the behavior of your Microsoft Purview Data Loss Prevention (DLP) policies as part of your DLP policy deployment. This article introduces you to some of the basic methods you can use to test policies in your DLP environment. ++## Test mode ++When you deploy a new policy, [you should run it in test mode,](dlp-overview-plan-for-dlp.md#policy-deployment) and then use the [view the reports for](view-the-dlp-reports.md) and any [alerts](dlp-alerts-dashboard-learn.md) to assess the impact. Test mode allows you to see the impact of an individual policy on all the items that are in the policies scope. You use it to find out what items match a policy. ++## Test-DlpPolicies (preview) ++**Test-DlpPolicies** is a cmdlet that allows you to see what SharePoint Online and OneDrive for Business scoped DLP policies match/don't match an individual item in SharePoint Online or OneDrive for Business. ++### Before you begin ++- You must be able to connect to [Connect to Security & Compliance PowerShell](/powershell/exchange/exchange-online-powershell). +- You must have a valid smtp address to send the report to. For example: `dlp_admin@contoso.com` +- You must get the site ID where the item is located. +- You must have the direct link path to the item. ++> [!IMPORTANT] +> +> - Test-DlpPolicies only works for items that are in SharePoint Online (SPO) or OneDrive for Business (ODB). +> - It will only report results for policies that include SharePoint Online alone, OneDrive alone or SharePoint and OneDrive in their scope. +> - Test-DlpPolices works only with simple conditions. It doesn't work with complex, grouped, or nested conditions. ++### Use Test-DlpPolices ++To see which DLP policies an item will match, follow these steps: ++#### Get the direct link path to the item ++1. Open the SharePoint or OneDrive folder in a browser. ++1. Select the files ellipsis and select **details**. ++1. In the details pane, scroll down and select **Path** (Copy direct link). Save it. ++For example: ++`https://contoso.sharepoint.com/personal/user_contoso_com/Documents/test.docx` ++#### Get the site ID ++1. [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). ++1. For SharePoint use the following syntax to get the site id and save it. ++```powershell +$reportAddress = "email@report.com" $siteName = "SITENAME@TENANT.onmicrosoft.com" $filePath = "https://Contoso.sharepoint.com/sites/SOMESITENAME/Shared%20Documents/TESTFILE.pptx" $r = Get-Mailbox -Identity $siteName -GroupMailbox $e = $r.EmailAddresses | Where-Object {$_ -like '*SPO*'} Test-DlpPolicies -SiteId $e.Substring(8,36) -FileUrl $filePath -Workload SPO -SendReportTo $reportAddress +``` +3. For OneDrive use the following syntax to get the site id and save it. ++```powershell +$reportAddress = "email@report.com" $odbUser = "USER@TENANT.onmicrosoft.com" $filePath = "https://contoso-my.sharepoint.com/personal/userid_contoso_onmicrosoft_com/Documents/TESTFILE.docx" $r = Get-Mailbox -Identity $odbUser $e = $r.EmailAddresses | Where-Object {$_ -like '*SPO*'} Test-DlpPolicies -SiteId $e.Substring(8,36) -FileUrl $filePath -Workload ODB -SendReportTo $reportAddress +``` ++Here's an example of a returned value: ++`36ca70ab-6f38-7f3c-515f-a71e59ca6276` ++#### Run Test-DlpPolicies ++1. Run this syntax in the PowerShell window + ++```powershell +Test-DlpPolicies -workload <workload> -Fileurl <path/direct link> -SendReportTo <smtpaddress> +``` ++For example: ++`Test-DlpPolicies -workload <ODB> -Fileurl <https://contoso.sharepoint.com/personal/user_contoso_com/Documents/test.docx> -SendReportTo <dlp_admin@contoso.com>` ++For detailed syntax and parameter information, see [Test-DlpPolicies](/powershell/module/exchange/test-dlppolicies). +++### Interpret the report ++The report is sent to the smtp address you passed the Test-DlpPolicies PowerShell command. There are multiple fields, here are explanations of the most important ones. +++|Field name |Means | +||| +|Classification ID |The sensitive information type (SIT) the item is categorized as | +|Confidence |The [confidence level](/sensitive-information-type-learn-about.md#more-on-confidence-levels) of the SIT | +|Count |The total number of times the SIT value was found in the item, this includes duplicates | +|Unique Count |The number SIT values found in the item with duplicates eliminated | +|Policy Details |The name and GUID of the policy that was evaluated | +|Rules - Rule Details |The DLP rule name and GUID | +|Rules - Predicates - Name |The condition defined in the DLP rule | +|Rules - Predicates - IsMatch | Whether the item matched the conditions | +|Predicates - Past Actions |Any actions, like notify user, block, block with override that 's been taken on the item | +|Predicates - Rule's Actions |The action defined in the DLP rule | +|Predicates - IsMatched | Whether the item matched the rule | +|IsMatched |Whether the item matched the overall policy | |
| compliance | Encryption Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/encryption-sensitivity-labels.md | You can use the following options to let users assign permissions when they manu The Do Not Forward option is supported by all email clients that support sensitivity labels. However, applying the **Encrypt-Only** option with a sensitivity label is a more recent release that's supported only by built-in labeling and not the Azure Information Protection unified labeling client. For email clients that don't support this capability, the label won't be visible. - To check the minimum versions of Outlook apps that use built-in labeling to support applying the Encrypt-Only option with a sensitivity label, use the [capabilities table for Outlook](sensitivity-labels-office-apps.md#sensitivity-label-capabilities-in-outlook) and the row **Let users assign permissions: - Encrypt-Only**. + To check the minimum versions of Outlook apps that use built-in labeling to support applying the Encrypt-Only option with a sensitivity label, use the [capabilities table for Outlook](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-outlook) and the row **Let users assign permissions: - Encrypt-Only**. - In Word, PowerPoint, and Excel, a user is prompted to select their own permissions for specific users, groups, or organizations. This option is supported by the Azure Information Protection unified labeling client and by some apps that use built-in labeling. For apps that don't support this capability, the label either won't be visible for users, or the label is visible for consistency but it can't be applied with an explanation message to users. - To check which apps that use built-in labeling support this option, use the [capabilities table for Word, Excel, and PowerPoint](sensitivity-labels-office-apps.md#sensitivity-label-capabilities-in-word-excel-and-powerpoint) and the rows for **Let users assign permissions**. + To check which apps that use built-in labeling support this option, use the [capabilities table for Word, Excel, and PowerPoint](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-word-excel-and-powerpoint) and the rows for **Let users assign permissions**. When the options are supported, use the following table to identify when users see the sensitivity label: |
| compliance | Microsoft 365 Compliance Center Redirection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/microsoft-365-compliance-center-redirection.md | - Title: "Redirection of users from the Office 365 Security and Compliance Center to the Microsoft Purview compliance portal" -description: Learn about automatic redirection of users from the Office 365 Security and Compliance Center users to the Microsoft Purview compliance portal. -- NOCSH-------- tier1-- purview-compliance----# Redirection of users from the Office 365 Security and Compliance Center to the Microsoft Purview compliance portal --This article explains how automatic redirection works for users accessing compliance solutions from the Office 365 Security and Compliance Center (protection.office.com) to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft Purview compliance portal</a>. ---## What to expect --Automatic redirection is enabled by default for all users accessing compliance-related solutions in Office 365 Security and Compliance (protection.office.com): --- [eDiscovery (Premium)](ediscovery-overview.md)-- [Communication compliance](communication-compliance.md)-- [Content search](search-for-content.md)-- [eDiscovery (Standard)](ediscovery-standard-get-started.md)-- [Data classification](data-classification-overview.md)-- [Data loss prevention (DLP)](dlp-learn-about-dlp.md)-- [Data subject requests](/compliance/regulatory/gdpr-manage-gdpr-data-subject-requests-with-the-dsr-case-tool)-- [Data lifecycle management](manage-data-governance.md) (formerly **Information governance**)-- [Records management](records-management.md)--Users are automatically routed to the same compliance solutions in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">compliance portal</a>. --This feature and associated controls does not enable the automatic redirection of Security features for Microsoft Defender for Office 365. For more information, see [Microsoft Defender for Office 365 in Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-center-mdo). --## Related information --- [Microsoft Purview compliance portal overview](/microsoft-365/compliance/microsoft-365-compliance-center) |
| compliance | Sensitivity Labels Aip | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-aip.md | To keep informed when new labeling capabilities become available for built-in la For the latest Office apps, the AIP add-in is disabled by default, so there's nothing for you to configure: - Currently in preview: [Current Channel (Preview)](https://office.com/insider)-- **Current Channel** and **Monthly Enterprise Channel**: Not before version 2212+ (not yet released)+- **Current Channel** and **Monthly Enterprise Channel**: Not before version 2302+ (not yet released) - **Semi-Annual Channel**: Not before version 2301+ (not yet released) If you have a version that disabled the AIP add-in by default, and you need to use the AIP add-in rather than built-in labeling, you must [configure a new setting to override the default](#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in). The following configurations from the AIP add-in that aren't yet supported by bu - [Label inheritance from email attachments](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#for-email-messages-with-attachments-apply-a-label-that-matches-the-highest-classification-of-those-attachments) - [Oversharing popup messages for Outlook](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#implement-pop-up-messages-in-outlook-that-warn-justify-or-block-emails-being-sent) - [Default sublabel for a parent label](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#specify-a-default-sublabel-for-a-parent-label)+ - This option is currently rolling out in preview. For more information, see [Specify a default sublabel for a parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label) - [Remove external content markings](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#remove-headers-and-footers-from-other-labeling-solution) ## Features not planned to be supported by built-in labeling for Office apps |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | The Azure Information Protection (AIP) add-in component from the [Azure Informat ## Support for sensitivity label capabilities in apps -The following tables list the minimum Office version that introduced specific capabilities for sensitivity labels built in to Office apps. Or, if the label capability is in public preview or under review for a future release: +Use the tables in [Minimum versions for sensitivity labels in Office apps](sensitivity-labels-versions.md) to identify the minimum Office version that introduced specific capabilities for sensitivity labels built in to Office apps. Or, if the label capability is in public preview or under review for a future release. -- [Capabilities table for Word, Excel, and PowerPoint](#sensitivity-label-capabilities-in-word-excel-and-powerpoint)-- [Capabilities table for Outlook](#sensitivity-label-capabilities-in-outlook)+In addition to listing the minimum versions for Windows, macOS, iOS, and Android, the tables also include whether the capability is supported for Office on the web: -Use the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap?filters=Microsoft%20Information%20Protection&searchterms=label) for details about new labeling capabilities that are planned for future releases. --New versions of Office apps are made available at different times for different update channels. For Windows, you'll get the new capabilities earlier when you are on the Current Channel or Monthly Enterprise Channel, rather than Semi-Annual Enterprise Channel. The minimum version numbers can also be different from one update channel to the next. For more information, see [Overview of update channels for Microsoft 365 Apps](/deployoffice/overview-update-channels) and [Update history for Microsoft 365 Apps](/officeupdates/update-history-microsoft365-apps-by-date). --New capabilities that are in private preview are not included in the tables but you might be able to join these previews by nominating your organization for the [Microsoft Information Protection private preview program](https://aka.ms/mip-preview). +- [Capabilities table for Word, Excel, and PowerPoint](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-word-excel-and-powerpoint) +- [Capabilities table for Outlook](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-outlook) Office for iOS and Office for Android: Sensitivity labels are built into the [Office app](https://www.microsoft.com/microsoft-365/blog/2020/02/19/new-office-app-android-ios-available/). -> [!TIP] -> When you compare the minimum versions in the tables with the versions you have, remember the common practice of release versions to omit leading zeros. -> -> For example, you have version 4.2128.0 and read that 4.7.1+ is the minimum version. For easier comparison, read 4.7.1 (no leading zeros) as 4.**0007**.1 (and not 4.**7000**.1). Your version of 4.2128.0 is higher than 4.0007.1, so your version is supported. --### Sensitivity label capabilities in Word, Excel, and PowerPoint --The numbers listed are the minimum Office application versions required for each capability. --> [!NOTE] -> For Windows and the Semi-Annual Enterprise Channel, the minimum supported version numbers might not yet be released. [Learn more](/officeupdates/update-history-microsoft365-apps-by-date#supported-versions) - -|Capability |Windows |Mac |iOS |Android |Web | -|--|-:|-|-|--|-| -|[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)| Preview: [Current Channel (Preview)](https://office.com/insider) | Not relevant | Not relevant | Not relevant| Not relevant | -|[Manually apply, change, or remove label](https://support.microsoft.com/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | -|[Multi-language support](create-sensitivity-labels.md#additional-label-settings-with-security--compliance-powershell)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | Under review | -|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) to new documents | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | -|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) to existing documents | Current Channel: 2208+ <br /><br> Monthly Enterprise Channel: 2207+ <br /><br> Semi-Annual Enterprise Channel: Under review | 16.63+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | -|[Require a justification to change a label](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | -|[Provide help link to a custom help page](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | -|[Mark the content](sensitivity-labels.md#what-sensitivity-labels-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | -|[Dynamic markings with variables](#dynamic-markings-with-variables) | Current Channel: 2010+ <br /><br> Monthly Enterprise Channel: 2010+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.42+ | 2.42+ | 16.0.13328+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | -|[Assign permissions now](encryption-sensitivity-labels.md#assign-permissions-now) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | -|[Let users assign permissions: <br /> - Prompt users for custom permissions (users and groups)](encryption-sensitivity-labels.md#let-users-assign-permissions) |Current Channel: 2004+ <br /><br> Monthly Enterprise Channel: 2004+ <br /><br> Semi-Annual Enterprise Channel: 2008+ | 16.35+ | Under review | Under review | Under review | -|[Let users assign permissions: <br /> - Prompt users for custom permissions (users, groups, and organizations)](encryption-sensitivity-labels.md#support-for-organization-wide-custom-permissions) |Preview: Rolling out to [Beta Channel](https://office.com/insider) | Under review | Under review | Under review | Under review | -|[Audit label-related user activity](#auditing-labeling-activities) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ | 2.46+ | 16.0.13628+ | Yes | -|[Require users to apply a label to their email and documents](#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.45+ | 2.47+ | 16.0.13628+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) -|[Apply a sensitivity label to files automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | -|[Apply a sensitivity label to files automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | Under review | -|[Support co-authoring and AutoSave](sensitivity-labels-coauthoring.md) for labeled and encrypted documents | Current Channel: 2107+ <br /><br> Monthly Enterprise Channel: 2107+ <br /><br> Semi-Annual Enterprise Channel: 2202+ | 16.51+ | 2.58+ | 16.0.14931+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | -|[PDF support](#pdf-support)| Current Channel: 2208+ <br /><br> Monthly Enterprise Channel: 2209+ <br /><br> Semi-Annual Enterprise Channel: 2302+ | Under review | Under review | Under review | Under review | -|[Sensitivity bar](#sensitivity-bar) and [display label color](#label-colors) | Preview: [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review | Under review | --### Sensitivity label capabilities in Outlook --The numbers listed are the minimum Office application versions required for each capability. --> [!NOTE] -> For Windows and the Semi-Annual Enterprise Channel, the minimum supported version numbers might not yet be released. [Learn more](/officeupdates/update-history-microsoft365-apps-by-date#supported-versions) --|Capability |Outlook for Windows |Outlook for Mac |Outlook on iOS |Outlook on Android |Outlook on the web | -|--|-:|-||-|-| -|[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)| Preview: [Current Channel (Preview)](https://office.com/insider) | Not relevant | Not relevant | Not relevant| Not relevant | -|Manually apply, change, or remove label <br /> - [Files and emails](https://support.microsoft.com/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | -|Manually apply, change, or remove label <br /> - [Calendar items](sensitivity-labels-meetings.md)| Preview: Rolling out to [Beta Channel](https://office.com/insider) | Under review | Under review | Under review | Yes | -|[Multi-language support](create-sensitivity-labels.md#additional-label-settings-with-security--compliance-powershell)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | -|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | -|[Require a justification to change a label](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | -|[Provide help link to a custom help page](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | -|[Mark the content](sensitivity-labels.md#what-sensitivity-labels-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | -|[Dynamic markings with variables](#dynamic-markings-with-variables) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | -|[Assign permissions now](encryption-sensitivity-labels.md#assign-permissions-now) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | -|[Let users assign permissions: <br /> - Do Not Forward](encryption-sensitivity-labels.md#let-users-assign-permissions) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | -|[Let users assign permissions: <br /> - Encrypt-Only](encryption-sensitivity-labels.md#let-users-assign-permissions) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.48+ <sup>\*</sup> | 4.2112.0+ | 4.2112.0+ | Yes | -|[Require users to apply a label to their email and documents](#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes | -|[Audit label-related user activity](#auditing-labeling-activities) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.51+ <sup>\*</sup> | 4.2126+ | 4.2126+ | Yes | -|[Apply a sensitivity label to emails automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ <sup>\*</sup> | Under review | Under review | Yes | -|[Apply a sensitivity label to emails automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | Yes | -|[Different settings for default label and mandatory labeling](#outlook-specific-options-for-default-label-and-mandatory-labeling) | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes | -|[PDF support](#pdf-support) | Current Channel: 2205+ <br /><br> Monthly Enterprise Channel: 2205+ <br /><br> Semi-Annual Enterprise Channel: Under review| Under review | Under review | Under review | Under review | -|[Apply S/MIME protection](#configure-a-label-to-apply-smime-protection-in-outlook) | Current Channel: 2211+ <br /><br> Monthly Enterprise Channel: Under review <br /><br> Semi-Annual Enterprise Channel:Under review | 16.61+ <sup>\*</sup> | 4.2226+ | 4.2203+ | Under review | -|[Sensitivity bar](#sensitivity-bar) and [display label color](#label-colors) | Under review | Under review | Under review | Under review | Under review | --**Footnotes:** --<sup>\*</sup> -Requires the [new Outlook for Mac](https://support.microsoft.com/office/the-new-outlook-for-mac-6283be54-e74d-434e-babb-b70cefc77439) - ## Office built-in labeling client and the Azure Information Protection client If users have the [Azure Information Protection (AIP) client](/azure/information-protection/rms-client/aip-clientv2) installed on their Windows computers, built-in labels are the new default for the latest Windows Office apps that [support labeling](#labeling-client-for-desktop-apps). Because built-in labels don't use an Office add-in, as used by the AIP client, they have the benefit of more stability and better performance. They also support the latest features, such as advanced classifiers. For these scenarios, using their Office apps, a user with built-in labeling can > [!IMPORTANT] > If your Office apps don't support this capability, they apply the markings as the original text specified in the label configuration, rather than resolving the variables. > -> The Azure Information Protection unified labeling client supports dynamic markings. For labeling built in to Office, see the tables in the [capabilities](#support-for-sensitivity-label-capabilities-in-apps) section on this page for minimum versions supported. +> The Azure Information Protection unified labeling client supports dynamic markings. For labeling built in to Office, see the tables in [Minimum versions for sensitivity labels in Office apps](sensitivity-labels-versions.md). When you configure a sensitivity label for content markings, you can use the following variables in the text string for your header, footer, or watermark: Examples: > [!IMPORTANT] > -> The [Azure Information Protection unified labeling client](/azure/information-protection/rms-client/install-unifiedlabelingclient-app) supports this configuration that's also known as mandatory labeling. For labeling built in to Office apps, see the tables in the [capabilities](#support-for-sensitivity-label-capabilities-in-apps) section on this page for minimum versions. +> The [Azure Information Protection unified labeling client](/azure/information-protection/rms-client/install-unifiedlabelingclient-app) supports this configuration that's also known as mandatory labeling. For labeling built in to Office apps, see the tables in [Minimum versions for sensitivity labels in Office apps](sensitivity-labels-versions.md). > > To use mandatory labeling for documents but not emails, see the instructions in the next section that explains how to configure Outlook-specific options. > For guidance about when to use this setting, see the information about [policy s > > The default label always takes priority over mandatory labeling. However, for documents, the Azure Information Protection unified labeling client applies the default label to all unlabeled documents whereas built-in labeling applies the default label to new documents and not to existing documents that are unlabeled. This difference in behavior means that when you use mandatory labeling with the default label setting, users will probably be prompted to apply a sensitivity label more often when they use built-in labeling than when they use the Azure Information Protection unified labeling client. > -> Now rolling out: Office apps that use built-in labeling and support a default label for existing documents. For details, see the [capabilities table](sensitivity-labels-office-apps.md#sensitivity-label-capabilities-in-word-excel-and-powerpoint) for Word, Excel, and PowerPoint. +> Now rolling out: Office apps that use built-in labeling and support a default label for existing documents. For details, see the [capabilities table](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-word-excel-and-powerpoint) for Word, Excel, and PowerPoint. ## Outlook-specific options for default label and mandatory labeling -For built-in labeling, identify the minimum versions of Outlook that support these features by using the [capabilities table for Outlook](#sensitivity-label-capabilities-in-outlook) on this page, and the row **Different settings for default label and mandatory labeling**. All versions of the Azure Information Protection unified labeling client support these Outlook-specific options. +For built-in labeling, identify the minimum versions of Outlook that support these features by using the [capabilities table for Outlook](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-outlook) and the row **Different settings for default label and mandatory labeling**. All versions of the Azure Information Protection unified labeling client support these Outlook-specific options. When the Outlook app supports a default label setting that's different from the default label setting for documents: When the Outlook app doesn't support turning off mandatory labeling: If you sele ## Configure a label to apply S/MIME protection in Outlook > [!NOTE]-> This capability is available for built-in labeling for Windows, Mac, iOS, and Android, but it's not yet available for Outlook on the web. Identify the minimum versions of Outlook that support this feature by using the [capabilities table for Outlook](#sensitivity-label-capabilities-in-outlook) on this page, and the row **Apply S/MIME protection**. +> This capability is available for built-in labeling for Windows, Mac, iOS, and Android, but it's not yet available for Outlook on the web. Identify the minimum versions of Outlook that support this feature by using the [capabilities table for Outlook](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-outlook) and the row **Apply S/MIME protection**. > > If you configure a label to apply S/MIME protection but your version of Outlook for Windows doesn't yet support it, the label is still displayed and can be applied, but the S/MIME settings are ignored. You won't be able to select this label for Exchange auto-labeling policies. For more help in specifying PowerShell advanced settings, see [PowerShell tips f ## PDF support -For built-in labeling, use the tables in the [capabilities](#support-for-sensitivity-label-capabilities-in-apps) section on this page to identify minimum versions supported. The Azure Information Protection unified labeling client doesn't support PDF in Office apps. +For built-in labeling, use the tables in [Minimum versions for sensitivity labels in Office apps](sensitivity-labels-versions.md). The Azure Information Protection unified labeling client doesn't support PDF in Office apps. Word, Excel, and PowerPoint support the following methods to convert an Office document into a PDF document: For end user documentation, see [Create protected PDFs from Office files](https: ## Sensitivity bar -Newly supported in preview for built-in labels in Word, Excel, and PowerPoint, but not yet for Outlook or Office for the web, see the tables in the [capabilities](#support-for-sensitivity-label-capabilities-in-apps) section on this page to identify minimum versions. +Newly supported in preview for built-in labels in Word, Excel, and PowerPoint, but not yet for Outlook or Office for the web, see the tables in [Minimum versions for sensitivity labels in Office apps](sensitivity-labels-versions.md) to identify which Office versions support this feature. For the supported apps, sensitivity labels are now displayed in a sensitivity bar, next to the file name on the top window bar. For example: As part of this high visibility, these labels also support colors. For more info > [!IMPORTANT] > If your labeling apps don't support this capability, they don't display the configured label colors. > -> The Azure Information Protection unified labeling client supports label colors. For labeling built in to Office, label colors are currently supported in preview for Word, Excel, and PowerPoint on Windows, but not yet for Outlook, macOS, or Office for the web. For more information, see the tables in the [capabilities](#support-for-sensitivity-label-capabilities-in-apps) section on this page. +> The Azure Information Protection unified labeling client supports label colors. For labeling built in to Office, label colors are currently supported in preview for Word, Excel, and PowerPoint on Windows, but not yet for Outlook, macOS, or Office for the web. For more information, see the tables in [Minimum versions for sensitivity labels in Office apps](sensitivity-labels-versions.md). Newly created labels don't have a color by default. If your labels were [migrated from Azure Information Protection](/azure/information-protection/configure-policy-migrate-labels) or you configured label colors for the Azure Information Protection unified labeling client, these label colors are now displayed in apps that support them. Set-Label -Identity 8faca7b8-8d20-48a3-8ea2-0f96310a848e -AdvancedSettings @{col For more information to help you specify PowerShell advanced settings for sensitivity labels, see [PowerShell tips for specifying the advanced settings](create-sensitivity-labels.md#powershell-tips-for-specifying-the-advanced-settings). +## Specify a default sublabel for a parent label ++> [!NOTE] +> For built-in labeling, identify the minimum versions that support this setting by using the [capabilities tables](sensitivity-labels-versions.md) and the row **Default sublabel for parent label**. All versions of the Azure Information Protection unified labeling client support this setting. ++This configuration is not available in the Microsoft Purview compliance portal. You must use the PowerShell advanced setting *DefaultSubLabelId* with the [Set-Label](/powershell/module/exchange/set-label) or [New-Label](/powershell/module/exchange/new-label) cmd after you've [connected to Security & Compliance PowerShell](/powershell/exchange/office-365-scc/connect-to-scc-powershell/connect-to-scc-powershell). ++When you add a sublabel to a label, users can no longer apply the parent label to a document or email. By default, users select the parent label to see the sublabels that they can apply, and then select one of those sublabels. If you specify a default sublabel for a parent label, when users select the parent label, a sublabel is automatically selected and applied for them. ++Example PowerShell command, where the parent sensitivity label GUID is **8faca7b8-8d20-48a3-8ea2-0f96310a848e** and its sublabel that you want to specify as the default is **1ace2cc3-14bc-4142-9125-bf946a70542c**: ++```PowerShell +Set-Label -Identity "8faca7b8-8d20-48a3-8ea2-0f96310a848e" -AdvancedSettings @{DefaultSubLabelId="1ace2cc3-14bc-4142-9125-bf946a70542c"} +``` ++For more help in specifying PowerShell advanced settings, see [PowerShell tips for specifying the advanced settings](create-sensitivity-labels.md#powershell-tips-for-specifying-the-advanced-settings). + ## Auditing labeling activities For information about the auditing events that are generated by sensitivity label activities, see the [Sensitivity label activities](audit-log-activities.md#sensitivity-label-activities) section from [Search the audit log in the Microsoft Purview compliance portal](audit-log-search.md). |
| compliance | Sensitivity Labels Versions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-versions.md | + + Title: "Minimum versions for sensitivity labels in Microsoft 365 Apps" +f1.keywords: +- NOCSH +++ Last updated : +audience: Admin +++ms.localizationpriority: high ++- purview-compliance +- tier3 +search.appverid: +- MOE150 +- MET150 +description: Identify the minimum versions of Office apps that support specific capabilities for sensitivity labels from Microsoft Purview Information Protection. +++# Minimum versions for sensitivity labels in Office apps ++>*[Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance).* ++The capabilities tables on this page supplement [Manage sensitivity labels in Office apps](sensitivity-labels-office-apps.md) by listing the minimum Office version that introduced specific capabilities for sensitivity labels built in to Office apps. Or, if the label capability is in public preview or under review for a future release. ++New versions of Office apps are made available at different times for different update channels. For Windows, you'll get the new capabilities earlier when you are on the Current Channel or Monthly Enterprise Channel, rather than Semi-Annual Enterprise Channel. The minimum version numbers can also be different from one update channel to the next. For more information, see [Overview of update channels for Microsoft 365 Apps](/deployoffice/overview-update-channels) and [Update history for Microsoft 365 Apps](/officeupdates/update-history-microsoft365-apps-by-date). ++New capabilities that are in private preview are not included in the tables but you might be able to join these previews by nominating your organization for the [Microsoft Information Protection private preview program](https://aka.ms/mip-preview). ++> [!TIP] +> When you compare the minimum versions in the tables with the versions you have, remember the common practice of release versions to omit leading zeros. +> +> For example, you have version 4.2128.0 and read that 4.7.1+ is the minimum version. For easier comparison, read 4.7.1 (no leading zeros) as 4.**0007**.1 (and not 4.**7000**.1). Your version of 4.2128.0 is higher than 4.0007.1, so your version is supported. ++## Sensitivity label capabilities in Word, Excel, and PowerPoint ++The numbers listed are the minimum Office application versions required for each capability. ++> [!NOTE] +> For Windows and the Semi-Annual Enterprise Channel, the minimum supported version numbers might not yet be released. [Learn more](/officeupdates/update-history-microsoft365-apps-by-date#supported-versions) + +|Capability |Windows |Mac |iOS |Android |Web | +|--|-:|-|-|--|-| +|[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)| Preview: [Current Channel (Preview)](https://office.com/insider) | Not relevant | Not relevant | Not relevant| Not relevant | +|[Manually apply, change, or remove label](https://support.microsoft.com/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | +|[Multi-language support](create-sensitivity-labels.md#additional-label-settings-with-security--compliance-powershell)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | Under review | +|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) to new documents | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | +|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) to existing documents | Current Channel: 2208+ <br /><br> Monthly Enterprise Channel: 2207+ <br /><br> Semi-Annual Enterprise Channel: Under review | 16.63+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | +|[Require a justification to change a label](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | +|[Provide help link to a custom help page](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | +|[Mark the content](sensitivity-labels.md#what-sensitivity-labels-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | +|[Dynamic markings with variables](sensitivity-labels-office-apps.md#dynamic-markings-with-variables) | Current Channel: 2010+ <br /><br> Monthly Enterprise Channel: 2010+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.42+ | 2.42+ | 16.0.13328+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | +|[Assign permissions now](encryption-sensitivity-labels.md#assign-permissions-now) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | +|[Let users assign permissions: <br /> - Prompt users for custom permissions (users and groups)](encryption-sensitivity-labels.md#let-users-assign-permissions) |Current Channel: 2004+ <br /><br> Monthly Enterprise Channel: 2004+ <br /><br> Semi-Annual Enterprise Channel: 2008+ | 16.35+ | Under review | Under review | Under review | +|[Let users assign permissions: <br /> - Prompt users for custom permissions (users, groups, and organizations)](encryption-sensitivity-labels.md#support-for-organization-wide-custom-permissions) |Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review | Under review | +|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ | 2.46+ | 16.0.13628+ | Yes | +|[Require users to apply a label to their email and documents](sensitivity-labels-office-apps.md#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.45+ | 2.47+ | 16.0.13628+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) +|[Apply a sensitivity label to files automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | +|[Apply a sensitivity label to files automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | Under review | +|[Support co-authoring and AutoSave](sensitivity-labels-coauthoring.md) for labeled and encrypted documents | Current Channel: 2107+ <br /><br> Monthly Enterprise Channel: 2107+ <br /><br> Semi-Annual Enterprise Channel: 2202+ | 16.51+ | 2.58+ | 16.0.14931+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | +|[PDF support](sensitivity-labels-office-apps.md#pdf-support)| Current Channel: 2208+ <br /><br> Monthly Enterprise Channel: 2209+ <br /><br> Semi-Annual Enterprise Channel: 2302+ | Under review | Under review | Under review | Under review | +|[Sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) and [display label color](sensitivity-labels-office-apps.md#label-colors) | Preview: [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review | Under review | +|[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)| Preview: Rolling out to [Beta Channel](https://office.com/insider) | Under review | Under review | Under review | Under review | ++## Sensitivity label capabilities in Outlook ++The numbers listed are the minimum Office application versions required for each capability. ++> [!NOTE] +> For Windows and the Semi-Annual Enterprise Channel, the minimum supported version numbers might not yet be released. [Learn more](/officeupdates/update-history-microsoft365-apps-by-date#supported-versions) ++|Capability |Outlook for Windows |Outlook for Mac |Outlook on iOS |Outlook on Android |Outlook on the web | +|--|-:|-||-|-| +|[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)| Preview: [Current Channel (Preview)](https://office.com/insider) | Not relevant | Not relevant | Not relevant| Not relevant | +|Manually apply, change, or remove label <br /> - [Files and emails](https://support.microsoft.com/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | +|Manually apply, change, or remove label <br /> - [Calendar items](sensitivity-labels-meetings.md)| Preview: Rolling out to [Beta Channel](https://office.com/insider) | Under review | Under review | Under review | Yes | +|[Multi-language support](create-sensitivity-labels.md#additional-label-settings-with-security--compliance-powershell)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | +|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | +|[Require a justification to change a label](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | +|[Provide help link to a custom help page](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | +|[Mark the content](sensitivity-labels.md#what-sensitivity-labels-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | +|[Dynamic markings with variables](sensitivity-labels-office-apps.md#dynamic-markings-with-variables) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | +|[Assign permissions now](encryption-sensitivity-labels.md#assign-permissions-now) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | +|[Let users assign permissions: <br /> - Do Not Forward](encryption-sensitivity-labels.md#let-users-assign-permissions) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | +|[Let users assign permissions: <br /> - Encrypt-Only](encryption-sensitivity-labels.md#let-users-assign-permissions) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.48+ <sup>\*</sup> | 4.2112.0+ | 4.2112.0+ | Yes | +|[Require users to apply a label to their email and documents](sensitivity-labels-office-apps.md#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes | +|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.51+ <sup>\*</sup> | 4.2126+ | 4.2126+ | Yes | +|[Apply a sensitivity label to emails automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ <sup>\*</sup> | Under review | Under review | Yes | +|[Apply a sensitivity label to emails automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | Yes | +|[Different settings for default label and mandatory labeling](sensitivity-labels-office-apps.md#outlook-specific-options-for-default-label-and-mandatory-labeling) | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes | +|[PDF support](sensitivity-labels-office-apps.md#pdf-support) | Current Channel: 2205+ <br /><br> Monthly Enterprise Channel: 2205+ <br /><br> Semi-Annual Enterprise Channel: Under review| Under review | Under review | Under review | Under review | +|[Apply S/MIME protection](sensitivity-labels-office-apps.md#configure-a-label-to-apply-smime-protection-in-outlook) | Current Channel: 2211+ <br /><br> Monthly Enterprise Channel: 2211+ <br /><br> Semi-Annual Enterprise Channel:Under review | 16.61+ <sup>\*</sup> | 4.2226+ | 4.2203+ | Under review | +|[Sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) and [display label color](sensitivity-labels-office-apps.md#label-colors) | Under review | Under review | Under review | Under review | Under review | +|[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)| Preview: Rolling out to [Beta Channel](https://office.com/insider) | Under review | Under review | Under review | Under review | ++**Footnotes:** ++<sup>\*</sup> +Requires the [new Outlook for Mac](https://support.microsoft.com/office/the-new-outlook-for-mac-6283be54-e74d-434e-babb-b70cefc77439) ++## Future releases ++Use the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap?filters=Microsoft%20Information%20Protection&searchterms=label) for details about new labeling capabilities that are planned for future releases. |
| compliance | Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels.md | To get their work done, people in your organization collaborate with others both Sensitivity labels from Microsoft Purview Information Protection let you classify and protect your organization's data, while making sure that user productivity and their ability to collaborate isn't hindered. -Example showing available sensitivity labels in Excel, from the **Home** tab on the Ribbon. In this example, the applied label displays on the status bar: +The following example from Excel shows some sensitivity labels that have been made available to users. In this case, the **Highly Confidential** label has been applied to the spreadsheet, but users can change the label by using the **Sensitivity** button from the **Home** tab on the Ribbon.  When you configure a label policy, you can: - **Specify a default label** for unlabeled documents, emails and meeting invites, new containers (when you've [enabled sensitivity labels for Microsoft Teams, Microsoft 365 groups, and SharePoint sites](sensitivity-labels-teams-groups-sites.md)), and also a default label for [Power BI content](/power-bi/admin/service-security-sensitivity-label-default-label-policy). You can specify the same label for all five types of items, or different labels. Users can change the applied default sensitivity label to better match the sensitivity of their content or container. > [!NOTE]- > Default labeling for existing documents is newly supported for built-in labeling for Office apps. For more information about the rollout per app and minimum versions, see the [capabilities table](sensitivity-labels-office-apps.md#sensitivity-label-capabilities-in-word-excel-and-powerpoint) for Word, Excel, and PowerPoint. + > Default labeling for existing documents is newly supported for built-in labeling for Office apps. For more information about the rollout per app and minimum versions, see the [capabilities table](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-word-excel-and-powerpoint) for Word, Excel, and PowerPoint. Consider using a default label to set a base level of protection settings that you want applied to all your content. However, without user training and other controls, this setting can also result in inaccurate labeling. It's usually not a good idea to select a label that applies encryption as a default label to documents. For example, many organizations need to send and share documents with external users who might not have apps that support the encryption or they might not use an account that can be authorized. For more information about this scenario, see [Sharing encrypted documents with external users](sensitivity-labels-office-apps.md#sharing-encrypted-documents-with-external-users). |
| compliance | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md | Whether it be adding new solutions to the [Microsoft Purview compliance portal]( [!INCLUDE [purview-preview](../includes/purview-preview.md)] +## January 2023 ++### Sensitivity labels +- **Rolling out in preview**: As a parity feature for the AIP add-in, built-in labeling for Windows supports the configuration of a [default sublabel for a parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label). +- The earliest version for the AIP add-in to be [disabled by default in Office apps](sensitivity-labels-aip.md#how-to-disable-the-aip-add-in-to-use-built-in-labeling-for-office-apps) for the Current Channel and Monthly Enterprise Channel is now version 2302. The minimum version for the Semi-Annual Channel hasn't changed. + ## December 2022 ### Communication compliance |
| enterprise | Azure Expressroute | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/azure-expressroute.md | Title: "Azure ExpressRoute for Microsoft 365" Previously updated : audience: ITPro Implementing ExpressRoute requires the involvement of network and application ow <sup>1</sup> Important performance considerations. Decisions here can dramatically impact latency, which is a critical for applications such as Skype for Business. -For additional references, use our [routing guide](https://support.office.com/article/Routing-with-ExpressRoute-for-Office-365-e1da26c6-2d39-4379-af6f-4da213218408) in addition to the [ExpressRoute documentation](/azure/expressroute/expressroute-introduction). +For additional references, see [What is Azure ExpressRoute?](/azure/expressroute/expressroute-introduction) To purchase ExpressRoute for Microsoft 365, you'll need to work with one or more [approved providers](/azure/expressroute/expressroute-locations) to provision the desired number and size circuits with an ExpressRoute Premium subscription. There are no additional licenses to purchase from Microsoft 365. -Here's a short link you can use to come back: [https://aka.ms/expressrouteoffice365]() +Here's a short link you can use to come back: [https://aka.ms/expressrouteoffice365](https://aka.ms/expressrouteoffice365) Ready to sign up for [ExpressRoute for Microsoft 365](https://aka.ms/ert)? |
| enterprise | Setup Guides For Microsoft 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/setup-guides-for-microsoft-365.md | The setup guides are accessible from the [Setup guidance](https://aka.ms/setupgu 2. Find the **Training & guides** card. -  + :::image type="content" alt-text="This screenshot shows the training & guides card in the Microsoft 365 admin center." source="../media/setup-guides-for-microsoft-365/adminportal-trainingandguides.png"::: 3. Select **Advanced deployment guides** and then select **All guides**. -  + ::image type="content" alt-text="Screenshot of the Setup guidance page in the Microsoft 365 admin center." source="../media/setup-guides-for-microsoft-365/adminportal-setupguidance.png"::: ## Guides for initial setup |
| frontline | Ehr Admin Cerner | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/ehr-admin-cerner.md | appliesto: - Microsoft 365 for frontline workers description: Learn how to integrate the Teams EHR connector to enable healthcare providers in your organization to conduct virtual appointments with patients or other providers in Teams directly from the Cerner EHR system. Previously updated : 01/05/2023 Last updated : 01/11/2023 # Virtual Appointments with Teams - Integration into Cerner EHR Key features of the patient experience - Patients are placed in a lobby until the provider joins and admits them. - Patients can test their video and microphone in the lobby before joining the appointment. +## Troubleshoot Teams EHR connector setup and integration ++If you're experiencing issues when setting up the integration, see [Troubleshoot Teams EHR connector setup and configuration](ehr-connector-troubleshoot-setup-configuration.md) for guidance on how to resolve common setup and configuration issues. + ## Get insight into Virtual Appointments usage The [EHR connector Virtual Appointments report](ehr-connector-report.md) in the Teams admin center gives you an overview of EHR-integrated virtual appointment activity in your organization. You can view a breakdown of data for each appointment that took place for a given date range. The data includes the staff member who conducted the appointment, duration, the number of attendees, department, and whether the appointment was within the allocation limit. |
| frontline | Ehr Admin Epic | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/ehr-admin-epic.md | appliesto: - Microsoft 365 for frontline workers description: Learn how to integrate the Teams EHR connector to enable healthcare providers in your organization to conduct virtual appointments with patients or other providers in Teams directly from the Epic EHR system. Previously updated : 12/15/2022 Last updated : 01/11/2023 # Virtual Appointments with Teams - Integration into Epic EHR Key features of the patient experience: > [!NOTE] > Epic, MyChart, Haiku, and Canto are trademarks of Epic Systems Corporation. +## Troubleshoot Teams EHR connector setup and integration ++If you're experiencing issues when setting up the integration, see [Troubleshoot Teams EHR connector setup and configuration](ehr-connector-troubleshoot-setup-configuration.md) for guidance on how to resolve common setup and configuration issues. + ## Get insight into Virtual Appointments usage The [EHR connector Virtual Appointments report](ehr-connector-report.md) in the Teams admin center gives you an overview of EHR-integrated virtual appointment activity in your organization. You can view a breakdown of data for each appointment that took place for a given date range. The data includes the staff member who conducted the appointment, duration, the number of attendees, department, and whether the appointment was within the allocation limit. |
| frontline | Ehr Connector Troubleshoot Setup Configuration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/ehr-connector-troubleshoot-setup-configuration.md | + + Title: Troubleshoot Microsoft Teams EHR connector setup and configuration ++++audience: ITPro +++search.appverid: MET150 +searchScope: + - Microsoft Teams + - Microsoft Cloud for Healthcare +f1.keywords: +- NOCSH +ms.localizationpriority: high ++ - M365-collaboration + - Teams_ITAdmin_Healthcare + - microsoftcloud-healthcare + - m365solution-healthcare + - m365solution-scenario + - m365-frontline + - highpri + - tier2 +appliesto: + - Microsoft Teams + - Microsoft 365 for frontline workers ++description: Use this guidance to help you troubleshoot common setup and configuration issues for the Teams Electronic Health Record (EHR) connector. Last updated : 01/11/2023+++# Troubleshoot Microsoft Teams EHR connector setup and configuration ++This article provides guidance for how to troubleshoot common setup and configuration issues for the Microsoft Teams Electronic Health Record (EHR) connector. Use it to help resolve blockers that you may experience when you set up and configure the EHR connector to integrate with your [Cerner EHR](ehr-admin-cerner.md) or [Epic EHR](ehr-admin-epic.md) system. ++## FHIR URL isn't working ++### I get an "FHIR URL isn't valid" error when I try to configure the EHR connector ++This issue can happen in the following scenarios: ++- The FHIR base URL is missing the DSTU2 extension and you're using Teams version 1.1 or 1.2. +- The FHIR base URL is missing the R4 extension and you're using Teams version 1.3. ++Contact your Epic technical specialist to provide the full FHIR base URL. ++### I'm an Epic analyst and I get an "OAUTH2" error from Epic when I try to approve the FHIR URL. ++This issue can occur if the keys aren't set up in the Epic instance or if OAuth configuration isn't completed by Epic. Contact your Epic technical specialist. ++### I'm an Epic analyst and when I try to approve the FHIR URL in the EHR connector configuration portal, I can't sign in to Epic using my Epic credentials. ++Your permissions need to be changed in Epic. Contact your Epic technical specialist to check and update your permissions. ++## Can't launch virtual appointments ++### I've set up the EHR connector for the first time and patients are unable to launch a virtual appointment from the patient portal. ++Here are some common reasons why you may be experiencing this issue and how to resolve it. ++#### The FDI records in Epic don't match the values from the EHR connector configuration portal ++The launch URL and the context tokens must be copied from the [EHR connector configuration portal](https://ehrconnector.teams.microsoft.com/) to the FDI records in Epic. Contact the Epic analyst in your organization to verify that the values were copied correctly. Keep in mind that in some cases, manipulating the FDI records after copying them from the EHR connector configuration portal is allowed. ++#### The FDI records aren't updated in the correct Epic environment ++The FHIR base URLs for the test and production environments in Epic are different. Check to make sure that the FDI records reflect the values for the correct environment. ++#### You're using a production environment and you don't have a production license ++Your organization must have at least one active license for either Microsoft Cloud for Healthcare, Microsoft Teams EHR Connector add-on, or Microsoft Teams EMR connector add-on. For Cerner customers, a license is also required for testing. ++### Users get a "Tenant config not found" error when launching a virtual appointment even though all our FHIR base URLs are configured correctly. ++This issue can happen if a user accidentally launches the virtual appointment in the EHR production environment by using the test FHIR base URL or vice versa. ++To resolve this issue: ++- Make sure that the production FHIR base URL is used only to launch virtual appointments in the production environment. +- Make that the test FHIR base URL is used only to launch virtual appointments in the test environment. ++## Group visits ++### Group visits aren't working in my organization. ++Currently, group visits are only supported in Epic. ++Here are some common reasons why you may be experiencing this issue when integrating with Epic, and how to resolve it. ++- You're using an incorrect version of Teams. Group visits require a minimum of Teams version 1.2 and an upgrade must be requested in Epic App Market. +- New FDI records need to be added. Your Epic analyst will need to create new FDI records for group visits to support the provider and patient join experience. Additionally, you must change the context token in the group visit FDI records from ```sessionId=%CSN%``` to ```sessionId=%CONFERENCEID%```. Contact your Epic technical specialist for help. +- If you're still experiencing this issue after trying the previous steps in this list, your tenant settings may need to be changed. Contact Microsoft Support to open a support ticket for the Teams EHR connector. Indicate in the ticket that group settings need to be enabled. ++## Provider experience ++### Providers donΓÇÖt get a Teams notification when patients join a virtual appointment. ++Often this can be solved by training. When a provider starts the virtual appointment, a temporary notification is displayed to the provider to admit the patient. This notification appears only briefly. ++Providers can also select **People** in the meeting controls at the top of the screen to see the list of participants, and then under **Waiting in lobby**, select the green check mark next to the participantΓÇÖs name to admit them. ++## Patient experience ++### Patients are prompted to download the Teams app instead of joining from a web browser. We want patients to join from a web browser without having to install Teams. ++Contact Microsoft Support and open a support ticket for the Teams EHR connector. Indicate in the ticket that the web browser join setting needs to be turned on. This change needs to be done by the Teams EHR connector team. ++After the web browser join setting is turned on, patients can join virtual appointments in a browser without having to install Teams. ++### Patients can send chat messages to providers in Teams after the virtual appointment ends from within the appointment. How can we block this? ++This scenario can happen because of several reasons. ++#### The provider leaves the appointment but didn't end it ++If the provider leaves the appointment but didn't end it and the patient remains in the appointment, they can both continue to chat. To prevent the patient from sending chat messages, the provider must select **End meeting** in Teams to end the appointment. ++#### The web browser join setting is turned off and the patient, who is also an employee of your organization, joins in the Teams app using their work credentials ++If the patient is an employee of your organization and they join the appointment via the Teams app using their work credentials, they're joining the appointment as a member of your organization and not as a guest. This means that they can send chat messages even after the appointment ends. ++To avoid this scenario, you can do one of the following actions: ++- Contact Microsoft Support and open a support ticket for the Teams EHR connector. Indicate in the ticket that the web browser join setting needs to be turned on. This change needs to be done by the Teams EHR connector team. +- Train your employees to not sign in to Teams using their work credentials when they attend appointments as a patient. ++## Admin experience ++### I'm unable to access the EHR connector configuration portal or I can only see existing configurations and can't add new ones. ++You don't have admin access to the [EHR connector configuration portal](https://ehrconnector.teams.microsoft.com/). As a quick check, see whether you can access the [Teams admin center](https://admin.teams.microsoft.com/). If you can't access the Teams admin center, you don't have admin permissions. ++Contact an admin in your organization to either grant you admin access or set up the integration in the portal. ++## Virtual Desktop Infrastructure (VDI) support ++### My organization uses a Citrix environment. How do I configure it to use the EHR connector? ++You can configure a Citrix environment to route certain URLs back to the local machine and not launch in the virtual machine. For example, to launch virtual appointments in Teams, configure all traffic for ΓÇ£*.teams.microsoft.comΓÇ¥ to the local machine. ++To learn more, see the following Citrix documentation: ++- [Optimization for Microsoft Teams](https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/multimedia/opt-ms-teams.html) +- [Browser content redirection](https://docs.citrix.com//en-us/citrix-virtual-apps-desktops/multimedia/browser-content-redirection.html) ++## Related articles ++- [Virtual Appointments with Teams - Integration into Cerner EHR](ehr-admin-cerner.md) +- [Virtual Appointments with Teams - Integration into Epic EHR](ehr-admin-epic.md) +- [EHR connector Virtual Appointments report](ehr-connector-report.md) +- [Get started with Microsoft 365 for healthcare organizations](teams-in-hc.md) |
| includes | Microsoft 365 Content Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-365-content-updates.md | +## Week of January 09, 2023 +++| Published On |Topic title | Change | +|||--| +| 1/9/2023 | [Upgrade distribution lists to Microsoft 365 Groups in Exchange Online](/microsoft-365/admin/manage/upgrade-distribution-lists?view=o365-worldwide) | modified | +| 1/9/2023 | [Create and manage insider risk management policies](/microsoft-365/compliance/insider-risk-management-policies?view=o365-worldwide) | modified | +| 1/9/2023 | [Deploy Microsoft Defender for Endpoint on Linux manually](/microsoft-365/security/defender-endpoint/linux-install-manually?view=o365-worldwide) | modified | +| 1/9/2023 | [Assess personal data and privacy risks ΓÇô Microsoft Priva and Purview](/microsoft-365/solutions/data-privacy-protection-assess?view=o365-worldwide) | added | +| 1/9/2023 | [Protect and govern personal data ΓÇô Microsoft Priva and Purview](/microsoft-365/solutions/data-privacy-protection-protect-govern?view=o365-worldwide) | added | +| 1/9/2023 | [Stay on track with data privacy regulations ΓÇô Microsoft Priva and Purview](/microsoft-365/solutions/data-privacy-protection-regulations?view=o365-worldwide) | added | +| 1/9/2023 | [Respond to privacy incidents and subject requests ΓÇô Microsoft Priva and Purview](/microsoft-365/solutions/data-privacy-protection-respond-requests?view=o365-worldwide) | added | +| 1/9/2023 | [Manage data privacy and protection ΓÇô Microsoft Priva and Purview](/microsoft-365/solutions/data-privacy-protection?view=o365-worldwide) | added | +| 1/9/2023 | [What's new in Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-whatsnew?view=o365-worldwide) | modified | +| 1/9/2023 | Assess data privacy risks and identify sensitive items with Microsoft 365 | removed | +| 1/9/2023 | Use Compliance Manager to manage improvement actions | removed | +| 1/9/2023 | Govern information subject to data privacy regulation | removed | +| 1/9/2023 | Use identity, device, and threat protection for data privacy regulation | removed | +| 1/9/2023 | Monitor and respond to data privacy incidents in your organization | removed | +| 1/9/2023 | Protect information subject to data privacy regulation | removed | +| 1/9/2023 | Deploy information protection for data privacy regulations with Microsoft 365 | removed | +| 1/9/2023 | [Configure SMS text notifications and reminders in Microsoft Bookings](/microsoft-365/bookings/bookings-sms?view=o365-worldwide) | modified | +| 1/9/2023 | [Buy a domain name](/microsoft-365/admin/get-help-with-domains/buy-a-domain-name?view=o365-worldwide) | modified | +| 1/10/2023 | [Deploy and manage using group policy](/microsoft-365/security/defender-endpoint/deploy-and-manage-using-group-policy?view=o365-worldwide) | added | +| 1/10/2023 | [Deploy and manage using Intune](/microsoft-365/security/defender-endpoint/deploy-and-manage-using-intune?view=o365-worldwide) | added | +| 1/10/2023 | [Printer Protection frequently asked questions](/microsoft-365/security/defender-endpoint/printer-protection-frequently-asked-questions?view=o365-worldwide) | added | +| 1/10/2023 | [Printer Protection Overview](/microsoft-365/security/defender-endpoint/printer-protection-overview?view=o365-worldwide) | added | +| 1/10/2023 | [Switch to Microsoft Defender for Endpoint - Setup](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2?view=o365-worldwide) | modified | +| 1/10/2023 | [What's new in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint?view=o365-worldwide) | modified | +| 1/10/2023 | [Get started with the Microsoft Purview Data Loss Prevention migration assistant for Symantec](/microsoft-365/compliance/dlp-migration-assistant-for-symantec-get-started?view=o365-worldwide) | added | +| 1/10/2023 | [Learn about the Microsoft Purview Data Loss Prevention migration assistant for Symantec](/microsoft-365/compliance/dlp-migration-assistant-for-symantec-learn?view=o365-worldwide) | added | +| 1/10/2023 | [Use the Microsoft Purview Data Loss Prevention migration assistant for Symantec](/microsoft-365/compliance/dlp-migration-assistant-for-symantec-use?view=o365-worldwide) | added | +| 1/10/2023 | [Learn about insider risk management policy templates](/microsoft-365/compliance/insider-risk-management-policy-templates?view=o365-worldwide) | added | +| 1/10/2023 | [Create and manage insider risk management policies](/microsoft-365/compliance/insider-risk-management-policies?view=o365-worldwide) | modified | +| 1/10/2023 | [Learn about insider risk management](/microsoft-365/compliance/insider-risk-management?view=o365-worldwide) | modified | +| 1/10/2023 | [Migrate to Microsoft Defender for Endpoint - Prepare](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-1?view=o365-worldwide) | modified | +| 1/10/2023 | [Migrate to Microsoft Defender for Endpoint - Setup](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2?view=o365-worldwide) | modified | +| 1/10/2023 | [Migrate to Microsoft Defender for Endpoint - Onboard](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-3?view=o365-worldwide) | modified | +| 1/10/2023 | [Frequently asked questions on tamper protection](/microsoft-365/security/defender-endpoint/faqs-tamper-protection?view=o365-worldwide) | modified | +| 1/10/2023 | [Troubleshooting issues when switching to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/switch-to-mde-troubleshooting?view=o365-worldwide) | modified | +| 1/10/2023 | [User reported message settings](/microsoft-365/security/office-365-security/submissions-user-reported-messages-files-custom-mailbox?view=o365-worldwide) | modified | +| 1/11/2023 | [What happens to my data and access when my subscription ends?](/microsoft-365/commerce/subscriptions/what-if-my-subscription-expires?view=o365-worldwide) | modified | +| 1/11/2023 | [Enable attack surface reduction rules](/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide) | modified | +| 1/11/2023 | [What's new in Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-whatsnew?view=o365-worldwide) | modified | +| 1/11/2023 | [Performance analyzer for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/tune-performance-defender-antivirus?view=o365-worldwide) | modified | +| 1/11/2023 | [What's new in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint?view=o365-worldwide) | modified | +| 1/11/2023 | [What's new in Microsoft Defender for Endpoint on Windows](/microsoft-365/security/defender-endpoint/windows-whatsnew?view=o365-worldwide) | modified | +| 1/11/2023 | [Exposure score in Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/tvm-exposure-score?view=o365-worldwide) | modified | +| 1/11/2023 | [Security recommendations](/microsoft-365/security/defender-vulnerability-management/tvm-security-recommendation?view=o365-worldwide) | modified | +| 1/11/2023 | [Get started with the Microsoft Purview Firefox Extension](/microsoft-365/compliance/dlp-firefox-extension-get-started?view=o365-worldwide) | added | +| 1/11/2023 | [Learn about the Microsoft Purview Firefox Extension](/microsoft-365/compliance/dlp-firefox-extension-learn?view=o365-worldwide) | added | +| 1/11/2023 | [Get started with the Microsoft Purview Chrome Extension](/microsoft-365/compliance/dlp-chrome-get-started?view=o365-worldwide) | modified | +| 1/11/2023 | [Learn about the Microsoft Purview Chrome Extension](/microsoft-365/compliance/dlp-chrome-learn-about?view=o365-worldwide) | modified | +| 1/11/2023 | [Get started with the Microsoft Purview Data Loss Prevention migration assistant for Symantec](/microsoft-365/compliance/dlp-migration-assistant-for-symantec-get-started?view=o365-worldwide) | modified | +| 1/11/2023 | [Identify the available PowerShell cmdlets for retention](/microsoft-365/compliance/retention-cmdlets?view=o365-worldwide) | modified | +| 1/11/2023 | [Use attack surface reduction rules to prevent malware infection](/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-worldwide) | modified | +| 1/11/2023 | [Report spam, non-spam, phishing, suspicious emails and files to Microsoft](/microsoft-365/security/office-365-security/submissions-report-messages-files-to-microsoft?view=o365-worldwide) | modified | +| 1/11/2023 | [Build and manage assessments in Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-assessments?view=o365-worldwide) | modified | +| 1/11/2023 | [Get started with Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-setup?view=o365-worldwide) | modified | +| 1/12/2023 | [Troubleshoot Microsoft Teams EHR connector setup and configuration](/microsoft-365/frontline/ehr-connector-troubleshoot-setup-configuration?view=o365-worldwide) | added | +| 1/12/2023 | Redirection of users from the Office 365 Security and Compliance Center to the Microsoft Purview compliance portal | removed | +| 1/12/2023 | [Frequently asked questions on tamper protection](/microsoft-365/security/defender-endpoint/faqs-tamper-protection?view=o365-worldwide) | modified | +| 1/12/2023 | [Protect security settings with tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide) | modified | +| 1/12/2023 | [Add, update or delete a scan definition](/microsoft-365/security/defender-endpoint/add-a-new-scan-definition?view=o365-worldwide) | modified | +| 1/12/2023 | [Deploy and manage using group policy](/microsoft-365/security/defender-endpoint/deploy-and-manage-using-group-policy?view=o365-worldwide) | modified | +| 1/12/2023 | [Deploy and manage using Intune](/microsoft-365/security/defender-endpoint/deploy-and-manage-using-intune?view=o365-worldwide) | modified | +| 1/12/2023 | [Deploy and manage Removable Storage Access Control using Intune](/microsoft-365/security/defender-endpoint/deploy-manage-removable-storage-intune?view=o365-worldwide) | modified | +| 1/12/2023 | [Get scan definitions](/microsoft-365/security/defender-endpoint/get-all-scan-definitions?view=o365-worldwide) | modified | +| 1/12/2023 | [Printer Protection Overview](/microsoft-365/security/defender-endpoint/printer-protection-overview?view=o365-worldwide) | modified | +| 1/12/2023 | [Migrate to Microsoft Defender for Endpoint - Onboard](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-3?view=o365-worldwide) | modified | +| 1/12/2023 | [Troubleshooting issues when moving to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/switch-to-mde-troubleshooting?view=o365-worldwide) | modified | +| 1/12/2023 | [What's new in Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-whats-new?view=o365-worldwide) | modified | +| 1/12/2023 | [Review and remove unnecessary allow list entries with Advanced Hunting in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/review-allow-entries?view=o365-worldwide) | added | +| 1/13/2023 | [Trainable classifiers definitions](/microsoft-365/compliance/classifier-tc-definitions?view=o365-worldwide) | modified | +| 1/13/2023 | [What's new in Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-whats-new?view=o365-worldwide) | modified | +| 1/13/2023 | [Get started with the Microsoft Purview Chrome Extension](/microsoft-365/compliance/dlp-chrome-get-started?view=o365-worldwide) | modified | ++ ## Week of January 02, 2023 | 12/16/2022 | [How to use the Microsoft Defender Experts for XDR preview service](/microsoft-365/security/defender/start-using-mdex-xdr?view=o365-worldwide) | modified | | 12/16/2022 | [What's new in Microsoft Purview risk and compliance solutions](/microsoft-365/compliance/whats-new?view=o365-worldwide) | modified | | 12/16/2022 | [Get Microsoft Defender for Business](/microsoft-365/security/defender-business/get-defender-business?view=o365-worldwide) | modified |---## Week of December 05, 2022 ---| Published On |Topic title | Change | -|||--| -| 12/5/2022 | [Plan for data loss prevention](/microsoft-365/compliance/dlp-overview-plan-for-dlp?view=o365-worldwide) | modified | -| 12/5/2022 | [Design a Data loss prevention policy](/microsoft-365/compliance/dlp-policy-design?view=o365-worldwide) | modified | -| 12/5/2022 | [Data Loss Prevention policy reference](/microsoft-365/compliance/dlp-policy-reference?view=o365-worldwide) | modified | -| 12/5/2022 | [Apply encryption using sensitivity labels](/microsoft-365/compliance/encryption-sensitivity-labels?view=o365-worldwide) | modified | -| 12/5/2022 | [Use sensitivity labels to protect calendar items, Teams meetings, and chat](/microsoft-365/compliance/sensitivity-labels-meetings?view=o365-worldwide) | added | -| 12/5/2022 | [Manage sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide) | modified | -| 12/5/2022 | [Learn about sensitivity labels](/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) | modified | -| 12/5/2022 | [Microsoft Teams Advanced Virtual Appointments activity report](/microsoft-365/frontline/advanced-virtual-appointments-activity-report?view=o365-worldwide) | added | -| 12/5/2022 | [Virtual Appointments with Microsoft Teams and the Bookings app](/microsoft-365/frontline/bookings-virtual-appointments?view=o365-worldwide) | added | -| 12/5/2022 | [Manage the join experience for Teams Virtual Appointments on browsers](/microsoft-365/frontline/browser-join?view=o365-worldwide) | modified | -| 12/5/2022 | [Virtual Appointments with Teams - Integration into Cerner EHR](/microsoft-365/frontline/ehr-admin-cerner?view=o365-worldwide) | modified | -| 12/5/2022 | [Virtual Appointments with Teams - Integration into Epic EHR](/microsoft-365/frontline/ehr-admin-epic?view=o365-worldwide) | modified | -| 12/5/2022 | [Microsoft Teams EHR connector Virtual Appointments report](/microsoft-365/frontline/ehr-connector-report?view=o365-worldwide) | modified | -| 12/5/2022 | [Choose your scenarios for Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-choose-scenarios?view=o365-worldwide) | modified | -| 12/5/2022 | [Set up Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-setup-microsoft-365?view=o365-worldwide) | modified | -| 12/5/2022 | [Microsoft 365 for retail organizations](/microsoft-365/frontline/teams-for-retail-landing-page?view=o365-worldwide) | modified | -| 12/5/2022 | [Get started with Microsoft 365 for healthcare organizations](/microsoft-365/frontline/teams-in-hc?view=o365-worldwide) | modified | -| 12/5/2022 | [Help your clients and customers use virtual appointments scheduled with the Bookings app in Teams](/microsoft-365/frontline/virtual-appointments-toolkit?view=o365-worldwide) | modified | -| 12/5/2022 | [Microsoft Teams Virtual Appointments usage report](/microsoft-365/frontline/virtual-appointments-usage-report?view=o365-worldwide) | added | -| 12/5/2022 | [Virtual Appointments with Microsoft Teams](/microsoft-365/frontline/virtual-appointments?view=o365-worldwide) | modified | -| 12/5/2022 | [Activate Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/activate-defender-rbac?view=o365-worldwide) | added | -| 12/5/2022 | [Map Microsoft 365 Defender role-based access control (RBAC) permissions](/microsoft-365/security/defender/compare-rbac-roles?view=o365-worldwide) | added | -| 12/5/2022 | [Create custom roles with Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/create-custom-rbac-roles?view=o365-worldwide) | added | -| 12/5/2022 | [Details of custom permissions in Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/custom-permissions-details?view=o365-worldwide) | added | -| 12/5/2022 | [Custom roles for role-based access control](/microsoft-365/security/defender/custom-roles?view=o365-worldwide) | modified | -| 12/5/2022 | [Edit or delete roles Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/edit-delete-rbac-roles?view=o365-worldwide) | added | -| 12/5/2022 | [Import roles to Microsoft 365 Defender RBAC](/microsoft-365/security/defender/import-rbac-roles?view=o365-worldwide) | added | -| 12/5/2022 | [Manage access to Microsoft 365 Defender data in the Microsoft 365 Defender portal](/microsoft-365/security/defender/m365d-permissions?view=o365-worldwide) | modified | -| 12/5/2022 | [Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/manage-rbac?view=o365-worldwide) | added | -| 12/5/2022 | [View email security reports](/microsoft-365/security/office-365-security/reports-email-security?view=o365-worldwide) | renamed | -| 12/5/2022 | [Test your application with in-place upgrade](/microsoft-365/test-base/test-application-with-in-place-upgrade?view=o365-worldwide) | added | -| 12/5/2022 | [Communication compliance](/microsoft-365/compliance/communication-compliance-solution-overview?view=o365-worldwide) | modified | -| 12/5/2022 | [Assessing Microsoft 365 network connectivity](/microsoft-365/enterprise/assessing-network-connectivity?view=o365-worldwide) | modified | -| 12/5/2022 | [Azure ExpressRoute for Microsoft 365](/microsoft-365/enterprise/azure-expressroute?view=o365-worldwide) | modified | -| 12/5/2022 | [Connect an on-premises network to a Microsoft Azure virtual network](/microsoft-365/enterprise/connect-an-on-premises-network-to-a-microsoft-azure-virtual-network?view=o365-worldwide) | modified | -| 12/5/2022 | [Content delivery networks](/microsoft-365/enterprise/content-delivery-networks?view=o365-worldwide) | modified | -| 12/5/2022 | [Implementing ExpressRoute for Microsoft 365](/microsoft-365/enterprise/implementing-expressroute?view=o365-worldwide) | modified | -| 12/5/2022 | [Managing Microsoft 365 endpoints](/microsoft-365/enterprise/managing-office-365-endpoints?view=o365-worldwide) | modified | -| 12/5/2022 | [Office 365 IP Address and URL web service](/microsoft-365/enterprise/microsoft-365-ip-web-service?view=o365-worldwide) | modified | -| 12/5/2022 | [Set up your network for Microsoft 365](/microsoft-365/enterprise/set-up-network-for-microsoft-365?view=o365-worldwide) | modified | -| 12/5/2022 | [Tune Skype for Business Online performance](/microsoft-365/enterprise/tune-skype-for-business-online-performance?view=o365-worldwide) | modified | -| 12/5/2022 | [What's new in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/defender-for-office-365-whats-new?view=o365-worldwide) | modified | -| 12/5/2022 | [Protect against threats in Microsoft Defender for Office 365, Anti-malware, Anti-Phishing, Anti-spam, Safe links, Safe attachments, Zero-hour auto purge (ZAP), MDO security configuration](/microsoft-365/security/office-365-security/protect-against-threats?view=o365-worldwide) | modified | -| 12/5/2022 | [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-worldwide) | modified | -| 12/5/2022 | [Complete Safe Links overview for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/safe-links-about?view=o365-worldwide) | renamed | -| 12/5/2022 | [Enable the Report Message or the Report Phishing add-ins](/microsoft-365/security/office-365-security/submissions-users-report-message-add-in-configure?view=o365-worldwide) | renamed | -| 12/5/2022 | [Manage spoofed senders using the spoof intelligence policy and spoof intelligence insight](/microsoft-365/security/office-365-security/walkthrough-spoof-intelligence-insight?view=o365-worldwide) | modified | -| 12/5/2022 | [OneDrive Cross-tenant OneDrive migration FAQs](/microsoft-365/enterprise/cross-tenant-onedrive-migration-faqs?view=o365-worldwide) | modified | -| 12/5/2022 | [Assign Microsoft 365 licenses to user accounts with PowerShell](/microsoft-365/enterprise/assign-licenses-to-user-accounts-with-microsoft-365-powershell?view=o365-worldwide) | modified | -| 12/5/2022 | [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-worldwide) | modified | -| 12/5/2022 | [View email security reports](/microsoft-365/security/office-365-security/reports-email-security?view=o365-worldwide) | modified | -| 12/5/2022 | [Audit log activities](/microsoft-365/compliance/audit-log-activities?view=o365-worldwide) | renamed | -| 12/5/2022 | [Turn auditing on or off](/microsoft-365/compliance/audit-log-enable-disable?view=o365-worldwide) | renamed | -| 12/5/2022 | [Export, configure, and view audit log records](/microsoft-365/compliance/audit-log-export-records?view=o365-worldwide) | renamed | -| 12/5/2022 | [Use Audit (Premium) to investigate compromised accounts](/microsoft-365/compliance/audit-log-investigate-accounts?view=o365-worldwide) | renamed | -| 12/5/2022 | [Manage audit log retention policies](/microsoft-365/compliance/audit-log-retention-policies?view=o365-worldwide) | modified | -| 12/5/2022 | [Search the audit log in the Microsoft Purview compliance portal](/microsoft-365/compliance/audit-log-search?view=o365-worldwide) | added | -| 12/5/2022 | [Use sharing auditing in the audit log](/microsoft-365/compliance/audit-log-sharing?view=o365-worldwide) | renamed | -| 12/5/2022 | [Manage mailbox auditing](/microsoft-365/compliance/audit-mailboxes?view=o365-worldwide) | renamed | -| 12/5/2022 | [Set up Audit (Premium) in Microsoft 365](/microsoft-365/compliance/audit-premium-setup?view=o365-worldwide) | renamed | -| 12/5/2022 | [Microsoft Purview Audit (Premium)](/microsoft-365/compliance/audit-premium?view=o365-worldwide) | renamed | -| 12/5/2022 | [Microsoft Purview auditing solutions](/microsoft-365/compliance/audit-solutions-overview?view=o365-worldwide) | renamed | -| 12/5/2022 | [Set up Audit (Standard) in Microsoft 365](/microsoft-365/compliance/audit-standard-setup?view=o365-worldwide) | renamed | -| 12/5/2022 | [Search the audit log to troubleshoot common scenarios](/microsoft-365/compliance/audit-troubleshooting-scenarios?view=o365-worldwide) | renamed | -| 12/5/2022 | [Microsoft Purview solutions trial user guide](/microsoft-365/compliance/compliance-easy-trials-compliance-playbook?view=o365-worldwide) | modified | -| 12/5/2022 | [Customer Lockbox requests](/microsoft-365/compliance/customer-lockbox-requests?view=o365-worldwide) | modified | -| 12/6/2022 | [Advanced deployment guidance for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/comprehensive-guidance-on-linux-deployment?view=o365-worldwide) | added | -| 12/6/2022 | [Microsoft Defender for Endpoint device timeline](/microsoft-365/security/defender-endpoint/device-timeline-event-flag?view=o365-worldwide) | modified | -| 12/6/2022 | [Export information gathering assessment](/microsoft-365/security/defender-endpoint/get-assessment-information-gathering?view=o365-worldwide) | added | -| 12/6/2022 | [Deploy Microsoft Defender for Endpoint on Linux manually](/microsoft-365/security/defender-endpoint/linux-install-manually?view=o365-worldwide) | modified | -| 12/6/2022 | [What's new in Microsoft Purview risk and compliance solutions](/microsoft-365/compliance/whats-new?view=o365-worldwide) | modified | -| 12/6/2022 | [Start with a pilot deployment of Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-pilot?view=o365-worldwide) | modified | -| 12/6/2022 | [Protect security settings with tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide) | modified | -| 12/6/2022 | [Search for and delete chat messages in Teams](/microsoft-365/compliance/search-and-delete-teams-chat-messages?view=o365-worldwide) | modified | -| 12/6/2022 | [Admin review for reported messages](/microsoft-365/security/office-365-security/admin-review-reported-message?view=o365-worldwide) | modified | -| 12/6/2022 | [Security Operations Guide for Defender for Office 365](/microsoft-365/security/office-365-security/mdo-sec-ops-guide?view=o365-worldwide) | modified | -| 12/6/2022 | [Migrate to Microsoft Defender for Office 365 Phase 3: Onboard](/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365-onboard?view=o365-worldwide) | modified | -| 12/6/2022 | [Migrate to Microsoft Defender for Office 365 Phase 2: Setup](/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365-setup?view=o365-worldwide) | modified | -| 12/6/2022 | [(False Negatives) How to handle malicious emails that are delivered to recipients using Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-negatives-in-microsoft-defender-for-office-365?view=o365-worldwide) | modified | -| 12/6/2022 | [(False Positives) How to handle legitimate emails getting blocked from delivery using Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-positives-in-microsoft-defender-for-office-365?view=o365-worldwide) | modified | -| 12/6/2022 | [Manage submissions](/microsoft-365/security/office-365-security/submissions-admin?view=o365-worldwide) | modified | -| 12/6/2022 | [Report false positives and false negatives in Outlook](/microsoft-365/security/office-365-security/submissions-outlook-report-messages?view=o365-worldwide) | modified | -| 12/6/2022 | [User reported message settings](/microsoft-365/security/office-365-security/submissions-user-reported-messages-files-custom-mailbox?view=o365-worldwide) | modified | -| 12/6/2022 | [Enable the Report Message or the Report Phishing add-ins](/microsoft-365/security/office-365-security/submissions-users-report-message-add-in-configure?view=o365-worldwide) | modified | -| 12/6/2022 | [Get Microsoft Defender for Business servers](/microsoft-365/security/defender-business/get-defender-business-servers?view=o365-worldwide) | modified | -| 12/6/2022 | [Preset security policies](/microsoft-365/security/office-365-security/preset-security-policies?view=o365-worldwide) | modified | -| 12/6/2022 | [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-worldwide) | modified | -| 12/6/2022 | [View email security reports](/microsoft-365/security/office-365-security/reports-email-security?view=o365-worldwide) | modified | -| 12/6/2022 | [Report spam, non-spam, phishing, suspicious emails and files to Microsoft](/microsoft-365/security/office-365-security/submissions-report-messages-files-to-microsoft?view=o365-worldwide) | modified | -| 12/6/2022 | [Allow or block email using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure?view=o365-worldwide) | modified | -| 12/6/2022 | [OneDrive Cross-tenant OneDrive migration Step 5](/microsoft-365/enterprise/cross-tenant-onedrive-migration-step5?view=o365-worldwide) | modified | -| 12/6/2022 | [Order and precedence of email protection](/microsoft-365/security/office-365-security/how-policies-and-protections-are-combined?view=o365-worldwide) | modified | -| 12/6/2022 | [Quarantine policies](/microsoft-365/security/office-365-security/quarantine-policies?view=o365-worldwide) | modified | -| 12/7/2022 | [Microsoft 365 Multi-Tenant Organization People Search](/microsoft-365/enterprise/multi-tenant-people-search?view=o365-worldwide) | added | -| 12/7/2022 | [Test attack surface reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-test?view=o365-worldwide) | modified | -| 12/7/2022 | [Attack surface reduction (ASR) rules reporting](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-report?view=o365-worldwide) | modified | -| 12/7/2022 | [Microsoft Purview auditing solutions](/microsoft-365/compliance/audit-solutions-overview?view=o365-worldwide) | modified | -| 12/7/2022 | [Anti-phishing policies](/microsoft-365/security/office-365-security/anti-phishing-policies-about?view=o365-worldwide) | modified | -| 12/7/2022 | [Anti-spoofing protection](/microsoft-365/security/office-365-security/anti-phishing-protection-spoofing-about?view=o365-worldwide) | modified | -| 12/7/2022 | [Insights and reports Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-insights?view=o365-worldwide) | modified | -| 12/7/2022 | [How Sender Policy Framework (SPF) prevents spoofing](/microsoft-365/security/office-365-security/email-authentication-anti-spoofing?view=o365-worldwide) | modified | -| 12/7/2022 | [Allow or block email using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure?view=o365-worldwide) | modified | -| 12/7/2022 | [Get and provision Microsoft Defender for Business](/microsoft-365/security/defender-business/get-defender-business?view=o365-worldwide) | modified | -| 12/7/2022 | [Assign security roles and permissions in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-roles-permissions?view=o365-worldwide) | modified | -| 12/7/2022 | [Set up and configure Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-setup-configuration?view=o365-worldwide) | modified | -| 12/7/2022 | [Microsoft Defender for Endpoint - Mobile Threat Defense](/microsoft-365/security/defender-endpoint/mtd?view=o365-worldwide) | modified | -| 12/7/2022 | [How to use DKIM for email in your custom domain](/microsoft-365/security/office-365-security/email-authentication-dkim-configure?view=o365-worldwide) | modified | -| 12/7/2022 | [View email security reports](/microsoft-365/security/office-365-security/reports-email-security?view=o365-worldwide) | modified | -| 12/7/2022 | [Set up Safe Links policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/safe-links-policies-configure?view=o365-worldwide) | modified | -| 12/7/2022 | [Configure global settings for Safe Links settings in Defender for Office 365](/microsoft-365/security/office-365-security/safe-links-policies-global-settings-configure?view=o365-worldwide) | modified | -| 12/8/2022 | [Microsoft Secure score data storage and privacy](/microsoft-365/security/defender/secure-score-data-storage-privacy?view=o365-worldwide) | added | -| 12/8/2022 | [Microsoft Purview auditing solutions](/microsoft-365/compliance/audit-solutions-overview?view=o365-worldwide) | modified | -| 12/8/2022 | [Track your Microsoft Secure Score history and meet goals](/microsoft-365/security/defender/microsoft-secure-score-history-metrics-trends?view=o365-worldwide) | modified | -| 12/8/2022 | [Assess your security posture through Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score-improvement-actions?view=o365-worldwide) | modified | -| 12/8/2022 | [Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score?view=o365-worldwide) | modified | -| 12/8/2022 | [Set up and configure Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-setup-configuration?view=o365-worldwide) | modified | -| 12/8/2022 | [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-worldwide) | modified | -| 12/8/2022 | [Security Operations Guide for Defender for Office 365](/microsoft-365/security/office-365-security/mdo-sec-ops-guide?view=o365-worldwide) | modified | -| 12/8/2022 | [View Defender for Office 365 reports](/microsoft-365/security/office-365-security/reports-defender-for-office-365?view=o365-worldwide) | modified | -| 12/8/2022 | [View email security reports](/microsoft-365/security/office-365-security/reports-email-security?view=o365-worldwide) | modified | -| 12/8/2022 | [Manage submissions](/microsoft-365/security/office-365-security/submissions-admin?view=o365-worldwide) | modified | -| 12/8/2022 | [Try and evaluate Defender for Office 365](/microsoft-365/security/office-365-security/try-microsoft-defender-for-office-365?view=o365-worldwide) | modified | -| 12/9/2022 | [Test and deploy Microsoft 365 Apps by partners in the Integrated apps portal](/microsoft-365/admin/manage/test-and-deploy-microsoft-365-apps?view=o365-worldwide) | modified | -| 12/9/2022 | [Bookings with me](/microsoft-365/bookings/bookings-in-outlook?view=o365-worldwide) | modified | -| 12/9/2022 | [Pay for your Microsoft business subscription with a billing profile](/microsoft-365/commerce/billing-and-payments/pay-for-subscription-billing-profile?view=o365-worldwide) | modified | -| 12/9/2022 | [Payment options for your Microsoft business subscription](/microsoft-365/commerce/billing-and-payments/pay-for-your-subscription?view=o365-worldwide) | modified | -| 12/9/2022 | [Test attack surface reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-test?view=o365-worldwide) | modified | -| 12/9/2022 | [Attack surface reduction rules reference](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide) | modified | -| 12/9/2022 | [Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/defender-for-office-365?view=o365-worldwide) | modified | -| 12/9/2022 | [Security Operations Guide for Defender for Office 365](/microsoft-365/security/office-365-security/mdo-sec-ops-guide?view=o365-worldwide) | modified | -| 12/9/2022 | [Delete an inactive mailbox](/microsoft-365/compliance/delete-an-inactive-mailbox?view=o365-worldwide) | modified | -| 12/9/2022 | [Configure Microsoft Defender for Endpoint on iOS features](/microsoft-365/security/defender-endpoint/ios-configure-features?view=o365-worldwide) | modified | |
| security | Add A New Scan Definition | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/add-a-new-scan-definition.md | POST https://api.securitycenter.microsoft.com/api/DeviceAuthenticatedScanDefinit ```json {-"scanType": "Windows", -"scanName": "Test Windows scan", -"isActive": true, -"target": "127.0.0.1", +"scanType": "Windows", +"scanName": "Test Windows scan", +"isActive": true, +"target": "127.0.0.1", "intervalInHours": 1, "targetType": "Ip", "scannerAgent": { "machineId": "eb663a27ae9d032f61bc268a79eedf14c4b90f77", "machineName": "DESKTOP-TEST", "scanAuthenticationParams": { -    "@odata.type": "#microsoft.windowsDefenderATP.api.WindowsAuthParams", - "type": "Kerberos", -  "username": "username", - "domain": "password", + "@odata.type": "#microsoft.windowsDefenderATP.api.WindowsAuthParams", + "type": "Kerberos", + "username": "username", + "domain": "password", "isGmsaUser": true }, }, }, {-"scanType": "Network", -"scanName": "Test Network scan", -"isActive": true, -"target": "127.0.0.1", +"scanType": "Network", +"scanName": "Test Network scan", +"isActive": true, +"target": "127.0.0.1", "intervalInHours": 1, "targetType": "Ip", "scannerAgent": { "machineId": "eb663a27678ik2f61bc268a79eeasdf450f77", "machineName": "DESKTOP-TEST", "scanAuthenticationParams": {- "@odata.type": "#microsoft.windowsDefenderATP.api.SnmpAuthParams", - "type": "AuthPriv", -        "username": "username", -        "authProtocol": "authProtocol", -        "authPassword": "authPassword", -        "privProtocol": "privProtocol", -        "privPassword": "privPassword", -        "communityString": "community-string" + "@odata.type": "#microsoft.windowsDefenderATP.api.SnmpAuthParams", + "type": "AuthPriv", + "username": "username", + "authProtocol": "authProtocol", + "authPassword": "authPassword", + "privProtocol": "privProtocol", + "privPassword": "privPassword", + "communityString": "community-string" }, }, } PATCH https://api.securitycenter.microsoft.com/api/DeviceAuthenticatedScanDefini ```json {-"scanName": "Test Network scan", +"scanName": "Test Network scan", "intervalInHours": 8, "isActive": "True", "targetType": "Ip", "target": "10.5.0.8", "scanAuthenticationParams": { "@odata.type": "#microsoft.windowsDefenderATP.api.SnmpAuthParams", - "type": "Kerberos", -  "username": "username", - "domain": "password", + "type": "Kerberos", + "username": "username", + "domain": "password", "isGmsaUser": true } } |
| security | Attack Surface Reduction Rules Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference.md | Following is a list of ASR rules that honor Microsoft Defender Antivirus exclusi | [Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | > [!NOTE]-> See: [Configure ASR rules per-rule exclusions](attack-surface-reduction-rules-deployment-test.md#configure-asr-rules-per-rule-exclusions) for information about configuring ASR rules per-rule exclusions. +> For information about configuring per-rule exclusions, see the section titled **Configure ASR rules per-rule exclusions** in the topic [Test attack surface reduction (ASR) rules](attack-surface-reduction-rules-deployment-test.md). ## ASR rules supported operating systems |
| security | Attack Surface Reduction | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction.md | See [Requirements](enable-attack-surface-reduction.md#requirements) in the "Enab ## Audit mode for evaluation -Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would affect your organization if enabled. Run all rules in audit mode first so you can understand how they affect your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they might perform tasks in ways that seem similar to malware. By monitoring audit data and [adding exclusions](enable-attack-surface-reduction.md#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without reducing productivity. +### Audit mode ++Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would affect your organization if enabled. Run all rules in audit mode first so you can understand how they affect your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they might perform tasks in ways that seem similar to malware. ++### Exclusions ++By monitoring audit data and [adding exclusions](attack-surface-reduction-rules-deployment-test.md) for necessary applications, you can deploy attack surface reduction rules without reducing productivity. ++### Per-rule exclusions ++For information about configuring per-rule exclusions, see the section titled **Configure ASR rules per-rule exclusions** in the topic [Test attack surface reduction (ASR) rules](attack-surface-reduction-rules-deployment-test.md). ## Warn mode for users |
| security | Built In Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/built-in-protection.md | Built-in protection is a set of default settings that are rolling out to help en | After built-in protection has arrived | Whenever new devices are onboarded to Defender for Endpoint, built-in protection settings will be applied to any new devices running Windows. You can always [change your built-in protection settings](#can-i-change-built-in-protection-settings). | > [!NOTE]-> Built-in protection sets default values for Windows devices. If endpoint security settings change, such as through baselines or policies in [Microsoft Endpoint Manager](/mem/endpoint-manager-overview), those settings override the built-in protection settings. +> Built-in protection sets default values for Windows and Mac devices. If endpoint security settings change, such as through baselines or policies in [Microsoft Intune](/mem/endpoint-manager-overview), those settings override the built-in protection settings. ## What does the notification look like? Built-in protection is a set of default settings. You aren't required to keep th | Task | Description | |:|:|-| Determine whether tamper protection is turned on | 1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in.<br/>2. Go to **Settings** > **Endpoints** > **Advanced features** > **Tamper protection**. | -| Manage tamper protection tenant wide using the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) | 1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in.<br/>2. Go to **Settings** > **Endpoints** > **Advanced features**.<br/>3. Set **Tamper protection** to **On** (*recommended*) or **Off**.<br/>4. Select **Save preferences**.<br/><br/>See [Manage tamper protection for your organization using Microsoft 365 Defender portal](manage-tamper-protection-microsoft-365-defender.md). | -| Set tamper protection settings for some, but not all, devices | Use endpoint security policies and profiles that are applied to specific devices. See the following articles:<br/>- [Manage tamper protection using Microsoft Endpoint Manager](manage-tamper-protection-microsoft-endpoint-manager.md)<br/>- [Manage tamper protection using tenant attach with Configuration Manager, version 2006](manage-tamper-protection-configuration-manager.md)| -| Turn tamper protection on or off on an individual device | 1. On your Windows device, select **Start**, and start typing *Security*.<br/>2. In the search results, select **Windows Security**.<br/>3. Select **Virus & threat protection** > **Virus & threat protection settings**.<br/>4. Set **Tamper Protection** to **On** (*recommended*) or **Off**. <br/><br/>If the device is onboarded to Defender for Endpoint, or the device is managed in the Microsoft Endpoint Manager admin center, those settings will override user settings on the individual device. <br/><br/>See [Manage tamper protection on an individual device](manage-tamper-protection-individual-device.md). | +| Determine whether tamper protection is turned on for your organization | 1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in.<br/>2. Go to **Settings** > **Endpoints** > **Advanced features** > **Tamper protection**. | +| Manage tamper protection tenant wide using the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) | 1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in.<br/>2. Go to **Settings** > **Endpoints** > **Advanced features**.<br/>3. Set **Tamper protection** to **On** (*recommended*) or **Off**.<br/>4. Select **Save preferences**.<br/>See [Manage tamper protection for your organization using Microsoft 365 Defender portal](manage-tamper-protection-microsoft-365-defender.md). | +| Set tamper protection settings for some, but not all, devices | Use endpoint security policies and profiles that are applied to specific devices. See the following articles:<br/>- [Manage tamper protection using Microsoft Intune](manage-tamper-protection-microsoft-endpoint-manager.md)<br/>- [Manage tamper protection using tenant attach with Configuration Manager, version 2006](manage-tamper-protection-configuration-manager.md)| +| Turn tamper protection on or off on an individual Windows device | 1. On your Windows device, select **Start**, and start typing *Security*.<br/>2. In the search results, select **Windows Security**.<br/>3. Select **Virus & threat protection** > **Virus & threat protection settings**.<br/>4. Set **Tamper Protection** to **On** (*recommended*) or **Off**. <br/><br/>If the device is onboarded to Defender for Endpoint, or the device is managed in the Microsoft Endpoint Manager admin center, those settings will override user settings on the individual device. See [Manage tamper protection on an individual device](manage-tamper-protection-individual-device.md). | +| Turn tamper protection on or off manually on a Mac | 1. On your Mac, open Finder, and go to **Applications** > **Utilities** > **Terminal**.<br/>2. In Terminal, type the following command `sudo mdatp config tamper-protection enforcement-level --value (chosen mode)`.<br/><br/>See [Manual configuration](tamperprotection-macos.md#manual-configuration). | +| Change tamper protection settings using a Mobile Device Management (MDM) solution | To change the tamper protection mode using an MDM, go to the configuration profile and change the enforcement level in [Intune](tamperprotection-macos.md#intune) or [JAMF](tamperprotection-macos.md#jamf).<br/><br/>The configuration profile set with the MDM will be your first point of reference. Any settings defined in the profile will be enforced on the device, and built-in-protection default settings won't override these applied settings. | | Temporarily disable tamper protection on a device for troubleshooting purposes | See the following articles:<br/>- [Get started with troubleshooting mode in Microsoft Defender for Endpoint](enable-troubleshooting-mode.md)<br/>- [Troubleshooting mode scenarios in Microsoft Defender for Endpoint](troubleshooting-mode-scenarios.md) | ## See also |
| security | Defender Endpoint Antivirus Exclusions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-antivirus-exclusions.md | The following table summarizes exclusion types that can be defined for Defender | Product/service | Exclusion types | |:|:-|-| [Microsoft Defender Antivirus](microsoft-defender-antivirus-windows.md) <br/>[Defender for Endpoint Plan 1 or Plan 2](defender-endpoint-plan-1-2.md) | <ul><li>[Automatic exclusions](#automatic-exclusions) (for Windows Server 2016 and later)</li><li>[Custom exclusions](#custom-exclusions), such as process-based exclusions, folder location-based exclusions, file extension exclusions, or contextual file and folder exclusions</li><li>[Custom remediation actions](#custom-remediation-actions) based on threat severity or for specific threats </li></ul> *The standalone versions of Defender for Endpoint Plan 1 and Plan 2 don't include server licenses. To onboard servers, you'll need another license, such as [Microsoft Defender for Servers Plan 1 or 2](/azure/defender-for-cloud/defender-for-servers-introduction). If you're a small or medium-sized business using [Microsoft Defender for Business](../defender-business/mdb-overview.md), you can get [Microsoft Defender for Business servers](../defender-business/get-defender-business-servers.md).* | +| [Microsoft Defender Antivirus](microsoft-defender-antivirus-windows.md) <br/>[Defender for Endpoint Plan 1 or Plan 2](defender-endpoint-plan-1-2.md) | <ul><li>[Automatic exclusions](#automatic-exclusions) (for Windows Server 2016 and later)</li><li>[Custom exclusions](#custom-exclusions), such as process-based exclusions, folder location-based exclusions, file extension exclusions, or contextual file and folder exclusions</li><li>[Custom remediation actions](#custom-remediation-actions) based on threat severity or for specific threats </li></ul> *The standalone versions of Defender for Endpoint Plan 1 and Plan 2 don't include server licenses. To onboard servers, you'll need another license, such as Microsoft Defender for Endpoint for Servers or [Microsoft Defender for Servers Plan 1 or 2](/azure/defender-for-cloud/defender-for-servers-introduction). To learn more, see [Defender for Endpoint onboarding Windows Server](onboard-windows-server.md).*<br/><br/>*If you're a small or medium-sized business using [Microsoft Defender for Business](../defender-business/mdb-overview.md), you can get [Microsoft Defender for Business servers](../defender-business/get-defender-business-servers.md).* | | [Defender for Endpoint Plan 1 or Plan 2](defender-endpoint-plan-1-2.md) |<ul><li>[Indicators](#defender-for-endpoint-indicators) for files, certificates, or IP addresses, URLs/domains</li><li>[Attack surface reduction exclusions](#attack-surface-reduction-exclusions)</li><li>[Controlled folder access exclusions](#controlled-folder-access-exclusions)</li></ul> | | [Defender for Endpoint Plan 2](microsoft-defender-endpoint.md) | [Automation folder exclusions](#automation-folder-exclusions) (for automated investigation and remediation) | |
| security | Defender Endpoint Plan 1 2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2.md | The following table summarizes what's included in Microsoft endpoint security pl Defender for Endpoint Plan 1 and 2 (standalone), Defender for Business (standalone), and Microsoft 365 Business Premium don't include server licenses. To onboard servers, choose from the following options: +- **Microsoft Defender for Endpoint for Servers**. See [Defender for Endpoint onboarding Windows Server](onboard-windows-server.md). - **Microsoft Defender for Servers Plan 1 or Plan 2** as part of the [Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction) offering. To learn more. see [Overview of Microsoft Defender for Servers](/azure/defender-for-cloud/defender-for-servers-introduction).-- **Microsoft Defender for Business servers (preview)** for small and medium-sized businesses. See [How to get Microsoft Defender for Business servers (preview)](../defender-business/get-defender-business-servers.md).+- **Microsoft Defender for Business servers** for small and medium-sized businesses. See [How to get Microsoft Defender for Business servers](../defender-business/get-defender-business-servers.md). ## Mixed licensing scenarios |
| security | Deploy And Manage Using Group Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deploy-and-manage-using-group-policy.md | search.appverid: met150 - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) -Microsoft Defender for Endpoint Device Control Printer Protection feature enables you to audit, allow, or prevent printer with or without exclusions. +Microsoft Defender for Endpoint Device Control Printer Protection feature enables you to audit, allow, or prevent printer with or without exclusions. -## Licensing requirements +## Licensing requirements -Before you get started with Removable Storage Access Control, you must confirm yourΓÇ»[Microsoft 365 subscription](https://www.microsoft.com/en-in/microsoft-365/compare-microsoft-365-enterprise-plans?rtc=3). To access and use Printer Protection through group policy, you must have Microsoft 365 E5. +Before you get started with Removable Storage Access Control, you must confirm your [Microsoft 365 subscription](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans?rtc=3). To access and use Printer Protection through group policy, you must have Microsoft 365 E5. ## Deploy using group policy Before you get started with Removable Storage Access Control, you must confirm y :::image type="content" source="images/enable-rsac-gp.png" alt-text="Screenshot of Enabling RSAC using Group Policy. " lightbox="images/enable-rsac-gp.png"::: -The purpose of this configuration is to temporarily disable device control on specific machine. --> [!NOTE] -> If you don't see this group policy objects, you need to add the group policy administrative template. You can download administrative template (WindowsDefender.admx and WindowsDefender.admx) from [samples](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Removable%20Storage%20Access%20Control%20Samples) -. --> [!NOTE] -> This configuration controls both Removable storage access control [Microsoft Defender for Endpoint Device Control Removable Storage Access Control](device-control-removable-storage-access-control.md) and Printer protection. + The purpose of this configuration is to temporarily disable device control on specific machine. + > [!NOTE] + > If you don't see this group policy objects, you need to add the group policy administrative template. You can download administrative template (WindowsDefender.admx and WindowsDefender.admx) from [samples](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Removable%20Storage%20Access%20Control%20Samples). + > + > This configuration controls both Removable storage access control [Microsoft Defender for Endpoint Device Control Removable Storage Access Control](device-control-removable-storage-access-control.md) and Printer protection. 2. Set Default Enforcement: You can set default access (Deny or Allow) for all Device Control features (RemovableMediaDevices, CdRomDevices, WpdDevices, PrinterDevices). - For example, you can have either a Deny or an Allow policy for RemovableMediaDevices, but not for CdRomDevices or WpdDevices. You set Default Deny through this policy, then Read/Write/Execute access to CdRomDevices or WpdDevices will be blocked. + For example, you can have either a Deny or an Allow policy for RemovableMediaDevices, but not for CdRomDevices or WpdDevices. You set Default Deny through this policy, then Read/Write/Execute access to CdRomDevices or WpdDevices will be blocked. - Go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Features** > **Device Control** > **Select Device Control Default Enforcement** The purpose of this configuration is to temporarily disable device control on sp - In the **Define device control policy groups** window, specify the network share file path containing the XML groups data. Take a look at the **Overview** > **Removable storage group**. You can create different group types. Here's one group example XML file for any removable storage and CDROM and Windows portable devices and approved USBs group: [XML file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Group%20Policy/Demo_Groups.xml)- -> [!NOTE] -> Comments using XML comment notation `<!-- COMMENT -->` can be used in the Rule and Group XML files, but they must be inside the first XML tag, not the first line of the XML file. ++ > [!NOTE] + > Comments using XML comment notation `<!-- COMMENT -->` can be used in the Rule and Group XML files, but they must be inside the first XML tag, not the first line of the XML file. 4. Create one XML file for access policy rule(s): The purpose of this configuration is to temporarily disable device control on sp Take a look at the **Overview** -> **Access policy rule**, you can use **Parameters** to set condition for specific Entry. Here's one [example XML file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Group%20Policy/Demo_Policies.xml). -> [!NOTE] -> Comments using XML comment notation `<!-- COMMENT -->` can be used in the Rule and Group XML files, but they must be inside the first XML tag, not the first line of the XML file. + > [!NOTE] + > Comments using XML comment notation `<!-- COMMENT -->` can be used in the Rule and Group XML files, but they must be inside the first XML tag, not the first line of the XML file. 5. Set location for a copy of the file (evidence): Here are some common scenarios to help you familiarize with Microsoft Defender f ### Scenario 1: Prevent print to all but allow print through specific approved USB printer when the machine is corporate network, VPN connected, or print through PDF/XPS file -Allows to print only through approved USB when machine is in corporate network, VPN connected, or print through PDF/XPS file. +Allows to print only through approved USB when machine is in corporate network, VPN connected, or print through PDF/XPS file. You can download the files here, [Printer Protection Samples](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Printer%20Protection%20Samples/Group%20Policy). -1. Create any printer group and allowed-USB printer group and allowed-file printer group +1. Create any printer group and allowed-USB printer group and allowed-file printer group. - 1. Group 1: Any printer group + 1. Group 1: Any printer group. - :::image type="content" source="media/screenshot-of-removable-storage.png" alt-text="This is the screenshot of removable of storage." lightbox="media/screenshot-of-removable-storage.png"::: + :::image type="content" source="media/screenshot-of-removable-storage.png" alt-text="This is the screenshot of removable of storage." lightbox="media/screenshot-of-removable-storage.png"::: - 2. Group 2: Allowed-USB printer group + 2. Group 2: Allowed-USB printer group. - :::image type="content" source="media/screenshot-of-approved-usbs.png" alt-text="This is the screenshot of approved USBs." lightbox="media/screenshot-of-approved-usbs.png"::: + :::image type="content" source="media/screenshot-of-approved-usbs.png" alt-text="This is the screenshot of approved USBs." lightbox="media/screenshot-of-approved-usbs.png"::: - 3. Group 2: Allowed PDF/XPS file printer group: following PrinterConnectionId is used, but if you want to only allow PDF, FriendlyNameId with ΓÇÿMicrosoft Print to PDFΓÇÖ is recommended + 3. Group 2: Allowed PDF/XPS file printer group: following PrinterConnectionId is used, but if you want to only allow PDF, FriendlyNameId with 'Microsoft Print to PDF' is recommended. - :::image type="content" source="images/group-3.png" alt-text="This is group 3policy." lightbox="images/group-3.png"::: - - Combine these two groups into [one XML file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Group%20Policy/Demo_Groups.xml). See step 3 from the [Deploy using group policy](deploy-and-manage-using-group-policy.md) section to deploy this configuration. + :::image type="content" source="images/group-3.png" alt-text="This is group 3policy." lightbox="images/group-3.png"::: - > [!TIP] - > Replace `&` with `&` in the value. + Combine these two groups into [one XML file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Group%20Policy/Demo_Groups.xml). See step 3 from the [Deploy using group policy](deploy-and-manage-using-group-policy.md) section to deploy this configuration. -2. Create policy + > [!TIP] + > Replace `&` with `&` in the value. - 1. Create Allow and Audit policy for allowed-file printer group +2. Create policy. - :::image type="content" source="media/block-write-execute-access.png" alt-text="This is block write access screenshot." lightbox="media/block-write-execute-access.png"::: + 1. Create Allow and Audit policy for allowed-file printer group. + :::image type="content" source="media/block-write-execute-access.png" alt-text="This is block write access screenshot." lightbox="media/block-write-execute-access.png"::: - 2. Create policy to allow authorized USB printer only when the machine is Corporate Network OR VPN connected + 2. Create policy to allow authorized USB printer only when the machine is Corporate Network OR VPN connected. - :::image type="content" source="media/audit-write.png" alt-text="This is the deafult audit write access screenshot." lightbox="media/audit-write.png"::: + :::image type="content" source="media/audit-write.png" alt-text="This is the deafult audit write access screenshot." lightbox="media/audit-write.png"::: - 3. Create Default Deny custom policy for any other printers + 3. Create Default Deny custom policy for any other printers. - :::image type="content" source="images/create-default.png" alt-text="This is create default." lightbox="images/create-default.png"::: - - Combine these two policy rules into [one XML file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Group%20Policy/Scenario%201%20GPO%20Policy%20-%20Prevent%20Write%20and%20Execute%20access%20to%20all%20but%20allow%20specific%20approved%20USBs.xml). See step 4 from the [Deploy using group policy](deploy-and-manage-using-group-policy.md) section to deploy this configuration. + :::image type="content" source="images/create-default.png" alt-text="This is create default." lightbox="images/create-default.png"::: + Combine these two policy rules into [one XML file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Group%20Policy/Scenario%201%20GPO%20Policy%20-%20Prevent%20Write%20and%20Execute%20access%20to%20all%20but%20allow%20specific%20approved%20USBs.xml). See step 4 from the [Deploy using group policy](deploy-and-manage-using-group-policy.md) section to deploy this configuration. |
| security | Deploy And Manage Using Intune | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deploy-and-manage-using-intune.md | Title: Deploy and manage using Intune + Title: Deploy and manage using Intune description: Use Intune OMA-URI and Intune user interface to deploy and manage on printer protection. search.appverid: met150 - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) -Microsoft Defender for Endpoint Device Control Printer Protection feature enables you to audit, allow, or prevent printer with or without exclusions. +Microsoft Defender for Endpoint Device Control Printer Protection feature enables you to audit, allow, or prevent printer with or without exclusions. ## Licensing requirements Go to Microsoft Endpoint Manager admin center (<https://endpoint.microsoft.com/> :::image type="content" source="media/enable-rsac.png" alt-text="Screenshot of enabling Removable Storage Access Control policy." lightbox="media/enable-rsac.png"::: -The purpose of this configuration is to temporarily disable Device control on specific machine. + The purpose of this configuration is to temporarily disable Device control on specific machine. -> [!NOTE] - > This configuration controls both [Microsoft Defender for Endpoint Device Control Removable Storage Access Control](device-control-removable-storage-access-control.md) and Printer Protection. + > [!NOTE] + > This configuration controls both [Microsoft Defender for Endpoint Device Control Removable Storage Access Control](device-control-removable-storage-access-control.md) and Printer Protection. 2. Set Default Enforcement: The purpose of this configuration is to temporarily disable Device control on sp > This configuration controls both Removable storage access control [Microsoft Defender for Endpoint Device Control Removable Storage Access Control](device-control-removable-storage-access-control.md) and Printer protection. If you only want to manage storage, make sure to create Allow policy for Printer. Otherwise, this Default Enforcement will be applied to Printer as well. 3. Create one XML file for each group:- + You can create a removable storage group for each group as follows: - In the **Add Row** pane, enter: The purpose of this configuration is to temporarily disable Device control on sp ## Scenarios (default enforcement) -Here are some common scenarios to help you familiarize with Microsoft Defender for Endpoint Printer Protection. In the following samples, **Default Enforcement** hasn't been used because the **Default Enforcement** will apply to both the removable storage and the printer. +Here are some common scenarios to help you familiarize with Microsoft Defender for Endpoint Printer Protection. In the following samples, **Default Enforcement** hasn't been used because the **Default Enforcement** will apply to both the removable storage and the printer. ### Scenario 1: Prevent print to all but allow print through specific approved USB printer when the machine is Corporate Network OR VPN connected or print through PDF/XPS file -Allows to print only through approved the USB when machine is in Corporate Network OR VPN connected, or print through PDF/XPS file. +Allows to print only through approved the USB when machine is in Corporate Network OR VPN connected, or print through PDF/XPS file. You can download the files [Printer Protection Samples](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Printer%20Protection%20Samples/Intune%20OMA-URI). -1. Create groups +1. Create groups. - 1. Group 1: Any printer group + 1. Group 1: Any printer group - :::image type="content" source="media/188234308-4db09787-b14e-446a-b9e0-93c99b08748f.png" alt-text="A screenshot showing removable storage." lightbox= "media/188234308-4db09787-b14e-446a-b9e0-93c99b08748f.png"::: + :::image type="content" source="media/188234308-4db09787-b14e-446a-b9e0-93c99b08748f.png" alt-text="A screenshot showing removable storage." lightbox= "media/188234308-4db09787-b14e-446a-b9e0-93c99b08748f.png"::: - Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Any%20Removable%20Storage%20and%20CD-DVD%20and%20WPD%20Group.xml). See step 3 from the [Deploy Printer Protection](deploy-and-manage-using-intune.md) section to deploy the configuration. + Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Any%20Removable%20Storage%20and%20CD-DVD%20and%20WPD%20Group.xml). See step 3 from the [Deploy Printer Protection](deploy-and-manage-using-intune.md) section to deploy the configuration. - 2. Group 2: Allowed-USB printer group + 2. Group 2: Allowed-USB printer group - :::image type="content" source="media/188234372-526d20b3-cfea-4f1d-8d63-b513497ada52.png" alt-text="A screenshot of approved USBs." lightbox= "media/188234372-526d20b3-cfea-4f1d-8d63-b513497ada52.png"::: + :::image type="content" source="media/188234372-526d20b3-cfea-4f1d-8d63-b513497ada52.png" alt-text="A screenshot of approved USBs." lightbox= "media/188234372-526d20b3-cfea-4f1d-8d63-b513497ada52.png"::: Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Any%20Removable%20Storage%20and%20CD-DVD%20and%20WPD%20Group.xml). See step 3 from the [Deploy Printer Protection](deploy-and-manage-using-intune.md) section to deploy the configuration. - 3. Group 3: Allowed PDF/XPS file printer group: following PrinterConnectionId is used, but if you want to only allow PDF, FriendlyNameId with ΓÇÿMicrosoft Print to PDFΓÇÖ is recommended. + 3. Group 3: Allowed PDF/XPS file printer group: following PrinterConnectionId is used, but if you want to only allow PDF, FriendlyNameId with 'Microsoft Print to PDF' is recommended. :::image type="content" source="images/allowed-pdf.png" alt-text="This is allowed pdf."lightbox="images/allowed-pdf.png"::: - Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Any%20Removable%20Storage%20and%20CD-DVD%20and%20WPD%20Group.xml). See step 3 from the [Deploy Printer Protection](deploy-and-manage-using-intune.md) section to deploy the configuration. - > [!TIP] - > Replace `&` with `&` in the value. --2. Create policy -- 1. Create **Allow** and **Audit** policy for allowed-file printer group. + > [!TIP] + > Replace `&` with `&` in the value. - :::image type="content" source="media/188243425-c0772ed4-6537-4c6a-9a1d-1dbb48018578.png" alt-text="A screenshot of policy 1." lightbox= "media/188243425-c0772ed4-6537-4c6a-9a1d-1dbb48018578.png"::: +2. Create policy. - Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Scenario%201%20Block%20Write%20and%20Execute%20Access%20but%20allow%20approved%20USBs.xml). See step 4 from the [Deploy Printer Protection](deploy-and-manage-using-intune.md) section to deploy the configuration. + 1. Create **Allow** and **Audit** policy for allowed-file printer group. - 2. Create policy to allow authorized USB printer only when the machine is in Corporate Network or connected to the VPN + :::image type="content" source="media/188243425-c0772ed4-6537-4c6a-9a1d-1dbb48018578.png" alt-text="A screenshot of policy 1." lightbox= "media/188243425-c0772ed4-6537-4c6a-9a1d-1dbb48018578.png"::: - :::image type="content" source="media/188243552-5d2a90ab-dba6-450f-ad8f-86a862f6e739.png" alt-text="A screenshot of policy 2." lightbox= "media/188243552-5d2a90ab-dba6-450f-ad8f-86a862f6e739.png"::: + Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Scenario%201%20Block%20Write%20and%20Execute%20Access%20but%20allow%20approved%20USBs.xml). See step 4 from the [Deploy Printer Protection](deploy-and-manage-using-intune.md) section to deploy the configuration. - Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Scenario%201%20Block%20Write%20and%20Execute%20Access%20but%20allow%20approved%20USBs.xml). See step 4 from the [Deploy Printer Protection](deploy-and-manage-using-intune.md) section to deploy the configuration. + 2. Create policy to allow authorized USB printer only when the machine is in Corporate Network or connected to the VPN. - 3. Create Default Deny custom policy for any other printers + :::image type="content" source="media/188243552-5d2a90ab-dba6-450f-ad8f-86a862f6e739.png" alt-text="A screenshot of policy 2." lightbox= "media/188243552-5d2a90ab-dba6-450f-ad8f-86a862f6e739.png"::: - :::image type="content" source="media/188243552-5d2a90ab-dba6-450f-ad8f-86a862f6e739.png" alt-text="A screenshot of policy 2." lightbox= "media/188243552-5d2a90ab-dba6-450f-ad8f-86a862f6e739.png"::: + Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Scenario%201%20Block%20Write%20and%20Execute%20Access%20but%20allow%20approved%20USBs.xml). See step 4 from the [Deploy Printer Protection](deploy-and-manage-using-intune.md) section to deploy the configuration. - Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Scenario%201%20Block%20Write%20and%20Execute%20Access%20but%20allow%20approved%20USBs.xml). See step 4 from the [Deploy Printer Protection](deploy-and-manage-using-intune.md) section to deploy the configuration. + 3. Create Default Deny custom policy for any other printers. + :::image type="content" source="media/188243552-5d2a90ab-dba6-450f-ad8f-86a862f6e739.png" alt-text="A screenshot of policy 2." lightbox= "media/188243552-5d2a90ab-dba6-450f-ad8f-86a862f6e739.png"::: + Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Scenario%201%20Block%20Write%20and%20Execute%20Access%20but%20allow%20approved%20USBs.xml). See step 4 from the [Deploy Printer Protection](deploy-and-manage-using-intune.md) section to deploy the configuration. |
| security | Deploy Manage Removable Storage Intune | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deploy-manage-removable-storage-intune.md | The Removable Storage Access Control feature enables you to apply policy by usin |File Parameter|supported|not supported| |Network location|supported|not supported| - ## Licensing requirements Before you get started with Removable Storage Access Control, you must confirm your [Microsoft 365 subscription](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans?rtc=2). To access and use Removable Storage Access Control, you must have Microsoft 365 E3. Here are some common scenarios to help you familiarize with Microsoft Defender f For this scenario, you need to create two groups: one group for any removable storage and another group for approved USBs. You also need to create two policies: one policy to deny Write and Execute access for any removable storage group and the other policy to audit the approved USBs group. -1. Create groups +1. Create groups. - 1. Group 1: Any removable storage, CD/DVD, and Windows portable devices. + 1. Group 1: Any removable storage, CD/DVD, and Windows portable devices. - :::image type="content" source="media/188234308-4db09787-b14e-446a-b9e0-93c99b08748f.png" alt-text="A screenshot showing removable storage" lightbox= "media/188234308-4db09787-b14e-446a-b9e0-93c99b08748f.png"::: + :::image type="content" source="media/188234308-4db09787-b14e-446a-b9e0-93c99b08748f.png" alt-text="A screenshot showing removable storage" lightbox= "media/188234308-4db09787-b14e-446a-b9e0-93c99b08748f.png"::: - Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Any%20Removable%20Storage%20and%20CD-DVD%20and%20WPD%20Group.xml). See step 3 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. + Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Any%20Removable%20Storage%20and%20CD-DVD%20and%20WPD%20Group.xml). See step 3 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. - 2. Group 2: Approved USBs based on device properties. + 2. Group 2: Approved USBs based on device properties. - :::image type="content" source="media/188234372-526d20b3-cfea-4f1d-8d63-b513497ada52.png" alt-text="A screenshot of approved USBs" lightbox= "media/188234372-526d20b3-cfea-4f1d-8d63-b513497ada52.png"::: + :::image type="content" source="media/188234372-526d20b3-cfea-4f1d-8d63-b513497ada52.png" alt-text="A screenshot of approved USBs" lightbox= "media/188234372-526d20b3-cfea-4f1d-8d63-b513497ada52.png"::: - Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Approved%20USBs%20Group.xml). See step 3 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. + Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Approved%20USBs%20Group.xml). See step 3 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. - > [!TIP] - > Replace `&` with `&` in the value in the XML file. + > [!TIP] + > Replace `&` with `&` in the value in the XML file. 2. Create policy - 1. Policy 1: Block Write and Execute access for any removable storage group but allow approved USBs. + 1. Policy 1: Block Write and Execute access for any removable storage group but allow approved USBs. - :::image type="content" source="media/188243425-c0772ed4-6537-4c6a-9a1d-1dbb48018578.png" alt-text="A screenshot of policy 1" lightbox= "media/188243425-c0772ed4-6537-4c6a-9a1d-1dbb48018578.png"::: + :::image type="content" source="media/188243425-c0772ed4-6537-4c6a-9a1d-1dbb48018578.png" alt-text="A screenshot of policy 1" lightbox= "media/188243425-c0772ed4-6537-4c6a-9a1d-1dbb48018578.png"::: - Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Scenario%201%20Block%20Write%20and%20Execute%20Access%20but%20allow%20approved%20USBs.xml). See step 4 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. + Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Scenario%201%20Block%20Write%20and%20Execute%20Access%20but%20allow%20approved%20USBs.xml). See step 4 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. - 2. Policy 2: Audit Write and Execute access for allowed USBs. + 2. Policy 2: Audit Write and Execute access for allowed USBs. - :::image type="content" source="media/188243552-5d2a90ab-dba6-450f-ad8f-86a862f6e739.png" alt-text="A screenshot of policy 2" lightbox= "media/188243552-5d2a90ab-dba6-450f-ad8f-86a862f6e739.png"::: + :::image type="content" source="media/188243552-5d2a90ab-dba6-450f-ad8f-86a862f6e739.png" alt-text="A screenshot of policy 2" lightbox= "media/188243552-5d2a90ab-dba6-450f-ad8f-86a862f6e739.png"::: - What does `54` mean in the policy? It's `18 + 36 = 54`. + What does `54` mean in the policy? It's `18 + 36 = 54`. - - Write access: disk level 2 + file system level 16 = 18. - - Execute: disk level 4 + file system level 32 = 36. + - Write access: disk level 2 + file system level 16 = 18. + - Execute: disk level 4 + file system level 32 = 36. - Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Scenario%201%20Audit%20Write%20and%20Execute%20access%20to%20aproved%20USBs.xml). See step 4 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. + Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Scenario%201%20Audit%20Write%20and%20Execute%20access%20to%20aproved%20USBs.xml). See step 4 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. ### Scenario 2: Audit Write and Execute access for all but block specific blocked USBs For this scenario, you need to create two groups: one group for any removable st :::image type="content" source="media/188244203-36c869b6-9330-4e2a-854b-494c342bb77d.png" alt-text="A screenshot of audit write and execute access" lightbox= "media/188244203-36c869b6-9330-4e2a-854b-494c342bb77d.png"::: - What does `54` mean in the policy? It's `18 + 36 = 54`. + What does `54` mean in the policy? It's `18 + 36 = 54`. - Write access: disk level 2 + file system level 16 = 18. - Execute: disk level 4 + file system level 32 = 36. For this scenario, you need to create two groups: one group for any removable st For this scenario, you need to create two groups: one removable storage group for any removable storage and another group for unallowed file extensions. You also need to create one policy: deny read and execute access to any file under the allowed file extension group for defined removable storage group. -1. Create groups +1. Create groups. - 1. Group 1: Any removable storage, CD/DVD, and Windows portable devices. + 1. Group 1: Any removable storage, CD/DVD, and Windows portable devices. - :::image type="content" source="media/188234308-4db09787-b14e-446a-b9e0-93c99b08748f.png" alt-text="A screenshot of group 1" lightbox="media/188234308-4db09787-b14e-446a-b9e0-93c99b08748f.png"::: - - Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Any%20Removable%20Storage%20and%20CD-DVD%20and%20WPD%20Group.xml). See step 3 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. + :::image type="content" source="media/188234308-4db09787-b14e-446a-b9e0-93c99b08748f.png" alt-text="A screenshot of group 1" lightbox="media/188234308-4db09787-b14e-446a-b9e0-93c99b08748f.png"::: - 2. Group 2: Unallowed file extensions. - - Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Unauthorized%20File%20Group.xml). See step 3 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. + Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Any%20Removable%20Storage%20and%20CD-DVD%20and%20WPD%20Group.xml). See step 3 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. + 2. Group 2: Unallowed file extensions. - > [!TIP] - > Explicily mark the Type attribute on the group as **File** + Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Unauthorized%20File%20Group.xml). See step 3 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. ++ > [!TIP] + > Explicily mark the Type attribute on the group as **File** ++ 3. Policy 2: Deny read and execute access to any file under the allowed file extension group for defined removable storage group. - 2. Policy 2: Deny read and execute access to any file under the allowed file extension group for defined removable storage group. - - :::image type="content" source="media/200713006-c0d39e2b-9acc-4522-9f88-e064eeb3a4ae.png" alt-text="Screenshot of OMA-URI settings." lightbox="media/200713006-c0d39e2b-9acc-4522-9f88-e064eeb3a4ae.png"::: - - What does `40` mean in the policy? It's `8 + 32 = 40`. + :::image type="content" source="media/200713006-c0d39e2b-9acc-4522-9f88-e064eeb3a4ae.png" alt-text="Screenshot of OMA-URI settings." lightbox="media/200713006-c0d39e2b-9acc-4522-9f88-e064eeb3a4ae.png"::: - - only need to restrict file system level access - - Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Deny%20Read%20and%20Write%20access%20to%20specific%20files.xml). See step 4 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. + What does `40` mean in the policy? It's `8 + 32 = 40`. + - only need to restrict file system level access ++ Here's the [sample file](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Deny%20Read%20and%20Write%20access%20to%20specific%20files.xml). See step 4 from the [Deploy Removable Storage Access Control](deploy-manage-removable-storage-intune.md#deploy-removable-storage-access-control-by-using-intune-oma-uri) section to deploy the configuration. ## Deploy Removable Storage Access Control by using Intune user interface Here are some common scenarios to help you familiarize with Microsoft Defender f For this scenario, you need to create two groups: one group for any removable storage and another group for approved USBs. You also need to create two policies: one policy to deny Write and Execute access for any removable storage group and the other policy to audit the approved USBs group. -1. To set up the groups you'll need, go to **Endpoint Security** > **Attack Surface Reduction** > **Reusable settings** > **Add**. For more details, see **DescriptorIdList** on the [Microsoft Defender for Endpoint Device Control Removable Storage Access Control, removable storage media](device-control-removable-storage-access-control.md#group). +1. To set up the groups you'll need, go to **Endpoint Security** \> **Attack Surface Reduction** \> **Reusable settings** \> **Add**. For more details, see **DescriptorIdList** on the [Microsoft Defender for Endpoint Device Control Removable Storage Access Control, removable storage media](device-control-removable-storage-access-control.md#group). 1. For group 1, configure any removable storage, CD/DVD, and Windows portable devices, as shown in the following screenshots: For this scenario, you need to create two groups: one group for any removable st 2. For group 2, choose **+ Add** to create another group for approved USBs, based on device properties, as shown in the following screenshot: :::image type="content" source="media/208774190-b700f7cb-0d0e-4d27-955b-23be9c0cb7b5.png" alt-text="Screenshot showing additional group for approved USB devices." lightbox="media/208774190-b700f7cb-0d0e-4d27-955b-23be9c0cb7b5.png":::- -2. To set up your policy, go to **Endpoint Security** > **Attack Surface Reduction** > **Create Policy**. ++2. To set up your policy, go to **Endpoint Security** \> **Attack Surface Reduction** \> **Create Policy**. 3. Choose **Platform**: **Windows 10 and later** with **Profile: Device Control**. Select **Device Control**: **Configured**. For this scenario, you need to create two groups: one group for any removable st 1. To create groups, go to **Endpoint Security** > **Attack Surface Reduction** > **Reusable settings** > **Add**. For more details, see **DescriptorIdList** on the [Microsoft Defender for Endpoint Device Control Removable Storage Access Control, removable storage media](device-control-removable-storage-access-control.md#group). 1. Group 1: Any removable storage, CD/DVD, and Windows portable devices, as shown in the following screenshots:- + :::image type="content" source="media/208774115-ab503406-a3c6-4611-b5fa-9e837e731898.png" alt-text="Screenshot showing removable storage example." lightbox="media/208774115-ab503406-a3c6-4611-b5fa-9e837e731898.png"::: And here's another example: :::image type="content" source="media/208774136-b63b2268-926f-482a-a509-aab7f8efba02.png" alt-text="Screenshot showing a second example of removable storage." lightbox="media/208774136-b63b2268-926f-482a-a509-aab7f8efba02.png"::: -2. To create your policy, go to **Endpoint Security** > **Attack Surface Reduction** > **Create Policy**. Choose **Platform**: **Windows 10 and later** with **Profile: Device Control**. Select **Device Control**: **Configured**. +2. To create your policy, go to **Endpoint Security** > **Attack Surface Reduction** > **Create Policy**. Choose **Platform**: **Windows 10 and later** with **Profile: Device Control**. Select **Device Control**: **Configured**. 1. Policy 1: Block unauthorized USBs. Choose **+ Set reusable settings** for **Included ID** and choose **Select**, as shown in the following screenshot: For this scenario, you need to create two groups: one group for any removable st :::image type="content" source="media/208775203-439bb8b5-e45a-47a7-9828-51ea9d5cfe95.png" alt-text="Screenshot showing Entry being edited." lightbox="media/208775203-439bb8b5-e45a-47a7-9828-51ea9d5cfe95.png"::: - 2. Policy 2: Choose **+ Add** to create another policy for ΓÇÿAudit Write and Execute access for any removable storage groupΓÇÖ. Choose **+ Set reusable settings** for **Included ID**, and then choose **Select**, as shown in the following screenshot: + 2. Policy 2: Choose **+ Add** to create another policy for 'Audit Write and Execute access for any removable storage group'. Choose **+ Set reusable settings** for **Included ID**, and then choose **Select**, as shown in the following screenshot: :::image type="content" source="media/208775292-485a13e4-533c-4efc-97a4-611786d02fd1.png" alt-text="Screenshot showing reusable settings." lightbox="media/208775292-485a13e4-533c-4efc-97a4-611786d02fd1.png"::: For this scenario, you need to create two groups: one group for any removable st Choose **+ Edit Entry** for **Entry**, as shown in the following screenshot: :::image type="content" source="media/208775366-f2cafb54-eb63-4bcd-b0fe-880f3cba2c1b.png" alt-text="Screenshot showing edit mode for an entry." lightbox="media/208775366-f2cafb54-eb63-4bcd-b0fe-880f3cba2c1b.png":::- |
| security | Enable Attack Surface Reduction | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction.md | To use the entire feature-set of attack surface reduction rules, you need: - [Cloud-Delivery Protection](/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus) on (some rules require that) - Windows 10 Enterprise E5 or E3 License -Although attack surface reduction rules don't require a [Windows E5 license](/windows/deployment/deploy-enterprise-licenses), with a Windows E5 license, you get advanced management capabilities including monitoring, analytics, and workflows available in Defender for Endpoint, as well as reporting and configuration capabilities in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. These advanced capabilities aren't available with an E3 license, but you can still use Event Viewer to review attack surface reduction rule events. +Although attack surface reduction rules don't require a [Windows E5 license](/windows/deployment/deploy-enterprise-licenses), with a Windows E5 license, you get advanced management capabilities including monitoring, analytics, and workflows available in Defender for Endpoint, as well as reporting and configuration capabilities in the [Microsoft 365 Defender](https://go.microsoft.com/fwlink/p/?linkid=2077139) portal. These advanced capabilities aren't available with an E3 license, but you can still use Event Viewer to review attack surface reduction rule events. Each ASR rule contains one of four settings: You can also exclude ASR rules from triggering based on certificate and file has You can specify individual files or folders (using folder paths or fully qualified resource names). An exclusion is applied only when the excluded application or service starts. For example, if you add an exclusion for an update service that is already running, the update service will continue to trigger events until the service is stopped and restarted. -For information about per-rule exclusions, see [Configure ASR rules per-rule exclusions](attack-surface-reduction-rules-deployment-test.md#configure-asr-rules-per-rule-exclusions). +For information about per-rule exclusions, see the section titled **Configure ASR rules per-rule exclusions** in the topic [Test attack surface reduction (ASR) rules](attack-surface-reduction-rules-deployment-test.md) ASR rules support environment variables and wildcards. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](configure-extension-file-exclusions-microsoft-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists). |
| security | Faqs Tamper Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/faqs-tamper-protection.md | search.appverid: met150 **Platforms** - Windows -## On which versions of Windows can I configure 'tamper protection'? +## On which versions of Windows can I configure tamper protection? - Windows 11 - Windows 11 Enterprise multi-session Devices that are onboarded to Microsoft Defender for Endpoint will have Microsof ## How do I turn tamper protection on or off? -If you're a home user, see [Manage tamper protection on an individual device](manage-tamper-protection-individual-device.md). --If you're an organization using [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint), you should be able to manage 'tamper protection' in Intune similar to how you manage other endpoint protection features. See the following sections of this article: +If you're an organization using [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint), you should be able to manage tamper protection in Intune similar to how you manage other endpoint protection features. See the following sections of this article: - [Manage tamper protection using Microsoft Endpoint Manager](manage-tamper-protection-microsoft-endpoint-manager.md) - [Manage tamper protection using Microsoft 365 Defender](manage-tamper-protection-microsoft-365-defender.md) -## How does configuring tamper protection in Intune affect how I manage Microsoft Defender Antivirus with Group Policy? +If you're a home user, see [Manage tamper protection on an individual device](manage-tamper-protection-individual-device.md). -If you're currently using Intune to configure and manage tamper protection, you should continue using Intune. +## Does tamper protection apply to Microsoft Defender Antivirus exclusions? -When tamper protection is turned on and you use Group Policy to make changes to Microsoft Defender Antivirus settings, the settings that are tamper protected will be ignored. +New functionality is rolling out now to protect Microsoft Defender Antivirus exclusions. However, certain conditions must be met. See [What about exclusions](prevent-changes-to-security-settings-with-tamper-protection.md#what-about-exclusions)? ++## How does configuring tamper protection in Intune affect how I manage Microsoft Defender Antivirus with Group Policy? ++If you're currently using Intune to configure and manage tamper protection, you should continue using Intune. When tamper protection is turned on and you use Group Policy to make changes to Microsoft Defender Antivirus settings, any settings that are protected by tamper protection will be ignored. ## If we use Microsoft Intune to configure tamper protection, does it apply only to the entire organization? -You have flexibility in configuring tamper protection with Intune. You can target your entire organization, or select specific devices and user groups. +If you're using Intune to configure and manage tamper protection, you can target your entire organization, or select specific devices and user groups. ++## What settings can't be changed when tamper protection is turned on? ++When tamper protection is turned on, tamper-protected settings cannot be changed from their default value, even if you're using Intune to manage your security settings. Changes might appear to be successful in Intune, but will not actually be allowed by tamper protection. For the most current list of tamper protected settings, contact support. ## Can I configure tamper protection with Microsoft Endpoint Configuration Manager? If you're using tenant attach, you can use Microsoft Endpoint Configuration Mana ## I have the Windows E3 enrollment. Can I use configuring tamper protection in Intune? -Currently, configuring tamper protection in Intune is only available for customers who have [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint). +Currently, configuring tamper protection in Intune is only available for customers whose subscriptions include [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint). ## I'm an enterprise customer. Can local admins change tamper protection on their devices? |
| security | Get All Scan Definitions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-all-scan-definitions.md | Here is an example of the response. "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#DeviceAuthenticatedScanDefinitions", "value": [ {- "id": "60c4vv57-asdf-3454-a456-2e45t9d79ec9d", - "scanType": "Windows", - "scanName": "Test Windows scan", - "isActive": true, - "target": "127.0.0.1", + "id": "60c4vv57-asdf-3454-a456-2e45t9d79ec9d", + "scanType": "Windows", + "scanName": "Test Windows scan", + "isActive": true, + "target": "127.0.0.1", "orgId": "47d21a0c-cccd-45d3-bffa-a93dbc0bfcaa",- "intervalInHours": 1, + "intervalInHours": 1, "createdBy": "test@contoso.com", "targetType": "Ip", "scanAuthenticationParams": {- "@odata.type": "#microsoft.windowsDefenderATP.api.WindowsAuthParams", - "type": "Kerberos", -  "username": "username", - "domain": "password", + "@odata.type": "#microsoft.windowsDefenderATP.api.WindowsAuthParams", + "type": "Kerberos", + "username": "username", + "domain": "password", "isGmsaUser": true }, "scannerAgent": { Here is an example of the response. "status": "Fail", "failureReason": null, "executionDateTime": "2021-12-19T20:06:55.2295854Z"-     }, - { + }, + { "id": "60c4aa57-ioi3-1290-7ff6-09fr14792a92", "scanType": "Network", "scanName": "Network-test-scan",- "isActive": true, - "target": "127.0.0.1", + "isActive": true, + "target": "127.0.0.1", "orgId": "asdf781a0c-792d-46d3-bbea-a93dbc0bfcaa",- "intervalInHours": 1, + "intervalInHours": 1, "createdBy": "test@contoso.com", "targetType": "Ip", "scanAuthenticationParams": {- "@odata.type": "#microsoft.windowsDefenderATP.api.SnmpAuthParams"", - type": "AuthPriv", -        "username": "username", -        "authProtocol": "authProtocol", -        "authPassword": "authPassword", -        "privProtocol": "privProtocol", -        "privPassword": "privPassword", -        "communityString": "community-string" + "@odata.type": "#microsoft.windowsDefenderATP.api.SnmpAuthParams"", + type": "AuthPriv", + "username": "username", + "authProtocol": "authProtocol", + "authPassword": "authPassword", + "privProtocol": "privProtocol", + "privPassword": "privPassword", + "communityString": "community-string" }, "scannerAgent": { "id": "4asdff0c-3344-46d3-bxxe-a9334rtgfcaa_eb6df89dfdf9032f61eedf14c4b90f77", Here is an example of the response. "status": "Fail", "failureReason": null, "executionDateTime": "2022-12-21T14:35:55.6702703Z"- } + } },- } + } ] } ``` |
| security | Ios Troubleshoot | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-troubleshoot.md | search.appverid: met150 > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +> [!NOTE] +> **Control Filter not working as expected on Supervised devices** +Control Filter is not working as expected from iOS 16.1 onwards. This has impacted the Web Protection capability for Supervised devices without local loopback VPN. The issue has been acknowledge by iOS platform. As a temporary fix, the loopback VPN has been enabled for the affected devices where the users will be asked to setup the loopback VPN. The fix is available with the new version - 1.1.36120102. The issue is expected to be resolved with iOS 16.3. Once the issue is resolved by Apple, we will re-enable the support for Control filter. + + This topic provides troubleshooting information to help you address issues that may arise as you use Microsoft Defender for Endpoint on iOS. > [!NOTE] |
| security | Linux Support Install | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-support-install.md | Verify that the package you are installing matches the host distribution and ver For [manual deployment](linux-install-manually.md), make sure the correct distro and version had been chosen. +## Installation failed due to dependency error ++If the Microsoft Defender for Endpoint installation fails due to missing dependencies errors, you can manually download the pre-requisite dependencies. ++The following external package dependencies exist for the mdatp package: ++The mdatp RPM package requires "glibc >= 2.17", "audit", "policycoreutils", "selinux-policy-targeted", "mde-netfilter" +For RHEL6 the mdatp RPM package requires "audit", "policycoreutils", "libselinux", "mde-netfilter" +For DEBIAN the mdatp package requires "libc6 >= 2.23", "uuid-runtime", "auditd", "mde-netfilter" +++The mde-netfilter package also has the following package dependencies: ++For DEBIAN the mde-netfilter package requires "libnetfilter-queue1", "libglib2.0-0" +For RPM the mde-netfilter package requires "libmnl", "libnfnetlink", "libnetfilter_queue", "glib2" + ## Installation failed Check if the Defender for Endpoint service is running: |
| security | Mac Whatsnew | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-whatsnew.md | The issue impacts Microsoft Defender for endpoint security extensions, and might **What's new** -- Performance improvement - Adding system exclusions during full scan and quick scan - Bug and performance fixes <br/> |
| security | Manage Tamper Protection Microsoft Endpoint Manager | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-tamper-protection-microsoft-endpoint-manager.md | Tamper protection is part of anti-tampering capabilities that include [standard - You must have appropriate [permissions](/microsoft-365/security/defender-endpoint/assign-portal-access) assigned, such as global admin, security admin, or security operations. - Your organization uses [Intune to manage devices](/mem/endpoint-manager-getting-started). (Intune licenses are required; Intune is included in Microsoft 365 E3/E5, Enterprise Mobility + Security E3/E5, Microsoft 365 Business Premium, Microsoft 365 F1/F3, Microsoft 365 Government G3/G5, and corresponding education licenses.)-- Your Windows devices must be running Windows 10 [version 1709 or later](/lifecycle/announcements/revised-end-of-service-windows-10-1709) or Windows 11. (For more information about releases, see [Windows 10 release information](/windows/release-health/release-information).)+- Your Windows devices must be running Windows 10 [version 1709 or later](/lifecycle/announcements/revised-end-of-service-windows-10-1709) or Windows 11. (For more information about releases, see [Windows release information](/windows/release-health/release-information).) - You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above). - Your devices must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version `1.1.15500.X` (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).) - Your Intune and Defender for Endpoint tenants must share the same Microsoft Entra (Azure Active Directory) infrastructure. Tamper protection is part of anti-tampering capabilities that include [standard > [!NOTE] > If your devices are not enrolled in Microsoft Defender for Endpoint, tamper protection will show as **Not Applicable** until the onboarding process completes.+> Tamper protection can prevent changes to security settings from occurring. If you see an error code with Event ID 5013, see [Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus](troubleshoot-microsoft-defender-antivirus.md). ## Turn tamper protection on (or off) in Microsoft Intune |
| security | Mde P1 Setup Configuration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mde-p1-setup-configuration.md | The following table lists the basic requirements for Defender for Endpoint Plan |:|:| | Licensing requirements | Defender for Endpoint Plan 1 (standalone, or as part of Microsoft 365 E3 or A3) | | Browser requirements | Microsoft Edge <br/> Internet Explorer version 11 <br/> Google Chrome |-| Operating systems | Windows 11, or Windows 10, version 1709, or later <br/>macOS (the three most recent releases are supported) <br/>iOS <br/>Android OS <br/><br/>Note that the standalone version of Defender for Endpoint Plan 1 does not include server licenses. To onboard servers, you'll need Defender for Servers Plan 1 or Plan 2 as part of the [Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction) offering. To learn more. see [Overview of Microsoft Defender for Servers](/azure/defender-for-cloud/defender-for-servers-introduction). | +| Operating systems | Windows 11, or Windows 10, version 1709, or later <br/>macOS (the three most recent releases are supported) <br/>iOS <br/>Android OS <br/><br/>Note that the standalone version of Defender for Endpoint Plan 1 does not include server licenses. To onboard servers, you'll need either Microsoft Defender for Endpoint for Servers, or Defender for Servers Plan 1 or Plan 2 (as part of the [Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction)) offering. To learn more. see [Defender for Endpoint onboarding Windows Server](onboard-windows-server.md). | | Datacenter | One of the following datacenter locations: <br/>- European Union <br/>- United Kingdom <br/>- United States | |
| security | Minimum Requirements | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/minimum-requirements.md | ms.pagetype: security ms.localizationpriority: medium Last updated : 01/12/2023 audience: ITPro There are some minimum requirements for onboarding devices to the service. Learn ## Licensing requirements -The standalone versions of [Defender for Endpoint Plan 1 and Plan 2](defender-endpoint-plan-1-2.md), even when they are included as part of other Microsoft 365 plans, do not include server licenses. To onboard servers to those plans, you'll need Defender for Servers Plan 1 or Plan 2 as part of the [Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction) offering. To learn more, see the overview of [Microsoft Defender for Servers](/azure/defender-for-cloud/defender-for-servers-introduction). +The standalone versions of [Defender for Endpoint Plan 1 and Plan 2](defender-endpoint-plan-1-2.md), even when they are included as part of other Microsoft 365 plans, do not include server licenses. To onboard servers to those plans, you'll need either Microsoft Defender for Endpoint for Servers or Defender for Servers Plan 1 or Plan 2 as part of the [Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction) offering. To learn more, see [Defender for Endpoint onboarding Windows Server](onboard-windows-server.md). For information licensing requirements for Microsoft Defender for Endpoint, see [Microsoft Defender for Endpoint licensing information](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#microsoft-defender-for-endpoint). For more information on supported versions of Windows 10, see [Windows 10 releas > > - For virtual environments, we recommend using Windows 10 Enterprise LTSC 2019 or later. >-> - The standalone versions of [Defender for Endpoint Plan 1 and Plan 2](defender-endpoint-plan-1-2.md) do not include server licenses. To onboard servers to those plans, you'll need Defender for Servers Plan 1 or Plan 2 as part of the [Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction) offering. To learn more. see [Overview of Microsoft Defender for Servers](/azure/defender-for-cloud/defender-for-servers-introduction). +> - The standalone versions of [Defender for Endpoint Plan 1 and Plan 2](defender-endpoint-plan-1-2.md) do not include server licenses. To onboard servers to those plans, you'll need either Defender for Endpoint for Servers, or Defender for Servers Plan 1 or Plan 2 (as part of the [Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction) offering). To learn more. see [Defender for Endpoint onboarding Windows Server](onboard-windows-server.md). When components are up-to-date on Microsoft Windows operating systems, Microsoft Defender for Endpoint support will follow the respective operating system's lifecycle. For more information, see [Lifecycle FAQ](/lifecycle/faq/general-lifecycle). New features or capabilities are typically provided only on operating systems that have not yet reached the end of their lifecycle. Security intelligence updates (definition and engine updates) and detection logic will continue to be provided until at least: |
| security | Prevent Changes To Security Settings With Tamper Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection.md | During some kinds of cyber attacks, bad actors try to disable security features, > When tamper protection is turned on, tamper protected settings cannot be changed from their default value. Changes might appear to be successful in Intune, but will not actually be allowed by tamper protection. For the most current list of tamper protected settings, contact support. -### How it works +## How tamper protection works Tamper protection essentially locks Microsoft Defender Antivirus to its secure, default values, and prevents your security settings from being changed through apps and methods such as: Tamper protection essentially locks Microsoft Defender Antivirus to its secure, Tamper protection doesn't prevent you from viewing your security settings. And, tamper protection doesn't affect how non-Microsoft antivirus apps register with the Windows Security app. If your organization is using Defender for Endpoint, individual users can't change the tamper protection setting; in those cases, tamper protection is managed by your security team. -### What do you want to do? +## Tamper protection and cloud protection + +Depending on the method or management tool you use to enable tamper protection, there might be a dependency on [cloud-delivered protection](cloud-protection-microsoft-defender-antivirus.md). Cloud-delivered protection is also referred to as cloud protection, or Microsoft Advanced Protection Service (MAPS). The following table summarizes whether there's a dependency on cloud protection. -|To perform this task...|See this section...| +| How tamper protection is enabled | Dependency on cloud protection? | |||-|Manage tamper protection across your tenant <p> Use the Microsoft 365 Defender portal to turn tamper protection on or off|[Manage tamper protection for your organization using Microsoft 365 Defender](manage-tamper-protection-microsoft-365-defender.md)| -|Fine-tune tamper protection settings in your organization <p> Use Microsoft Intune to turn tamper protection on or off. You can configure tamper protection for some or all users with this method.|[Manage tamper protection for your organization using Intune](manage-tamper-protection-microsoft-endpoint-manager.md)| +|Microsoft Intune|No| +|Microsoft Endpoint Configuration Manager with Tenant Attach|No| +|Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com))|Yes| ++## Methods to configure tamper protection ++The following table lists the various methods you can use to configure tamper protection: ++|To perform this task...|See this content...| +||| +|Manage tamper protection across your tenant <br/><br/> Use the Microsoft 365 Defender portal to turn tamper protection on or off|[Manage tamper protection for your organization using Microsoft 365 Defender](manage-tamper-protection-microsoft-365-defender.md)| +|Fine-tune tamper protection settings in your organization <br/><br/> Use Microsoft Intune to turn tamper protection on or off. You can configure tamper protection for some or all users with this method.|[Manage tamper protection for your organization using Intune](manage-tamper-protection-microsoft-endpoint-manager.md)| +| Protect Microsoft Defender Antivirus exclusions | [What about exclusions?](#what-about-exclusions) <br/><br/>[How to determine whether the functionality to protect exclusions is enabled on a Windows device](#how-to-determine-whether-the-functionality-to-protect-exclusions-is-enabled-on-a-windows-device) | |Turn tamper protection on (or off) for your organization by using Configuration Manager|[Manage tamper protection for your organization using tenant attach with Configuration Manager, version 2006](manage-tamper-protection-configuration-manager.md)|-|Turn tamper protection on (or off) for an individual device (for home users or devices that are not managed by a security team)|[Manage tamper protection on an individual device](manage-tamper-protection-individual-device.md)| +|Turn tamper protection on (or off) for an individual device (for home users or devices that aren't managed by a security team)|[Manage tamper protection on an individual device](manage-tamper-protection-individual-device.md)| |View details about tampering attempts on devices|[View information about tampering attempts in Microsoft 365 Defender](#view-information-about-tampering-attempts)| |Review your security recommendations |[Review security recommendations](#review-your-security-recommendations)| |Review the list of frequently asked questions (FAQs)|[Browse the FAQs](faqs-tamper-protection.md)| -## Potential dependency on cloud protection - -Depending on the method or management tool you use to enable tamper protection, there might be a dependency on [cloud-delivered protection](cloud-protection-microsoft-defender-antivirus.md). Cloud-delivered protection is also referred to as cloud protection, or Microsoft Advanced Protection Service (MAPS). +## What about exclusions? -The following table provides details on the methods, tools, and dependencies. +If your organization has [exclusions defined for Microsoft Defender Antivirus](configure-exclusions-microsoft-defender-antivirus.md), tamper protection will protect those exclusions, provided all of the following conditions are met: -| How tamper protection is enabled | Dependency on cloud protection | -||| -|Microsoft Intune|No| -|Microsoft Endpoint Configuration Manager with Tenant Attach|No| -|Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com))|Yes| +- `DisableLocalAdminMerge` is enabled. (See [DisableLocalAdminMerge](/windows/client-management/mdm/defender-csp).) +- Microsoft Defender Antivirus exclusions are managed in Microsoft Intune. (See [Settings for Microsoft Defender Antivirus policy in Microsoft Intune for Windows devices](/mem/intune/protect/antivirus-microsoft-defender-settings-windows).) +- Tamper protection is deployed and managed by using Intune. (See [Manage tamper protection for your organization using Microsoft Intune](manage-tamper-protection-microsoft-endpoint-manager.md).) +- Devices are running Windows Defender platform `4.18.2111.*` or later. (See [Monthly platform and engine versions](manage-updates-baselines-microsoft-defender-antivirus.md#monthly-platform-and-engine-versions).) +- Functionality to protect exclusions is enabled on devices. (See [How to determine whether the functionality is enabled on a Windows device](#how-to-determine-whether-the-functionality-to-protect-exclusions-is-enabled-on-a-windows-device).) ++> [!TIP] +> For more detailed information about exclusions, see [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md). ++### How to determine whether the functionality to protect exclusions is enabled on a Windows device ++You can use a registry key to determine whether the functionality to protect Microsoft Defender Antivirus exclusions is enabled. ++1. On a Windows device open Registry Editor. (Read-only mode is fine; you won't be editing the registry key.) ++2. Go to `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features` (or `HKLM\SOFTWARE\Microsoft\Windows Defender\Features`), and look for a `REG_DWORD` entry called **TPExclusions**. ++ - If **TPExclusions** has a value of `1`, then the new functionality to protect exclusions is enabled on the device. + - If **TPExclusions** has a value of `0`, then tamper protection isn't currently protecting exclusions on the device. ++> [!CAUTION] +> Do not change the value of **TPExclusions**. Use the preceding procedure for information only. Changing the key will have no effect on whether tamper protection applies to exclusions. ## Are you using Windows Server 2012 R2, 2016, or Windows version 1709, 1803, or 1809? If you're using Windows Server 2012 R2 using the modern unified solution, Windows Server 2016, Windows 10 version 1709, 1803, or [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), you won't see **Tamper Protection** in the Windows Security app. Instead, you can use PowerShell to determine whether tamper protection is enabled. -On Windows Server 2016, the Settings app won't accurately reflect the status of real-time protection when tamper protection is enabled. +> [!IMPORTANT] +> On Windows Server 2016, the Settings app won't accurately reflect the status of real-time protection when tamper protection is enabled. ### Use PowerShell to determine whether tamper protection and real-time protection are turned on On Windows Server 2016, the Settings app won't accurately reflect the status of ## View information about tampering attempts -Tampering attempts typically indicate bigger cyberattacks. Bad actors try to change security settings as a way to persist and stay undetected. If you're part of your organization's security team, you can view information about such attempts, and then take appropriate actions to mitigate threats. +Tampering attempts typically indicate that a larger cyberattack has taken place. Bad actors try to change security settings as a way to persist and stay undetected. If you're part of your organization's security team, you can view information about such attempts, and then take appropriate actions to mitigate threats. -When a tampering attempt is detected, an alert is raised in the [Microsoft 365 Defender portal](/microsoft-365/security/defender-endpoint/portal-overview) ([https://security.microsoft.com](https://security.microsoft.com)). +Whenever a tampering attempt is detected, an alert is raised in the [Microsoft 365 Defender portal](/microsoft-365/security/defender-endpoint/portal-overview) ([https://security.microsoft.com](https://security.microsoft.com)). Using [endpoint detection and response](overview-endpoint-detection-response.md) and [advanced hunting](advanced-hunting-overview.md) capabilities in Microsoft Defender for Endpoint, your security operations team can investigate and address such attempts. |
| security | Printer Protection Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/printer-protection-overview.md | search.appverid: met150 - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) > [!NOTE]-> The Group Policy management and Intune OMA-URI/Custom Policy management of this product have been release, if you are currently using [Microsoft Defender for Endpoint Device Control Printer Protection | Microsoft Learn](printer-protection-overview.md), we recommend you upgrade. +> The Group Policy management and Intune OMA-URI/Custom Policy management of this product have been released. If you're currently using [Microsoft Defender for Endpoint Device Control Printer Protection](printer-protection-overview.md), we recommend that you upgrade. ## Overview -Microsoft Defender for Endpoint Device Control Printer Protection feature enables you to audit, allow, or prevent printer with or without exclusions. +Microsoft Defender for Endpoint Device Control Printer Protection feature enables you to audit, allow, or prevent printer with or without exclusions. |Privilege|Permission|-||| +||::| |Access|Read, Write, Execute| |Action Mode|Audit, Allow, Prevent| |CSP Support|Yes| Microsoft Defender for Endpoint Device Control Printer Protection feature enable |User-based Support|Yes| |Machine-based Support|Yes| -### Prerequisites for preview +### Prerequisites for preview Ensure that the Windows devices that you need to onboard should meet the following requirements: 1. Install the right OS KB:- -- [KB5020030 (OS Builds 19042.2311, 19043.2311, 19044.2311, and 19045.2311) Preview Microsoft Support](https://support.microsoft.com/en-us/topic/november-15-2022-kb5020030-os-builds-19042-2311-19043-2311-19044-2311-and-19045-2311-preview-237a9048-f853-4e29-a3a2-62efdbea95e2)-- [KB5019157 (OS Build 22000.1281) Preview - Microsoft Support](https://support.microsoft.com/en-us/topic/november-15-2022-kb5019157-os-build-22000-1281-preview-d64fb317-3435-49ff-b2c4-d0356a51a6b0)- -2. MOCAMP:4.18.2205 or later, you can run the command `Get-MpComputerStatus `on PowerShell to check the version. ++ - [KB5020030 (OS Builds 19042.2311, 19043.2311, 19044.2311, and 19045.2311) Preview Microsoft Support](https://support.microsoft.com/topic/november-15-2022-kb5020030-os-builds-19042-2311-19043-2311-19044-2311-and-19045-2311-preview-237a9048-f853-4e29-a3a2-62efdbea95e2) + - [KB5019157 (OS Build 22000.1281) Preview - Microsoft Support](https://support.microsoft.com/topic/november-15-2022-kb5019157-os-build-22000-1281-preview-d64fb317-3435-49ff-b2c4-d0356a51a6b0) ++2. MOCAMP:4.18.2205 or later, you can run the command `Get-MpComputerStatus` in PowerShell to check the version. :::image type="content" source="images/administrator-windows-powershell.png" alt-text="This is administrator windows powershell."::: Ensure that the Windows devices that you need to onboard should meet the followi The printer protection comprises group and policy configurations: -- Group configuration allows you to create group. For example, authorized USB printer group or network location group. -- Policy configuration allows you to create policy to restrict each printer group. For example, only allow authorized users to Print access authorized printer group. +- Group configuration allows you to create group. For example, authorized USB printer group or network location group. +- Policy configuration allows you to create policy to restrict each printer group. For example, only allow authorized users to Print access authorized printer group. -**Group configuration** +#### Group configuration Group configuration includes the following types: The table below lists the properties you can use in **Group**: |Property Name|Description|Options| ||||-|Group ID |GUID, a unique ID, represents the group and will be used in the policy.|You can generate the group ID through  [PowerShell](/powershell/module/microsoft.powershell.utility/new-guid?view=powershell-7.3&preserve-view=true)| -|Name |String, the name of the policy and will display on the toast based on the policy setting. | -|Type |The type of the group. |<li> Device</li><li>Network</li><li>VPN Connection</li><li>PrintJob</li><p><b>Note:</b></p>Default type is Device that includes removable storage and printer. For any other group you define in your Group setting, make sure explicitly mark Type, for example, Type="File". -|DescriptorIdList|List the device properties you want to use to cover in the group. All properties are case sensitive.|When the Group type is Device, following are the attributes you can use inside DescriptorIdList: <li> PrimaryId: The Primary ID includes RemovableMediaDevices, CdRomDevices, WpdDevices, PrinterDevices. </li><li> FriendlyNameId: It's a string attached to the device, for example, Generic Flash Disk USB Device. It's the Friendly name in the Device Manager. </li><li> Device</li>VID_PID: Vendor ID is the four-digit vendor code that the USB committee assigns to the vendor. Product ID is the four-digit product code that the vendor assigns to the device. It supports wildcard. To transform Device instance path to Vendor ID and Product ID format, see  [Standard USB Identifiers](/windows-hardware/drivers/install/standard-usb-identifiers). For example:<b>0751_55E0: match this exact VID/PID pair</b><b>_55E0: match any media with PID=55E0</b><b>_0751_: match any media with VID=0751 </b> PrinterConnectionId: The PrinterConnectionId includes:<li> USB: A printer connected through USB port of a computer. You can use this if you want to enforce any USB printer, if you want to define specific USB printer then use the VID_PID.</li> <li> Corporate: A corporate printer is a print queue shared through on-premises Windows print server in your domain. Its path might look like \print-server\contoso.com\legal_printer_001. </li> <li> Network: A network printer is a printer that is accessible by network connection, making it usable by other computers connected to the network. </li> <li> Universal: See, Set up Universal Print for more information on universal printers. </li> <li> File: Microsoft Print to PDF or Microsoft XPS Document Writer. If you only want to enforce Microsoft Print to PDF, you should use Friendly printer name with 'Microsoft Print to PDF'.</li> <li> Custom: Any printer not connecting through Microsoft print port.</li> <li> Local: Any printer connecting through Microsoft print port but not any of above type, for example print through remote desktop or redirect printer. </li> **When the Group type is Network, following are the attributes you can use inside DescriptorIdList:** <li> NameId: The name of the Network, support wildcard. </li> <li> NetworkCategoryId: includes Public, Private, DomainAuthenticated. </li> <li> NetworkDomainId: includes NonDomain, Domain, DomainAuthenticated. </li> **When the Group type is VPNConnection, following are the attributes you can use inside DescriptorIdList:** <li> NameId: The name of the VPN Connection, support wildcard. </li> <li> VPNConnectionStatusId: includes Connected, Disconnected. </li> <li> VPNServerAddressId: string, value of VPNServerAddress, support. </li> <li> VPNDnsSuffixId: string, value of VPNDnsSuffix, support wildcard. </li> **When the Group type is PrintJob, following are the attributes you can use inside DescriptorIdList:** <li> PrintOutputFileNameId: Print to file, the output destination file path, support wildcard, for example, C:\*\Test.pdf </li> <li> PrintDocumentNameId: The source file path, support wildcard. This may not exist, e.g. open a `notepad.exe`, type and print without saving to the disk.</li> -|MatchType|When there are multiple device properties being used in the `DescriptorIDList`, MatchType defines the relationship.|<li> **MatchAll**: Any attributes under the DescriptorIdList will be And relationship; for example, if administrator puts DeviceID and InstancePathID, for every connected USB, system will check to see whether the USB meets both values. </li><li>**MatchAny**: The attributes under the DescriptorIdList will be Or relationship; for example, if administrator puts DeviceID and InstancePathID, for every connected USB, system will do the enforcement as long as the USB has either an identical DeviceID or InstanceID value. </li><li>**MatchExcludeAll**: The attributes under the DescriptorIdList will be And relationship, any items that do NOT meet will be covered. For example, if administrator puts DeviceID and InstancePathID and uses MatchExcludeAll, for every connected USB, system will do the enforcement as long as the USB doesn't have both identical DeviceID and InstanceID value.</li><li>**MatchExcludeAny**: The attributes under the DescriptorIdList will be Or relationship, any items that do NOT meet will be covered. For example, if administrator puts DeviceID and InstancePathID and uses MatchExcludeAny, for every connected USB, system will do the enforcement as long as the USB doesn't have either an identical DeviceID or InstanceID value.</li>| +|Group ID|GUID, a unique ID, represents the group and will be used in the policy.|You can generate the group ID through [PowerShell](/powershell/module/microsoft.powershell.utility/new-guid?view=powershell-7.3&preserve-view=true)| +|Name|String, the name of the policy and will display on the toast based on the policy setting.| +|Type|The type of the group.|<ul><li>Device</li><li>Network</li><li>VPN Connection</li><li>PrintJob</li></ul> <p> **Note:** Default type is Device that includes removable storage and printer. For any other group you define in your Group setting, make sure explicitly mark Type, for example, Type="File".| +|DescriptorIdList|List the device properties you want to use to cover in the group. All properties are case sensitive.|When the Group type is Device, you can use the following attributes inside DescriptorIdList: <ul><li>PrimaryId: The Primary ID includes: <ul><li>RemovableMediaDevices</li><li>CdRomDevices</li><li>WpdDevices</li><li>PrinterDevices</li></ul></li><li>FriendlyNameId: A string that's attached to the device (the same string as the Friendly name in Device Manager). For example, `Generic Flash Disk USB Device`.</li><li>Device instance path (VID_PID): <ul><li>Vendor ID (VID): The four-digit vendor code that's assigned to the vendor by the USB committee.</li><li>Product ID (PID): The four-digit product code that's assigned to the device by the vendor. Wildcards are supported.</li></ul> <p> To transform the Device instance path to the VID_PID format, see [Standard USB Identifiers](/windows-hardware/drivers/install/standard-usb-identifiers). For example: <ul><li>`0751_55E0` matches that exact VID_PID pair value.</li><li>`_55E0` matches any device with the PID value 55E0.</li><li>`0751_` matches any device with the VID value 0751.</li></ul></li><li>PrinterConnectionId: Includes the following values: <ul><li>USB: A printer that's connected through USB port of a computer. You can use this value to enforce any USB printer. To define a specific USB printer, use the VID_PID.</li><li>Corporate: A print queue that's shared through a Windows print server in your on-premises domain. For example, `\print-server\contoso.com\legal_printer_001`.</li><li>Network: A printer that's accessible by network connection, making it usable by other computers that are connected to the network.</li><li>Universal: For more information about universal printers, see [Set up Universal Print](/universal-print/fundamentals/universal-print-getting-started).</li><li>File: Microsoft Print to PDF or Microsoft XPS Document Writer. To enforce Microsoft Print to PDF only, use the FriendlyNameId value 'Microsoft Print to PDF'.</li><li>Custom: A printer that doesn't connect through a Microsoft print port.</li><li>Local: A printer that connects through a Microsoft print port, but not any of the previously described types. For example, print through Remote Desktop or redirect printer.</li></ul> </li></ul> <p> **When the Group type is Network, you can use the following attributes inside DescriptorIdList**: <ul><li>NameId: The name of the Network. Wildcards are supported.</li><li>NetworkCategoryId: Public, Private, or DomainAuthenticated.</li><li>NetworkDomainId: NonDomain, Domain, or DomainAuthenticated.</li></ul> <p> **When the Group type is VPNConnection, you can use the following attributes inside DescriptorIdList**: <ul><li>NameId: The name of the VPN Connection. Wildcards are supported.</li><li>VPNConnectionStatusId: Connected or Disconnected.</li><li>VPNServerAddressId: The value of VPNServerAddress (string). Wildcards are supported.</li><li>VPNDnsSuffixId: The value of VPNDnsSuffix (string). Wildcards are supported.</li></ul> <p> **When the Group type is PrintJob, you can use the following attributes inside DescriptorIdList**: <ul><li>PrintOutputFileNameId: The output destination file path for print to file. Wildcards are supported. For example, `C:\*\Test.pdf`</li><li>PrintDocumentNameId: The source file path. Wildcards are supported. This path may not exist. For example, add text to a new file in Notepad, and then print without saving the file.</li></ul>| +|MatchType|When there are multiple device properties being used in the `DescriptorIDList`, MatchType defines the relationship.|<ul><li>**MatchAll**: Any attributes under the DescriptorIdList will be And relationship; for example, if administrator puts DeviceID and InstancePathID, for every connected USB, system will check to see whether the USB meets both values. </li><li>**MatchAny**: The attributes under the DescriptorIdList will be Or relationship; for example, if administrator puts DeviceID and InstancePathID, for every connected USB, system will do the enforcement as long as the USB has either an identical DeviceID or InstanceID value.</li><li>**MatchExcludeAll**: The attributes under the DescriptorIdList will be And relationship, any items that do NOT meet will be covered. For example, if administrator puts DeviceID and InstancePathID and uses MatchExcludeAll, for every connected USB, system will do the enforcement as long as the USB doesn't have both identical DeviceID and InstanceID value.</li><li>**MatchExcludeAny**: The attributes under the DescriptorIdList will be Or relationship, any items that do NOT meet will be covered. For example, if administrator puts DeviceID and InstancePathID and uses MatchExcludeAny, for every connected USB, system will do the enforcement as long as the USB doesn't have either an identical DeviceID or InstanceID value.</li></ul>| ## Access policy rule -Every access policy rule called PolicyRule can be used to define access restriction for each Device type group through multiple Entry. +Every access policy rule called PolicyRule can be used to define access restriction for each Device type group through multiple Entry. -The table below lists the properties you can use in **PolicyRule**: +The table below lists the properties you can use in **PolicyRule**: |Property Name|Description|Options| ||||-|PolicyRule ID|GUID, a unique ID, represents the policy and will be used in the reporting and troubleshooting.|You can generate the group ID through  [PowerShell](/powershell/module/microsoft.powershell.utility/new-guid?view=powershell-7.3&preserve-view=true)| -|Name |String, the name of the policy and will display on the toast based on the policy setting and will be captured in the reporting.| -|IncludedIdList|The group(s) that the policy will be applied to. If multiple groups are added, the policy will be applied to any media in all those groups. |The Group ID/GUID must be used at this instance. The following example shows the usage of GroupID: {EAA4CCE5-F6C9-4760-8BAD-FDCC76A2ACA1}<p><b>Note:</b></p> You shouldn't add multiple groups inside IncludedIdList, instead, add all groups into a new group and then add the new group inside IncludedIdList.| -|ExcludedIDList |The group(s) that the policy won't be applied to.|The Group ID/GUID must be used at this instance.| -|Entry |One PolicyRule can have multiple entries; each entry with a unique GUID tells Device Control one restriction. |See Entry properties table below for more details.| +|PolicyRule ID|GUID, a unique ID, represents the policy and will be used in the reporting and troubleshooting.|You can generate the group ID through [PowerShell](/powershell/module/microsoft.powershell.utility/new-guid?view=powershell-7.3&preserve-view=true)| +|Name|String, the name of the policy and will display on the toast based on the policy setting and will be captured in the reporting.| +|IncludedIdList|The group(s) that the policy will be applied to. If multiple groups are added, the policy will be applied to any media in all those groups.|The Group ID/GUID must be used at this instance. The following example shows the usage of GroupID: {EAA4CCE5-F6C9-4760-8BAD-FDCC76A2ACA1} <p> **Note**: You shouldn't add multiple groups inside IncludedIdList. Instead, add all groups into a new group and then add the new group inside IncludedIdList.| +|ExcludedIDList|The group(s) that the policy won't be applied to.|The Group ID/GUID must be used at this instance.| +|Entry|One PolicyRule can have multiple entries; each entry with a unique GUID tells Device Control one restriction.|See Entry properties table below for more details.| -The table below lists the properties you can use in **Entry**: +The table below lists the properties you can use in **Entry**: |Property Name|Description|Options| ||||-|PolicyRule ID|GUID, a unique ID, represents the policy and will be used in the reporting and troubleshooting.|You can generate the group ID through  [PowerShell](/powershell/module/microsoft.powershell.utility/new-guid?view=powershell-7.3&preserve-view=true)| -|Type |Defines the action for the removable storage groups in IncludedIDList.<li> Enforcement: Allow or Deny</li> <li> Audit: AuditAllowed or AuditDenied | <li> Allow</li> <li> Deny</li><li> AuditAllowed: Defines event when access is allowed</li> <li> AuditDenied: Defines notification and event when access is denied; has to work together with Deny entry. </li> When there are conflict types for the same media, the system will apply the first one in the policy. An example of a conflict type is  **Allow**  and  **Deny**.| -|Sid |Local user Sid or user Sid group or the Sid of the AD object or the Object ID of the Azure AD object, defines whether to apply this policy over a specific user or user group. One entry can have a maximum of one SID and an entry without any SID means to apply the policy over the machine.| -|ComputerSid|Local computer Sid or computer Sid group or the Sid of the AD object or the Object ID of the AAD object, defines whether to apply this policy over a specific machine or machine group. One entry can have a maximum of one ComputerSID and an entry without any ComputerSID means to apply the policy over the machine. If you want to apply an Entry to a specific user and specific machine, add both SID and ComputerSID into the same Entry. | -|Options|Defines whether to display notification or not|**When Type Allow is selected:**<li> 0: nothing </li> <li> 4: disable AuditAllowed and AuditDenied for this Entry. Even if Allow happens and the AuditAllowed is setting configured, the system won't send event. </li> <li> 8: capture file information and have a copy of the file as evidence for Write access. </li> <li> 16: capture printed content. </li> **When Type Deny is selected:**<li> 0: nothing </li> <li> 4: disable AuditDenied for this Entry. Even if Block happens and the AuditDenied is setting configured, the system won't show notification. </li> **When Type AuditAllowed is selected:**<li> 0: nothing </li> <li> 1: nothing </li> <li> 2: send event </li> **When Type AuditDenied is selected:**<li> 0: nothing </li> <li> 1: show notification </li> <li> 2: send event </li> <li> 3: show notification and send event </li> <li> 4: print </li>| -|AccessMask |Defines the access. | -|Parameters |Condition for this Entry, for example, network condition.| Can add groups (non-devices type) or even put Parameters into Parameters. See Parameters properties table below for more details.| +|PolicyRule ID|GUID, a unique ID, represents the policy and will be used in the reporting and troubleshooting.|You can generate the group ID through [PowerShell](/powershell/module/microsoft.powershell.utility/new-guid?view=powershell-7.3&preserve-view=true)| +|Type|Defines the action for the removable storage groups in IncludedIDList. <ul><li>Enforcement: Allow or Deny</li><li>Audit: AuditAllowed or AuditDenied</li></ul>|<ul><li>Allow</li><li>Deny</li><li>AuditAllowed: Defines event when access is allowed</li><li>AuditDenied: Defines notification and event when access is denied; has to work together with Deny entry.</li></ul> <p> When there are conflict types for the same media, the system will apply the first one in the policy. An example of a conflict type is **Allow** and **Deny**.| +|Sid|Local user Sid or user Sid group or the Sid of the AD object or the Object ID of the Azure AD object, defines whether to apply this policy over a specific user or user group. One entry can have a maximum of one SID and an entry without any SID means to apply the policy over the machine.| +|ComputerSid|Local computer Sid or computer Sid group or the Sid of the AD object or the Object ID of the AAD object, defines whether to apply this policy over a specific machine or machine group. One entry can have a maximum of one ComputerSID and an entry without any ComputerSID means to apply the policy over the machine. If you want to apply an Entry to a specific user and specific machine, add both SID and ComputerSID into the same Entry.| +|Options|Defines whether to display notification or not|**When Type Allow is selected:** <ul><li>0: nothing</li><li>4: disable AuditAllowed and AuditDenied for this Entry. Even if Allow happens and the AuditAllowed is setting configured, the system won't send events.</li><li>8: capture a copy of the file as evidence; must be used together with the **Set location for a copy of the file** setting.</li></ul> <p> **When Type Deny is selected:**<ul><li>0: nothing</li><li>4: disable AuditDenied for this entry. Even if Block happens and the AuditDenied is setting configured, the system won't show notifications.</li></ul> <p> **When Type AuditAllowed is selected:** <ul><li>0: nothing</li><li>1: nothing</li><li>2: send event</li></ul> <p> **When Type AuditDenied is selected:** </ul><li>0: nothing</li><li>1: show notification</li><li>2: send events</li><li>3: show notification and send events</li><li>4: print</li></ul>| +|AccessMask|Defines the access.|64: Print| +|Parameters|Condition for this Entry, for example, network condition.|Can add groups (non-devices type) or even put Parameters into Parameters. See Parameters properties table below for more details.| -The table below lists the properties you can use in **Parameters**: +The table below lists the properties you can use in **Parameters**: |Property Name|Description|Options| ||||-|MatchType | When there are multiple device properties being used in the DescriptorIDList, MatchType defines the relationship.| **MatchAll:**<li> Any attributes under the DescriptorIdList will be And relationship; for example, if administrator puts DeviceID and InstancePathID, for every connected USB, system will check to see whether the USB meets both values.</li> **MatchAny:**</li> The attributes under the DescriptorIdList will be Or relationship; for example, if administrator puts DeviceID and InstancePathID, for every connected USB, system will do the enforcement as long as the USB has either an identical DeviceID or InstanceID value. </li> **MatchExcludeAll:**<li> The attributes under the DescriptorIdList will be And relationship, any items that do NOT meet will be covered. For example, if administrator puts DeviceID and InstancePathID and uses MatchExcludeAll, for every connected USB, system will do the enforcement as long as the USB doesn't have both identical DeviceID and InstanceID value.</li> **MatchExcludeAny:**<li> The attributes under the DescriptorIdList will be Or relationship, any items that do NOT meet will be covered. For example, if administrator puts DeviceID and InstancePathID and uses MatchExcludeAny, for every connected USB, system will do the enforcement as long as the USB doesn't have either an identical DeviceID or InstanceID value.</li>| -|PrintJob Network VPNConnection| The PrintJob or Network or VPNConnection group(s) created above.| Use the GroupId of the PrintJob or Network or VPNConnection group(s) created above.| -|Parameters | You can embed Parameters inside Parameters with MatchType. | +|MatchType|When there are multiple device properties being used in the DescriptorIDList, MatchType defines the relationship.|**MatchAll:** <ul><li> Any attributes under the DescriptorIdList will be And relationship; for example, if administrator puts DeviceID and InstancePathID, for every connected USB, system will check to see whether the USB meets both values.</li></ul> <p> **MatchAny:** <ul></li>The attributes under the DescriptorIdList will be Or relationship; for example, if administrator puts DeviceID and InstancePathID, for every connected USB, system will do the enforcement as long as the USB has either an identical DeviceID or InstanceID value.</li></ul> <p> **MatchExcludeAll:** <ul><li>The attributes under the DescriptorIdList will be And relationship, any items that do NOT meet will be covered. For example, if administrator puts DeviceID and InstancePathID and uses MatchExcludeAll, for every connected USB, system will do the enforcement as long as the USB doesn't have both identical DeviceID and InstanceID value.</li></ul> <p> **MatchExcludeAny:** <ul><li>The attributes under the DescriptorIdList will be Or relationship, any items that do NOT meet will be covered. For example, if administrator puts DeviceID and InstancePathID and uses MatchExcludeAny, for every connected USB, system will do the enforcement as long as the USB doesn't have either an identical DeviceID or InstanceID value.</li></ul>| +|PrintJob Network VPNConnection|The PrintJob or Network or VPNConnection group(s) created above.|Use the GroupId of the PrintJob or Network or VPNConnection group(s) created above.| +|Parameters|You can embed Parameters inside Parameters with MatchType.| ## Enduser experience You can view the policy name and printer information if you have right options setting in your policy. |
| security | Respond Machine Alerts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/respond-machine-alerts.md | - + Title: Take response actions on a device in Microsoft Defender for Endpoint description: Take response actions on a device such as isolating devices, collecting an investigation package, managing tags, running an av scan, and restricting app execution. keywords: respond, isolate, isolate device, collect investigation package, action center, restrict, manage tags, av scan, restrict app Response actions run along the top of a specific device page and include: > [!IMPORTANT] > - These response actions are only available for devices on Windows 10, version 1703 or later, Windows 11, Windows Server 2019, and Windows Server 2022.-> - For non-Windows platforms, response capabilities (such as Device isolation) are dependent on the third-party capabilities. +> - For non-Windows platforms, response capabilities (such as isolate device) are dependent on the third-party capabilities. > - For Microsoft first party agents, please refer to the "more information" link under each feature for minimum OS requirements. ## Manage tags When an app is restricted, the following notification is displayed to inform the :::image type="content" source="images/atp-app-restriction.png" alt-text="The application restriction message" lightbox="images/atp-app-restriction.png"::: -> [!NOTE] -> The notification is not available on Windows Server 2016 and Windows Server 2012 R2. +>[!NOTE] +>The notification is not available on Windows Server 2016 and Windows Server 2012 R2. ## Isolate devices from the network Depending on the severity of the attack and the sensitivity of the device, you might want to isolate the device from the network. This action can help prevent the attacker from controlling the compromised device and performing further activities such as data exfiltration and lateral movement. ++ > [!IMPORTANT]-> - Isolating devices from the network is not currently supported for devices running macOS or Linux. For macOS, use live response to run the action. For more information on live response, see [Investigate entities on devices using live response](live-response.md). +> - Isolating devices from the network is not currently supported for devices running macOS. For macOS, use live response to run the action. For more information on live response, see [Investigate entities on devices using live response](live-response.md). > - Full isolation is available for devices running Windows 11, Windows 10, version 1703 or later, Windows Server 2022, Windows Server 2019, and Windows Server 2016.+>- You can use the device isolation capability **in public preview** on all supported Microsoft Defender for Endpoint on Linux listed in [System requirements](microsoft-defender-endpoint-linux.md#system-requirements). > - Selective isolation is available for devices running Windows 10, version 1709 or later, and Windows 11. > - When isolating a device, only certain processes and destinations are allowed. Therefore, devices that are behind a full VPN tunnel won't be able to reach the Microsoft Defender for Endpoint cloud service after the device is isolated. We recommend using a split-tunneling VPN for Microsoft Defender for Endpoint and Microsoft Defender Antivirus cloud-based protection-related traffic.+>- The feature supports VPN connection. +>- You must have at least one the following role permissions: 'Active remediation actions'. For more information, see [Create and manage roles](user-roles.md). +>- You must have access to the device based on the device group settings. For more information, see [Create and manage device groups](machine-groups.md). +>- Exclusion for Linux isolation is not supported. This device isolation feature disconnects the compromised device from the network while retaining connectivity to the Defender for Endpoint service, which continues to monitor the device. + On Windows 10, version 1709 or later, you'll have more control over the network isolation level. You can also choose to enable Outlook, Microsoft Teams, and Skype for Business connectivity (a.k.a 'Selective Isolation'). + > [!NOTE] > You'll be able to reconnect the device back to the network at any time. The button on the device page will change to say **Release from isolation**, and then you take the same steps as isolating the device. ++ Once you have selected **Isolate device** on the device page, type a comment and select **Confirm**. The Action center will show the scan information and the device timeline will include a new event. :::image type="content" source="images/isolate-device.png" alt-text="An isolated device details page" lightbox="images/isolate-device.png"::: When a device is being isolated, the following notification is displayed to info :::image type="content" source="images/atp-notification-isolate.png" alt-text="A no network connection message" lightbox="images/atp-notification-isolate.png"::: ++>[!NOTE] +>The notification is not available on non-Windows platforms. + ## Contain devices from the network > [!NOTE] |
| security | Switch To Mde Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/switch-to-mde-overview.md | Title: Migrate to Microsoft Defender for Endpoint from non-Microsoft endpoint protection -description: Make the switch to Microsoft Defender for Endpoint, which includes Microsoft Defender Antivirus for your endpoint protection solution. +description: Move to Microsoft Defender for Endpoint, which includes Microsoft Defender Antivirus for your endpoint protection solution. keywords: migration, windows defender, advanced endpoint protection, antivirus, antimalware, passive mode, active mode ms.mktglfcycl: deploy |
| security | Switch To Mde Phase 1 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/switch-to-mde-phase-1.md | Title: Migrate to Microsoft Defender for Endpoint - Prepare -description: Get ready to make the switch to Microsoft Defender for Endpoint. Update your devices and configure your network connections. +description: Get ready to move to Microsoft Defender for Endpoint. Update your devices and configure your network connections. keywords: migration, Microsoft Defender for Endpoint, best practice To enable communication between your devices and Defender for Endpoint, you migh \* Windows Server 2016 and Windows Server 2012 R2 require installation of the modern, unified solution for Windows Server 2012 R2 and 2016. For more information, see [Onboard Windows servers to Defender for Endpoint: Windows Server 2012 R2 and Windows Server 2016](/microsoft-365/security/defender-endpoint/configure-server-endpoints#windows-server-2012-r2-and-windows-server-2016). > [!IMPORTANT]-> The standalone versions of Defender for Endpoint Plan 1 and Plan 2 do not include server licenses. To onboard servers, you'll need an additional license, such as [Defender for Servers Plan 1 or Plan 2](/azure/defender-for-cloud/plan-defender-for-servers-select-plan). +> The standalone versions of Defender for Endpoint Plan 1 and Plan 2 do not include server licenses. To onboard servers, you'll need an additional license, such as either Defender for Endpoint for Servers, or [Defender for Servers Plan 1 or Plan 2](/azure/defender-for-cloud/plan-defender-for-servers-select-plan). To learn more, see [Defender for Endpoint onboarding Windows Server](onboard-windows-server.md). ## Next step |
| security | Switch To Mde Phase 2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2.md | Title: Migrate to Microsoft Defender for Endpoint - Setup -description: Make the switch to Defender for Endpoint. Review the setup process, which includes installing Microsoft Defender Antivirus. +description: Move to Defender for Endpoint. Review the setup process, which includes installing Microsoft Defender Antivirus. keywords: migration, Microsoft Defender for Endpoint, antivirus, passive mode, setup process ms.pagetype: security ms.localizationpriority: medium Previously updated : 01/10/2023 Last updated : 01/12/2023 audience: ITPro Device groups, device collections, and organizational units enable your security ## Next step -**Congratulations**! You've completed the Setup phase of [switching to Defender for Endpoint](switch-to-mde-overview.md#the-migration-process)! +**Congratulations**! You've completed the Setup phase of [migrating to Defender for Endpoint](switch-to-mde-overview.md#the-migration-process)! - [Proceed to Phase 3: Onboard to Defender for Endpoint](switch-to-mde-phase-3.md) |
| security | Switch To Mde Phase 3 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/switch-to-mde-phase-3.md | Title: Migrate to Microsoft Defender for Endpoint - Onboard -description: Make the switch to Microsoft Defender for Endpoint. Onboard devices and then uninstall your non-Microsoft solution. +description: Move to Microsoft Defender for Endpoint. Onboard devices and then uninstall your non-Microsoft solution. keywords: migration, Microsoft Defender for Endpoint, edr -# Switch to Microsoft Defender for Endpoint - Phase 3: Onboard +# Migrate to Microsoft Defender for Endpoint - Phase 3: Onboard **Applies to:** - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/?linkid=2154037) Deployment methods vary, depending on operating system and preferred methods. Th (<a id="fn1">1</a>) Windows Server 2016 and Windows Server 2012 R2 will need to be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016). > [!IMPORTANT]-> The standalone versions of Defender for Endpoint Plan 1 and Plan 2 do not include server licenses. To onboard servers, you'll need an additional license, such as [Defender for Servers Plan 1 or Plan 2](/azure/defender-for-cloud/plan-defender-for-servers-select-plan). +> The standalone versions of Defender for Endpoint Plan 1 and Plan 2 do not include server licenses. To onboard servers, you'll need an additional license, such as either Defender for Endpoint for Servers, or [Defender for Servers Plan 1 or Plan 2](/azure/defender-for-cloud/plan-defender-for-servers-select-plan). To learn more, see [Defender for Endpoint onboarding Windows Server](onboard-windows-server.md). ## Step 2: Run a detection test If at this point you have: - Microsoft Defender Antivirus is installed and enabled, -Then your next step is to uninstall your non-Microsoft antivirus, antimalware, and endpoint protection solution. When you uninstall your non-Microsoft solution, Microsoft Defender Antivirus switches from passive mode to active mode. In most cases, this happens automatically. +Then your next step is to uninstall your non-Microsoft antivirus, antimalware, and endpoint protection solution. When you uninstall your non-Microsoft solution, Microsoft Defender Antivirus changes from passive mode to active mode. In most cases, this happens automatically. > [!IMPORTANT] > If, for some reason, Microsoft Defender Antivirus does not go into active mode after you have uninstalled your non-Microsoft antivirus/antimalware solution, see [Microsoft Defender Antivirus seems to be stuck in passive mode](switch-to-mde-troubleshooting.md#microsoft-defender-antivirus-seems-to-be-stuck-in-passive-mode). Now that you have onboarded to Defender for Endpoint, and you have uninstalled y To learn more, see [Device inventory](machines-view-overview.md). -## Next steps +## Next step **Congratulations**! You have completed your [migration to Defender for Endpoint](switch-to-mde-overview.md#the-migration-process)! - - [Manage Defender for Endpoint, post migration](manage-mde-post-migration.md). |
| security | Switch To Mde Troubleshooting | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/switch-to-mde-troubleshooting.md | Title: Troubleshooting issues when switching to Microsoft Defender for Endpoint -description: Learn how to troubleshoot issues when you make the switch to Microsoft Defender for Endpoint. + Title: Troubleshooting issues when moving to Microsoft Defender for Endpoint +description: Learn how to troubleshoot issues when you migrate to Microsoft Defender for Endpoint. keywords: migration, windows defender, advanced endpoint protection, antivirus, antimalware, passive mode, active mode, troubleshooting ms.mktglfcycl: deploy-# Troubleshooting issues when switching to Microsoft Defender for Endpoint +# Troubleshooting issues when migrating to Microsoft Defender for Endpoint **Applies to:** - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -This article provides troubleshooting information for security administrators who are experiencing issues when switching from a non-Microsoft endpoint protection solution to Microsoft Defender for Endpoint. +This article provides troubleshooting information for security administrators who are experiencing issues when moving from a non-Microsoft endpoint protection solution to Microsoft Defender for Endpoint. ## Microsoft Defender Antivirus is getting uninstalled on Windows Server -When you make the switch to Defender for Endpoint, you begin with your non-Microsoft antivirus/antimalware protection in active mode. As part of the setup process, you configure Microsoft Defender Antivirus in passive mode. Occasionally, your non-Microsoft antivirus/antimalware solution might prevent Microsoft Defender Antivirus from running on Windows Server. In fact, it can look like Microsoft Defender Antivirus has been removed from Windows Server. +When you migrate to Defender for Endpoint, you begin with your non-Microsoft antivirus/antimalware protection in active mode. As part of the setup process, you configure Microsoft Defender Antivirus in passive mode. Occasionally, your non-Microsoft antivirus/antimalware solution might prevent Microsoft Defender Antivirus from running on Windows Server. In fact, it can look like Microsoft Defender Antivirus has been removed from Windows Server. To resolve this issue, take the following steps: |
| security | Troubleshoot Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus.md | Microsoft Defender Antivirus client is up and running in a healthy state. </td> </tr> <tr>+<th colspan="2">Event ID: 1121</th> +</tr> +<tr><td> +Symbolic name: +</td> +<td > +<b>(TBD)</b> +</td> +</tr> +<tr> +<td> +Message: +</td> +<td > +<b>Event when an attack surface reduction rule fires in block mode.</b> +</td> +</tr> +<tr> +<td> +Description: +</td> +<td > +TBD. +<dl> +<dt>Current Platform Version: <Current platform version></dt> +<dt>Threat Resource Path: <Path></dt> +<dt>Hashes: <Hashes></dt> +</dl> +</td> +</tr> +<tr> +<td></td> +<td > +<div class="alert"><b>Note: whatgoeshere?: <b>TBD</b>.</div> +<div> </div> +</td> +</tr> +<tr> <th colspan="2">Event ID: 1127</th> </tr> <tr><td> |
| security | Whats New In Microsoft Defender Endpoint | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint.md | ms.pagetype: security ms.localizationpriority: medium Previously updated : 11/28/2022 Last updated : 01/10/2023 audience: ITPro For more information on Microsoft Defender for Endpoint on specific operating sy - [What's new in Defender for Endpoint on iOS](ios-whatsnew.md) - [What's new in Defender for Endpoint on Linux](linux-whatsnew.md) - ## January 2023 +- [Tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) can now protect exclusions when deployed with Microsoft Intune. See [What about exclusions](prevent-changes-to-security-settings-with-tamper-protection.md#what-about-exclusions)? + - Live Response is now generally available for macOS and Linux. For more information, see, [Investigate entities on devices using live response](live-response.md). - [Live response API and library API for Linux and macos is now generally available](run-live-response.md) <br/> You can now run live response API commands on Linux and macos. |
| security | Tvm Hardware And Firmware | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-hardware-and-firmware.md | Select the **Laptop, desktop, and server modals** page to see a list of all syst :::image type="content" source=" ../../media/defender-vulnerability-management/firmware-laptop-desktop-server-modals.png" alt-text="Screenshot of the Laptop, desktop, and server modals page" lightbox=" ../../media/defender-vulnerability-management/firmware-laptop-desktop-server-modals.png"::: -[test](../../media/defender-vulnerability-management/firmware-laptop-desktop-server-modals.png) - At the top of the page, you can view the number of models per vendor. -When you select a model from the list, a flyout panel will open with the model software details: -- :::image type="content" source="../defender-vulnerability-management/media/image2.png" alt-text="Screenshot of the Laptop, desktop, and server modals flyout page" lightbox="../defender-vulnerability-management/media/image2.png"::: +When you select a model from the list, a flyout panel will open with the model software details. ### Processor inventory Select the **Processors** page to see a list of all processors in the organization. - :::image type="content" source="../defender-vulnerability-management/media/image3.png" alt-text="Screenshot of the Processors page" lightbox="../defender-vulnerability-management/media/image3.png"::: + :::image type="content" source="../../media/defender-vulnerability-management/processors.png" alt-text="Screenshot of the Processors page" lightbox="../../media/defender-vulnerability-management/processors.png"::: At the top of the page, you can view the number of processors per vendor. |
| security | Windows Authenticated Scan | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/windows-authenticated-scan.md | Title: Windows authenticated scan in Defender Vulnerability Management -description: Find out about how to create windows authenticated scans + Title: Authenticated scan for Windows in Defender Vulnerability Management +description: Find out about how to create Authenticated scans for Windows keywords: Microsoft Defender Vulnerability Management, authenticated scans search.appverid: MET150 -# Windows authenticated scan +# Authenticated scan for Windows [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -Windows authenticated scan provides the ability to run scans on unmanaged Windows devices. You can remotely target by IP ranges or hostnames and scan Windows services by providing Microsoft Defender Vulnerability Management with credentials to remotely access the devices. Once configured the targeted unmanaged devices will be scanned regularly for software vulnerabilities. +Authenticated scan for Windows provides the ability to run scans on unmanaged Windows devices. You can remotely target by IP ranges or hostnames and scan Windows services by providing Microsoft Defender Vulnerability Management with credentials to remotely access the devices. Once configured the targeted unmanaged devices will be scanned regularly for software vulnerabilities. This is applicable for devices that don't have the Defender Vulnerability Management or Defender for Endpoint agent deployed. Similar to [network device](../defender-endpoint/network-devices.md) authenticat ## Pre-requisites -The following section lists the pre-requisites you need to configure to use Windows authenticated scan. +The following section lists the pre-requisites you need to configure to use Authenticated scan for Windows. ### Scanning account To configure a new authenticated scan: > >FIPS compliant algorithms are only used in relation to departments and agencies of the United States federal government. -### Windows authenticated scan APIs +### Authenticated scan for Windows APIs You can use APIs to create a new scan and view all existing configured scans in your organization. For more information, see: |
| security | Defender Experts Report | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/defender-experts-report.md | Title: Understand the Defender Experts for Hunting report in Microsoft 365 Defender -description: The Defender Experts for Hunting service publishes monthly reports to help you understand all the threats the hunting service surfaced in your environment +description: The Defender Experts for Hunting service publishes reports to help you understand all the threats the hunting service surfaced in your environment keywords: analyst report, defender experts report, detections, defender expert notification, hunting, notifications, threat categories, hunting reports search.product: eADQiWindows 10XVcnh search.appverid: met150-Microsoft Defender Experts for Hunting layers human intelligence and expert-trained technology to help Microsoft 365 Defender customers understand the significant threats they face. It showcases how Defender Expert's threat hunting skills, thorough understanding of the threat landscape, and knowledge of emerging threats can help you identify, prioritize, and address those threats in your environment. +Microsoft Defender Experts for Hunting layers human intelligence and expert-trained technology to help Microsoft 365 Defender customers understand the significant threats they face. It highlights how Defender Expert's threat hunting skills, thorough understanding of the threat landscape, and knowledge of emerging threats can help you identify, prioritize, and address those threats in your environment. -The Defender Experts for Hunting service publishes monthly reports to help you understand all the threats the hunting service surfaced in your environment, alongside the alerts generated by your Microsoft 365 Defender products. +The Defender Experts for Hunting service generates reports to help you understand all the threats the hunting service surfaced in your environment, alongside the alerts generated by your Microsoft 365 Defender products. You can view the report in the current (running) month, or in one-, three-, or six-month periods. -To view the latest report in your Microsoft 365 Defender portal, go to **Reports**, select **Defender Experts** > **Defender Experts for Hunting report**. --## Scan the Defender Experts for Hunting report to know what to prioritize --Each section of the report is designed to provide more insights about the threats our Defender Experts found in your environment. The reports include the sections described in the following table: --| Report section | Description | -|--|--| -| Hunted and triaged | The total number of potential cybersecurity issues found in your environment. | -| Investigated | The number of cybersecurity issues that need further analysis to determine their nature and extent. | -| Notified (View notification) | The number of Defender Experts Notifications the Defender Experts sent. These notifications are related to the investigated possible threat activities in your environment that must be prioritized based on urgency and impact. | -| MITRE ATT&CK tactics observed | The number of attack tactics and techniques observed in your environment and mapped according to the [MITRE ATT&CK framework](https://attack.mitre.org/). This section visualizes how many attacks reached each tactic so you can take appropriate actions like reviewing those that progressed further first. | -| Threat categories observed | The categories depict the most significant threats and risks observed in your environment. The most critical categories are highlighted to help you further assess and evaluate your security posture based on the threats' known characteristics, behavior, and potential impact. It also enables you to focus and prioritize urgent tasks to address. | +To view the report in your Microsoft 365 Defender portal, go to **Reports**, select **Defender Experts** > **Defender Experts for Hunting report**. Each section of the report is designed to provide more insights into the threats and suspicious activities our Defender Experts found in your environment. Refer to the following screenshot of a sample report: - + ++## Identify prevalent threats and other potential attack entry points -## View Defender Experts Notifications +Signals from Microsoft 365 Defender and investigations by Defender Experts for Hunting help identify suspicious activities in your environment. Significant threat activities will have corresponding [Defender Experts Notifications](/microsoft-365/security/defender/onboarding-defender-experts-for-hunting#receive-defender-experts-notifications), which also provide recommendations to remediate and defend your organization. -A Defender Experts Notification describes the significant threat activity Defender Experts for Hunting observed in your environment and provides recommendations to remediate and defend your organization. +The report provides you with the total number of Defender Experts Notifications our experts have sent for your chosen period: -The Defender Experts for Hunting reports provide you with the total number of Defender Experts Notifications our Defender Experts have sent for your chosen time. To view these notifications, select **View notification** beside **Notified**. + -This link redirects you to the Microsoft 365 Defender incidents page. Defender Expert for Hunting alerts or Defender Experts Notifications are labeled with **Defender Experts**. +To view these notifications, select **View Defender Experts Notifications**. This button redirects you to the Microsoft 365 Defender incidents page. Defender Expert for Hunting alerts or Defender Experts Notifications are labeled with **Defender Experts**. > [!NOTE]-> The **View notification** link only appears if the value displayed in **Notified** is at least 1. +> The **View Defender Experts Notifications** button only appears if the number of threats identified is at least 1. -## Identify potential attack entry points and other security weak spots +All other identified suspicious activities are summarized in a table in the **Threat categories** section of the report. The columns represent the different threat attack tactics and categories to help you visualize what an activity is trying to achieve in each attack phase so you can plan the corresponding containment and remediation actions. -The MITRE ATT&CK tactics represent adversary goalsΓÇöwhat they're trying to achieve in each attack phase. The **MITRE ATT&CK tactics observed** section of the report tracks the progression of attack against the phase they reached: +If an activity has a related Defender Expert Notification, its corresponding icon also appears under the activity name. +Selecting an identified suspicious activity opens a flyout panel detailing the impacted devices and users: -1. Reconnaissance -2. Resource Development -3. Initial access -4. Execution -5. Persistence -6. Privilege escalation -7. Defense evasion -8. Credential access -9. Discovery -10. Lateral movement -11. Collection -12. Command and control -13. Exfiltration -14. Impact + -Signals from Microsoft 365 Defender and investigations by Defender Experts for Hunting help identify these tactics, represented in the bar chart. This chart helps you visualize where the surge is and provides you with the information you need to plan the corresponding containment and remediation actions. +If applicable, the page also provides links to view related Defender Expert Notifications. -## Know and understand the prevalent threats in your environment +## Know and understand the security weak spots in your environment -Threat categories help identify and organize security threats into classes to assess and evaluate their impact and develop strategies to prevent or mitigate these threats to your environment. The **Threat categories observed** section of the report shows a bar chart with significant risks and threats detected in your environment, helping you understand the breadth and scope of your exposure. +The **Top trending suspicious activities** section of the report identifies up to 20 suspicious activities that were consistently observed in your environment in the last three months, sorted based on their severity rating and frequency of occurrence: -Among the various threat categories available, the following categories are carefully chosen because they aren't covered under the purview of MITRE ATT&CK framework: + -- Ransomware-- Malware-- Weaponization-- Exploit-- Delivery+By showing the most critical and frequently observed activities, you can assess and evaluate their impact and develop strategies to prevent or mitigate potential threats to your environment -You can prioritize remediation based on the most impacted category, as depicted in the bar chart. +Select **View details** in each card to open a flyout panel detailing the impacted devices and users. If applicable, the page also provides links to view related Defender Expert Notifications. |
| security | Microsoft 365 Security Mdi Redirection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-mdi-redirection.md | Once disabled, accounts will no longer be routed to security.microsoft.com. ## Related information - [Microsoft 365 Defender overview](microsoft-365-defender.md)+- [Deploy Microsoft Defender for Identity with Microsoft 365 Defender](/defender-for-identity/deploy-defender-identity) - [About Microsoft 365 Defender](https://www.microsoft.com/microsoft-365/security/microsoft-365-defender) - [Microsoft security portals and admin centers](portals.md) |
| security | Supported Event Types | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/supported-event-types.md | The following table only includes the list of the tables supported in the stream | **[IdentityQueryEvents](advanced-hunting-identityqueryevents-table.md)**|GA |GA |GA |GA | | **[IdentityDirectoryEvents](advanced-hunting-identitydirectoryevents-table.md)**|GA |GA |GA |GA | | **[CloudAppEvents](advanced-hunting-cloudappevents-table.md)**|GA |GA |GA |GA |-| **[UrlClickEvents](advanced-hunting-urlclickevents-table.md)**|GA |GA |GA |GA | +| **[UrlClickEvents](advanced-hunting-urlclickevents-table.md)**|Public preview |Not available |Not available |Not available | ## Related topics |
| security | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/whats-new.md | You can also get product updates and important notifications through the [messag ## January 2023 +- The new Microsoft Defender Experts for Hunting report is now available. The report's new interface now lets customers have more contextual details about the suspicious activities Defender Experts have observed in their environments. It also shows which suspicious activities have been continuously trending from month to month. For details, see [Understand the Defender Experts for Hunting report in Microsoft 365 Defender](defender-experts-report.md). + - (GA) Live Response is now generally available for macOS and Linux. ## December 2022 |
| security | Anti Phishing Policies Mdo Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure.md | Creating a custom anti-phishing policy in the Microsoft 365 Defender portal crea When you're finished, click **Add domains** > [!NOTE]- > You can have a maximum of 50 domains in all anti-phishing policies. + > You can specify a maximum of 50 custom domains in each anti-phishing policy. Back on the **Manage custom domains for impersonation** flyout, you can remove entries by selecting one or more entries from the list. You can search for entries using the  **Search** box. |
| security | Quarantine About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-about.md | Both users and admins can work with quarantined messages: |||::|| |Messages quarantined by anti-spam policies: spam, high confidence spam, phishing, high confidence phishing, or bulk.|15 days: <ul><li>In the default anti-spam policy.</li><li>In anti-spam policies that you create in PowerShell.</li></ul> <p> 30 days in anti-spam policies that you create in the Microsoft 365 Defender portal.|Yes|You can configure (lower) this value in anti-spam policies. For more information, see the **Retain spam in quarantine for this many days** (_QuarantineRetentionPeriod_) setting in [Configure anti-spam policies](anti-spam-policies-configure.md).| |Messages quarantined by anti-phishing policies: spoof intelligence in EOP; user impersonation, domain impersonation, or mailbox intelligence in Defender for Office 365.|30 days|Yes|This retention period is also controlled by the **Retain spam in quarantine for this many days** (_QuarantineRetentionPeriod_) setting in **anti-spam** policies. The retention period that's used is the value from the first matching **anti-spam** policy that the recipient is defined in.|- |Messages quarantined by anti-malware policies (malware messages).|30 days|No|| + |Messages quarantined by anti-malware policies (malware messages).|30 days|No|If you turn on common attachments filtering in anti-malware policies (in the default policy or in custom policies), file attachments in email messages to the affected recipients are treated as malware based solely on the file extension. A predefined list of mostly executable file types is used by default, but you can customize the list. For more information, see [Anti-malware policies](anti-malware-protection-about.md#anti-malware-policies).| |Messages quarantined by Safe Attachments policies in Defender for Office 365 (malware messages).|30 days|No|| |Messages quarantined by mail flow rules: the action is **Deliver the message to the hosted quarantine** (_Quarantine_).|30 days|No|| |Files quarantined by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams (malware files).|30 days|No|Files quarantined in SharePoint or OneDrive are removed fom quarantine after 30 days, but the blocked files remain in SharePoint or OneDrive in the blocked state.| |
| security | Reports Email Security | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/reports-email-security.md | If you are not seeing data in your reports, check the filters that you're using > [!NOTE] > To create or manage report schedules, you need to be a member of the **Organization management** role. -1. On the main page for the specific report, click  **Create schedule**. +1. On the main page for the specific report, select :::image type="icon" source="../../media/m365-cc-sc-create-icon.png"::: **Create schedule**. 2. The **Create scheduled report** wizard opens. On the **Name scheduled report** page, review or customize the **Name** value, and then click **Next**. 3. On the **Set preferences** page, configure the following settings: - **Frequency**: Select one of the following values: |
| security | Responding To A Compromised Email Account | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account.md | If a user reports any of the above symptoms, you should perform further investig ## How to secure and restore email function to a suspected compromised Microsoft 365 account and mailbox -> [!VIDEO https://videoplayercdn.osi.office.net/hub/?csid=ux-cms-en-us-msoffice&uuid=RE2jvOb&AutoPlayVideo=false] +<! [!VIDEO https://videoplayercdn.osi.office.net/hub/?csid=ux-cms-en-us-msoffice&uuid=RE2jvOb&AutoPlayVideo=false] > Even after you've regained access to your account, the attacker may have added back-door entries that enable the attacker to resume control of the account. |
| security | Submissions Admin | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-admin.md | If you've deployed the [Microsoft Report Message or Report Phishing add-ins](sub ## Undo user reported messages -Once a user reports a suspicious message that's delivered to the reporting mailbox, the user and admins don't can't undo the reported message. The user can recover the messages from their Deleted Items or Junk Email folders. +Once a user reports a suspicious message that's delivered to the reporting mailbox, the user and admins can't undo the reported message. The user can recover the messages from their Deleted Items or Junk Email folders. ## Convert user reported messages in the reporting mailbox into admin submissions |
| security | Submissions Error Messages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-error-messages.md | + + Title: Errors during admin submissions +f1.keywords: +- NOCSH ++++audience: Admin ++ms.localizationpriority: medium ++ - m365-security +description: Learn about the errors that admins might encounter when they try to report email, URLs, and email attachments to Microsoft as false positives and false negatives. +++search.appverid: met150 +++# Errors during admin submissions ++**Applies to** +- [Exchange Online Protection](eop-about.md) +- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) +- [Microsoft 365 Defender](../defender/microsoft-365-defender.md) +++This article attempts to explain the common error messages tha you might receive as you try to [report emails, URLs, and email attachments to Microsoft](submissions-admin.md) ++## This message didn't pass through our mail flow system, or the message metadata isn't available yet error ++If you encounter this error message, then either of the following conditions might have occured: ++- You tried to submit an email message that wasn't filtered by Exchange Online Protection (EOP) or Microsoft Defender for Office 365 at the time of delivery. ++ It's hard for us to determine why the message was missed or delivered when it wasn't filtered by Microsoft's protection stack. ++- You tried to submit an email message that was filtered by EOP or Defender for Office 365, but we're still in the process of collecting the required metadata (descriptive data) about the message. ++ If you wait "a while" and submit the message again, the submission will be successful. |
| security | Submissions Report Messages Files To Microsoft | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-report-messages-files-to-microsoft.md | Watch this video that shows more information about the unified submissions exper |||| |[The built-in Report button](submissions-outlook-report-messages.md#use-the-built-in-report-button-in-outlook-on-the-web)|User|Currently, this method is available only in Outlook on the web (formerly known as Outlook Web App or OWA).| |[The Microsoft Report Message and Report Phishing add-ins](submissions-outlook-report-messages.md#use-the-report-message-and-report-phishing-add-ins-in-outlook)|User|These free add-ins work in Outlook on all available platforms. For installation instructions, see [Enable the Report Message or the Report Phishing add-ins](submissions-users-report-message-add-in-configure.md).|-|[The Submissions page in the Microsoft 365 Defender portal](submissions-admin.md)|Admin|Admins use this method to submit good (false positive) and bad (false negative) entities including user-reported messages to Microsoft for further analysis. Tabs include **Email**, **Email attachments**, **URLs**, and **Files**. The Submissions page is available to organizations who have Exchange Online mailboxes as part of a Microsoft 365 subscription (not available in standalone EOP).| +|[The Submissions page in the Microsoft 365 Defender portal](submissions-admin.md)|Admin|Admins use this method to submit good (false positive) and bad (false negative) entities including user-reported messages to Microsoft for further analysis. Tabs include **Email**, **Email attachments**, **URLs**, and **Files**. Note that **Files** is only available to users with Microsoft Defender for Endpoint P2 license, Microsoft Defender for Office P2 license, and Microsoft 365 Defender E5 license.. The Submissions page is available to organizations who have Exchange Online mailboxes as part of a Microsoft 365 subscription (not available in standalone EOP).| [User reported message settings](submissions-user-reported-messages-files-custom-mailbox.md) allow admins to configure whether user reported messages go to a specified reporting mailbox, to Microsoft, or both. Depending on your subscription, user reported messages are available in the following locations in the Microsoft 365 Defender portal: Admins can use mail flow rules (also known as transport rules) to notify specifi Admins can also submit email attachments and other suspected files to Microsoft for analysis using the sample submission portal at <https://www.microsoft.com/wdsi/filesubmission>. For more information, see [Submit files for analysis](../intelligence/submission-guide.md). -> [!NOTE] -> When you report an email entity to Microsoft, we copy everything associated with the email to include it in our continual algorithm reviews. This copy includes the email content, email headers, and related data about email routing. Any message attachments are also included. -> -> Microsoft treats your feedback as your organization's permission for us to analyze all of the previously described information to fine tune the message hygiene algorithms. We hold your message in our secure audited datacenters in the USA. The submission is deleted as soon as it's no longer required. Microsoft personnel might read your submitted messages and attachments, which is normally not permitted for email in Microsoft 365. However, your email is still treated as confidential between you and Microsoft, and we will not provide your email or attachments to any other party as part of the review process. +> [!TIP] +> Information is blocked from going outside the organization when data isn't supposed to leave the tenant boundary for compliance purposes (for example, in U.S. Government organizations: Microsoft 365 GCC, GCC High, and DoD). Reporting a message or file to Microsoft from one of these organizations will have the following message in the result details: >-> Information is blocked from going outside the organization when data is not supposed to leave the tenant boundary for compliance purposes (for example, in U.S. Government organizations: Microsoft 365 GCC, GCC High, and DoD). Reporting a message or file to Microsoft from one of these organizations will have the following message in the result details: +> **Further investigation needed**. Your tenant doesn't allow data to leave the environment, so nothing was found during the initial scan. You'll need to contact Microsoft support to have this item reviewed. ++> [!NOTE] +> When you report an email entity to Microsoft, everything associated with the email is copied to include it in the continual algorithm reviews. This copy includes the email content, email headers, and related data about email routing. Any message attachments are also included. >-> **Further investigation needed**. Your tenant does not allow data to leave the environment, so we could not find anything with an initial scan. You'll need to contact Microsoft support to have this item reviewed. +> Microsoft treats your feedback as your organization's permission to analyze all the information to fine tune the message hygiene algorithms. Your message is held in secured and audited data centers in the USA. The submission is deleted as soon as it's no longer required. Microsoft personnel might read your submitted messages and attachments, which is normally not permitted for email in Microsoft 365. However, your email is still treated as confidential between you and Microsoft, and your email or attachments isn't shared with any other party as part of the review process. + |
| security | Tenant Allow Block List About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-allow-block-list-about.md | -The Tenant Allow/Block List in the Microsoft 365 Defender portal gives you a way to manually override the Microsoft 365 filtering verdicts. The Tenant Allow/Block List is used during mail flow for incoming messages from external senders (does not apply to intra-org messages) and at the time of user clicks. +The Tenant Allow/Block List in the Microsoft 365 Defender portal gives you a way to manually override the Microsoft 365 filtering verdicts. The Tenant Allow/Block List is used during mail flow for incoming messages from external senders. Note that it doesn't apply to messages within the organization. The Tenant Allow/Block list is available in the Microsoft 365 Defender portal at <https://security.microsoft.com> \> **Policies & rules** \> **Threat Policies** \> **Tenant Allow/Block Lists** in the **Rules** section. To go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>. These articles contain procedures in the Microsoft 365 Defender Portal and in Po > [!NOTE] > In the Tenant Allow/Block List, block entries take precedence over allow entries. -Use the Submissions portal (also known as *admin submission*) at <https://security.microsoft.com/reportsubmission> to create block entries for the following types of items as you report them as false positives to Microsoft: +Use the Submissions portal (also known as *admin submission*) at <https://security.microsoft.com/reportsubmission> to create block entries for the following types of items as you report them as false negatives to Microsoft: - **Domains and email addresses**: - Email messages from these senders are marked as *high confidence spam* (SCL = 9). What happens to the messages is determined by the [anti-spam policy](anti-spam-policies-configure.md) that detected the message for the recipient. In the default anti-spam policy and new custom policies, messages that are marked as high confidence spam are delivered to the Junk Email folder by default. In Standard and Strict [preset security policies](preset-security-policies.md), high confidence spam messages are quarantined. Use the Submissions portal (also known as *admin submission*) at <https://securi > [!NOTE] > To block only spam from a specific sender, add the email address or domain to the block list in [anti-spam policies](anti-spam-policies-configure.md). To block all email from the sender, use **Domains and email addresses** in the Tenant Allow/Block List. -- **Files**: Email messages that contain these blocked files are blocked as *malware*.+- **Files**: Email messages that contain these blocked files are marked as malware and moved to quarantine. - **URLs**: Email messages that contain these blocked URLs are blocked as *high confidence phishing*. Messages containing the blocked URLs are quarantined. |
| security | Tenant Allow Block List Email Spoof Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure.md | For detailed syntax and parameter information, see [Get-TenantAllowBlockListItem ### Use the Microsoft 365 Defender portal to modify allow or block entries for domains and email addresses in the Tenant Allow/Block List -When you modify allow or block entries for domains and email addresses in the Tenant Allow/Block list, you can only modify the expiration date and notes. +You can make the following modifications to entries for domains and email addresses in the Tenant Allow/Block list: ++- **Block enries**: The expiration date and notes. +- **Allow entries**: Notes. 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>. When you modify allow or block entries for domains and email addresses in the Te 3. On the **Domains & addresses** tab, select the check box of the entry that you want to modify, and then click the  **Edit** button that appears. 4. The following settings are available in the **Edit domain & addresses** flyout that appears:-- - **Remove allow entry after** or **Remove block entry after**: - - You can extend allow entries for a maximum of 30 days after the creation date. - - You can extend block entries for a maximum of 90 days after the creation date or set them to **Never expire**. -+ - **Remove block entry after**: You can extend block entries for a maximum of 90 days after the creation date or set them to **Never expire**. - **Optional note** When you're finished, click **Save**. |
| security | Tenant Allow Block List Files Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-allow-block-list-files-configure.md | For detailed syntax and parameter information, see [Get-TenantAllowBlockListItem ## Use the Microsoft 365 Defender portal to modify allow or block entries for files in the Tenant Allow/Block List -When you modify allow or block entries for files in the Tenant Allow/Block list, you can only modify the expiration date and notes. +You can make the following modifications to entries for files in the Tenant Allow/Block list: ++- **Block enries**: The expiration date and notes. +- **Allow entries**: Notes. 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>. When you modify allow or block entries for files in the Tenant Allow/Block list, 3. On the **Files** tab, select the check box of the entry that you want to modify, and then click the  **Edit** button that appears. 4. The following settings are available in the **Edit file** flyout that appears:-- - **Remove allow entry after** or **Remove block entry after**: - - You can extend allow entries for a maximum of 30 days after the creation date. - - You can extend block entries for a maximum of 90 days after the creation date or set them to **Never expire**. -+ - **Remove block entry after**: You can extend block entries for a maximum of 90 days after the creation date or set them to **Never expire**. - **Optional note** When you're finished, click **Save**. |
| security | Tenant Allow Block List Urls Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-allow-block-list-urls-configure.md | For detailed syntax and parameter information, see [Get-TenantAllowBlockListItem ## Use the Microsoft 365 Defender portal to modify allow or block entries for URLs in the Tenant Allow/Block List -When you modify allow or block entries for URLs in the Tenant Allow/Block list, you can only modify the expiration date and notes. +You can make the following modifications to entries for URLs in the Tenant Allow/Block list: +- **Block enries**: The expiration date and notes. +- **Allow entries**: Notes. +- 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>. 2. Select the **URLs** tab When you modify allow or block entries for URLs in the Tenant Allow/Block list, 3. On the **URLs** tab, select the check box of the entry that you want to modify, and then click the  **Edit** button that appears. 4. The following values are available in the **Edit URL** flyout that appears:-- - **Remove allow entry after** or **Remove block entry after**: - - You can extend allow entries for a maximum of 30 days after the creation date. - - You can extend block entries for a maximum of 90 days after the creation date or set them to **Never expire**. -+ - **Remove block entry after**: You can extend block entries for a maximum of 90 days after the creation date or set them to **Never expire**. - **Optional note** When you're finished, click **Save**. |
| syntex | Content Processing Create Rules | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/content-processing-create-rules.md | + + Title: Create a rule to move or copy a file from one document library to another in Microsoft Syntex +++++audience: admin +++search.appverid: ++ - enabler-strategic + - m365initiative-syntex +ms.localizationpriority: medium +description: Learn how to create a rule to move or copy a file to another SharePoint document library in Microsoft Syntex. +++# Create a rule to move or copy a file from one document library to another in Microsoft Syntex ++Microsoft Syntex lets you build simple rules-driven actions in document libraries based on metadata. From a document library, you can create rules to automate tasks such as sending a notification when metadata changes in a file, when a new file is created in the library, or when files are moved or copied based on metadata extracted by Syntex models. ++You'll choose a condition that triggers the rule and the action that the rule will take. +For example, you can create a rule to move files tagged with a specific customer to a specific library or folder. These rules help you structure your content architecture with the power of AI-driven processing. ++Document libraries can have multiple move and copy rules to support moving and copying files to different destination libraries based on metadata criteria. ++> [!NOTE] +> This feature is available only for users who are licensed for Syntex. ++## Move or copy a file ++To move or copy a file from one document library to another, follow these steps. ++1. In the document library, select **Automate** > **Rules** > **Create a rule**. ++  ++2. On the **Create a rule** page, select a condition that triggers the rule and the action that the rule will take. In this case, select **A new file is added**. ++  ++ Your selection here creates a rule statement that you'll complete in the next step. ++3. To complete the rule statement, under **When a new file is added**: ++ 1. Select **Choose action**, and then: ++ - To copy a file, select **copy file to**. + - To move a file, select **move file to**. ++  ++ 2. Select **Enter a site name or address**, and then select the site that contains the document library you want the file moved or copied to. ++  ++ When you select **Enter a site name or address**, you can either select from the list of recent sites or enter the name or URL of another site. ++ 3. Select **Choose a library**, and then select the document library you want the file moved or copied to. ++  ++ When you select **Choose a library**, you can either select from the list of suggested libraries or enter the name of another library. ++ > [!NOTE] + > If you try to set up a rule to move or copy a file to a library that already has a move or copy rule applied, you'll receive a message saying that you need to disable all move or copy rules on the destination library. To disable a rule, see [Manage a rule](#manage-a-rule).<br> + > ++4. When your rule statement is complete, select **Create**. You'll see the new rule on the **Manage rules** page. ++## Manage a rule ++1. In the document library, select **Automate** > **Rules** > **Manage rules**. ++  ++2. On the **Manage rules** page, you can see the rules that have been applied. You can turn on or off a rule or [create a new rule](#move-or-copy-a-file) to automate actions on a specific document library. ++  ++## View the activity feed of a document library ++When a file is moved or copied, you'll see an update in the source library activity feed. The updates occur in both the source library and the target library. ++In the document library, in the upper-right corner of the page, select the details pane icon () to view the recent history, activity, and rules that have been applied to the library. ++  ++> [!NOTE] +> Currently, the activity feed shows only move activity. Copy activity will be available in a future release. |
| syntex | Requirements And Limitations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/requirements-and-limitations.md | Prebuilt models: | - | - | |  | **Supported languages** <br>This model supports all of the Latin-based languages, including: English, French, German, Italian, and Spanish. |-|  | **OCR considerations** <br>This model uses optical character recognition (OCR) technology to scan .pdf files, image files, and .tiff files. OCR processing works best on documents that meet the following requirements: <br> - File format of .jpg, .png, or .pdf (text or scanned). Text-embedded .pdf files are better, because there won't be any errors in character extraction and location. <br> - If your .pdf files are password-locked, you must remove the lock before submitting them. <br> - The combined file size of the documents used for training per collection must not exceed 50 MB, and PDF documents shouldn't have more than 500 pages. <br> - For images, dimensions must be between 50 x 50 and 10,000 x 10,000 pixels. Images that are very wide or have odd dimensions (for example, floor plans) might get truncated in the OCR process and lose accuracy. <br> - For .pdf files, dimensions must be at most 17 x 17 inches, corresponding to Legal or A3 paper sizes and smaller. <br> - If scanned from paper documents, scans should be high-quality images. <br> - Must use the Latin alphabet (English characters). <br> Note the following differences about Microsoft Office text-based files and OCR-scanned files (.pdf, image, or .tiff): <br> - Office files: Truncated at 64,000 characters (in training and when run against files in a document library). <br> - OCR-scanned files: There's a 500-page limit. Only PDF and image file types are processed by OCR. | +|  | **OCR considerations** <br>This model uses optical character recognition (OCR) technology to scan .pdf files, image files, and .tiff files. OCR processing works best on documents that meet the following requirements: <br> - File format of .jpg, .png, or .pdf (text or scanned). Text-embedded .pdf files are better, because there won't be any errors in character extraction and location. <br> - If your .pdf files are password-locked, you must remove the lock before submitting them. <br> - The combined file size of the documents used for training per collection must not exceed 50 MB, and PDF documents shouldn't have more than 500 pages. <br> - For images, dimensions must be between 50 x 50 and 10,000 x 10,000 pixels. Images that are very wide or have odd dimensions (for example, floor plans) might get truncated in the OCR process and lose accuracy. <br> - For .pdf files, dimensions must be at most 11 x 17 inches, corresponding to Legal or A3 paper sizes and smaller. <br> - If scanned from paper documents, scans should be high-quality images. <br> - Must use the Latin alphabet (English characters). <br> Note the following differences about Microsoft Office text-based files and OCR-scanned files (.pdf, image, or .tiff): <br> - Office files: Truncated at 64,000 characters (in training and when run against files in a document library). <br> - OCR-scanned files: There's a 500-page limit. Only PDF and image file types are processed by OCR. | |  | **Multi-Geo environments** <br>When setting up Syntex in a [Microsoft 365 Multi-Geo](/microsoft-365/enterprise/microsoft-365-multi-geo) environment, you can only configure it to use the model type in the central location. If you want to use this model type in a satellite location, contact Microsoft support. | |  | **Multi-model libraries** <br>If two or more trained models are applied to the same library, the file is classified using the model that has the highest average confidence score. The extracted entities will be from the applied model only. | Prebuilt models: | - | - | |  | **Supported file types** <br>This model supports the following file types: .bmp, .jpeg, .pdf, .png, and .tiff. | |  | **Supported languages** <br>This model supports only English language invoices from the United States. |-|  | **OCR considerations** <br>This model uses optical character recognition (OCR) technology to scan .pdf files, image files, and .tiff files. OCR processing works best on documents that meet the following requirements: <br> - File format of .jpg, .png, or .pdf (text or scanned). Text-embedded .pdf files are better, because there won't be any errors in character extraction and location. <br> - For .pdf and .tiff files, up to 2,000 pages can be processed. <br> - The file size must be less than 50 MB. <br> - For images, dimensions must be between 50 x 50 and 10,000 x 10,000 pixels. <br> - For .pdf files, dimensions must be at most 17 x 17 inches, corresponding to Legal or A3 paper sizes and smaller. <br> - The total size of the training data is 500 pages or less. <br> Note the following differences about Microsoft Office text-based files and OCR-scanned files (.pdf, image, or .tiff): <br> - Office files: Truncated at 64,000 characters (in training and when run against files in a document library). <br> - OCR-scanned files: There's a 20-page limit.| +|  | **OCR considerations** <br>This model uses optical character recognition (OCR) technology to scan .pdf files, image files, and .tiff files. OCR processing works best on documents that meet the following requirements: <br> - File format of .jpg, .png, or .pdf (text or scanned). Text-embedded .pdf files are better, because there won't be any errors in character extraction and location. <br> - For .pdf and .tiff files, up to 2,000 pages can be processed. <br> - The file size must be less than 50 MB. <br> - For images, dimensions must be between 50 x 50 and 10,000 x 10,000 pixels. <br> - For .pdf files, dimensions must be at most 11 x 17 inches, corresponding to Legal or A3 paper sizes and smaller. <br> - The total size of the training data is 500 pages or less. <br> Note the following differences about Microsoft Office text-based files and OCR-scanned files (.pdf, image, or .tiff): <br> - Office files: Truncated at 64,000 characters (in training and when run against files in a document library). <br> - OCR-scanned files: There's a 20-page limit.| |  | **Multi-Geo environments** <br>When setting up Syntex in a [Microsoft 365 Multi-Geo](/microsoft-365/enterprise/microsoft-365-multi-geo) environment, you can only configure it to use the model type in the central location. If you want to use this model type in a satellite location, contact Microsoft support. | |  | **Multi-model libraries** <br>If two or more trained models are applied to the same library, the file is classified using the model that has the highest average confidence score. The extracted entities will be from the applied model only. | Prebuilt models: | - | - | |  | **Supported file types** <br>This model supports the following file types: .bmp, .jpeg, .pdf, .png, and .tiff. | |  | **Supported languages** <br>This model supports English sales receipts from Australia, Canada, Great Britain, India, and the United States. |-|  | **OCR considerations** <br>This model uses optical character recognition (OCR) technology to scan .pdf files, image files, and .tiff files. OCR processing works best on documents that meet the following requirements: <br> - File format of .jpg, .png, or .pdf (text or scanned). Text-embedded .pdf files are better, because there won't be any errors in character extraction and location. <br> - For .pdf and .tiff files, up to 2,000 pages can be processed. <br> - The file size must be less than 50 MB. <br> - For images, dimensions must be between 50 x 50 and 10,000 x 10,000 pixels. <br> - For .pdf files, dimensions must be at most 17 x 17 inches, corresponding to Legal or A3 paper sizes and smaller. <br> - The total size of the training data is 500 pages or less. <br> Note the following differences about Microsoft Office text-based files and OCR-scanned files (.pdf, image, or .tiff): <br> - Office files: Truncated at 64,000 characters (in training and when run against files in a document library). <br> - OCR-scanned files: There's a 20-page limit.| +|  | **OCR considerations** <br>This model uses optical character recognition (OCR) technology to scan .pdf files, image files, and .tiff files. OCR processing works best on documents that meet the following requirements: <br> - File format of .jpg, .png, or .pdf (text or scanned). Text-embedded .pdf files are better, because there won't be any errors in character extraction and location. <br> - For .pdf and .tiff files, up to 2,000 pages can be processed. <br> - The file size must be less than 50 MB. <br> - For images, dimensions must be between 50 x 50 and 10,000 x 10,000 pixels. <br> - For .pdf files, dimensions must be at most 11 x 17 inches, corresponding to Legal or A3 paper sizes and smaller. <br> - The total size of the training data is 500 pages or less. <br> Note the following differences about Microsoft Office text-based files and OCR-scanned files (.pdf, image, or .tiff): <br> - Office files: Truncated at 64,000 characters (in training and when run against files in a document library). <br> - OCR-scanned files: There's a 20-page limit.| |  | **Multi-Geo environments** <br>When setting up Syntex in a [Microsoft 365 Multi-Geo](/microsoft-365/enterprise/microsoft-365-multi-geo) environment, you can only configure it to use the model type in the central location. If you want to use this model type in a satellite location, contact Microsoft support. | |  | **Multi-model libraries** <br>If two or more trained models are applied to the same library, the file is classified using the model that has the highest average confidence score. The extracted entities will be from the applied model only. | |