| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Create Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/create-groups.md | While users can create a Microsoft 365 group from Outlook or other apps, as an a 2. Select **Add a group**. -3. On the **Choose a group type** page, select **Office 365**, and select **Next**. +3. On the **Choose a group type** page, select **Microsoft 365**, and select **Next**. 4. On the **Basics** page, type a name for the group, and, optionally, a description. Select **Next**.++5. On the **Owners** page, choose the name of one or more people who will be designated to manage the group. Anyone who is a group owner will be able to delete email from the Group inbox. Other members won't be able to delete email from the Group inbox. Select **Next**. ++6. On the **Members** page, choose the name of one or more people who will be designated as members of the group. Select **Next**. ++7. On the **Settings** page, type a unique email address for the group, choose a privacy option and whether you want to add Microsoft Teams, and then select **Next**. -5. On the **Edit settings** page, type a unique email address for the group, choose a privacy option and whether you want to add Microsoft Teams, and then select**Next**. - -6. On the **Owners** choose the name of one or more people who will be designated to manage the group. Anyone who is a group owner will be able to delete email from the Group inbox. Other members won't be able to delete email from the Group inbox. Select **Next**. - -7. After reviewing your settings and making any changes, select **Create group**. +8. After reviewing your settings and making any changes, select **Create group**. -8. Select **Close**. +9. Select **Close**. ## Add members to the group After creating a new group and adding members, you can further configure your gr [Manage guest access to Microsoft 365 groups](https://support.microsoft.com/office/bfc7a840-868f-4fd6-a390-f347bf51aff6) (article)\ [Choose the domain to use when creating Microsoft 365 groups](../../solutions/choose-domain-to-create-groups.md) (article)\-[Upgrade distribution lists to Microsoft 365 groups](../manage/upgrade-distribution-lists.md) (article) +[Upgrade distribution lists to Microsoft 365 groups](../manage/upgrade-distribution-lists.md) (article) |
| admin | Become The Admin | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/become-the-admin.md | search.appverid: - MET150 - MOE150 ms.assetid: b9707ec8-2247-4e25-9bad-f11ddbc686e4-description: "Learn how to verify your email and domain ownership to take over an unmanaged tenant created by a self-service user signup in Microsoft 365." +description: "Learn how to verify your email and domain ownership to take over an unmanaged account created by a self-service user signup in Microsoft 365." # Perform an internal admin takeover - **[Check the Domains FAQ](../setup/domains-faq.yml)** if you don't find what you're looking for. + **[Check the Domains FAQ](../setup/domains-faq.yml)** if you don't find what you're looking for. -If you are an admin and want to take over an unmanaged tenant created by a self-service user signup, you can do this with an internal admin takeover. +If you're an admin and want to take over an unmanaged account created by a self-service user signup, you can perform an internal admin takeover by following the steps in this article. > [!NOTE]-> A self-service sign up for any cloud service that uses Azure AD will add the user to an unmanaged or "shadow" Azure AD directory and create an unmanaged tenant. An unmanaged tenant is a directory without a global administrator. To determine whether a tenant is managed or unmanaged, please see [Determining Tenant Type](/power-platform/admin/powerapps-gdpr-dsr-guide-systemlogs#determining-tenant-type). +> A self-service sign up for any cloud service that uses Azure AD adds the user to an unmanaged or "shadow" Azure AD directory and creates an unmanaged account. An unmanaged account is a directory without a global administrator. To determine whether an account is managed or unmanaged, see [Determining Tenant Type](/power-platform/admin/powerapps-gdpr-dsr-guide-systemlogs#determining-tenant-type). +## Before you begin ++When a user signs up for Microsoft 365 services using an email address, an account is automatically created for them. If an admin wants to manage the users on the account or purchase additional Microsoft 365 services, they must become an admin on the account by following these steps to perform an admin takeover. + ## Step 1: Verify your email address > [!NOTE]-> If self-service is enabled in your tenant, users can subscribe to free services, such as Power BI, on their own. These steps assume that a self-service user subscription has created the unmanaged tenant you want to take over as admin. In the first step you create a user context in the unmanaged tenant, using Power BI to illustrate the admin takeover path. +> If self-service is enabled in your account, users can subscribe to free services such as Power BI, on their own. These services are specifically for use in cases where a self-service user subscription has created the unmanaged account you want to take over as admin. In Step 1 you create a user account for the domain you want to remove by using Power BI to launch the admin takeover wizard so you can become the admin for the unmanaged domain account. 1. To sign up for Power BI, go to the [Power BI site](https://powerbi.com) and select **Start Free** > **Start free trial** (in Share with Power BI Pro box). 2. Sign up with a user account that uses the domain name of your organization (like `powerbiadmin@contoso.com`). If your account is already in use, sign in using your current password. 3. Check your email for the **verification code** and enter the code to validate your email address.- -## Step 2: Create a new account -1. When you enter the verification code, you'll be brought to a page where you can create a new account. - -2. Fill in the user name and password fields with the account that you want to use, then select **Start**. - +## Step 2: Create a new account for admin access ++1. When you enter the verification code, you'll be brought to a page where you can create a new account. ++2. Fill in the user name and password fields with the account that you want to use, and then complete the steps to create the account. + ## Step 3: Verify domain ownership and become the admin -1. The **Become the admin** wizard will open. If the wizard doesn't start, look for the **Admin** tile and select it. +1. After you complete Step 2, select the admin center icon in the left navigation pane (alternatively, go to a browser and type in `https://admin.microsoft.com`). -2. Select **Yes, I want to be the admin**. + You're redirected to the admin takeover wizard. -3. Verify that you own the domain you want to take over by adding a TXT record to your domain registrar. The wizard will give you the TXT record to add, as well as provide a link to your registrar's website, and a link to step-by-step instructions. - -4. Once you've added the TXT record to your registrar site, return to the wizard and select **Okay, I've added the record**. - -> [!NOTE] -> Taking over the shadow tenant will not impact any existing information or services. However, if any users in the domain have signed up for services that require a license, you'll be asked to buy licenses for them as part of taking over the admin role. You can buy or remove licenses once the admin setup process is finished. +1. Select **Next** and verify that you own the domain you want to take over by adding a TXT record to your domain registrar. ++ The wizard will give you the TXT record to add, as well as provide a link to your registrar's website, and a link to step-by-step instructions. ++1. On the **You're now the admin** page, select **Go to the admin center**. ++ You have the admin privileges required to manage the account in the admin center. For example, you can manage account users and groups, purchase new subscriptions and make user assignments, and manage the account domains. ++ If you want to remove your domain from this account so you can add it to another account, see [Remove a domain from another account](remove-a-domain-from-another-account.md). ## Related content |
| admin | Move A Domain | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/move-a-domain.md | + + Title: "Move a domain verified in an unmanaged account" +f1.keywords: +- CSH ++++audience: Admin +++ms.localizationpriority: medium ++- M365-subscription-management +- Adm_O365 +- Adm_NonTOC ++- AdminSurgePortfolio +- AdminTemplateSet +search.appverid: +- BCS160 +- MET150 +- MOE150 +ms.assetid: b9707ec8-2247-4e25-9bad-f11ddbc686e4 +description: "Learn how to join an unmanaged account to remove the domain from the account and add the domain to your account." +++# Move a domain verified in an unmanaged account ++ **[Check the Domains FAQ](../setup/domains-faq.yml)** if you don't find what you're looking for. ++If you're an admin and you've tried to add a domain to your Microsoft 365 account, but you're blocked because the domain is verified for an unmanaged account, you can become the admin on the unmanaged account to remove the domain and add it to your account. ++> [!NOTE] +> A self-service sign up for any cloud service that uses Azure AD adds the user to an unmanaged or "shadow" Azure AD directory and creates an unmanaged account. An unmanaged account is a directory without a global administrator. To determine whether an account is managed or unmanaged, see [Determining Tenant Type](/power-platform/admin/powerapps-gdpr-dsr-guide-systemlogs#determining-tenant-type). + +## Before you begin ++Sometimes you can't add a domain to your organization account because someone else has already signed up for Microsoft 365 using an email address associated with that domain name. But you can remove the domain from the other, unmanaged account and add it to your organization account. ++First, you'll need to join the unmanaged account and become an admin for that account (Steps 1 - 3). Then you can remove the domain from the account (Step 4), sign back into your organization account, and add the domain to your account (Step 5). ++## Step 1: Get an invitation to join the unmanaged account ++After you try to add a domain to your account, you might receive a message that someone has already signed up for Microsoft 365 using the email address. Step 1 is to request an invitation to join the other account and begin the process of performing an admin takeover. ++1. Go to the Microsoft 365 admin center > **Settings** > **Domains** > **+ Add domain**, and add the domain name. ++1. If you see a message that you can't add the domain because other people have already signed up using an email address for the domain, enter your account username, and then select **Send me the invitation**. ++1. Sign out of your current account, so you can sign into the unmanaged account. ++ Check your email for an invitation to help you join the unmanaged account, and select the link provided in the email. ++ Enter the **verification code** from the email to validate your email address. ++## Step 2: Complete signup with email instructions ++1. When you enter the verification code, you'll be brought to a page where you can create a new account. ++2. Fill in the username and password fields with the account that you want to use, and then complete the steps to create the account. ++## Step 3: Verify domain ownership and become the admin ++1. After you complete Step 2, select the admin center icon in the left navigation pane (alternatively, go to a browser and type in `https://admin.microsoft.com`). ++ You're redirected to the admin takeover wizard. ++1. Select **Next** and verify that you own the domain you want to take over by adding a TXT record to your domain registrar. ++ The wizard will give you the TXT record to add, as well as provide a link to your registrar's website, and a link to step-by-step instructions. ++1. On the **You're now the admin** page, select **Go to the admin center**. ++ You now have the admin privileges required to remove the domain from the formerly unmanaged account. ++## Step 4: Remove a domain from the unmanaged account ++1. Go to **Users** > **Active users** for the account you joined in Step 2, and then select the Display name for the username you're logged in with. ++1. Under **Username**, select **Manage username**, and move the user to the onmicrosoft domain by choosing the onmicrosoft.com domain from the dropdown list. ++1. Sign out of the account and sign back in using the new `username@account.onmicrosoft.com`. ++1. Select **Settings** > **Domains**, locate the domain you want to add to the other account and select **Remove domain**. ++ If you're asked to select another domain as the default, choose the onmicrosoft.com domain. ++ If other users are using the domain, you must remove them. Choose from the options to **Automatically remove**, manually move the users to your domain, or remove the users completely. ++ > [!NOTE] + > Check back as it can take some time for the domain to be removed from the account. Removal is complete when the domain disappears from the account. ++1. Sign out of the account. ++## Step 5: Add the domain to your account ++1. Log in to the account where you want to add the domain. ++1. Select **Settings** > **Domains** > **+ Add domain**, and then enter the domain name to continue with wizard steps to verify domain ownership in this account and complete adding the domain to your account. + +## Related content ++[Perform an internal admin takeover](become-the-admin.md) (article) |
| admin | Remove A Domain From Another Account | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/remove-a-domain-from-another-account.md | + + Title: "Remove a domain from another account" +f1.keywords: +- CSH ++++audience: Admin +++ms.localizationpriority: medium ++- M365-subscription-management +- Adm_O365 +- Adm_NonTOC ++- AdminSurgePortfolio +- AdminTemplateSet +search.appverid: +- BCS160 +- MET150 +- MOE150 +ms.assetid: b9707ec8-2247-4e25-9bad-f11ddbc686e4 +description: "Learn how to join an unmanaged account created by a self-service user signup in Microsoft 365." +++# Perform an internal admin takeover ++ **[Check the Domains FAQ](../setup/domains-faq.yml)** if you don't find what you're looking for. ++If you are an admin and want to take over an unmanaged account created by a self-service user signup, you can do this by performing an internal admin takeover. ++> [!NOTE] +> A self-service sign up for any cloud service that uses Azure AD adds the user to an unmanaged or "shadow" Azure AD directory and creates an unmanaged account. An unmanaged account is a directory without a global administrator. To determine whether an account is managed or unmanaged, see [Determining Tenant Type](/power-platform/admin/powerapps-gdpr-dsr-guide-systemlogs#determining-tenant-type). + +## Before you begin ++Sometimes you can't add a domain to your organization account because someone else has already signed up for Microsoft 365 using an email address associated with that domain name. But you can remove the domain from the other, unmanaged account and add it to your organization managed account. ++Before you can remove the domain from the other account and add it to your account though, you must join the unmanaged account and become an admin for that account. Then, you'll remove the domain from the unmanaged account, sign back into your account, and add the domain to your managed account. ++The steps in this article outline only how to join the other account (Steps 1 and 2) and follow the steps in the admin takeover wizard to become the admin on the unmanaged account (Step 3). ++After you've become an admin for the unmanaged account, you can remove the domain from the unmanaged account and add it to your account. ++## Step 1: Verify your email address ++> [!NOTE] +> If self-service is enabled in your account, users can subscribe to free services such as Power BI, on their own. These services are specifically for use in cases where a self-service user subscription has created the unmanaged account you want to take over as admin. In Step 1 you create a user account for the domain you want to remove by using Power BI to launch the admin takeover wizard so you can become the admin for the unmanaged domain account. ++1. To sign up for Power BI, go to the [Power BI site](https://powerbi.com) and select **Start Free** > **Start free trial** (in Share with Power BI Pro box). ++2. Sign up with a user account that uses the domain name of your organization (like `powerbiadmin@contoso.com`). If your account is already in use, sign in using your current password. ++3. Check your email for the **verification code** and enter the code to validate your email address. ++## Step 2: Create a new account for admin access ++1. When you enter the verification code, you'll be brought to a page where you can create a new account. ++2. Fill in the user name and password fields with the account that you want to use, then select **Start**. ++## Step 3: Verify domain ownership and become the admin ++1. After you complete Step 2, select the admin center icon in the left navigation pane (alternatively, go to a browser and type in `https://admin.microsoft.com`). ++ You're redirected to the admin takeover wizard. ++1. Select **Next** and verify that you own the domain you want to take over by adding a TXT record to your domain registrar. ++ The wizard will give you the TXT record to add, as well as provide a link to your registrar's website, and a link to step-by-step instructions. ++1. On the **You're now the admin** page, select **Go to the admin center**. ++ You now have the admin privileges required to remove the domain from the other account. +## Related content ++YouTube: [3 steps to do an IT Admin Takeover for Power BI and Microsoft 365](https://www.youtube.com/watch?v=xt5EsrQBZZk) (video)\ +[Admin takeover in Azure AD](/azure/active-directory/users-groups-roles/domains-admin-takeover) (article)\ +[Using self-service sign up in your organization](self-service-sign-up.md) (article)\ +[Understanding the Power BI service administrator role](/power-bi/service-admin-role) (article) |
| compliance | Records Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/records-management.md | Use the following capabilities to support your records management solution in Mi Using these capabilities, you can incorporate your organization's retention schedules and requirements into a records management solution that manages retention, records declaration, and disposition, to support the full lifecycle of your content. -In addition to the online documentation, you might find it useful to listen to the [webinar recording](https://aka.ms/MIPC/Video-RecordsManagementWebinar) for records management, and download the accompanying [deck with FAQs](https://aka.ms/MIPC/Blog-RecordsManagementWebinar). +In addition to the online documentation, you might find it useful to download a [deck with FAQs](https://aka.ms/MIPC/Blog-RecordsManagementWebinar) from a records management webinar. The recording of the actual webinar is no longer available. ## Records |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | For these scenarios, using their Office apps, a user with built-in labeling can ### Dynamic markings with variables > [!IMPORTANT]-> Currently, not all apps on all platforms support dynamic content markings that you can specify for your headers, footers, and watermarks. For apps that don't support this capability, they apply the markings as the original text specified in the label configuration, rather than resolving the variables. +> If your Office apps don't support this capability, they apply the markings as the original text specified in the label configuration, rather than resolving the variables. > > The Azure Information Protection unified labeling client supports dynamic markings. For labeling built in to Office, see the tables in the [capabilities](#support-for-sensitivity-label-capabilities-in-apps) section on this page for minimum versions supported. |
| contentunderstanding | Content Assembly | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/content-assembly.md | + + Title: Create documents using content assembly in Microsoft SharePoint Syntex ++++audience: admin +++search.appverid: ++ - enabler-strategic + - m365initiative-syntex +ms.localizationpriority: medium +description: Learn how to automatically create documents and other content using content assembly in Microsoft SharePoint Syntex. +++# Create documents using content assembly in Microsoft SharePoint Syntex ++You can use SharePoint Syntex to help you automatically generate standard repetitive business documents, such as contracts, statements of work, service agreements, letters of consent, sales pitches, and correspondence. You can do all this quicker, more consistentently, and less prone to errors by using content assembly in SharePoint Syntex. ++With content assembly, you can use an existing document to create a *modern template*, and then use that template to automatically generate new content using SharePoint lists or user inputs as a data source. ++> [!NOTE] +> You must be a licensed SharePoint Syntex user to access and use content assembly capabilities. You also must have permissions to manage SharePoint lists. ++## Create a modern template ++Follow these steps to create a modern template. ++1. From a Sharepoint document library, select **New** > **Create modern template**. + +  ++2. Choose an existing Word document that you want to use as a basis for creating a modern template, and then select **Open**. + +  ++ > [!NOTE] + > Currently, you can upload only Word documents (.docx extension) to create templates. Upload Word documents from your local storage or desktop. ++3. After you upload the document, the document is displayed in the template studio where you can convert the document to a template. + +  ++4. At the upper-left corner of the template studio, select the name for the template. The default name is the name of the document used to create the template. If you want to rename the template, select the default name or the pencil icon next to the name, type the new name, and then select **Enter**. + +  ++5. Create placeholders for all dynamic text in the document that users might want to change from one document to another. For example, you might want to create a placeholder for input such as company name, client name, address, phone number, or date. ++ To create a placeholder, select the text (such as the date). The **All placeholders** panel will open, where you'll give the placeholder a relevant name and choose the type of input you want to associate with the placeholder. + +  ++ Currently, there are two ways for users to fill in a placeholder: ++ - [Enter text or select a date](#associate-a-placeholder-by-entering-text-or-selecting-a-date) + - [Select from choices in a column of a list or library](#associate-a-placeholder-by-selecting-from-choices-in-a-column-of-a-list-or-library) ++### Associate a placeholder by entering text or selecting a date ++On the **All placeholders** panel: ++1. In the **Name** field, enter a relevant name for the placeholder. ++  ++2. In the **How authors fill in this placeholder** section, select **Enter text or select a date**. ++3. In the **Type of info** field, select the data type you want to associate with the placeholder. Currently, there are six options available: **Single line of text**, **Multiple lines of text**, **Number**, **Date and time**, **Email**, and **Hyperlink**. ++4. Select **Add**. ++### Associate a placeholder by selecting from choices in a column of a list or library ++On the **All placeholders** panel: ++1. In the **Name** field, enter a relevant name for the placeholder. ++  ++2. In the **How authors fill in this placeholder** section, choose **Select from choices in a column of a list or library**, and then choose **Select**. ++3. On the **Select a list for adding a source column** page, select the list you want to use, and then select **Next**. ++  ++4. On the **Select a source column from the existing list** page, select the column name you want to associate with the placeholder, and then select **Save**. ++  ++ If you want to see the original page of lists again, select **Go to (list name)** link at the bottom of the list. ++5. When you're done, you'll see that the list field has been associated with the placeholder. ++  ++6. If you want users to be able to add inputs manually, in addition to choosing from a list, select **Allow authors to add new choices**. In this case, the default for the manual input data type is *Single line of text*. Also the values input by the authors will only be used to generate the document. They won't be added to the SharePoint list. + +You can create as many placeholders as you think are necessary. When you're done, you can choose to save the template as a draft or publish the template. ++ - **Save draft** – Saves the template as a draft and you can access it later. You can view, edit, or publish saved drafts from the **Modern templates** section by selecting **New** > **Edit New menu** from the document library. + - **Publish** – Publishes the template to be used by other users in the organization to create documents. You can view, edit, or unpublish *published* templates from the **Modern templates** section by selecting **New** > **Edit New menu** from the document library. ++## Edit a modern template ++If you need to edit an existing template or to delete or unpublish a template, follow these steps. ++1. From a Sharepoint document library, select **New** > **Edit New menu**. + +  ++2. On the **Edit New menu** panel, in the **Modern templates** section, select the published or draft template you want to edit. + +  ++3. To edit a published template or a draft template: ++ - For **Published templates**, select **Edit** to open the template studio where you can edit the published template. You can also choose to delete or unpublish the template. + +  ++ - For **Draft templates**, select **Edit** to open the template studio where you can edit the draft template. You can also choose to delete or publish the template. + +  ++## Create a document from a modern template ++You can use a *published* modern template to quickly create similar documents without having to start from scratch. To create a document using a published template, follow these steps: ++1. From a Sharepoint document library, select **New**, and then select the modern template you want to use. + +  ++2. The template opens in the template studio. ++3. On the **Create a document from a template** panel, enter the information, and then select **Create document**. ++  ++ To help reduce time and effort involved in filling values for placeholders, SharePoint Syntex provides: ++ - Suggestions to help you easily pick values when selecting values from a list. + - Autofill placeholder values if able to uniquely identify a record for placeholders associated with the same list. ++> [!NOTE] +> - Currently, only Microsoft Word documents (.docx extension) are supported for creating a template. Before uploading the document, ensure that the Word document doesn't have **Track changes** enabled or comments. If your document contains text placeholders for images, ensure that they are not text-wrapped. +>- The template and the document are associated with one document library. To use the template in another document library, you will need to create the template again in that document library. +>- You can create placeholders only for text. Currently, images, smart art, tables, and bullet lists are not supported. +>- Once a document is created from a template, it is not associated with the template. ++++ |
| security | Automation Levels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/automation-levels.md | Automated investigation and remediation (AIR) capabilities in Microsoft Defender - *Full automation* (recommended) means remediation actions are taken automatically on artifacts determined to be malicious. - *Semi-automation* means some remediation actions are taken automatically, but other remediation actions await approval before being taken. (See the table in [Levels of automation](#levels-of-automation).)-- All remediation actions, whether pending or completed, are tracked in the Action Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)).+- All remediation actions, whether pending or completed, are tracked in the Action Center ([https://security.microsoft.com](https://security.microsoft.com)). > [!TIP] > For best results, we recommend using full automation when you [configure AIR](configure-automated-investigations-remediation.md). Data collected and analyzed over the past year shows that customers who are using full automation had 40% more high-confidence malware samples removed than customers who are using lower levels of automation. Full automation can help free up your security operations resources to focus more on your strategic initiatives. |
| security | Configure Endpoints Non Windows | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-non-windows.md | You'll need to take the following steps to onboard non-Windows devices: For macOS and Linux devices, you can choose to offboard through Microsoft Defender for Endpoint. In the navigation pane, select **Settings** \> **Offboard** \> **Select Operating System to start the offboarding Process**. -You can also offboard non-Windows devices by disabling the third-party integration. Enable coverage for devices running non-Windows platforms by [integrating third-party solutions](https://securitycenter.windows.com/interoperability/partners). +You can also offboard non-Windows devices by disabling the third-party integration. Enable coverage for devices running non-Windows platforms by [integrating third-party solutions](https://security.microsoft.com/interoperability/partners). ## Related topics - [Onboard Windows devices](configure-endpoints.md) |
| security | Configure Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints.md | ms.technology: mde [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:**+ - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) - [Microsoft 365 Endpoint data loss prevention (DLP)](/microsoft-365/compliance/endpoint-dlp-learn-about) In general, you'll identify the Windows device you're onboarding, then follow th  ## Endpoint onboarding tools+ Depending on the Windows endpoint you want to onboard, use the corresponding tool or method described in the following table. Windows device | Onboarding tool or method Windows device | Onboarding tool or method |<ul><li> Windows Server 2008 R2 SP1 </li></ul>| [Microsoft Monitoring Agent (MMA)](onboard-downlevel.md) <br>[Onboard previous versions of Windows](onboard-downlevel.md) or [Microsoft Defender for Cloud](/azure/security-center/security-center-wdatp) <br><br> **NOTE**: Microsoft Monitoring Agent is now Azure Log Analytics agent. To learn more, see [Log Analytics agent overview](/azure/azure-monitor/platform/log-analytics-agent). |<ul><li> Windows 7 SP1 </li> <li> Windows 7 SP1 Pro </li> <li> Windows 8.1 Pro </li> <li> Windows 8.1 Enterprise</li></ul> | [Microsoft Monitoring Agent (MMA)](onboard-downlevel.md) <br><br> **NOTE**: Microsoft Monitoring Agent is now Azure Log Analytics agent. To learn more, see [Log Analytics agent overview](/azure/azure-monitor/platform/log-analytics-agent). -- (<a id="fn1">1</a>) Windows Server 2016 and Windows Server 2012 R2 will need to be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016). - >[!IMPORTANT] >In order to be eligible to purchase Microsoft Defender for Endpoint Server SKU, you must have already purchased a combined minimum of any of the following, Windows E5/A5, Microsoft 365 E5/A5 or Microsoft 365 E5 Security subscription licenses. For more information on licensing, see the [Product Terms](https://www.microsoft.com/licensing/terms/productoffering/MicrosoftDefenderforEndpointServer/all). - Topic|Description :|: [Onboard devices using Group Policy](configure-endpoints-gp.md)|Use Group Policy to deploy the configuration package on devices. Topic|Description > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-configureendpoints-belowfoldlink) - After onboarding the device, you can choose to run a detection test to verify that a device is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender for Endpoint device](run-detection-test.md). |
| security | Configure Server Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-server-endpoints.md | You will need to download both the **installation** and **onboarding** packages > [!div class="mx-imgBorder"] > - +++ > [!NOTE] + > On Windows Server 2012R2, Microsoft Defender Antivirus will get installed by the installation package and will be active unless you set it to passive mode. On Windows Server 2016, Microsoft Defender Antivirus must be installed as a feature (see [Switch to MDE](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2#re-enable-microsoft-defender-antivirus-on-windows-server-2016)) first and fully updated before proceeding with the installation. + > + > If you are running a non-Microsoft antimalware solution ensure you add exclusions for Microsoft Defender Antivirus ([from this list of Microsoft Defender Processes on the Defender Processes tab](https://download.microsoft.com/download/8/e-urls.xlsx)) to the non-Microsoft solution before installation. It is also recommended to add non-Microsoft security solutions to the Defender Antivirus exclusion list. + The **installation package** contains an MSI file that installs the Microsoft Defender for Endpoint agent. Use the following steps to download the packages: 4. Select **Download onboarding package** and save the .zip file. +5. Install the installation package using any of the options to install Microsoft Defender Antivirus. The installation requires administrative permissions. + ### STEP 2: Apply the installation and onboarding package The `/quiet` switch suppresses all notifications. > [!NOTE] > Microsoft Defender Antivirus doesn't automatically go into passive mode. You can choose to set Microsoft Defender Antivirus to run in passive mode if you are running a non-Microsoft antivirus/antimalware solution. For command line installations, the optional `FORCEPASSIVEMODE=1` immediately sets the Microsoft Defender Antivirus component to Passive mode to avoid interference. Then, to ensure Defender Antivirus remains in passive mode after onboarding to support capabilities like EDR Block, set the "ForceDefenderPassiveMode" registry key.-> -> - The Onboarding package for Windows Server 2019 and Windows Server 2022 through Microsoft Endpoint Manager currently ships a script. For more information on how to deploy scripts in Configuration Manager, see [Packages and programs in Configuration Manager](/configmgr/apps/deploy-use/packages-and-programs). -> - A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, or Microsoft Endpoint Configuration Manager. Support for Windows Server provides deeper insight into server activities, coverage for kernel and memory attack detection, and enables response actions. The following steps are only applicable if you're using a third-party anti-malwa Data collected by Defender for Endpoint is stored in the geo-location of the tenant as identified during provisioning. > - If you use Defender for Endpoint before using Microsoft Defender for Cloud, your data will be stored in the location you specified when you created your tenant even if you integrate with Microsoft Defender for Cloud at a later time. > - Once configured, you cannot change the location where your data is stored. If you need to move your data to another location, you need to contact Microsoft Support to reset the tenant.+> - The Onboarding package for Windows Server 2019 and Windows Server 2022 through Microsoft Endpoint Manager currently ships a script. For more information on how to deploy scripts in Configuration Manager, see [Packages and programs in Configuration Manager](/configmgr/apps/deploy-use/packages-and-programs). +> - A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, or Microsoft Endpoint Configuration Manager. + ## Windows Server Semi-Annual Enterprise Channel and Windows Server 2019 and Windows Server 2022 |
| security | Defender Endpoint Plan 1 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1.md | To learn more, see [Defender for Endpoint APIs](management-apis.md). Most organizations use various devices and operating systems. Currently, Defender for Endpoint Plan 1 supports the following operating systems: +- Windows 7 (ESU required) +- Windows 8.1 - Windows 10, version 1709, or later - macOS: 11.5 (Big Sur), 10.15.7 (Catalina), or 10.14.6 (Mojave) - iOS |
| security | Linux Install With Ansible | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-install-with-ansible.md | Create a subtask or role files that contribute to a playbook or task. dnf: name: mdatp state: latest- enablerepo: packages-microsoft-com-prod-[channel] + enablerepo: packages-microsoft-[channel] ``` ```bash |
| security | Mac Install With Intune | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-install-with-intune.md | This profile contains a license information for Microsoft Defender for Endpoint, >  1. Choose a name for the configuration profile name, e.g., "Defender for Endpoint onboarding for macOS".+1. Choose a [deployment channel](/mem/intune/fundamentals/whats-new#new-deployment-channel-setting-for-custom-device-configuration-profiles-on-macos-devices). 1. Select intune/WindowsDefenderATPOnboarding.xml that you extracted from the onboarding package above as configuration profile file. > [!div class="mx-imgBorder"] |
| security | Mac Resources | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-resources.md | There are several ways to uninstall Microsoft Defender for Endpoint on macOS. No - Open **Finder > Applications**. Right click on **Microsoft Defender for Endpoint > Move to Trash**. +### Supported output types ++Supports table and JSON format output types. For each command, there's a default output behavior. You can modify the output in your preferred output format using the following commands: ++`-output json` ++`-output table` + ### From the command line - `sudo '/Library/Application Support/Microsoft/Defender/uninstall/uninstall'` |
| security | Mac Schedule Scan | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-schedule-scan.md | The following code shows the schema you need to use to schedule a quick scan. <key>Hour</key> <integer>2</integer> <key>Minute</key>- <integer>0</integer> + <integer>50</integer> <key>Weekday</key> <integer>5</integer> </dict> The following code shows the schema you need to use to schedule a quick scan. launchctl start <your file name> ``` -3. Your scheduled scan will run at the date, time, and frequency you defined in your p-list. In the examples above, the scan runs at 2:00 AM every Friday. -- The `Weekday` value of `StartCalendarInterval` uses an integer to indicate the fifth day of the week, or Friday. +3. Your scheduled scan will run at the date, time, and frequency you defined in your p-list. In the previous examples, the scan runs at 2:50 AM every Friday. + - The `Weekday` value of `StartCalendarInterval` uses an integer to indicate the fifth day of the week, or Friday. The range is between 0 and 7 with 7 representing Sunday. + - The `Day` value of `StartCalendarInterval` uses an integer to indicate the third day of the month. The range is between 1 and 31. + - The `Hour` value of `StartCalendarInterval` uses an integer to indicate the second hour of the day. The range is between 0 and 24. + The `Minute` value of `StartCalendarInterval` uses an integer to indicate fifty minutes of the hour. The range is between 0 and 59. + + > [!IMPORTANT] > Agents executed with *launchd* will not run at the scheduled time while the device is asleep. They will instead run once the device resumes from sleep mode. > |
| security | Microsoft Defender Antivirus Compatibility | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility.md | This section describes what happens with Microsoft Defender Antivirus and non-Mi <br/><br/> |Windows version|Primary antivirus/antimalware solution|Microsoft Defender Antivirus state|-|||| -|Windows 10 <p> Windows 11|Microsoft Defender Antivirus|Active mode| -|Windows 10 <p> Windows 11|A non-Microsoft antivirus/antimalware solution|Disabled mode (happens automatically)| -|Windows Server 2022 <p> Windows Server 2019<p> Windows Server, version 1803, or newer <p> Windows Server 2016 |Microsoft Defender Antivirus|Active mode| -|Windows Server 2022<p>Windows Server 2019<p>Windows Server, version 1803, or newer <p> Windows Server 2016 <p> |A non-Microsoft antivirus/antimalware solution|Disabled (set manually) <sup>[[1](#fn1)]</sup>| +|:|:|:| +|Windows 10 <br/> Windows 11|Microsoft Defender Antivirus|Active mode| +|Windows 10 <br/> Windows 11|A non-Microsoft antivirus/antimalware solution|Disabled mode (happens automatically)| +|Windows Server 2022 <br/> Windows Server 2019<br/> Windows Server, version 1803, or newer <br/> Windows Server 2016 |Microsoft Defender Antivirus|Active mode| +|Windows Server 2022<br/>Windows Server 2019<br/>Windows Server, version 1803, or newer <br/> Windows Server 2016 |A non-Microsoft antivirus/antimalware solution|Disabled (set manually) <sup>[[1](#fn1)]</sup>| (<a id="fn1">1</a>) On Windows Server, if you are running a non-Microsoft antivirus product, you can disable Microsoft Defender Antivirus by using Group Policy to turn off Microsoft Defender Antivirus, or by using the [DisableAntiSpyware](/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware) registry key. To use the registry key, navigate to `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender`, and set or create a DWORD entry called `DisableAntiSpyware`. Set its value to `1` (which sets the registry key's value to *true*), and select **Hexadecimal** for its base. This section describes what happens with Microsoft Defender Antivirus and non-Mi ## Microsoft Defender Antivirus and non-Microsoft antivirus/antimalware solutions -The following table summarizes what happens with Microsoft Defender Antivirus when non-Microsoft antivirus/antimalware solutions are used together or without Microsoft Defender for Endpoint. +The following table summarizes what happens with Microsoft Defender Antivirus when non-Microsoft antivirus/antimalware solutions are used together or without Microsoft Defender for Endpoint. <br/><br/> | Windows version | Antivirus/antimalware solution | Onboarded to <br/> Defender for Endpoint? | Microsoft Defender Antivirus state |-|||-|-| -| Windows 10 <p> Windows 11| Microsoft Defender Antivirus | Yes | Active mode | -| Windows 10 <p> Windows 11 | Microsoft Defender Antivirus | No | Active mode | -| Windows 10 <p> Windows 11 | A non-Microsoft antivirus/antimalware solution | Yes | Passive mode (automatically) | -| Windows 10 <p> Windows 11 | A non-Microsoft antivirus/antimalware solution | No | Disabled mode (automatically) | -| Windows Server 2019 <p>Windows Server, version 1803 or newer | Microsoft Defender Antivirus | Yes | Active mode | -| Windows Server 2019 <p> Windows Server, version 1803 or newer | Microsoft Defender Antivirus | No | Active mode | -| Windows Server 2019 <p> Windows Server, version 1803 or newer | A non-Microsoft antivirus/antimalware solution | Yes | Microsoft Defender Antivirus must be set to passive mode (manually) <sup>[[2](#fn2)]<sup> | -| Windows Server 2019 <p> Windows Server, version 1803 or newer | A non-Microsoft antivirus/antimalware solution | No | Microsoft Defender Antivirus must be disabled (manually) <sup>[[3](#fn3)]<sup></sup> | -| Windows Server 2016 <br><br> Windows Server 2012 R2 | Microsoft Defender Antivirus | Yes | Active mode | -|Windows Server 2016 <br><br> Windows Server 2012 R2 | Microsoft Defender Antivirus | No | Active mode | -| Windows Server 2016 <br><br> Windows Server 2012 R2 | A non-Microsoft antivirus/antimalware solution | Yes | Microsoft Defender Antivirus must be set to passive mode (manually) <sup>[[2](#fn2)]<sup> | -|Windows Server 2016 <br><br> Windows Server 2012 R2 | A non-Microsoft antivirus/antimalware solution | No | Microsoft Defender Antivirus must be disabled (manually) <sup>[[3](#fn3)]<sup> | +|:|:|:-|:-| +| Windows 10 <br/> Windows 11| Microsoft Defender Antivirus | Yes | Active mode | +| Windows 10 <br/> Windows 11 | Microsoft Defender Antivirus | No | Active mode | +| Windows 10 <br/> Windows 11 | A non-Microsoft antivirus/antimalware solution | Yes | Passive mode (automatically) | +| Windows 10 <br/> Windows 11 | A non-Microsoft antivirus/antimalware solution | No | Disabled mode (automatically) | +| Windows Server 2022 <br/> Windows Server 2019 <br/>Windows Server, version 1803 or newer | Microsoft Defender Antivirus | Yes | Active mode | +| Windows Server 2022 <br/> Windows Server 2019 <br/> Windows Server, version 1803 or newer | Microsoft Defender Antivirus | No | Active mode | +| Windows Server 2022 <br/> Windows Server 2019 <p> Windows Server, version 1803 or newer | A non-Microsoft antivirus/antimalware solution | Yes | Microsoft Defender Antivirus must be set to passive mode (manually) <sup>[[2](#fn2)]<sup> | +| Windows Server 2022 <br/> Windows Server 2019 <p> Windows Server, version 1803 or newer | A non-Microsoft antivirus/antimalware solution | No | Microsoft Defender Antivirus must be disabled (manually) <sup>[[3](#fn3)]<sup></sup> | +| Windows Server 2016 <br/> Windows Server 2012 R2 | Microsoft Defender Antivirus | Yes | Active mode | +|Windows Server 2016 <br/> Windows Server 2012 R2 | Microsoft Defender Antivirus | No | Active mode | +| Windows Server 2016 <br/> Windows Server 2012 R2 | A non-Microsoft antivirus/antimalware solution | Yes | Microsoft Defender Antivirus must be set to passive mode (manually) <sup>[[2](#fn2)]<sup> | +|Windows Server 2016 <br/> Windows Server 2012 R2 | A non-Microsoft antivirus/antimalware solution | No | Microsoft Defender Antivirus must be disabled (manually) <sup>[[3](#fn3)]<sup> | (<a id="fn2">2</a>) On Windows Server 2019, Windows Server, version 1803 or newer, Windows Server 2016, or Windows Server 2012 R2, Microsoft Defender Antivirus does not enter passive mode automatically when you install a non-Microsoft antivirus product. In those cases, set Microsoft Defender Antivirus to passive mode to prevent problems caused by having multiple antivirus products installed on a server. You can set Microsoft Defender Antivirus to passive mode using PowerShell, Group Policy, or a registry key. The table in this section summarizes the features and capabilities that are acti <br/><br/> | Protection | Microsoft Defender Antivirus <br/>(*Active mode*) | Microsoft Defender Antivirus <br/>(*Passive mode*) | Microsoft Defender Antivirus <br/>(*Disabled or uninstalled*) | [EDR in block mode](edr-in-block-mode.md) | - |||||| + |:|:|:|:|:| | [Real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md) | Yes | No <sup>[[4](#fn4)]</sup> | No | No | | [Cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) | Yes | No | No | No | | [Network protection](network-protection.md) | Yes | No | No | No | You can use one of several methods to confirm the state of Microsoft Defender An <br/><br/> | Method | Procedure | - ||| + |:|:| | Windows Security app | 1. On a Windows device, open the Windows Security app.<br/>2. Select **Virus & threat protection**.<br/>3. Under **Who's protecting me?** select **Manage providers**.<br/>4. On the **Security providers** page, under **Antivirus**, you should see **Microsoft Defender Antivirus is turned on**. | | Task Manager | 1. On a Windows device, open the Task Manager app.<br/>2. Select the **Details** tab.<br/>3. Look for **MsMpEng.exe** in the list. | - | Windows PowerShell <br/><br/> (To confirm that Microsoft Defender Antivirus is running) | 1. On a Windows device, open Windows PowerShell. <br/>2. Run the following PowerShell cmdlet: `Get-Process`.<br/>3. Review the results. You should see **MsMpEng.exe** if Microsoft Defender Antivirus is enabled. | - | Windows PowerShell <br/><br/> (To confirm that antivirus protection is in place) | You can use the [Get-MpComputerStatus PowerShell cmdlet](/powershell/module/defender/get-mpcomputerstatus). <br/><br/>1. On a Windows device, open Windows PowerShell.<br/>2. Run following PowerShell cmdlet: `Get-MpComputerStatus | select AMRunningMode`.<br/>3. Review the results. You should see either **Normal** or **Passive** if Microsoft Defender Antivirus is enabled on the endpoint. | + | Windows PowerShell <br/> (To confirm that Microsoft Defender Antivirus is running) | 1. On a Windows device, open Windows PowerShell. <br/>2. Run the following PowerShell cmdlet: `Get-Process`.<br/>3. Review the results. You should see **MsMpEng.exe** if Microsoft Defender Antivirus is enabled. | + | Windows PowerShell <br/>(To confirm that antivirus protection is in place) | You can use the [Get-MpComputerStatus PowerShell cmdlet](/powershell/module/defender/get-mpcomputerstatus).<br/>1. On a Windows device, open Windows PowerShell.<br/>2. Run following PowerShell cmdlet:<br/> Get-MpComputerStatus \| select AMRunningMode <br/>3. Review the results. You should see either **Normal** or **Passive** if Microsoft Defender Antivirus is enabled on the endpoint. | | Command Prompt | 1. On a Windows device, open Command Prompt.<br/>2. Type `sc query windefend`, and then press Enter.<br/>3. Review the results to confirm that Microsoft Defender Antivirus is running in passive mode. | ## More details about Microsoft Defender Antivirus states The table in this section describes various states you might see with Microsoft <br/><br/> | State | What happens | - ||| + |:|:| | Active mode | In active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. Settings that are configured by using Configuration Manager, Group Policy, Microsoft Intune, or other management products will apply. Files are scanned, threats are remediated, and detection information is reported in your configuration tool (such as Configuration Manager or the Microsoft Defender Antivirus app on the endpoint itself). | | Passive mode | In passive mode, Microsoft Defender Antivirus is not used as the antivirus app, and threats are *not* remediated by Microsoft Defender Antivirus. Threats can be remediated by [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md), however. <br/><br/> Files are scanned, and reports are provided for threat detections that are shared with the Defender for Endpoint service. You might see alerts in the [Defender for Cloud](microsoft-defender-security-center.md) showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode. <br/><br/> When Microsoft Defender Antivirus is in passive mode, you can still [manage updates for Microsoft Defender Antivirus](manage-updates-baselines-microsoft-defender-antivirus.md); however, you can't move Microsoft Defender Antivirus into active mode if your devices have a non-Microsoft antivirus product that is providing real-time protection from malware. <br/><br/> For optimal security layered defense and detection efficacy, make sure to get your antivirus and antimalware updates, even if Microsoft Defender Antivirus is running in passive mode. See [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md). <br/><br/> **NOTE**: Passive mode is not supported on Windows Server 2016. | | Disabled <br/><br/> or <br/><br/> Uninstalled | When disabled or uninstalled, Microsoft Defender Antivirus is not used as the antivirus app. Files are not scanned and threats are not remediated. <br/><br/> Disabling or uninstalling Microsoft Defender Antivirus is not recommended in general; if possible, keep Microsoft Defender Antivirus in passive mode if you are using a non-Microsoft antimalware/antivirus solution. <br/><br/> In cases where Microsoft Defender Antivirus is disabled automatically, it can be re-enabled automatically if the non-Microsoft antivirus/antimalware product expires or otherwise stops providing real-time protection from viruses, malware, or other threats. The automatic re-enabling of Microsoft Defender Antivirus helps to ensure that antivirus protection is maintained on your endpoints. <br/><br/> You might also use [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), which works with the Microsoft Defender Antivirus engine to periodically check for threats if you are using a non-Microsoft antivirus app. | |
| security | Microsoft Defender Endpoint Linux | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-linux.md | If you experience any installation failures, refer to [Troubleshooting installat - Supported Linux server distributions and x64 (AMD64/EM64T) versions: - Red Hat Enterprise Linux 6.7 or higher- - Red Hat Enterprise Linux 7.2 or higher + - Red Hat Enterprise Linux 7.2 or higher + - Red Hat Enterprise Linux 8.x - CentOS 6.7 or higher - CentOS 7.2 or higher - Ubuntu 16.04 LTS or higher LTS |
| security | Onboarding Endpoint Manager | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/onboarding-endpoint-manager.md | ms.technology: mde [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:**+ - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) - > Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) This article is part of the Deployment guide and acts as an example onboarding method. In the [Planning](deployment-strategy.md) topic, there were several methods prov While Defender for Endpoint supports onboarding of various endpoints and tools, this article does not cover them. For information on general onboarding using other supported deployment tools and methods, see [Onboarding overview](onboarding.md). -[Microsoft Endpoint Manager](/mem/endpoint-manager-overview) is a solution platform that unifies several services. It includes [Microsoft Intune](/mem/intune/fundamentals/what-is-intune) +[Microsoft Endpoint Manager](/mem/endpoint-manager-overview) is a solution platform that unifies several services. It includes [Microsoft Intune](/mem/intune/fundamentals/what-is-intune) -based device management. This onboarding guidance will walk you through the following basic steps that yo Here are the links you'll need for the rest of the process: - [MEM portal](https://aka.ms/memac)-- [Microsoft Defender for Endpoint](https://securitycenter.windows.com/)+- [Microsoft 365 Defender](https://security.microsoft.com) - [Intune Security baselines](/mem/intune/protect/security-baseline-settings-defender-atp#microsoft-defender) For more information about Microsoft Endpoint Manager, check out these resources: |
| security | Prevent Changes To Security Settings With Tamper Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection.md | Title: Protect security settings with tamper protection-+ description: Use tamper protection to prevent malicious apps from changing important security settings. keywords: malware, defender, antivirus, tamper protection Tamper protection doesn't prevent you from viewing your security settings. And, |To perform this task...|See this section...| ||| |Manage tamper protection across your tenant <p> Use the Microsoft 365 Defender portal to turn tamper protection on or off|[Manage tamper protection for your organization using the Microsoft 365 Defender](#manage-tamper-protection-for-your-organization-using-the-microsoft-365-defender-portal)|-|Fine-tune tamper protection settings in your organization <p> Use Intune (Microsoft Endpoint Manager) to turn tamper protection on or off. You can configure tamper protection for some or all users with this method.|[Manage tamper protection for your organization using Intune](#manage-tamper-protection-for-your-organization-using-intune)| +|Fine-tune tamper protection settings in your organization <p> Use Intune (Microsoft Endpoint Manager) to turn tamper protection on or off. You can configure tamper protection for some or all users with this method.|[Manage tamper protection for your organization using Microsoft Endpoint Manager](#manage-tamper-protection-for-your-organization-using-microsoft-endpoint-manager)| |Turn tamper protection on (or off) for your organization with Configuration Manager|[Manage tamper protection for your organization using tenant attach with Configuration Manager, version 2006](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006)| |Turn tamper protection on (or off) for an individual device|[Manage tamper protection on an individual device](#manage-tamper-protection-on-an-individual-device)| |View details about tampering attempts on devices|[View information about tampering attempts](#view-information-about-tampering-attempts)| Tamper protection can be turned on or off for your tenant using the Microsoft 36 - When you use the Microsoft 365 Defender portal to manage tamper protection, you do not have to use Intune or the tenant attach method. -- When you manage tamper protection in the Microsoft 365 Defender portal, the setting is applied tenant wide, affecting all of your devices that are running Windows 10, Windows 10 Enterprise multi-session, Windows 11, Windows 11 Enterprise multi-session, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 or Windows Server 2022. To fine-tune tamper protection (such as having tamper protection on for some devices but off for others), use either [Intune](#manage-tamper-protection-for-your-organization-using-intune) or [Configuration Manager with tenant attach](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006).+- When you manage tamper protection in the Microsoft 365 Defender portal, the setting is applied tenant wide, affecting all of your devices that are running Windows 10, Windows 10 Enterprise multi-session, Windows 11, Windows 11 Enterprise multi-session, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 or Windows Server 2022. To fine-tune tamper protection (such as having tamper protection on for some devices but off for others), use either [Microsoft Endpoint Manager](#manage-tamper-protection-for-your-organization-using-microsoft-endpoint-manager) or [Configuration Manager with tenant attach](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006). - If you have a hybrid environment, tamper protection settings configured in Intune take precedence over settings configured in the Microsoft 365 Defender portal. Tamper protection can be turned on or off for your tenant using the Microsoft 36 - Windows 11 - Windows 10 Enterprise multi-session - Windows 11 Enterprise multi-session - - [Windows Server 2019](/windows-server/get-started-19/whats-new-19) + - Windows Server 2019 - Windows Server 2022- - Windows Server, version [1803](/windows/release-health/status-windows-10-1803) or later - - [Windows Server 2016](/windows-server/get-started/whats-new-in-windows-server-2016) - - [Windows Server 2012 R2](/win32/srvnodes/what-s-new-for-windows-server-2012-r2) + - Windows Server, version 1803 or later + - Windows Server 2016 + - Windows Server 2012 R2 For more information about releases, see [Windows 10 release information](/windows/release-health/release-information). - Your devices must be [onboarded to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboarding). -- Your devices must be using anti-malware platform version 4.18.2010.7 (or above) and anti-malware engine version 1.1.17600.5 (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).)+- Your devices must be using anti-malware platform version `4.18.2010.7` (or above) and anti-malware engine version `1.1.17600.5` (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).) - [Cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) must be turned on. For more information about releases, see [Windows 10 release information](/windo 3. Go to **General** \> **Advanced features**, and then turn tamper protection on. -## Manage tamper protection for your organization using Intune +## Manage tamper protection for your organization using Microsoft Endpoint Manager -If you are part of your organization's security team, and your subscription includes [Intune](/intune/fundamentals/what-is-intune), you can turn tamper protection on (or off) for your organization in the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). Use Intune when you want to fine-tune tamper protection settings. For example, if you want to enable tamper protection on some devices, but not all, use Intune. +If your organization uses Microsoft Endpoint Manager (MEM) you can turn tamper protection on (or off) for your organization in the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). Use Intune when you want to fine-tune tamper protection settings. For example, if you want to enable tamper protection on some devices, but not all, use Intune. -### Requirements for managing tamper protection in Intune +### Requirements for managing tamper protection in Endpoint Manager - Your devices must be [onboarded to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboarding). - You must have appropriate [permissions](/microsoft-365/security/defender-endpoint/assign-portal-access) assigned, such as global admin, security admin, or security operations. -- Your organization uses [Intune to manage devices](/intune/fundamentals/what-is-device-management). ([Intune licenses](/intune/fundamentals/licenses) are required; Intune is included in Microsoft 365 E5/E3, Enterprise Mobility + Security E5/E3, Microsoft 365 Business Premium, Microsoft 365 F1/F3, Microsoft 365 Government G5/G3, and Intune for Education.)+- Your organization uses [Microsoft Endpoint Manager to manage devices](/mem/endpoint-manager-getting-started). (Microsoft Endpoint Manager (MEM) licenses are required; MEM is included in Microsoft 365 E3/E5, Enterprise Mobility + Security E3/E5, Microsoft 365 Business Premium, Microsoft 365 F1/F3, Microsoft 365 Government G3/G5, and corresponding education licenses.) -- Your Windows devices must be running Windows 11 or Windows 10 OS [1709](/windows/release-health/status-windows-10-1709), [1803](/windows/release-health/status-windows-10-1803), [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019) or later. (For more information about releases, see [Windows 10 release information](/windows/release-health/release-information).)+- Your Windows devices must be running Windows 11 or Windows 10 [1709](/windows/release-health/status-windows-10-1709), [1803](/windows/release-health/status-windows-10-1803), [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), or later. (For more information about releases, see [Windows 10 release information](/windows/release-health/release-information).) - You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above). -- Your devices must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).)+- Your devices must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version `1.1.15500.X` (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).) -### Turn tamper protection on (or off) in Intune +### Turn tamper protection on (or off) in Microsoft Endpoint Manager - + -1. Go to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com) and sign in. +1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Endpoint security** \> **Antivirus**, and then choose **+ Create Policy**. -2. Select **Devices** \> **Configuration Profiles**. + - In the **Platform** list, select **Windows 10 and later**. + - In the **Profile** list, select **Windows Security experience**. -3. Create a profile that includes the following settings: +2. Create a profile that includes the following setting: - - **Platform: Windows 10 and later** - - **Profile type: Endpoint protection** - - **Category: Microsoft 365 Defender** - - **Tamper Protection: Enabled** + - **Enable tamper protection to prevent Microsoft Defender being disabled: Enable** -4. Assign the profile to one or more groups. --### Are you using Windows Server 2016, or Windows version 1709, 1803, or 1809? --If you are using Windows Server 2016, Windows 10 version 1709, 1803, or [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), you won't see **Tamper Protection** in the Windows Security app. Instead, you can use PowerShell to determine whether tamper protection is enabled. --On Windows Server 2016, the Settings app will not accurately reflect the status of real-time protection when tamper protection is enabled. --#### Use PowerShell to determine whether tamper protection and real-time protection are turned on --1. Open the Windows PowerShell app. --2. Use the [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus?preserve-view=true&view=win10-ps) PowerShell cmdlet. --3. In the list of results, look for `IsTamperProtected` or `RealTimeProtectionEnabled`. (A value of *true* means tamper protection is enabled.) --## Manage tamper protection for your organization with Configuration Manager, version 2006 +3. Assign the profile to one or more groups. + +### Manage tamper protection for your organization with Configuration Manager, version 2006 If you're using [version 2006 of Configuration Manager](/mem/configmgr/core/plan-design/changes/whats-new-in-version-2006), you can manage tamper protection settings on Windows 10, Windows 10 Enterprise multi-session, Windows 11, Windows 11 Enterprise multi-session, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, and Windows Server 2022 by using a method called *tenant attach*. Tenant attach enables you to sync your on-premises-only Configuration Manager devices into the Microsoft Endpoint Manager admin center, and then deliver endpoint security configuration policies to on-premises collections & devices. If you're using [version 2006 of Configuration Manager](/mem/configmgr/core/plan 3. Deploy the policy to your device collection. -### Need help with this method? +#### Need help with this method? See the following resources: Here's what you see in the Windows Security app: 3. Set **Tamper Protection** to **On** or **Off**. +## Are you using Windows Server 2016, or Windows version 1709, 1803, or 1809? ++If you are using Windows Server 2016, Windows 10 version 1709, 1803, or [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), you won't see **Tamper Protection** in the Windows Security app. Instead, you can use PowerShell to determine whether tamper protection is enabled. ++On Windows Server 2016, the Settings app will not accurately reflect the status of real-time protection when tamper protection is enabled. ++#### Use PowerShell to determine whether tamper protection and real-time protection are turned on ++1. Open the Windows PowerShell app. ++2. Use the [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus?preserve-view=true&view=win10-ps) PowerShell cmdlet. ++3. In the list of results, look for `IsTamperProtected` or `RealTimeProtectionEnabled`. (A value of *true* means tamper protection is enabled.) + ## View information about tampering attempts Tampering attempts typically indicate bigger cyberattacks. Bad actors try to change security settings as a way to persist and stay undetected. If you're part of your organization's security team, you can view information about such attempts, and then take appropriate actions to mitigate threats. When a tampering attempt is detected, an alert is raised in the [Microsoft 365 D  -Using [endpoint detection and response](/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response) and [advanced hunting](/microsoft-365/security/defender-endpoint/advanced-hunting-overview) capabilities in Microsoft Defender for Endpoint, your security operations team can investigate and address such attempts. +Using [endpoint detection and response](overview-endpoint-detection-response.md) and [advanced hunting](advanced-hunting-overview.md) capabilities in Microsoft Defender for Endpoint, your security operations team can investigate and address such attempts. ## Review your security recommendations -Tamper protection integrates with [Threat & Vulnerability Management](/microsoft-365/security/defender-endpoint/next-gen-threat-and-vuln-mgt) capabilities. [Security recommendations](/microsoft-365/security/defender-endpoint/tvm-security-recommendation) include making sure tamper protection is turned on. For example, you can search on *tamper*. In the results, you can select **Turn on Tamper Protection** to learn more and turn it on. +Tamper protection integrates with [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) capabilities. [Security recommendations](tvm-security-recommendation.md) include making sure tamper protection is turned on. For example, you can search on *tamper*. In the results, you can select **Turn on Tamper Protection** to learn more and turn it on.  -To learn more about Threat & Vulnerability Management, see [Threat & Vulnerability Management in Microsoft 365 Defender](/microsoft-365/security/defender-endpoint/tvm-dashboard-insights#threat--vulnerability-management-in-microsoft-defender-security-center). +To learn more about Threat & Vulnerability Management, see [Dashboard insights - threat and vulnerability management](tvm-dashboard-insights.md#dashboard-insightsthreat-and-vulnerability-management). ## Frequently asked questions If you are a home user, see [Manage tamper protection on an individual device](# If you are an organization using [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint), you should be able to manage tamper protection in Intune similar to how you manage other endpoint protection features. See the following sections of this article: -- [Manage tamper protection using Intune](#manage-tamper-protection-for-your-organization-using-intune)-- [Manage tamper protection using Configuration Manager, version 2006](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006)+- [Manage tamper protection using Microsoft Endpoint Manager](#manage-tamper-protection-for-your-organization-using-microsoft-endpoint-manager) - [Manage tamper protection using the Microsoft 365 Defender portal](#manage-tamper-protection-for-your-organization-using-the-microsoft-365-defender-portal) ### How does configuring tamper protection in Intune affect how I manage Microsoft Defender Antivirus with Group Policy? |
| security | Raw Data Export Event Hub | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/raw-data-export-event-hub.md | -2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to **Microsoft.insights****. +2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to Microsoft.insights**. ## Enable raw data streaming -1. Log in to the [Microsoft Defender Security Center](https://securitycenter.windows.com) as a ***Global Administrator*** or ***Security Administrator***. +1. Log in to the [Microsoft 365 Defender](https://security.microsoft.com) as a ***Global Administrator*** or ***Security Administrator***. -2. Go to the [Data export settings page](https://securitycenter.windows.com/interoperability/dataexport) on Microsoft Defender Security Center. +2. Go to the [Data export settings page](https://security.microsoft.com/interoperability/dataexport) in the Microsoft Defender portal. 3. Click on **Add data export settings**. -1. Log in to [Microsoft Defender Security Center](https://securitycenter.windows.com) and go to [Advanced Hunting page](https://securitycenter.windows.com/hunting-package). +1. Log in to [Microsoft 365 Defender](https://security.microsoft.com) and go to [Advanced Hunting page](https://security.microsoft.com/hunting-package). 2. Run the following query to get the data types mapping for each event: |
| security | Raw Data Export Storage | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/raw-data-export-storage.md | -1. Log in to [Microsoft Defender for Endpoint portal](https://securitycenter.windows.com) as a ***Global Administrator*** or ***Security Administrator***. +1. Log in to [Microsoft 365 Defender](https://security.microsoft.com) as a ***Global Administrator*** or ***Security Administrator***. -2. Go to [Data export settings page](https://securitycenter.windows.com/interoperability/dataexport) on Microsoft Defender Security Center. +2. Go to [Data export settings page](https://security.microsoft.com/interoperability/dataexport) in Microsoft 365 Defender. 3. Click on **Add data export settings**. -1. Log in to [Microsoft Defender Security Center](https://securitycenter.windows.com) and go to [Advanced Hunting page](https://securitycenter.windows.com/hunting-package). +1. Log in to [Microsoft 365 Defender](https://security.microsoft.com) and go to [Advanced Hunting page](https://security.microsoft.com/hunting-package). 2. Run the following query to get the data types mapping for each event: In order to get the data types for our events properties do the following: - [Overview of Advanced Hunting](advanced-hunting-overview.md) - [Microsoft Defender for Endpoint Streaming API](raw-data-export.md) - [Stream Microsoft Defender for Endpoint events to your Azure storage account](raw-data-export-storage.md)-- [Azure Storage Account documentation](/azure/storage/common/storage-account-overview)+- [Azure Storage Account documentation](/azure/storage/common/storage-account-overview) |
| security | Run Analyzer Windows | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/run-analyzer-windows.md | ms.technology: m365d **Replace HardDrivePath with the path to which the tool was extracted to, for example:** ```dos- C:\Work\tools\MDATPClientAnalyzer\MDEClientAnalyzer.cmd + C:\Work\tools\MDEClientAnalyzer\MDEClientAnalyzer.cmd ``` In addition to the above, there is also an option to [collect the analyzer support logs using live response.](troubleshoot-collect-support-log.md). > [!NOTE]-> On Windows 10, Windows Server 2019 or later OS editions, or Windows 11, the client analyzer script calls into an executable file called `MDEClientAnalyzer.exe` to run the connectivity tests to cloud service URLs. +> On Windows 10/11, Windows Server 2019/2022, or Windows Server 2012R2/2016 with the [modern unified solution](configure-server-endpoints.md#new-functionality-in-the-modern-unified-solution-for-windows-server-2012-r2-and-2016-preview) installed, the client analyzer script calls into an executable file called `MDEClientAnalyzer.exe` to run the connectivity tests to cloud service URLs. >-> On Windows 8.1, Windows Server 2016 or previous OS editions, the client analyzer script calls into an executable file called `MDEClientAnalyzerPreviousVersion.exe` to run connectivity tests for Command and Control (CnC) URLs while also calling into Microsoft Monitoring Agent connectivity tool `TestCloudConnection.exe` for Cyber Data channel URLs. +> On Windows 8.1, Windows Server 2016 or any previous OS edition where Microsoft Monitoring Agent (MMA) is used for onboarding, the client analyzer script calls into an executable file called `MDEClientAnalyzerPreviousVersion.exe` to run connectivity tests for Command and Control (CnC) URLs while also calling into Microsoft Monitoring Agent connectivity tool `TestCloudConnection.exe` for Cyber Data channel URLs. All the PowerShell scripts and modules included with the analyzer are Microsoft-signed. |
| security | Threat Analytics Analyst Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/threat-analytics-analyst-reports.md | ms.technology: mde [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:**+ - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) While detections allow you to identify and stop the tracked threat automatically [Advanced hunting](advanced-hunting-overview.md) provides a query interface based on Kusto Query Language that simplifies locating subtle indicators of threat activity. It also allows you to surface contextual information and verify whether indicators are connected to a threat. -Advanced hunting queries in the analyst reports have been vetted by Microsoft analysts and are ready for you to run in the [advanced hunting query editor](https://securitycenter.windows.com/advanced-hunting). You can also use the queries to create [custom detection rules](custom-detection-rules.md) that trigger alerts for future matches. +Advanced hunting queries in the analyst reports have been vetted by Microsoft analysts and are ready for you to run in the [advanced hunting query editor](https://security.microsoft.com/advanced-hunting). You can also use the queries to create [custom detection rules](custom-detection-rules.md) that trigger alerts for future matches. ## Related topics - [Threat analytics overview](threat-analytics.md) - [Proactively find threats with advanced hunting](advanced-hunting-overview.md) - [Custom detection rules](custom-detection-rules.md)-- |
| security | Troubleshoot Onboarding Error Messages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-onboarding-error-messages.md | ms.technology: mde [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:**+ - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) If you encounter issues with accessing the portal, missing data, or restricted a - `*.blob.core.windows.net` - `crl.microsoft.com` - `https://*.microsoftonline-p.com`-- `https://*.securitycenter.windows.com`-- `https://automatediracs-eus-prd.securitycenter.windows.com`+- `https://*.security.microsoft.com` +- `https://automatediracs-eus-prd.security.microsoft.com` - `https://login.microsoftonline.com` - `https://login.windows.net` - `https://onboardingpackagescusprd.blob.core.windows.net` - `https://secure.aadcdn.microsoftonline-p.com`-- `https://securitycenter.windows.com`+- `https://security.microsoft.com` - `https://static2.sharepointonline.com` |
| security | Investigate Alerts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/investigate-alerts.md | To manage an alert, select the alert in the alerts queue on its row to see a **M The **Manage alert** pane allows you to view or specify: - The alert status (New, Resolved, In progress).-- The user account that has been assigned the alert+- The user account that has been assigned the alert. - The alert's classification (Not set, True alert, False Alert). - For the classification as a true alert, the type of threat for the alert in **Determination** field. - A comment on the alert. |
| security | Manage Incidents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/manage-incidents.md | ms.technology: m365d Incident management is critical in ensuring that threats are contained and addressed. -Ratulac-acrolinx-updates You can manage incidents from **Incidents & alerts > Incidents** on the quick launch of the Microsoft 365 Defender portal ([security.microsoft.com](https://security.microsoft.com)). Here's an example. - :::image type="content" source="../../media/incidents-queue/incidents-ss-incidents.png" alt-text="Example of the incident queue." lightbox="../../media/incidents-queue/incidents-ss-incidents.png"::: Here are the ways you can manage your incidents: When you start typing, you have the option to select from a list of selected tag ## Assign an incident -If an incident has not yet been assigned, you can select the **Assign to** box and specify the user account (Preview). Te re-assign an incident, remove the current assignment account by selecting the "x" next to the account name and then select the **Assign to** box. Assigning ownership of an incident assigns the same ownership to all the alerts associated with it. +If an incident has not yet been assigned, you can select the **Assign to** box and specify the user account. To re-assign an incident, remove the current assignment account by selecting the "x" next to the account name and then select the **Assign to** box. Assigning ownership of an incident assigns the same ownership to all the alerts associated with it. You can get a list of incidents assigned to you by filtering the incident queue. |
| security | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/whats-new.md | For more information on what's new with other Microsoft Defender security produc - (GA) Microsoft Defender for Office 365 event data is available in the Microsoft 365 Defender event streaming API. You can see the availability and status of event types in the [Supported Microsoft 365 Defender event types in streaming API](supported-event-types.md). - (GA) Microsoft Defender for Office 365 data available in advanced hunting is now generally available.-- (Preview) Assign incidents and alerts to user accounts+- (GA) Assign incidents and alerts to user accounts You can assign an incident, and all the alerts associated with it, to a user account from **Assign to:** on the **Manage incident** pane of an incident or the **Manage alert** pane of an alert. |
| security | Investigate Malicious Email That Was Delivered | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/investigate-malicious-email-that-was-delivered.md | Threat Explorer is a powerful report that can serve multiple purposes, such as f > [!NOTE] > Default searches in Explorer don't currently include delivered items that were removed from the cloud mailbox by zero-hour auto purge (ZAP). This limitation applies to all views (for example, the **Email \> Malware** or **Email \> Phish** views). To include items removed by ZAP, you need to add a **Delivery action** set to include **Removed by ZAP**. If you include all options, you'll see all delivery action results, including items removed by ZAP. -1. In the Microsoft 365 Defender portal at <https://security.microsofot.com>, go to **Email & collaboration** \> **Explorer** . To go directly to the **Explorer** page, use <https://security.microsoft.com/threatexplorer>. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Explorer** . To go directly to the **Explorer** page, use <https://security.microsoft.com/threatexplorer>. On the **Explorer** page, the **Additional actions** column shows admins the outcome of processing an email. The **Additional actions** column can be accessed in the same place as **Delivery action** and **Delivery location**. Special actions might be updated at the end of Threat Explorer's email timeline, which is a new feature aimed at making the hunting experience better for admins. |
| security | Safe Links | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/safe-links.md | Safe Links protection for Office 365 apps has the following client requirements: - Office apps on iOS or Android devices. - Visio on Windows. - OneNote in a web browser.+ - Outlook for Windows when opening saved EML or MSG files. - Office 365 apps are configured to use modern authentication. For more information, see [How modern authentication works for Office 2013, Office 2016, and Office 2019 client apps](../../enterprise/modern-auth-for-office-2013-and-2016.md). |
| security | View Email Security Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/view-email-security-reports.md | On the main report page, the .-- **File detonation**: Malicious files detected by [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](mdo-for-spo-odb-and-teams.md).+- **MDO detonation**: Malicious files detected by [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](mdo-for-spo-odb-and-teams.md). +- **File reputation** In the details table below the chart, the following information is available: -- **Date (UTC)** **Start date** and **End date**-- **Location**+- **Date (UTC)** +- **Attachment filename** +- **Workload** - **Detection technology**-- **Malware name**+- **File size** +- **Last modifying user** If you click **Filter**, the following filters are available: - **Date (UTC)** **Start date** and **End date**-- **Detection**: **Anti-malware engine** or **File detonation**+- **Detection**: **Anti-malware engine**, **MDO detonation**, and **File detonation** +- **Workload**: **Teams**, **SharePoint**, and **OneDrive** When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. |
| solutions | Manage Creation Of Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-creation-of-groups.md | If you're a member of one of these roles, you can create Microsoft 365 Groups fo ## Licensing requirements -To manage who creates groups, the following people need Azure AD Premium licenses assigned to them: +To manage who creates groups, the following people need Azure AD Premium licenses or Azure AD Basic EDU licenses assigned to them: - The admin who configures these group creation settings - The members of the group who are allowed to create groups To manage who creates groups, the following people need Azure AD Premium license > [!NOTE] > See [Assign or remove licenses in the Azure Active Directory portal](/azure/active-directory/fundamentals/license-users-groups) for more details about how to assign Azure licenses. -The following people don't need Azure AD Premium licenses assigned to them: +The following people don't need Azure AD Premium or Azure AD Basic EDU licenses assigned to them: - People who are members of Microsoft 365 groups and who don't have the ability to create other groups. |