| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | About Shared Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/email/about-shared-mailboxes.md | Before you [create a shared mailbox](create-a-shared-mailbox.md), here are some - **Message deletion:** Unfortunately, you can't prevent people from deleting messages in a shared mailbox. The only way around this is to create a Microsoft 365 group instead of a shared mailbox. A group in Outlook is like a shared mailbox. For a comparison of the two, see [Compare groups](../create-groups/compare-groups.md). To learn more about groups, see [Learn more about groups](https://support.microsoft.com/office/b565caa1-5c40-40ef-9915-60fdb2d97fa2). +- **Multi-Geo** In a multi-geo environment, shared mailboxes need to be licensed the same way a user mailbox is licensed. Note that cross-geo mailbox auditing is not supported. For example, if a user is assigned permissions to access a shared mailbox in a different geo location, mailbox actions performed by that user are not logged in the mailbox audit log of the shared mailbox. + > [!NOTE] > To access a shared mailbox, a user must have an Exchange Online license, but the shared mailbox doesn't require a separate license. Every shared mailbox has a corresponding user account. Notice how you weren't asked to provide a password when you created the shared mailbox? The account has a password, but it's system-generated (unknown). You shouldn't use the account to log in to the shared mailbox. Without a license, shared mailboxes are limited to 50 GB. To increase the size limit to 100 GB, the shared mailbox must be assigned an Exchange Online Plan 2 license. The Exchange Online Plan 1 license with an Exchange Online Archiving add-on license will only increase the size of the archive mailbox. This will also let you enable auto-expanding archiving for additional archive storage capacity. Similarly, if you want to place a shared mailbox on litigation hold, the shared mailbox must have an Exchange Online Plan 2 license or an Exchange Online Plan 1 license with an Exchange Online Archiving add-on license. If you want to apply advanced features such as Microsoft Defender for Office 365, Advanced eDiscovery, or automatic retention policies, the shared mailbox must be licensed for those features. |
| commerce | View Your Bill Or Invoice | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/view-your-bill-or-invoice.md | You can submit your Fapiao request to our [Fapiao management system](https://go. ::: moniker-end > [!NOTE]-> +> > Microsoft 365 services do not provide payment receipts. > For credit card payments, please use the invoice and credit card billing statement to match your payment. - ## Receive a copy of your billing statement in email You can choose to receive a copy of your billing statement as an email attachment. If you do, be aware that: You can choose to receive a copy of your billing statement as an email attachmen ::: moniker range="o365-21vianet" 1. In the admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=853215" target="_blank">Billing notifications</a> page.- + ::: moniker-end 2. Under **Receive billing statement as email attachment?** switch the toggle to **On**. You can stop receiving the billing statement emails at any time by switching the toggle to **Off**. +## Run the Unknown Charge Diagnostic ++As a Microsoft 365 Global admin, you can use a diagnostic tool that runs within the Microsoft 365 admin center to research unexpected charges from Microsoft that appear on your bank or credit card statement. ++> [!NOTE] +> The Unknown Charge Diagnostic is only available for customers who bought their products and services from Microsoft.com, including Microsoft 365 Enterprise, Education, and Non-profit. ++Select the **Run Tests** link below to open the diagnostic tool in the Microsoft 365 admin center. ++>[!div class="nextstepaction"] +>[Run Tests: Unknown Charge](https://aka.ms/PillarUnknownCharge) + ## Next steps If you have a balance and would like to pay it, you can do that online. To learn how, see [Pay for your subscription](pay-for-your-subscription.md). |
| compliance | Classifier Learn About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/classifier-learn-about.md | Sensitivity and retention labels can then be automatically applied to make the c This classification method is well suited to content that isn't easily identified by either the manual or automated pattern-matching methods. This method of classification is more about using a classifier to identify an item based on what the item is, not by elements that are in the item (pattern matching). A classifier learns how to identify a type of content by looking at hundreds of examples of the content you're interested in classifying. > [!NOTE]-> You can view the trainable classifiers in content explorer by expanding **Trainable Classifiers** in the filters panel. The trainable classifiers will automatically display the number of incidents found in SharePoint, Teams, and OneDrive, without requiring any labeling. +> In Preview - You can view the trainable classifiers in content explorer by expanding **Trainable Classifiers** in the filters panel. The trainable classifiers will automatically display the number of incidents found in SharePoint, Teams, and OneDrive, without requiring any labeling. > If you do not want to use this feature, you must file a request with Microsoft Support to disable out-of-the-box classification. This will disable the scanning of your sensitive and labeled content before you create labeling policies. ### Where you can use classifiers |
| compliance | Create A Custom Sensitive Information Type | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-a-custom-sensitive-information-type.md | The SIT instance count limit applies when SITs are used in these solutions: - Information Governance - Communication Compliance - Records Management-- Microsoft Cloud App Security+- Microsoft Defender for Cloud Apps - Privacy Management For a scanned item to satisfy rule criteria, the number of unique instances of a SIT in any single item must fall between the min and max values. This is called the **Instance count**. |
| compliance | Customer Lockbox Requests | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/customer-lockbox-requests.md | If a customer rejects a Customer Lockbox request, no access to customer content #### How do I set up alerts whenever a request has been approved? -There is no built-in option to alert administrators. However, administrators can set up alerts using [Microsoft cloud App security](/cloud-app-security/getting-started-with-cloud-app-security#to-create-policies). +There is no built-in option to alert administrators. However, administrators can set up alerts using [Microsoft Defender for Cloud Apps](/cloud-app-security/getting-started-with-cloud-app-security#to-create-policies). #### Does Customer Lockbox protect against data requests from law enforcement agencies or other third parties? |
| compliance | Enable Mailbox Auditing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/enable-mailbox-auditing.md | The value **True** indicates that mailbox audit logging is bypassed for the user - If a mailbox is placed on hold or assigned to a retention policy in the Compliance Center, audit log records are still retained for the duration that's defined by the mailbox's *AuditLogAgeLimit* property (90 days by default). To retain audit log records longer for mailboxes on hold, you need to increase mailbox's *AuditLogAgeLimit* value. -- In a multi-geo environment, cross-geo mailbox auditing is not supported. For example, if a user is assigned permissions to access a shared mailbox in a different geo location, mailbox actions performed by that user are not logged in the mailbox audit log of the shared mailbox.+- In a multi-geo environment, cross-geo mailbox auditing is not supported. For example, if a user is assigned permissions to access a shared mailbox in a different geo location, mailbox actions performed by that user are not logged in the mailbox audit log of the shared mailbox. Exchange admin audit events are currently only available for the default location. |
| compliance | How Smtp Dane Works | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/how-smtp-dane-works.md | + + Title: "How SMTP DNS-based Authentication of Named Entities (DANE) works to secure email communications" +f1.keywords: +- NOCSH ++++audience: ITPro +++ms.localizationpriority: medium +search.appverid: +- MET150 ++- M365-security-compliance +description: "Learn how SMTP DNS-based Authentication of Named Entities (DANE) works to secure email communications between mail servers." +++# How SMTP DNS-based Authentication of Named Entities (DANE) works ++The SMTP protocol is the main protocol used to transfer messages between mail servers and is, by default, not secure. The Transport Layer Security (TLS) protocol was introduced years ago to support encrypted transmission of messages over SMTP. It’s commonly used opportunistically rather than as a requirement, leaving much email traffic in clear text, vulnerable to interception by nefarious actors. Furthermore, SMTP determines the IP addresses of destination servers through the public DNS infrastructure, which is susceptible to spoofing and Man-in-the-Middle (MITM) attacks. This has led to many new standards being created to increase security for sending and receiving email, one of those is DNS-based Authentication of Named Entities (DANE). + +DANE for SMTP [RFC 7672](https://tools.ietf.org/html/rfc7672) uses the presence of a Transport Layer Security Authentication (TLSA) record in a domain's DNS record set to signal a domain and its mail server(s) support DANE. If there is no TLSA record present, DNS resolution for mail flow will work as usual without any DANE checks being attempted. The TLSA record securely signals TLS support and publishes the DANE policy for the domain. So, sending mail servers can successfully authenticate legitimate receiving mail servers using SMTP DANE. This makes it resistant to downgrade and MITM attacks. DANE has direct dependencies on DNSSEC, which works by digitally signing records for DNS lookups using public key cryptography. DNSSEC checks occur on recursive DNS resolvers, the DNS servers that make DNS queries for clients. DNSSEC ensures that DNS records aren’t tampered with and are authentic. ++Once the MX, A/AAAA and DNSSEC-related resource records for a domain are returned to the DNS recursive resolver as DNSSEC authentic, the sending mail server will ask for the TLSA record corresponding to the MX host entry or entries. If the TLSA record is present and proven authentic using another DNSSEC check, the DNS recursive resolver will return the TLSA record to the sending mail server. ++After receiving the authentic TLSA record, the sending mail server establishes an SMTP connection to the MX host associated with the authentic TLSA record. The sending mail server will try to set up TLS and compare the server's TLS certificate with the data in the TLSA record to validate that the destination mail server connected to the sender is the legitimate receiving mail server. The message will be transmitted (using TLS) if authentication succeeds. When authentication fails or if TLS isn’t supported by the destination server, Exchange Online will retry the entire validation process beginning with a DNS query for the same destination domain again after 15 minutes, then 15 minutes after that, then every hour for the next 24 hours. If authentication continues to fail after 24 hours of retrying, the message will expire and an NDR with error details will be generated and sent to the sender. ++## What are the components of DANE? ++### TLSA Resource Record ++The TLS Authentication (TLSA) record is used to associate a server’s X.509 certificate or public key value with the domain name that contains the record. TLSA records can only be trusted if DNSSEC is enabled on your domain. If you’re using a DNS provider to host your domain, this may be a setting offered when configuring a domain with them. To learn more about DNSSEC zone signing, visit this link: [Overview of DNSSEC | Microsoft Docs](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj200221(v=ws.11)). + +Example TLSA record: + ++There are four configurable fields unique to the TLSA record type: ++**Certificate Usage Field**: Specifies how the sending email server should verify the destination email server’s certificate. ++|Value |Acronym |Description | +|||| +|0<sup>1</sup> |PKIX-TA |Certificate used is the trust-anchor Public CA from the X.509 trust-chain. | +|1<sup>1</sup> |PKIX-EE |Certificate checked is the destination server; DNSSEC checks must verify its authenticity. | +|2 |DANE-TA |Use server’s private key from the X.509 tree that must be validated by a trust anchor in the chain of trust. The TLSA record specifies the trust anchor to be used for validating the TLS certificates for the domain. | +|3 |DANE-EE |Only match against the destination server’s certificate. | ++<sup>1</sup> Exchange Online follows RFC implementation guidance that Certificate Usage Field values of 0 or 1 shouldn’t be used when DANE is implemented with SMTP. When a TLSA record that has a Certificate Usage field value of 0 or 1 is returned to Exchange Online, Exchange Online will treat it as not usable. If all TLSA records are found unusable, Exchange Online won’t perform the DANE validation steps for 0 or 1 when sending the email. Instead, because of the presence of a TLSA record, Exchange Online will enforce the use of TLS for sending the email, sending the email if the destination email server supports TLS or dropping the email and generating an NDR if the destination email server doesn’t support TLS. ++In the example TLSA record, the Certificate Usage Field is set to ‘3’, so the Certificate Association Data (‘abc123…xyz789’) would be matched against the destination server’s certificate only. ++**Selector field**: Indicates which parts of the destination server’s certificate should be checked. ++|Value |Acronym |Description | +|||| +|0 |Cert |Use full certificate. | +|1 |SPKI (Subject Public Key Info) |Use certificate’s public key and the algorithm with which the public key is identified to use. | ++In the example TLSA record, the Selector Field is set to ‘1’ so the Certificate Association Data would be matched using the destination server certificate’s public key and the algorithm with which the public key is identified to use. ++**Matching Type Field**: Indicates the format the certificate will be represented in the TLSA record. ++|Value |Acronym |Description | +|||| +|0 |Full |The data in the TSLA record is the full certificate or SPKI. | +|1 |SHA-256 |The data in the TSLA record is a SHA-256 hash of either the certificate or the SPKI. | +|2 |SHA-512 |The data in the TSLA record is a SHA-512 hash of either the certificate or the SPKI. | ++In the example of TLSA record, the Matching Type Field is set to ‘1’ so the Certificate Association Data is a SHA-256 hash of the Subject Public Key Info from the destination server certificate ++**Certificate Association Data**: Specifies the certificate data that is used for matching against the destination server certificate. This data depends on the Selector Field value and the Matching Type Value. ++In the example of TLSA record, the Certificate Association data is set to ‘abc123…xyz789’. Since the Selector Field value in the example is set to '1’, it would reference the destination server certificate’s public key and the algorithm that is identified to be used with it. And since the Matching Type field value in the example is set to ‘1’, it would reference the SHA-256 hash of the Subject Public Key Info from the destination server certificate. ++## How can Exchange Online customers use SMTP DANE Outbound? ++As an Exchange Online customer, there isn't anything you need to do to configure this enhanced email security for your outbound email. This is something we have built for you and it is on by default for all Exchange Online customers and is used when the destination domain advertises support for DANE. To reap the benefits of sending email with DNSSEC and DANE checks, communicate to your business partners with whom you exchange email that they need to implement DNSSEC and DANE so they can receive email using these standards. ++## How can Exchange Online customers use SMTP DANE inbound? ++Currently, inbound SMTP DANE isn’t supported for Exchange Online. Support is anticipated to be released at the end of 2022. ++## What is the recommended TLSA record configuration? ++Per RFC implementation guidance for SMTP DANE, a TLSA record composed of the Certificate Usage field set to 3, the Selector field set to 1, and the Matching Type field set to 1 is recommended. ++## Exchange Online Mail Flow with SMTP DANE ++The mail flow process for Exchange Online with SMTP DANE, shown in the flow chart below, validates domain and resource record security through DNSSEC, TLS support on the destination mail server, and that the destination mail server’s certificate matches what is expected based on its associated TLSA record. ++There are only two scenarios where an SMTP DANE failure will result in the email being blocked: ++- The destination domain signaled DNSSEC support but one or more records were returned as inauthentic. ++- All MX records for the destination domain have TLSA records and none of the destination server’s certificates match what was expected per the TSLA record data, or a TLS connection isn’t supported by the destination server. +++## Related Technologies ++|Technology |Additional Information | +||| +|**Mail Transfer Agent – Strict Transport Security (MTA-STS)** helps thwart downgrade and Man-in-the-Middle attacks by providing a mechanism for setting domain policies that specify whether the destination email server supports TLS and what to do when TLS can’t be negotiated, for example stop the transmission. |More information about Exchange Online’s upcoming support for inbound and outbound MTA-STS will be published later this year. [Exchange Online Transport News from Microsoft Ignite 2020 - Microsoft Tech Community](https://techcommunity.microsoft.com/t5/exchange-team-blog/exchange-online-transport-news-from-microsoft-ignite-2020/ba-p/1687699)<br /><br />[rfc8461 (ietf.org)](https://datatracker.ietf.org/doc/html/rfc8461) | +|**Sender Policy Framework (SPF)** uses IP information to ensure that destination email systems trust messages sent from your custom domain. | [How Sender Policy Framework (SPF) prevents spoofing - Office 365 - Microsoft Docs](/microsoft-365/security/office-365-security/how-office-365-uses-spf-to-prevent-spoofing) | +|**DomainKeys Identified Mail (DKIM)** uses X.509 certificate information to ensure that destination email systems trust messages sent outbound from your custom domain. | [How to use DKIM for email in your custom domain - Office 365 - Microsoft Docs](/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email) | +|**Domain-based Message Authentication, Reporting, and Conformance (DMARC)** works with Sender Policy Framework and DomainKeys Identified Mail to authenticate mail senders and ensure that destination email systems trust messages sent from your domain. | [Use DMARC to validate email, setup steps - Office 365 - Microsoft Docs](/microsoft-365/security/office-365-security/use-dmarc-to-validate-email) | ++## Troubleshooting Sending Emails with SMTP DANE ++Currently, there are four error codes for DANE when sending emails with Exchange Online. Microsoft is actively updating this error code list. The errors will be visible in: +1. The Exchange Admin Center portal through the Message Trace Details view. +2. NDRs generated when a message isn’t sent due to a DANE or DNSSEC failure. +3. Remote Connectivity Analyzer tool [Microsoft Remote Connectivity Analyzer](https://testconnectivity.microsoft.com/tests/o365). ++|NDR Code |Description | +||| +|5.7.321 |starttls-not-supported: Destination mail server must support TLS to receive mail. | +|5.7.322 |certificate-expired: Destination mail server's certificate is expired. | +|5.7.323 |tlsa-invalid: The domain failed DANE validation. | +|5.7.324 |dnssec-invalid: Destination domain returned invalid DNSSEC records. | ++### Troubleshooting 5.7.321 starttls-not-supported ++This usually indicates an issue with the destination mail server. After receiving the message: +1. Check that the destination email address was entered correctly. +2. Alert the destination email administrator that you received this error code so they can determine if the destination server is configured correctly to receive messages using TLS. +3. Retry sending the email and review the Message Trace Details for the message in the Exchange Admin Center portal. ++### Troubleshooting 5.7.322 certificate-expired ++A valid X.509 certificate that hasn't expired must be presented to the sending email server. X.509 certificates must be renewed after their expiration, commonly annually. After receiving the message: ++1. Alert the destination email administrator that you received this error code and provide the error code string. +2. Allow time for the destination server certificate to be renewed and the TLSA record to be updated to reference the new certificate. Then, retry sending the email and review the Message Trace Details for the message in the Exchange Admin Center portal. ++### Troubleshooting 5.7.323 tlsa-invalid ++This error code is related to a TLSA record misconfiguration and can only be generated after a DNSSEC-authentic TLSA record has been returned. There are many scenarios during the DANE validation that occur after the record has been returned that can result in the code being generated. Microsoft is actively working on the scenarios that are covered by this error code, so that each scenario has a specific code. Currently, one or more of these scenarios could cause the generation of the error code: ++1. The destination mail server's certificate doesn’t match with what is expected per the authentic TLSA record. +2. Authentic TLSA record is misconfigured. +3. The destination domain is being attacked. +4. Any other DANE failure. ++After receiving the message: ++1. Alert the destination email administrator that you received this error code and provide them the error code string. +2. Allow time for the destination email admin to review their DANE configuration and email server certificate validity. Then, retry sending the email and review the Message Trace Details for the message in the Exchange Admin Center portal. ++### Troubleshooting 5.7.324 dnssec-invalid ++This error code is generated when the destination domain indicated it was DNSSEC-authentic but Exchange Online wasn’t able to verify it as DNSSEC-authentic. ++After receiving the message: ++1. Alert the destination email administrator that you received this error code and provide them the error code string. +2. Allow time for the destination email admin to review their domain’s DNSSEC configuration. Then, retry sending the email and review the Message Trace Details for the message in the Exchange Admin Center portal. ++## Troubleshooting Receiving Emails with SMTP DANE ++Currently, there are two methods an admin of a receiving domain can use to validate and troubleshoot their DNSSEC and DANE configuration to receive email from Exchange Online using these standards. ++1. Adopt SMTP TLS-RPT (Transport Layer Security Reporting) introduced in [RFC8460](https://datatracker.ietf.org/doc/html/rfc8460) +2. Use the Remote Connectivity Analyzer tool [Microsoft Remote Connectivity Analyzer](https://testconnectivity.microsoft.com/tests/o365) ++TLS-RPT [https://datatracker.ietf.org/doc/html/rfc8460](https://datatracker.ietf.org/doc/html/rfc8460) is a reporting mechanism for senders to provide details to destination domain administrators about DANE and MTA-STS successes and failures with those respective destination domains. To receive TLS-RPT reports, you only need to add a TXT record in your domain's DNS records that includes the email address or URI you would like the reports to be sent to. Exchange Online will send TLS-RPT reports in JSON format. ++Example record: +++The second method is to use the Remote Connectivity Analyzer [Microsoft Remote Connectivity Analyzer](https://testconnectivity.microsoft.com/tests/o365), which can do the same DNSSEC and DANE checks against your DNS configuration that Exchange Online will do when sending email outside the service. This is the most direct way of troubleshooting errors in your configuration to receive email from Exchange Online using these standards. ++When troubleshooting, the below error codes may be generated: ++|NDR Code |Description | +||| +|4/5.7.321 |starttls-not-supported: Destination mail server must support TLS to receive mail. | +|4/5.7.322 |certificate-expired: Destination mail server's certificate has expired. | +|4/5.7.323 |tlsa-invalid: The domain failed DANE validation. | +|4/5.7.324 |dnssec-invalid: Destination domain returned invalid DNSSEC records. | ++### Troubleshooting 5.7.321 starttls-not-supported ++> [!NOTE] +> These steps are for email administrators troubleshooting receiving email from Exchange Online using SMTP DANE. ++This usually indicates an issue with the destination mail server. The mail server that the Remote Connectivity Analyzer is testing connecting with. There are generally two scenarios that generate this code: ++1. The destination mail server doesn’t support secure communication at all, and plain, non-encrypted communication must be used. +2. The destination server is configured improperly and ignores the STARTTLS command. + +After receiving the message: ++1. Check the email address. +2. Locate the IP address that is associated with the error statement so you can identify the mail server the statement is associated with. +3. Check your mail server’s setting to make sure it’s configured to listen for SMTP traffic (commonly ports 25 and 587). +4. Wait a few minutes, then retry the test with the Remote Connectivity Analyzer tool. +5. If it still fails, then try removing the TLSA record and run the test with the Remote Connectivity Analyzer tool again. +6. If there are no failures, this may indicate the mail server you’re using to receive mail doesn’t support STARTTLS and you may need to upgrade to one that does in order to use DANE. ++### Troubleshooting 5.7.322 certificate-expired ++> [!NOTE] +> These steps are for email administrators troubleshooting receiving email from Exchange Online using SMTP DANE. ++A valid X.509 certificate that hasn’t expired must be presented to the sending email server. X.509 certificates must be renewed after their expiration, commonly annually. After receiving the message: ++1. Check the IP that is associated with the error statement, so you can identify the mail server it’s associated with. Locate the expired certificate on the email server you identified. +2. Log in to your certificate provider's website. +3. Select the expired certificate and follow the instructions to renew and to pay for the renewal. +4. After your provider has verified the purchase, you may download a new certificate. +5. Install the renewed certificate into its associated mail server. +6. Update the mail server’s associated TLSA record with the new certificate’s data. +7. After waiting an appropriate amount of time, retry the test with the Remote Connectivity Analyzer tool. ++### Troubleshooting 5.7.323 tlsa-invalid ++> [!NOTE] +> These steps are for email administrators troubleshooting receiving email from Exchange Online using SMTP DANE. ++This error code is related to a TLSA record misconfiguration and can only be generated after a DNSSEC-authentic TSLA record has been returned. But, there are many scenarios during the DANE validation that occur after the record has been returned that can result in the code being generated. Microsoft is actively working on the scenarios that are covered by this error code, so that each scenario has a specific code. Currently, one or more of these scenarios could cause the generation of the error code: ++1. Authentic TLSA record is misconfigured. +2. The certificate isn’t yet time valid/configured for a future time window. +3. Destination domain is being attacked. +4. Any other DANE failure. ++After receiving the message: ++1. Check the IP that is associated with the error statement to identify the mail server it’s associated with. +2. Identify the TLSA record that is associated with the identified mail server. +3. Verify the configuration of the TLSA record to ensure that it signals the sender to perform the preferred DANE checks and that the correct certificate data has been included in the TLSA record. + 1. If you have to make any updates to the record for discrepancies, then wait a few minutes then rerun the test with the Remote Connectivity Analyzer tool. +4. Locate the certificate on the identified mail server. +5. Check the time window for which the certificate is valid. If it’s set to start validity at a future date, it needs to be renewed for the current date. + 1. Log in to your certificate provider's website. + 2. Select the expired certificate and follow the instructions to renew and to pay for the renewal. + 3. After your provider has verified the purchase, you may download a new certificate. + 4. Install the renewed certificate into its associated mail server. ++### Troubleshooting 5.7.324 dnssec-invalid ++> [!NOTE] +> These steps are for email administrators troubleshooting receiving email from Exchange Online using SMTP DANE. ++This error code is generated when the destination domain indicated it’s DNSSEC-authentic but Exchange Online isn’t able to verify it as DNSSEC-authentic. This section won’t be comprehensive for troubleshooting DNSSEC issues and focuses on scenarios where domains previously passed DNSSEC authentication but not now. ++After receiving the message: ++1. If you’re using a DNS provider, for example GoDaddy, alert your DNS provider of the error so they can work on the troubleshooting and configuration change. +2. If you’re managing your own DNSSEC infrastructure, there are many DNSSEC misconfigurations that may generate this error message. Some common problems to check for if your zone was previously passing DNSSEC authentication: + 1. Broken trust chain, when the parent zone holds a set of DS records that point to something that doesn’t exist in the child zone. This results in the child zone being marked as bogus by validating resolvers. + - Resolve by reviewing the child domains RRSIG key IDs and ensuring that they match with the key IDs in the DS records published in the parent zone. + 2. RRSIG resource record for the domain isn’t time valid, it has either expired or its validity period hasn’t begun. + - Resolve by generating new signatures for the domain using valid timespans. ++## Frequently Asked Questions ++### As an Exchange Online customer, can I opt out of using DNSSEC and/or DANE? ++We strongly believe DNSSEC and DANE will significantly increase the security position of our service and benefit all of our customers. We’ve worked diligently over the last year to reduce the risk and severity of the potential impact this deployment might have for M365 customers. We’ll be actively monitoring and tracking the deployment to ensure negative impact is minimized as it rolls out. Because of this, tenant-level exceptions or opt-out won’t be available. +If you experience any issues related to the enablement of DNSSEC and/or DANE, the different methods for investigating failures noted in this document will help you identify the source of the error. In most cases, the issue will be with the external destination party and you’ll need to communicate to these business partners that they need to correctly configure DNSSEC and DANE in order to receive email from Exchange Online using these standards. ++### How does DNSSEC relate to DANE? ++DNSSEC adds a layer of trust into DNS resolution by leveraging the public key infrastructure to ensure the records returned in response to a DNS query are authentic. DANE ensures that the receiving mail server is the legitimate and expected mail server for the authentic MX record. ++### What is the difference between MTA-STS and DANE for SMTP? ++DANE and MTA-STS serve the same purpose, but DANE requires DNSSEC for DNS authentication while MTA-STS relies on certificate authorities. ++### Why isn't Opportunistic TLS sufficient? ++Opportunistic TLS will encrypt communication between two endpoints if both agree to support it. However, even if TLS encrypts the transmission, a domain could be spoofed during DNS resolution such that it points to a malicious actor's endpoint instead of the real endpoint for the domain. This is a gap in email security that is addressed by implementing MTA-STS and/or SMTP DANE with DNSSEC. ++### Why isn't DNSSEC sufficient? ++DNSSEC isn’t fully resistant to Man-in-the-Middle attacks and downgrade (from TLS to clear text) attacks for mail flow scenarios. The addition of MTA-STS and DANE along with DNSSEC provides a comprehensive security method to thwart both MITM and downgrade attacks. ++## Additional Links ++[Find and fix issues after adding your domain or DNS records](/microsoft-365/admin/get-help-with-domains/find-and-fix-issues) ++[Overview of DNSSEC | Microsoft Docs ](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj200221(v=ws.11)) ++[Use DMARC to validate email, setup steps - Office 365 | Microsoft Docs](/microsoft-365/security/office-365-security/use-dmarc-to-validate-email) ++[How to use DKIM for email in your custom domain - Office 365 | Microsoft Docs](/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email) ++[How Sender Policy Framework (SPF) prevents spoofing - Office 365 | Microsoft Docs](/microsoft-365/security/office-365-security/how-office-365-uses-spf-to-prevent-spoofing) ++[Exchange Online Transport News from Microsoft Ignite 2020 - Microsoft Tech Community](https://techcommunity.microsoft.com/t5/exchange-team-blog/exchange-online-transport-news-from-microsoft-ignite-2020/ba-p/1687699) ++[rfc8461 (ietf.org)](https://datatracker.ietf.org/doc/html/rfc8461) |
| compliance | Put An In Place Hold On A Soft Deleted Mailbox | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/put-an-in-place-hold-on-a-soft-deleted-mailbox.md | search.appverid: ms.assetid: 421f72bd-dd43-4be1-82f5-0ae9ac43bd00 - seo-marvel-apr2020-description: Learn how to create an In-Place Hold for a soft-deleted mailbox to make it inactive and preserve its contents. ++description: "Learn how to create an In-Place Hold for a soft-deleted mailbox to make it inactive and preserve its contents." # Put an In-Place Hold on a soft-deleted mailbox in Exchange Online |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | The numbers listed are the minimum Office application versions required for each |[Let users assign permissions: <br /> - Do Not Forward](encryption-sensitivity-labels.md#let-users-assign-permissions) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | |[Let users assign permissions: <br /> - Encrypt-Only](encryption-sensitivity-labels.md#let-users-assign-permissions) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.48+ <sup>\*</sup> | 4.2112.0+ | 4.2112.0+ | Yes | |[Require users to apply a label to their email and documents](#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes |-|[Audit label-related user activity](data-classification-activity-explorer.md) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: Under review | 16.51+ <sup>\*</sup> | 4.2126+ | 4.2126+ | Yes | +|[Audit label-related user activity](data-classification-activity-explorer.md) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2202+ | 16.51+ <sup>\*</sup> | 4.2126+ | 4.2126+ | Yes | |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ <sup>\*</sup> | Under review | Under review | Yes | |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | Under review | Under review | Under review | Yes | |[Different settings for default label and mandatory labeling](#outlook-specific-options-for-default-label-and-mandatory-labeling) | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes | |
| contentunderstanding | Solution Manage Contracts Step3 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/solution-manage-contracts-step3.md | When a contract has been approved, the following things occur: | Approval state | body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')?['submitActionId'] | | Approved by | body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')?['responder']['displayName'] | | Approval date | body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')?['responseTime'] |- | Comment | body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')?['data']['acComments'] | + | Comment | body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')?['data']?['acComments'] | The following example shows how to use the formula box in Power Automate to write an expression. When a contract has been approved, the following things occur: }, { "title": "Approval comment",- "value": "@{body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')?['data']['acComments']}" + "value": "@{body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')?['data']?['acComments']}" }, { "title": " ", The following code is the JSON used for this step in the Power Automate flow. }, { "title": "Comment",- "value": "@{body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')?['data']['acComments']}" + "value": "@{body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')?['data']?['acComments']}" }, { "title": " ", The following code is the JSON used for this step in the Power Automate flow. - The card is posted in the Contract Management channel. -  +  |
| enterprise | Administering A Multi Geo Environment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/administering-a-multi-geo-environment.md | The [SharePoint admin center](https://admin.microsoft.com/sharepoint) has a **Ge A unified [Audit log](https://support.office.com/article/0d4d0f35-390b-4518-800e-0c7ec95e946c) for all your satellite locations is available from the Microsoft 365 audit log search page. You can see all the audit log entries from across geo locations, for example, NAM & EUR users' activities will show up in one org view and then you can apply existing filters to see specific user's activities. +> [!NOTE] +> Exchange admin audit events are only available for the default location. + ## BCS, Secure Store, Apps BCS, Secure Store, and Apps all have separate instances in each satellite location, therefore the SharePoint Online administrator should manage and configure these services separately from each satellite location. |
| enterprise | Cross Tenant Mailbox Migration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/cross-tenant-mailbox-migration.md | To obtain the tenant ID of a subscription, sign in to the [Microsoft 365 admin c  -5. On the Register an application page, under Supported account types, Select Accounts in any organizational directly (Any Azure AD directory - Multitenant). Then under Redirect URI (optional), select Web and enter <https://office.com>. Last, select Register. +5. On the Register an application page, under Supported account types, select Accounts in any organizational directory (Any Azure AD directory - Multitenant). Then, under Redirect URI (optional), select Web and enter <https://office.com>. Lastly, select Register.  To obtain the tenant ID of a subscription, sign in to the [Microsoft 365 admin c 12. Now we need to add permission for mailbox migration, select Add a permission -13. In the Request API permissions windows, select APIs my organization users, and search for office 365 exchange online, select it. +13. In the Request API permissions windows, select APIs my organization uses, search for Office 365 Exchange Online, and select it.  |
| enterprise | Multi Geo Capabilities In Exchange Online | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/multi-geo-capabilities-in-exchange-online.md | Exchange Online synchronizes the **PreferredDataLocation** property from Azure A - Public folders are supported in multi-geo organizations. However, the public folders must remain in the central geo location. You can't move public folders to satellite geo locations. -- In a multi-geo environment, cross-geo mailbox auditing is not supported. For example, if a user is assigned permissions to access a shared mailbox in a different geo location, mailbox actions performed by that user are not logged in the mailbox audit log of the shared mailbox. For more information, see [Manage mailbox auditing](../compliance/enable-mailbox-auditing.md).+- In a multi-geo environment, cross-geo mailbox auditing is not supported. For example, if a user is assigned permissions to access a shared mailbox in a different geo location, mailbox actions performed by that user are not logged in the mailbox audit log of the shared mailbox. Exchange admin audit events are also only available for the default location. For more information, see [Manage mailbox auditing](../compliance/enable-mailbox-auditing.md). |
| enterprise | Setup Guides For Microsoft 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/setup-guides-for-microsoft-365.md | The [Windows Virtual Desktop setup guide](https://aka.ms/wvdsetupguide) provides Microsoft Edge has been rebuilt from the ground up to bring you world-class compatibility and performance, the security and privacy you deserve, and new features designed to bring you the best of the web. -The [Microsoft Edge setup guide](https://aka.ms/edgeadvisor) will help you configure Enterprise Site Discovery to see which sites accessed in your org might need to use IE mode, review and configure important security features, configure privacy policies and compliance policies to meet your org's requirements, and manage web access on your devices. You can download Microsoft Edge to individual devices, or we'll show you how to deploy to multiple users in your org with Group Policy, Configuration Manager, or Microsoft Intune. +The [Microsoft Edge setup guide](https://aka.ms/edgeadvisoradmin) will help you configure Enterprise Site Discovery to see which sites accessed in your org might need to use IE mode, review and configure important security features, configure privacy policies and compliance policies to meet your org's requirements, and manage web access on your devices. You can download Microsoft Edge to individual devices, or we'll show you how to deploy to multiple users in your org with Group Policy, Configuration Manager, or Microsoft Intune. ### Configure IE mode for Microsoft Edge -If you've already deployed Microsoft Edge and only want to configure IE mode, the [Configure IE mode for Microsoft Edge guide](https://aka.ms/configureiemode) will give you scripts to automate the configuration of Enterprise Site Discovery. You'll also get IE mode recommendations from a cloud-based tool that will help you create an Enterprise Mode Site List to deploy to your users. +If you've already deployed Microsoft Edge and only want to configure IE mode, the [Configure IE mode for Microsoft Edge guide](https://aka.ms/configureiemodeadmin) will give you scripts to automate the configuration of Enterprise Site Discovery. You'll also get IE mode recommendations from a cloud-based tool that will help you create an Enterprise Mode Site List to deploy to your users. ### Microsoft Search setup guide |
| lighthouse | M365 Lighthouse Compare Compliance Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-compare-compliance-policies.md | + + Title: "Compare device compliance policy settings" +f1.keywords: NOCSH ++++audience: Admin ++ms.localizationpriority: medium ++- M365-subscription-management +- Adm_O365 ++- AdminSurgePortfolio +- M365-Lighthouse +search.appverid: MET150 +description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn how to compare device compliance policy settings." ++++# Compare device compliance policy settings ++> [!NOTE] +> The features described in this article are in Preview, are subject to change, and are only available to partners who meet the [requirements](m365-lighthouse-requirements.md). If your organization does not have Microsoft 365 Lighthouse, see [Sign up for Microsoft 365 Lighthouse](m365-lighthouse-sign-up.md). ++Microsoft 365 Lighthouse lets you view compliance policies across your tenants in a single view. You can drive security and standardization across your tenants by comparing policies. You can filter views to see settings that have been configured (versus settings that were left not configured), settings that differ in their configurations, or just the settings that match. You can also search for specific settings youΓÇÖre interested in and see how that compares among the policies. ++## Before you begin ++- Devices must have an Intune license and be enrolled in Microsoft Endpoint Manager (MEM). ++## Compare policy settings ++1. In the left navigation pane in Lighthouse, select **Devices**. ++2. Select the **Policies** tab. ++3. From the **Filters** drop-down list, select an operating system/platform. ++ > [!NOTE] + > You can only compare policies with the same operating system/platform. ++4. From the filtered list, select up to three policies you want to compare. ++5. Select **Compare**. ++You can filter the results to see **Settings that differ**, **Settings that match**, or **Configured settings**. ++## Configure a policy setting ++1. In the left navigation pane in Lighthouse, select **Devices**. ++2. Select the **Policies** tab. ++3. From the list, select a policy name. ++4. From the Policy details pane, select **View this policy in Microsoft Endpoint Manager**. ++5. In MEM, edit the policy settings as needed. ++## Next steps ++As you make policy adjustments, make sure you assess your changes against your current baseline settings. For more information, see [Overview of using baselines to deploy standard tenant configurations](m365-lighthouse-deploy-standard-tenant-configurations-overview.md). ++## Related content ++[What is device enrollment in Intune?](/mem/intune/enrollment/device-enrollment) (article) +[Use compliance policies to set rules for devices you manage with Intune](/mem/intune/protect/device-compliance-get-started) (article) +[Overview of using baselines to deploy standard tenant configurations](m365-lighthouse-deploy-standard-tenant-configurations-overview.md) (article) |
| security | TOC | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/TOC.md | #### [SIEM integration]() ##### [Integrate SIEM tools with Microsoft Defender for Endpoint](configure-siem.md) -##### [Enable SIEM integration in Microsoft Defender for Endpoint](enable-siem-integration.md) -##### [Pull detections using SIEM REST API](pull-alerts-using-rest-api.md) ##### [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) #### [Partners & APIs]() |
| security | Configure Microsoft Threat Experts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-microsoft-threat-experts.md | You can partner with Microsoft Threat Experts who can be engaged directly from w 4. Enter the email address that you'd like to use to correspond with Microsoft Threat Experts. > [!NOTE]-> If you would like to track the status of your Experts on Demand cases through Microsoft Services Hub, reach out to your Technical Account Manager. +> If you would like to track the status of your Experts on Demand cases through Microsoft Services Hub, reach out to your Customer Success Account Manager. Watch this video for a quick overview of the Microsoft Services Hub. |
| security | Enable Siem Integration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-siem-integration.md | - Title: Enable SIEM integration in Microsoft Defender for Endpoint -description: Enable SIEM integration to receive detections in your security information and event management (SIEM) solution. -keywords: enable siem connector, siem, connector, security information and events -ms.sitesec: library -ms.pagetype: security --------# Enable SIEM integration in Microsoft Defender for Endpoint ---**Applies to:** -- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/?linkid=2154037)-- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037)--> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-enablesiem-abovefoldlink) --> [!IMPORTANT] -> The Microsoft Defender for Endpoint SIEM REST API is being retired on March 1, 2022, as the Microsoft Defender for Endpoint Alert API and the Microsoft 365 Defender Incident API that replace it provide richer metadata - including up-to-date status of the alert, evidence entities related to the alert, comments entered by analysts, and they support updating the status, assignedTo, classification, and determination fields programmatically. **Effective immediately, no new customer onboarding to the SIEM REST API will be supported.** --Enable security information and event management (SIEM) integration so you can pull detections from Microsoft 365 Defender. Pull detections using your SIEM solution or by connecting directly to the detections REST API. --> [!NOTE] -> -> - [Microsoft Defender for Endpoint Alert](alerts.md) is composed from one or more detections. -> - [Microsoft Defender for Endpoint Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Device and its related Alert details. -> - The Microsoft Defender for Endpoint Alert API is the latest API for alert consumption and contain a detailed list of related evidence for each alert. For more information, see [Alert methods and properties](alerts.md) and [List alerts](get-alerts.md). --## Prerequisites --- The user who activates the setting must have permissions to create an app in Azure Active Directory (AAD). This is someone with the following roles:-- - Security Administrator and either Global Administrator - - Cloud Application Administrator - - Application Administrator - - Owner of the service principal --- During the initial activation, a pop-up screen is displayed for credentials to be entered. Make sure that you allow pop-ups for this site.--## Enabling SIEM integration --1. In the navigation pane, select **Settings** \> **Endpoints** \> **APIs** \> **SIEM**. -- :::image type="content" source="../../media/enable-siemnew.png" lightbox="../../media/enable-siemnew.png" alt-text="Image of SIEM integration from Settings menu1."::: -- > [!TIP] - > If you encounter an error when trying to enable the SIEM connector application, check the pop-up blocker settings of your browser. It might be blocking the new window being opened when you enable the capability. --2. Select **Enable SIEM integration**. This activates the **SIEM connector access details** section with pre-populated values and an application is created under your Azure Active Directory (Azure AD) tenant. -- > [!WARNING] - > The client secret is only displayed once. Make sure you keep a copy of it in a safe place. -- :::image type="content" alt-text="Image of SIEM integration from Settings menu2." source="images/siem_details.png" lightbox="images/siem_details.png"::: --3. Choose the SIEM type you use in your organization. -- > [!NOTE] - > If you select HP ArcSight, you'll need to save these two configuration files: - > - > - WDATP-connector.jsonparser.properties - > - WDATP-connector.properties -- If you want to connect directly to the detections REST API through programmatic access, choose **Generic API**. --4. Copy the individual values or select **Save details to file** to download a file that contains all the values. --5. Select **Generate tokens** to get an access and refresh token. -- > [!NOTE] - > You'll need to generate a new Refresh token every 90 days. --6. Follow the instructions for [creating an Azure AD app registration for Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/exposed-apis-create-app-webapp) and assign the correct permissions to it to read alerts. --You can now proceed with configuring your SIEM solution or connecting to the detections REST API through programmatic access. You'll need to use the tokens when configuring your SIEM solution to allow it to receive detections from Microsoft 365 Defender. --## Integrate Microsoft Defender for Endpoint with IBM QRadar --You can configure IBM QRadar to collect detections from Microsoft Defender for Endpoint. For more information, see [IBM Knowledge Center](https://www.ibm.com/docs/en/qsip/7.3.2?topic=quick-start-guide). --## See also --- [Configure HP ArcSight to pull Microsoft Defender for Endpoint detections](configure-arcsight.md)-- [Microsoft Defender for Endpoint Detection fields](api-portal-mapping.md)-- [Pull Microsoft Defender for Endpoint detections using REST API](pull-alerts-using-rest-api.md)-- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) |
| security | Fetch Alerts Mssp | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/fetch-alerts-mssp.md | You can now download the relevant configuration file for your SIEM and connect t ## Fetch alerts from MSSP customer's tenant using APIs -For information on how to fetch alerts using REST API, see [Pull alerts using REST API](pull-alerts-using-rest-api.md). +For information on how to fetch alerts using REST API, see [Fetch alerts from MSSP customer tenant](fetch-alerts-mssp.md). ## See also |
| security | Linux Preferences | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-preferences.md | The *antivirusEngine* section of the configuration profile is used to manage the |**Comments**|See the following sections for a description of the dictionary contents.| | -#### Enable / disable real-time protection +#### Enforcement level for antivirus engine -Determines whether real-time protection (scan files as they are accessed) is enabled. +Specifies the enforcement preference of antivirus engine. There are three values for setting enforcement level: -<br> --**** --|Description|Value| -||| -|**Key**|enableRealTimeProtection| -|**Data type**|Boolean| -|**Possible values**|true (default) <p> false| -| --#### Enable / disable passive mode --Determines whether the antivirus engine runs in passive mode or not. In passive mode: --- Real-time protection is turned off.-- On-demand scanning is turned on.-- Automatic threat remediation is turned off.-- Security intelligence updates are turned on.-- Status menu icon is hidden.+- Real-time (`real_time`): Real-time protection (scan files as they are accessed) is enabled. +- On-demand (`on_demand`): Files are scanned only on demand. In this: + - Real-time protection is turned off. +- Passive (`passive`): Runs the antivirus engine in passive mode. In this: + - Real-time protection is turned off. + - On-demand scanning is turned on. + - Automatic threat remediation is turned off. + - Security intelligence updates are turned on. <br> Determines whether the antivirus engine runs in passive mode or not. In passive |Description|Value| |||-|**Key**|passiveMode| -|**Data type**|Boolean| -|**Possible values**|false (default) <p> true| -|**Comments**|Available in Defender for Endpoint version 100.67.60 or higher.| +|**Key**|enforcementLevel| +|**Data type**|String| +|**Possible values**|real_time (default) <p> on_demand <p> passive| +|**Comments**|Available in Defender for Endpoint version 101.10.72 or higher.| | The following configuration profile will: { "antivirusEngine":{ "behaviorMonitoring":"enabled",- "enableRealTimeProtection":true, + "enforcementLevel":"real_time", "threatTypeSettings":[ { "key":"potentially_unwanted_application", The following configuration profile contains entries for all settings described { "antivirusEngine":{ "behaviorMonitoring":"enabled",- "enableRealTimeProtection":true, + "enforcementLevel":"real_time", "scanAfterDefinitionUpdate":true, "scanArchives":true, "maximumOnDemandScanThreads":2,- "passiveMode":false, "exclusionsMergePolicy":"merge", "exclusions":[ { |
| security | Mac Preferences | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-preferences.md | The *antivirusEngine* section of the configuration profile is used to manage the |**Comments**|See the following sections for a description of the dictionary contents.| ||| -#### Enable / disable real-time protection +#### Enforcement level for antivirus engine -Specify whether to enable real-time protection, which scans files as they are accessed. +Specifies the enforcement preference of antivirus engine. There are three values for setting enforcement level: -<br> --**** --|Section|Value| -||| -|**Domain**|`com.microsoft.wdav`| -|**Key**|enableRealTimeProtection| -|**Data type**|Boolean| -|**Possible values**|true (default) <p> false| -||| --#### Enable / disable passive mode --Specify whether the antivirus engine runs in passive mode. Passive mode has the following implications: --- Real-time protection is turned off-- On-demand scanning is turned on-- Automatic threat remediation is turned off-- Security intelligence updates are turned on-- Status menu icon is hidden+- Real-time (`real_time`): Real-time protection (scan files as they are accessed) is enabled. +- On-demand (`on_demand`): Files are scanned only on demand. In this: + - Real-time protection is turned off. +- Passive (`passive`): Runs the antivirus engine in passive mode. In this: + - Real-time protection is turned off. + - On-demand scanning is turned on. + - Automatic threat remediation is turned off. + - Security intelligence updates are turned on. + - Status menu icon is hidden. <br> Specify whether the antivirus engine runs in passive mode. Passive mode has the |Section|Value| ||| |**Domain**|`com.microsoft.wdav`|-|**Key**|passiveMode| -|**Data type**|Boolean| -|**Possible values**|false (default) <p> true| -|**Comments**|Available in Microsoft Defender for Endpoint version 100.67.60 or higher.| +|**Key**|enforcementLevel| +|**Data type**|String| +|**Possible values**|real_time (default) <p> on_demand <p> passive| +|**Comments**|Available in Microsoft Defender for Endpoint version 101.10.72 or higher.| ||| #### Run a scan after definitions are updated The following configuration profile (or, in case of JAMF, a property list that c <dict> <key>antivirusEngine</key> <dict>- <key>enableRealTimeProtection</key> - <true/> + <key>enforcementLevel</key> + <string>real_time</string> <key>threatTypeSettings</key> <array> <dict> The following configuration profile (or, in case of JAMF, a property list that c <true/> <key>antivirusEngine</key> <dict>- <key>enableRealTimeProtection</key> - <true/> - <key>passiveMode</key> - <false/> + <key>enforcementLevel</key> + <string>real_time</string> <key>threatTypeSettings</key> <array> <dict> The following templates contain entries for all settings described in this docum <dict> <key>antivirusEngine</key> <dict>- <key>enableRealTimeProtection</key> - <true/> - <key>passiveMode</key> - <false/> + <key>enforcementLevel</key> + <string>real_time</string> <key>scanAfterDefinitionUpdate</key> <true/> <key>scanArchives</key> The following templates contain entries for all settings described in this docum ### Intune full profile ```XML+<?xml version="1.0" encoding="utf-8"?> +<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> +<plist version="1"> + <dict> <key>PayloadUUID</key> <string>C4E6A782-0C8D-44AB-A025-EB893987A295</string> <key>PayloadType</key> The following templates contain entries for all settings described in this docum <true/> <key>antivirusEngine</key> <dict>- <key>enableRealTimeProtection</key> - <true/> - <key>passiveMode</key> - <false/> + <key>enforcementLevel</key> + <string>real_time</string> <key>scanAfterDefinitionUpdate</key> <true/> <key>scanArchives</key> The following templates contain entries for all settings described in this docum </dict> </dict> </array>+ </dict> +</plist> ``` ## Property list validation |
| security | Mac Whatsnew | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-whatsnew.md | ms.technology: mde ## 100.68.99 -- Added the ability to configure the antivirus functionality to run in [passive mode](mac-preferences.md#enable--disable-passive-mode)+- Added the ability to configure the antivirus functionality to run in [passive mode](mac-preferences.md#enforcement-level-for-antivirus-engine) - Performance improvements & bug fixes ## 100.65.28 |
| security | Management Apis | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/management-apis.md | For more information, see [Microsoft 365 Defender Streaming API](../defender/str ## SIEM API -When you enable security information and event management (SIEM) integration, it allows you to pull detections from Microsoft 365 Defender using your SIEM solution or by connecting directly to the detections REST API. This activates the SIEM connector access details section with pre-populated values and an application is created under your Azure Active Directory (Azure AD) tenant. For more information, see [SIEM integration](enable-siem-integration.md). +When you enable security information and event management (SIEM) integration, it allows you to pull detections from Microsoft 365 Defender using your SIEM solution or by connecting directly to the detections REST API. This activates the SIEM connector access details section with pre-populated values and an application is created under your Azure Active Directory (Azure AD) tenant. ## Related topics |
| security | Microsoft Defender Endpoint Linux | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-linux.md | ms.technology: mde This topic describes how to install, configure, update, and use Microsoft Defender for Endpoint on Linux. > [!CAUTION]-> Running other third-party endpoint protection products alongside Microsoft Defender for Endpoint on Linux is likely to lead to performance problems and unpredictable side effects. If non-Microsoft endpoint protection is an absolute requirement in your environment, you can still safely take advantage of Defender for Endpoint on Linux EDR functionality after configuring the antivirus functionality to run in [Passive mode](linux-preferences.md#enable--disable-passive-mode). +> Running other third-party endpoint protection products alongside Microsoft Defender for Endpoint on Linux is likely to lead to performance problems and unpredictable side effects. If non-Microsoft endpoint protection is an absolute requirement in your environment, you can still safely take advantage of Defender for Endpoint on Linux EDR functionality after configuring the antivirus functionality to run in [Passive mode](linux-preferences.md#enforcement-level-for-antivirus-engine). ## How to install Microsoft Defender for Endpoint on Linux If you experience any installation failures, refer to [Troubleshooting installat > [!NOTE] > Distributions and version that are not explicitly listed are unsupported (even if they are derived from the officially supported distributions). +- List of supported kernel versions + - Red Hat Enterprise Linux 6 and CentOS 6: + - For 6.7: 2.6.32-573.* + - For 6.8: 2.6.32-642.* + - For 6.9: 2.6.32-696.* + - For 6.10: 2.6.32.754.2.1.el6.x86_64 to 2.6.32-754.41.2: + + ||||| + |--|--|--|--| + |2.6.32-754.2.1.el6.x86_64|2.6.32-754.17.1.el6.x86_64|2.6.32-754.29.1.el6.x86_64|2.6.32-754.3.5.el6.x86_64| + |2.6.32-754.18.2.el6.x86_64|2.6.32-754.29.2.el6.x86_64|2.6.32-754.6.3.el6.x86_64|2.6.32-754.22.1.el6.x86_64| + |2.6.32-754.30.2.el6.x86_64|2.6.32-754.9.1.el6.x86_64|2.6.32-754.23.1.el6.x86_64|2.6.32-754.33.1.el6.x86_64| + |2.6.32-754.10.1.el6.x86_64|2.6.32-754.24.2.el6.x86_64|2.6.32-754.35.1.el6.x86_64|2.6.32-754.11.1.el6.x86_64| + |2.6.32-754.24.3.el6.x86_64|2.6.32-754.39.1.el6.x86_64|2.6.32-754.12.1.el6.x86_64|2.6.32-754.25.1.el6.x86_64| + |2.6.32-754.41.2.el6.x86_64|2.6.32-754.14.2.el6.x86_64|2.6.32-754.27.1.el6.x86_64|2.6.32-754.15.3.el6.x86_64| + |2.6.32-754.28.1.el6.x86_64| - For Red Hat Enterprise Linux 6 and CentOS 6, the list of supported kernel versions are: - - For 6.7: 2.6.32-573.* - - For 6.8: 2.6.32-642.* - - For 6.9: 2.6.32-696.* - - For 6.10: 2.6.32.754.2.1.el6.x86_64 to 2.6.32-754.41.2: -- > [!NOTE] - > After a new package version is released, support for the previous two versions is reduced to technical support only. Versions older than that that are listed in this section are provided for technical upgrade support only. -- List of versions: -- - 2.6.32-754.2.1.el6.x86_64 - - 2.6.32-754.17.1.el6.x86_64 - - 2.6.32-754.29.1.el6.x86_64 - - 2.6.32-754.3.5.el6.x86_64 - - 2.6.32-754.18.2.el6.x86_64 - - 2.6.32-754.29.2.el6.x86_64 - - 2.6.32-754.6.3.el6.x86_64 - - 2.6.32-754.22.1.el6.x86_64 - - 2.6.32-754.30.2.el6.x86_64 - - 2.6.32-754.9.1.el6.x86_64 - - 2.6.32-754.23.1.el6.x86_64 - - 2.6.32-754.33.1.el6.x86_64 - - 2.6.32-754.10.1.el6.x86_64 - - 2.6.32-754.24.2.el6.x86_64 - - 2.6.32-754.35.1.el6.x86_64 - - 2.6.32-754.11.1.el6.x86_64 - - 2.6.32-754.24.3.el6.x86_64 - - 2.6.32-754.39.1.el6.x86_64 - - 2.6.32-754.12.1.el6.x86_64 - - 2.6.32-754.25.1.el6.x86_64 - - 2.6.32-754.41.2.el6.x86_64 - - 2.6.32-754.14.2.el6.x86_64 - - 2.6.32-754.27.1.el6.x86_64 - - 2.6.32-754.15.3.el6.x86_64 - - 2.6.32-754.28.1.el6.x86_64 ---- Minimum kernel version 3.10.0-327--- The `fanotify` kernel option must be enabled-- > [!CAUTION] - > Running Defender for Endpoint on Linux side by side with other `fanotify`-based security solutions is not supported. It can lead to unpredictable results, including hanging the operating system. + > [!NOTE] + > After a new package version is released, support for the previous two versions is reduced to technical support only. Versions older than that that are listed in this section are provided for technical upgrade support only. ++ - For rest of the supported distributions, minimum kernel version required is 3.10.0-327 ++- Event provider mechanism + - Red Hat Enterprise Linux 6 and CentOS 6: `Talpa` kernel module based solution + - For rest of the supported distributions: `Fanotify` + - The `fanotify` kernel option must be enabled ++ > [!CAUTION] + > Running Defender for Endpoint on Linux side by side with other `fanotify`-based security solutions is not supported. It can lead to unpredictable results, including hanging the operating system. - Disk space: 1 GB |
| security | Microsoft Defender Endpoint Mac | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-mac.md | ms.technology: mde This topic describes how to install, configure, update, and use Defender for Endpoint on Mac. > [!CAUTION]-> Running other third-party endpoint protection products alongside Microsoft Defender for Endpoint on Mac is likely to lead to performance problems and unpredictable side effects. If non-Microsoft endpoint protection is an absolute requirement in your environment, you can still safely take advantage of Defender for Endpoint on Mac EDR functionality after configuring the antivirus functionality to run in [Passive mode](mac-preferences.md#enable--disable-passive-mode). +> Running other third-party endpoint protection products alongside Microsoft Defender for Endpoint on Mac is likely to lead to performance problems and unpredictable side effects. If non-Microsoft endpoint protection is an absolute requirement in your environment, you can still safely take advantage of Defender for Endpoint on Mac EDR functionality after configuring the antivirus functionality to run in [Passive mode](mac-preferences.md#enforcement-level-for-antivirus-engine). ## What's new in the latest release |
| security | Microsoft Threat Experts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-threat-experts.md | The option to **Consult a threat expert** is available in several places in the  > [!NOTE]-> If you would like to track the status of your Experts on Demand cases through Microsoft Services Hub, reach out to your Technical Account Manager. +> If you would like to track the status of your Experts on Demand cases through Microsoft Services Hub, reach out to your Customer Success Account Manager. Watch this video for a quick overview of the Microsoft Services Hub. |
| security | Partner Applications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/partner-applications.md | Logo|Partner name|Description ## SIEM integration -Defender for Endpoint supports SIEM integration through various of methods. This can include specialized SIEM system interface with out of the box connectors, a generic alert API enabling custom implementations, and an action API enabling alert status management. For more information, see [Enable SIEM integration](enable-siem-integration.md). +Defender for Endpoint supports SIEM integration through various of methods. This can include specialized SIEM system interface with out of the box connectors, a generic alert API enabling custom implementations, and an action API enabling alert status management. ## Ticketing and IT service management |
| security | Preview Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/preview-settings.md | Turn on the preview experience setting to be among the first to try upcoming fea - [Update general settings in Microsoft Defender for Endpoint](data-retention-settings.md) - [Turn on advanced features in Microsoft Defender for Endpoint](advanced-features.md) - [Configure email notifications in Microsoft Defender for Endpoint](configure-email-notifications.md)-- [Enable SIEM integration in Microsoft Defender for Endpoint](enable-siem-integration.md)+ |
| security | Pull Alerts Using Rest Api | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/pull-alerts-using-rest-api.md | - Title: Pull Microsoft Defender for Endpoint detections using REST API -description: Learn how to call a Microsoft Defender for Endpoint API endpoint to pull detections in JSON format using the SIEM REST API. -keywords: detections, pull detections, rest api, request, response -ms.sitesec: library -ms.pagetype: security ---------# Pull Microsoft Defender for Endpoint detections using SIEM REST API ----**Applies to:** -- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037)-- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)-- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)--> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-pullalerts-abovefoldlink) ----> [!NOTE] -> -> - [Microsoft Defender for Endpoint Alert](alerts.md) is composed from one or more detections. -> - [Microsoft Defender for Endpoint Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Device and its related Alert details. -> s-The Microsoft Defender for Endpoint Alert API is the latest API for alert consumption and contain a detailed list of related evidence for each alert. For more information, see [Alert methods and properties](alerts.md) and [List alerts](get-alerts.md). --Microsoft Defender for Endpoint supports the OAuth 2.0 protocol to pull detections from the API. --In general, the OAuth 2.0 protocol supports four types of flows: --- Authorization grant flow-- Implicit flow-- Client credentials flow-- Resource owner flow--For more information about the OAuth specifications, see the [OAuth Website](http://www.oauth.net). --Microsoft Defender for Endpoint supports the _Authorization grant flow_ and _Client credential flow_ to obtain access to pull detections, with Azure Active Directory (AAD) as the authorization server. --The _Authorization grant flow_ uses user credentials to get an authorization code, which is then used to obtain an access token. --The _Client credential flow_ uses client credentials to authenticate against the Microsoft Defender for Endpoint endpoint URL. This flow is suitable for scenarios when an OAuth client creates requests to an API that doesn't require user credentials. --Use the following method in the Microsoft Defender for Endpoint API to pull detections in JSON format. --> [!NOTE] -> Microsoft 365 Defender merges similar alert detections into a single alert. This API pulls alert detections in its raw form based on the query parameters you set, enabling you to apply your own grouping and filtering. --## Before you begin --- Before calling the Microsoft Defender for Endpoint endpoint to pull detections, you'll need to enable the SIEM integration application in Azure Active Directory (AAD). For more information, see [Enable SIEM integration in Microsoft Defender for Endpoint](enable-siem-integration.md).--- Take note of the following values in your Azure application registration. You need these values to configure the OAuth flow in your service or daemon app:- - Application ID (unique to your application) - - App key, or secret (unique to your application) - - Your app's OAuth 2.0 token endpoint - - Find this value by clicking **View Endpoints** at the bottom of the Azure Management Portal in your app's page. The endpoint will look like `https://login.microsoftonline.com/{tenantId}/oauth2/token`. --## Get an access token --Before creating calls to the endpoint, you'll need to get an access token. --You'll use the access token to access the protected resource, which is detections in Microsoft Defender for Endpoint. --To get an access token, you'll need to do a POST request to the token issuing endpoint. Here is a sample request: --```http -POST /72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/token HTTP/1.1 -Host: login.microsoftonline.com -Content-Type: application/x-www-form-urlencoded --resource=https%3A%2F%2Fgraph.windows.net&client_id=35e0f735-5fe4-4693-9e68-3de80f1d3745&client_secret=IKXc6PxB2eoFNJ%2FIT%2Bl2JZZD9d9032VXz6Ul3D2WyUQ%3D&grant_type=client_credentials -``` --The response will include an access token and expiry information. --```json -{ - "token_type": "Bearer", - "expires_in": 3599, - "ext_expires_in": 0, - "expires_on": 1488720683, - "not_before": 1488720683, - "resource": "https://graph.windows.net", - "access_token":"eyJ0eXaioJJOIneiowiouqSuzNiZ345FYOVkaJL0625TueyaJasjhIjEnbMlWqP..." -} -``` --You can now use the value in the *access_token* field in a request to the Defender for Endpoint API. --## Request --With an access token, your app can make authenticated requests to the Microsoft Defender for Endpoint API. Your app must append the access token to the Authorization header of each request. --### Request syntax --Method|Request URI -| -GET|Use the URI applicable for your region. <p> **For EU**: `https://wdatp-alertexporter-eu.windows.com/api/alerts` <p> **For US**: `https://wdatp-alertexporter-us.windows.com/api/alerts` <p> **For UK**: `https://wdatp-alertexporter-uk.windows.com/api/alerts` --### Request header --Header|Type|Description| -|| -Authorization|string|Required. The Azure AD access token in the form **Bearer** <*token*>.| --### Request parameters --Use optional query parameters to specify and control the amount of data returned in a response. If you call this method without parameters, the response contains all the alerts in your organization in the last 2 hours. --Name|Value|Description -|| -sinceTimeUtc|DateTime|Defines the lower time bound alerts are retrieved from, based on field: <p> `LastProcessedTimeUtc` <p> The time range will be: from sinceTimeUtc time to current time. <p> **NOTE**: When not specified, all alerts generated in the last two hours are retrieved. -untilTimeUtc|DateTime|Defines the upper time bound alerts are retrieved. <p> The time range will be: from `sinceTimeUtc` time to `untilTimeUtc` time. <p> **NOTE**: When not specified, the default value will be the current time. -ago|string|Pulls alerts in the following time range: from `(current_time - ago)` time to `current_time` time. <p> Value should be set according to **ISO 8601** duration format <p> Example: `ago=PT10M` will pull alerts received in the last 10 minutes. -limit|int|Defines the number of alerts to be retrieved. Most recent alerts will be retrieved based on the number defined.<p> **NOTE**: When not specified, all alerts available in the time range will be retrieved. -machinegroups|string|Specifies device groups to pull alerts from. <p> **NOTE**: When not specified, alerts from all device groups will be retrieved. <p> Example: <br><br> `https://wdatp-alertexporter-eu.securitycenter.windows.com/api/alerts/?machinegroups=UKMachines&machinegroups=FranceMachines` -DeviceCreatedMachineTags|string|Single device tag from the registry. -CloudCreatedMachineTags|string|Device tags that were created in Microsoft 365 Defender. --### Request example --The following example demonstrates how to retrieve all the detections in your organization. --```http -GET https://wdatp-alertexporter-eu.windows.com/api/alerts -Authorization: Bearer <your access token> -``` --The following example demonstrates a request to get the last 20 detections since 2016-09-12 00:00:00. --```http -GET https://wdatp-alertexporter-eu.windows.com/api/alerts?limit=20&sinceTimeUtc=2016-09-12T00:00:00.000 -Authorization: Bearer <your access token> -``` --## Response --The return value is an array of alert objects in JSON format. --Here is an example return value: --```json -[ -{ - "AlertTime": "2020-09-30T14:09:20.35743Z", - "ComputerDnsName": "mymachine1.domain.com", - "AlertTitle": "Suspicious File Activity", - "Category": "Malware", - "Severity": "High", - "AlertId": "da637370718981685665_16349121", - "Actor": "", - "LinkToWDATP": "https://securitycenter.windows.com/alert/da637370718981685665_16349121", - "IocName": "", - "IocValue": "", - "CreatorIocName": "", - "CreatorIocValue": "", - "Sha1": "aabbccddee1122334455aabbccddee1122334455", - "FileName": "cmdParent.exe", - "FilePath": "C:\\WINDOWS\\SysWOW64\\boo3\\qwerty", - "IpAddress": "", - "Url": "", - "IoaDefinitionId": "b20af1d2-5990-4672-87f1-acc2a8ff7725", - "UserName": "", - "AlertPart": 0, - "FullId": "da637370718981685665_16349121:R4xEdgAvDb2LQl3BgHoA3NYqKmRSiIAG7dpxAJCYZhY=", - "LastProcessedTimeUtc": "2020-09-30T14:11:44.0779765Z", - "ThreatCategory": "", - "ThreatFamily": "", - "ThreatName": "", - "RemediationAction": "", - "RemediationIsSuccess": null, - "Source": "EDR", - "Md5": "854b85cbff2752fcb88606bca76f83c6", - "Sha256": "", - "WasExecutingWhileDetected": null, - "UserDomain": "", - "LogOnUsers": "", - "MachineDomain": "domain.com", - "MachineName": "mymachine1", - "InternalIPv4List": "", - "InternalIPv6List": "", - "FileHash": "aabbccddee1122334455aabbccddee1122334455", - "DeviceID": "deadbeef000040830ee54503926f556dcaf82bb0", - "MachineGroup": "", - "Description": "Test Alert", - "DeviceCreatedMachineTags": "", - "CloudCreatedMachineTags": "", - "CommandLine": "", - "IncidentLinkToWDATP": "https://securitycenter.windows.com/incidents/byalert?alertId=da637370718981685665_16349121&source=SIEM", - "ReportID": 1053729833, - "LinkToMTP": "https://security.microsoft.com/alert/da637370718981685665_16349121", - "IncidentLinkToMTP": "https://security.microsoft.com/incidents/byalert?alertId=da637370718981685665_16349121&source=SIEM", - "ExternalId": "31DD0A845DDA4059FDEDE031014645350AECABD3", - "IocUniqueId": "R4xEdgAvDb2LQl3BgHoA3NYqKmRSiIAG7dpxAJCYZhY=" -} -] -``` --## Code examples --### Get access token --The following code examples demonstrate how to obtain an access token for calling the Microsoft Defender for Endpoint SIEM API. --```csharp -AuthenticationContext context = new AuthenticationContext(string.Format("https://login.microsoftonline.com/{0}", tenantId)); -ClientCredential clientCredentials = new ClientCredential(clientId, clientSecret); -AuthenticationResult authenticationResult = context.AcquireTokenAsync(detectionsResource, clientCredentials).GetAwaiter().GetResult(); -``` --```PowerShell -#Get current working directory -$scriptDir = Split-Path -Path $MyInvocation.MyCommand.Definition -Parent --#Paste below your Tenant ID, App ID and App Secret (App key). -$tenantId = '' ### Paste your tenant ID here -$appId = '' ### Paste your Application ID here -$appSecret = '' ### Paste your Application secret here --$resourceAppIdUri = 'https://graph.windows.net' -$oAuthUri = "https://login.microsoftonline.com/$tenantId/oauth2/token" -$authBody = [Ordered] @{ - resource = "$resourceAppIdUri" - client_id = "$appId" - client_secret = "$appSecret" - grant_type = 'client_credentials' -} --#call API -$authResponse = Invoke-RestMethod -Method Post -Uri $oAuthUri -Body $authBody -ErrorAction Stop -$authResponse -Out-File -FilePath "$scriptDir\LatestSIEM-token.txt" -InputObject $authResponse.access_token -``` --```Bash -tenantId='' ### Paste your tenant ID here -appId='' ### Paste your Application ID here -appSecret='' ### Paste your Application secret here -resourceAppIdUri='https://graph.windows.net' -oAuthUri="https://login.microsoftonline.com/$tenantId/oauth2/token" -scriptDir=$(pwd) --apiResponse=$(curl -s X POST "$oAuthUri" -d "resource=$resourceAppIdUri&client_id=$appId&client_secret=$appSecret&\ - grant_type=client_credentials"|cut -d "{" -f2|cut -d "}" -f1) -IFS="," -apiResponseArr=($apiResponse) -IFS=":" -tokenArr=(${apiResponseArr[6]}) -echo ${tokenArr[1]}|cut -d "\"" -f2|cut -d "\"" -f1 >> $scriptDir/LatestSIEM-token.txt -``` --### Use token to connect to the detections endpoint --The following code examples demonstrate how to use an access token for calling the Defender for Endpoint SIEM API to get alerts. --```csharp -HttpClient httpClient = new HttpClient(); -httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(authenticationResult.AccessTokenType, authenticationResult.AccessToken); -HttpResponseMessage response = httpClient.GetAsync("https://wdatp-alertexporter-eu.windows.com/api/alert").GetAwaiter().GetResult(); -string detectionsJson = response.Content.ReadAsStringAsync().Result; -Console.WriteLine("Got detections list: {0}", detectionsJson); -``` --```PowerShell -#Get current working directory -$scriptDir = Split-Path -Path $MyInvocation.MyCommand.Definition -Parent --#run the script Get-Token.ps1 - make sure you are running this script from the same folder of Get-SIEMToken.ps1 -$token = Get-Content "$scriptDir\LatestSIEM-token.txt" --#Get Alert from the last xx hours 200 in this example. Make sure you have alerts in that time frame. -$dateTime = (Get-Date).ToUniversalTime().AddHours(-200).ToString("o") --#test SIEM API -$url = 'https://wdatp-alertexporter-us.windows.com/api/alerts?limit=20&sinceTimeUtc=2020-01-01T00:00:00.000' --#Set the WebRequest headers -$headers = @{ - 'Content-Type' = 'application/json' - Accept = 'application/json' - Authorization = "Bearer $token" -} --#Send the webrequest and get the results. -$response = Invoke-WebRequest -Method Get -Uri $url -Headers $headers -ErrorAction Stop -$response -Write-Host --#Extract the alerts from the results. This works for SIEM API: -$alerts = $response.Content|ConvertFrom-Json|ConvertTo-Json --#Get string with the execution time. We concatenate that string to the output file to avoid overwrite the file -$dateTimeForFileName = Get-Date -Format o|foreach {$_ -replace ":", "."} --#Save the result as json and as csv -$outputJsonPath = "$scriptDir\Latest Alerts $dateTimeForFileName.json" -$outputCsvPath = "$scriptDir\Latest Alerts $dateTimeForFileName.csv" --Out-File -FilePath $outputJsonPath -InputObject $alerts -Get-Content -Path $outputJsonPath -Raw|ConvertFrom-Json|Select-Object -ExpandProperty value|Export-CSV $outputCsvPath -NoTypeInformation -``` --```Bash -#Get current working directory -scriptDir=$(pwd) --#get the token -token=$(<$scriptDir/LatestSIEM-token.txt) --#test the SIEM API, get alerts since 1/1/2020 -url='https://wdatp-alertexporter-us.windows.com/api/alerts?limit=20&sinceTimeUtc=2020-01-01T00:00:00.000' --#send web requst to API and echo JSON content -apiResponse=$(curl -s X GET "$url" -H "Content-Type: application/json" -H "Accept: application/json"\ - -H "Authorization: Bearer $token"|cut -d "[" -f2|cut -d "]" -f1) -echo "If you see Alert info in JSON format, congratulations you accessed the MDATP SIEM API!" -echo -echo $apiResponse -``` --## Error codes --The Microsoft Defender for Endpoint REST API returns the following error codes caused by an invalid request. --HTTP error code|Description -| -401|Malformed request or invalid token. -403|Unauthorized exception - any of the domains is not managed by the tenant administrator or tenant state is deleted. -500|Error in the service. --## Related topics --- [Enable SIEM integration in Microsoft Defender for Endpoint](enable-siem-integration.md)-- [Configure ArcSight to pull Microsoft Defender for Endpoint detections](configure-arcsight.md)-- [Pull detections to your SIEM tools](configure-siem.md)-- [Microsoft Defender for Endpoint Detection fields](api-portal-mapping.md)-- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) |
| security | Run Analyzer Macos Linux | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/run-analyzer-macos-linux.md | ms.technology: m365d 1. Download the [XMDE Client Analyzer](https://aka.ms/XMDEClientAnalyzer) tool to the macOS or Linux machine you need to investigate. > [!NOTE]- > The current SHA256 hash of 'XMDEClientAnalyzer.zip' that is downloaded from the above link is: '34C7F043211575544BB2C9CE30AB0998172066E44CD51E1CA018EDE9C96AB834'. + > The current SHA256 hash of 'XMDEClientAnalyzer.zip' that is downloaded from the above link is: '34C0DA20A6B38A16951394958991CD74EF7E07EB1DE06923547B351665A32DF6'. 2. Extract the contents of XMDEClientAnalyzer.zip on the machine. |
| security | Troubleshoot Siem | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-siem.md | If you encounter an error when trying to enable the SIEM connector application, ## Related topics -- [Enable SIEM integration in Microsoft Defender for Endpoint](enable-siem-integration.md)-- [Configure ArcSight to pull Microsoft Defender for Endpoint detections](configure-arcsight.md) - [Pull detections to your SIEM tools](configure-siem.md)-- [Microsoft Defender for Endpoint Detection fields](api-portal-mapping.md)-- [Pull Microsoft Defender for Endpoint detections using REST API](pull-alerts-using-rest-api.md)+ |
| security | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/whats-new.md | For more information on what's new with other Microsoft Defender security produc - [What's new in Microsoft Defender for Identity](/defender-for-identity/whats-new) - [What's new in Microsoft Cloud App Security](/cloud-app-security/release-notes) +You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter). + ## December 2021 - (GA) The `DeviceTvmSoftwareEvidenceBeta` table was added on a short-term basis in advanced hunting to allow you to view evidence of where a specific software was detected on a device. |
| security | Admin Submission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/admin-submission.md | For other ways to submit email messages, URLs, and attachments to Microsoft, see - You open the Microsoft 365 Defender portal at <https://security.microsoft.com/>. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. - To submit messages and files to Microsoft, you need to be a member of one of the following role groups:- - **Organization Management** or **Security Reader** in the [Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md). + - **Security Administrator** or **Security Reader** in the [Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md). Note that membership in this role group is required to [View user submissions to the custom mailbox](#view-user-submissions-to-microsoft) as described later in this article. |
| security | Manage Tenant Blocks | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/manage-tenant-blocks.md | ms.prod: m365-security 4. When you're finished, click **Add**. +> [!NOTE] +> The emails from these senders will be blocked as *spam*. + ### Create block URL entries in the Tenant Allow/Block List 1. In the Microsoft 365 Defender portal, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. ms.prod: m365-security 4. When you're finished, click **Add**. +> [!NOTE] +> The emails containing these URLs will be blocked as *phish*. + ### Create block file entries in the Tenant Allow/Block List 1. In the Microsoft 365 Defender portal, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. ms.prod: m365-security 4. When you're finished, click **Add**. +> [!NOTE] +> The emails containing these files will be blocked as *malware*. + ### Create spoofed sender block entries **Notes**: |