+> - For Copilot to work in Word Online, Excel Online, and PowerPoint Online, you need to have third-party cookies enabled.

+> - Review your privacy settings for Microsoft 365 Apps for enterprise because those settings might have an effect on the availability of Microsoft Copilot for Microsoft 365 features. For more information, see [Microsoft Copilot for Microsoft 365 and policy settings for connected experiences](microsoft-365-copilot-privacy.md#microsoft-copilot-for-microsoft-365-and-policy-settings-for-connected-experiences).

+ Title: "Understand the Microsoft 365 E3 and E5 Extra Features license"

+description: "Learn about Microsoft 365 E3 and E5 Extra Features and how to assign licenses for it to your users."

+# Understand the Microsoft 365 E3 and E5 Extra Features license

+> This article only applies if you bought a Microsoft 365 E3 or E5 Original subscription through an Enterprise Agreement (EA). If this applies to you, you now see the Microsoft 365 E3 Extra Features or Microsoft 365 E5 Extra Features product on the **Licenses** page in the Microsoft 365 admin center.

+If you have a Microsoft 365 E3 or E5 Original subscription that you bought through an Enterprise Agreement (EA), you now also have a subscription for Microsoft 365 E3 Extra Features or Microsoft 365 E5 Extra Features. The Microsoft 365 E3 or E5 Original package includes the following products and services at no additional cost.

+- Office 365 E3 or Office 365 E5

+- Enterprise Mobility and Security E3 or Enterprise Mobility and Security E5

+- Windows E3 or Windows E5

+The new Microsoft 365 E3 or E5 Extra Features product is now included in this list. To provide the features for your users, [assign them licenses for Microsoft 365 E3 and/or E5 Extra Features](#assign-the-microsoft-365-e3-or-e5-extra-features-license-to-users).

+## WhatΓÇÖs provided by Microsoft 365 E3 or E5 Extra Features?

+Microsoft 365 E3 or E5 Extra Features provides the following features for your users:

+## Assign the Microsoft 365 E3 or E5 Extra Features license to users

+To use any of the features provided by Microsoft 365 E3 or E5 Extra Features, you must assign a license for it to your Microsoft 365 E3 or E5 users. We recommend that you assign the license to your users as soon as possible, so that they can use the features and improve their Microsoft 365 experience.

+- `sudo '/Library/Application Support/Microsoft/Defender/uninstall/uninstall'`

+ Title: Rerun queries in query history

+description: Learn about the query history tab in advanced hunting

+keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft Defender XDR, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, security events, antivirus, query history, features

+search.product: eADQiWindows 10XVcnh

+search.appverid: met150

+ms.mktglfcycl: deploy

+ms.sitesec: library

+ms.pagetype: security

+f1.keywords:

+ - NOCSH

+ms.localizationpriority: medium

+audience: ITPro

+- m365-security

+- tier3

+# Rerun queries in query history

+**Applies to:**

+- Microsoft Defender XDR

+> [!IMPORTANT]

+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

+Your previous queries appear in the **Query history** tab in the lower half of the advanced hunting page. You can run queries you have generated and run before even if you have already closed the query tab that contains it.

+## View the query history tab

+To view your query history, select the **Query history** tab.

+Your recent queries appear in descending order of when you last ran them. The query history contains up to 30 queries from the last 28 days.

+By default, **Query history** contains following columns:

+- Time - when the query was started

+- Query

+- Query time - how long the query ran

+- State - whether the query was completed, failed, or was throttled

+Select **Customize columns** to hide any of the columns in your view.

+## Rerun queries from query history

+To use any of your previous queries, select the query. The **Run query** and **Use in editor** options then appear.

+Select **Run query** to load and run the query in the query editor. Select **Use in editor** to load the query in the editor, where you can then refine it further.

+You can also explore the results in-line with the following features:

+- Expand a result by selecting the dropdown arrow at the left of each result

+- Where applicable, expand details for results that are in JSON and array formats by selecting the dropdown arrow at the left of applicable column names for added readability

+- Open the side pane to see a recordΓÇÖs details (concurrent with expanded rows)

+You can also right-click on any result value in a row so that you can use it to add more filters to the existing query or copy the value for use in further investigation.

+ Title: Create custom Microsoft Defender XDR reports using Microsoft Graph security API and Power BI

+description: How to create custom Microsoft Defender XDR reports using Microsoft Graph security API and Power BI

+keywords: reports, Microsoft Defender XDR, Microsoft Graph security API, Power BI

+ms.sitesec: library

+ms.pagetype: security

+ms.localizationpriority: medium

+- m365-security

+- tier2

+search.appverid: met150

+# Create custom Microsoft Defender XDR reports using Microsoft Graph security API and Power BI

+**Applies to:**

+- [Microsoft Defender XDR](https://go.microsoft.com/fwlink/?linkid=2118804)

+Empowering security professionals to visualize their data enables them to quickly recognize complex patterns, anomalies, and trends that might otherwise be lurking underneath the noise. With visualizations, SOC teams can rapidly identify threats, make informed decisions, and communicate insights effectively across the organization.

+There are multiple ways to visualize Microsoft Defender security data:

+- Navigating built-in reports in the Microsoft Defender portal

+- Using Microsoft Sentinel workbooks with prebuilt templates for every Defender product (requires integration with Microsoft Sentinel)

+- Applying the render function in Advanced Hunting

+- Using Power BI to expand existing reporting capabilities.

+In this article we'll create a sample Security Operations Center (SOC) efficiency dashboard in Power BI using Microsoft Graph security API. We'll access it in user context, therefore user must have [corresponding permissions](manage-rbac.md) to be able to view alerts and incidents data.

+> [!NOTE]

+> **Example below is based on our new MS Graph security API**. Find out more at: [Use the Microsoft Graph security API](/graph/api/resources/security-api-overview).

+## Importing data into Power BI

+In this section we'll go through the steps required to get Microsoft Defender XDR data into Power BI, using Alerts data as an example.

+1. Open Microsoft Power BI Desktop.

+2. Select **Get Data > Blank Query**.

+3. Select **Advanced Editor**.

+ :::image type="content" source="../../../microsoft-365/media/defender/power-bi/manage-parameters.png" alt-text="Screenshot that shows how to create a new data query in PowerBI Desktop.." lightbox="../../../microsoft-365/media/defender/power-bi/manage-parameters.png":::

+5. Paste in Query:

+ ```

+ let

+ Source = OData.Feed("https://graph.microsoft.com/v1.0/security/alerts_v2", null, [Implementation="2.0"])

+ in

+ Source

+ ```

+6. Select **Done**.

+7. You'll be prompted for credentials, select **Edit Credentials**:

+

+ :::image type="content" source="../../../microsoft-365/media/defender/power-bi/edit-credentials-api.png" alt-text="Screenshot of how to edit credentials for API connection." lightbox="../../../microsoft-365/media/defender/power-bi/edit-credentials-api.png":::

+9. Select **Organizational account > Sign in**.

+

+ :::image type="content" source="../../../microsoft-365/media/defender/power-bi/sign-in-org-account.png" alt-text="Screenshot of the organizational account authentication window." lightbox="../../../microsoft-365/media/defender/power-bi/sign-in-org-account.png":::

+11. Enter credentials for account with access to Microsoft Defender XDR incidents data.

+12. Select **Connect**.

+Now the results of your query appear as a table, and you can start building visualizations on top of it.

+> [!TIP]

+> If you are looking to visualize other forms of Microsoft Graph security data like Incidents, Advanced Hunting, Secure Score, etc., see [Microsoft Graph security API Overview](/graph/api/resources/security-api-overview).

+## Filtering data

+Microsoft Graph API supports OData protocol so that users don't have to worry about pagination - or requesting the next set of data. However, filtering data is essential to improving load times in a busy environment.

+Microsoft Graph API supports [query parameters](/graph/filter-query-parameter). Below are few examples of filters used in the report:

+- The query below will return the list of alerts generated over the past three days. Note that using this query in environments with high volumes of data may result in hundreds of megabytes of data that could take a moment to load. By using this hardcoded approach, you'll be able to quickly see your most recent alerts over the last three days as soon as you open the report.

+ ```

+ let

+ AlertDays = "3",

+ TIME = "" & Date.ToText(Date.AddDays(Date.From(DateTime.LocalNow()), -AlertDays), "yyyy-MM-dd") & "",

+ Source = OData.Feed("https://graph.microsoft.com/v1.0/security/alerts_v2?$filter=createdDateTime ge " & TIME & "", null, [Implementation="2.0"])

+ in

+ Source

+ ```

+- Instead of collecting data across a date range, we can gather alerts across more precise dates by inputting a date using the YYYY-MM-DD format.

+ ```

+ let

+ StartDate = "YYYY-MM-DD",

+ EndDate = "YYYY-MM-DD",

+ Source = OData.Feed("https://graph.microsoft.com/v1.0/security/ alerts_v2?$filter=createdDateTime ge " & StartDate & " and createdDateTime lt " & EndDate & "", null, [Implementation="2.0"])

+ in

+ Source

+ ```

+- When historical data is required (for example, comparing the number of incidents per month), filtering by date isn't an option (since we want to go as far back as possible). In this case we need to pull a few selected fields shown below:

+ ```

+ let

+ Source = OData.Feed("https://graph.microsoft.com/v1.0/security/alerts_v2?$filter=createdDateTime ge " & StartLookbackDate & " and createdDateTime lt " & EndLookbackDate &

+ "&$select=id,title,severity,createdDateTime", null, [Implementation="2.0"])

+ in

+ Source

+ ```

+## Introducing parameters

+Instead of constantly querying the code to adjust the timeframe, use parameters to set a Start and End Date each time you open the report. To do this, follow the steps below:

+1. Go to **Query Editor**.

+2. Select **Manage Parameters > New Parameter**.

+3. Set desired parameters.

+In the example below, we use two different time frames, Start and End dates.

+4. Remove hardcoded values from the queries and make sure that StartDate and EndDate variable names correspond to parameter names:

+ ```

+ let

+ Source = OData.Feed("https://graph.microsoft.com/v1.0/security/incidents?$filter=createdDateTime ge " & StartDate & " and createdDateTime lt " & EndDate & "", null, [Implementation="2.0"])

+ in

+ Source

+ ```

+## Reviewing the report

+Once the data has been queried and the parameters are set, now we can review the report. During the first launch of the .PBIT report file you'll be prompted to provide the parameters that we specified earlier:

+The dashboard offers three tabs intended to provide SOC insights. The first tab provides a summary of all recent alerts (depending on the selected timeframe). This helps analysts clearly understand the security state over their environment using alert details broken down by detection source, severity, total number of alerts and mean-time-to-resolution.

+The second tab offers more insight into the attack data collected across the incidents and alerts. This view can provide analysts with greater perspective into the types of attacks executed and how they map to the MITRE ATT&CK framework.

+## Power BI dashboard samples

+For more information, see the

+[Power BI report templates sample file](https://download.microsoft.com/download/0/1/6/01686830-b4e4-4cc1-af5b-7e07eab3ff55/defender-xdr-soc-overview.zip).

+## Related articles

+- [Use Microsoft Graph security API](/graph/api/resources/security-api-overview)

+6. Select **Next** to choose the roles to import. You can choose all roles or select specific roles from the list. Select the role name to review the permissions and assigned users or groups for that specific role.

+7. Select the roles you want to import and select **Next**.

+> [!NOTE]

+> If the role you want to import appears in the **Roles not eligible for import** list, it contains assignments for users or user groups that no longer exist in Entra ID.

+>

+> To import this role to Unified RBAC, remove the user or user group from the role in the original RBAC model. Select the role to view the list of users that still exist for that role to determine which user or group to remove.

+8. Select **Submit**.

+9. Select **Done** on the confirmation page.

+## January 2024

+- (Preview) **[Query history](advanced-hunting-query-history.md) in advanced hunting** is now available. You can now rerun or refine queries you have run recently. Up to 30 queries in the past 28 days can be loaded in the query history pane.

+- (Preview) Additional features you can use to **[drill down](/advanced-hunting-query-results#drill-down-from-query-results)** further from your query results in advanced hunting are now available.

+> [!NOTE]

+> Through June 2024, you can try out content assembly and other selected Syntex services at no cost if you have [pay-as-you-go billing](syntex-azure-billing.md) set up. For information and limitations, see [Try out Microsoft Syntex and explore its services](promo-syntex.md).

+> [!NOTE]

+> Through June 2024, you can try out unstructured document processing and other selected Syntex services at no cost if you have [pay-as-you-go billing](syntex-azure-billing.md) set up. For information and limitations, see [Try out Microsoft Syntex and explore its services](promo-syntex.md).

+Use the unstructured document processing model ([teaching method](create-syntex-model.md#train-a-custom-model)) to automatically classify files and extract information. It works best for unstructured documents, such as letters or contracts.

+> [!NOTE]

+> Through June 2024, you can try out eSignature and other selected Syntex services at no cost if you have [pay-as-you-go billing](syntex-azure-billing.md) set up. For information and limitations, see [Try out Microsoft Syntex and explore its services](promo-syntex.md).

+> [!NOTE]

+> Through June 2024, you can try out structured and freeform document processing and other selected Syntex services at no cost if you have [pay-as-you-go billing](syntex-azure-billing.md) set up. For information and limitations, see [Try out Microsoft Syntex and explore its services](promo-syntex.md).

+> [!NOTE]

+> Through June 2024, you can try out image tagging and other selected Syntex services at no cost if you have [pay-as-you-go billing](syntex-azure-billing.md) set up. For information and limitations, see [Try out Microsoft Syntex and explore its services](promo-syntex.md).

+> [!NOTE]

+> Through June 2024, you can try out optical character recognition and other selected Syntex services at no cost if you have [pay-as-you-go billing](syntex-azure-billing.md) set up. For information and limitations, see [Try out Microsoft Syntex and explore its services](promo-syntex.md).

+> [!NOTE]

+> Through June 2024, you can try out prebuilt document processing and other selected Syntex services at no cost if you have [pay-as-you-go billing](syntex-azure-billing.md) set up. For information and limitations, see [Try out Microsoft Syntex and explore its services](promo-syntex.md).

+ Title: Try out Microsoft Syntex and explore its services

+audience: admin

+- enabler-strategic

+- m365initiative-syntex

+- Adopt

+search.appverid:

+ms.localizationpriority: medium

+description: Learn how to try Microsoft Syntex services during a limited offering.

+# Try out Microsoft Syntex and explore its services

+Microsoft Syntex (evolving to be SharePoint Premium) is a powerful tool that lets you do more with your documents. You can process, analyze, create, sign, manage, and enhance them with ease.

+Through June 2024, your organization can use included monthly capacity for some of these services when you set up [pay-as-you-go billing](syntex-azure-billing.md). It's a great way to try out Syntex capabilities, such as document processing, document tagging, and content assembly, to see how you can use them to streamline processes in your organization.

+## Get started

+If you want to try some of these services, here are the steps to follow:

+1. [Set up pay-as-you-go billing](syntex-azure-billing.md).

+2. [Turn on the Syntex services you want to try](set-up-microsoft-syntex.md).

+3. [Start using the Syntex services](syntex-overview.md#syntex-services).

+## Monthly included capacity

+You'll get a limited amount of usage each month during the offering period. The following table shows the units of service and capacity limits your organization can use at no charge for each month. Capacity limits shown are per tenant, not per user.

+|Service |Units |Monthly included capacity at no charge |

+||||

+|Content assembly | Documents | 50 |

+|eSignature | Envelopes | 5 |

+|Image tagging | Images | 2,500 |

+|Optical character recognition | Pages | 2,500 |

+|Prebuilt document processing | Pages | 100 |

+|Structured document processing | Pages | 100 |

+|Taxonomy tagging | Documents | 50 |

+|Unstructured document processing | Pages | 100 |

+<!

+|Document translation | Characters | 1 million |

+>

+Monthly usage over the limitations will be billed as described in [Pay-as-you-go services and pricing](syntex-pay-as-you-go-services.md). This offering doesn't include capacity for Microsoft 365 Archive and Microsoft 365 Backup.

+For ideas about how you might use Syntex services in your organization, see [Scenarios and use cases for Microsoft Syntex](adoption-scenarios.md) and [Get started driving adoption of Microsoft Syntex](adoption-getstarted.md).

+<!

+This article describes how to set up and run a trial pilot program to deploy Microsoft Syntex in your organization. It also recommends best practices for the trial.

+## Sign up for a trial

+The trial of Syntex gives access to 300 users for 30 days.

+> [!NOTE]

+> Up to 300 users are included in the trial to ensure the automatic addition of 1 million AI Builder credits. You do not have to include 300 users for a trial to succeed.

+You can get the trial version from one of the following sources:

+- The [Syntex product page](https://www.microsoft.com/microsoft-365/enterprise/sharepoint-syntex?activetab=pivot:overviewtab)

+- The [Microsoft 365 admin center](https://admin.microsoft.com)

+ 1. Sign in to the [Microsoft 365 admin center](https://admin.microsoft.com).

+ 2. Go to **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=868433" target="_blank">**Purchase Services**</a>.

+ 3. Scroll down to the **Add-Ons** section.

+ 4. On the Syntex tile, select **Details**.

+ 5. Select **Start free trial**.

+ 6. To confirm the trial, follow the remaining wizard steps.

+You must be a Microsoft 365 global administrator or billing administrator to activate a trial.

+### Who should be involved in a trial

+|Role|Activity|

+|||

+|Microsoft 365 global admin or billing admin|Activate the trial and assign licenses|

+|Microsoft 365 global admin or SharePoint admin|Configure Syntex and create content centers|

+|Business users|Model building and testing|

+### Before you activate a trial

+To successfully plan a Syntex trial, consider the following factors:

+- The most meaningful testing is completed on ΓÇ£real worldΓÇ¥ scenarios and data.

+- You can only activate a Syntex trial once per tenant.

+A test or demo tenant can be used as a ΓÇ£dry runΓÇ¥ to walk through the activation steps and administrative controls. But it's probably best to evaluate model building on a production tenant.

+To maximize the value of a trial on a production tenant, planning and business engagement are essential. You should engage one or more business areas to identify three to six use cases that could potentially be addressed by Syntex. These use cases should:

+- Include scenarios that could be solved by using either a custom model or a prebuilt model.

+- Have a clear understanding of the purpose for any extracted metadata; for example, view formatting or automation by using Power Automate. While Syntex is focused on classifying documents and extracting metadata, the value to quantify is what this metadata enables.

+- Be based on a defined set of data; for example, specific SharePoint sites or libraries. A common misconception of Syntex is that general purpose models can be applied across all organization content. A more accurate view is that models are built to help solve specific business problems in targeted locations.

+All of these use cases might not be a good fit for Syntex. The goal of a quality trial isn't to prove that Syntex will fit all the scenarios. Instead, the trial should help you better understand the value of the product.

+For each of the planned use cases, identify users who are subject matter experts in the related content or process. The creation of Syntex models is focused on domain experts in the content, rather than on IT professionals or developer resources.

+## Activate a trial

+When you initiate a trial, you need to:

+- Assign licenses to the relevant users.

+- Perform [additional setup of Syntex](set-up-content-understanding.md).

+ - You might want to [create more content centers](create-a-content-center.md).

+After the trial is activated, you can create models and process files. See [guidance for model creation](create-a-content-center.md).

+## During a trial

+Trial periods are limited, so it's best to focus initially on whether Syntex models can classify documents and extract metadata for the defined use cases. After the trial period is over, you can evaluate how the metadata can be used.

+## After a trial

+Based on the outcome of the trial, you can decide whether to proceed to production use of Syntex.

+### Proceed to production use

+To ensure continuity of service, you need to purchase the required number of [licenses](syntex-licensing.md) and assign those licenses to users. Trial users who don't have a full license at the end of the trial period won't be able to fully use Syntex.

+You might have to estimate your projected use of structured document processing or freeform document processing models, and plan for the expected number of AI Builder credits. For help, see [Estimate the AI Builder capacity that's right for you](https://powerapps.microsoft.com/ai-builder-calculator/).

+### Don't proceed to production use

+If you don't purchase licenses following the trial:

+- You won't be able to create new models.

+- Libraries that were running models will no longer automatically classify files or extract models.

+- Any previously classified files or extracted metadata won't be affected.

+- Content centers and any models in them won't be automatically deleted. These will remain available for use if you decide to purchase licenses in the future.

+- Structured document processing or freeform document processing models will be stored in the Dataverse (formerly named Common Data Service (CDS)) instance of the default Power Platform environment. These could be used with future licensing for Syntex or with AI Builder capabilities in the Power Platform.

+## See also

+[Get started driving adoption of Microsoft Syntex](adoption-getstarted.md)

+[Scenarios and use cases for Microsoft Syntex](adoption-scenarios.md)>

+> [!NOTE]

+> Through June 2024, if you have [pay-as-you-go billing](syntex-azure-billing.md) set up, your organization will receive a limited amount of included capacity each month for selected services, letting you try these services at no cost. This offering does not include capacity for Microsoft 365 Archive or Microsoft 365 Backup. For more information, see [Try out Microsoft Syntex and explore its services](promo-syntex.md).

+> [!NOTE]

+> Through June 2024, you can try out taxonomy tagging and other selected Syntex services at no cost if you have [pay-as-you-go billing](syntex-azure-billing.md) set up. For information and limitations, see [Try out Microsoft Syntex and explore its services](promo-syntex.md).