| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| compliance | Alert Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/alert-policies.md | The table also indicates the Office 365 Enterprise and Office 365 US Government |**Phish delivered due to tenant or user override**<sup>1</sup>|Generates an alert when Microsoft detects an admin or user override allowed the delivery of a phishing message to a mailbox. Examples of overrides include an inbox or mail flow rule that allows messages from a specific sender or domain, or an anti-spam policy that allows messages from specific senders or domains. This policy has a **High** severity setting.|Threat management|E5/G5 or Defender for Office 365 P2 add-on subscription| |**Suspicious email forwarding activity**|Generates an alert when someone in your organization has autoforwarded email to a suspicious external account. This is an early warning for behavior that may indicate the account is compromised, but not severe enough to restrict the user. This policy has a **High** severity setting. Although it's rare, an alert generated by this policy may be an anomaly. It's a good idea to [check whether the user account is compromised](../security/office-365-security/responding-to-a-compromised-email-account.md).|Threat management|E1/F1/G1, E3/F3/G3, or E5/G5| |**Suspicious email sending patterns detected**|Generates an alert when someone in your organization has sent suspicious email and is at risk of being restricted from sending email. This is an early warning for behavior that may indicate that the account is compromised, but not severe enough to restrict the user. This policy has a **Medium** severity setting. Although it's rare, an alert generated by this policy may be an anomaly. However, it's a good idea to [check whether the user account is compromised](../security/office-365-security/responding-to-a-compromised-email-account.md).|Threat management|E1/F1/G1, E3/F3/G3, or E5/G5 |+|**Tenant Allow/Block List entry is about to expire**|Generates an alert when a Tenant Allow/Block List entry is about to be removed. This event is triggered three days prior to expiration date, which is based when the entry was created or last updated. This alert policy has an **Informational** severity setting. This is to inform admins of upcoming changes in the filters since the allow or block could be going away. For blocks, you can extend the expiration date to keep the block in place. For allows, you need to resubmit the item so that our analysts can take another look. However, if the allow has already been graded as a false positive, then the entry will only expire when the system filters have been updated to naturally allow the entry. For more information on events that trigger this alert, see [Manage the Tenant Allow/Block list](..security/office-365-security/tenant-allow-block-list.md).|Threat management|E5/G5 or Defender for Office 365 P2 add-on subscription| |**Tenant restricted from sending email**|Generates an alert when most of the email traffic from your organization has been detected as suspicious and Microsoft has restricted your organization from sending email. Investigate any potentially compromised user and admin accounts, new connectors, or open relays, and then contact Microsoft Support to unblock your organization. This policy has a **High** severity setting. For more information about why organizations are blocked, see [Fix email delivery issues for error code 5.7.7xx in Exchange Online](/Exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/fix-error-code-5-7-700-through-5-7-750).|Threat management|E1/F1/G1, E3/F3/G3, or E5/G5|+|**Tenant restricted from sending unprovisioned email**|Generates an alert when too much email is being sent from unregistered domains (also known as *unprovisioned* domains). Office 365 allows a reasonable amount of email from unregistered domains, but you should configure every domain that you use to send email as an accepted domain. This alert indicates that all users in the organization can no longer send email. This policy has a **High** severity setting. For more information about why organizations are blocked, see [Fix email delivery issues for error code 5.7.7xx in Exchange Online](/Exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/fix-error-code-5-7-700-through-5-7-750).|Threat management|E1/F1/G1, E3/F3/G3, or E5/G5| |**Unusual external user file activity**|Generates an alert when an unusually large number of activities are performed on files in SharePoint or OneDrive by users outside of your organization. This includes activities such as accessing files, downloading files, and deleting files. This policy has a **High** severity setting.|Information governance|E5/G5, Microsoft Defender for Office 365 P2, or Microsoft 365 E5 add-on subscription| |**Unusual volume of external file sharing**|Generates an alert when an unusually large number of files in SharePoint or OneDrive are shared with users outside of your organization. This policy has a **Medium** severity setting.|Information governance|E5/G5, Defender for Office 365 P2, or Microsoft 365 E5 add-on subscription| |**Unusual volume of file deletion**|Generates an alert when an unusually large number of files are deleted in SharePoint or OneDrive within a short time frame. This policy has a **Medium** severity setting.|Information governance|E5/G5, Defender for Office 365 P2, or Microsoft 365 E5 add-on subscription| |
| compliance | Download Documents From Review Set | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/download-documents-from-review-set.md | -Download offers a simple way to download content from a review set in native format. The download tool in Advanced eDiscovery leverages the browser's data transfer features. A browser prompt will appear when a download is ready. Files downloaded using this method are zipped in a container file and will contain item-level files. This means that if you select to download an attachment, you will receive the email message with the attachment included. Similarly, if you export an Excel spreadsheet that is embedded in a Word document, the Word document with the embedded Excel spreadsheet are included in the download. When you downloaded items, the Last Modified Data property is preserved and can be viewed as a file property. +Download offers a simple way to download content from a review set in native format. The download tool in Advanced eDiscovery uses the browser's data transfer features. A browser prompt will appear when a download is ready. Files downloaded using this method are zipped in a container file and will contain item-level files. This means that if you select to download an attachment, you will receive the email message with the attachment included. Similarly, if you export an Excel spreadsheet that is embedded in a Word document, the Word document and the embedded Excel spreadsheet are included in the download. When you downloaded items, the Last Modified Data property is preserved and can be viewed as a file property. To download content from a review set in an Advanced eDiscovery case, start by selecting the files you want to download then select **Action items** > **Download**. |
| compliance | Importing Pst Files To Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/importing-pst-files-to-office-365.md | description: Learn how to use the Import service in the Microsoft 365 compliance > [!NOTE] > This article is for administrators. Are you trying to import PST files to your own mailbox? See [Import email, contacts, and calendar from an Outlook .pst file](https://go.microsoft.com/fwlink/p/?LinkID=785075). -You can use the Import service in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft 365 compliance center</a> to quickly bulk-import PST files to Exchange Online mailboxes in your organization. There are two ways you can import PST files to Office 365: +You can use the Import service in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft 365 compliance center</a> to quickly bulk-import PST files to Exchange Online mailboxes in your organization. There are two ways you can import PST files to Microsoft 365: -- **Network upload**  - Upload the PST files over the network to a temporary Azure Storage location in the Microsoft cloud. Then you use the Office 365 Import service to import the PST data to mailboxes in your organization.+- **Network upload**  - Upload the PST files over the network to a temporary Azure Storage location in the Microsoft cloud. Then you use the Microsoft 365 Import service to import the PST data to mailboxes in your organization. -- **Drive shipping**  - Copy the PST files to a BitLocker-encrypted hard drive and then physically ship the drive to Microsoft. When Microsoft receives the hard drive, data center personnel upload the data to a temporary Azure Storage location in the Microsoft cloud. Then you use the Office 365 Import service to import the data to mailboxes in your organization.+- **Drive shipping**  - Copy the PST files to a BitLocker-encrypted hard drive and then physically ship the drive to Microsoft. When Microsoft receives the hard drive, data center personnel upload the data to a temporary Azure Storage location in the Microsoft cloud. Then you use the Microsoft 365 Import service to import the data to mailboxes in your organization. ## Step-by-step instructions -See one of the following topics for detailed, step-by-step instructions for bulk-importing your organization's PST files to Office 365. +See one of the following topics for detailed, step-by-step instructions for bulk-importing your organization's PST files to Microsoft 365. -- [Use network upload to import PST files to Office 365](use-network-upload-to-import-pst-files.md)+- [Use network upload to import PST files to Microsoft 365](use-network-upload-to-import-pst-files.md) - [Use drive shipping to import PST files](use-drive-shipping-to-import-pst-files-to-office-365.md) Here's an illustration and description of the complete PST import process. The i - **Drive shipping:** The WAImportExport.exe tool (downloaded in step 1) is used to copy your PST files to the hard drive. This tool encrypts the hard drive with BitLocker and then copies the PSTs to the hard drive. Like network upload, the PST files that you want to copy to the hard drive have to be located in a file share or file server in your organization. -3. **Create a PST import mapping file** - After the PST files have been uploaded to the Azure Storage location or copied to a hard drive, the next step is to create a comma-separated value (CSV) file that specifies which user mailboxes the PST files will be imported to (and a PST file can be imported to a user's primary mailbox or their archive mailbox). [Download a copy of the PST Import mapping file](https://go.microsoft.com/fwlink/p/?LinkId=544717). The Office 365 Import service will use the information to import the PST files. +3. **Create a PST import mapping file** - After the PST files have been uploaded to the Azure Storage location or copied to a hard drive, the next step is to create a comma-separated value (CSV) file that specifies which user mailboxes the PST files will be imported to (and a PST file can be imported to a user's primary mailbox or their archive mailbox). [Download a copy of the PST Import mapping file](https://go.microsoft.com/fwlink/p/?LinkId=544717). The Microsoft 365 Import service will use the information to import the PST files. 4. **Create a PST import job** - The next step is to create a PST import job on the **Import PST files** page in the Microsoft 365 compliance center and submit the PST import mapping file created in the previous step. For network upload (because the PST files have been uploaded to Azure) Microsoft 365 analyzes the data in the PST files and then gives you an opportunity to set filters that control what data actually gets imported to the mailboxes specified in the PST import mapping file. You can also import files and documents to SharePoint sites and OneDrive account ## Frequently asked questions about importing PST files -Here are some frequently asked questions about using the Office 365 Import service to bulk-import PST files to Microsoft 365 mailboxes. +Here are some frequently asked questions about using the Microsoft 365 Import service to bulk-import PST files to Microsoft 365 mailboxes. - [Using network upload to import PST files](#using-network-upload-to-import-pst-files) Here are some frequently asked questions about using the Office 365 Import servi ### Using network upload to import PST files -#### What permissions are required to create import jobs in the Office 365 Import Service using network upload? +#### What permissions are required to create import jobs in the Microsoft 365 Import Service using network upload? You have to be assigned the Mailbox Import Export role in Exchange Online to import PST files to Microsoft 365 mailboxes. By default, this role isn't assigned to any role group in Exchange Online. You can add the Mailbox Import Export role to the Organization Management role group. Or you can create a new role group, assign the Mailbox Import Export role, and then add yourself or other users as a member. For more information, see the "Add a role to a role group" or the "Create a role group" sections in [Manage role groups in Exchange Online](/Exchange/permissions-exo/role-groups). Additionally, to create import jobs in the Microsoft 365 compliance center, one - You have to be a global administrator in your organization. > [!TIP]-> Consider creating a new role group in Exchange Online that's specifically intended for importing PST files to Office 365. For the minimum level of privileges required to import PST files, assign the Mailbox Import Export and Mail Recipients roles to the new role group, and then add members. +> Consider creating a new role group in Exchange Online that's specifically intended for importing PST files to Microsoft 365. For the minimum level of privileges required to import PST files, assign the Mailbox Import Export and Mail Recipients roles to the new role group, and then add members. #### Where is network upload available? Network upload is currently available in these regions: United States, Canada, B Using network upload to import PST files is free. -This also means that after PST files are deleted from the Azure Storage area, they're no longer displayed in the list of files for a completed import job in the [Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=2024339). Although an import job might still be listed on the **Import data to Office 365** page, the list of PST files might be empty when you view the details of older import jobs. +This also means that after PST files are deleted from the Azure Storage area, they're no longer displayed in the list of files for a completed import job in the [Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=2024339). Although an import job might still be listed on the **Import data to Microsoft 365** page, the list of PST files might be empty when you view the details of older import jobs. -#### What version of the PST file format is supported for importing to Office 365? +#### What version of the PST file format is supported for importing to Microsoft 365? -There are two versions of the PST file format: ANSI and Unicode. We recommend importing files that use the Unicode PST file format. However, files that use the ANSI PST file format, such as those for languages that use a double-byte character set (DBCS), can also be imported to Office 365. For more information about importing ANSI PST files, see Step 4 in [Use network upload to import PST files to Office 365](./use-network-upload-to-import-pst-files.md). +There are two versions of the PST file format: ANSI and Unicode. We recommend importing files that use the Unicode PST file format. However, files that use the ANSI PST file format, such as those for languages that use a double-byte character set (DBCS), can also be imported to Microsoft 365. For more information about importing ANSI PST files, see Step 4 in [Use network upload to import PST files to Microsoft 365](./use-network-upload-to-import-pst-files.md). -Additionally, PST files from Outlook 2007 and later versions can be imported to Office 365. +Additionally, PST files from Outlook 2007 and later versions can be imported to Microsoft 365. #### After I upload my PST files to the Azure Storage area, how long are they kept in Azure before they're deleted? This also means that after PST files are deleted from the Azure Storage area, th #### How long does it take to import a PST file to a mailbox using network upload? -It depends on the capacity of your network, but it typically takes several hours for each terabyte (TB) of data to be uploaded to the Azure Storage area for your organization. After the PST files are copied to the Azure Storage area, a PST file is imported to a Microsoft 365 mailbox at a rate of approximately 24 GB per day<sup>\*</sup>. If this rate doesn't meet your needs, you might consider other methods to get email data into Office 365. For more information, see [Ways to migrate multiple email accounts to Office 365](/Exchange/mailbox-migration/mailbox-migration). +It depends on the capacity of your network, but it typically takes several hours for each terabyte (TB) of data to be uploaded to the Azure Storage area for your organization. After the PST files are copied to the Azure Storage area, a PST file is imported to a Microsoft 365 mailbox at a rate of approximately 24 GB per day<sup>\*</sup>. If this rate doesn't meet your needs, you might consider other methods to get email data into Microsoft 365. For more information, see [Ways to migrate multiple email accounts to Microsoft 365](/Exchange/mailbox-migration/mailbox-migration). If different PST files are imported to different target mailboxes, the import process occurs in parallel; in other words, each PST/mailbox pair is imported simultaneously. If multiple PST files are imported to the same mailbox, they will be imported sequentially (one at a time), not simultaneously. Yes. The original message metadata isn't changed during the import process. Yes. You can't import a PST file that has 300 or more levels of nested folders. -#### Can I use network upload to import PST files to an inactive mailbox in Office 365? +#### Can I use network upload to import PST files to an inactive mailbox in Microsoft 365? Yes, this capability is now available. No, you can't import PST files to public folders. ### Using drive shipping to import PST files -#### What permissions are required to create import jobs in the Office 365 Import Service using drive shipping? +#### What permissions are required to create import jobs in the Microsoft 365 Import Service using drive shipping? You have to be assigned the Mailbox Import Export role to import PST files to Microsoft 365 mailboxes. By default, this role isn't assigned to any role group in Exchange Online. You can add the Mailbox Import Export role to the Organization Management role group. Or you can create a new role group, assign the Mailbox Import Export role, and then add yourself or other users as a member. For more information, see the "Add a role to a role group" or the "Create a role group" sections in [Manage role groups in Exchange Online](/Exchange/permissions-exo/role-groups). Additionally, to create import jobs in the Microsoft 365 compliance center, one - You have to be a global administrator in your organization. > [!TIP]-> Consider creating a new role group in Exchange Online that's specifically intended for importing PST files to Office 365. For the minimum level of privileges required to import PST files, assign the Mailbox Import Export and Mail Recipients roles to the new role group, and then add members. +> Consider creating a new role group in Exchange Online that's specifically intended for importing PST files to Microsoft 365. For the minimum level of privileges required to import PST files, assign the Mailbox Import Export and Mail Recipients roles to the new role group, and then add members. #### Where is drive shipping available? The cost to use drive shipping to import PST files to Microsoft 365 mailboxes is #### What kind of hard drives are supported for drive shipping? -Only 2.5-inch solid-state drives (SSDs) or 2.5 inch or 3.5 inch SATA II/III internal hard drives are supported for use with the Office 365 Import service. You can use hard drives up to 10 TB. For import jobs, only the first data volume on the hard drive will be processed. The data volume must be formatted with NTFS. When copying data to a hard drive, you can attach it directly using a 2.5 inch SSD or 2.5 inch or 3.5 inch SATA II/III connector or you can attach it externally using an external 2.5 inch SSD or 2.5 inch or 3.5 inch SATA II/III USB adapter. +Only 2.5-inch solid-state drives (SSDs) or 2.5 inch or 3.5 inch SATA II/III internal hard drives are supported for use with the Microsoft 365 Import service. You can use hard drives up to 10 TB. For import jobs, only the first data volume on the hard drive will be processed. The data volume must be formatted with NTFS. When copying data to a hard drive, you can attach it directly using a 2.5 inch SSD or 2.5 inch or 3.5 inch SATA II/III connector or you can attach it externally using an external 2.5 inch SSD or 2.5 inch or 3.5 inch SATA II/III USB adapter. > [!IMPORTANT]-> External hard drives that come with a built-in USB adapter aren't supported by the Office 365 Import service. Additionally, the disk inside the casing of an external hard drive can't be used. Please don't ship external hard drives. +> External hard drives that come with a built-in USB adapter aren't supported by the Microsoft 365 Import service. Additionally, the disk inside the casing of an external hard drive can't be used. Please don't ship external hard drives. #### How many hard drives can I ship for a single import job? |
| compliance | Mailitemsaccessed Forensics Investigations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/mailitemsaccessed-forensics-investigations.md | description: "Use the MailItemsAccessed mailbox auditing action to perform foren A compromised user account (also called an *account takeover*) is a type of attack when an attacker gains access to a user account and operates as the user. These types of attacks sometimes cause more damage than the attacker may have intended. When investigating compromised email accounts, you have to assume that more mail data was compromised than may be indicated by tracing the attacker's actual presence. Depending on the type of data in email messages, you have to assume that sensitive information was compromised or face regulatory fines unless you can prove that sensitive information wasn't exposed. For example, HIPAA-regulated organizations face significant fines if there is evidence that patient health information (PHI) was exposed. In these cases, attackers are unlikely to be interested in PHI, but organizations still must report data breaches unless they can prove otherwise. -To help you with investigating compromise email accounts, we're now auditing accesses of mail data by mail protocols and clients with the *MailItemsAccessed* mailbox auditing action. This new audited action will help investigators better understand email data breaches and help you identify the scope of compromises to specific mail items that may been compromised. The goal of using this new auditing action is forensics defensibility to help assert that a specific piece of mail data was not compromised. If an attacker gained access to a specific piece of mail, Exchange Online audits the event even though there is no indication that the mail item was actually read. +To help you with investigating compromise email accounts, we're now auditing accesses of mail data by mail protocols and clients with the *MailItemsAccessed* mailbox auditing action. This new audited action will help investigators better understand email data breaches and help you identify the scope of compromises to specific mail items that may been compromised. The goal of using this new auditing action is forensics defensibility to help assert that a specific piece of mail data was not compromised. If an attacker gained access to a specific piece of mail, Exchange Online audits the event even though there is no indication that the mail item was read. ## The MailItemsAccessed mailbox auditing action The MailItemsAccessed mailbox auditing action covers all mail protocols: POP, IM ### Auditing sync access -Sync operations are only recorded when a mailbox is accessed by a desktop version of the Outlook client for Windows or Mac. During the sync operation, these clients typically download a large set of mail items from the cloud to a local computer. The audit volume for sync operations is huge. So, instead of generating an audit record for each mail item that's synched, we just generate an audit event for the mail folder containing items that were synched. This makes the assumption that *all* mail items in the synched folder have been compromised. The access type is recorded in the OperationProperties field of the audit record. +Sync operations are only recorded when a mailbox is accessed by a desktop version of the Outlook client for Windows or Mac. During the sync operation, these clients typically download a large set of mail items from the cloud to a local computer. The audit volume for sync operations is huge. So, instead of generating an audit record for each mail item that's synched, we generate an audit event for the mail folder containing items that were synched and assume that *all* mail items in the synched folder have been compromised. The access type is recorded in the OperationProperties field of the audit record. See step 2 in the [Use MailItemsAccessed audit records for forensic investigations](#use-mailitemsaccessed-audit-records-for-forensic-investigations) section for an example of displaying the sync access type in an audit record. See step 4 in the [Use MailItemsAccessed audit records for forensic investigatio ### Throttling of MailItemsAccessed audit records -If more than 1,000 MailItemsAccessed audit records are generated in less than 24 hours, Exchange Online will stop generating auditing records for MailItemsAccessed activity. When a mailbox is throttled, MailItemsAccessed activity will not be logged for 24 hours after the mailbox was throttled. If this occurs, there's a potential that mailbox could have been compromised during this period. The recording of MailItemsAccessed activity will be resumed following a 24-hour period. +If more than 1,000 MailItemsAccessed audit records are generated in less than 24 hours, Exchange Online will stop generating auditing records for MailItemsAccessed activity. When a mailbox is throttled, MailItemsAccessed activity will not be logged for 24 hours after the mailbox was throttled. If the mailbox was throttled, there's a potential that mailbox could have been compromised during this period. The recording of MailItemsAccessed activity will be resumed following a 24-hour period. Here's a few things to keep in mind about throttling: Here are the steps for using MailItemsAccessed audit records to investigate a co Search-MailboxAuditLog -StartDate 01/06/2020 -EndDate 01/20/2020 -Identity <user> -Operations MailItemsAccessed -ResultSize 10000 -ShowDetails | Where {$_.OperationProperties -like "*IsThrottled:True*"} | FL ``` -2. Check for sync activities. If an attacker uses an email client to downloaded messages in a mailbox, they can disconnect the computer from the Internet and access the messages locally without interacting with the server. This means that mailbox auditing would not be able to audit these activities. +2. Check for sync activities. If an attacker uses an email client to downloaded messages in a mailbox, they can disconnect the computer from the Internet and access the messages locally without interacting with the server. In this case, mailbox auditing would not be able to audit these activities. To search for MailItemsAccessed records where the mail items were accessed by a sync operation, run the following command: Here are the steps for using MailItemsAccessed audit records to investigate a co ||| |ClientInfoString|Describes protocol, client (includes version)| |ClientIPAddress|IP address of the client machine.|- |SessionId|Session ID helps to differentiate attacker actions vs day-to-day user activities on the same account (in the case of a compromised account)| + |SessionId|Session ID helps to differentiate attacker actions vs day-to-day user activities on the same account (useful for compromised accounts)| |UserId|UPN of the user reading the message.| | Here are the steps for using MailItemsAccessed audit records to investigate a co You can use the audit data for bind operations in two different ways: - Access or collect all email messages the attacker accessed by using the InternetMessageId to find them and then checking to see if any of those messages contains sensitive information.- - Use the InternetMessageId to search audit records related to a set of potentially sensitive email messages. This is useful if you're concerned only about a small number of messages. + - Use the InternetMessageId to search audit records related to a set of potentially sensitive email messages. This is useful if you're concerned only about a few messages. ## Filtering of duplicate audit records |
| compliance | Managing Custodian Communications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/managing-custodian-communications.md | Advanced eDiscovery allows legal departments to simplify their processes around ## What is a legal hold notification? -A legal hold (also known as a *litigation hold*) notice is a notification sent from an organizationΓÇÖs legal department to employees, contingent staff, or custodians of data that may be relevant to a legal investigation. These notifications instruct custodians to preserve electronically stored information as well as any content that may be relevant to an active or impending legal matter. Legal teams must know that each custodian has received, read, understood, and has agreed to comply with the given instructions. +A legal hold (also known as a *litigation hold*) notice is a notification sent from an organizationΓÇÖs legal department to employees, contingent staff, or custodians of data that may be relevant to a legal investigation. These notifications instruct custodians to preserve electronically stored information and any content that may be relevant to an active or impending legal matter. Legal teams must know that each custodian has received, read, understood, and has agreed to comply with the given instructions. ## The legal hold notification process An organization has a duty to preserve relevant information when it learns about an impending litigation or regulatory investigation. To comply with the preservation requirements of an investigation, the organization should immediately inform potential custodians about their duty to preserve relevant information. -With Advanced eDiscovery, legal teams can create and customize their legal hold notification workflow. The custodian communications tool lets legal teams to configure the following notices and workflows: +With Advanced eDiscovery, legal teams can create and customize their legal hold notification workflow. The custodian communications tool lets legal teams configure the following notices and workflows: 1. **Issuance notice:** A legal hold notice is issued (or initiated) by a notification from the legal department to custodians who may have relevant information about the case matter. This notice instructs the custodians to preserve any information that may be needed for discovery. -2. **Re-Issuance notice:** During a case, custodians may be required to preserve additional content (or less content) than was previously requested. For this scenario, you can update the existing hold notice and re-issue it to custodians. +2. **Re-Issuance notice:** During a case, custodians may be required to preserve additional content (or less content) than was previously requested. For this scenario, you can update the existing hold notice and reissue it to custodians. -3. **Release notice:** Once a matter is resolved and the custodian is no longer subject to a preservation requirement, the custodian can be released from the case. Additionally, you can notify the custodian that they are no longer required to preserve content, and provide instructions about how to resume their normal work activity with regard to their data. +3. **Release notice:** Once a matter is resolved and the custodian is no longer subject to a preservation requirement, the custodian can be released from the case. Additionally, you can notify the custodian that they are no longer required to preserve content, and provide instructions about how to resume their normal work activity and their data. 4. **Reminders and escalations:** In some instances, just issuing a notice isn't enough to satisfy legal discovery requirements. With each notification, legal teams can schedule a set of reminder and escalation workflows to automatically follow up with unresponsive custodians. - - **Reminders:** After a legal hold notice has been issued or re-issued to a set of custodians, an organization can set up reminders to alert unresponsive custodians. + - **Reminders:** After a legal hold notice has been issued or reissued to a set of custodians, an organization can set up reminders to alert unresponsive custodians. - **Escalations:** In some cases, if a custodian remains unresponsive even after a set of reminders over a period of time, the legal team can set up an escalation workflow to notify unresponsive custodians and their manager. |
| compliance | Retention Policies Yammer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention-policies-yammer.md | For other workloads, see: ## What's included for retention and deletion -Yammer user messages and community messages can be deleted by using retention policies for Yammer, and in addition to the text in the messages, the following items can be retained for compliance reasons: Hypertext links and links to other Yammer messages. +Yammer user messages and community messages can be deleted by using retention policies for Yammer, and in addition to the text in these messages, the following items can be retained for compliance reasons: Hypertext links and links to other Yammer messages. ++> [!NOTE] +> As explained in the following section, user messages include private messages for an individual user, and any community messages associated with that user. User messages include all the names of the people in the conversation, and community messages include the community name and the message title (if supplied). Use this section to understand how your compliance requirements are met by backe You can use a retention policy to retain data from community messages and user messages in Yammer, and delete these messages. Behind the scenes, Exchange mailboxes are used to store data copied from these messages. Data from Yammer user messages is stored in a hidden folder in the mailbox of each user included in the user message, and a similar hidden folder in a group mailbox is used for community messages. -Copies of community messages can also be stored in the hidden folder of user mailboxes when they @ mention users or notify the user of a reply. Although these messages originate as a community message, a retention policy for Yammer user messages will often include copies of community messages. +Copies of community messages can also be stored in the hidden folder of user mailboxes when they @ mention users or notify the user of a reply. Although these messages originate as a community message, a retention policy for Yammer user messages will often include copies of community messages. As a result, user messages are not restricted to private messages. These hidden folders are not designed to be directly accessible to users or administrators, but instead, store data that compliance administrators can search with eDiscovery tools. |
| contentunderstanding | Explanation Types Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/explanation-types-overview.md | You can choose the following options for this setting:  In the viewer, you can manually adjust the select box to include the location where the phase occurs. For this setting, you need to select a **Start** and an **End** position. These values represent the number of tokens from the beginning of the document. While you can manually enter in these values, it's easier to manually adjust the select box in the viewer.+ +## Considerations when configuring explanations +When training a classifier there a few things to keep in mind that will produce more predictable results: ++- The more documents you train with, the more accurate the classifier will be. When possible, use more than 5 good documents and use more than 1 bad document. If the libraries youΓÇÖre working with have several different document types in it, several of each type lead to more predictable results. +- Labeling the document plays an important role in the training process. They are used together with explanations to train the model. You may see some anomalies when training a classifier with documents that donΓÇÖt have a lot of content in them. The explanation may not match anything in the document but since it was labeled as a ΓÇ£goodΓÇ¥ document you may see it be a match during training. +- When creating explanations, it uses OR logic in combination with the label to determine if it is a match. Regular expression that uses AND logic may be more predictable. Here is a sample regular expression to use on real documents as your training them. Note the text highlighted in red is the phrase(s) you would be looking for. ++ <pre>(?=.*network provider)(?=.*participating providers).*</pre> + +- Labels and explanations work together and are used in training the model. ItΓÇÖs not a series of rules that can be de-coupled and precise weights or prediction applied to each variable that has been configured. The greater the variation of documents used in the training will provide more accuracy in the model. ### See also -[Use explanation templates in SharePoint Syntex](explanation-templates.md) +[Use explanation templates in SharePoint Syntex](explanation-templates.md) |
| contentunderstanding | Rest Applymodel Method | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/rest-api/rest-applymodel-method.md | - Title: Batch apply model------ -description: Use REST API to apply a document understanding model to one or more libraries. ---# Batch Apply model --Applies (or syncs) a trained document understanding model to one or more libraries (see [example](rest-applymodel-method.md#examples)). --## HTTP request --```HTTP -POST /_api/machinelearning/publications HTTP/1.1 -``` --## URI parameters --None --## Request headers --| Header | Value | -|--|-| -|Accept|application/json;odata=verbose| -|Content-Type|application/json;odata=verbose;charset=utf-8| -|x-requestdigest|The appropriate digest for current site.| --## Request body --| Name | Required | Type | Description | -|--|-|--|| -|__metadata|yes|string|Set the object meta on the SPO. Always use the value: {"type": "Microsoft.Office.Server.ContentCenter.SPMachineLearningPublicationsEntityData"}.| -|Publications|yes|MachineLearningPublicationEntityData[]|The collection of MachineLearningPublicationEntityData each of which specifies the model and target document library.| --### MachineLearningPublicationEntityData --| Name | Required | Type | Description | -|--|-|--|| -|ModelUniqueId|yes|string|The unique ID of the model file.| -|TargetSiteUrl|yes|string|The full URL of the target library site.| -|TargetWebServerRelativeUrl|yes|string|The server relative URL of the web for the target library.| -|TargetLibraryServerRelativeUrl|yes|string|The server relative URL of the target library.| -|ViewOption|no|string|Specifies whether to set new model view as the library default.| --## Response --| Name | Type | Description| -|--|-|| -|201 Created||This is a customized API to support applying a model to multi document libraries. In the case of partial success, 201 created could still be returned and the caller needs to inspect the response body to understand if the model has been successfully applied to a document library.| --## Response Body --| Name | Type | Description| -|--|-|| -|TotalSuccesses|int|The total number of a model being successfully applied to a document library.| -|TotalFailures|int|The total number of a model failing to be applied to a document library.| -|Details|MachineLearningPublicationResult[]|The collection of MachineLearningPublicationResult each of which specifies the detailed result of applying the model to the document library.| --### MachineLearningPublicationResult --| Name | Type | Description| -|--|-|| -|StatusCode|int|The HTTP status code.| -|ErrorMessage|string|The error message which tells what's wrong when apply the model to the document library.| -|Publication|MachineLearningPublicationEntityData|It specifies the model info and the target document library.| --### MachineLearningPublicationEntityData --| Name | Type | Description | -|--|--|| -|ModelUniqueId|string|The unique ID of the model file.| -|TargetSiteUrl|string|The full URL of the target library site.| -|TargetWebServerRelativeUrl|string|The server relative URL of the web for the target library.| -|TargetLibraryServerRelativeUrl|string|The server relative URL of the target library.| --## Examples --### Apply a model to the contracts document library in the repository site --In this sample, the ID of the Contoso Contract document understanding model is `7645e69d-21fb-4a24-a17a-9bdfa7cb63dc`. --#### Sample request --```HTTP -{ - "__metadata": { - "type": "Microsoft.Office.Server.ContentCenter.SPMachineLearningPublicationsEntityData" - }, - "Publications": { - "results": [ - { - "ModelUniqueId": "7645e69d-21fb-4a24-a17a-9bdfa7cb63dc", - "TargetSiteUrl": "https://contoso.sharepoint.com/sites/repository/", - "TargetWebServerRelativeUrl": "/sites/repository", - "TargetLibraryServerRelativeUrl": "/sites/repository/contracts", - "ViewOption": "NewViewAsDefault" - } - ] - } -} -``` ---#### Sample response --In the response, TotalFailures and TotalSuccesses refers to the number of failures and successes of the model being applies to the specified libraries. --**Status code:** 201 --```JSON -{ - "Details": [ - { - "ErrorMessage": null, - "Publication": { - "ModelUniqueId": "7645e69d-21fb-4a24-a17a-9bdfa7cb63dc", - "TargetSiteUrl": "https://contoso.sharepoint.com/sites/repository/", - "TargetWebServerRelativeUrl": "/sites/repository", - "TargetLibraryServerRelativeUrl": "/sites/repository/contracts", - "ViewOption": "NewViewAsDefault" - }, - "StatusCode": 201 - } - ], - "TotalFailures": 0, - "TotalSuccesses": 1 -} -``` --## See also --[Syntex document understanding model REST API](syntex-model-rest-api.md) |
| contentunderstanding | Rest Batchdelete Method | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/rest-api/rest-batchdelete-method.md | - Title: BatchDelete------ -description: Use REST API to remove an applied document understanding model from one or more libraries. ---# BatchDelete --Removes an applied document understanding model from one or more libraries. Note that a model must be removed from all libraries before it can be deleted (see [example](rest-batchdelete-method.md#examples)). --## HTTP request --```HTTP -POST /_api/machinelearning/publications/batchdelete HTTP/1.1 -``` --## URI parameters --None --## Request headers --| Header | Value | -|--|-| -|Accept|application/json;odata=verbose| -|Content-Type|application/json;odata=verbose;charset=utf-8| -|x-requestdigest|The appropriate digest for current site.| --## Request body --| Name | Required | Type | Description | -|--|-|--|| -|Publications|yes|MachineLearningPublicationEntityData[]|The collection of MachineLearningPublicationEntityData each of which specifies the model and target document library.| --### MachineLearningPublicationEntityData --| Name | Required | Type | Description | -|--|-|--|| -|ModelUniqueId|yes|string|The unique ID of the model file.| -|TargetSiteUrl|yes|string|The full URL of the target library site.| -|TargetWebServerRelativeUrl|yes|string|The server relative URL of the web for the target library.| -|TargetLibraryServerRelativeUrl|yes|string|The server relative URL of the target library.| --## Response --| Name | Type | Description| -|--|-|| -|200 OK||This is a customized API to support removing a model from multi document libraries. In the case of partial success, 200 OK could still be returned and the caller needs to inspect the response body to understand if the model has been successfully removed from a document library.| --## Response Body --| Name | Type | Description| -|--|-|| -|TotalSuccesses|int|The total number of a model being successfully removed from a document library.| -|TotalFailures|int|The total number of a model failing to be removed from a document library.| -|Details|MachineLearningPublicationResult[]|The collection of MachineLearningPublicationResult each of which specifies the detailed result of removing the model from a document library.| --### MachineLearningPublicationResult --| Name | Type | Description| -|--|-|| -|StatusCode|int|The HTTP status code.| -|ErrorMessage|string|The error message which tells what's wrong when apply the model to the document library.| -|Publication|MachineLearningPublicationEntityData|It specifies the model info and the target document library.| --### MachineLearningPublicationEntityData --| Name | Type | Description | -|--|--|| -|ModelUniqueId|string|The unique ID of the model file.| -|TargetSiteUrl|string|The full URL of the target library site.| -|TargetWebServerRelativeUrl|string|The server relative URL of the web for the target library.| -|TargetLibraryServerRelativeUrl|string|The server relative URL of the target library.| --## Examples --### Remove a model from the contracts document library in the repository site --In this sample, the ID of the Contoso Contract document understanding model is `7645e69d-21fb-4a24-a17a-9bdfa7cb63dc`. --#### Sample request --```HTTP -{ - "publications": [ - { - "ModelUniqueId": "7645e69d-21fb-4a24-a17a-9bdfa7cb63dc", - "TargetSiteUrl": "https://constco.sharepoint-df.com/sites/docsite", - "TargetWebServerRelativeUrl": "/sites/docsite ", - "TargetLibraryServerRelativeUrl": "/sites/dcocsite/joedcos" - } - ] -} -``` --#### Sample response --In the response, TotalFailures and TotalSuccesses refer to the number of failures and successes of the model being removed from the specified libraries. --**Status code:** 200 --```JSON -{ - "Details": [ - { - "ErrorMessage": null, - "Publication": { - "ModelUniqueId": "7645e69d-21fb-4a24-a17a-9bdfa7cb63dc", - "TargetSiteUrl": "https://contoso.sharepoint.com/sites/repository/", - "TargetWebServerRelativeUrl": "/sites/repository", - "TargetLibraryServerRelativeUrl": "/sites/repository/contracts", - "ViewOption": "NewViewAsDefault" - }, - "StatusCode": 200 - } - ], - "TotalFailures": 0, - "TotalSuccesses": 1 -} -``` --## See also --[Syntex document understanding model REST API](syntex-model-rest-api.md) |
| contentunderstanding | Rest Createclassificationrequest | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/rest-api/rest-createclassificationrequest.md | - Title: Create file classification request------ -description: Use REST API to create a request to classify one or more files using a trained document understanding model. ---# Create file classification request --Creates a request to classify one or more files using the applied document understanding model. (For more information, see [example](rest-createclassificationrequest.md#examples).) --The REST service of SharePoint Online (and SharePoint 2016 and later on-premises) supports the combining of multiple requests. Requests are combined into a single call to the service by using the OData $batch query option. This method can be used to enqueue classification work items for hundreds of documents at one time. --## HTTP request --```http -POST /_api/machinelearning/workItems HTTP/1.1 -``` --## URI Parameters --None --## Request headers --| Header | Value | -|--|-| -|Accept|application/json;odata=verbose| -|Content-Type|application/json;odata=verbose;charset=utf-8| -|x-requestdigest|The appropriate digest for current site| --## Request body --|Name |Type |Description | -|--|-|| -|_metadata|string |Set the object meta on the SPO. Always use the value: {"type": "Microsoft.Office.Server.ContentCenter.SPMachineLearningWorkItemEntityData"}. | -|TargetSiteId|guid|The ID of the site where the file to classify is located. This can be omitted when TargetSiteUrl has a value. | -|TargetSiteUrl|string|The full URL of the site where the file to classify is located. This can be omitted when TargeSiteId has a value.| -|TargetWebId|guid|The ID of the web where the file to classify is located. This can be omitted when TargetWebServerRelativeUrl has a value. | -|TargetWebServerRelativeUrl|string|The server relative URL of the web where the file to classify is located. This can be omitted when TargetWebId has a value. | -|TargetUniqueId|guid|The ID of the folder to classify. This can be omitted when TargetServerRelativeUrl has a value. | -|TargetServerRelativeUrl|string|The server relative URL of the file to classify is located. This can be omitted when TargetUniqueId has a value.| --## Responses --| Name | Type | Description| -|--|-|| -|201 Created| |The response is customized. In there is failure, it could still return 201 Created. The caller should further check the response body to determine the exact result.| --## Examples --### Enqueue a request to classify a file of ID "e6cff8b7-c90c-4564-b5b8-033449090932" --#### Sample request --```JSON -{ - "__metadata": { - "type": "Microsoft.Office.Server.ContentCenter.SPMachineLearningWorkItemEntityData" - }, - "TargetSiteId": "f686e63b-aba7-48e5-97c7-68c4c1df292f", - "TargetWebId": "66d6b64d-6f88-4dd9-b3db-47e6f00c53e8", - "TargetUniqueId": "e6cff8b7-c90c-4564-b5b8-033449090932" -} -``` --#### Sample response --**Status code:** 201 -```JSON -{ - "ErrorMessage": null, - "StatusCode": 201 -} -``` --```JSON -{ - "ErrorMessage": null, - "StatusCode": 201 -} -``` --## See also --[Syntex document understanding model REST API](syntex-model-rest-api.md) |
| contentunderstanding | Rest Createfolderclassificationrequest | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/rest-api/rest-createfolderclassificationrequest.md | - Title: Create folder classification request------ -description: Use REST API to create a request to classify an entire folder using a trained document understanding model. ---# Create folder classification request --Creates a request to classify a whole folder during off-peak hours by using the applied document understanding model. (For more information, see [example](rest-createfolderclassificationrequest.md#examples).) -This API can be used to classify a whole document library by creating a work item for its root folder. --## HTTP request --```http -POST /_api/machinelearning/workItems HTTP/1.1 -``` --## URI Parameters --None --## Request headers --| Header | Value | -|--|-| -|Accept|application/json;odata=verbose| -|Content-Type|application/json;odata=verbose;charset=utf-8| -|x-requestdigest|The appropriate digest for current site| --## Request body --|Name |Type |Description | -|--|-|| -|_metadata|string |Set the object meta on the SPO. Always use the value: {"type": "Microsoft.Office.Server.ContentCenter.SPMachineLearningWorkItemEntityData"}. | -|TargetSiteId|guid|The ID of the site where the folder to classify is located. This can be omitted when TargetSiteUrl has a value. | -|TargetSiteUrl|string|The full URL of the site where the folder to classify is located. This can be omitted when TargeSiteId has a value.| -|TargetWebId|guid|The ID of the web where the folder to classify is located. This can be omitted when TargetWebServerRelativeUrl has a value. | -|TargetWebServerRelativeUrl|string|The server relative URL of the web where the folder to classify is located. This can be omitted when TargetWebId has a value. | -|TargetUniqueId|guid|The ID of the folder to classify. This can be omitted when TargetServerRelativeUrl has a value. | -|TargetServerRelativeUrl|string|The server relative URL of the folder to classify is located. This can be omitted when TargetUniqueId has a value.| -|IsFolder|boolean|The flag that indicates if what will be classified is a folder. Always set this to true for creating a folder classification work item. | ---## Responses --| Name | Type | Description| -|--|-|| -|201 Created| |The response is customized. If there is failure, it could still return 201 Created. The caller should further check the response body to determine the exact result.| --## Response body --| Name | Type | Description| -|--|-|| -|StatusCode |int |The HTTP status code. If itΓÇÖs not 200 or 201, the API should have failed.| -|ErrorMessage |string |The error message that tells what's wrong when apply the model to the document library.| --## Examples --### Enqueue a request to classify a whole folder of ID "e6cff8b7-c90c-4564-b5b8-033449090932" ---#### Sample request --```JSON -{ - "__metadata": { - "type": "Microsoft.Office.Server.ContentCenter.SPMachineLearningWorkItemEntityData" - }, - "TargetSiteId": "f686e63b-aba7-48e5-97c7-68c4c1df292f", - "TargetWebId": "66d6b64d-6f88-4dd9-b3db-47e6f00c53e8", - "TargetUniqueId": "e6cff8b7-c90c-4564-b5b8-033449090932", - "IsFolder": true -} -``` --#### Sample response --**Status code:** 201 --```JSON -{ - "ErrorMessage": null, - "StatusCode": 201 -} -``` --## See also --[Syntex document understanding model REST API](syntex-model-rest-api.md) |
| contentunderstanding | Rest Createmodel Method | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/rest-api/rest-createmodel-method.md | - Title: Create model------ -description: Use REST API to create a model and its associated content type. ---# Create model --Creates a model and its associated content type. Note that this only creates the model. It will still need to be trained in the content center (see [example](rest-createmodel-method.md#examples)). --## HTTP request --```http -POST /_api/machinelearning/models HTTP/1.1 -``` -## URI Parameters --None --## Request headers --| Header | Value | -|--|-| -|Accept|application/json;odata=verbose| -|Content-Type|application/json;odata=verbose;charset=utf-8| -|x-requestdigest|The appropriate digest for current site| --## Request body --|Name |Type |Description | -|--|-|| -|_metadata| |Set the object meta on the SPO. Always use the value: {"type": "Microsoft.Office.Server.ContentCenter.SPMachineLearningModelEntityData"}. | -|ContentTypeGroup|string|The associated content type group associated with the model. Defaulted to "Intelligent Document Content Types".| -|ContentTypeName|string|The associated content type name. The created model file will have the same name.| --## Responses --| Name | Type | Description| -|--|-|| -|201 Created| |Success| --## Examples --### Create a new document understanding model called "Contoso Contract" --#### Sample request --```json -{ - "__metadata": { - "type": "Microsoft.Office.Server.ContentCenter.SPMachineLearningModelEntityData" - }, - "ContentTypeGroup": "Intelligent Document Content Types", - "ContentTypeName": "Contoso Contract" -} -``` --#### Sample response --**Status code:** 201 --## See also --[Syntex document understanding model REST API](syntex-model-rest-api.md) |
| contentunderstanding | Rest Getbytitle Method | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/rest-api/rest-getbytitle-method.md | - Title: GetByTitle------ -description: Use REST API to get or update information about a SharePoint Syntex document understanding model using the model title. ---# GetByTitle --Gets or updates information about a SharePoint Syntex document understanding model using the model title (see [example](rest-getbytitle-method.md#examples)). --## HTTP request --```HTTP -GET /_api/machinelearning/models/getbytitle('{modelFileName}') HTTP/1.1 -``` --This same method can be used for deleting a model, too. --```HTTP -DELETE /_api/machinelearning/models/getbytitle('{modelFileName}') HTTP/1.1 -``` --## URI parameters --|Name |In |Required|Type|Description| -|--||--|-|--| -|modelFileName|query|True|string|Name of the Syntex model file.| --## Request headers --| Header | Value | -|--|-| -|Accept|application/json;odata=verbose| --## Request body --For GET, no request body is needed. --## Responses --| Name | Type | Description| -|--|-|| -|200 OK| |Success| --## Examples --### Get information about the Contoso Contract model --In this sample, the name of the Syntex document understanding model is `Contoso Contract`. --#### Sample request --```HTTP -GET /_api/machinelearning/models/getbytitle('Contoso Contract') HTTP/1.1 -``` --#### Sample response --**Status code:** 200 --```HTTP -{ - "@odata.context": "https://contoso.sharepoint.com/sites/filerepository/_api/$metadata#models/$entity", - "@odata.type": "#Microsoft.Office.Server.ContentCenter.SPMachineLearningModel", - "@odata.id": "https://contoso.sharepoint.com/sites/filerepository/_api/machinelearning/models/getbyuniqueId('7645e69d-21fb-4a24-a17a-9bdfa7cb63dc')", - "@odata.etag": "\"7645e69d-21fb-4a24-a17a-9bdfa7cb63dc,111\"", - "@odata.editLink": " https://contoso.sharepoint.com/sites/filerepository /_api/machinelearning/models/getbyuniqueId('7645e69d-21fb-4a24-a17a-9bdfa7cb63dc')", - "ConfidenceScore": "{\"trainingStatus\":{\"kind\":\"original\",\"ClassifierStatus\":{\"TrainingStatus\":\"success\",\"TimeStamp\":1611716640535},\"ExtractorsStatus\":[{\"TimeStamp\":1585175746775,\"ExtractorName\":\"Contract Name\",\"TrainingStatus\":\"success\"},{\"TimeStamp\":1586905975794,\"ExtractorName\":\"Client \",\"TrainingStatus\":\"success\"},{\"TimeStamp\":1586906061099,\"ExtractorName\":\"Contract Date\",\"TrainingStatus\":\"success\"},{\"TimeStamp\":1586907912388,\"ExtractorName\":\"Fee\",\"TrainingStatus\":\"success\"},{\"TimeStamp\":1611716640115,\"ExtractorName\":\"ServiceType\",\"TrainingStatus\":\"success\"}]},\"modelAccuracy\":{\"Classifier\":1,\"Extractors\":{\"Contract Name\":1,\"Client \":1,\"Contract Date\":1,\"Fee\":1,\"ServiceType\":1}},\"perSampleAccuracy\":{\"133\":{\"Classifier\":1,\"Extractors\":{\"ServiceType\":1}},\"249\":{\"Classifier\":1,\"Extractors\":{\"ServiceType\":1}},\"252\":{\"Classifier\":1,\"Extractors\":{\"ServiceType\":1}},\"253\":{\"Classifier\":1,\"Extractors\":{\"ServiceType\":1}},\"254\":{\"Classifier\":1,\"Extractors\":{\"ServiceType\":1}},\"255\":{\"Classifier\":1,\"Extractors\":{\"ServiceType\":1}},\"256\":{\"Extractors\":{\"ServiceType\":1}},\"257\":{\"Extractors\":{\"ServiceType\":1}}},\"perSamplePrediction\":{\"133\":{\"Extractors\":{\"ServiceType\":[]}},\"249\":{\"Extractors\":{\"ServiceType\":[\"Writing\"]}},\"252\":{\"Extractors\":{\"ServiceType\":[\"Catering\"]}},\"253\":{\"Extractors\":{\"ServiceType\":[\"Design\"]}},\"254\":{\"Extractors\":{\"ServiceType\":[\"Marketing\"]}},\"255\":{\"Extractors\":{\"ServiceType\":[\"Financial Planning\"]}},\"256\":{\"Extractors\":{\"ServiceType\":[\"Writing\"]}},\"257\":{\"Extractors\":{\"ServiceType\":[\"Writing\"]}}},\"trainingFailures\":{}}", - "ContentTypeGroup": "Intelligent Document Content Types", - "ContentTypeId": "0x01010083DF84D4F59BBD4CB06F075AA81F58AA", - "ContentTypeName": "Contoso Contract", - "Created": "2020-03-25T22:04:04Z", - "CreatedBy": "i:0#.f|membership|meganb@contoso.com", - "DriveId": "b!O-aG9qer5UiXx2jEwd8pL0221maIb9lNs9tH5vAMU-h2NuHxlYUiTJyiwKQHZobK", - "Explanations": "{\"Classifier\":[{\"id\":\"8122ac1d-8fcb-4705-8872-2825cbf05bfe\",\"kind\":\"dictionaryFeature\",\"name\":\"agreement\",\"active\":true,\"nGrams\":[\"CONSULTING AGREEMENT\",\"SERVICES AGREEMENT\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false},{\"id\":\"af83bea8-bc53-4e93-a3da-f1e697eb6bef\",\"kind\":\"modelFeature\",\"name\":\"Contract Name\",\"active\":true,\"modelReference\":\"Contract Name\",\"conceptId\":\"841d0dcf-7f1d-4a39-931c-53923d10c346\"},{\"id\":\"e3734994-9e34-40e3-82c7-bb6c7bc5a0c3\",\"kind\":\"modelFeature\",\"name\":\"Client \",\"active\":true,\"modelReference\":\"Client \",\"conceptId\":\"8b8490d0-9a09-4c16-bcff-59ce62e05c28\"},{\"id\":\"7c93e7fe-cbfb-47ee-8cca-46ecdf5f628f\",\"kind\":\"modelFeature\",\"name\":\"Contract Date\",\"active\":true,\"modelReference\":\"Contract Date\",\"conceptId\":\"6ba58918-e2f0-4685-9080-98ec4c3adc7c\"},{\"id\":\"5cc85b62-148a-4b07-9155-d9fb7cebb6d0\",\"kind\":\"modelFeature\",\"name\":\"Fee\",\"active\":true,\"modelReference\":\"Fee\",\"conceptId\":\"9c7f764d-afd2-49cd-aaa2-e9407156bfb3\"},{\"id\":\"0f8a23a6-c744-4cae-82bd-d836332ceb56\",\"kind\":\"modelFeature\",\"name\":\"ServiceType\",\"active\":true,\"modelReference\":\"ServiceType\",\"conceptId\":\"4aa9f2fe-cfab-49f8-86b1-11646c79cdbf\"}],\"Extractors\":{\"Contract Name\":[{\"id\":\"8804fbeb-bcf8-44c0-8ade-3fc65496037f\",\"kind\":\"dictionaryFeature\",\"name\":\"before\",\"active\":true,\"nGrams\":[\"- AND -\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false}],\"Client \":[{\"id\":\"606c56de-9e71-42ef-8ec6-f0bbf351d673\",\"kind\":\"dictionaryFeature\",\"name\":\"start\",\"active\":true,\"nGrams\":[\"BETWEEN:\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false},{\"id\":\"334e6df5-e076-40db-a47b-f11ceec7af9a\",\"kind\":\"dictionaryFeature\",\"name\":\"after\",\"active\":true,\"nGrams\":[\"of\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false},{\"id\":\"bccefd2e-88a4-406c-aa9d-81d508bbafb3\",\"kind\":\"proximityFeature\",\"name\":\"prox\",\"active\":true,\"patterns\":[[{\"id\":\"606c56de-9e71-42ef-8ec6-f0bbf351d673\",\"kind\":\"proximityFeatureReference\"},{\"kind\":\"proximityTokenRange\",\"minCount\":1,\"maxCount\":6},{\"id\":\"334e6df5-e076-40db-a47b-f11ceec7af9a\",\"kind\":\"proximityFeatureReference\"}]]}],\"Contract Date\":[{\"id\":\"fabe1ed3-07af-4dc6-852d-fe9521c64801\",\"kind\":\"dictionaryFeature\",\"name\":\"dated\",\"active\":true,\"nGrams\":[\"dated\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false},{\"id\":\"983da7b8-51d7-4a85-9644-007b488fce0b\",\"kind\":\"dictionaryFeature\",\"name\":\"betw\",\"active\":true,\"nGrams\":[\"between\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false}],\"Fee\":[{\"id\":\"f4cf89dc-64d1-49a1-9be4-41debda251b6\",\"kind\":\"dictionaryFeature\",\"name\":\"flat fee of \",\"active\":true,\"nGrams\":[\"flat fee of $\",\"flat fee of $$\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false}],\"ServiceType\":[{\"id\":\"c04408f5-ce14-4eb0-81d0-f72ea9fa7e83\",\"kind\":\"dictionaryFeature\",\"name\":\"Before label\",\"active\":true,\"nGrams\":[\"will provide \"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false},{\"id\":\"ea94fa7f-e41b-4e09-a484-355912bfbdff\",\"kind\":\"dictionaryFeature\",\"name\":\"After label\",\"active\":true,\"nGrams\":[\"services for \"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false}]}}", - "ID": 16, - "LastTrained": "2021-01-27T03:04:00Z", - "ListID": "f1e13676-8595-4c22-9ca2-c0a4076686ca", - "ModelSettings": null, - "ModelType": 2, - "Modified": "2021-01-27T03:05:04Z", - "ModifiedBy": "i:0#.f|membership|kevinche@contoso.com", - "ObjectId": "01ZBWEM5E54ZCXN6ZBERFKC6U336T4WY64", - "PublicationType": 0, - "Schemas": "{\"Extractors\":{\"Contract Name\":{\"concepts\":{\"841d0dcf-7f1d-4a39-931c-53923d10c346\":{\"name\":\"Contract Name\"}},\"relationships\":[]},\"Client \":{\"concepts\":{\"8b8490d0-9a09-4c16-bcff-59ce62e05c28\":{\"name\":\"Client \"}},\"relationships\":[]},\"Contract Date\":{\"concepts\":{\"6ba58918-e2f0-4685-9080-98ec4c3adc7c\":{\"name\":\"Contract Date\"}},\"relationships\":[]},\"Fee\":{\"concepts\":{\"9c7f764d-afd2-49cd-aaa2-e9407156bfb3\":{\"name\":\"Fee\"}},\"relationships\":[]},\"ServiceType\":{\"concepts\":{\"4aa9f2fe-cfab-49f8-86b1-11646c79cdbf\":{\"name\":\"ServiceType\",\"termSetId\":\"76c12efb-5173-4982-ae9b-5f9e37187171\"}},\"relationships\":[]}}}", - "SourceUrl": null, - "UniqueId": "7645e69d-21fb-4a24-a17a-9bdfa7cb63dc" -} -``` --### Get and delete the Contoso Contract model by name --In this sample, the name of the Contoso Contract document understanding model is `Contoso Contract`. --##### Sample request --```HTTP -DELETE /_api/machinelearning/models/getbytitle('Contoso Contract') HTTP/1.1 -``` --## See also --[Syntex document understanding model REST API](syntex-model-rest-api.md) |
| contentunderstanding | Rest Getbyuniqueid Method | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/rest-api/rest-getbyuniqueid-method.md | - Title: GetByUniqueId------ -description: Use REST API to get or update information about a SharePoint Syntex document understanding model. ---# GetByUniqueId --Gets or updates information about a SharePoint Syntex document understanding model (see [example](rest-getbyuniqueid-method.md#examples)). --## HTTP request --```HTTP -GET /_api/machinelearning/models/getbyuniqueid('{modelUniqueId}') HTTP/1.1 -``` --This same method can be used for deleting a model, too. --```HTTP -DELETE /_api/machinelearning/models/getbyuniqueid('{modelUniqueId}') HTTP/1.1 -``` -## URI parameters --|Name |In |Required|Type|Description| -|--||--|-|--| -|modelUniqueId|query|True|string|ID of the Syntex model file.| --## Request headers --| Header | Value | -|--|-| -|Accept|application/json;odata=verbose| --## Request body --For GET, no request body is needed. --## Responses --| Name | Type | Description| -|--|-|| -|200 OK| |Success| --## Examples --### Get the Contoso Contract model by ID --In this sample, the ID of the Contoso Contract document understanding model is `7645e69d-21fb-4a24-a17a-9bdfa7cb63dc`. --#### Sample request --```HTTP -GET /_api/machinelearning/models/getbyuniqueid('7645e69d-21fb-4a24-a17a-9bdfa7cb63dc') HTTP/1.1 -``` --#### Sample response --**Status code:** 200 --```HTTP -{ - "@odata.context": "https://contoso.sharepoint.com/sites/filerepository/_api/$metadata#models/$entity", - "@odata.type": "#Microsoft.Office.Server.ContentCenter.SPMachineLearningModel", - "@odata.id": "https://contoso.sharepoint.com/sites/filerepository/_api/machinelearning/models/getbyuniqueId('7645e69d-21fb-4a24-a17a-9bdfa7cb63dc')", - "@odata.etag": "\"7645e69d-21fb-4a24-a17a-9bdfa7cb63dc,111\"", - "@odata.editLink": " https://contoso.sharepoint.com/sites/filerepository /_api/machinelearning/models/getbyuniqueId('7645e69d-21fb-4a24-a17a-9bdfa7cb63dc')", - "ConfidenceScore": "{\"trainingStatus\":{\"kind\":\"original\",\"ClassifierStatus\":{\"TrainingStatus\":\"success\",\"TimeStamp\":1611716640535},\"ExtractorsStatus\":[{\"TimeStamp\":1585175746775,\"ExtractorName\":\"Contract Name\",\"TrainingStatus\":\"success\"},{\"TimeStamp\":1586905975794,\"ExtractorName\":\"Client \",\"TrainingStatus\":\"success\"},{\"TimeStamp\":1586906061099,\"ExtractorName\":\"Contract Date\",\"TrainingStatus\":\"success\"},{\"TimeStamp\":1586907912388,\"ExtractorName\":\"Fee\",\"TrainingStatus\":\"success\"},{\"TimeStamp\":1611716640115,\"ExtractorName\":\"ServiceType\",\"TrainingStatus\":\"success\"}]},\"modelAccuracy\":{\"Classifier\":1,\"Extractors\":{\"Contract Name\":1,\"Client \":1,\"Contract Date\":1,\"Fee\":1,\"ServiceType\":1}},\"perSampleAccuracy\":{\"133\":{\"Classifier\":1,\"Extractors\":{\"ServiceType\":1}},\"249\":{\"Classifier\":1,\"Extractors\":{\"ServiceType\":1}},\"252\":{\"Classifier\":1,\"Extractors\":{\"ServiceType\":1}},\"253\":{\"Classifier\":1,\"Extractors\":{\"ServiceType\":1}},\"254\":{\"Classifier\":1,\"Extractors\":{\"ServiceType\":1}},\"255\":{\"Classifier\":1,\"Extractors\":{\"ServiceType\":1}},\"256\":{\"Extractors\":{\"ServiceType\":1}},\"257\":{\"Extractors\":{\"ServiceType\":1}}},\"perSamplePrediction\":{\"133\":{\"Extractors\":{\"ServiceType\":[]}},\"249\":{\"Extractors\":{\"ServiceType\":[\"Writing\"]}},\"252\":{\"Extractors\":{\"ServiceType\":[\"Catering\"]}},\"253\":{\"Extractors\":{\"ServiceType\":[\"Design\"]}},\"254\":{\"Extractors\":{\"ServiceType\":[\"Marketing\"]}},\"255\":{\"Extractors\":{\"ServiceType\":[\"Financial Planning\"]}},\"256\":{\"Extractors\":{\"ServiceType\":[\"Writing\"]}},\"257\":{\"Extractors\":{\"ServiceType\":[\"Writing\"]}}},\"trainingFailures\":{}}", - "ContentTypeGroup": "Intelligent Document Content Types", - "ContentTypeId": "0x01010083DF84D4F59BBD4CB06F075AA81F58AA", - "ContentTypeName": "Contoso Contract", - "Created": "2020-03-25T22:04:04Z", - "CreatedBy": "i:0#.f|membership|meganb@contoso.com", - "DriveId": "b!O-aG9qer5UiXx2jEwd8pL0221maIb9lNs9tH5vAMU-h2NuHxlYUiTJyiwKQHZobK", - "Explanations": "{\"Classifier\":[{\"id\":\"8122ac1d-8fcb-4705-8872-2825cbf05bfe\",\"kind\":\"dictionaryFeature\",\"name\":\"agreement\",\"active\":true,\"nGrams\":[\"CONSULTING AGREEMENT\",\"SERVICES AGREEMENT\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false},{\"id\":\"af83bea8-bc53-4e93-a3da-f1e697eb6bef\",\"kind\":\"modelFeature\",\"name\":\"Contract Name\",\"active\":true,\"modelReference\":\"Contract Name\",\"conceptId\":\"841d0dcf-7f1d-4a39-931c-53923d10c346\"},{\"id\":\"e3734994-9e34-40e3-82c7-bb6c7bc5a0c3\",\"kind\":\"modelFeature\",\"name\":\"Client \",\"active\":true,\"modelReference\":\"Client \",\"conceptId\":\"8b8490d0-9a09-4c16-bcff-59ce62e05c28\"},{\"id\":\"7c93e7fe-cbfb-47ee-8cca-46ecdf5f628f\",\"kind\":\"modelFeature\",\"name\":\"Contract Date\",\"active\":true,\"modelReference\":\"Contract Date\",\"conceptId\":\"6ba58918-e2f0-4685-9080-98ec4c3adc7c\"},{\"id\":\"5cc85b62-148a-4b07-9155-d9fb7cebb6d0\",\"kind\":\"modelFeature\",\"name\":\"Fee\",\"active\":true,\"modelReference\":\"Fee\",\"conceptId\":\"9c7f764d-afd2-49cd-aaa2-e9407156bfb3\"},{\"id\":\"0f8a23a6-c744-4cae-82bd-d836332ceb56\",\"kind\":\"modelFeature\",\"name\":\"ServiceType\",\"active\":true,\"modelReference\":\"ServiceType\",\"conceptId\":\"4aa9f2fe-cfab-49f8-86b1-11646c79cdbf\"}],\"Extractors\":{\"Contract Name\":[{\"id\":\"8804fbeb-bcf8-44c0-8ade-3fc65496037f\",\"kind\":\"dictionaryFeature\",\"name\":\"before\",\"active\":true,\"nGrams\":[\"- AND -\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false}],\"Client \":[{\"id\":\"606c56de-9e71-42ef-8ec6-f0bbf351d673\",\"kind\":\"dictionaryFeature\",\"name\":\"start\",\"active\":true,\"nGrams\":[\"BETWEEN:\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false},{\"id\":\"334e6df5-e076-40db-a47b-f11ceec7af9a\",\"kind\":\"dictionaryFeature\",\"name\":\"after\",\"active\":true,\"nGrams\":[\"of\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false},{\"id\":\"bccefd2e-88a4-406c-aa9d-81d508bbafb3\",\"kind\":\"proximityFeature\",\"name\":\"prox\",\"active\":true,\"patterns\":[[{\"id\":\"606c56de-9e71-42ef-8ec6-f0bbf351d673\",\"kind\":\"proximityFeatureReference\"},{\"kind\":\"proximityTokenRange\",\"minCount\":1,\"maxCount\":6},{\"id\":\"334e6df5-e076-40db-a47b-f11ceec7af9a\",\"kind\":\"proximityFeatureReference\"}]]}],\"Contract Date\":[{\"id\":\"fabe1ed3-07af-4dc6-852d-fe9521c64801\",\"kind\":\"dictionaryFeature\",\"name\":\"dated\",\"active\":true,\"nGrams\":[\"dated\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false},{\"id\":\"983da7b8-51d7-4a85-9644-007b488fce0b\",\"kind\":\"dictionaryFeature\",\"name\":\"betw\",\"active\":true,\"nGrams\":[\"between\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false}],\"Fee\":[{\"id\":\"f4cf89dc-64d1-49a1-9be4-41debda251b6\",\"kind\":\"dictionaryFeature\",\"name\":\"flat fee of \",\"active\":true,\"nGrams\":[\"flat fee of $\",\"flat fee of $$\"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false}],\"ServiceType\":[{\"id\":\"c04408f5-ce14-4eb0-81d0-f72ea9fa7e83\",\"kind\":\"dictionaryFeature\",\"name\":\"Before label\",\"active\":true,\"nGrams\":[\"will provide \"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false},{\"id\":\"ea94fa7f-e41b-4e09-a484-355912bfbdff\",\"kind\":\"dictionaryFeature\",\"name\":\"After label\",\"active\":true,\"nGrams\":[\"services for \"],\"caseSensitive\":false,\"ignoreDigitIdentity\":false,\"ignoreLetterIdentity\":false}]}}", - "ID": 16, - "LastTrained": "2021-01-27T03:04:00Z", - "ListID": "f1e13676-8595-4c22-9ca2-c0a4076686ca", - "ModelSettings": null, - "ModelType": 2, - "Modified": "2021-01-27T03:05:04Z", - "ModifiedBy": "i:0#.f|membership|kevinche@contoso.com", - "ObjectId": "01ZBWEM5E54ZCXN6ZBERFKC6U336T4WY64", - "PublicationType": 0, - "Schemas": "{\"Extractors\":{\"Contract Name\":{\"concepts\":{\"841d0dcf-7f1d-4a39-931c-53923d10c346\":{\"name\":\"Contract Name\"}},\"relationships\":[]},\"Client \":{\"concepts\":{\"8b8490d0-9a09-4c16-bcff-59ce62e05c28\":{\"name\":\"Client \"}},\"relationships\":[]},\"Contract Date\":{\"concepts\":{\"6ba58918-e2f0-4685-9080-98ec4c3adc7c\":{\"name\":\"Contract Date\"}},\"relationships\":[]},\"Fee\":{\"concepts\":{\"9c7f764d-afd2-49cd-aaa2-e9407156bfb3\":{\"name\":\"Fee\"}},\"relationships\":[]},\"ServiceType\":{\"concepts\":{\"4aa9f2fe-cfab-49f8-86b1-11646c79cdbf\":{\"name\":\"ServiceType\",\"termSetId\":\"76c12efb-5173-4982-ae9b-5f9e37187171\"}},\"relationships\":[]}}}", - "SourceUrl": null, - "UniqueId": "7645e69d-21fb-4a24-a17a-9bdfa7cb63dc" -} -``` --### Get and delete the Contoso Contract model by ID --In this sample, the ID of the Contoso Contract document understanding model is `7645e69d-21fb-4a24-a17a-9bdfa7cb63dc`. --#### Sample request --```HTTP -DELETE /_api/machinelearning/models/getbyuniqueid('7645e69d-21fb-4a24-a17a-9bdfa7cb63dc') HTTP/1.1 -``` --## See also --[Syntex document understanding model REST API](syntex-model-rest-api.md) |
| contentunderstanding | Rest Getmodelandlibraryinfo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/rest-api/rest-getmodelandlibraryinfo.md | - Title: Get model and library info------ -description: Use REST API to get information about a model and the library where it has been applied. ---# Get model and library information --Gets information about a model and the library where it has been applied (see [example](rest-getmodelandlibraryinfo.md#examples)). --## HTTP request --```HTTP -GET /_api/machinelearning/publications/getbymodeluniqueid('{modelUniqueId}') HTTP/1.1 -``` --## URI parameters --| Name | In | Required | Type | Description | -|--|-|--||--| -|ModelUniqueId|query|True|GUID|The unique id of the model file.| --## Request headers --| Header | Value | -|--|-| -|Accept|application/json;odata=verbose| ---## Response --| Name | Type | Description| -|--|-|| -|200 OK| |Success| --## Examples --### Get information about the contracts model and primed document library in the repository site --In this sample, the ID of the Contoso Contract document understanding model is `7645e69d-21fb-4a24-a17a-9bdfa7cb63dc`. --#### Sample request --```HTTP -GET /sites/TestCC/_api/machinelearning/publications/getbymodeluniqueid('7645e69d-21fb-4a24-a17a-9bdfa7cb63dc') HTTP/1.1 -``` --#### Sample response --**Status code:** 200 --```JSON -{ - "@odata.context": "https://contoso.sharepoint.com/sites/TestCC/_api/$metadata#publications", - "value": [ - { - "@odata.type": "#Microsoft.Office.Server.ContentCenter.SPMachineLearningPublication", - "@odata.id": "https://contoso.sharepoint.com/sites/repository /_api/machinelearning/publications/getbyuniqueId('7645e69d-21fb-4a24-a17a-9bdfa7cb63dc')", - "@odata.etag": "\"7645e69d-21fb-4a24-a17a-9bdfa7cb63dc,94\"", - "@odata.editLink": " https://contoso.sharepoint.com/sites/TestCC /_api/machinelearning/publications/getbyuniqueId('7645e69d-21fb-4a24-a17a-9bdfa7cb63dc')", - "Created": "2021-04-27T03:05:25Z", - "CreatedBy": "i:0#.f|membership|meganb@contoso.com", - "DriveId": "b!O-aG9qer5UiXx2jEwd8pL0221maIb9lNs9tH5vAMU-gPy9BrxT7GTrtXtdtv1Uzb", - "ID": 26, - "ModelId": 16, - "ModelName": "contosocontract.classifier", - "ModelType": 0, - "ModelUniqueId": "7645e69d-21fb-4a24-a17a-9bdfa7cb63dc", - "ModelVersion": "8.0", - "Modified": "2021-03-17T17:56:42Z", - "ModifiedBy": "i:0#.f|membership|joedoe@contoso.com", - "ObjectId": "01ZBWEM5FZRILGLXTEB5CZ2NNNSCTWBJMQ", - "PublicationType": 1, - "TargetLibraryRemoved": false, - "TargetLibraryServerRelativeUrl": "/sites/repository/contracts", - "TargetLibraryUrl": " https://contoso.sharepoint.com/sites/repository/contracts", - "TargetSiteUrl": "https://contoso.sharepoint.com/sites/repository", - "TargetWebServerRelativeUrl": "/sites/repository", - "UniqueId": "7645e69d-21fb-4a24-a17a-9bdfa7cb63dc", - "ViewOption": "NewViewAsDefault" - }, - { - "@odata.type": "#Microsoft.Office.Server.ContentCenter.SPMachineLearningPublication", - "@odata.id": "https://contoso.sharepoint.com /sites/legal/_api/machinelearning/publications/getbyuniqueId('7645e69d-21fb-4a24-a17a-9bdfa7cb63dc')", - "@odata.etag": "\"7645e69d-21fb-4a24-a17a-9bdfa7cb63dc,101\"", - "@odata.editLink": "https://contoso.sharepoint.com /sites/legal/_api/machinelearning/publications/getbyuniqueId('7645e69d-21fb-4a24-a17a-9bdfa7cb63dc')", - "Created": "2021-01-27T03:17:44Z", - "CreatedBy": "i:0#.f|membership|esherman@contoso.com ", - "DriveId": "b!O-aG9qer5UiXx2jEwd8pL0221maIb9lNs9tH5vAMU-gPy9BrxT7GTrtXtdtv1Uzb", - "ID": 27, - "ModelId": 16, - "ModelName": "dispositions.classifier", - "ModelType": 0, - "ModelUniqueId": "7645e69d-21fb-4a24-a17a-9bdfa7cb63dc", - "ModelVersion": "8.0", - "Modified": "2021-03-17T23:17:46Z", - "ModifiedBy": "i:0#.f|membership|esherman@contoso.com ", - "ObjectId": "01ZBWEM5B3ERSZK4PAARGLFZ7JP6GMXG2R", - "PublicationType": 1, - "TargetLibraryRemoved": false, - "TargetLibraryServerRelativeUrl": "/sites/legal/dispositions", - "TargetLibraryUrl": "https://contoso.sharepoint.com/sites/legal/dispositions", - "TargetSiteUrl": " https://contoso.sharepoint.com/sites/legal", - "TargetWebServerRelativeUrl": "/sites/legal", - "UniqueId": "7645e69d-21fb-4a24-a17a-9bdfa7cb63dc", - "ViewOption": "NewViewAsDefault" - } - ] -} -``` --## See also --[Syntex document understanding model REST API](syntex-model-rest-api.md) |
| contentunderstanding | Rest Updatemodelsettings Method | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/rest-api/rest-updatemodelsettings-method.md | - Title: UpdateModelSettings------ -description: Use REST API to update available models settings for a SharePoint Syntex document understanding model. ---# UpdateModelSettings --Updates available models settings (associated retention label and model description) for a SharePoint Syntex document understanding model (see [example](rest-updatemodelsettings-method.md#examples)). --## HTTP request --```HTTP -POST /_api/machinelearning/models/getbytitle('{modelFileName}')/updatemodelsettings HTTP/1.1 -``` --## URI parameters --|Name |In |Required|Type|Description| -|--||--|-|--| -|modelFileName|query|True|string|Name of the Syntex model file.| --## Request headers --| Header | Value | -|--|-| -|Accept|application/json;odata=verbose| -|Content-Type|application/json;odata=verbose;charset=utf-8| -|x-requestdigest|The appropriate digest for the current site.| --## Request body --|Name |Type |Description | -|--|-|-| -|ModelSettings|string|JSON of model settings.| -|Description|string|The model description.| -|RetentionLabel| |Info for the associated label (label ID and name).| --## Responses --| Name | Type | Description| -|--|-|| -|200 OK| |Success| --## Examples --### Update model settings for Contoso Contract --In this example, the model description and "Standard Hold" retention label are updated. The ID of the retention label is `27c5fcba-abfd-4c34-823d-0b4a48f7ffe6`. --#### Sample request --```HTTP -{ - "ModelSettings": "{\"Description\":\"This model is used to set files classified as Contoso Contracts with a standard hold retention.\", \"RetentionLabel\":{\"Id\":\"27c5fcba-abfd-4c34-823d-0b4a48f7ffe6\",\"Name\":\"Standard Hold\"}}" -} --``` --#### Sample response --**Status code:** 200 --## See also --[Syntex document understanding model REST API](syntex-model-rest-api.md) |
| contentunderstanding | Syntex Model Rest Api | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/rest-api/syntex-model-rest-api.md | - Title: SharePoint Syntex document understanding model REST API------ -description: Overview of the SharePoint Syntex document understanding model REST API. ---# SharePoint Syntex document understanding model REST API --You can use the SharePoint REST interface to create a document understanding model, apply or remove the model to one or more libraries, and obtain or update information about the model. --The SharePoint Online (and SharePoint 2016 and later on-premises) REST service supports combining multiple requests into a single call to the service by using the OData $batch query option. --For details and links to code samples, see [Make batch requests with the REST APIs](/sharepoint/dev/sp-add-ins/make-batch-requests-with-the-rest-apis). --## Prerequisites --Before you get started, make sure that you're familiar with the following: --- [Get to know the SharePoint REST service](/sharepoint/dev/sp-add-ins/get-to-know-the-sharepoint-rest-service) -- [Complete basic operations using SharePoint REST endpoints](/sharepoint/dev/sp-add-ins/complete-basic-operations-using-sharepoint-rest-endpoints)--## REST commands --The following REST commands are available for working with Syntex document understanding models: --- [Create model](rest-createmodel-method.md) ΓÇô Creates a model and its associated content type.-- [GetByUniqueId](rest-getbyuniqueid-method.md) ΓÇô Gets or updates information about a SharePoint Syntex document understanding model.-- [GetByTitle](rest-getbytitle-method.md) ΓÇô Gets or updates information about a SharePoint Syntex document understanding model using the model title.-- [Apply model](rest-applymodel-method.md) ΓÇô Applies (or syncs) a trained document understanding model to one or more libraries.-- [Get model and library information](rest-getmodelandlibraryinfo.md) ΓÇô Gets information about a model and the library where it has been applied.-- [UpdateModelSettings](rest-updatemodelsettings-method.md) ΓÇô Updates available models settings (associated retention label and model description) for a SharePoint Syntex document understanding model.-- [BatchDelete](rest-batchdelete-method.md) ΓÇô Removes an applied document understanding model from one or more libraries.-- [Create file classification request](rest-createclassificationrequest.md) ΓÇô Creates a request to classify a specified file or files using the applied model.-- [Create folder classification request](rest-createclassificationrequest.md) ΓÇô Creates a request to classify an entire folder using the applied model.--## Scenarios --Note the following scenario examples that aren't intuitive from the method name. For more information, see each article. --The create model method only creates the model object and its associated content type. You'll need to first train the model in the content center before it can be applied to a library. --The apply model method is used to configure the model on the target library to classify documents and optionally extract additional information. This API also supports batch applying the model to multiple libraries. --The remove model method just removes the model from one or more libraries where it was previously applied. If you want to delete the model, it must first be removed from all the libraries where it was applied. ---## See also --[Document understanding overview](../document-understanding-overview.md) - |
| security | Mdb Get Help | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-get-help.md | If you need help with Microsoft Defender for Business (preview), select the Help If you don't see the answer to your question, you can open a support ticket. +> +> **Got a minute?** +> Please take our <a href="https://microsoft.qualtrics.com/jfe/form/SV_0JPjTPHGEWTQr4y" target="_blank">short survey about Microsoft Defender for Business</a>. We'd love to hear from you! +> + ## See also - [Microsoft Defender for Business (preview) - Frequently asked questions and answers](mdb-faq.yml) |
| security | Mdb Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-get-started.md | +> +> **Got a minute?** +> Please take our <a href="https://microsoft.qualtrics.com/jfe/form/SV_0JPjTPHGEWTQr4y" target="_blank">short survey about Microsoft Defender for Business</a>. We'd love to hear from you! +> + ## Navigate the Microsoft 365 Defender portal The Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) is your one-stop shop for using and managing Microsoft Defender for Business (preview). It includes a welcome banner and callouts to help you get started, cards that surface relevant information, and a navigation bar to give you easy access to the various features and capabilities. |
| security | Mdb Manage Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-manage-devices.md | In Microsoft Defender for Business (preview), you can manage devices as follows: - [Onboard a device to Defender for Business (preview)](#onboard-a-device) - [Offboard a device from Defender for Business (preview)](#offboard-a-device) +> +> **Got a minute?** +> Please take our <a href="https://microsoft.qualtrics.com/jfe/form/SV_0JPjTPHGEWTQr4y" target="_blank">short survey about Microsoft Defender for Business</a>. We'd love to hear from you! +> + ## View the list of onboarded devices :::image type="content" source="../../medib-deviceinventory.png" alt-text="Screenshot of device inventory"::: |
| security | Mdb Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-overview.md | With Defender for Business (preview), you can help protect the devices and data ## Next steps +> +> **Got a minute?** +> Please take our <a href="https://microsoft.qualtrics.com/jfe/form/SV_0JPjTPHGEWTQr4y" target="_blank">short survey about Microsoft Defender for Business</a>. We'd love to hear from you! +> + - [Learn more about the simplified configuration process in Microsoft Defender for Business (preview)](mdb-simplified-configuration.md) -- [Find out how to get Microsoft Defender for Business (preview)](get-defender-business.md)+- [Find out how to get Microsoft Defender for Business (preview)](get-defender-business.md) |
| security | Mdb Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-reports.md | +Several reports are availble in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). This article describes these reports, how you can use them, and how to find them. ++> +> **Got a minute?** +> Please take our <a href="https://microsoft.qualtrics.com/jfe/form/SV_0JPjTPHGEWTQr4y" target="_blank">short survey about Microsoft Defender for Business</a>. We'd love to hear from you! +> ++<br/><br/> ++## Reports in Defender for Business |Report |Description | ||| |
| security | Mdb Respond Mitigate Threats | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-respond-mitigate-threats.md | -The Microsoft 365 Defender portal enables your security team to respond to and mitigate detected threats. +The Microsoft 365 Defender portal enables your security team to respond to and mitigate detected threats. This article walks you through an example of how you can use Defender for Business (preview). ++> +> **Got a minute?** +> Please take our <a href="https://microsoft.qualtrics.com/jfe/form/SV_0JPjTPHGEWTQr4y" target="_blank">short survey about Microsoft Defender for Business</a>. We'd love to hear from you! +> ++## View detected threats 1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in. |
| security | Mdb Review Remediation Actions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-review-remediation-actions.md | As threats are detected, remediation actions come into play. Depending on the pa - [How to use the Action center](#how-to-use-the-action-center) - [Remediation actions](#remediation-actions) +> +> **Got a minute?** +> Please take our <a href="https://microsoft.qualtrics.com/jfe/form/SV_0JPjTPHGEWTQr4y" target="_blank">short survey about Microsoft Defender for Business</a>. We'd love to hear from you! +> + ## How to use the Action center 1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), and sign in. |
| security | Mdb Roles Permissions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-roles-permissions.md | To perform tasks in the Microsoft 365 Defender portal, such as configuring Micro 3. [Proceed to your next steps](#next-steps). +> +> **Got a minute?** +> Please take our <a href="https://microsoft.qualtrics.com/jfe/form/SV_0JPjTPHGEWTQr4y" target="_blank">short survey about Microsoft Defender for Business</a>. We'd love to hear from you! +> ++ ## Roles in Defender for Business The following table describes the three roles that can be assigned in Defender for Business (preview). [Learn more about admin roles](../../admin/add-users/about-admin-roles.md). <br/><br/> |
| security | Mdb Setup Configuration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-setup-configuration.md | +> +> **Got a minute?** +> Please take our <a href="https://microsoft.qualtrics.com/jfe/form/SV_0JPjTPHGEWTQr4y" target="_blank">short survey about Microsoft Defender for Business</a>. We'd love to hear from you! +> + ## The setup and configuration process :::image type="content" source="media/mdb-setup-process-2.png" alt-text="Setup and configuration process for Microsoft Defender for Business (preview)."::: |
| security | Mdb Simplified Configuration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-simplified-configuration.md | Defender for Business (preview) is designed to provide strong protection while s ## Next steps +> +> **Got a minute?** +> Please take our <a href="https://microsoft.qualtrics.com/jfe/form/SV_0JPjTPHGEWTQr4y" target="_blank">short survey about Microsoft Defender for Business</a>. We'd love to hear from you! +> + - [Set up and configure Microsoft Defender for Business (preview)](mdb-setup-configuration.md) - [Get started using Microsoft Defender for Business (preview)](mdb-get-started.md) |
| security | Mdb Tutorials | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-tutorials.md | +> +> **Got a minute?** +> Please take our <a href="https://microsoft.qualtrics.com/jfe/form/SV_0JPjTPHGEWTQr4y" target="_blank">short survey about Microsoft Defender for Business</a>. We'd love to hear from you! +> + ## Try these preview scenarios The following table summarizes several scenarios to try during the preview of Defender for Business (preview). |
| security | Mdb View Edit Create Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-view-edit-create-policies.md | In Microsoft Defender for Business (preview), security settings are configured t - [Edit an existing policy](#edit-an-existing-policy) - [Create a new policy](#create-a-new-policy) +> +> **Got a minute?** +> Please take our <a href="https://microsoft.qualtrics.com/jfe/form/SV_0JPjTPHGEWTQr4y" target="_blank">short survey about Microsoft Defender for Business</a>. We'd love to hear from you! +> + ## View your existing policies 1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), and sign in. |
| security | Mdb View Manage Incidents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-view-manage-incidents.md | As threats are detected and alerts are triggered, incidents are created. Your co - [Alert severity](#alert-severity) - [Next steps](#next-steps) +> +> **Got a minute?** +> Please take our <a href="https://microsoft.qualtrics.com/jfe/form/SV_0JPjTPHGEWTQr4y" target="_blank">short survey about Microsoft Defender for Business</a>. We'd love to hear from you! +> + ## Monitor your incidents & alerts 1. In the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), in the navigation pane, select **Incidents**. Any incidents that were created are listed on the page. |
| security | Configure Endpoints Gp | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-gp.md | audience: ITPro Previously updated : 09/16/2021 Last updated : 12/07/2021 ms.technology: mde Get the current list of attack surface reduction GUIDs from [Attack surface redu  -Policy|Setting -| -Configure Controlled folder access| Enabled, Audit Mode +Policy|Location|Setting +|| +Configure Controlled folder access| \Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Controlled Folder Access| Enabled, Audit Mode ## Run a detection test to verify onboarding Create a new Group Policy or group these settings in with the other policies. Th Browse to **Computer Configuration** \> **Policies** \> **Administrative Templates** \> **Windows Components** \> **Microsoft Defender Antivirus** \> **Real-time Protection**. + Since the value for "Scan incoming and outgoing files" (default) is 0, the group policy for the "Configure monitoring for incoming and outgoing file and program activity" for "bi-directional (full on-access)" setting changes to disabled. + :::image type="content" source="images/config-monitor-incoming-outgoing-file-act.png" alt-text="configure monitoring for incoming outgoing file activity."::: ### Configure Windows Defender SmartScreen settings Browse to **Computer Configuration** \> **Policies** \> **Administrative Templat ### Check for signature update -Browse to **Computer Configuration** \> **Policies** \> **Administrative Templates** \> **Windows Components** \> **Microsoft Defender Antivirus** \> **Signature Updates** +Browse to **Computer Configuration** \> **Policies** \> **Administrative Templates** \> **Windows Components** \> **Microsoft Defender Antivirus** \> **Security Intelligence Updates**. :::image type="content" source="images/signature-update-1.png" alt-text="signature update."::: |
| security | Configure Endpoints Script | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-script.md | ms.technology: mde You can also manually onboard individual devices to Defender for Endpoint. You might want to do this first when testing the service before you commit to onboarding all devices in your network. > [!IMPORTANT]-> This script has been optimized for use on up to 10 devices. -> -> To deploy at scale, use [other deployment options](configure-endpoints.md). For example, you can deploy an onboarding script to more than 10 devices in production with the script available in [Onboard Windows devices using Group Policy](configure-endpoints-gp.md). +> This script has been optimized for use on up to ten devices. +> Local scripting is a special onboarding method for evaluating Microsoft Defender for Endpoint. +> The data reporting frequency is set higher than with other onboarding methods when onboarding using a local script. +> This setting is for evaluation purposes and is not normally used in production deployments. For this reason, there are concerns about environmental impact, so we recommend limiting the number of deployments using local scripts to ten. +> If you are deploying to a production environment as previously described, use [other deployment options](configure-endpoints.md) like Group Policy or Microsoft Endpoint Configuration Manager. Check out the [PDF](https://github.com/MicrosoftDocs/microsoft-365-docs/raw/public/microsoft-365/security/defender-endpoint/downloads/mdatp-deployment-strategy.pdf) or [Visio](https://github.com/MicrosoftDocs/microsoft-365-docs/raw/public/microsoft-365/security/defender-endpoint/downloads/mdatp-deployment-strategy.vsdx) to see the various paths in deploying Defender for Endpoint. |
| security | Configure Server Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-server-endpoints.md | For more information, see [Integration with Microsoft Defender for Cloud](azure- **Prerequisites for Windows Server 2012 R2** -If you have fully updated your machines with the latest [monthly rollup](/troubleshoot/windows-client/deployment/standard-terminology-software-updates.md#monthly-rollup) package, there are **no** additional prerequisites. +If you have fully updated your machines with the latest [monthly rollup](https://support.microsoft.com/topic/october-12-2021-kb5006714-monthly-rollup-4dc4a2cd-677c-477b-8079-dcfef2bda09e) package, there are **no** additional prerequisites. The installer package will check if the following components have already been installed via an update: |
| security | Enable Siem Integration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-siem-integration.md | ms.technology: mde > Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-enablesiem-abovefoldlink) +> [!IMPORTANT] +> The Microsoft Defender for Endpoint SIEM REST API is being retired on March 1, 2022, as the Microsoft Defender for Endpoint Alert API and the Microsoft 365 Defender Incident API that replace it provide richer metadata - including up-to-date status of the alert, evidence entities related to the alert, comments entered by analysts, and they support updating the status, assignedTo, classification, and determination fields programmatically. **Effective immediately, no new customer onboarding to the SIEM REST API will be supported.** + Enable security information and event management (SIEM) integration so you can pull detections from Microsoft 365 Defender. Pull detections using your SIEM solution or by connecting directly to the detections REST API. > [!NOTE] |
| security | Indicator Ip Domain | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/indicator-ip-domain.md | It's important to understand the following prerequisites prior to creating indic > [!IMPORTANT] > Only external IPs can be added to the indicator list. Indicators cannot be created for internal IPs. > For web protection scenarios, we recommend using the built-in capabilities in Microsoft Edge. Microsoft Edge leverages [Network Protection](network-protection.md) to inspect network traffic and allows blocks for TCP, HTTP, and HTTPS (TLS).-> If there are conflicting URL indicator policies, the longer path is applied. For example, the URL indicator policy `https:\\support.microsoft.com/office` takes precedence over the URL indicator policy `https:\\support.microsoft.com`. +> If there are conflicting URL indicator policies, the longer path is applied. For example, the URL indicator policy `https://support.microsoft.com/office` takes precedence over the URL indicator policy `https://support.microsoft.com`. > [!NOTE] > For all other processes, web protection scenarios leverage Network Protection for inspection and enforcement: |
| security | Indicator Manage | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/indicator-manage.md | indicatorValue|String|Identity of the [Indicator](ti-indicator.md) entity. **Req action|Enum|The action that will be taken if the indicator will be discovered in the organization. Possible values are: "Alert", "AlertAndBlock", and "Allowed". **Required** title|String|Indicator alert title. **Required** description|String| Description of the indicator. **Required**-expirationTime|DateTimeOffset|The expiration time of the indicator in the following format YYYY-MM-DDTHH:MM:SS.0Z. **Optional** +expirationTime|DateTimeOffset|The expiration time of the indicator in the following format YYYY-MM-DDTHH:MM:SS.0Z. The indicator gets deleted if the expiration time passes and whatever happens at the expiration time occurs at the seconds (SS) value. **Optional** severity|Enum|The severity of the indicator. Possible values are: "Informational", "Low", "Medium" and "High". **Optional** recommendedActions|String|TI indicator alert recommended actions. **Optional** rbacGroupNames|String|Comma-separated list of RBAC group names the indicator would be applied to. **Optional** |
| security | Linux Install With Ansible | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-install-with-ansible.md | Create a subtask or role files that contribute to a playbook or task. - name: Add Microsoft apt repository for MDATP apt_repository:- repo: deb [arch=arm64,armhf,amd64] https://packages.microsoft.com/config/[distro]/[version]/prod [channel] main + repo: deb [arch=arm64,armhf,amd64] https://packages.microsoft.com/[distro]/[version]/prod [codename] main update_cache: yes state: present filename: microsoft-[channel] |
| security | Live Response | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/live-response.md | Select the **Command log** tab to see the commands used on the device during a s - Live response sessions are limited to 25 live response sessions at a time. - Live response session inactive timeout value is 30 minutes.+- Getfile command inactive timeout value is 30 minutes. It is considered inactive while the command is running in the background. - A user can initiate up to 10 concurrent sessions. - A device can only be in one session at a time. - The following file size limits apply: |
| security | Mac Jamfpro Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-jamfpro-policies.md | You'll need to take the following steps:  -2. In the Jamf Pro dashboard, select **New**. +2. Sign in to Jamf Pro, navigate to **Computers** > **Configuration Profiles**, and select **New**.  You'll need to take the following steps: - Distribution Method: Install Automatically - Level: Computer Level -4. In **Application & Custom Settings** select **Configure**. +4. Navigate to the **Application & Custom Settings** page and select **Upload** > **Add**.  These steps are applicable of macOS 10.15 (Catalina) or newer. Note that **Identifier**, **Socket Filter** and **Socket Filter Designated Requirement** exact values as specified above. + + > [!NOTE] + > Jamf supports built-in content filter settings which can be set directly through the interface. 3. Select the **Scope** tab. |
| security | Manage Updates Baselines Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus.md | We recommend updating your Windows 10 (Enterprise, Pro, and Home editions), Wind For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images). <details>+<summary>20220105.1</summary> ++ Package version: **20220105.1**<br/> + Platform version: **4.18.2111.5**<br/> + Engine version: **1.1.18800.4**<br/> + Signature version: **1.355.1482.0**<br/> ++### Fixes +- None ++### Additional information +- None +<br/> +</details><details> <summary>1.1.2112.01</summary>  Package version: **1.1.2112.01**<br/> |
| security | Microsoft Defender Antivirus Compatibility | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility.md | The following table summarizes what happens with Microsoft Defender Antivirus wh - Value: `1` > [!NOTE]- > For passive mode to work on endpoints running Windows Server 2016 and Windows Server 2012 R2, those endpoints must be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016). + > For passive mode to work on endpoints running Windows Server 2016 and Windows Server 2012 R2, those endpoints must be onboarded with the modern, unified solution described in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016). (<a id="fn3">3</a>) On Windows Server 2016 or Windows Server 2012 R2, if you are using a non-Microsoft antivirus product and that endpoint is not onboarded to Microsoft Defender for Endpoint, disable/uninstall Microsoft Defender Antivirus manually to prevent problems caused by having multiple antivirus products installed on a server. The table in this section describes various states you might see with Microsoft | State | What happens | ||| | Active mode | In active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. Settings that are configured by using Configuration Manager, Group Policy, Microsoft Intune, or other management products will apply. Files are scanned, threats are remediated, and detection information is reported in your configuration tool (such as Configuration Manager or the Microsoft Defender Antivirus app on the endpoint itself). | - | Passive mode | In passive mode, Microsoft Defender Antivirus is not used as the antivirus app, and threats are *not* remediated by Microsoft Defender Antivirus. Threats can be remediated by [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md), however. <br/><br/> Files are scanned, and reports are provided for threat detections that are shared with the Defender for Endpoint service. You might see alerts in the [Defender for Cloud](microsoft-defender-security-center.md) showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode. <br/><br/> When Microsoft Defender Antivirus is in passive mode, you can still [manage updates for Microsoft Defender Antivirus](manage-updates-baselines-microsoft-defender-antivirus.md); however, you can't move Microsoft Defender Antivirus into active mode if your devices have a non-Microsoft antivirus product that is providing real-time protection from malware. <br/><br/> For optimal security layered defense and detection efficacy, make sure to get your antivirus and antimwalware updates, even if Microsoft Defender Antivirus is running in passive mode. See [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md). <br/><br/> **NOTE**: Passive mode is not supported on Windows Server 2016. | + | Passive mode | In passive mode, Microsoft Defender Antivirus is not used as the antivirus app, and threats are *not* remediated by Microsoft Defender Antivirus. Threats can be remediated by [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md), however. <br/><br/> Files are scanned, and reports are provided for threat detections that are shared with the Defender for Endpoint service. You might see alerts in the [Defender for Cloud](microsoft-defender-security-center.md) showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode. <br/><br/> When Microsoft Defender Antivirus is in passive mode, you can still [manage updates for Microsoft Defender Antivirus](manage-updates-baselines-microsoft-defender-antivirus.md); however, you can't move Microsoft Defender Antivirus into active mode if your devices have a non-Microsoft antivirus product that is providing real-time protection from malware. <br/><br/> For optimal security layered defense and detection efficacy, make sure to get your antivirus and antimalware updates, even if Microsoft Defender Antivirus is running in passive mode. See [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md). <br/><br/> **NOTE**: Passive mode is not supported on Windows Server 2016. | | Disabled <br/><br/> or <br/><br/> Uninstalled | When disabled or uninstalled, Microsoft Defender Antivirus is not used as the antivirus app. Files are not scanned and threats are not remediated. <br/><br/> Disabling or uninstalling Microsoft Defender Antivirus is not recommended in general; if possible, keep Microsoft Defender Antivirus in passive mode if you are using a non-Microsoft antimalware/antivirus solution. <br/><br/> In cases where Microsoft Defender Antivirus is disabled automatically, it can be re-enabled automatically if the non-Microsoft antivirus/antimalware product expires or otherwise stops providing real-time protection from viruses, malware, or other threats. The automatic re-enabling of Microsoft Defender Antivirus helps to ensure that antivirus protection is maintained on your endpoints. <br/><br/> You might also use [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), which works with the Microsoft Defender Antivirus engine to periodically check for threats if you are using a non-Microsoft antivirus app. | |
| security | Microsoft Defender Endpoint Linux | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-linux.md | If you experience any installation failures, refer to [Troubleshooting installat - For 6.9: 2.6.32-696.* - For 6.10: 2.6.32.754.2.1.el6.x86_64 to 2.6.32-754.41.2: + > [!NOTE] + > After a new package version is released, support for the previous two versions is reduced to technical support only. Versions older than that that are listed in this section are provided for technical upgrade support only. + List of versions: - 2.6.32-754.2.1.el6.x86_64 |
| security | Microsoft Defender Endpoint Mac | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-mac.md | Microsoft Defender for Endpoint on Mac requires one of the following Microsoft V - Microsoft 365 E5 Security - Microsoft 365 A5 (M365 A5) - Windows 10 Enterprise E5+- Microsoft 365 Business Premium - Windows 11 Enterprise E5 - Microsoft Defender for Endpoint |
| security | Minimum Requirements | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/minimum-requirements.md | Microsoft Defender for Endpoint requires one of the following Microsoft volume l > Microsoft Defender for Endpoint is also available for purchase from a Cloud Solution Provider (CSP). > RDSH VMs do not require a separate Defender for Endpoint license. -Microsoft Defender for Endpoint for servers requires one of the following licensing options: +Microsoft Defender for Endpoint on servers requires one of the following licensing options: - [Microsoft Defender for Cloud with enhanced security features enabled](/azure/security-center/enable-enhanced-security)-- Microsoft Defender for Endpoint for Server (one per covered server)+- Microsoft Defender for Endpoint Server SKU (one per covered server) > [!NOTE]-> Customers may acquire server licenses (one per covered server Operating System Environment (OSE)) for Microsoft Defender for Endpoint for Servers if they have a combined minimum of 50 licenses for one or more of the following user licenses: +> Customers may acquire server licenses (one per covered server Operating System Environment (OSE)) to run Microsoft Defender for Endpoint on servers if they have a combined minimum of 50 licenses for one or more of the following user licenses: > > - Microsoft Defender for Endpoint > - Windows E5/A5 |
| security | Troubleshoot Security Config Mgt | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-security-config-mgt.md | For Security Management for Microsoft Defender for Endpoint on Windows Server 20 7. Select **Save** to save the new rule. +> [!NOTE] +> After this rule change is performed, a full synchronization of your Active Directory will be required. For large environments, it is recommended to schedule this rule change and full sync during on-premise Active Directory quiet periods. + ## Related topic - [Manage Microsoft Defender for Endpoint on devices with Microsoft Endpoint Manager](/mem/intune/protect/mde-security-integration) |
| security | Prerequisites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/prerequisites.md | Any of these licenses gives you access to Microsoft 365 Defender features via th - Microsoft 365 E5 or A5 - Microsoft 365 E3 with the Microsoft 365 E5 Security add-on+- Microsoft 365 E3 with the Enterprise Mobility + Security E5 add-on - Microsoft 365 A3 with the Microsoft 365 A5 Security add-on - Windows 10 Enterprise E5 or A5 - Windows 11 Enterprise E5 or A5 |
| security | Address Compromised Users Quickly | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/address-compromised-users-quickly.md | search.appverid: - MET150 - MOE150 -+ Last updated 06/10/2021 description: Learn how to speed up the process of detecting and addressing compromised user accounts with automated investigation and response capabilities in Microsoft Defender for Office 365 Plan 2. ms.technology: mdo When a user account is compromised, alerts are triggered. And in some cases, tha You have a few options for navigating to a list of restricted users. For example, in the Microsoft 365 Defender portal, you can go to **Email & collaboration** \> **Review** \> **Restricted Users**. The following procedure describes navigation using the **Alerts** dashboard, which is a good way to see various kinds of alerts that might have been triggered. -1. Open the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> and go to **Incidents & alerts** \> **Alerts**. Or, to go directly to the **Alerts** page, use <https://security.microsoft.com/alerts>. +1. Open the Microsoft 365 Defender portal at <https://security.microsoft.com> and go to **Incidents & alerts** \> **Alerts**. Or, to go directly to the **Alerts** page, use <https://security.microsoft.com/alerts>. 2. On the **Alerts** page, filter the results by time period and the policy named **User restricted from sending email**. |
| security | Admin Review Reported Message | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/admin-review-reported-message.md | ms.prod: m365-security In Microsoft 365 organizations with Exchange Online mailboxes and Microsoft Defender for Office 365, admins can now send templated messages back to end users after they review reported messages. The templates can be customized for your organization and based on your admin's verdict as well. -The feature is designed to give feedback to your users but doesn't change the verdicts of messages in the system. To help Microsoft update and improve its filters, you need to submit messages for analysis using [Admin submission](admin-submission.md). +The feature is designed to give feedback to your users but doesn't change the verdicts of messages in the system. To help Microsoft update and improve its filters, you need to submit messages for analysis using [Admin submission](admin-submission.md). You will only be able to mark and notify users of review results if the message was reported as a [false positives or false negatives](report-false-positives-and-false-negatives.md). ## What do you need to know before you begin? -- You open the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. - To modify the configuration for User submissions, you need to be a member of one of the following role groups:- - Organization Management or Security Administrator in the [Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md). - - Organization Management in [Exchange Online](/Exchange/permissions-exo/permissions-exo#role-groups). + - Organization Management or Security Administrator in the [Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md). + - Organization Management in [Exchange Online](/Exchange/permissions-exo/permissions-exo#role-groups). - You'll also need access to Exchange Online PowerShell. If the account that you're trying to use doesn't have access to Exchange Online PowerShell, you'll receive an error that says *Specify an email address in your domain*. For more information about enabling or disabling access to Exchange Online PowerShell, see the following topics: - [Enable or disable access to Exchange Online PowerShell](/powershell/exchange/disable-access-to-exchange-online-powershell) You will only be able to mark and notify users of review results if the message ## Notify users from within the portal -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go directly to the **Submissions** page: [https://security.microsoft.com/reportsubmission](https://security.microsoft.com/reportsubmission). +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Email & collaboration** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. 2. Click **User reported messages**, and then select the message you want to mark and notify. The reported message will be marked as either false positive or false negative, ## Customize the messages used to notify users -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **User reported message settings** in the **Others** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **User submissions** page at **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **User reported message settings** in the **Others** section. To go directly to the **User submissions** page, use <https://security.microsoft.com/userSubmissionsReportMessage>. 2. On the **User submissions** page, if you want to specify the sender display name, check the box for **Specify Office 365 email address to use as sender** under the **Email notifications for admin review results** section, and enter in the name you wish to use. The email address that will be visible in Outlook and all the replies will go there. The reported message will be marked as either false positive or false negative, > [!div class="mx-imgBorder"] >  -4. When you're finished, click **Save**. To clear these values, click **Discard** on the User submissions page. +4. When you're finished, click **Save**. To clear these values, click **Discard** on the **User submissions** page. |
| security | Admin Submission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/admin-submission.md | search.appverid: - M365-security-compliance - m365initiative-defender-office365-- - seo-marvel-apr2020 - - admindeeplinkDEFENDER + description: Admins can learn how to use the Submissions portal in the Microsoft 365 Defender portal to submit suspicious emails, suspected phishing mails, spam, and other potentially harmful messages, URLs, and email attachments to Microsoft for rescanning. ms.technology: mdo ms.prod: m365-security For other ways to submit email messages, URLs, and attachments to Microsoft, see - You open the Microsoft 365 Defender portal at <https://security.microsoft.com/>. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. - To submit messages and files to Microsoft, you need to be a member of one of the following role groups:- - **Organization Management** or **Security Reader** in the [Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md). + - **Organization Management** or **Security Reader** in the [Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md). Note that membership in this role group is required to [View user submissions to the custom mailbox](#view-user-submissions-to-microsoft) as described later in this article. For other ways to submit email messages, URLs, and attachments to Microsoft, see ## Report suspicious content to Microsoft -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, under **Actions & submissions**, go to **Submissions**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Email & collaboration** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. -2. On the **Submissions** page, verify that the **Emails** tab is selected, select the email you want to report, and then click  **Submit to Microsoft for analysis**. +2. On the **Submissions** page, verify that the **Submitted for analysis** tab is selected, select the email you want to report, and then click  **Submit to Microsoft for analysis**. 3. Use the **Submit to Microsoft for analysis** flyout that appears to submit the email, URL, or email attachment as described in the following sections. For other ways to submit email messages, URLs, and attachments to Microsoft, see ### Notify users from within the portal -1. In the Microsoft 365 Defender portal, under **Actions & submissions**, go to **Submissions**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Email & collaboration** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. -2. Select **User reported messages** tab, and then select the message you want to mark and notify. +2. On the **Submissions** page, select **User reported messages** tab, and then select the message you want to mark and notify. 3. Select the **Mark as and notify** drop-down, and then select **No threats found** \> **Phishing** or **Junk**. The reported message will be marked as a false positive or a false negative. An ## View admin submissions to Microsoft -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, under **Actions & submissions**, go to **Submissions**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Email & collaboration** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. 2. On the **Submissions** page, verify that the **Emails**, **URL**, or **Email attachment** tab is selected. If an override was found, the rescan should complete in several minutes. If ther If you've deployed the [Report Message add-in](enable-the-report-message-add-in.md), the [Report Phishing add-in](enable-the-report-phish-add-in.md), or people use the [built-in reporting in Outlook on the web](report-junk-email-and-phishing-scams-in-outlook-on-the-web-eop.md), you can see what users are reporting on the **User reported message** tab. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, under **Actions & submissions**, go to **Submissions**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Email & collaboration** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. 2. On the **Submissions** page, select the **User reported messages** tab. |
| security | Air Report False Positives Negatives | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-report-false-positives-negatives.md | With Threat Explorer, your security operations team can find an email affected b In the Action center, you can see remediation actions that were taken and potentially undo the action. -1. Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. -2. In the navigation pane, select **Action center**. -3. Select the **History** tab to view the list of completed actions. -4. Select an item. Its flyout pane opens. -5. In the flyout pane, select **Undo**. (Only actions that can be undone will have an **Undo** button.) +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the Action center by selecting **Action center**. To go directly to the Action center, use <https://security.microsoft.com/action-center/>. +2. In the Action center, select the **History** tab to view the list of completed actions. +3. Select an item. Its flyout pane opens. +4. In the flyout pane, select **Undo**. (Only actions that can be undone will have an **Undo** button.) ## See also |
| security | Air Review Approve Pending Completed Actions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-review-approve-pending-completed-actions.md | search.appverid: - M365-security-compliance - m365initiative-defender-office365-+ description: Learn about remediation actions in automated investigation and response capabilities in Microsoft Defender for Office 365 Plan 2. ms.technology: mdo ms.prod: m365-security As automated investigations on email & collaboration content result in verdicts, These remediation actions are not taken unless and until your security operations team approves them. We recommend reviewing and approving any pending actions as soon as possible so that your automated investigations complete in a timely manner. In some cases, you can reconsider submitted actions. You need to be part of Search & purge role before taking any actions. ## Approve (or reject) pending actions+ There are four different ways to find and take auto investigation actions: - [Incident queue](https://security.microsoft.com/incidents)-- [Action center](https://security.microsoft.com/action-center/pending) - Investigation itself (accessed via Incident or from an alert)+- [Action center](https://security.microsoft.com/action-center/pending) - [Investigation and remediation investigations queue](https://security.microsoft.com/airinvestigation) ## Incident queue -1. Open the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> and sign in. -2. In the navigation pane, select **Incidents & alerts > Incidents**. -3. Select an incident name to open its summary page. -4. Select the **Evidence and Response** tab. -5. Select an item in the list. Its side pane opens. -6. In the side pane, take approve or reject actions. --## Investigation queue --1. Open the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> and sign in. -2. Navigate from the alerts/incident page. -3. On the Investigation page, go to the **pending actions** tab. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Incidents** page at **Incidents & alerts** \> **Incidents**. To go directly to the **Incidents** page, use <https://security.microsoft.com/incidents>. +2. On the **Incidents** page, select an incident name to open its summary page. +3. Select the **Evidence and Response** tab. 4. Select an item in the list. Its side pane opens. 5. In the side pane, take approve or reject actions. ## Action center -1. Open the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> and sign in. -2. In the navigation pane, select **Action center**. -3. On the **Pending** tab, review the list of actions that are awaiting approval. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Action center** page by selecting **Action center**. To go directly to the **Action center** page, use <https://security.microsoft.com/action-center/pending>. +2. On the **Action center** page, verify that the **Pending** tab is selected, and then review the list of actions that are awaiting approval. - Select **Open investigation page** to view more details about the investigation. - Select **Approve** to initiate a pending action. - Select **Reject** to prevent a pending action from being taken. ## Investigation and remediation investigations queue -1. Open the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> and sign in. -2. Open pending investigations. -3. On the Investigation page, go to the **pending actions** tab. -4. Select an item in the list. Its side pane opens. -5. In the side pane, take approve or reject actions. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Threat investigation** page at **Email & collaboration** \> **Investigations**. To go directly to the **Threat investigation** page, use <https://security.microsoft.com/airinvestigation>. +2. On the **Threat investigation** page, find and an item from the list whose status is **Pending action**. +3. Click  **Open in new window** on the list time (between **ID** and **Status**). +4. In the page that opens, take approve or reject actions. ## Change or undo one remediation action There are two different ways to reconsider submitted actions: ## Change or undo through the unified action center -1. Go to the [unified action center](https://security.microsoft.com/action-center) and sign in. -2. On the **History** tab, select an action that you want to change or undo. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the unified action center by selecting **Action center**. To go directly to the unified action center, use <https://security.microsoft.com/action-center/>. +2. On the **Action center** page, select the **History** tab, and then select the action that you want to change or undo. 3. In the pane on the right side of the screen, select the appropriate action (**move to inbox**, **move to junk**, **move to deleted items**, **soft delete**, or **hard delete**). ## Change or undo through the Office action center -1. Go to the [Office action center](https://security.microsoft.com/threatincidents) and sign in. -2. Select the appropriate remediation. -3. In the side pane, click on the mail submissions entry and wait for the list to load. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the Office action center at **Email & collaboration** \> **Review** \> **Action center**. To go directly to the Office action center, use <https://security.microsoft.com/threatincidents>. +2. On the **Action center** page, select the appropriate remediation. +3. In the side panel, click on the mail submissions entry and wait for the list to load. 4. Wait for the Action button at the top to enable and select the Action button to change the action type. 5. This will create the appropriate actions. |
| security | Alerts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/alerts.md | Use the alerts features in the Microsoft 365 Defender portal to view and manage ## How to get to the alerts features -Alerts are in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. Here's how to get to the page: --In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Alerts**. Or, to go direct to the **Alerts** page, use <https://security.microsoft.com/alerts>. +Alerts are available in the Microsoft 365 Defender portal at <https://security.microsoft.com> at **Incidents & alerts** \> **Alerts**. Or, to go direct to the **Alerts** page, use <https://security.microsoft.com/alerts>. ## Alerts features -The following table describes the tools that are available under **Alerts** in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. +The following table describes the tools that are available on the **Alerts** page. <br> |
| security | Attack Simulation Training Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-get-started.md | - - admindeeplinkDEFENDER description: Admins can learn how to use Attack simulation training to run simulated phishing and password attacks in their Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2 organizations. ms.technology: mdo ms.prod: m365-security If your organization has Microsoft 365 E5 or Microsoft Defender for Office 365 P ## What do you need to know before you begin? -- To open the Microsoft 365 Defender portal, go to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. Attack simulation training is available at **Email and collaboration** \> **Attack simulation training**. To go directly to Attack simulation training, open <https://security.microsoft.com/attacksimulator>.+- To open the Microsoft 365 Defender portal, go to <https://security.microsoft.com>. Attack simulation training is available at **Email and collaboration** \> **Attack simulation training**. To go directly to Attack simulation training, use <https://security.microsoft.com/attacksimulator>. - For more information about the availability of Attack simulation training across different Microsoft 365 subscriptions, see [Microsoft Defender for Office 365 service description](/office365/servicedescriptions/office-365-advanced-threat-protection-service-description). If your organization has Microsoft 365 E5 or Microsoft Defender for Office 365 P - Attack simulation and training related data is stored with other customer data for Microsoft 365 services. For more information see [Microsoft 365 data locations](../../enterprise/o365-data-locations.md). Attack simulation is available in the following regions: NAM, APC, EUR, IND, CAN, AUS, FRA, GBR, JPN, KOR, BRA, LAM, CHE, NOR, ZAF, ARE and DEU. > [!NOTE]- > NOR, ZAF, ARE and DEU are the latest additions. All features except reported email telemetry will be available in these regions. We are working to enable this and will notify our customers as soon as reported email telemetry becomes available. + > NOR, ZAF, ARE and DEU are the latest additions. All features except reported email telemetry will be available in these regions. We are working to enable this and will notify our customers as soon as reported email telemetry becomes available. - As of June 15 2021, Attack simulation training is available in GCC. If your organization has Office 365 G5 GCC or Microsoft Defender for Office 365 (Plan 2) for Government, you can use Attack simulation training in the Microsoft 365 Defender portal to run realistic attack scenarios in your organization as described in this article. Attack simulation training is not yet available in GCC High or DoD environments. |
| security | Attack Simulation Training Insights | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-insights.md | ms.localizationpriority: medium - M365-security-compliance - m365initiative-defender-office365-+ description: Admins can learn how Attack simulation training in the Microsoft 365 Defender portal affects users and can gain insights from simulation and training outcomes. ms.technology: mdo For getting started information about Attack simulation training, see [Get start ## Insights and reports on the Overview tab of Attack simulation training -To go to the **Overview** tab, open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>, go to **Email & collaboration** \> **Attack simulation training**, and verify that the **Overview** tab is selected (it's the default). To go directly to the **Overview** tab on the **Attack simulation training** page, use <https://security.microsoft.com/attacksimulator?viewid=overview>. +To go to the **Overview** tab, open the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Attack simulation training**, and verify that the **Overview** tab is selected (it's the default). To go directly to the **Overview** tab on the **Attack simulation training** page, use <https://security.microsoft.com/attacksimulator?viewid=overview>. The rest of this section describes the information that's available on the **Overview** tab of Attack simulation training. If you click the  **Exp ## Insights and reports in the simulation details of Attack simulation training -To go to the **Simulations** tab, open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>, go to **Email & collaboration** \> **Attack simulation training**, and then click the **Simulations** tab. To go directly to the **Simulations** tab on the **Attack simulation training** page, use <https://security.microsoft.com/attacksimulator?viewid=simulations>. +To go to the **Simulations** tab, open the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Attack simulation training**, and then select the **Simulations** tab. To go directly to the **Simulations** tab on the **Attack simulation training** page, use <https://security.microsoft.com/attacksimulator?viewid=simulations>. When you select a simulation from the list, a details page opens. This page contains the configuration settings of the simulation that you would expect to see (status, launch date, payload used, etc.). |
| security | Attack Simulation Training Payloads | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-payloads.md | ms.localizationpriority: medium - M365-security-compliance - m365initiative-defender-office365-+ description: Admins can learn how to create custom payloads for Attack simulation training in Microsoft Defender for Office 365 Plan 2. ms.technology: mdo In Attack simulation training, a _payload_ is the phishing email message and web This article describes how to create your own payloads in Attack simulation training. You can create custom payloads in the following locations: -- The **Payloads** tab: In the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>, go to **Email & collaboration** \> **Attack simulation training** \> **Payloads** tab. To go directly to the **Payloads** tab, use <https://security.microsoft.com/attacksimulator?viewid=payload>.+- The **Payloads** tab: In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Attack simulation training** \> **Payloads** tab. To go directly to the **Payloads** tab, use <https://security.microsoft.com/attacksimulator?viewid=payload>. - During simulation creation: You can create custom payloads on the **Select a payload** page (the third page) of the simulation creation wizard. For more information, see [Simulate a phishing attack in Defender for Office 365](attack-simulation-training.md). For getting started information about Attack simulation training, see [Get started using Attack simulation training](attack-simulation-training-get-started.md). |
| security | Attack Simulation Training | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training.md | ms.localizationpriority: medium - M365-security-compliance - m365initiative-defender-office365-+ description: Admins can learn how to simulate phishing attacks and train their users on phishing prevention using Attack simulation training in Microsoft Defender for Office 365 Plan 2. ms.technology: mdo For getting started information about Attack simulation training, see [Get start To launch a simulated phishing attack, do the following steps: -1. In the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>, go to **Email & collaboration** \> **Attack simulation training** \> **Simulations** tab. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Attack simulation training** \> **Simulations** tab. To go directly to the **Simulations** tab, use <https://security.microsoft.com/attacksimulator?viewid=simulations>. |
| security | Campaigns | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/campaigns.md | ms.assetid: - M365-security-compliance - m365initiative-defender-office365-+ description: Learn about Campaign Views in Microsoft Defender for Office 365. ms.technology: mdo ms.prod: m365-security A campaign might be short-lived, or could span several days, weeks, or months wi ## Campaign Views in the Microsoft 365 Defender portal -Campaign Views is available in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> at **Email & collaboration** \> **Campaigns**, or directly at <https://security.microsoft.com/campaigns>. +Campaign Views is available in the Microsoft 365 Defender portal at <https://security.microsoft.com> at **Email & collaboration** \> **Campaigns**, or directly at <https://security.microsoft.com/campaigns>.  |
| security | Configuration Analyzer For Security Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies.md | search.appverid: ms.assetid: - M365-security-compliance-+ description: Admins can learn how to use the configuration analyzer to find and fix security policies that are below the settings in Standard protection and Strict protection in preset security policies. ms.technology: mdo ms.prod: m365-security The Standard and Strict policy setting values that are used as baselines are des ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To go directly to the **Configuration analyzer** page, use <https://security.microsoft.com/configurationAnalyzer>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Configuration analyzer** page, use <https://security.microsoft.com/configurationAnalyzer>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). The Standard and Strict policy setting values that are used as baselines are des ## Use the configuration analyzer in the Microsoft 365 Defender portal -In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Configuration analyzer** in the **Templated policies** section. +In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Configuration analyzer** in the **Templated policies** section. To go directly to the **Configuration analyzer** page, use <https://security.microsoft.com/configurationAnalyzer>. The **Configuration analyzer** page has three main tabs: |
| security | Configure Advanced Delivery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-advanced-delivery.md | search.appverid: - MET150 - M365-security-compliance-+ description: Admins can learn how to use the advanced delivery policy in Exchange Online Protection (EOP) to identify messages that should not be filtered in specific supported scenarios (third-party phishing simulations and messages delivered to security operations (SecOps) mailboxes. ms.technology: mdo ms.prod: m365-security Messages that are identified by the advanced delivery policy aren't security thr ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To go directly to the **Advanced delivery** page, open <https://security.microsoft.com/advanceddelivery>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Advanced delivery** page, open <https://security.microsoft.com/advanceddelivery>. - To connect to Security & Compliance Center PowerShell, see [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell). Messages that are identified by the advanced delivery policy aren't security thr ## Use the Microsoft 365 Defender portal to configure SecOps mailboxes in the advanced delivery policy -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Advanced delivery** in the **Rules** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Advanced delivery** in the **Rules** section. To go directly to the **Advanced delivery** page, use <https://security.microsoft.com/advanceddelivery>. 2. On the **Advanced delivery** page, verify that the **SecOps mailbox** tab is selected, and then do one of the following steps: - Click  **Edit**. The SecOps mailbox entries that you configured are displayed on the **SecOps mai ## Use the Microsoft 365 Defender portal to configure third-party phishing simulations in the advanced delivery policy -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Advanced delivery** in the **Rules** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Advanced delivery** in the **Rules** section. To go directly to the **Advanced delivery** page, use <https://security.microsoft.com/advanceddelivery>. 2. On the **Advanced delivery** page, select the **Phishing simulation** tab, and then do one of the following steps: - Click  **Edit**. |
| security | Configure Anti Malware Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-anti-malware-policies.md | You can configure anti-malware policies in the Microsoft 365 Defender portal or ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To go directly to the **Anti-malware** page, use <https://security.microsoft.com/antimalwarev2>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Anti-malware** page, use <https://security.microsoft.com/antimalwarev2>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). To connect to standalone EOP PowerShell, see [Connect to Exchange Online Protection PowerShell](/powershell/exchange/connect-to-exchange-online-protection-powershell). You can configure anti-malware policies in the Microsoft 365 Defender portal or Creating a custom anti-malware policy in the Microsoft 365 Defender portal creates the malware filter rule and the associated malware filter policy at the same time using the same name for both. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-Malware** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-Malware** in the **Policies** section. To go directly to the **Anti-malware** page, use <https://security.microsoft.com/antimalwarev2>. 2. On the **Anti-malware** page, click  **Create**. Creating a custom anti-malware policy in the Microsoft 365 Defender portal creat ## Use the Microsoft 365 Defender portal to view anti-malware policies -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-Malware** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-Malware** in the **Policies** section. To go directly to the **Anti-malware** page, use <https://security.microsoft.com/antimalwarev2>. 2. On the **Anti-malware** page, the following properties are displayed in the list of anti-malware policies: - **Name** Creating a custom anti-malware policy in the Microsoft 365 Defender portal creat ## Use the Microsoft 365 Defender portal to modify anti-malware policies -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-Malware** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-Malware** in the **Policies** section. To go directly to the **Anti-malware** page, use <https://security.microsoft.com/antimalwarev2>. 2. On the **Anti-malware** page, select a policy from the list by clicking on the name. To enable or disable a policy or set the policy priority order, see the followin You can't disable the default anti-malware policy. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-Malware** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-Malware** in the **Policies** section. To go directly to the **Anti-malware** page, use <https://security.microsoft.com/antimalwarev2>. 2. On the **Anti-malware** page, select a custom policy from the list by clicking on the name. To change the priority of a policy, you click **Increase priority** or **Decreas **Notes**: -- In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, you can only change the priority of the anti-malware policy after you create it. In PowerShell, you can override the default priority when you create the malware filter rule (which can affect the priority of existing rules).+- In the Microsoft 365 Defender portal, you can only change the priority of the anti-malware policy after you create it. In PowerShell, you can override the default priority when you create the malware filter rule (which can affect the priority of existing rules). - Anti-malware policies are processed in the order that they're displayed (the first policy has the **Priority** value 0). The default anti-malware policy has the priority value **Lowest**, and you can't change it. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-Malware** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-Malware** in the **Policies** section. To go directly to the **Anti-malware** page, use <https://security.microsoft.com/antimalwarev2>. 2. On the **Anti-malware** page, select a custom policy from the list by clicking on the name. To change the priority of a policy, you click **Increase priority** or **Decreas When you use the Microsoft 365 Defender portal to remove a custom anti-malware policy, the malware filter rule and the corresponding malware filter policy are both deleted. You can't remove the default anti-malware policy. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-Malware** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-Malware** in the **Policies** section. To go directly to the **Anti-malware** page, use <https://security.microsoft.com/antimalwarev2>. 2. On the **Anti-malware page**, select a custom policy from the list by clicking on the name. |
| security | Configure Anti Phishing Policies Eop | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-anti-phishing-policies-eop.md | ms.localizationpriority: medium ms.assetid: - M365-security-compliance-+ description: Admins can learn how to create, modify, and delete the anti-phishing policies that are available in Exchange Online Protection (EOP) organizations with or without Exchange Online mailboxes. ms.technology: mdo ms.prod: m365-security To increase the effectiveness of anti-phishing protection, you can create custom ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). To increase the effectiveness of anti-phishing protection, you can create custom Creating a custom anti-phishing policy in the Microsoft 365 Defender portal creates the anti-phish rule and the associated anti-phish policy at the same time using the same name for both. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. 2. On the **Anti-phishing** page, click  **Create**. Creating a custom anti-phishing policy in the Microsoft 365 Defender portal crea ## Use the Microsoft 365 Defender portal to view anti-phishing policies -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. 2. On the **Anti-phishing** page, the following properties are displayed in the list of policies: Creating a custom anti-phishing policy in the Microsoft 365 Defender portal crea ## Use the Microsoft 365 Defender portal to modify anti-phishing policies -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. 2. On the **Anti-phishing** page, select a policy from the list by clicking on the name. To enable or disable a policy or set the policy priority order, see the followin You can't disable the default anti-phishing policy. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. 2. On the **Anti-phishing** page, select a custom policy from the list by clicking on the name. To change the priority of a policy, you click **Increase priority** or **Decreas - In the Microsoft 365 Defender portal, you can only change the priority of the anti-phishing policy after you create it. In PowerShell, you can override the default priority when you create the anti-phish rule (which can affect the priority of existing rules). - Anti-phishing policies are processed in the order that they're displayed (the first policy has the **Priority** value 0). The default anti-phishing policy has the priority value **Lowest**, and you can't change it. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. 2. On the **Anti-phishing** page, select a custom policy from the list by clicking on the name. To change the priority of a policy, you click **Increase priority** or **Decreas When you use the Microsoft 365 Defender portal to remove a custom anti-phishing policy, the anti-phish rule and the corresponding anti-phish policy are both deleted. You can't remove the default anti-phishing policy. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. 2. On the **Anti-phishing** page, select a custom policy from the list by clicking on the name. For detailed syntax and parameter information, see [Remove-AntiPhishRule](/power To verify that you've successfully configured anti-phishing policies in EOP, do any of the following steps: -- In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. Verify the list of policies, their **Status** values, and their **Priority** values. To view more details, select the policy from the list by clicking on the name and viewing the details in the flyout that appears.+- On the **Anti-phishing** page in the Microsoft 365 Defender portal at <https://security.microsoft.com/antiphishing>, verify the list of policies, their **Status** values, and their **Priority** values. To view more details, select the policy from the list by clicking on the name and viewing the details in the flyout that appears. - In Exchange Online PowerShell, replace \<Name\> with the name of the policy or rule, run the following command, and verify the settings: |
| security | Configure Global Settings For Safe Links | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-global-settings-for-safe-links.md | search.appverid: ms.assetid: - M365-security-compliance-+ description: Admins can learn how to view and configure global settings (the 'Block the following URLs' list and protection for Office 365 apps) for Safe Links in Microsoft Defender for Office 365. ms.technology: mdo ms.prod: m365-security You can configure the global Safe Links settings in the Microsoft 365 Defender p - Although there's no default Safe Links policy, the **Built-in protection** preset security policy provides Safe Links protection to all recipients (users who aren't defined in custom Safe Links policies). For more information, see [Preset security policies in EOP and Microsoft Defender for Office 365](preset-security-policies.md). You can also create Safe Links policies to apply to specific users, group, or domains. For instructions, see [Set up Safe Links policies in Microsoft Defender for Office 365](set-up-safe-links-policies.md). -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To go directly to the **Safe Links** page, use <https://security.microsoft.com/safelinksv2>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Safe Links** page, use <https://security.microsoft.com/safelinksv2>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). To connect to standalone EOP PowerShell, see [Connect to Exchange Online Protection PowerShell](/powershell/exchange/connect-to-exchange-online-protection-powershell). You can configure the global Safe Links settings in the Microsoft 365 Defender p The **Block the following URLs** list identifies the links that should always be blocked by Safe Links scanning in supported apps. For more information, see ["Block the following URLs" list for Safe Links](safe-links.md#block-the-following-urls-list-for-safe-links). -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Links** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Links** in the **Policies** section. To go directly to the **Safe Links** page, use <https://security.microsoft.com/safelinksv2>. 2. On the **Safe Links** page, click **Global settings**. In the **Safe Links policy for your organization** fly out that appears, go to the **Block the following URLs** box. You can use the **Get-AtpPolicyForO365** cmdlet to view existing entries in the Safe Links protection for Office 365 apps applies to documents in supported Office desktop, mobile, and web apps. For more information, see [Safe Links settings for Office 365 apps](safe-links.md#safe-links-settings-for-office-365-apps). -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Links** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Links** in the **Policies** section. To go directly to the **Safe Links** page, use <https://security.microsoft.com/safelinksv2>. 2. On the **Safe Links** page, click **Global settings**. In the **Safe Links policy for your organization** fly out that appears, configure the following settings in the **Settings that apply to content in supported Office 365 apps** section: For detailed syntax and parameter information, see [Set-AtpPolicyForO365](/power To verify that you've successfully configured the global settings for Safe Links (the **Block the following URLs** list and the Office 365 app protection settings), do any of the following steps: -- In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Links** in the **Policies** section \> click **Global settings**, and verify the settings in the fly out that appears.+- On the **Safe Links** page in the Microsoft 365 Defender portal at <https://security.microsoft.com/safelinksv2>, click **Global settings**, and verify the settings in the fly out that appears. - In Exchange Online PowerShell or Exchange Online Protection PowerShell, run the following command and verify the settings: |
| security | Configure Mdo Anti Phishing Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-mdo-anti-phishing-policies.md | ms.localizationpriority: medium ms.assetid: - M365-security-compliance-+ description: Admins can learn how to create, modify, and delete the advanced anti-phishing policies that are available in organizations with Microsoft Defender for Office 365. ms.technology: mdo ms.prod: m365-security To increase the effectiveness of anti-phishing protection in Defender for Office Creating a custom anti-phishing policy in the Microsoft 365 Defender portal creates the anti-phish rule and the associated anti-phish policy at the same time using the same name for both. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. 2. On the **Anti-phishing** page, click  **Create**. Creating a custom anti-phishing policy in the Microsoft 365 Defender portal crea ## Use the Microsoft 365 Defender portal to modify anti-phishing policies -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. 2. On the **Anti-phishing** page, select a policy from the list by clicking on the name. To enable or disable a policy or set the policy priority order, see the followin You can't disable the default anti-phishing policy. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. 2. On the **Anti-phishing** page, select a custom policy from the list by clicking on the name. To change the priority of a policy, you click **Increase priority** or **Decreas - In the Microsoft 365 Defender portal, you can only change the priority of the anti-phishing policy after you create it. In PowerShell, you can override the default priority when you create the anti-phish rule (which can affect the priority of existing rules). - Anti-phishing policies are processed in the order that they're displayed (the first policy has the **Priority** value 0). The default anti-phishing policy has the priority value **Lowest**, and you can't change it. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. 2. On the **Anti-phishing** page, select a custom policy from the list by clicking on the name. To change the priority of a policy, you click **Increase priority** or **Decreas When you use the Microsoft 365 Defender portal to remove a custom anti-phishing policy, the anti-phish rule and the corresponding anti-phish policy are both deleted. You can't remove the default anti-phishing policy. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. 2. On the **Anti-phishing** page, select a custom policy from the list by clicking on the name of the policy. For detailed syntax and parameter information, see [Remove-AntiPhishRule](/power To verify that you've successfully configured anti-phishing policies in Defender for Office 365, do any of the following steps: -- In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to ***Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. Verify the list of policies, their **Status** values, and their **Priority** values. To view more details, select the policy from the list by clicking on the name and viewing the details in the flyout that appears.+- On the **Anti-phishing** page in the Microsoft 365 Defender portal at <https://security.microsoft.com/antiphishing>, verify the list of policies, their **Status** values, and their **Priority** values. To view more details, select the policy from the list by clicking on the name and viewing the details in the flyout that appears. - In Exchange Online PowerShell, replace \<Name\> with the name of the policy or rule, and run the following command and verify the settings: |
| security | Configure The Connection Filter Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-the-connection-filter-policy.md | - - admindeeplinkDEFENDER description: Admins can learn how to configure connection filtering in Exchange Online Protection (EOP) to allow or block emails from email servers. ms.technology: mdo ms.prod: m365-security This article describes how to configure the default connection filter policy in ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). To connect to standalone EOP PowerShell, see [Connect to Exchange Online Protection PowerShell](/powershell/exchange/connect-to-exchange-online-protection-powershell). This article describes how to configure the default connection filter policy in ## Use the Microsoft 365 Defender portal to modify the default connection filter policy -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>. 2. On the **Anti-spam policies** page, select **Connection filter policy (Default)** from the list by clicking on the name of the policy. This article describes how to configure the default connection filter policy in ## Use the Microsoft 365 Defender portal to view the default connection filter policy -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>. 2. On the **Anti-spam policies** page, the following properties are displayed in the list of policies: For detailed syntax and parameter information, see [Set-HostedConnectionFilterPo To verify that you've successfully modified the default connection filter policy, do any of the following steps: -- In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section \> select **Connection filter policy (Default)** from the list by clicking on the name of the policy, and verify the settings.+- On the **Anti-spam** page in the Microsoft 365 Defender portal at <https://security.microsoft.com/antispam>, select **Connection filter policy (Default)** from the list by clicking on the name of the policy, and verify the settings. - In Exchange Online PowerShell or standalone EOP PowerShell, run the following command and verify the settings: |
| security | Configure The Outbound Spam Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-the-outbound-spam-policy.md | - - admindeeplinkDEFENDER description: Admins can learn how to view, create, modify, and delete outbound spam policies in Exchange Online Protection (EOP). ms.technology: mdo ms.prod: m365-security The basic elements of an outbound spam policy in EOP are: - **The outbound spam filter policy**: Specifies the actions for outbound spam filtering verdicts and the notification options. - **The outbound spam filter rule**: Specifies the priority and recipient filters (who the policy applies to) for a outbound spam filter policy. -The difference between these two elements isn't obvious when you manage outbound spam polices in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>: +The difference between these two elements isn't obvious when you manage outbound spam polices in the Microsoft 365 Defender portal: - When you create a policy, you're actually creating a outbound spam filter rule and the associated outbound spam filter policy at the same time using the same name for both. - When you modify a policy, settings related to the name, priority, enabled or disabled, and recipient filters modify the outbound spam filter rule. All other settings modify the associated outbound spam filter policy. To increase the effectiveness of outbound spam filtering, you can create custom ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To go directly to the **Anti-spam settings** page, use <https://security.microsoft.com/antispam>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Anti-spam settings** page, use <https://security.microsoft.com/antispam>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). To connect to standalone EOP PowerShell, see [Connect to Exchange Online Protection PowerShell](/powershell/exchange/connect-to-exchange-online-protection-powershell). To increase the effectiveness of outbound spam filtering, you can create custom Creating a custom outbound spam policy in the Microsoft 365 Defender portal creates the spam filter rule and the associated spam filter policy at the same time using the same name for both. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. To go directly to the **Anti-spam settings** page, use <https://security.microsoft.com/antispam>. 2. On the **Anti-spam policies** page, click  **Create policy** and then select **Outbound** from the drop down list. Creating a custom outbound spam policy in the Microsoft 365 Defender portal crea ## Use the Microsoft 365 Defender portal to view outbound spam policies -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. To go directly to the **Anti-spam settings** page, use <https://security.microsoft.com/antispam>. 2. On the **Anti-spam policies** page, look for one of the following values: - The **Type** value is **Custom outbound spam policy** To change the priority of a policy, you click **Increase priority** or **Decreas When you use the Microsoft 365 Defender portal to remove a custom outbound spam policy, the spam filter rule and the corresponding spam filter policy are both deleted. You can't remove the default outbound spam policy. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. To go directly to the **Anti-spam settings** page, use <https://security.microsoft.com/antispam>. 2. On the **Anti-spam policies** page, select a policy with the **Type value** of **Custom outbound spam policy** from the list by clicking on the name. At the top of the policy details flyout that appears, click  **More actions** \>  **Delete policy**. |
| security | Configure Your Spam Filter Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-your-spam-filter-policies.md | search.appverid: ms.assetid: 316544cb-db1d-4c25-a5b9-c73bbcf53047 - M365-security-compliance-+ description: Admins can learn how to view, create, modify, and delete anti-spam policies in Exchange Online Protection (EOP). ms.technology: mdo ms.prod: m365-security To increase the effectiveness of spam filtering, you can create custom anti-spam ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). To connect to standalone EOP PowerShell, see [Connect to Exchange Online Protection PowerShell](/powershell/exchange/connect-to-exchange-online-protection-powershell). To increase the effectiveness of spam filtering, you can create custom anti-spam Creating a custom anti-spam policy in the Microsoft 365 Defender portal creates the spam filter rule and the associated spam filter policy at the same time using the same name for both. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>. 2. On the **Anti-spam policies** page, click  **Create policy** and then select **Inbound** from the drop down list. Creating a custom anti-spam policy in the Microsoft 365 Defender portal creates ## Use the Microsoft 365 Defender portal to view anti-spam policies -1. In the<a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>. 2. On the **Anti-spam policies** page, look for one of the following values: - The **Type** value is **Custom anti-spam policy** Creating a custom anti-spam policy in the Microsoft 365 Defender portal creates ## Use the Microsoft 365 Defender portal to modify anti-spam policies -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>. 2. On the **Anti-spam policies** page, select an anti-spam policy from the list by clicking on the name: - A custom policy that you created where the value in the **Type** column is **Custom anti-spam policy**. To enable or disable a policy or set the policy priority order, see the followin You can't disable the default anti-spam policy. -1. In the<a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>. 2. On the **Anti-spam policies** page, select a policy with the **Type value** of **Custom anti-spam policy** from the list by clicking on the name. To change the priority of a policy, you click **Increase priority** or **Decreas - In the Microsoft 365 Defender portal, you can only change the priority of the anti-spam policy after you create it. In PowerShell, you can override the default priority when you create the spam filter rule (which can affect the priority of existing rules). - Anti-spam policies are processed in the order that they're displayed (the first policy has the **Priority** value 0). The default anti-spam policy has the priority value **Lowest**, and you can't change it. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>. 2. On the **Anti-spam policies** page, select a select a policy with the **Type value** of **Custom anti-spam policy** from the list by clicking on the name. To change the priority of a policy, you click **Increase priority** or **Decreas When you use the Microsoft 365 Defender portal to remove a custom anti-spam policy, the spam filter rule and the corresponding spam filter policy are both deleted. You can't remove the default anti-spam policy. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>. 2. On the **Anti-spam policies** page, select a policy with the **Type value** of **Custom anti-spam policy** from the list by clicking on the name. At the top of the policy details flyout that appears, click  **More actions** \>  **Delete policy**. |
| security | Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/defender-for-office-365.md | - - admindeeplinkDEFENDER - intro-overview description: Microsoft Defender for Office 365 includes Safe Attachments, Safe Links, advanced anti-phishing tools, reporting tools and threat intelligence capabilities. ms.technology: mdo The following table summarizes what's included in each plan. ## Configure Microsoft Defender for Office 365 policies -With Microsoft Defender for Office 365, your organization's security team can configure protection by defining policies in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> \> **Email & collaboration** \> **Policies & rules** \> **Threat policies**). +With Microsoft Defender for Office 365, your organization's security team can configure protection by defining policies in the Microsoft 365 Defender portal at <https://security.microsoft.com> at **Email & collaboration** \> **Policies & rules** \> **Threat policies**. Or, you can go directly to the **Threat policies** page by using <https://security.microsoft.com/threatpolicy>. Learn more by watching [this video](https://www.youtube.com/watch?v=vivvTmWJ_3c). The policies that are defined for your organization determine the behavior and p ## View Microsoft Defender for Office 365 reports -Microsoft Defender for Office 365 includes [reports](view-reports-for-mdo.md) to monitor Defender for Office 365. You can access the reports in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> at **Reports** \> **Email & collaboration** \> **Email & collaboration reports** or directly at <https://security.microsoft.com/securityreports>. +Microsoft Defender for Office 365 includes [reports](view-reports-for-mdo.md) to monitor Defender for Office 365. You can access the reports in theMicrosoft 365 Defender portal at <https://security.microsoft.com> at **Reports** \> **Email & collaboration** \> **Email & collaboration reports**. Or, you can go directly to the **Email and collaboration reports** page using <https://security.microsoft.com/securityreports>. Reports update in real-time, providing you with the latest insights. These reports also provide recommendations and alert you to imminent threats. Predefined reports include the following: |
| security | Detect And Remediate Illicit Consent Grants | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants.md | search.appverid: description: Learn how to recognize and remediate the illicit consent grants attack in Microsoft 365. - seo-marvel-apr2020-- admindeeplinkDEFENDER ms.technology: mdo ms.prod: m365-security You need to search the **audit log** to find signs, also called Indicators of Co ### Steps for finding signs of this attack -1. Open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a> and then select **Audit**. Or, to go directly to the **Audit** page, use <https://security.microsoft.com/auditlogsearch>. +1. Open the Microsoft 365 Defender portal at <https://security.microsoft.com> and then select **Audit**. Or, to go directly to the **Audit** page, use <https://security.microsoft.com/auditlogsearch>. 2. On the **Audit** page, verify that the **Search** tab is selected, and then configure the following settings: - **Date and time range** |
| security | Email Security In Microsoft Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-security-in-microsoft-defender.md | This article explains how to view and investigate malware and phishing attempts To see malware detected in email sorted by Microsoft 365 technology, use the [**Email \> Malware**](threat-explorer-views.md#email--malware) view of Explorer (or Real-time detections). Malware is the default view, so it might be selected as soon as you open Explorer. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, choose **Email & collaboration** \> **Explorer** (or **Real-time detections**; This example uses Explorer). +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration**, and then choose **Explorer** or **Real-time detections**. To go directly to the page, use <https://security.microsoft.com/threatexplorer> or <https://security.microsoft.com/realtimereports>. ++ This example uses **Explorer**. From here, start at the View, choose a particular frame of time to investigate (if needed), and focus your filters, as per the [Explorer walk- through](threat-hunting-in-threat-explorer.md#threat-explorer-walk-through). You can use the **Report clean** option in Explorer to report a message as false You can view phishing attempts through URLs in email, including a list of URLs that were allowed, blocked, and overridden. To identify URLs that were clicked, [Safe Links](safe-links.md) must be configured. Make sure that you set up [Safe Links policies](set-up-safe-links-policies.md) for time-of-click protection and logging of click verdicts by Safe Links. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, choose **Email & collaboration** \> **Explorer** (or **Real-time detections**; This example uses Explorer). -, choose **Email & collaboration** \> **Explorer** (or **Real-time detections**; This example uses Explorer). +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration**, and then choose **Explorer** or **Real-time detections**. To go directly to the page, use <https://security.microsoft.com/threatexplorer> or <https://security.microsoft.com/realtimereports>. ++ This example uses **Explorer**. 2. In the **View** drop down list, choose **Email** \> **Phish**. |
| security | Find And Release Quarantined Messages As A User | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/find-and-release-quarantined-messages-as-a-user.md | - - admindeeplinkDEFENDER description: Users can learn how to view and manage quarantined messages in Exchange Online Protection (EOP) that should have been delivered to them. ms.technology: mdo ms.prod: m365-security You view and manage your quarantined messages in the Microsoft 365 Defender port ## What do you need to know before you begin? -- To open the Microsoft 365 Defender portal, go to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To open the **Quarantine** page directly, use <https://security.microsoft.com/quarantine>.+- To open the Microsoft 365 Defender portal, go to <https://security.microsoft.com>. To go directly to the **Quarantine** page, use <https://security.microsoft.com/quarantine>. - Admins can configure how long messages are kept in quarantine before they're permanently deleted in anti-spam policies. Messages that have expired from quarantine are unrecoverable. For more information, see [Configure anti-spam policies in EOP](configure-your-spam-filter-policies.md). You view and manage your quarantined messages in the Microsoft 365 Defender port > [!NOTE] > Your ability to view quarantined messages is controlled by the [quarantine policy](quarantine-policies.md) that applies to the quarantined message type (which might be the [default quarantine policy for the quarantine reason](quarantine-policies.md#step-2-assign-a-quarantine-policy-to-supported-features)). -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & collaboration** \> **Review** \> **Quarantine**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Review** \> **Quarantine**. To go directly to the **Quarantine** page, use <https://security.microsoft.com/quarantine>. + 2. On the **Quarantine** page, you can sort the results by clicking on an available column header. Click **Customize columns** to change the columns that are shown. The default values are marked with an asterisk (<sup>\*</sup>): - **Time received**<sup>\*</sup> |
| security | Impersonation Insight | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/impersonation-insight.md | You can use the impersonation insight in the Microsoft 365 Defender portal to qu ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To go directly to the impersonation insight on the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. To go directly to the **Impersonation insight** page, use <https://security.microsoft.com/impersonationinsight>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. To go directly to the **Impersonation insight** page, use <https://security.microsoft.com/impersonationinsight>. - You need to be assigned permissions in the Microsoft 365 Defender portal before you can do the procedures in this article: - **Organization Management** You can use the impersonation insight in the Microsoft 365 Defender portal to qu ## Open the impersonation insight in the Microsoft 365 Defender portal -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. 2. On the **Anti-phishing** page, the impersonation insight looks like this: |
| security | Integrate Office 365 Ti With Mde | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/integrate-office-365-ti-with-mde.md | |
| security | Investigate Malicious Email That Was Delivered | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/investigate-malicious-email-that-was-delivered.md | To perform certain actions, such as viewing message headers or downloading email |Activity|Role group|Preview role needed?| ||||-|Use Threat Explorer (and Real-time detections) to analyze threats |Global Administrator <p> Security Administrator <p> Security Reader|No| -|Use Threat Explorer (and Real-time detections) to view headers for email messages as well as preview and download quarantined email messages|Global Administrator <p> Security Administrator <p> Security Reader|No| -|Use Threat Explorer to view headers, preview email (only in the email entity page) and download email messages delivered to mailboxes|Global Administrator <p> Security Administrator <p> Security Reader <p> Preview|Yes| +|Use Threat Explorer (and Real-time detections) to analyze threats|Global Administrator <p> Security Administrator <p> Security Reader|No| +|Use Threat Explorer (and Real-time detections) to view headers for email messages as well as preview and download quarantined email messages|Global Administrator <p> Security Administrator <p> Security Reader|No| +|Use Threat Explorer to view headers, preview email (only in the email entity page) and download email messages delivered to mailboxes|Global Administrator <p> Security Administrator <p> Security Reader <p> Preview|Yes| | > [!NOTE]-> *Preview* is a role, not a role group. The Preview role must be added to an existing role group in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. Go to **Permissions**, and then either edit an existing role group or add a new role group with the **Preview** role assigned. +> **Preview** is a role, not a role group. The Preview role must be added to an existing role group or a new role group in the Microsoft 365 Defender portal. For more information, see [Permissions in the Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md). >-> The Global Administrator role is assigned the Microsoft 365 admin center (<https://admin.microsoft.com>), and the Security Administrator and Security Reader roles are assigned in <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. To learn more about roles and permissions, see [Permissions in the Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md). +> The Global Administrator role is assigned the Microsoft 365 admin center at <https://admin.microsoft.com>. The Security Administrator and Security Reader roles are assigned in Microsoft 365 Defender portal. -We understand previewing and downloading email are sensitive activities, and so we auditing is enabled for these. Once an admin performs these activities on emails, audit logs are generated for the same and can be seen in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. Go to **Audit** \> **Search** tab, and filter on the admin name in **Users** box. The filtered results will show activity **AdminMailAccess**. Select a row to view details in the **More information** section about previewed or downloaded email. +We understand previewing and downloading email are sensitive activities, so auditing is enabled for these activities. Once an admin performs these activities on email, audit logs are generated for the same and can be seen in the Microsoft 365 Defender portal at <https://security.microsoft.com> at **Audit** \> **Search** tab, and filter on the admin name in **Users** box. The filtered results will show activity **AdminMailAccess**. Select a row to view details in the **More information** section about previewed or downloaded email. ## Find suspicious email that was delivered Threat Explorer is a powerful report that can serve multiple purposes, such as f > [!NOTE] > Default searches in Explorer don't currently include delivered items that were removed from the cloud mailbox by zero-hour auto purge (ZAP). This limitation applies to all views (for example, the **Email \> Malware** or **Email \> Phish** views). To include items removed by ZAP, you need to add a **Delivery action** set to include **Removed by ZAP**. If you include all options, you'll see all delivery action results, including items removed by ZAP. -1. Open the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> and sign in using your work or school account for Office 365. --2. Go to **Threat Explorer** by choosing **Email & collaboration** \> **Explorer** in the left navigation. To go to **Threat Explorer** directly, use <https://security.microsoft.com/threatexplorer>. +1. In the Microsoft 365 Defender portal at <https://security.microsofot.com>, go to **Email & collaboration** \> **Explorer** . To go directly to the **Explorer** page, use <https://security.microsoft.com/threatexplorer>. On the **Explorer** page, the **Additional actions** column shows admins the outcome of processing an email. The **Additional actions** column can be accessed in the same place as **Delivery action** and **Delivery location**. Special actions might be updated at the end of Threat Explorer's email timeline, which is a new feature aimed at making the hunting experience better for admins. -3. In the **View** menu, choose **Email** \> **All email** from the drop down list. +2. In the **View** menu, choose **Email** \> **All email** from the drop down list.  |
| security | Learn About Spoof Intelligence | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/learn-about-spoof-intelligence.md | - - admindeeplinkDEFENDER description: Admins can learn about the spoof intelligence insight in Exchange Online Protection (EOP). ms.technology: mdo ms.prod: m365-security By allowing known senders to send spoofed messages from known locations, you can Likewise, you can review spoofed senders that were allowed by spoof intelligence and manually block those senders from the spoof intelligence insight. -The rest of this article explains how to use the spoof intelligence insight in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> and in PowerShell (Exchange Online PowerShell for Microsoft 365 organizations with mailboxes in Exchange Online; standalone EOP PowerShell for organizations without Exchange Online mailboxes). +The rest of this article explains how to use the spoof intelligence insight in the Microsoft 365 Defender portal and in PowerShell (Exchange Online PowerShell for Microsoft 365 organizations with mailboxes in Exchange Online; standalone EOP PowerShell for organizations without Exchange Online mailboxes). > [!NOTE] > The rest of this article explains how to use the spoof intelligence insight in t ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com/</a>. To go directly to the **Spoofing** tab on the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. To go directly to the **Spoof intelligence insight** page, use <https://security.microsoft.com/spoofintelligence>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Spoofing** tab on the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. To go directly to the **Spoof intelligence insight** page, use <https://security.microsoft.com/spoofintelligence>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). To connect to standalone EOP PowerShell, see [Connect to Exchange Online Protection PowerShell](/powershell/exchange/connect-to-exchange-online-protection-powershell). The rest of this article explains how to use the spoof intelligence insight in t ## Open the spoof intelligence insight in the Microsoft 365 Defender portal -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Tenant Allow/Block Lists** in the **Rules** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Tenant Allow/Block Lists** in the **Rules** section. To go directly to the **Spoofing** tab on the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. 2. On the **Tenant Allow/Block Lists** page, the spoof intelligence insight looks like this: |
| security | Mail Flow Intelligence In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mail-flow-intelligence-in-office-365.md | Typically, this error means Microsoft 365 encountered a connection error when it - If no more messages should be delivered to your on-premises environment, click **Fix now** in the alert so Microsoft 365 can immediately reject the messages with invalid recipients. This will reduce the risk of exceeding your organization's quota for invalid recipients, which could impact normal message delivery. Or, you can use the following instructions to manually fix the issue: - - In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a>, disable or delete the connector that delivers email from Microsoft 365 to your on-premises email environment: + - In the Exchange admin center, disable or delete the connector that delivers email from Microsoft 365 to your on-premises email environment: - 1. In the EAC, go to **Mail flow** \> **Connectors**. + 1. In the EAC at <https://admin.exchange.microsoft.com>, go to **Mail flow** \> **Connectors**. To go directly to the **Connectors** page, use <https://admin.exchange.microsoft.com/#/connectors>. 2. Select the connector with the **From** value **Office 365** and the **To** value **Your organization's email server** and do one of the following steps: - Delete the connector by clicking **Delete**  |
| security | Manage Quarantined Messages And Files | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/manage-quarantined-messages-and-files.md | - - admindeeplinkDEFENDER description: Admins can learn how to view and manage quarantined messages for all users in Exchange Online Protection (EOP). Admins in organizations with Microsoft Defender for Office 365 can also manage quarantined files in SharePoint Online, OneDrive for Business, and Microsoft Teams. ms.technology: mdo ms.prod: m365-security You view and manage quarantined messages in the Microsoft 365 Defender portal or ## What do you need to know before you begin? -- To open the Microsoft 365 Defender portal, go to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To open the **Quarantine** page directly, use <https://security.microsoft.com/quarantine>.+- To open the Microsoft 365 Defender portal, go to <https://security.microsoft.com>. To go directly to the **Quarantine** page, use <https://security.microsoft.com/quarantine>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). To connect to standalone EOP PowerShell, see [Connect to Exchange Online Protection PowerShell](/powershell/exchange/connect-to-exchange-online-protection-powershell). You view and manage quarantined messages in the Microsoft 365 Defender portal or ### View quarantined email -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & collaboration** \> **Review** \> **Quarantine**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Review** \> **Quarantine**. To go directly to the **Quarantine** page, use <https://security.microsoft.com/quarantine>. + 2. On the **Quarantine** page, verify that the **Email** tab is selected. 3. You can sort the results by clicking on an available column header. Click **Customize columns** to change the columns that are shown. The default values are marked with an asterisk (<sup>\*</sup>): In organizations with Defender for Office 365, admins can manage files that were ### View quarantined files -1. In the<a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & collaboration** \> **Review** \> **Quarantine**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Review** \> **Quarantine**. To go directly to the **Quarantine** page, use <https://security.microsoft.com/quarantine>. + 2. On the **Quarantine** page, select the **Files** tab (**Email** is the default tab). 3. You can sort the results by clicking on an available column header. Click **Customize columns** to change the columns that are shown. The default columns are marked with an asterisk (<sup>\*</sup>): |
| security | Mdo Email Entity Page | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-email-entity-page.md | Admins of Microsoft Defender for Office 365 E5, and Defender for Office P1 and P ## Reach the email entity page -The email entity page is available in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> at **Email & collaboration** \> **Explorer**. Or, to go directly to the **Explorer** page, use <https://security.microsoft.com/threatexplorer>. +The email entity page is available in the Microsoft 365 Defender portal at <https://security.microsoft.com> at **Email & collaboration** \> **Explorer**. Or, to go directly to the **Explorer** page, use <https://security.microsoft.com/threatexplorer>. In **Explorer**, select the subject of an email you're investigating. A gold bar will display at the top of the email fly-out for that mail. This invitation to the new page, reads 'Try out our new email entity page with enriched data...'. Select to view the new page. Users will see enriched detonation details for known malicious attachments or UR *Email details*: Details required for a deeper understanding of email available in the *Analysis* tab. -- *Exchange transport rules (also known as mail flow rules or ETRs)*: These rules are applied to a message at the transport layer and take precedence over phish and spam verdicts. These can be only created and modified in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a>, but if any ETR applies to a message, the ETR name and GUID will be shown here. Valuable information for tracking purposes.+- *Exchange transport rules (also known as mail flow rules or ETRs)*: These rules are applied to a message at the transport layer and take precedence over phish and spam verdicts. Mail flow rules are created and modified in the Exchange admin center at <https://admin.exchange.microsoft.com/#/transportrules>, but if any mail flow rule applies to a message, the rule name and GUID will be shown here. Valuable information for tracking purposes. - *System Overrides*: This is a means of making exceptions to the delivery location intended for a message by overriding the delivery location given by system (as per the threat and detection tech). |
| security | Message Trace Scc | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/message-trace-scc.md | ms.localizationpriority: medium ms.assetid: 3e64f99d-ac33-4aba-91c5-9cb4ca476803 - seo-marvel-apr2020- - admindeeplinkDEFENDER - - admindeeplinkEXCHANGE description: Admins can use the message trace link in the Microsoft 365 Defender portal to find out what happened to messages. ms.technology: mdo ms.prod: m365-security ms.prod: m365-security - [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) - [Microsoft 365 Defender](../defender/microsoft-365-defender.md) -Message trace in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> follows email messages as they travel through your Exchange Online organization. You can determine if a message was received, rejected, deferred, or delivered by the service. It also shows what actions were taken on the message before it reached its final status. +Message trace follows email messages as they travel through your Exchange Online organization. You can determine if a message was received, rejected, deferred, or delivered by the service. It also shows what actions were taken on the message before it reached its final status. You can use the information from message trace to efficiently answer user questions about what happened to messages, troubleshoot mail flow issues, and validate policy changes. > [!NOTE]-> Message trace in the Microsoft 365 Defender portal is just a pass through to Message trace in the Exchange admin center. For more information, see [Message trace in the modern <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a>](/exchange/monitoring/trace-an-email-message/message-trace-modern-eac). +> Message trace in the Microsoft 365 Defender portal is just a pass through to Message trace in the Exchange admin center. For more information, see [Message trace in the modern Exchange admin center](/exchange/monitoring/trace-an-email-message/message-trace-modern-eac). ## What do you need to know before you begin? You can use the information from message trace to efficiently answer user questi ## Open message trace -In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & collaboration** \> **Exchange message trace**. Or, to go directly to the message trace page, use <https://admin.exchange.microsoft.com/#/messagetrace>. +In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Exchange message trace**. To go directly to the message trace page, use <https://admin.exchange.microsoft.com/#/messagetrace>. At this point, message trace in the EAC opens. For more information, see [Message trace in the modern Exchange admin center](/exchange/monitoring/trace-an-email-message/message-trace-modern-eac). |
| security | Mfi Queue Alerts And Queues | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mfi-queue-alerts-and-queues.md | Even if the queued message volume hasn't exceeded the threshold and generated an If you click the number of messages on the widget, a **Messages queued** flyout appears with the following information: - **Number of queued messages**-- **Connector name**: Select the connector name to manage the connector in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center (EAC)</a>.+- **Connector name**: Select the connector name to manage the connector in the Exchange admin center (EAC) at <https://admin.exchange.microsoft.com/#/connectors>. - **Queue started time** - **Oldest messages expired** - **Destination server** |
| security | Mfi Slow Mail Flow Rules Insight | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mfi-slow-mail-flow-rules-insight.md | ms.localizationpriority: medium ms.assetid: 37125cdb-715d-42d0-b669-1a8efa140813 - seo-marvel-apr2020- - admindeeplinkEXCHANGE description: Admins can learn how to use the Fix slow mail flow rules insight in the Security & Compliance Center to identify and fix inefficient or broken mail flow rules (also known as transport rules) in their organization. ms.technology: mdo ms.prod: m365-security You can use this notification to help you to identify and fine-tune mail flow ru When you click **View details** on the widget, a flyout appears with more information: -- **Rule**: You can hover over the summary to see all of the conditions, exceptions, and actions of the rule. You can click on the summary to edit the rule in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center (EAC)</a>.+- **Rule**: You can hover over the summary to see all of the conditions, exceptions, and actions of the rule. You can click on the summary to edit the rule in the Exchange admin center (EAC) at <https://admin.exchange.microsoft.com/#/transportrules>. - **Number of messages evaluated**: You can click **View sample messages** to see the [message trace](message-trace-scc.md) results for a sample of the messages that were affected by the rule. - **Average time spent on each message** - **Median time spent on a message**: The middle value that separates the upper half from the lower half of time data. |
| security | Office 365 Air | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/office-365-air.md | description: Get started using automated investigation and response capabilities - air - seo-marvel-mar2020-- admindeeplinkDEFENDER ms.technology: mdo ms.prod: m365-security If you're already using AIR capabilities in Microsoft Defender for Office 365, y :::image type="content" source="../../media/m3d-action-center-unified.png" alt-text="Unified Action center."::: -The new and improved <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> brings together AIR capabilities in [Microsoft Defender for Office 365](defender-for-office-365.md) and in [Microsoft Defender for Endpoint](../defender-endpoint/automated-investigations.md). With these updates and improvements, your security operations team will be able to view details about automated investigations and remediation actions across your email, collaboration content, user accounts, and devices, all in one place. +The new and improved Microsoft 365 Defender portal <https://security.microsoft.com> brings together AIR capabilities in [Microsoft Defender for Office 365](defender-for-office-365.md) and in [Microsoft Defender for Endpoint](../defender-endpoint/automated-investigations.md). With these updates and improvements, your security operations team will be able to view details about automated investigations and remediation actions across your email, collaboration content, user accounts, and devices, all in one place. > [!TIP]-> The new <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> replaces the following centers: +> The new Microsoft 365 Defender portal replaces the following admin centers: > > - Security & Compliance Center (<https://protection.office.com>) > - Microsoft Defender Security Center (<https://securitycenter.windows.com>) |
| security | Office 365 Evaluation | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/office-365-evaluation.md | Title: Evaluate Microsoft Defender for Office 365 -description: Defender for Office 365 in evaluation mode creates Defender for Office 365 email policies that log verdicts, such as malware, but don't act on messages. +description: Defender for Office 365 in evaluation mode creates Defender for Office 365 email policies that log verdicts, such as malware, but don't act on messages. keywords: evaluate Office 365, Microsoft Defender for Office 365, office 365 evaluation, try office 365, Microsoft Defender, Microsoft Defender for Endpoint f1.keywords: - NOCSH The [Microsoft Defender for Office 365](defender-for-office-365.md) evaluation e If you don't already have a license that supports Microsoft Defender for Office 365, you can start a [free 30-day evaluation](https://admin.microsoft.com/AdminPortal/Home#/catalog/offer-details/microsoft-defender-for-office-365-plan-2-/223860DC-15D6-42D9-A861-AE05473069FA) and test the capabilities in the Microsoft 365 Defender portal at <https://security.microsoft.com>. You'll enjoy the quick set-up and you can easily turn it off if necessary. > [!NOTE]-> If you're in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, you can start a Defender for Office 365 evaluation here: **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Evaluation mode** in the **Others** section. +> If you're in the Microsoft 365 Defender portal at <https://security.microsoft.com>, you can start a Defender for Office 365 evaluation here: **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Evaluation mode** in the **Others** section. Or, to go directly to the **Evaluation mode** page, use <https://security.microsoft.com/atpEvaluation>. ## How the evaluation works -Defender for Office 365 in evaluation mode creates Defender for Office 365 email policies that log verdicts, such as malware, but don't act on messages. You are not required to change your MX record configuration. +Defender for Office 365 in evaluation mode creates Defender for Office 365 email policies that log verdicts, such as malware, but don't act on messages. You are not required to change your MX record configuration. -With evaluation mode, [Safe Attachments](safe-attachments.md), [Safe Links](safe-links.md), and [mailbox intelligence in anti-pishing policies](set-up-anti-phishing-policies.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365) are set up on your behalf. All Defender for Office 365 policies is created in non-enforcement mode in the background and are not visible to you. +With evaluation mode, [Safe Attachments](safe-attachments.md), [Safe Links](safe-links.md), and [mailbox intelligence in anti-pishing policies](set-up-anti-phishing-policies.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365) are set up on your behalf. All Defender for Office 365 policies is created in non-enforcement mode in the background and are not visible to you. -As part of the setup, evaluation mode also configures [Enhanced Filtering for Connectors](/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) (also known as _skip listing_). It improves filtering accuracy by preserving IP address and sender information, which are otherwise lost when mail passes through an email security gateway (ESG) in front of Defender for Office 365. Enhanced Filtering for Connectors also improves the filtering accuracy for your existing Exchange Online Protection (EOP) anti-spam and anti-phishing policies. +As part of the setup, evaluation mode also configures [Enhanced Filtering for Connectors](/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) (also known as _skip listing_). It improves filtering accuracy by preserving IP address and sender information, which are otherwise lost when mail passes through an email security gateway (ESG) in front of Defender for Office 365. Enhanced Filtering for Connectors also improves the filtering accuracy for your existing Exchange Online Protection (EOP) anti-spam and anti-phishing policies. -Enhanced Filtering for Connectors improves filtering accuracy but may alter deliverability for certain messages if you have an ESG in front of Defender for Office 365, and currently do not bypass EOP filtering. The impact is limited to EOP policies; Defender for Office 365 policies set up as part of the evaluation are created in non-enforcement mode. To minimize potential production impact, you can bypass most EOP filtering by creating a mail flow rule (also known as a transport rule) to set the spam confidence level (SCL) of messages to -1. See [Use mail flow rules to set the spam confidence level (SCL) in messages in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl) for details. +Enhanced Filtering for Connectors improves filtering accuracy but may alter deliverability for certain messages if you have an ESG in front of Defender for Office 365, and currently do not bypass EOP filtering. The impact is limited to EOP policies; Defender for Office 365 policies set up as part of the evaluation are created in non-enforcement mode. To minimize potential production impact, you can bypass most EOP filtering by creating a mail flow rule (also known as a transport rule) to set the spam confidence level (SCL) of messages to -1. See [Use mail flow rules to set the spam confidence level (SCL) in messages in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl) for details. When the evaluation mode is set up, you will have a report updated daily with up to 90 days of data quantifying the messages that would have been blocked if the policies were implemented (for example, delete, send to junk, quarantine). Reports are generated for all Defender for Office 365 and EOP detections. They are aggregated per detection technology (for example, impersonation) and can be filtered by time range. Additionally, message reports can be created on-demand to create custom pivots or to deep dive messages using Explorer. With the simplified set-up experience, you can focus on: ### Licensing -To access the evaluation, you'll need to meet the licensing requirements. Any of the following licenses will work: +To access the evaluation, you'll need to meet the licensing requirements. Any of the following licenses will work: - Microsoft Defender for Office 365 Plan 1 - Microsoft Defender for Office 365 Plan 2 URL links in the email message bodies won't wrap, to lessen customer impact. ### Email routing -Prepare the corresponding details that you will need to set up how your email is currently routed, including the name of the inbound connector that routes your mail. If you are just using Exchange Online Protection, you won't have a connector. [Learn about mail flow and email routing](/office365/servicedescriptions/exchange-online-service-description/mail-flow) +Prepare the corresponding details that you will need to set up how your email is currently routed, including the name of the inbound connector that routes your mail. If you are just using Exchange Online Protection, you won't have a connector. [Learn about mail flow and email routing](/office365/servicedescriptions/exchange-online-service-description/mail-flow) Supported email routing scenarios include: You will be able to scope the evaluation to an inbound connector. If there's no ## Get started with the evaluation -Find the Microsoft Defender for Office 365 evaluation set-up card in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> from three access points: +Find the Microsoft Defender for Office 365 evaluation set-up card in the Microsoft 365 Defender portal from the following access points: - **Endpoints** \> **Vulnerability Management** \> **Dashboard** (<https://security.microsoft.com/tvm_dashboard>) - **Email & collaboration** \> **Policies & rules** \> **Threat policies** (<https://security.microsoft.com/threatpolicy>) Your Microsoft Defender for Office 365 evaluation report is generated once per d ### Exchange mail flow rules (optional) -If you have an existing gateway, enabling evaluation mode will activate Enhanced Filtering for Connectors. This feature improves filtering accuracy by altering the incoming sender IP address. This feature might change the filter verdicts, and if you are not bypassing Exchange Online Protection, this may alter deliverability for certain messages. In this case, you might want to temporarily bypass filtering to analyze impact. To bypass filtering, open the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a> and create a mail flow rule that sets the SCL of messages to -1 (if you don't already have one). For instructions, see [Use mail flow rules to set the spam confidence level (SCL) in messages in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl). +If you have an existing gateway, enabling evaluation mode will activate Enhanced Filtering for Connectors. This feature improves filtering accuracy by altering the incoming sender IP address. This feature might change the filter verdicts, and if you are not bypassing Exchange Online Protection, this may alter deliverability for certain messages. In this case, you might want to temporarily bypass filtering to analyze impact. To bypass filtering, create a mail flow rule (also known as a transport rule) in the Exchange admin center (EAC) at <https://admin.exchange.microsoft.com/#/transportrules> that sets the SCL of messages to -1 (if you don't already have one). For instructions, see [Use mail flow rules to set the spam confidence level (SCL) in messages in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl). ## Evaluate capabilities |
| security | Office 365 Ti | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/office-365-ti.md | - - admindeeplinkDEFENDER description: Learn about threat investigation and response capabilities in Microsoft Defender for Office 365 Plan. ms.technology: mdo ms.prod: m365-security ms.prod: m365-security Threat investigation and response capabilities in [Microsoft Defender for Office 365](defender-for-office-365.md) help security analysts and administrators protect their organization's Microsoft 365 for business users by: -- Making it easy to identify, monitor, and understand cyberattacks-- Helping to quickly address threats in Exchange Online, SharePoint Online, OneDrive for Business and Microsoft Teams-- Providing insights and knowledge to help security operations prevent cyberattacks against their organization-- Employing [automated investigation and response in Office 365](automated-investigation-response-office.md) for critical email-based threats+- Making it easy to identify, monitor, and understand cyberattacks. +- Helping to quickly address threats in Exchange Online, SharePoint Online, OneDrive for Business and Microsoft Teams. +- Providing insights and knowledge to help security operations prevent cyberattacks against their organization. +- Employing [automated investigation and response in Office 365](automated-investigation-response-office.md) for critical email-based threats. Threat investigation and response capabilities provide insights into threats and related response actions that are available in the Microsoft 365 Defender portal. These insights can help your organization's security team protect users from email- or file-based attacks. The capabilities help monitor signals and gather data from multiple sources, such as user activity, authentication, email, compromised PCs, and security incidents. Business decision makers and your security operations team can use this information to understand and respond to threats against your organization and protect your intellectual property. ## Get acquainted with threat investigation and response tools -Threat investigation and response capabilities surface in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, as a set of tools and response workflows, including the following: +Threat investigation and response capabilities in the Microsoft 365 Defender portal at <https://security.microsoft.com> are a set of tools and response workflows that include: - [Explorer](#explorer) - [Incidents](#incidents) Use [Explorer (and real-time detections)](threat-explorer.md) to analyze threats  -To view and use this report, in the Microsoft 365 Defender portal, go to **Email & collaboration** > **Explorer**. +To view and use this report in the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Explorer**. Or, to go directly to the **Explorer** page, use <https://security.microsoft.com/threatexplorer>. ### Incidents Use the Incidents list (this is also called Investigations) to see a list of in  -To view the list of current incidents for your organization, in the Microsoft 365 Defender portal, go to **Incidents & alerts** > **Incidents**. +To view the list of current incidents for your organization in the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Incidents & alerts** \> **Incidents**. Or, to go directly to the **Incidents** page, use <https://security.microsoft.com/incidents>.  To view the list of current incidents for your organization, in the Microsoft 36 Use Attack simulation training to set up and run realistic cyberattacks in your organization, and identify vulnerable people before a real cyberattack affects your business. To learn more, see [Simulate a phishing attack](attack-simulation-training.md). -To view and use this feature in the Microsoft 365 Defender portal, go to **Email & collaboration** > **Attack simulation training**. +To view and use this feature in the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** > **Attack simulation training**. Or, to go directly to the **Attack simulation training** page, use <https://security.microsoft.com/attacksimulator?viewid=overview>. ### Automated investigation and response |
| security | Permissions In The Security And Compliance Center | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center.md | search.appverid: description: Admins can learn about the permissions that are available in the Security & Compliance Center in Microsoft 365. - seo-marvel-apr2020-- admindeeplinkEXCHANGE ms.technology: mdo ms.prod: m365-security The Security & Compliance Center includes default role groups for the most commo The following table lists the default role groups that are available in the Security & Compliance Center, and the roles that are assigned to the role groups by default. To grant permissions to a user to perform a compliance task, add them to the appropriate Security & Compliance Center role group. -Managing permissions in the Security & Compliance Center only gives users access to the compliance features that are available within the Security & Compliance Center itself. If you want to grant permissions to other compliance features that aren't in the Security & Compliance Center, such as Exchange mail flow rules (also known as transport rules), you need to use the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a>. +Managing permissions in the Security & Compliance Center only gives users access to the compliance features that are available within the Security & Compliance Center itself. If you want to grant permissions to other compliance features that aren't in the Security & Compliance Center, such as Exchange mail flow rules (also known as transport rules), you need to use the Exchange admin center (EAC). For more information, see [Permissions in Exchange Online](/exchange/permissions-exo/permissions-exo). To see how to grant access to the Security & Compliance Center, check out [Give users access to Microsoft 365 Compliance admin center](grant-access-to-the-security-and-compliance-center.md). |
| security | Permissions Microsoft 365 Security Center | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/permissions-microsoft-365-security-center.md | search.appverid: description: Admins can learn how to manage permissions in the Microsoft 365 Defender portal for all tasks related to security. - seo-marvel-apr2020-- admindeeplinkDEFENDER ms.technology: mdo ms.prod: m365-security ms.prod: m365-security You need to manage security scenarios that span all the Microsoft 365 services. And you need the flexibility to give the right admin permissions to the right people in your organization. -The Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a> supports directly managing permissions for users who perform security tasks in Microsoft 365. By using the Microsoft 365 Defender portal to manage permissions, you can manage permissions centrally for all tasks related to security. +The Microsoft 365 Defender portal at <https://security.microsoft.com> supports directly managing permissions for users who perform security tasks in Microsoft 365. By using the Microsoft 365 Defender portal to manage permissions, you can manage permissions centrally for all tasks related to security. To manage permissions in the Microsoft 365 Defender portal, go to **Permissions & roles** or <https://security.microsoft.com/securitypermissions>. You need to be a **global administrator** or a member of the **Organization Management** role group in the Microsoft 365 Defender portal. Specifically, the **Role Management** role allows users to view, create, and modify role groups in the Microsoft 365 Defender portal, and by default, that role is assigned only to the **Organization Management** role group. To manage permissions in the Microsoft 365 Defender portal, go to **Permissions ## Relationship of members, roles, and role groups -Permissions in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> are based on the role-based access control (RBAC) permissions model. RBAC is the same permissions model that's used by most Microsoft 365 services, so if you're familiar with the permission structure in these services, granting permissions in the Microsoft 365 Defender portal will be very familiar. +Permissions in the Microsoft 365 Defender portal are based on the role-based access control (RBAC) permissions model. RBAC is the same permissions model that's used by most Microsoft 365 services, so if you're familiar with the permission structure in these services, granting permissions in the Microsoft 365 Defender portal will be very familiar. A **role** grants the permissions to do a set of tasks. A **role group** is a set of roles that lets people do their jobs in the Microsoft 365 Defender portal. -The <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> includes default role groups for the most common tasks and functions that you'll need to assign. Generally, we recommend simply adding individual users as **members** to the default role groups. +The Microsoft 365 Defender portal> includes default role groups for the most common tasks and functions that you'll need to assign. Generally, we recommend simply adding individual users as **members** to the default role groups.  ## Roles and role groups in the Microsoft 365 Defender portal -The following types of roles and role groups are available in **Permissions & roles** in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>: +The following types of roles and role groups are available in on the **Permissions & roles** page at <https://security.microsoft.com/securitypermissions> in the Microsoft 365 Defender portal: - **Azure AD roles**: You can view the roles and assigned users, but you can't manage them directly in the Microsoft 365 Defender portal. Azure AD roles are central roles that assign permissions for **all** Microsoft 365 services. The following types of roles and role groups are available in **Permissions & ro ### Azure AD roles in the Microsoft 365 Defender portal -When you go to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> \> **Email & collaboration roles** \> **Permissions & roles** \> **Azure AD roles** \> **Roles** (or directly to <https://security.microsoft.com/aadpermissions>) you'll see the Azure AD roles that are described in this section. +When you open the Microsoft 365 Defender portal at <https://security.microsoft.com> and go to **Email & collaboration roles** \> **Permissions & roles** \> **Azure AD roles** \> **Roles** (or directly to <https://security.microsoft.com/aadpermissions>) you'll see the Azure AD roles that are described in this section. When you select a role, a details flyout that contains the description of the role and the user assignments appears. But to manage those assignments, you need to click **Manage members in Azure AD** in the details flyout. For more information, see [View and assign administrator roles in Azure Active D ### Email & collaboration roles in the Microsoft 365 Defender portal -When you go to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> \> **Email & collaboration roles** \> **Permissions & roles** \> **Email & collaboration roles** \> **Roles** (or directly to <https://security.microsoft.com/emailandcollabpermissions>) you'll see the same role groups that are available in the Security & Compliance Center. +When you open the Microsoft 365 Defender portal at <https://security.microsoft.com> and go to **Email & collaboration roles** \> **Permissions & roles** \> **Email & collaboration roles** \> **Roles** (or directly to <https://security.microsoft.com/emailandcollabpermissions>) you'll see the same role groups that are available in the Security & Compliance Center. For complete information about these role groups, see [Permissions in the Security & Compliance Center](permissions-in-the-security-and-compliance-center.md) #### Modify Email & collaboration role membership in the Microsoft 365 Defender portal -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & collaboration roles** \> **Permissions & roles** \> **Email & collaboration roles** \> **Roles**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration roles** \> **Permissions & roles** \> **Email & collaboration roles** \> **Roles**. To go directly to the **Permissions** page, use <https://security.microsoft.com/emailandcollabpermissions>. -2. In the **Permissions** page that opens, select the role group that you want to modify from the list. You can click on the **Name** column header to sort the list by name, or you can click **Search**  to find the role group. +2. On the **Permissions** page, select the role group that you want to modify from the list. You can click on the **Name** column header to sort the list by name, or you can click **Search**  to find the role group. 3. In the role group details flyout that appears, click **Edit** in the **Members** section. |
| security | Preset Security Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/preset-security-policies.md | For example, if a security setting exists in **Standard protection** and an admi ### What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To go directly to the **Preset security policies** page, use <https://security.microsoft.com/presetSecurityPolicies>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Preset security policies** page, use <https://security.microsoft.com/presetSecurityPolicies>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). For example, if a security setting exists in **Standard protection** and an admi ### Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Preset Security Policies** in the **Templated policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsofot.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Preset Security Policies** in the **Templated policies** section. To go directly to the **Preset security policies** page, use <https://security.microsoft.com/presetSecurityPolicies>. 2. On the **Preset security policies** page, click **Manage** in the **Standard protection** or **Strict protection** sections. Remember, the **Built-in protection** preset security policy is assigned to all Therefore, we typically don't recommend exceptions to the **Built-in protection** preset security policy. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Preset Security Policies** in the **Templated policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsofot.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Preset Security Policies** in the **Templated policies** section. To go directly to the **Preset security policies** page, use <https://security.microsoft.com/presetSecurityPolicies>. 2. On the **Preset security policies** page, select **Add exclusions (not recommended)** in the **Built-in protection** section. |
| security | Real Time Detections | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/real-time-detections.md | This article explains the difference between Explorer and real-time detections r If your organization has [Microsoft Defender for Office 365](defender-for-office-365.md), and you have the [permissions](#required-licenses-and-permissions), you can use **Explorer** (also known as **Threat Explorer**) or **Real-time detections** to detect and remediate threats. -In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & collaboration**, and then choose **Explorer** _or_ **Real-time detections**. +In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration**, and then choose **Explorer** _or_ **Real-time detections**. To go directly to the page, use <https://security.microsoft.com/threatexplorer> or <https://security.microsoft.com/realtimereports>. With these tools, you can: |
| security | Removing User From Restricted Users Portal After Spam | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/removing-user-from-restricted-users-portal-after-spam.md | audience: ITPro f1_keywords: - 'ms.exch.eac.ActionCenter.Restricted.Users.RestrictedUsers'- ms.localizationpriority: high search.appverid: - MET150 ms.prod: m365-security If a user exceeds one of the outbound sending limits as specified in [the service limits](/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits#sending-limits-across-office-365-options) or in [outbound spam policies](configure-the-outbound-spam-policy.md), the user is restricted from sending email, but they can still receive email. -The user is added to the **Restricted users** page in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. When they try to send email, the message is returned in a non-delivery report (also known as an NDR or bounce messages) with the error code [5.1.8](/Exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/fix-error-code-5-1-8-in-exchange-online) and the following text: +The user is added to the **Restricted users** page in the Microsoft 365 Defender portal. When they try to send email, the message is returned in a non-delivery report (also known as an NDR or bounce messages) with the error code [5.1.8](/Exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/fix-error-code-5-1-8-in-exchange-online) and the following text: > "Your message couldn't be delivered because you weren't recognized as a valid sender. The most common reason for this is that > your email address is suspected of sending spam and it's no longer allowed to send email. Contact your email admin for Admins can remove users from the Restricted users page in the Microsoft 365 Defe ## What do you need to know before you begin? -- You open the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. To go directly to the **Restricted users** page, use <https://security.microsoft.com/restrictedusers>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Restricted users** page, use <https://security.microsoft.com/restrictedusers>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). Admins can remove users from the Restricted users page in the Microsoft 365 Defe ## Use the Microsoft 365 Defender portal to remove a user from the Restricted users list -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & collaboration** \> **Review** \> **Restricted users**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Review** \> **Restricted users**. To go directly to the **Restricted users** page, use <https://security.microsoft.com/restrictedusers>. 2. On the **Restricted users** page, find and select the user that you want to unblock by clicking on the user. |
| security | Responding To A Compromised Email Account | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account.md | - - admindeeplinkMAC - - admindeeplinkDEFENDER - - admindeeplinkEXCHANGE ms.localizationpriority: high search.appverid: - MET150 Users might notice and report unusual activity in their Microsoft 365 mailboxes. - Mail forwarding was recently added. - An unusual signature was recently added, such as a fake banking signature or a prescription drug signature. -If a user reports any of the above symptoms, you should perform further investigation. The <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> and the Azure portal offer tools to help you investigate the activity of a user account that you suspect may be compromised. +If a user reports any of the above symptoms, you should perform further investigation. The Microsoft 365 Defender portal and the Azure portal offer tools to help you investigate the activity of a user account that you suspect may be compromised. -- **Unified audit logs in the Microsoft 365 Defender portal**: Review all the activities for the suspected account by filtering the results for the date range spanning from immediately before the suspicious activity occurred to the current date. Do not filter on the activities during the search.--- **Admin Audit logs in the EAC**: In Exchange Online, you can use the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center (EAC) </a> to search for and view entries in the administrator audit log. The administrator audit log records specific actions, based on Exchange Online PowerShell cmdlets, performed by administrators, and users who have been assigned administrative privileges. Entries in the administrator audit log provide you with information about what cmdlet was run, which parameters were used, who ran the cmdlet, and what objects were affected.+- **Unified audit logs in the Microsoft 365 Defender portal**: Review all the activities for the suspected account by filtering the results for the date range spanning from immediately before the suspicious activity occurred to the current date. Do not filter on the activities during the search. For more information, see [Search the audit log in the compliance center](../../compliance/search-the-audit-log-in-security-and-compliance.md). - **Azure AD Sign-in logs and other risk reports in the Azure AD portal**: Examine the values in these columns: - Review IP address Follow the procedures in [Reset a business password for someone](../../admin/add ### Step 2 Remove suspicious email forwarding addresses -1. Go to the Microsoft 365 admin center at <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">https://admin.microsoft.com</a>. +1. In the Microsoft 365 admin center at <https://admin.microsoft.com>, go to **Users** \> **Active users**. To go directly to the **Active users** page, use <https://admin.microsoft.com/Adminportal/Home#/users>. -2. Go to **Users** \> **Active users**. Find the user account in question, and select the user (row) without selecting the checkbox. +2. On the **Active users** page, find the user account in question, and select the user (row) without selecting the checkbox. 3. In the details flyout that appears, select the **Mail** tab. To unblock a mailbox from sending mail, follow the procedures in [Removing a use > [!IMPORTANT] > You can block the suspected compromised account from signing-in until you believe it is safe to re-enable access. -1. Go to the Microsoft 365 admin center at <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">https://admin.microsoft.com</a> and go to **Users** \> **Active users**. +1. In the Microsoft 365 admin center at <https://admin.microsoft.com>, go to **Users** \> **Active users**. To go directly to the **Active users** page, use <https://admin.microsoft.com/Adminportal/Home#/users>. -2. Find and select the user account, click , and then select **Edit sign-in status**. +2. On the **Active users** page, find and select the user account, click , and then select **Edit sign-in status**. 3. On the **Block sign-in** pane that appears, select **Block this user from signing in**, and then click **Save changes**. -4. Open the Exchange admin center (EAC), and go to **Recipients** \> <a href="https://go.microsoft.com/fwlink/?linkid=2183135" target="_blank">**Mailboxes**</a>. +4. In the Exchange admin center (EAC) at <https://admin.exchange.microsoft.com>, go to **Recipients** \> **Mailboxes**. To go directly to the **Mailboxes** page, use <https://admin.exchange.microsoft.com/#/mailboxes>. -5. Find and select the user. In the mailbox details flyout that opens, do the following steps: - - In the **Email apps** section, block all of the available settings by moving the toggle to the right : +5. On the **Mailboxes** page, find and select the user. In the mailbox details flyout that opens, do the following steps: + - In the **Email apps** section, select **Manage email apps settings**. In the **Manage settings for email apps** flyout that appears, block all of the available settings by moving the toggle to the right : - **Outlook on the web** - **Outlook desktop (MAPI)** - **Exchange Web Services** To unblock a mailbox from sending mail, follow the procedures in [Removing a use > [!NOTE] > Administrative role group membership can be restored after the account has been secured. -1. Go to the Microsoft 365 admin center at <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">https://admin.microsoft.com</a> with a global administrator account and do the following steps: - 1. Go to **Users** \> **Active users**. - 2. Find and select the user account, click , and then select **Manage roles**. +1. In the Microsoft 365 admin center at <https://admin.microsoft.com>, do the following steps: + 1. Go to **Users** \> **Active users**. To go directly to the **Active users** page, use <https://admin.microsoft.com/Adminportal/Home#/users>. + 2. On the **Active users** page, find and select the user account, click , and then select **Manage roles**. 3. Remove any administrative roles that are assigned to the account. When you're finished, click **Save changes**. -2. Open the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> and do the following steps: - 1. Go to **Permissions & roles** \> **Email & collaboration roles** \> **Roles**. +2. in the Microsoft 365 Defender portal at <https://security.microsoft.com>, do the following steps: + 1. Go to **Permissions & roles** \> **Email & collaboration roles** \> **Roles**. To go directly to the **Permissions** page, use <https://security.microsoft.com/emailandcollabpermissions>. 2. On the **Permissions** page, select each role group in the list and look for the user account in the **Members** section of the details flyout that appears. If the role group contains the user account, do the following steps: 1. In the **Members** section, click **Edit**. 2. On the **Editing Choose members** flyout that appears, click **Edit**. To unblock a mailbox from sending mail, follow the procedures in [Removing a use When you're finished, click **Done**, **Save**, and then **Close**. -3. Open the EAC and do the following steps: - 1. Select **Roles** \> <a href="https://go.microsoft.com/fwlink/?linkid=2183234" target="_blank">**Admin roles**</a>. +3. In the Exchange admin center at <https://admin.exchange.microsoft.com/>, do the following steps: + 1. Select **Roles** \> **Admin roles**. To go directly to the **Admin roles** page, use <https://admin.exchange.microsoft.com/#/adminRoles>. 2. On the **Admin roles** page, manually select each role group, and in the details pane, select the **Assigned** tab to verify the user accounts. If the role group contains the user account, do the following steps: 1. Select the user account. 2. Click the . |
| security | Safe Docs | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/safe-docs.md | Users don't need Defender for Endpoint installed on their local devices to get S ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To go directly to the **Safe Attachments** page, use <https://security.microsoft.com/safeattachmentv2>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Safe Attachments** page, use <https://security.microsoft.com/safeattachmentv2>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). Files sent by Safe Documents are not retained in Defender for Endpoint beyond th ## Use the Microsoft 365 Defender portal to configure Safe Documents -1. Open the Microsoft 365 Defender portal and go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. To go directly to the **Safe Attachments** page, use <https://security.microsoft.com/safeattachmentv2>. 2. On the **Safe Attachments** page, click **Global settings**. |
| security | Security Recommendations For Priority Accounts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/security-recommendations-for-priority-accounts.md | After you secure and tag your priority users, you can use the available reports, |Explorer <p> Real-time detections|In **Explorer** (Defender for Office 365 Plan 2) or **Real-time detections** (Defender for Office 365 Plan 1), user tags are visible in the Email grid view and the Email details flyout. User tags are also available as a filterable property. For more information, see [Tags in Explorer](threat-explorer.md#tags-in-threat-explorer).| |Campaign Views|User tags are one of many filterable properties in Campaign Views in Microsoft Defender for Office 365 Plan 2. For more information, see [Campaign Views](campaigns.md).| |Threat protection status report|In virtually all of the views and detail tables in the **Threat protection status report**, you can filter the results by **priority accounts**. For more information, see [Threat protection status report](view-email-security-reports.md#threat-protection-status-report).|-|Email issues for priority accounts report|The **Email issues for priority accounts** report in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a> contains information about undelivered and delayed messages for **priority accounts**. For more information, see [Email issues for priority accounts report](/exchange/monitoring/mail-flow-reports/mfr-email-issues-for-priority-accounts-report).| +|Email issues for priority accounts report|The **Email issues for priority accounts** report in the Exchange admin center (EAC) contains information about undelivered and delayed messages for **priority accounts**. For more information, see [Email issues for priority accounts report](/exchange/monitoring/mail-flow-reports/mfr-email-issues-for-priority-accounts-report).| | ## Train users |
| security | Set Up Safe Attachments Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/set-up-safe-attachments-policies.md | In Exchange Online PowerShell or standalone EOP PowerShell, you manage the polic ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To go directly to the **Safe Attachments** page, use <https://security.microsoft.com/safeattachmentv2>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Safe Attachments** page, use <https://security.microsoft.com/safeattachmentv2>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). To connect to standalone EOP PowerShell, see [Connect to Exchange Online Protection PowerShell](/powershell/exchange/connect-to-exchange-online-protection-powershell). In Exchange Online PowerShell or standalone EOP PowerShell, you manage the polic Creating a custom Safe Attachments policy in the Microsoft 365 Defender portal creates the safe attachment rule and the associated safe attachment policy at the same time using the same name for both. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. To go directly to the **Safe Attachments** page, use <https://security.microsoft.com/safeattachmentv2>. 2. On the **Safe Attachments** page, click  **Create**. Creating a custom Safe Attachments policy in the Microsoft 365 Defender portal c ## Use the Microsoft 365 Defender portal to view Safe Attachments policies -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. To go directly to the **Safe Attachments** page, use <https://security.microsoft.com/safeattachmentv2>. 2. On the **Safe Attachments** page, the following properties are displayed in the list of policies: - **Name** Creating a custom Safe Attachments policy in the Microsoft 365 Defender portal c ## Use the Microsoft 365 Defender portal to modify Safe Attachments policies -1. In the Microsoft 365 Defender portal,<a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. +1. IIn the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. To go directly to the **Safe Attachments** page, use <https://security.microsoft.com/safeattachmentv2>. 2. On the **Safe Attachments** page, select a policy from the list by clicking on the name. To enable or disable a policy or set the policy priority order, see the followin ### Enable or disable Safe Attachments policies -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. To go directly to the **Safe Attachments** page, use <https://security.microsoft.com/safeattachmentv2>. 2. On the **Safe Attachments** page, select a policy from the list by clicking on the name. To change the priority of a policy, you click **Increase priority** or **Decreas ## Use the Microsoft 365 Defender portal to remove Safe Attachments policies -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. To go directly to the **Safe Attachments** page, use <https://security.microsoft.com/safeattachmentv2>. 2. On the **Safe Attachments** page, select a custom policy from the list by clicking on the name of the policy. For detailed syntax and parameter information, see [Remove-SafeAttachmentRule](/ To verify that you've successfully created, modified, or removed Safe Attachments policies, do any of the following steps: -- In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. Verify the list of policies, their **Status** values, and their **Priority** values. To view more details, select the policy from the list by clicking on the name, and view the details in the fly out.+- On the **Safe Attachments** page in the Microsoft 365 Defender portal at <https://security.microsoft.com/safeattachmentv2>, verify the list of policies, their **Status** values, and their **Priority** values. To view more details, select the policy from the list by clicking on the name, and view the details in the fly out. - In Exchange Online PowerShell or Exchange Online Protection PowerShell, replace \<Name\> with the name of the policy or rule, run the following command, and verify the settings: |
| security | Set Up Safe Links Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/set-up-safe-links-policies.md | search.appverid: ms.assetid: bdd5372d-775e-4442-9c1b-609627b94b5d - M365-security-compliance-+ description: Admins can learn how to view, create, modify, and delete Safe Links policies and global Safe Links settings in Microsoft Defender for Office 365. ms.technology: mdo ms.prod: m365-security In Exchange Online PowerShell or standalone EOP PowerShell, you manage the polic ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com/</a>. To go directly to the **Safe Links** page, use <https://security.microsoft.com/safelinksv2>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Safe Links** page, use <https://security.microsoft.com/safelinksv2>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). To connect to standalone EOP PowerShell, see [Connect to Exchange Online Protection PowerShell](/powershell/exchange/connect-to-exchange-online-protection-powershell). In Exchange Online PowerShell or standalone EOP PowerShell, you manage the polic Creating a custom Safe Links policy in the Microsoft 365 Defender portal creates the safe links rule and the associated safe links policy at the same time using the same name for both. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Policies & rules** \> **Threat Policies** \> **Policies** section \> **Safe Links**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Links** in the **Policies** section. To go directly to the **Safe Links** page, use <https://security.microsoft.com/safelinksv2>. 2. On the **Safe Links** page, click  **Create**. Creating a custom Safe Links policy in the Microsoft 365 Defender portal creates ## Use the Microsoft 365 Defender portal to view Safe Links policies -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Policies & rules** \> **Threat Policies** \> **Policies** section \> **Safe Links**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Links** in the **Policies** section. To go directly to the **Safe Links** page, use <https://security.microsoft.com/safelinksv2>. 2. On the **Safe Links** page, the following properties are displayed in the list of Safe Links policies: - **Name** To enable or disable a policy or set the policy priority order, see the followin ### Enable or disable Safe Links policies -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Links** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Links** in the **Policies** section. To go directly to the **Safe Links** page, use <https://security.microsoft.com/safelinksv2>. 2. On the **Safe Links** page, select a policy from the list by clicking on the name. To change the priority of a policy, you click **Increase priority** or **Decreas - In the Microsoft 365 Defender portal, you can only change the priority of the Safe Links policy after you create it. In PowerShell, you can override the default priority when you create the safe links rule (which can affect the priority of existing rules). - Safe Links policies are processed in the order that they're displayed (the first policy has the **Priority** value 0). For more information about the order of precedence and how multiple policies are evaluated and applied, see [Order and precedence of email protection](how-policies-and-protections-are-combined.md). -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Links** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Safe Links** in the **Policies** section. To go directly to the **Safe Links** page, use <https://security.microsoft.com/safelinksv2>. 2. On the **Safe Links** page, select a policy from the list by clicking on the name. To verify that Safe Links is scanning messages, check the available Microsoft De To verify that you've successfully created, modified, or removed Safe Links policies, do any of the following steps: -- In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Policies & rules** \> **Threat policies** \> **Safe Links**. Verify the list of policies, their **Status** values, and their **Priority** values. To view more details, select the policy from the list, and view the details in the fly out.+- On the **Safe Links** page in the Microsoft 365 Defender portal at <https://security.microsoft.com/safelinksv2>, verify the list of policies, their **Status** values, and their **Priority** values. To view more details, select the policy from the list, and view the details in the fly out. - In Exchange Online PowerShell or Exchange Online Protection PowerShell, replace \<Name\> with the name of the policy or rule, run the following command, and verify the settings: |
| security | Tenant Allow Block List | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-allow-block-list.md | search.appverid: - MET150 - M365-security-compliance-+ description: Admins can learn how to manage allows and blocks in the Tenant Allow/Block List in the Security portal. ms.technology: mdo ms.prod: m365-security This article describes how to configure entries in the Tenant Allow/Block List i ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com/</a>. To go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>. - You specify files by using the SHA256 hash value of the file. To find the SHA256 hash value of a file in Windows, run the following command in a Command Prompt: This article describes how to configure entries in the Tenant Allow/Block List i ### Use the Microsoft 365 Defender portal -In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. +In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Tenant Allow/Block Lists** in the **Rules** section. To go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>. To add all blocks, see [Add blocks in the Tenant Allow/Block List](manage-tenant-blocks.md). To manage all allows and blocks, see [Add blocks in the Tenant Allow/Block List] ## View entries in the Tenant Allow/Block List -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Tenant Allow/Block Lists** in the **Rules** section. To go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>. 2. Select the tab you want. The columns that are available depend on the tab you selected: |
| security | Threat Explorer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/threat-explorer.md | To view and use Explorer or Real-time detections, you must have appropriate perm - Security Administrator (this can be assigned in the Azure Active Directory admin center (<https://aad.portal.azure.com>) - Security Reader -- For Exchange Online, you must have one of the following roles assigned in either the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a> or [Exchange Online PowerShell](/powershell/exchange/exchange-online-powershell):+- For Exchange Online, you must have one of the following roles assigned in either the Exchange admin center (EAC) or [Exchange Online PowerShell](/powershell/exchange/exchange-online-powershell): - Organization Management - View-Only Organization Management |
| security | Threat Hunting In Threat Explorer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/threat-hunting-in-threat-explorer.md | In this article: If your organization has [Microsoft Defender for Office 365](defender-for-office-365.md), and you have the [permissions](#required-licenses-and-permissions), you can use **Explorer** or **Real-time detections** to detect and remediate threats. -In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & collaboration**, and then choose **Explorer** or **Real-time detections**. To do directly to the page, use <https://security.microsoft.com/threatexplorer> or <https://security.microsoft.com/realtimereports> +In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration**, and then choose **Explorer** or **Real-time detections**. To go directly to the page, use <https://security.microsoft.com/threatexplorer> or <https://security.microsoft.com/realtimereports>. With these tools, you can: You must have [Microsoft Defender for Office 365](defender-for-office-365.md) to To view and use Explorer or Real-time detections, you must have the following permissions: -- For the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>:+- In the Microsoft 365 Defender portal: - Organization Management - Security Administrator (this can be assigned in the Azure Active Directory admin center (<https://aad.portal.azure.com>) - Security Reader-- For Exchange Online:+- In Exchange Online: - Organization Management - View-Only Organization Management - View-Only Recipients To view and use Explorer or Real-time detections, you must have the following pe To learn more about roles and permissions, see the following resources: - [Permissions in the Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md)-- [Feature permissions in Exchange Online](/exchange/permissions-exo/feature-permissions)+- [Permissions in Exchange Online](/exchange/permissions-exo/permissions-exo) - [Exchange Online PowerShell](/powershell/exchange/exchange-online-powershell) ## More information |
| security | Threat Trackers | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/threat-trackers.md | ms.assetid: a097f5ca-eac0-44a4-bbce-365f35b79ed1 - M365-security-compliance - m365initiative-defender-office365-+ description: Learn about Threat Trackers, including new Noteworthy Trackers, to help your organization stay on top of security concerns. ms.technology: mdo ms.prod: m365-security Most tracker pages include trending numbers that are updated periodically, widge Trackers are just a few of the many great features you get with [Microsoft Defender for Office 365 Plan 2](office-365-ti.md). Threat Trackers include [Noteworth trackers](#noteworthy-trackers), [Trending trackers](#trending-trackers), [Tracked queries](#tracked-queries), and [Saved queries](#saved-queries). -To view and use your Threat Trackers for your organization, go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> and choose **Email & collaboration** \> **Threat tracker**. +To view and use your Threat Trackers for your organization, open the Microsoft 365 Defender portal at <https://security.microsoft.com>, and go to **Email & collaboration** \> **Threat tracker**. To go directly to the **Threat tracker** page, use <https://security.microsoft.com/threattracker>. > [!NOTE] > To use Threat Trackers, you must be a global administrator, security administrator, or security reader. See [Permissions in the Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md). The new Noteworthy threat filter highlights items that were recently detected th - Make sure that your security team has the correct roles and permissions assigned. You must be a global administrator, or have the Security Administrator or Search and Purge role assigned in the Microsoft 365 Defender portal. See [Permissions in the Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md). -- Watch for the new Trackers to show up in your Microsoft 365 environment. When available, you'll find your Trackers in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. Go to **Email & collaboration** \> **Threat tracker**.+- Watch for the new Trackers to show up in your Microsoft 365 environment. When available, you'll find your Trackers on the **Threat tracker** page in the Microsoft 365 Defender portal at <https://security.microsoft.com/threattracker>. - If you haven't already done so, learn more about and configure [Microsoft Defender for Office 365](defender-for-office-365.md) for your organization, including [Safe links](safe-links.md) and [Safe Attachments](safe-attachments.md). |
| security | Trial Playbook Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/trial-playbook-defender-for-office-365.md | description: "Microsoft Defender for Office 365 solutions trial playbook." # Trial playbook: Microsoft Defender for Office 365 -Welcome to the Microsoft Defender for Office 365 trial playbook. This playbook will help you make the most of your 90-day free trial by teaching you how to safeguard your organization with Defender for Office 365. Using Microsoft recommendations, you'll learn how Defender for Office 365 can help you define protection policies, analyze threats to your organization, and respond to attacks. +Welcome to the Microsoft Defender for Office 365 trial playbook. This playbook will help you make the most of your 90-day free trial by teaching you how to safeguard your organization with Defender for Office 365. Using Microsoft recommendations, you'll learn how Defender for Office 365 can help you define protection policies, analyze threats to your organization, and respond to attacks.  Equip your users with the right knowledge to identify threats and report suspici ## Additional resources - **Interactive guide**: Unfamiliar with Defender for Office 365? Review the [interactive guide](https://mslearn.cloudguides.com/guides/Safeguard%20your%20organization%20with%20Microsoft%20Defender%20for%20Office%20365) to understand how to get started.-- **Microsoft docs**: Get detailed information on how Defender for Office 365 works and how to best implement it for your organization. Visit [Docs](overview.md).+- **Microsoft docs**: Get detailed information on how Defender for Office 365 works and how to best implement it for your organization. Visit [Docs](overview.md). - **What's included**: For a full list of Office 365 email security features listed by product tier, view the [Feature Matrix](/office365/servicedescriptions/office-365-advanced-threat-protection-service-description#feature-availability). - **Why Defender for Office 365**: The [Defender for Office 365 Datasheet](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4FCiy) shows the top 10 reasons customers choose Microsoft. |
| security | Turn On Mdo For Spo Odb And Teams | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/turn-on-mdo-for-spo-odb-and-teams.md | This article contains the steps for enabling and configuring Safe Attachments fo ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>. To go directly to the **Safe Attachments** page, open <https://security.microsoft.com/safeattachmentv2>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Safe Attachments** page, use <https://security.microsoft.com/safeattachmentv2>. - To turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, you need to be a member of the **Organization Management** or **Security Administrator** role groups in the Microsoft 365 Defender portal. For more information, see [Permissions in the Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md). This article contains the steps for enabling and configuring Safe Attachments fo ## Step 1: Use the Microsoft 365 Defender portal to turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Policies & rules** \> **Threat policies** \> **Policies** section \> **Safe Attachments**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat policies** \> **Safe Attachments** in the **Policies** section. To go directly to the **Safe Attachments** page, use <https://security.microsoft.com/safeattachmentv2>. 2. On the **Safe Attachments** page, click **Global settings**. For detailed syntax and parameter information, see [Set-SPOTenant](/powershell/m You can create an alert policy that notifies you and other admins when Safe Attachments for SharePoint, OneDrive, and Microsoft Teams detects a malicious file. To learn more about alerts, see [Alert policies](../../compliance/alert-policies.md). -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Policies & rules** \> **Alert policy** or open <https://security.microsoft.com/alertpolicies>. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Alert policy**. To go directly to the **Alert policy** page, use <https://security.microsoft.com/alertpolicies>. 2. On the **Alert policy** page, click **New alert policy**. |
| security | Use Dkim To Validate Outbound Email | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email.md | - - admindeeplinkDEFENDER description: Learn how to use DomainKeys Identified Mail (DKIM) with Microsoft 365 to ensure messages sent from your custom domain are trusted by the destination email systems. ms.technology: mdo ms.prod: m365-security Once you have published the CNAME records in DNS, you are ready to enable DKIM s #### To enable DKIM signing for your custom domain in the Microsoft 365 Defender portal -1. Open the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> using your work or school account. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **DKIM** in the **Rules** section. To go directly to the DKIM page, use <https://security.microsoft.com/dkimv2>. -2. Go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **DKIM** in the **Rules** section. Or, to go directly to the DKIM page, use <https://security.microsoft.com/dkimv2>. +2. On the **DKIM** page, select the domain by clicking on the name. -3. On the **DKIM** page, select the domain by clicking on the name. --4. In the details flyout that appears, change the **Sign messages for this domain with DKIM signatures** setting to **Enabled** () +3. In the details flyout that appears, change the **Sign messages for this domain with DKIM signatures** setting to **Enabled** () When you're finished, click **Rotate DKIM keys**. -5. Repeat these step for each custom domain. +4. Repeat these step for each custom domain. -6. If you are configuring DKIM for the first time and see the error 'No DKIM keys saved for this domain' you will have to use Windows PowerShell to enable DKIM signing as explained in the next step. +5. If you are configuring DKIM for the first time and see the error 'No DKIM keys saved for this domain' you will have to use Windows PowerShell to enable DKIM signing as explained in the next step. #### To enable DKIM signing for your custom domain by using PowerShell For example, the DKIM record would look like this: **Although DKIM is designed to help prevent spoofing, DKIM works better with SPF and DMARC.** -Once you have set up DKIM, if you have not already set up SPF you should do so. For a quick introduction to SPF and to get it configured quickly, see [**Set up SPF in Microsoft 365 to help prevent spoofing**](set-up-spf-in-office-365-to-help-prevent-spoofing.md). For a more in-depth understanding of how Microsoft 365 uses SPF, or for troubleshooting or non-standard deployments such as hybrid deployments, start with [How Microsoft 365 uses Sender Policy Framework (SPF) to prevent spoofing](how-office-365-uses-spf-to-prevent-spoofing.md). +Once you have set up DKIM, if you have not already set up SPF you should do so. For a quick introduction to SPF and to get it configured quickly, see [**Set up SPF in Microsoft 365 to help prevent spoofing**](set-up-spf-in-office-365-to-help-prevent-spoofing.md). For a more in-depth understanding of how Microsoft 365 uses SPF, or for troubleshooting or non-standard deployments such as hybrid deployments, start with [How Microsoft 365 uses Sender Policy Framework (SPF) to prevent spoofing](how-office-365-uses-spf-to-prevent-spoofing.md). Next, see [**Use DMARC to validate email**](use-dmarc-to-validate-email.md). [Anti-spam message headers](anti-spam-message-headers.md) includes the syntax and header fields used by Microsoft 365 for DKIM checks. Next, see [**Use DMARC to validate email**](use-dmarc-to-validate-email.md). [An Key rotation via PowerShell: [Rotate-DkimSigningConfig](/powershell/module/exchange/rotate-dkimsigningconfig) -[Use DMARC to validate email](/microsoft-365/security/office-365-security/use-dmarc-to-validate-email?view=o365-worldwide) +[Use DMARC to validate email](use-dmarc-to-validate-email.md) |
| security | Use Privileged Identity Management In Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365.md | - - admindeeplinkDEFENDER description: Learn to integrate Azure PIM in order to grant just-in-time, time limited access to users to do elevated privilege tasks in Microsoft Defender for Office 365, lowering risk to your data. ms.technology: mdo ms.prod: m365-security Privileged Identity Management (PIM) is an Azure feature that, once set up, give By setting up PIM to work with Defender for Office 365, admins create a process for a user to request access to take the actions they need. The user must *justify* the need for the elevation of their privileges. -In this example we will configure "Alex", a member of our security team who will have zero standing access within Office 365, but can elevate to both a role required for normal day to day operations, such as [Threat Hunting](threat-hunting-in-threat-explorer.md) and then also to a higher level of privilege when less frequent but sensitive operations, such as [remediating malicious delivered email](remediate-malicious-email-delivered-office-365.md) is required. +In this example we will configure "Alex", a member of our security team who will have zero-standing access within Office 365, but can elevate to both a role required for normal day-to-day operations, such as [Threat Hunting](threat-hunting-in-threat-explorer.md) and then also to a higher level of privilege when less frequent but sensitive operations, such as [remediating malicious delivered email](remediate-malicious-email-delivered-office-365.md) is required. > [!NOTE]-> This will walk you through the steps required to setup PIM for a Security Analyst who requires the ability to purge emails using Threat Explorer in Microsoft Defender for Office 365, but the same steps can be used for other RBAC roles within the Security, and Compliance portal. For example this process could be used for a information worker who requires day to day access in eDiscovery to perform searches and case work, but only occasionally needs the elevated right to export data from the tenant. +> This will walk you through the steps required to setup PIM for a Security Analyst who requires the ability to purge emails using Threat Explorer in Microsoft Defender for Office 365, but the same steps can be used for other RBAC roles within the Security, and Compliance portal. For example this process could be used for a information worker who requires day-to-day access in eDiscovery to perform searches and case work, but only occasionally needs the elevated right to export data from the tenant. ***Step 1***. In the Azure PIM console for your subscription, add the user (Alex) to the Azure Security Reader role and configure the security settings related to activation. 1. Sign into the [Azure AD Admin Center](https://aad.portal.azure.com/) and select **Azure Active Directory** > **Roles and administrators**. 2. Select **Security Reader** in the list of roles and then **Settings** > **Edit** 3. Set the '**Activation maximum duration (hours)**' to a normal working day and 'On activation' to require **Azure MFA**.-4. As this is Alex's normal privilege level for day to day operations, we will Uncheck **Require justification on activation**' > **Update**. +4. As this is Alex's normal privilege level for day-to-day operations, we will Uncheck **Require justification on activation**' > **Update**. 5. Select **Add Assignments** > **No member selected** > select or type the name to search for the correct member.-6. Click the **Select** button to choose the member you need to add for PIM privileges > click **Next** > make no changes on the Add Assignment page (both assignment type *Eligible* and duration *Permenantly Eligible* will be defaults ) and **Assign**. +6. Click the **Select** button to choose the member you need to add for PIM privileges > click **Next** > make no changes on the Add Assignment page (both assignment type *Eligible* and duration *Permanently Eligible* will be defaults ) and **Assign**. The name of your user (here 'Alex') will appear under Eligible assignments on the next page, this means they are able to PIM into the role with the settings configured earlier. Using [Privileged Access groups](/azure/active-directory/privileged-identity-man ### Create a role group requiring the permissions we need -In the Security Portal, create a custom role group that contains the permissions that we want. +In the Microsoft 365 Defender portal, create a custom role group that contains the permissions that we want. -1. Browse to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> > **Permissions & Roles** > select **Roles** under Email and Collaboration > **Create**. -2. Name your group to reflect its purpose such as 'Search and Purge PIM'. -3. Don't add members, simply save the group and move on to the next part! +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Permissions & Roles**, and then select **Roles** under **Email and Collaboration**. To go directly to the **Permissions** page, use <https://security.microsoft.com/emailandcollabpermissions>. +2. On the **Permissions** page, click  **Create**. +3. Name your group to reflect its purpose such as 'Search and Purge PIM'. +4. Don't add members, simply save the group and move on to the next part! ### Create the security group in Azure AD for elevated permissions 1. Browse back to the [Azure AD Admin Center](https://aad.portal.azure.com/) and navigate to **Azure AD** > **Groups** > **New Group**.-2. Name your AAD group to reflect its purpose, **no owners or members are required** right now. +2. Name your Azure AD group to reflect its purpose, **no owners or members are required** right now. 3. Turn **Azure AD roles can be assigned to the group** to **Yes**. 4. Don't add any roles, members or owners, create the group. 5. Go back into the group you've just created, and select **Privileged Access** > **Enable Privileged Access**.-6. Within the group select **Eligible assignments** > **Add assignments** > Add the user who needs Search & Purge as a role of **Member**. +6. Within the group, select **Eligible assignments** > **Add assignments** > Add the user who needs Search & Purge as a role of **Member**. 7. Configure the **Settings** within the group's Privileged Access pane. Choose to **Edit** the settings for the role of **Member**. 8. Change the activation time to suit your organization. In this example require *Azure MFA*, *justification*, and *ticket information* before selecting **Update**. -### Nest the newly created security group into the role group. +### Nest the newly created security group into the role group -1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) and run the following: +1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) and run the following command: - `Add-RoleGroupMember "<<Role Group Name>>" -Member "<<Azure Security Group>>"` + ```powershell + Add-RoleGroupMember "<<Role Group Name>>" -Member "<<Azure Security Group>>"` + ``` ## Test your configuration of PIM with Defender for Office 365 -1. Login with the test user (Alex), who will should have no administrative access within the [Microsoft 365 Defender portal](/microsoft-365/security/defender/overview-security-center) at this point. -2. Navigate to PIM, where the user can activate their day to day security reader role. +1. Login with the test user (Alex), who should have no administrative access within the [Microsoft 365 Defender portal](/microsoft-365/security/defender/overview-security-center) at this point. +2. Navigate to PIM, where the user can activate their day-to-day security reader role. 3. If you try to purge an email using Threat Explorer, you get an error stating you need additional permissions. 4. PIM a second time into the more elevated role, after a short delay you should now be able to purge emails without issue. |
| security | User Submission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/user-submission.md | search.appverid: - M365-security-compliance - m365initiative-defender-office365-+ description: Admins can learn how to configure a mailbox to collect spam and phishing email that are reported by users. ms.technology: mdo ms.prod: m365-security After you've verified that your mailbox meets all applicable prerequisites, you ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com/</a>. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **User submissions** page, use <https://security.microsoft.com/reportsubmission>. - To modify the configuration for User submissions, you need to be a member of one of the following role groups: After you've verified that your mailbox meets all applicable prerequisites, you ## Use the Microsoft 365 Defender portal to configure the user submissions mailbox -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Policies & rules** \> **Threat policies** \> **User reported message settings** in the **Others** \> **User submissions**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat policies** \> **User reported message settings** in the **Others** section. To go directly to the **User submissions** page, use <https://security.microsoft.com/reportsubmission>. 2. On the **User submissions** page, what you see is determined by whether the **Microsoft Outlook Report Message button** setting is **Off** or **On**: After you've verified that your mailbox meets all applicable prerequisites, you - **User reporting experience section** - **Before reporting** tab: In the **Title** and **Message body** boxes, enter the descriptive text that users see before they report a message using the Report Message add-in or the Report Phishing add-in. You can use the variable %type% to include the submission type (junk, not junk, phish, etc.). - **After reporting** tab: In the **Title** and **Confirmation message** boxes, enter the descriptive text that users see after they report a message using the Report Message add-in or the Report Phishing add-in. You can use the variable %type% to include the submission type.- - **Only display when user reports phishing**: Check this option if you want to display the message only when an email is reported as phish. If not, checked messages will be shown for any kind of report. + - **Only display when user reports phishing**: Check this option if you want to display the message only when an email is reported as phish. If not, checked messages will be shown for any kind of report. As shown on the page, if you select an option that sends the reported messages to Microsoft, the following text is also added to the notification: |
| security | User Tags | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/user-tags.md | search.appverid: - M365-security-compliance -- admindeeplinkDEFENDER-- admindeeplinkEXCHANGE description: Admins can learn how to identify specific groups of users with user tags in Microsoft Defender for Office 365 Plan 2. Tag filtering is available across alerts, reports, and investigations in Microsoft Defender for Office 365 to quickly identify the tagged users. ms.technology: mdo ms.prod: m365-security After you apply system tags or custom tags to users, you can use those tags as f - [Campaign Views](campaigns.md) - [Admin and user submissions](admin-submission.md) - [Quarantine](quarantine.md)-- For priority accounts, you can use the [Email issues for priority accounts report](/exchange/monitoring/mail-flow-reports/mfr-email-issues-for-priority-accounts-report) in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a>.+- For priority accounts, you can use the [Email issues for priority accounts report](/exchange/monitoring/mail-flow-reports/mfr-email-issues-for-priority-accounts-report) in the Exchange admin center (EAC). -This article explains how to configure user tags in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. There are no cmdlets in Microsoft 365 Defender portal to manage user tags. +This article explains how to configure user tags in the Microsoft 365 Defender portal. There are no cmdlets in Microsoft 365 Defender portal to manage user tags. To see how user tags are part of the strategy to help protect high-impact user accounts, see [Security recommendations for priority accounts in Microsoft 365](security-recommendations-for-priority-accounts.md). ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com/</a>. To go directly to the **User tags** page, open <https://security.microsoft.com/securitysettings/userTags>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **User tags** page, use <https://security.microsoft.com/securitysettings/userTags>. - You need to be assigned permissions in the Microsoft 365 Defender portal before you can do the procedures in this article: - To create, modify, and delete custom user tags, you need to be a member of the **Organization Management** or **Security Administrator** role groups. To see how user tags are part of the strategy to help protect high-impact user a ## Use the Microsoft 365 Defender portal to create user tags -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Settings** \> **Email & collaboration** \> **User tags**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Settings** \> **Email & collaboration** \> **User tags**. To go directly to the **User tags** page, use <https://security.microsoft.com/securitysettings/userTags>. 2. On the **User tags** page, click  **Create tag**. To see how user tags are part of the strategy to help protect high-impact user a ## Use the Microsoft 365 Defender portal to view user tags -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Settings** \> **Email & collaboration** \> **User tags**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Settings** \> **Email & collaboration** \> **User tags**. To go directly to the **User tags** page, use <https://security.microsoft.com/securitysettings/userTags>. 2. On the **User tags** page, the following properties are displayed in the list of user tags: To see how user tags are part of the strategy to help protect high-impact user a ## Use the Microsoft 365 Defender portal to modify user tags -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Settings** \> **Email & collaboration** \> **User tags**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Settings** \> **Email & collaboration** \> **User tags**. To go directly to the **User tags** page, use <https://security.microsoft.com/securitysettings/userTags>. 2. On the **User tags** page, select the user tag from the list, and then click  **Edit tag**. To see how user tags are part of the strategy to help protect high-impact user a > [!NOTE] > You can't remove the built-in **Priority account** system tag. -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Settings** \> **Email & collaboration** \> **User tags**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Settings** \> **Email & collaboration** \> **User tags**. To go directly to the **User tags** page, use <https://security.microsoft.com/securitysettings/userTags>. 2. On the **User tags** page, select the user tag from the list, and then click  **Delete tag**. |
| security | View Email Security Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/view-email-security-reports.md | A variety of reports are available in the Microsoft 365 Defender portal at <http > > Some of the reports on the **Email & collaboration reports** page require Microsoft Defender for Office 365. For information about these reports, see [View Defender for Office 365 reports in the Microsoft 365 Defender portal](view-reports-for-mdo.md). >-> Reports that are related to mail flow are now in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a>. For more information about these reports, see [Mail flow reports in the new Exchange admin center](/exchange/monitoring/mail-flow-reports/mail-flow-reports). +> Reports that are related to mail flow are now in the Exchange admin center. For more information about these reports, see [Mail flow reports in the new Exchange admin center](/exchange/monitoring/mail-flow-reports/mail-flow-reports). ## Compromised users report |
| security | View Mail Flow Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/view-mail-flow-reports.md | ms.assetid: - M365-security-compliance description: Admins can learn about the mail flow reports that are available in the Reports dashboard in the Security & Compliance Center.-+ ms.technology: mdo ms.prod: m365-security ms.prod: m365-security > [!NOTE] >-> Most of the reports in this article are also available in the Microsoft 365 Defender portal or the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a>. For more information, see the following topics: +> Most of the reports in this article are also available in the Microsoft 365 Defender portal or the Exchange admin center (EAC). For more information, see the following topics: > > - [Mail flow reports in the new Exchange admin center](/exchange/monitoring/mail-flow-reports/mail-flow-reports) > - [View email security reports in the Microsoft 365 Defender portal](view-email-security-reports.md) |
| security | View Reports For Mdo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/view-reports-for-mdo.md | Microsoft Defender for Office 365 organizations (for example, Microsoft 365 E5 s ### View reports -1. Go to **Reports** \> **Email & collaboration** \> **Email & collaboration reports**. To go directly to the **Email & collaboration reports** page, open <https://security.microsoft.com/emailandcollabreport>. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Reports** \> **Email & collaboration** \> **Email & collaboration reports**. To go directly to the **Email & collaboration reports** page, use <https://security.microsoft.com/emailandcollabreport>. 1. Choose the report you want to view, and then select **View details**. ### Download reports -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Reports** > **Email & collaboration**. --2. Select **Reports for download**. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Reports** > **Email & collaboration** \> **Reports for download**. To go directly to the **Reports for download** page, use <https://security.microsoft.com/ReportsForDownload?viewid=custom>.  Microsoft Defender for Office 365 organizations (for example, Microsoft 365 E5 s > > Email security reports that don't require Defender for Office 365 are described in [View email security reports in the Microsoft 365 Defender portal](view-email-security-reports.md). >-> Reports that are related to mail flow are now in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a>. For more information about these reports, see [Mail flow reports in the new Exchange admin center](/exchange/monitoring/mail-flow-reports/mail-flow-reports). +> Reports that are related to mail flow are now in the Exchange admin center (EAC). For more information about these reports, see [Mail flow reports in the new Exchange admin center](/exchange/monitoring/mail-flow-reports/mail-flow-reports). ## Safe Attachments file types report The **Mail latency report** shows you an aggregate view of the mail delivery and Client side and network latency are not included. -To view the report, open the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Reports** \> **Email & collaboration** \> **Email & collaboration reports**. On the **Email & collaboration reports** page, find **Mail latency report** and then click **View details**. To go directly to the report, open <https://security.microsoft.com/mailLatencyReport>. +To view the report, open the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Reports** \> **Email & collaboration** \> **Email & collaboration reports**. To go directly to the **Email & collaboration reports** page, use <https://security.microsoft.com/emailandcollabreport>. ++On the **Email & collaboration reports** page, find **Mail latency report** and then click **View details**. To go directly to the report, use <https://security.microsoft.com/mailLatencyReport>.  |
| security | Walkthrough Spoof Intelligence Insight | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/walkthrough-spoof-intelligence-insight.md | You can manage spoof intelligence in the Microsoft 365 Defender portal, or in Po ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">https://security.microsoft.com</a>.- - To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>. +- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>. - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). To connect to standalone EOP PowerShell, see [Connect to Exchange Online Protection PowerShell](/powershell/exchange/connect-to-exchange-online-protection-powershell). There are two ways to allow and block spoofed senders: > [!IMPORTANT] > This article describes the older spoofed sender management experience that's being replaced (the **spoof intelligence policy** on the **Anti-spam policies** page). For more information about the new experience (the **Spoofing** tab in the Tenant Allow/Block List), see [Spoof intelligence insight in EOP](learn-about-spoof-intelligence.md). -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. +1. In the Microsoft 365 Defender portal at <https://security.microsofot.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. To go directly to the **Anti-spam policies** page, use <https://security.microsoft.com/antispam>. 2. On the **Anti-spam policies** page, select **Spoof intelligence policy** by clicking on the name. |