| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| threat-intelligence | What Is Microsoft Defender Threat Intelligence Defender Ti | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti.md | -Microsoft Defender Threat Intelligence (Defender TI) is a platform that streamlines triage, incident response, threat hunting, vulnerability management, and cyber threat intelligence analyst workflows when conducting threat infrastructure analysis and gathering threat intelligence. Analysts spend a significant amount of time on data discovery, collection, and parsing, instead of focusing on what actually helps their organization defend themselves--deriving insights about the actors through analysis and correlation.? +Microsoft Defender Threat Intelligence (Defender TI) is a platform that streamlines triage, incident response, threat hunting, vulnerability management, and cyber threat intelligence analyst workflows when conducting threat infrastructure analysis and gathering threat intelligence. Analysts spend a significant amount of time on data discovery, collection, and parsing, instead of focusing on what actually helps their organization defend themselves--deriving insights about the actors through analysis and correlation. Often, analysts must go to multiple repositories to obtain the critical data sets they need to assess a suspicious domain, host, or IP address. DNS data, WHOIS information, malware, and SSL certificates provide important context to indicators of compromise (IOCs), but these repositories are widely distributed and donΓÇÖt always share a common data structure, making it difficult to ensure analysts have all relevant data needed to make a proper and timely assessment of suspicious infrastructure. |
| admin | Yammer Device Usage Report Ww | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/activity-reports/yammer-device-usage-report-ww.md | description: "Get the Yammer device usage report to learn more about which devic # Microsoft 365 Reports in the admin center - Yammer device usage report -The Microsoft 365 Reports dashboard shows you the activity overview across the products in your organization. It enables you to drill in to individual product level reports to give you more granular insight about the activities within each product. Check out [the Reports overview topic](activity-reports.md). +The Microsoft 365 Reports dashboard shows you the activity overview across the products in your organization. It enables you to drill in to individual product level reports to give you more granular insight about the activities within each product. Check out the [Reports overview topic](activity-reports.md). The Yammer device usage reports give you information about which devices your users are using Yammer on. You can view the number of daily users by device type, and number of users by device type. You can view both over a selected time period. You can also view details per user. ## How do I get to the Yammer device usage report? 1. In the admin center, go to the **Reports**, and then select **Usage**. -2. From the dashboard homepage, click on the **View more** button on the Yammer card. +2. From the dashboard homepage, select **View more** on the Yammer card. ## Interpret the Yammer device usage report -You can view the usage in the OneDrive report by choosing the **Device usage** tab. +Select the **Device usage** tab to view the usage in the OneDrive report. - Select **Choose columns** to add or remove columns from the report. - -You can also export the report data into an Excel .csv file by selecting the **Export** link. This exports data of all users and enables you to do simple sorting and filtering for further analysis. +You also can export the report data into an Excel .csv file by selecting the Export link. This link exports data of all users and enables you to do simple sorting and filtering for further analysis. The **Yammer device usage** report can be viewed for trends over the last 7 days, 30 days, 90 days, or 180 days. However, if you select a particular day in the report, the table will show data for up to 28 days from the current date (not the date the report was generated). -|Item|Description| +|Metric|Definition| |:--|:--|-|**Metric**|**Definition**| -|Username <br/> |The email address of the user. You can display the actual email address or make this field anonymous. This grid shows users who logged into Yammer using the Microsoft 365 account or who logged into the network using single sign-on. <br/> | -|Display name <br/> |The full name of the user. You can display the actual email address or make this field anonymous. <br/> | -|User state <br/> |One of three values: Active, Deleted, or Suspended. These reports show data for active, suspended, and deleted users. They do not reflect pending users, because pending users cannot post, read, or like a message. <br/> | -|State change date (UTC) <br/> |The date on which the user's state was changed in Yammer. <br/> | -|Last activity date (UTC) <br/> |The last date (UTC) that the user participated in an Yammer activity. <br/> | -|Web <br/> |Indicates if the user has used Yammer on the web. <br/> | -|Windows phone <br/> | Indicates if the user has used Yammer on a Windows phone. <br/> | -|Android phone <br/> |Indicates if the user has used Yammer on an Android phone. <br/>| -|iphone <br/> | Indicates if the user has used Yammer on an iPhone. <br/> | -|ipad <br/> |Indicates if the user has used Yammer on an iPad. <br/>| -|other <br/> |Indicates if the user has used Yammer on another client, not listed previously. This includes Yammer Embed, SharePoint Web Part, Viva Engage, and select Outlook emails. <br/>| -||| +|Username |The email address of the user. You can display the actual email address or make this field anonymous. This grid shows users who logged in to Yammer using the Microsoft 365 account or who logged in to the network using single sign-on. | +|Display name |The full name of the user. You can display the actual email address or make this field anonymous. | +|User state |One of three values: Active, Deleted, or Suspended. These reports show data for active, suspended, and deleted users. They don't reflect pending users, because pending users can't post, read, or like a message. | +|State change date (UTC) |The date on which the user's state was changed in Yammer. | +|Last activity date (UTC) |The last date (UTC) that the user participated in a Yammer activity. | +|Web |Indicates if the user has used Yammer on the web. | +|Windows phone | Indicates if the user has used Yammer on a Windows phone. | +|Android phone |Indicates if the user has used Yammer on an Android phone. | +|iPhone | Indicates if the user has used Yammer on an iPhone. | +|iPad |Indicates if the user has used Yammer on an iPad. | +|other |Indicates if the user has used Yammer on another client, which wasn't listed previously. This includes Yammer Embed, SharePoint Web Part, Viva Engage, and select Outlook emails. | |
| admin | Admin Center Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/admin-overview/admin-center-overview.md | The Microsoft 365 admin center is fully localized in 40 languages. ## Related content [What is a Microsoft 365 admin?](../add-users/about-admin-roles.md) (video)\+[Manage teams in the Microsoft Teams admin center](/microsoftteams/manage-teams-in-modern-portal)\ [Assign admin roles](../add-users/assign-admin-roles.md) (video)\ [Customize the Microsoft 365 theme for your organization](../setup/customize-your-organization-theme.md) (article) |
| admin | Adoption Score | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/adoption/adoption-score.md | The role-based access control model for Adoption Score helps organizations furth Microsoft is committed to protecting individual privacy. This [privacy document](privacy.md) explains the controls we provide you, as your organization's IT administrator, to ensure that the information is actionable while not compromising the trust you place in Microsoft. You can access the experience from Microsoft 365 Admin home under **Reports** > **Adoption Score**.++> [!NOTE] +> This feature is not available in GCC High, GCC, and DOD tenants. ## How the score is calculated Share your thoughts about Adoption Score and your ideas about how to improve it. [Monitor Microsoft 365 activity by using reports](../../admin/activity-reports/activity-reports.md) (article)\ [Enable Microsoft 365 usage analytics](../../admin/usage-analytics/enable-usage-analytics.md) (article)\-[Overview of the Microsoft 365 admin center](../admin-overview/admin-center-overview.md) (video) +[Overview of the Microsoft 365 admin center](../admin-overview/admin-center-overview.md) (video) |
| admin | Create Dns Records At Cloudflare | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/dns/create-dns-records-at-cloudflare.md | Only select this option if your organization uses Skype for Business for online |Type|Name|Service|Protocol|TTL|Priority|Weight|Port|Target| |||||||||| |SRV|Use your *domain_name*; for example, contoso.com|_sip|TLS|30 minutes|100|1|443|sipfed.online.lync.com|- |SRV|_sipfederationtls|TCP|Use your *domain_name*; for example, contoso.com|30 minutes|100|1|5061|sipfed.online.lync.com| + |SRV|Use your *domain_name*; for example, contoso.com|_sipfederationtls|TCP|30 minutes|100|1|5061|sipfed.online.lync.com| 1. Select **Save**. |
| admin | Remove A Domain | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/get-help-with-domains/remove-a-domain.md | To change your NS records, see [Change nameservers to set up Microsoft 365 with ## How long does it take for a domain to be removed? -It can take as little as 5 minutes for Microsoft 365 to remove a domain if it's not referenced in a lot of places such as security groups, distribution lists, users, and Microsoft 365 groups. If there are many references that use the domain it can take several hours (a day) for the domain to be removed. +It can take as little as five minutes for Microsoft 365 to remove a domain if it's not referenced in a lot of places such as security groups, distribution lists, users, aliases, shared mailboxes, resource mailboxes, and Microsoft 365 groups. If there are many references that use the domain it can take several hours (a day) for the domain to be removed. If you have hundreds or thousands of users, use PowerShell to query for all users and then move them to another domain. Otherwise, it's possible for a handful of users to be missed in the UI, and then when you go to remove the domain, you won't be able to and you won't know why. See [Set-MsolUserPrincipalName](/powershell/module/msonline/set-msoluserprincipalname) for more information. To set the default domain, use [Set-MsolDomain](/powershell/module/msonline/set-msoldomain). |
| admin | Transfer A Domain From Microsoft To Another Host | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/get-help-with-domains/transfer-a-domain-from-microsoft-to-another-host.md | You can't transfer a Microsoft 365 domain to another registrar for 60 days after > [!NOTE] > A _Whois_ query shows a Microsoft purchased domain registrar as Wild West Domains LLC. However, only Microsoft should be contacted regarding your Microsoft 365 purchased domain. -Follow these steps to get a code at Microsoft 365, and then go to the other domain registrar website to set up transferring your domain name to the new registrar. +Sign in as a global administrator, follow these steps to get a code at Microsoft 365, and then go to the other domain registrar website to set up transferring your domain name to the new registrar. ## Transfer a domain |
| admin | Servicenow Aad Oauth Token | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/servicenow-aad-oauth-token.md | These prerequisites are necessary to set up the Microsoft 365 support integratio - Token URL: `https://login.microsoftonline.com/{microsoft-365-tenant-name}/oauth2/token` - - Redirect URL: `https://{service-now-instance-name``}.service-now.com/oauth_redirect.do` + - Redirect URL: `https://{your-servicenow-instance}.service-now.com/oauth_redirect.do` :::image type="content" source="../../media/ServiceNow-guide/servicenow-guide-image6.png" lightbox="../../media/ServiceNow-guide/servicenow-guide-image6.png" alt-text="Graphical user interface, application Description automatically generated"::: These prerequisites are necessary to set up the Microsoft 365 support integratio 1. Go to **System OAuth > Application Registry**. -1. Select **New**, and then select **Create new Open ID Connect Provider**. +1. Select **New**, and then select **Configure and OIDC provider to verify ID tokens**. 1. In **OAuth OIDC Provider Configuration**, select **Search** and create a new OIDC provider configuration under **oidc\_provider\_configuration.list** with these values: These prerequisites are necessary to set up the Microsoft 365 support integratio :::image type="content" source="../../media/ServiceNow-guide/servicenow-guide-image24.png" lightbox="../../media/ServiceNow-guide/servicenow-guide-image24.png" alt-text="Graphical user interface, text, application Description automatically generated"::: -1. Create a new application by selecting **Configure an OIDC provider to verify ID tokens** with these values: +1. In this new application, fill the fields with these values: - Name: **{Tenant\_Name}\_application\_inbound\_api** (example: contoso\_applicaiton\_inbound\_api) These prerequisites are necessary to set up the Microsoft 365 support integratio - OAuth OIDC Provider Configuration: The OIDC provider created in the previous step - - Redirect URL: `https://{service-now-instance-name}.service-now.com/oauth\_redirect.do` + - Redirect URL: `https://{service-now-instance-name}.service-now.com/oauth_redirect.do` :::image type="content" source="../../media/ServiceNow-guide/servicenow-guide-image25.png" lightbox="../../media/ServiceNow-guide/servicenow-guide-image25.png" alt-text="Graphical user interface, application Description automatically generated"::: |
| compliance | Add Your Organization Brand To Encrypted Messages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/add-your-organization-brand-to-encrypted-messages.md | audience: Admin ms.localizationpriority: medium Previously updated : 5/12/2022 Last updated : 10/14/2022 search.appverid: - MET150 - MOE150-description: Learn how Office 365 global administrators can apply your organization's branding to encrypted email messages & contents of the encryption portal. +description: Learn how Microsoft 365 global administrators can apply your organization's branding to encrypted email messages & contents of the encryption portal. -# Add your organization's brand to your Microsoft 365 for business Message Encryption encrypted messages +# Add your organization's brand to your Microsoft Purview Message Encryption encrypted messages -You can apply your company branding to customize the look of your organization's email messages and the encryption portal. You'll need to apply global administrator permissions to your work or school account before you can get started. Once you have these permissions, use the Get-OMEConfiguration and Set-OMEConfiguration cmdlets in Exchange Online PowerShell to customize these parts of encrypted email messages: +Apply your company branding to customize the look of your organization's email messages and the encryption portal. You'll need to apply global administrator permissions to your work or school account before you can get started. Use the Get-OMEConfiguration and Set-OMEConfiguration cmdlets in Exchange Online PowerShell to customize these parts of encrypted email messages: - Introductory text - Disclaimer text - URL for Your organization's privacy statement-- Text in the OME portal-- Logo that appears in the email message and OME portal, or whether to use a logo at all-- Background color in the email message and OME portal+- Text in the encrypted message portal +- Logo that appears in the email message and encrypted message portal, or whether to use a logo at all +- Background color in the email message and encrypted message portal You can also revert back to the default look and feel at any time. If you'd like more control, use Microsoft Purview Advanced Message Encryption to - Whether you want to allow emails to be revoked - Whether you want emails sent to external recipients to expire after a specified number of days. -Once you've created the templates, you can apply them to encrypted emails by using Exchange mail flow rules. If you have Microsoft Purview Advanced Message Encryption, you can revoke any email that you've branded by using these templates. +Once you've created the templates, apply them to encrypted emails sent from your online mailbox by using Exchange mail flow rules. If you have Microsoft Purview Advanced Message Encryption, you can revoke any email that you've branded. [!INCLUDE [purview-preview](../includes/purview-preview.md)] -## Work with OME branding templates +## Work with branding templates -You can modify several features within a branding template. You can modify, but not remove, the default template. If you have Advanced Message Encryption, you can also create, modify, and remove custom templates. Use Exchange Online PowerShell to work with one branding template at a time. +You can modify several features within a branding template, and modify, but not remove, the default template. If you have Advanced Message Encryption, you can also create, modify, and remove custom templates. Use Exchange Online PowerShell to work with one branding template at a time. - [Set-OMEConfiguration](/powershell/module/exchange/set-omeconfiguration) - Modify the default branding template or a custom branding template that you created. - [New-OMEConfiguration](/powershell/module/exchange/new-omeconfiguration) - Create a new branding template, Advanced Message Encryption only. - [Remove-OMEConfiguration](/powershell/module/exchange/remove-omeconfiguration) - Remove a custom branding template, Advanced Message Encryption only. You can't delete the default branding template. -## Modify an OME branding template +## Modify a branding template Use Exchange Online PowerShell to modify one branding template at a time. If you have Advanced Message Encryption, you can also create, modify, and remove custom templates. Use Exchange Online PowerShell to modify one branding template at a time. If you |To customize this feature of the encryption experience|Use these commands| |||-|Background color|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -BackgroundColor "<#RRGGBB hexadecimal color code or name value>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Branding Template 1" -BackgroundColor "#ffffff"` <p> For more information about background colors, see the [Background colors](#background-color-reference) section later in this article.| -|Logo|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -Image <Byte[]>` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Branding Template 1" -Image ([System.IO.File]::ReadAllBytes('C:\Temp\contosologo.png'))` <p> Supported file formats: .png, .jpg, .bmp, or .tiff <p> Optimal size of logo file: less than 40 KB <p> Optimal size of logo image: 170x70 pixels. If your image exceeds these dimensions, the service resizes your logo for display in the portal. The service doesn't modify the graphic file itself. For best results, use the optimal size.| -|Text next to the sender's name and email address|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -IntroductionText "<String up to 1024 characters>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Branding Template 1" -IntroductionText "has sent you a secure message."`| -|Text that appears on the "Read Message" button|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -ReadButtonText "<String up to 1024 characters>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "OME Configuration" -ReadButtonText "Read Secure Message."`| -|Text that appears below the "Read Message" button|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -EmailText "<String up to 1024 characters>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "OME Configuration" -EmailText "Encrypted message from ContosoPharma secure messaging system."`| -|URL for the Privacy Statement link|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -PrivacyStatementURL "<URL>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Branding Template 1" -PrivacyStatementURL "https://contoso.com/privacystatement.html"`| +|Background color|`Set-OMEConfiguration -Identity "<ConfigurationName>" -BackgroundColor "<#RRGGBB hexadecimal color code or name value>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Branding Template 1" -BackgroundColor "#ffffff"` <p> For more information about background colors, see the [Background colors](#background-color-reference) section later in this article.| +|Logo|`Set-OMEConfiguration -Identity "<ConfigurationName>" -Image <Byte[]>` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Branding Template 1" -Image ([System.IO.File]::ReadAllBytes('C:\Temp\contosologo.png'))` <p> Supported file formats: .png, .jpg, .bmp, or .tiff <p> Optimal size of logo file: less than 40 KB <p> Optimal size of logo image: 170x70 pixels. If your image exceeds these dimensions, the service resizes your logo for display in the portal. The service doesn't modify the graphic file itself. For best results, use the optimal size.| +|Text next to the sender's name and email address|`Set-OMEConfiguration -Identity "<ConfigurationName>" -IntroductionText "<String up to 1024 characters>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Branding Template 1" -IntroductionText "has sent you a secure message."`| +|Text that appears on the "Read Message" button|`Set-OMEConfiguration -Identity "<ConfigurationName>" -ReadButtonText "<String up to 1024 characters>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Message encryption configuration" -ReadButtonText "Read Secure Message."`| +|Text that appears below the "Read Message" button|`Set-OMEConfiguration -Identity "<ConfigurationName>" -EmailText "<String up to 1024 characters>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Message encryption configuration" -EmailText "Encrypted message from ContosoPharma secure messaging system."`| +|URL for the Privacy Statement link|`Set-OMEConfiguration -Identity "<ConfigurationName>" -PrivacyStatementURL "<URL>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Branding Template 1" -PrivacyStatementURL "https://contoso.com/privacystatement.html"`| |Disclaimer statement in the email that contains the encrypted message|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -DisclaimerText "<Disclaimer statement. String of up to 1024 characters.>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Branding Template 1" -DisclaimerText "This message is confidential for the use of the addressee only."`|-|Text that appears at the top of the encrypted mail viewing portal|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -PortalText "<Text for your portal. String of up to 128 characters.>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "OME Configuration" -PortalText "ContosoPharma secure email portal."`| +|Text that appears at the top of the encrypted mail viewing portal|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -PortalText "<Text for your portal. String of up to 128 characters.>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Message encryption cfonfiguration" -PortalText "ContosoPharma secure email portal."`| |To enable or disable authentication with a one-time pass code for this custom template|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -OTPEnabled <$true|$false>` <p> **Examples:** <br/>To enable one-time passcodes for this custom template <p> `Set-OMEConfiguration -Identity "Branding Template 1" -OTPEnabled $true` <p> To disable one-time passcodes for this custom template <p> `Set-OMEConfiguration -Identity "Branding Template 1" -OTPEnabled $false`| |To enable or disable authentication with Microsoft, Google, or Yahoo identities for this custom template|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -SocialIdSignIn <$true|$false>` <p> **Examples:** <br/>To enable social IDs for this custom template <p> `Set-OMEConfiguration -Identity "Branding Template 1" -SocialIdSignIn $true` <p> To disable social IDs for this custom template <p> `Set-OMEConfiguration -Identity "Branding Template 1" -SocialIdSignIn $false`| -## Create an OME branding template (Advanced Message Encryption) +## Create an encrypted message branding template (Advanced Message Encryption) -If you have Microsoft Purview Advanced Message Encryption, you can create custom branding templates for your organization by using the [New-OMEConfiguration](/powershell/module/exchange/new-omeconfiguration) cmdlet. Once you've created the template, you modify the template by using the Set-OMEConfiguration cmdlet as described in [Modify an OME branding template](#modify-an-ome-branding-template). You can create multiple templates. +If you have Microsoft Purview Advanced Message Encryption, you can create custom branding templates for your organization by using the [New-OMEConfiguration](/powershell/module/exchange/new-omeconfiguration) cmdlet. Once you've created the template, you modify the template by using the Set-OMEConfiguration cmdlet as described in [Modify a branding template](#modify-a-branding-template). You can create multiple templates. To create a new custom branding template: To remove all modifications from the default template, including brand customiza |To revert this feature of the encryption experience back to the default text and image|Use these commands| |:--|:--|- |Default text that comes with encrypted email messages. The default text appears above the instructions for viewing encrypted messages|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -EmailText "<empty string>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "OME Configuration" -EmailText ""`| - |Disclaimer statement in the email that contains the encrypted message|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" DisclaimerText "<empty string>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "OME Configuration" -DisclaimerText ""`| - |Text that appears at the top of the encrypted mail viewing portal|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -PortalText "<empty string>"` <p> **Example reverting back to default:** <p> `Set-OMEConfiguration -Identity "OME Configuration" -PortalText ""`| - |Logo|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -Image <"$null">` <p> **Example reverting back to default:** <p> `Set-OMEConfiguration -Identity "OME configuration" -Image $null`| - |Background color|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -BackgroundColor "$null">` <p> **Example reverting back to default:** <p> `Set-OMEConfiguration -Identity "OME configuration" -BackgroundColor $null`| + |Default text that comes with encrypted email messages. The default text appears above the instructions for viewing encrypted messages|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -EmailText "<empty string>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Message encryption configuration" -EmailText ""`| + |Disclaimer statement in the email that contains the encrypted message|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" DisclaimerText "<empty string>"` <p> **Example:** <p> `Set-OMEConfiguration -Identity "Message encryption configuration" -DisclaimerText ""`| + |Text that appears at the top of the encrypted mail viewing portal|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -PortalText "<empty string>"` <p> **Example reverting back to default:** <p> `Set-OMEConfiguration -Identity "Message encryption configuration" -PortalText ""`| + |Logo|`Set-OMEConfiguration -Identity "<OMEConfigurationName>" -Image <"$null">` <p> **Example reverting back to default:** <p> `Set-OMEConfiguration -Identity "Message encryption configuration" -Image $null`| + |Background color|`Set-OMEConfiguration -Identity "<ConfigurationName>" -BackgroundColor "$null">` <p> **Example reverting back to default:** <p> `Set-OMEConfiguration -Identity "Message encryption configuration" -BackgroundColor $null`| ## Remove a custom branding template (Advanced Message Encryption) You can only remove or delete branding templates that you've made. You can't rem To remove a custom branding template: -1. Using a work or school account that has global administrator permissions in your organization, connect to Exchange Online PowerShell. For instructions, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). +1. Using a work or school account that has global administrator permissions in your organization, [connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). 2. Use the **Remove-OMEConfiguration** cmdlet as follows: ```powershell- Remove-OMEConfiguration -Identity ""<OMEConfigurationName>" + Remove-OMEConfiguration -Identity "<OMEConfigurationName>" ``` For example, To remove a custom branding template: For more information, see [Remove-OMEConfiguration](/powershell/module/exchange/remove-omeconfiguration). -## Create an Exchange mail flow rule that applies your custom branding to encrypted emails +## Create an Exchange mail flow rule that applies your custom branding to encrypted emails sent from your online organization to external recipients > [!IMPORTANT]-> Third-party applications that scan and modify mail can prevent OME branding from being applied correctly. +> Third-party applications that scan and modify mail can prevent branding from being applied correctly. -After you've either modified the default template or created new branding templates, you can create Exchange mail flow rules to apply your custom branding based on certain conditions. Most importantly, the email must be encrypted. Such a rule will apply custom branding in the following scenarios: +After you've either modified the default template or created new branding templates, you can create Exchange mail flow rules to apply your custom branding based on certain conditions. Most importantly, the email must be encrypted. Such a rule will apply custom branding to mail sent from your online mailbox in the following scenarios: - If the email was manually encrypted by the end user using Outlook or Outlook on the web, formerly Outlook Web App - If the email was automatically encrypted by an Exchange mail flow rule or Microsoft Purview Data Loss Prevention policy -To ensure Microsoft Purview Message Encryption applies your custom branding, set up a mail flow rule to encrypt your email messages. The priority of the encryption rule should be higher than the branding rule so that the encryption rule is processed first. By default, if you create the encryption rule before the branding rule, then the encryption rule will have a higher priority. For information on how to create an Exchange mail flow rule that applies encryption, see [Define mail flow rules to encrypt email messages in Office 365](define-mail-flow-rules-to-encrypt-email.md). For information on setting the priority of a mail flow rule, see [Manage mail flow rules](/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules#set-the-priority-of-a-mail-flow-rule). +To ensure Microsoft Purview Message Encryption applies your custom branding, set up a mail flow rule to encrypt your messages. The priority of the encryption rule should be higher than the branding rule so that the encryption rule is processed first. By default, if you create the encryption rule before the branding rule, then the encryption rule will have a higher priority. For information, see [Define mail flow rules to encrypt email messages in Office 365](define-mail-flow-rules-to-encrypt-email.md). For information on setting the priority of a mail flow rule, see [Manage mail flow rules](/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules#set-the-priority-of-a-mail-flow-rule). 1. In a web browser, using a work or school account that has been granted global administrator permissions, [sign in to Office 365](https://support.office.com/article/b9582171-fd1f-4284-9846-bdd72bb28426#ID0EAABAAA=Web_browser). 2. Choose the **Admin** tile. -3. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>, choose **Admin centers** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">**Exchange**</a>. +3. In the Microsoft 365 admin center, choose **Admin centers** \> **Exchange**. 4. In the EAC, go to **Mail flow** \> **Rules** and select **New**  \> **Create a new rule**. For more information about using the EAC, see [Exchange admin center in Exchange Online](/exchange/exchange-admin-center). -5. In **Name**, type a name for the rule, such as Branding for sales department. +5. In **Name**, type a name for the rule, such as **Branding for sales department**. 6. In **Apply this rule if**, select the condition **The sender is located inside the organization** and other conditions you want from the list of available conditions. For example, you might want to apply a particular branding template to: To ensure Microsoft Purview Message Encryption applies your custom branding, set - Encrypted emails sent with a certain keyword such as "External" or "Partner" - Encrypted emails sent to a particular domain -7. If you've already defined a mail flow rule to apply encryption, skip this step. Otherwise, to configure the mail flow rule to apply encryption, from **Do the following**, select **Modify the message security**, and then choose **Apply Office 365 Message Encryption and rights protection**. Select an RMS template from the list and then choose **add action**. +7. If you've already defined a mail flow rule to apply encryption, skip this step. Otherwise, to configure the mail flow rule to apply encryption, from **Do the following**, select **Modify the message security**, and then select **Apply Office 365 Message Encryption and rights protection**. Select a Rights Management Service (RMS) template from the list and then select **add action**. - The list of templates includes default templates and options and any custom templates you create. If the list is empty, ensure that you have set up Microsoft Purview Message Encryption. For instructions, see [Set up Microsoft Purview Message Encryption](set-up-new-message-encryption-capabilities.md). For information about the default templates, see [Configuring and managing templates for Azure Information Protection](/information-protection/deploy-use/configure-policy-templates). For information about the **Do Not Forward** option, see [Do Not Forward option for emails](/information-protection/deploy-use/configure-usage-rights#do-not-forward-option-for-emails). For information about the **encrypt only** option, see [Encrypt Only option for emails](/information-protection/deploy-use/configure-usage-rights#encrypt-only-option-for-emails). + The list of templates includes default templates and options and any custom templates you create. If the list is empty, ensure that you have set up Microsoft Purview Message Encryption. For instructions, see [Set up Microsoft Purview Message Encryption](set-up-new-message-encryption-capabilities.md). For information about the default templates, see [Configuring and managing templates for Azure Information Protection](/information-protection/deploy-use/configure-policy-templates). For information about the **Do Not Forward** option, see [Do Not Forward option for emails](/information-protection/deploy-use/configure-usage-rights#do-not-forward-option-for-emails). For information about the **Encrypt Only** option, see [Encrypt Only option for emails](/information-protection/deploy-use/configure-usage-rights#encrypt-only-option-for-emails). 8. From **Do the following**, select **Modify the message security** \> **Apply custom branding to OME messages**. Next, from the drop-down, select a branding template. - Choose **add action** if you want to specify another action, or choose **Save**, and then choose **OK**. + Select **add action** if you want to specify another action, or select **Save**, and then select **OK**. ## Background color reference |
| compliance | Classifier Learn About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/classifier-learn-about.md | This categorization method is well suited to content that isn't easily identifie ### Where you can use classifiers -Classifiers are available to use as a condition for [Office auto-labeling with sensitivity labels](apply-sensitivity-label-automatically.md), [auto-apply retention label policy based on a condition](apply-retention-labels-automatically.md#configuring-conditions-for-auto-apply-retention-labels) and in [communication compliance](communication-compliance.md). +Classifiers are available to use as a condition for: -Sensitivity labels can use classifiers as conditions, see [Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md). +- [Office auto-labeling with sensitivity labels](apply-sensitivity-label-automatically.md) +- [Auto-apply retention label policy based on a condition](apply-retention-labels-automatically.md#configuring-conditions-for-auto-apply-retention-labels) +- [Communication compliance](communication-compliance.md) +- Sensitivity labels can use classifiers as conditions, see [Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md). +- [Data loss prevention](dlp-learn-about-dlp.md) > [!IMPORTANT] > Classifiers only work with items that are not encrypted. |
| compliance | Compliance Manager Alert Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-manager-alert-policies.md | description: "Learn how to create alerts for activities in Microsoft Purview Com [!INCLUDE [purview-preview](../includes/purview-preview.md)] ## Overview-Compliance Manger can alert you to changes as soon as they happen so that you can stay on track with your compliance goals. For example, you can set up alerts to inform you when an improvement action's score value has increased or decreased due to a configuration change in your tenant, or when an improvement action has been assigned to a user to perform implementation or testing work. View the [types of events](#create-an-alert-policy) for which you can create alerts. +Compliance Manager can alert you to changes as soon as they happen so that you can stay on track with your compliance goals. For example, you can set up alerts to inform you when an improvement action's score value has increased or decreased due to a configuration change in your tenant, or when an improvement action has been assigned to a user to perform implementation or testing work. View the [types of events](#create-an-alert-policy) for which you can create alerts. To create alerts, you first set up an alert policy to outline the conditions that trigger an alert and the frequency of notifications. When we detect a match to your policy conditions, you'll receive an email notification with details so you can determine whether to investigate or take further action. -All alerts are listed on the **Alerts** tab in Compliance Manger, and all alert policies are listed on the **Alert Policies tab**. All organizations have a [default score change policy](#default-score-change-policy) already set up for them. +All alerts are listed on the **Alerts** tab in Compliance Manager, and all alert policies are listed on the **Alert Policies tab**. All organizations have a [default score change policy](#default-score-change-policy) already set up for them. ## Understanding the Alerts and Alert policies pages All alerts are listed on the **Alerts** tab in Compliance Manger, and all alert ### Alert policies page -Select the **Alert policies** tab in Compliance Manger to view and manage your alert policies. The **Alert policies** page contains a table listing all the policies created by your organization. From this page, you can create new policies, edit existing policies, and change activation status, and delete policies. +Select the **Alert policies** tab in Compliance Manager to view and manage your alert policies. The **Alert policies** page contains a table listing all the policies created by your organization. From this page, you can create new policies, edit existing policies, change activation status, and delete policies. -In the **Status column**, **Active** means the policy is in effect and triggering alerts when conditions are met. **Inactive** means the policy exists but is't generating alerts. The policies table also shows you the severity of the policy and the date the policy was last modified. +In the **Status column**, **Active** means the policy is in effect and triggering alerts when conditions are met. **Inactive** means the policy exists but isn't generating alerts. The policies table also shows you the severity of the policy and the date the policy was last modified. To view an individual policy's details, select its row in the table. A flyout pane will appear that shows all details. Select the **Action** button at the bottom of the pane and select from options to edit the policy, view its alerts, or delete it. The commands to add, edit, delete, activate, and disable are also available near the top of the table, above the filters. You can filter your view of alerts by selecting the **Filter** command above the - Detection date - Policy name -After making your selections, select **Apply**. The flyout pane will close and your updated **Alerts** page shows your filtered view,. Your filters are displayed at the top of the table, though not all filter columns may show in the table. +After making your selections, select **Apply**. The flyout pane will close and your updated **Alerts** page shows your filtered view. Your filters are displayed at the top of the table, though not all filter columns may show in the table. ### View alert details |
| compliance | Dlp Policy Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-policy-reference.md | DLP policies detect sensitive items by matching them to a sensitive information |On-premises repositories| Yes| Yes| No| |Power BI|Yes | Yes| No| -> [!NOTE] -> DLP supports (in preview) using trainable classifiers as a condition to detect sensitive documents. Content can be defined by trainable classifiers in Exchange Online, SharePoint Online sites, OneDrive for Business accounts, Teams Chat and Channels, and Devices. For more information, see [Trainable Classifiers](classifier-learn-about.md). +DLP supports using trainable classifiers as a condition to detect sensitive documents. Content can be defined by trainable classifiers in Exchange Online, SharePoint Online sites, OneDrive for Business accounts, Teams Chat and Channels, and Devices. For more information, see [Trainable Classifiers](classifier-learn-about.md). > [!NOTE] > DLP supports detecting sensitivity labels on emails and attachments. For more information, see [Use sensitivity labels as conditions in DLP policies](dlp-sensitivity-label-as-condition.md#use-sensitivity-labels-as-conditions-in-dlp-policies). Conditions are inclusive and are where you define what you want the rule to look - [sensitive information types](sensitive-information-type-learn-about.md#learn-about-sensitive-information-types) - [sensitivity labels](sensitivity-labels.md) - [retention labels](retention.md#using-a-retention-label-as-a-condition-in-a-dlp-policy)-- [Trainable Classifiers](classifier-learn-about.md) (in preview)+- [Trainable Classifiers](classifier-learn-about.md) depending on the [location(s)](#location-support-for-how-content-can-be-defined) you choose to apply the policy to. |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | The [Azure Information Protection (AIP) unified labeling client](/azure/informat ## Support for sensitivity label capabilities in apps -The following tables list the minimum Office version that introduced specific capabilities for sensitivity labels that are built in to Office apps. Or, if the label capability is in public preview or under review for a future release: +The following tables list the minimum Office version that introduced specific capabilities for sensitivity labels built in to Office apps. Or, if the label capability is in public preview or under review for a future release: -- Table: [Sensitivity label capabilities in Word, Excel, and PowerPoint](#sensitivity-label-capabilities-in-word-excel-and-powerpoint)-- Table: [Sensitivity label capabilities in Outlook](#sensitivity-label-capabilities-in-outlook)+- [Capabilities table for Word, Excel, and PowerPoint](#sensitivity-label-capabilities-in-word-excel-and-powerpoint) +- [Capabilities table for Outlook](#sensitivity-label-capabilities-in-outlook) -Use the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap?filters=Microsoft%20Information%20Protection&searchterms=label) for details about new capabilities that are planned for future releases. +Use the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap?filters=Microsoft%20Information%20Protection&searchterms=label) for details about new labeling capabilities that are planned for future releases. New versions of Office apps are made available at different times for different update channels. For Windows, you'll get the new capabilities earlier when you are on the Current Channel or Monthly Enterprise Channel, rather than Semi-Annual Enterprise Channel. The minimum version numbers can also be different from one update channel to the next. For more information, see [Overview of update channels for Microsoft 365 Apps](/deployoffice/overview-update-channels) and [Update history for Microsoft 365 Apps](/officeupdates/update-history-microsoft365-apps-by-date). |
| compliance | Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels.md | When you create your sensitivity labels in the Microsoft Purview compliance port You can apply just one sensitivity label to an item such as a document, email, or container. If you set an option that requires your users to provide a justification for changing a label to a lower classification, the order of this list identifies the lower classifications. However, this option does not apply to sublabels that share the priority of their parent label. -The ordering of sublabels is used with [automatic labeling](apply-sensitivity-label-automatically.md), though. When you configure labels to be applied automatically or as a recommendation, multiple matches can result for more than one label. To determine the label to apply or recommend, the label ordering is used: The last sensitive label is selected, and then if applicable, the last sublabel. +The ordering of sublabels is used with [auto-labeling policies](apply-sensitivity-label-automatically.md#how-to-configure-auto-labeling-policies-for-sharepoint-onedrive-and-exchange), though. When you configure more than one auto-labeling policy for the same location, multiple matches can result for more than one label. To determine the label to apply, the label ordering is used even with sublabels: The last sensitive label is selected, and then if applicable, the last sublabel.  |
| enterprise | External Domain Name System Records | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/external-domain-name-system-records.md | Title: "External Domain Name System records for Office 365" Previously updated : 11/10/2021 Last updated : 10/14/2022 audience: Admin Email customers who are using Exchange Federation will also need the additional |**TXT** <br/> **(Exchange federation)**|Used for Exchange federation for hybrid deployment.|**TXT record 1:** For example, contoso.com and associated custom-generated, domain-proof hash text (for example, Y96nu89138789315669824) <br/> **TXT record 2:** For example, exchangedelegation.contoso.com and associated custom-generated, domain-proof hash text (for example, Y3259071352452626169)| |**CNAME** <br/> **(Exchange federation)**|Helps Outlook clients to easily connect to the Exchange Online service by using the Autodiscover service when your company is using Exchange federation. Autodiscover automatically finds the correct Exchange Server host and configures Outlook for your users.|**Alias:** For example, Autodiscover.service.contoso.com <br/> **Target:** autodiscover.outlook.com| -## External DNS records required for Skype for Business Online +## External DNS records required for Teams and Skype for Business Online <a name="BKMK_ReqdCore"> </a> -There are specific steps to take when you use [Office 365 URLs and IP address ranges](https://support.office.com/article/8548a211-3fe7-47cb-abb1-355ea5aa88a2#BKMK_LYO) to make sure your network is configured correctly. +There are specific steps to take when you use [Office 365 URLs and IP address ranges](urls-and-ip-address-ranges.md) to make sure your network is configured correctly. -> [!NOTE] -> These DNS records also apply to Teams, especially in a hybrid Teams and Skype for Business scenario, where certain federation issues could arise. +These DNS records apply to Teams, Skype for Business Online or both as indicated. |DNS record|Purpose|Value to use| ||||-|**SRV** <br/> **(Skype for Business Online)**|Allows your Office 365 domain to share instant messaging (IM) features with external clients by enabling SIP federation. Read more about [Office 365 URLs and IP address ranges](https://support.office.com/article/8548a211-3fe7-47cb-abb1-355ea5aa88a2#BKMK_LYO).|**Service:** sipfederationtls <br/> **Protocol:** TCP <br/> **Priority:** 100 <br/> **Weight:** 1 <br/> **Port:** 5061 <br/> **Target:** sipfed.online.lync.com <br/> **Note:** If the firewall or proxy server blocks SRV lookups on an external DNS, you should add this record to the internal DNS record. | -|**SRV** <br/> **(Skype for Business Online)**|Used by Skype for Business to coordinate the flow of information between Lync clients.|**Service:** sip <br/> **Protocol:** TLS <br/> **Priority:** 100 <br/> **Weight:** 1 <br/> **Port:** 443 <br/> **Target:** sipdir.online.lync.com| -|**CNAME** <br/> **(Skype for Business Online)**|Used by the Lync client to help find the Skype for Business Online service and sign in.|**Alias:** sip <br/> **Target:** sipdir.online.lync.com <br/> For more information, see [Office 365 URLs and IP address ranges](https://support.office.com/article/8548a211-3fe7-47cb-abb1-355ea5aa88a2#BKMK_LYO).| -|**CNAME** <br/> **(Skype for Business Online)**|Used by the Lync mobile client to help find the Skype for Business Online service and sign in.|**Alias:** lyncdiscover <br/> **Target:** webdir.online.lync.com| +|**SRV** <br/> **(Teams and Skype for Business Online)**|Allows your Office 365 domain to share instant messaging (IM) features with external clients by enabling SIP federation.|**Service:** sipfederationtls <br/> **Protocol:** TCP <br/> **Priority:** 100 <br/> **Weight:** 1 <br/> **Port:** 5061 <br/> **Target:** sipfed.online.lync.com <br/> **Note:** If the firewall or proxy server blocks SRV lookups on an external DNS, you should add this record to the internal DNS record. | +|**SRV** <br/> **(Teams and Skype for Business Online)**|Required by both Teams and Skype for Business Online to communicate between Skype for Business on-premises, Teams and Skype for Business cross-cloud (e.g., between Office 365 @ _sipfed.online.lync.com_ and Office 365 operated by 21Vianet @ _sipfed.online.partner.lync.cn_ or US government clouds).<br/>Required in both Teams-only and hybrid mode. In Teams-only mode it points to online edge servers (e.g. _sipfed.online.lync.com_) while in hybrid mode it points to on-premises edge servers (e.g. _sipfed.\<domain>_).|**Service:** sipfederationtls <br/> **Protocol:** TCP <br/> **Priority:** 100 <br/> **Weight:** 1 <br/> **Port:** 5061 <br/> **Target:** _sipfederationtls.tcp.\<domain> <br/> **Note:** If the firewall or proxy server blocks SRV lookups on an external DNS, you should add this record to the internal DNS record. | +|**SRV** <br/> **(Teams and Skype for Business Online)**|Required by Skype for Business Windows Desktop client and Skype for Business phones for sign-in. It may be needed by Teams-only tenants that use Skype for Business Online phones for Teams and must point to online edge servers (e.g. _sip.online.lync.com_). <br/>It is needed by hybrid tenants to support their Windows Desktop clients and phones that sign in to on-premises deployments (e.g. _sip.\<domain>_).|**Target:** _sip._tls.\<domain>| +|**CNAME** <br/> **(Teams and Skype for Business Online)**|Required by the Skype for Business desktop client for Windows, Mac, and web clients as well as Skype Meeting Application (SMA) to sign in. <br/>Also used by PowerShell cmdlets that still use Skype for Business Online infrastructure for management. Therefore, it is also needed for both Teams-only and hybrid tenants.|**Target:** lyncdiscover.\<domain>| +|**SRV** <br/> **(Skype for Business Online)**|Required by Skype for Business to coordinate the flow of information between Lync clients.|**Service:** sip <br/> **Protocol:** TLS <br/> **Priority:** 100 <br/> **Weight:** 1 <br/> **Port:** 443 <br/> **Target:** sipdir.online.lync.com| +|**CNAME** <br/> **(Skype for Business Online)**|Required by the Lync desktop client to locate the Skype for Business Online service and sign in.|**Alias:** sip <br/> **Target:** sipdir.online.lync.com| +|**CNAME** <br/> **(Skype for Business Online)**|Required by the Lync mobile client to help find the Skype for Business Online service and sign in.|**Alias:** lyncdiscover <br/> **Target:** webdir.online.lync.com| ## External DNS records required for Office 365 Single Sign-On <a name="BKMK_ReqdCore"> </a> |
| enterprise | Ipv6 Support | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/ipv6-support.md | description: "Summary: Describes IPv6 support in Microsoft 365 components and in # IPv6 support in Microsoft 365 services -With the growing adoption and support of IPv6 across enterprise networks, service providers and devices, many customers are wondering if their users can continue to access Microsoft 365 services from IPv6 clients and IPv6 networks. Microsoft 365 services can be successfully used from both IPv6 dual stack and IPv6-only devices. In fact, we have an increasing number of customers, from consumers to large enterprises, who are moving towards greater adoption of IPv6. For most customers, IPv4 won't completely disappear from their digital landscape, so we aren't planning to require IPv6 or to de-prioritize IPv4 in any Microsoft 365 features or services. +With the growing adoption and support of IPv6 across enterprise networks, service providers, and devices, many customers are wondering if their users can continue to access Microsoft 365 services from IPv6 clients and IPv6 networks. Microsoft 365 services can be successfully used from both IPv6 dual stack and IPv6-only devices (IPv6-only devices require translation technologies such as DNS64 or NAT64). In fact, we have an increasing number of customers, from consumers to large enterprises, who are moving towards greater adoption of IPv6. For most customers, IPv4 won't completely disappear from their digital landscape, so we aren't planning to require IPv6 or to de-prioritize IPv4 in any Microsoft 365 features or services. One of our key priorities with Microsoft 365 is to ensure seamless customer and user experiences over the Internet from any location, from any device. This includes access to Microsoft 365 from customer devices that are using IPv6 in the dual stack configuration as well as transitioning to IPv6-only client deployments. In most cases, when you follow a standard Internet-based model of connecting to Microsoft 365 as described in [Microsoft 365 network connectivity principles](microsoft-365-network-connectivity-principles.md), [Microsoft 365 URLs and IP address ranges](urls-and-ip-address-ranges.md), and [Microsoft 365 network planning best practices](network-and-migration-planning.md#best-practices-for-network-planning-and-improving-migration-performance-for-office-365), IPv6 transitions won't be disruptive to your user experience. |
| enterprise | Setup Guides For Microsoft 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/setup-guides-for-microsoft-365.md | Give users the ability to change or reset their password independently, if their Use the [Plan your self-service password reset deployment](https://aka.ms/SSPRSetupGuide) guide to receive relevant articles and instructions for configuring the appropriate Azure portal options to help you deploy SSPR in your environment. -### Active Directory Federation Services (AD FS) deployment advisor --The [AD FS deployment advisor](https://aka.ms/adfsguidance) provides you with step-by-step guidance on deploying an on-premises AD FS infrastructure that authenticates users for Microsoft 365 and Office 365 services. With this guide, your organization can review AD FS components and requirements, acquire and install SSL certificates that are necessary for deployment, and install a required web application proxy server. - ## Guides for security and compliance ### Security analyzer |
| security | TOC | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/TOC.md | #### [Tamper protection]() ##### [Protect security settings with tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) ##### [Manage tamper protection using Microsoft 365 Defender](manage-tamper-protection-microsoft-365-defender.md) -##### [Manage tamper protection using Microsoft Endpoint Manager](manage-tamper-protection-microsoft-endpoint-manager.md) +##### [Manage tamper protection using Microsoft Intune](manage-tamper-protection-microsoft-endpoint-manager.md) ##### [Manage tamper protection with Configuration Manager](manage-tamper-protection-configuration-manager.md) ##### [Manage tamper protection on an individual device](manage-tamper-protection-individual-device.md) ##### [FAQs on tamper protection](faqs-tamper-protection.md) |
| security | Manage Tamper Protection Microsoft Endpoint Manager | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-tamper-protection-microsoft-endpoint-manager.md | Title: Manage tamper protection for your organization using Microsoft Endpoint Manager + Title: Manage tamper protection for your organization using Microsoft Intune -description: Turn tamper protection on or off for your organization in Microsoft Endpoint Manager. -keywords: malware, defender, antivirus, tamper protection, Microsoft Endpoint Manager +description: Turn tamper protection on or off for your organization in Microsoft Intune. +keywords: malware, defender, antivirus, tamper protection, Microsoft Intune ms.pagetype: security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium Last updated : 10/14/2022 audience: ITPro -# Manage tamper protection for your organization using Microsoft Endpoint Manager +# Manage tamper protection for your organization using Microsoft Intune **Applies to:** search.appverid: met150 **Platforms** - Windows +If your organization uses [Microsoft Intune](/mem/intune/fundamentals/what-is-intune), you can turn tamper protection on (or off) for your organization in the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com). Use Intune when you want to fine-tune tamper protection settings. For example, if you want to enable tamper protection on some devices, but not all, use Intune. -If your organization uses Microsoft Endpoint Manager (MEM) you can turn tamper protection on (or off) for your organization in the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). Use Intune when you want to fine-tune tamper protection settings. For example, if you want to enable tamper protection on some devices, but not all, use Intune. --## Requirements for managing tamper protection in Endpoint Manager +## Requirements for managing tamper protection in Intune - You must have appropriate [permissions](/microsoft-365/security/defender-endpoint/assign-portal-access) assigned, such as global admin, security admin, or security operations.-- Your organization uses [Microsoft Endpoint Manager to manage devices](/mem/endpoint-manager-getting-started). (Microsoft Endpoint Manager (MEM) licenses are required; MEM is included in Microsoft 365 E3/E5, Enterprise Mobility + Security E3/E5, Microsoft 365 Business Premium, Microsoft 365 F1/F3, Microsoft 365 Government G3/G5, and corresponding education licenses.)-- Your Windows devices must be running Windows 11 or Windows 10 [1709](/lifecycle/announcements/revised-end-of-service-windows-10-1709), [1803](/lifecycle/announcements/windows-server-1803-end-of-servicing), [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), or later. (For more information about releases, see [Windows 10 release information](/windows/release-health/release-information).)+- Your organization uses [Intune to manage devices](/mem/endpoint-manager-getting-started). (Intune licenses are required; Intune is included in Microsoft 365 E3/E5, Enterprise Mobility + Security E3/E5, Microsoft 365 Business Premium, Microsoft 365 F1/F3, Microsoft 365 Government G3/G5, and corresponding education licenses.) +- Your Windows devices must be running Windows 10 [version 1709 or later](/lifecycle/announcements/revised-end-of-service-windows-10-1709) or Windows 11. (For more information about releases, see [Windows 10 release information](/windows/release-health/release-information).) - You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above). - Your devices must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version `1.1.15500.X` (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).)+- Your Intune and Defender for Endpoint tenants must share the same Microsoft Entra (Azure Active Directory) infrastructure. +- Your devices must be onboarded to Defender for Endpoint. ++> [!NOTE] +> If your devices are not enrolled in Microsoft Defender for Endpoint, tamper protection will show as **Not Applicable** until the onboarding process completes. -## Turn tamper protection on (or off) in Microsoft Endpoint Manager +## Turn tamper protection on (or off) in Microsoft Intune :::image type="content" source="images/turnontamperprotectinmem.png" alt-text="Turn tamper protection turned on with Intune" lightbox="images/turnontamperprotectinmem.png"::: 1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Endpoint security** \> **Antivirus**, and then choose **+ Create Policy**. - - In the **Platform** list, select **Windows 10 and later**. + - In the **Platform** list, select **Windows 10, Windows 11, and Windows Server**. - In the **Profile** list, select **Windows Security experience**. 2. Create a profile that includes the following setting: - - **Enable tamper protection to prevent Microsoft Defender being disabled: Enable** + - **TamperProtection (Device): Enable** 3. Assign the profile to one or more groups. |
| security | Allow Block Email Spoof | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/allow-block-email-spoof.md | You can't create allow entries for domains and email addresses directly in the T For instructions, see [Report good email to Microsoft](admin-submission.md#report-good-email-to-microsoft). > [!NOTE]-> Because Microsoft manages allow entries for you, unneeded allow entries for domains and email addresses will be removed. This behavior protects your organization and helps prevent misconfigured allow entries. If you disagree with the verdict, you might need to open a support case to help determine why a message is still considered bad. +> Microsoft does not allow you to create allow entries directly as it leads to creation of allows that are not needed, thus exposing the customer's tenant to malicious emails which might otherwise have been filtered by the system. >-> If the domain or email address has not already been blocked, an allow entry for the domain or email address won't be created. +> Microsoft manages the allow creation process from Submission by creating allows for those entities (domains or email addresses, spoofed senders, URLs, files) which were determined to be malicious by filters during mail flow. For example, if the sender and a URL in the message were determined to be bad, an allow entry is created for the sender, and an allow entry is created for the URL. >-> In most cases where the message was determined to be a false positive that was incorrectly blocked, the allow entry will be removed on the specified expiration date. +> When that entity (domain or email address, URL, file) is encountered again, all filters associated with that entity are skipped. >-> To create allow entries for spoofed senders, see the [Create allow entries for spoofed senders](#create-allow-entries-for-spoofed-senders) section later in this article. +> During mail flow, if messages from the domain or email address pass other checks in the filtering stack, the messages will be delivered. For example, if [email authentication](email-validation-and-authentication.md) passes, a message from a sender in the allow entry will be delivered. ### Use the Microsoft 365 Defender portal to view allow or block entries for domains and email addresses in the Tenant Allow/Block List When you modify allow or block entries for domains and email addresses in the Te When you're finished, click **Save**. +Note that with **allow expiry management** (currently in private preview), if Microsoft has not learned from the allow, Microsoft will automatically extend the expiry time of allows, which are going to expire soon, by 30 days to prevent legitimate email from going to junk or quarantine again. If Microsoft does not learn within 90 calendar days from the date of allow creation, Microsoft will remove the allow. ++If Microsoft has learned from the allow, the allow will be removed and you will get an alert informing you about it. + > [!NOTE] > For allow entries only, if you select the entry by clicking anywhere in the row other than the check box, you can select  **View submission** in the details flyout that appears to go to the **Submissions** page at <https://security.microsoft.com/reportsubmission>. |
| security | Configure Review Priority Account | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-review-priority-account.md | f1.keywords: Previously updated : 3/21/2022 Last updated : 10/14/2022 audience: ITPro ms.localizationpriority: medium The affects of priority account protection are visible in the following features - [Custom alert policies](../../compliance/alert-policies.md#view-alerts) - [Threat Explorer and real-time detections](threat-explorer.md) - [Compromised user report](view-email-security-reports.md#compromised-users-report)-- [Email entity page](mdo-email-entity-page.md#other-innovations)+- [Email entity page](mdo-email-entity-page.md) - [Threat protection status report](view-email-security-reports.md#threat-protection-status-report) - [Top senders and recipients report](view-email-security-reports.md#top-senders-and-recipients-report) - [Attack simulation](attack-simulation-training.md#target-users) |
| security | Manage Tenant Allow Block List | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/manage-tenant-allow-block-list.md | The following list describes what happens in the Tenant Allow/Block List when yo - **Email**: If a message was blocked by the Microsoft 365 filtering stack, an allow entry might be created in the Tenant Allow/Block List: - - If the message was blocked by [spoof intelligence](learn-about-spoof-intelligence.md), an allow entry for the sender is created and it appears on the **Spoofed senders** tab in the Tenant Allow Block List. + - If the message was blocked by [spoof intelligence](learn-about-spoof-intelligence.md), an allow entry for the sender is created, and it appears on the **Spoofed senders** tab in the Tenant Allow Block List. - If the message was blocked by [domain or user impersonation protection](set-up-anti-phishing-policies.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365) in Defender for Office 365, an allow entry is not created in the Tenant Allow/Block List. Instead, the domain or sender is added to the **Trusted senders and domains section** in the [anti-phishing policy](configure-mdo-anti-phishing-policies.md#use-the-microsoft-365-defender-portal-to-modify-anti-phishing-policies) that detected the message. - - If the message was blocked for other reasons, an allow entry for the sender is created and it appears on the **Domains & addresses** tab in the Tenant Allow Block List. + - If the message was blocked for other reasons, an allow entry for the sender is created, and it appears on the **Domains & addresses** tab in the Tenant Allow Block List. - - If the message was not blocked, and allow entry for the sender is not created, it won't on the **Spoofed senders** tab or the **Domains & addresses** tab. + - If the message was not blocked, and an allow entry for the sender is not created, it won't on the **Spoofed senders** tab or the **Domains & addresses** tab. By default, allow entries for **domains and email addresses**, **files** and **URLs** expire after 30 days, which is also the maximum. Allow entries for **spoofed senders** never expire. > [!NOTE]-> Because Microsoft manages allow entries for you, unneeded allow entries for **domains and email addresses**, **URLs**, or **files** will be removed. This behavior protects your organization and helps prevent misconfigured allow entries. If you disagree with the verdict, you might need to open a support case to help determine why a message is still considered bad. +> Microsoft does not allow you to create allow entries directly as it leads to creation of allows that are not needed, thus exposing the customer's tenant to malicious emails which might otherwise have been filtered by the system. >-> Allows are added during mail flow, based on which filters determined the message to be malicious. For example, if the sender and a URL in the message were determined to be bad, an allow entry is created for the sender, and an allow entry is created for the URL. +> Microsoft manage the allow creation process from Submission by creating allows for those entities (domains or email addresses, spoofed senders, URLs, files) which were determined to be malicious by filters during mail flow. For example, if the sender and a URL in the message were determined to be bad, an allow entry is created for the sender, and an allow entry is created for the URL. > > When that entity (domain or email address, URL, file) is encountered again, all filters associated with that entity are skipped. > By default, allow entries for **domains and email addresses**, **files** and **U After you add an allow entry through the Submissions portal or a block entry in the Tenant Allow/Block List, the entry should start working immediately 99.999% of the time. For the rest, it could take up to 24 hours. We recommend letting entries automatically expire after 30 days to see if the system has learned about the allow or block. If not, you should make another entry to give the system another 30 days to learn.++Note that with **allow expiry management** (currently in private preview), if Microsoft has not learned from the allow, Microsoft will automatically extend the expiry time of allows, which are going to expire soon, by 30 days to prevent legitimate email from going to junk or quarantine again. If Microsoft does not learn within 90 calendar days from the date of allow creation, Microsoft will remove the allow. ++If Microsoft has learned from the allow, the allow will be removed and you will get an alert informing you about it. |
| security | Mdo Email Entity Page | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-email-entity-page.md | f1.keywords: Previously updated : 08/12/2022 Last updated : 10/14/2022 audience: ITPro search.appverid: met150 - [Microsoft 365 Defender](../defender/microsoft-365-defender.md) **In this article:**-- [Reach the email entity page](#reach-the-email-entity-page)-- [Read the email entity page](#read-the-email-entity-page)-- [Use email entity page tabs](#use-email-entity-page-tabs)-- [New to the email entity page](#new-to-the-email-entity-page)+- [Reach the email entity page](#how-to-get-to-the-email-entity-page) +- [Read the email entity page](#how-to-read-the-email-entity-page) +- [Use email entity page tabs](#how-to-use-the-email-entity-page-tabs) +- [New to the email entity page](#available-on-the-email-entity-page) Admins of Microsoft Defender for Office 365 E5, and Defender for Office P1 and P2 have a 360-degree view of email using the **Email entity page**. This go-to email page was created to enhance information delivered on the [Threat Explorer 'email details' fly-out](threat-explorer-views.md). |
| security | Tenant Wide Setup For Increased Security | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-wide-setup-for-increased-security.md | Inside each report, you'll see cards for the specific areas monitored. 1. Click the **Email & Collaboration reports**. 1. Take note of the report cards available. 1. Everything from *Malware detected in email*, to *Spam detections*, *Compromised users*, to *User reported messages* and *Submissions* the final two, with a button that links to Submissions.-1. Click a report, such as *Mailflow status summary* and the click the **View details** button to dig into the data (which even includes a funnel view for easier interpretation of total mail flow vs. blocked, spam, and phishing emails, and more). +1. Click a report, for example *Mailflow status summary* and the click the **View details** button to dig into the data (which even includes a funnel view for easier interpretation of total mail flow vs. blocked, spam, and phishing emails, and more). |Dashboard|Description| |||-|Email security reports|These reports are available in Exchange Online Protection. For more information, see [View email security reports in the Microsoft 365 Defender portal](view-email-security-reports.md).| +|Security reports| Identities and device security reports such as users and devices with malware detections, device compliance, and users at risk.| |Defender for Office 365 reports|The reports are available only in Defender for Office 365. For more information, see [View Defender for Office 365 reports in the Microsoft 365 Defender portal](view-reports-for-mdo.md).| |Mail flow reports and insights|These reports and insights are available in the Exchange admin center (EAC). For more information, see [Mail flow reports](/exchange/monitoring/mail-flow-reports/mail-flow-reports) and [Mail flow insights](/exchange/monitoring/mail-flow-insights/mail-flow-insights).| |[Threat Explorer (or real-time detections)](threat-explorer.md)|If you are investigating or experiencing an attack against your tenant, use Explorer (or real-time detections) to analyze threats. Explorer (and the real-time detections report) shows you the volume of attacks over time, and you can analyze this data by threat families, attacker infrastructure, and more. You can also mark any suspicious email for the Incidents list.| |
| security | User Tags | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/user-tags.md | After you apply system tags or custom tags to users, you can use those tags as f - [Custom alert policies](../../compliance/alert-policies.md#view-alerts) - [Threat Explorer and real-time detections](threat-explorer.md) - [Compromised user report](view-email-security-reports.md#compromised-users-report)-- [Email entity page](mdo-email-entity-page.md#other-innovations)+- [Email entity page](mdo-email-entity-page.md) - [Threat protection status report](view-email-security-reports.md#threat-protection-status-report) - [Top senders and recipients report](view-email-security-reports.md#top-senders-and-recipients-report) - [Attack simulation](attack-simulation-training.md#target-users) |
| security | Whats New In Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/whats-new-in-defender-for-office-365.md | For more information on what's new with other Microsoft Defender security produc - [What's new in Microsoft Defender for Identity](/defender-for-identity/whats-new) - [What's new in Microsoft Defender for Cloud Apps](/cloud-app-security/release-notes) +## October 2022 ++- **[Manage your allows and blocks in the Tenant Allow/Block List](manage-tenant-allow-block-list.md):** + - With **allow expiry management** (currently in private preview), if Microsoft has not learned from the allow, Microsoft will automatically extend the expiry time of allows, which are going to expire soon, by 30 days to prevent legitimate email from going to junk or quarantine again. + - Customers in the government cloud environments will now be able to create allow and block entries for URLs and attachments in the Tenant Allow/Block List using the admin URL and email attachment submissions. The data submitted through the submissions experience will not leave the customer tenant, thus satisfying the data residency commitments for government cloud clients. + ## September 2022 **Automatic redirection from Office 365 Security and Compliance Center to Microsoft 365 Defender portal:** Automatic redirection begins for users accessing the security solutions in Office 365 Security and Compliance center (protection.office.com) to the appropriate solutions in Microsoft 365 Defender portal (security.microsoft.com). This is for all security workflows like: Alerts, Threat Management, and Reports. |