| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| threat-intelligence | Index Backup | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/defender/threat-intelligence/index-backup.md | Title: 'What is Microsoft Defender Threat Intelligence (Defender TI)?' -description: 'In this overview article, learn about the main features that come with Microsoft Defender Threat Intelligence (Defender TI).' + Title: 'What is Microsoft Defender Threat Intelligence (Defender TI)? - Backup' +description: 'In this overview article, learn about the main features that come with Microsoft Defender Threat Intelligence (Defender TI). - Backup' Last updated 08/02/2022 -# What is Microsoft Defender Threat Intelligence (Defender TI)? +# What is Microsoft Defender Threat Intelligence (Defender TI)? - Backup Microsoft Defender Threat Intelligence (Defender TI) is a platform that streamlines triage, incident response, threat hunting, vulnerability management, and cyber threat intelligence analyst workflows when conducting threat infrastructure analysis and gathering threat intelligence. Analysts spend a significant amount of time on data discovery, collection, and parsing, instead of focusing on what actually helps their organization defend themselves--deriving insights about the actors through analysis and correlation.? |
| admin | Meetings New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/adoption/meetings-new.md | -description: "Details of new Meetings insights score - people experiences Adoption Score." +description: "Details of new Meetings insights score - people experiences Adoption Score." + # Meetings insights score ΓÇô People experiences (New) |
| admin | Signup Business Basic | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/setup/signup-business-basic.md | description: "Learn how to sign up for a Microsoft 365 Business Basic subscripti Want to sign up for a Microsoft 365 Business Basic? There are a couple of ways to get started:+ - **[Buy](https://go.microsoft.com/fwlink/?linkid=2181424) Microsoft 365 Business Basic and complete the set up**. [Follow the steps below for info on how to buy](#sign-up-steps). - **For Microsoft partners**: **Do we have a link here?** There are a couple of ways to get started: - [Sign up for a home or family plan](https://go.microsoft.com/fwlink/?linkid=2109398) if you're not buying for a business. -> [!Note] +> [!NOTE] > Microsoft 365 Business Basic subscription is for commercial use and is intended for business customers. ## Sign up steps To buy, and sign up for Microsoft 365 Business Basic subscription, complete the 2. On the **Thank you for choosing Microsoft 365 Business Basic** page, enter an email address that you already use. This can be any address you want Microsoft to use to communicate with you during setup. It is also the address where we'll send you information about your bill and renewals. Select **Next**. 3. Select **Set up account** and enter your name, business phone number, business size, company name, and location. Select **Next**. -> [!NOTE] -> We display your company name in the Microsoft 365 admin center. This is where you manage users, licenses and other features and services. We also include it in any internal SharePoint site URLs. + > [!NOTE] + > We display your company name in the Microsoft 365 admin center. This is where you manage users, licenses and other features and services. We also include it in any internal SharePoint site URLs. 4. Help us make sure this is you. Enter a number that we can use to reach you and select **Send Verification Code**. You'll receive a text. Enter your code and select **Verify**. To buy, and sign up for Microsoft 365 Business Basic subscription, complete the 6. Select how many business licenses you want for your organization and select **Add payment method** and continue with checkout to **Place order**. -3. On the **Confirmation details** page, we'll give you some more info about your subscription. You can now go to the Microsoft 365 admin center to add users, install Office apps, invite your team to use Microsoft 365 and more. We'll also send you an email with set up steps. +7. On the **Confirmation details** page, we'll give you some more info about your subscription. You can now go to the Microsoft 365 admin center to add users, install Office apps, invite your team to use Microsoft 365 and more. We'll also send you an email with set up steps. Follow these steps to [finish setting up](setup-apps-for-business.md) your Microsoft Business Basic subscription. You can also [add a domain](../setup/add-domain.md) when you're ready. When signing up for Microsoft 365 Business Basic, you have 2 options for how to The table below outlines each choice. -||**Option 1** ΓÇô Sign in with Outlook, Hotmail, Yahoo, Gmail or other email account [(Simplified Sign-up)](#terms-of-service-update-for-simplified-sign-up-mode)|**Option 2** ΓÇô Add a business domain and create a new business email account | -|:--|:--|:--| -|Available apps and services <br/> |Use Word for the web, Excel for the web, PowerPoint for the web, Teams for the web and Access for the web. OneDrive and SharePoint desktop app are included. This set of apps is best for very small businesses who don't need branded email immediately, or who already use branded email from a different provider and do not intend to switch to use Microsoft Exchange. YouΓÇÖll use Outlook with your existing email account (be it outlook.com, Hotmail, Yahoo, Gmail or other). <br/> |Use Word for the web, Excel for the web, PowerPoint for the web, Teams for the web and Access for the web. OneDrive and SharePoint desktop app are included. Microsoft 365 Business Basic with Option 2 also lets you access a wide range of additional -|Required knowledge <br/> |LetΓÇÖs you get started without technical know-how. <br/> |Requires you to buy a domain, or to own a domain. You may need technical knowledge to prove ownership of the domain. <br/> | -|Data handling <br/> |Available under the Supplement to the [Microsoft Services Agreement](https://go.microsoft.com/fwlink/p/?linkid=2180702) and is best for businesses that want some remote work and collaboration tools and are comfortable with Microsoft acting as controller for your data under the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?LinkId=521839). Subscribers to services using this option will not have access to an individualΓÇÖs user content or data until a domain is attached. Subscribers should evaluate data ownership and intellectual property rights considerations based on their needs. For example, if you are working collaboratively with other users on a document stored in their account, they may choose to make those documents inaccessible to you. As such, you should evaluate data ownership and intellectual property rights considerations accordingly. Separately, users may choose not to transfer documents in their Simplified Sign-Up account to your Domain Account subscription, even after you invite them to do so. This means their documents may also not be accessible to you even if you add a domain account later <br/> |Available under the [Microsoft Online Subscription Agreement](https://go.microsoft.com/fwlink/p/?linkid=2180430) and is best for businesses that need Microsoft to act as a processor for their data under Microsoft's [Data Protection Addendum](https://go.microsoft.com/fwlink/p/?linkid=2180314) and need our full suite of remote work and collaboration tools. Subscribers who are in regulated industries or seek more control, both over the use of the services by your employees and over processing of related data by Microsoft, should choose Option 2 and attach a domain and sign up under the Domain Account enterprise-level agreement. <br/> | +| |**Option 1** ΓÇô Sign in with Outlook, Hotmail, Yahoo, Gmail or other email account [(Simplified Sign-up)](#terms-of-service-update-for-simplified-sign-up-mode)|**Option 2** ΓÇô Add a business domain and create a new business email account | +|||| +|Available apps and services|Use Word for the web, Excel for the web, PowerPoint for the web, Teams for the web and Access for the web. OneDrive and SharePoint desktop app are included. This set of apps is best for very small businesses who don't need branded email immediately, or who already use branded email from a different provider and do not intend to switch to use Microsoft Exchange. You'll use Outlook with your existing email account (be it outlook.com, Hotmail, Yahoo, Gmail or other).|Use Word for the web, Excel for the web, PowerPoint for the web, Teams for the web and Access for the web. OneDrive and SharePoint desktop app are included. Microsoft 365 Business Basic with Option 2 also lets you access a wide range of additional +|Required knowledge|Let's you get started without technical know-how.|Requires you to buy a domain, or to own a domain. You may need technical knowledge to prove ownership of the domain.| +|Data handling|Available under the Supplement to the [Microsoft Services Agreement](https://go.microsoft.com/fwlink/p/?linkid=2180702) and is best for businesses that want some remote work and collaboration tools and are comfortable with Microsoft acting as controller for your data under the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?LinkId=521839). Subscribers to services using this option will not have access to an individual's user content or data until a domain is attached. Subscribers should evaluate data ownership and intellectual property rights considerations based on their needs. For example, if you are working collaboratively with other users on a document stored in their account, they may choose to make those documents inaccessible to you. As such, you should evaluate data ownership and intellectual property rights considerations accordingly. Separately, users may choose not to transfer documents in their Simplified Sign-Up account to your Domain Account subscription, even after you invite them to do so. This means their documents may also not be accessible to you even if you add a domain account later|Available under the [Microsoft Online Subscription Agreement](https://go.microsoft.com/fwlink/p/?linkid=2180430) and is best for businesses that need Microsoft to act as a processor for their data under Microsoft's [Data Protection Addendum](https://go.microsoft.com/fwlink/p/?linkid=2180314) and need our full suite of remote work and collaboration tools. Subscribers who are in regulated industries or seek more control, both over the use of the services by your employees and over processing of related data by Microsoft, should choose Option 2 and attach a domain and sign up under the Domain Account enterprise-level agreement.| Use these three factors to determine which of the two options is best for your business needs. You'll sign in to Microsoft 365 with this email address. For example, alliebelle 3. On the **Confirmation details** page, we'll give you some more info about your subscription. You can now go to the Microsoft 365 admin center to add users, install Office apps, invite your team to use Microsoft 365 and more. We'll also send you an email with set up steps for Microsoft 365 Business Basic. -Remember this option doesn't provide branded email, admin control for use of the services by other users, or industry specific compliance support. Subscribers don't have any access or control over other usersΓÇÖ (employees) usage or documents under this option Users may choose not to transfer data created in storage such as OneDrive/Teams to your upgraded, enterprise-level domain account should you not choose option 2 immediately. +Remember this option doesn't provide branded email, admin control for use of the services by other users, or industry specific compliance support. Subscribers don't have any access or control over other users' (employees) usage or documents under this option Users may choose not to transfer data created in storage such as OneDrive/Teams to your upgraded, enterprise-level domain account should you not choose option 2 immediately. <!--This option isn't recommended for larger businesses, including specialty industries such as healthcare or legal.--> ### Option 2: Create a new business email account and attach a domain -With this option, youΓÇÖll be able to use Microsoft 365 Exchange as your professional, branded email provider. All your users will have a shared domain email address. For example, their username, followed by @contoso.com. You and your users sign into Microsoft 365 with this new email address. When you follow this process (add a domain and create new business email accounts), youΓÇÖll get access to all the features provided in Microsoft 365 Business Basic. For steps on how to buy or add a domain, see [Set up Microsoft 365 Business Basic](../setup/setup-business-basic.md). +With this option, you'll be able to use Microsoft 365 Exchange as your professional, branded email provider. All your users will have a shared domain email address. For example, their username, followed by @contoso.com. You and your users sign into Microsoft 365 with this new email address. When you follow this process (add a domain and create new business email accounts), you'll get access to all the features provided in Microsoft 365 Business Basic. For steps on how to buy or add a domain, see [Set up Microsoft 365 Business Basic](../setup/setup-business-basic.md). :::image type="content" source="../../media/ssu-create-biz-email.png" alt-text="Screenshot: Sign in with new business email."::: If you previously used Simplified Sign Up mode to purchase a business subscripti The Simplified Sign Up terms of use have been recently updated, and notably they clarify licensing and data ownership for multi-user business subscriptions. For continued service of your business subscription, you may either visit the [Microsoft 365 admin Center](https://go.microsoft.com/fwlink/?linkid=2024339) and stay using **Simplified Sign Up** (and agree to use the Microsoft Services Agreement Supplemental), or visit the [Microsoft 365 admin Center](https://go.microsoft.com/fwlink/?linkid=2024339) and add a **business domain** (and use the Microsoft Online Services Agreement). To help you choose which of these two modes best suits your needs, consult the table at the top of this article. -Should you choose not to accept the updated terms for Simplified Sign Up or to add a business domain, your subscription will not automatically renew, and at the end of your current subscription contract, you will lose access to the Office apps. Your OneDrive data will be retained for 90 days for you to make copies of it, and then it will be deleted. +Should you choose not to accept the updated terms for Simplified Sign Up or to add a business domain, your subscription will not automatically renew, and at the end of your current subscription contract, you will lose access to the Office apps. Your OneDrive data will be retained for 90 days for you to make copies of it, and then it will be deleted. ## Frequently asked questions There are three options for getting a business email. ### Why might I need to verify my domain to create a business email? -If you choose to use a domain you already own, you can use it for your email address with Microsoft 365. As part of sign up process, we ask you to verify the domain so you can send emails via Microsoft 365. This confirms that you are the owner of the domain that is sending emails with that identity, which enhances security and prevents fraudulent activity. +If you choose to use a domain you already own, you can use it for your email address with Microsoft 365. As part of sign up process, we ask you to verify the domain so you can send emails via Microsoft 365. This confirms that you are the owner of the domain that is sending emails with that identity, which enhances security and prevents fraudulent activity. ### Is there a benefit to paying monthly vs annually? Contact our small business support experts who can help you change your business ## Set up Microsoft 365 Business Basic For steps on how to buy or add a domain, see [Set up Microsoft 365 Business Basic with a new or existing domain](../setup/setup-business-basic.md).- |
| business-premium | M365 Campaigns Setup | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365-campaigns-setup.md | audience: Admin Previously updated : 09/15/2022 Last updated : 10/18/2022 ms.localizationpriority: high - M365-Campaigns Users who have been added to your Microsoft 365 for Campaigns (or Microsoft 365 2. Sign in using the username and password for the account. Users will have this information in the email they receive when they are added as users. If they can't find the email, see [user didn't receive invite email](../admin/simplified-signup/admin-invite-business-standard.md#i-shared-an-email-invite-but-the-user-didnt-receive-the-email). > [!TIP]-> Provide your staff a link to the [Employee quick setup guide](../admin/setup/employee-quick-setup.md) for help signing in, getting Office apps, and saving, copying, and sharing files. +> Provide your staff a link to the [Employee quick setup guide](../admin/setup/employee-quick-setup.md) for help signing in, getting Microsoft 365 apps, and saving, copying, and sharing files. ## Customize your sign-in page with a privacy and consent notice |
| business-premium | M365bp Add Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-add-users.md | The following information tells you how to use Microsoft 365 Business Premium to **Not an admin?** [Learn your way around Microsoft 365](https://support.microsoft.com/office/396b8d9e-e118-42d0-8a0d-87d1f2f055fb) helps business and home users with set up. - **No Office apps in your plan?** Follow the steps below, but skip the sections for installing apps. Use the [Online versions of Office](https://support.microsoft.com/office/91a4ec74-67fe-4a84-a268-f6bdf3da1804) instead. + **No Microsoft 365 apps in your plan?** Follow the steps below, but skip the sections for installing apps. Use the [Online versions of Office](https://support.microsoft.com/office/91a4ec74-67fe-4a84-a268-f6bdf3da1804) instead. ## How to add a new user And here's a quick reference to help them get started: |**Task**|**Find the details**| |:--|:--| |Sign in to Office <br/> |Go to [https://www.office.com](https://www.office.com), select **Sign in**, and then enter your user ID and password. <br/> |-|Install Office apps onto your computer. <br/><br/> |When you sign in, the home page has a link to download and install apps like Word and Outlook. Select **Install Office**. For instructions, see [How to install Office](https://support.microsoft.com/office/4414eaaf-0478-48be-9c42-23adc4716658). <br/> | -|Set up your email in Outlook 2016 . <br/> |Once Office apps are installed on your computer, set up your email. For instructions, see [How to set up Outlook](https://support.microsoft.com/office/6e27792a-9267-4aa4-8bb6-c84ef146101b). <br/> | +|Install Microsoft 365 apps onto your computer. <br/><br/> |When you sign in, the home page has a link to download and install apps like Word and Outlook. Select **Install Office**. For instructions, see [How to install Office](https://support.microsoft.com/office/4414eaaf-0478-48be-9c42-23adc4716658). <br/> | +|Set up your email in Outlook 2016 . <br/> |Once Microsoft 365 apps are installed on your computer, set up your email. For instructions, see [How to set up Outlook](https://support.microsoft.com/office/6e27792a-9267-4aa4-8bb6-c84ef146101b). <br/> | |Set up Skype for Business so you can connect with co-workers or business partners in your company or around the world. You can start conversations with IM, voice, or video calls. <br/> |[Install Skype for Business on your computer](https://support.microsoft.com/office/8a0d4da8-9d58-44f9-9759-5c8f340cb3fb). <br/> <br/>To learn how to use Skype for Business, [watch a video.](https://support.microsoft.com/office/3a21eca4-434d-41f1-ab06-3d4a268573b7) <br/> <br/>Have you set up Skype for Business so your employees can contact people external to your business who are using the free Skype app? If not, tell your new employee so they know what to expect when using Skype for Business. <br/> | |Install apps on your mobile device if you want to get email or use Skype for Business on your phone. <br/> |If you want to set up the Outlook mobile app so you can get email via your phone. For instructions, see [iOS](https://support.microsoft.com/office/b2de2161-cc1d-49ef-9ef9-81acd1c8e234), [Android](https://support.microsoft.com/office/886db551-8dfa-4fd5-b835-f8e532091872), [Windows Phone](https://support.microsoft.com/office/181a112a-be92-49ca-ade5-399264b3d417) <br/> <br/>If you want to use Skype for Business on your mobile device, download and install the mobile app. For instructions, see [iOS](https://support.microsoft.com/office/3239c8a3-cf55-4ff0-a967-5de51911c049#OS_Type=iOS), [Android](https://support.microsoft.com/office/4d1b7dfa-5b0b-4868-bae5-25947fb99e6e#OS_Type=Android), [Windows Phone](https://support.microsoft.com/office/4d1b7dfa-5b0b-4868-bae5-25947fb99e6e#OS_Type=Windows_Phone) <br/> | |Complete the OneDrive for Business training to help you learn how to store and organize your documents, presentations, and spreadsheets in the cloud. <br/> |Keep your business-related documents in the cloud by using OneDrive for Business. You can always get to your content, even if you're signed in to Microsoft 365 on a different computer. [Watch a video to learn how to use your OneDrive for Business](https://support.microsoft.com/office/b30da4eb-ddd2-44b6-943b-e6fbfc6b8dde) <br/><br/> **Training:** [OneDrive for Business training](https://support.microsoft.com/office/1f608184-b7e6-43ca-8753-2ff679203132) (Select OneDrive for Business). <br/> | |
| business-premium | M365bp Collaborate Share Securely | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-collaborate-share-securely.md | description: "An overview on how to collaborate and share files and communicate :::image type="content" source="media/mission5.png" alt-text="Collaborate and share securely using Microsoft Teams SharePoint and OneDrive."::: -Now that you're protected by the Microsoft 365 Business Premium Office apps, your next mission is to set up secure file sharing and communication. The best way to collaborate and share securely is to use Microsoft Teams. With Microsoft Teams, all your files and communications are in a protected environment and aren't being stored in unsafe ways outside of it. Your organization depends on protecting your data and information, which means that you want to protect your files by all means possible. +Now that you're protected by the Microsoft 365 Business Premium Microsoft 365 apps, your next mission is to set up secure file sharing and communication. The best way to collaborate and share securely is to use Microsoft Teams. With Microsoft Teams, all your files and communications are in a protected environment and aren't being stored in unsafe ways outside of it. Your organization depends on protecting your data and information, which means that you want to protect your files by all means possible. Your objectives are to: |
| business-premium | M365bp Device States | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-device-states.md | Title: "Device states" + Title: "View device status with Microsoft Defender for Business" f1.keywords: - NOCSH audience: Admin Previously updated : 09/15/2022 Last updated : 10/18/2022 ms.localizationpriority: high - tier1 search.appverid: - BCS160 - MET150 - MOE150-description: "Learn about the various device states in the Device actions list in Admin home in Microsoft 365 for business." +description: "View device health with Defender for Business in Microsoft 365 Business Premium." -# Device states in Microsoft 365 for business +# View device status in Microsoft Defender for Business -This article applies to Microsoft 365 Business Premium. +Microsoft Defender for Business is included with Microsoft 365 Business Premium, as of March 1, 2022. This offering provides additional security features for devices. [Learn more about Defender for Business](../security/defender-business/mdb-overview.md). -> [!NOTE] -> Microsoft Defender for Business is rolling out to Microsoft 365 Business Premium customers, beginning March 1, 2022. This offering provides additional security features for devices. [Learn more about Defender for Business](../security/defender-business/mdb-overview.md). +You can view and monitor device health state by using Defender for Business capabilities. -Devices in the **Device actions** list (Admin home \> **Device actions**) can have the following states. - - ++1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in. ++2. In the navigation pane, go to **Assets** > **Devices**. A list of devices that were onboarded to Defender for Business displays. ++3. Select a device to view more information and available actions. ++ :::image type="content" source="../medib-selected-device.png" alt-text="Screenshot showing a selected device with details and actions available"::: -|**Status**|**Description**| -|:--|:--| -|Managed by Intune |Managed by Microsoft 365 Business Premium. | -|Retire pending |Microsoft 365 Business Premium is getting ready to remove company data from the device. | -|Retire in progress |Microsoft 365 Business Premium is currently removing company data from the device. | -|Retire failed | Remove company data action failed. | -|Retire canceled |Retire action was canceled. | -|Wipe pending |Waiting for factory reset to start. | -|Wipe in progress |Factory reset has been issued. | -|Wipe failed |Couldn't do factory reset. | -|Wipe canceled |Factory wipe was canceled. | -|Unhealthy |An action is pending (or in progress), but the device hasn't checked in for 30+ days. | -|Delete pending |Delete action is pending. | -|Discovered |Microsoft 365 Business Premium has detected the device. | - ## See also -[Best practices for securing Microsoft 365 for business plans](../admin/security-and-compliance/secure-your-business-data.md) +- [View and edit device protection policies](m365bp-view-edit-create-mdb-policies.md) +- [What is Microsoft Defender for Business?](../security/defender-business/mdb-overview.md) +- [Best practices for securing Microsoft 365 for business plans](../admin/security-and-compliance/secure-your-business-data.md) |
| business-premium | M365bp Devices Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-devices-overview.md | Every device is a possible attack avenue into your network and must be monitored Your objectives are to: - [Get everyone to set up MFA](m365bp-multifactor-authentication.md).-- [Get Office apps installed on devices](m365bp-install-office-apps.md).+- [Get Microsoft 365 apps installed on devices](m365bp-install-office-apps.md). - [Protected unmanaged Windows and Mac devices](m365bp-protect-pcs-macs.md). Once you've achieved these objectives, proceed to [Use email securely](m365bp-protect-email-overview.md). |
| business-premium | M365bp Install Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-install-office-apps.md | Title: "Install Office apps on all devices in Microsoft 365 Business Premium" + Title: "Install Microsoft 365 apps on all devices in Microsoft 365 Business Premium" f1.keywords: - NOCSH audience: Admin Previously updated : 09/15/2022 Last updated : 10/18/2022 ms.localizationpriority: high - M365-Campaigns search.appverid: description: "How to install Office on all devices in Microsoft 365 Business Premium." -# Install Office apps on all devices +# Install Microsoft 365 apps on all devices -Okay, you've set up Microsoft 365 Business Premium, and now you can require users to install individual Office applications on their Mac, PC, or mobile devices. This is something your users should do to be part of the front lines and help protect the org against attack. +Okay, you've set up Microsoft 365 Business Premium, and now you can require users to install individual Microsoft 365 apps on their Mac, PC, or mobile devices. This is something your users should do to be part of the front lines and help protect the org against attack. -## Watch: Install Office apps +## Watch: Install Microsoft 365 apps > [!VIDEO https://www.microsoft.com/videoplayer/embed/acce002c-0756-4b64-ac5d-2198ee96a9b1?autoplay=false] -For all members of the organization, the Microsoft Office apps can be found on the **Start** menu. If you don't see them, each user must install them. +For all members of the organization, the Microsoft Microsoft 365 apps can be found on the **Start** menu. If you don't see them, each user must install them. Have them perform the following: 1. Go to [https://office.com](https://office.com), and sign in using your work account. 2. Select **Install Office** > **Microsoft 365 apps** > **Run** , and then select **Yes**.-3. The Office apps are installed. The process might take several minutes. When it completes, select **Close**. +3. The Microsoft 365 apps are installed. The process might take several minutes. When it completes, select **Close**. 4. To install Microsoft Teams, go to the [office.com page](https://office.com), and then choose **Teams**. 5. Get the Windows app, and then select **Run**. Teams displays a prompt when installation is complete. ## Set up mobile devices for Microsoft 365 Business Premium users -Use the following instructions to install Office on an iPhone or an Android phone. After you follow these steps, your work files created in Office apps will be protected by Microsoft 365 for business. +Use the following instructions to install Office on an iPhone or an Android phone. After you follow these steps, your work files created in Microsoft 365 apps will be protected by Microsoft 365 for business. -The example is for Outlook, but applies to any other Office apps you want to install. +The example is for Outlook, but applies to any other Microsoft 365 apps you want to install. ## [iPhone](#tab/iPhone) -Watch a short video on how to set up Office apps on iOS devices with Microsoft 365 for business.<br><br> +Watch a short video on how to set up Microsoft 365 apps on iOS devices with Microsoft 365 for business.<br><br> > [!VIDEO https://www.microsoft.com/videoplayer/embed/RWee2n] Locate Outlook on the iPhone, and restart it. When prompted, enter a PIN and ver Follow these links for additional information on how to: -- Install Office applications: [Install Office on your PC or Mac](https://support.microsoft.com/office/4414eaaf-0478-48be-9c42-23adc4716658)+- Install Microsoft 365 apps: [Install Office on your PC or Mac](https://support.microsoft.com/office/4414eaaf-0478-48be-9c42-23adc4716658) - Install other apps: [Project](https://support.microsoft.com/office/install-project-7059249b-d9fe-4d61-ab96-5c5bf435f281), [Visio](https://support.microsoft.com/office/install-visio-f98f21e3-aa02-4827-9167-ddab5b025710), or [Skype for Business](https://support.microsoft.com/office/install-skype-for-business-8a0d4da8-9d58-44f9-9759-5c8f340cb3fb) For additional details and information: - Set up email in Outlook: [Windows](https://support.microsoft.com/office/6e27792a-9267-4aa4-8bb6-c84ef146101b) or [Mac](https://support.microsoft.com/office/6e27792a-9267-4aa4-8bb6-c84ef146101b#PickTab=Outlook_for_Mac) -- [Upgrade users to the latest Office apps](../admin/setup/upgrade-users-to-latest-office-client.md)+- [Upgrade users to the latest Microsoft 365 apps](../admin/setup/upgrade-users-to-latest-office-client.md) For additional details and information: For additional details and information: - Set up email in Outlook: [Windows](https://support.microsoft.com/office/6e27792a-9267-4aa4-8bb6-c84ef146101b) or [Mac](https://support.microsoft.com/office/6e27792a-9267-4aa4-8bb6-c84ef146101b#PickTab=Outlook_for_Mac) -- [Upgrade users to the latest Office apps](../admin/setup/upgrade-users-to-latest-office-client.md)+- [Upgrade users to the latest Microsoft 365 apps](../admin/setup/upgrade-users-to-latest-office-client.md) Follow these links for additional information on how to: -- Install Office applications: [Install Office on your PC or Mac](https://support.microsoft.com/office/4414eaaf-0478-48be-9c42-23adc4716658)+- Install Microsoft 365 apps: [Install Office on your PC or Mac](https://support.microsoft.com/office/4414eaaf-0478-48be-9c42-23adc4716658) - Install other apps: [Project](https://support.microsoft.com/office/install-project-7059249b-d9fe-4d61-ab96-5c5bf435f281), [Visio](https://support.microsoft.com/office/install-visio-f98f21e3-aa02-4827-9167-ddab5b025710), or [Skype for Business](https://support.microsoft.com/office/install-skype-for-business-8a0d4da8-9d58-44f9-9759-5c8f340cb3fb) |
| business-premium | M365bp Map Protection Features To Intune Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-map-protection-features-to-intune-settings.md | audience: Admin Previously updated : 09/15/2022 Last updated : 10/18/2022 ms.localizationpriority: high - tier1 Under **Manage how user access Office files in mobile devices** |Force users to save work files to OneDrive for Business <br/> Note that only OneDrive for Business is allowed |Select which storage services corporate data can be saved to | |Encrypt work files |Encrypt app data | |Under **Manage how user access Office files in mobile devices** ||-|Require a PIN or fingerprint to access Office apps | Require PIN to access <br/> This also sets: <br/> **Allow simple PIN** to **Yes** <br/> **Pin Length** to 4 <br/> **Allow fingerprint instead of PIN** to **Yes** <br/> **Disable app PIN when device PIN is managed** to **No** | +|Require a PIN or fingerprint to access Microsoft 365 apps | Require PIN to access <br/> This also sets: <br/> **Allow simple PIN** to **Yes** <br/> **Pin Length** to 4 <br/> **Allow fingerprint instead of PIN** to **Yes** <br/> **Disable app PIN when device PIN is managed** to **No** | |Reset PIN when login fails this many times (this is disabled if PIN isn't required) |Number of attempts before PIN reset |-|Require users to sign in again after Office apps have been idle for (this is disabled if PIN isn't required) | Recheck the access requirements after (minutes) <br/> This also sets: <br/> **Timeout** is set to minutes <br/> This is same number of minutes you set in Microsoft 365 Business. <br/> **Offline grace period** is set to 720 minutes by default | +|Require users to sign in again after Microsoft 365 apps have been idle for (this is disabled if PIN isn't required) | Recheck the access requirements after (minutes) <br/> This also sets: <br/> **Timeout** is set to minutes <br/> This is same number of minutes you set in Microsoft 365 Business. <br/> **Offline grace period** is set to 720 minutes by default | |Deny access to work files on jailbroken or rooted devices |Block managed apps from running on jailbroken or rooted devices |-|Allow users to copy content from Office apps into personal apps | Restrict cut, copy, and paste with other apps <br/> If the Microsoft 365 Business Premium option is set to **On**, then these three options are also set to **All Apps** in Intune: <br/> **Allow app to transfer data to other apps** <br/> **Allow app to receive data from other apps** <br/> **Restrict cut, copy, and paste with other apps** <br/> If the Microsoft 365 Business option is set to **On**, then all the Intune options are set to: <br/> **Allow app to transfer data to other apps** is set to **Policy managed apps** <br/> **Allow app to receive data from other apps** is set to **All Apps** <br/> **Restrict cut, copy, and paste with other apps** is set to **Policy Managed apps with Paste-In** | +|Allow users to copy content from Microsoft 365 apps into personal apps | Restrict cut, copy, and paste with other apps <br/> If the Microsoft 365 Business Premium option is set to **On**, then these three options are also set to **All Apps** in Intune: <br/> **Allow app to transfer data to other apps** <br/> **Allow app to receive data from other apps** <br/> **Restrict cut, copy, and paste with other apps** <br/> If the Microsoft 365 Business option is set to **On**, then all the Intune options are set to: <br/> **Allow app to transfer data to other apps** is set to **Policy managed apps** <br/> **Allow app to receive data from other apps** is set to **All Apps** <br/> **Restrict cut, copy, and paste with other apps** is set to **Policy Managed apps with Paste-In** | ## Windows 10 app protection settings |
| business-premium | M365bp Multifactor Authentication | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-multifactor-authentication.md | audience: Admin Previously updated : 09/15/2022 Last updated : 10/18/2022 ms.localizationpriority: high - M365-Campaigns When MFA is enforced, the authenticator app serves as a second form of authentic ## Next objective -Proceed to [install Office applications](m365bp-install-office-apps.md). +Proceed to [install Microsoft 365 apps](m365bp-install-office-apps.md). |
| business-premium | M365bp Prepare For Office Client Deployment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-prepare-for-office-client-deployment.md | audience: Admin Previously updated : 09/15/2022 Last updated : 10/18/2022 ms.localizationpriority: high - tier1 search.appverid: - BCS160 - MET150 ROBOTS: NO INDEX, NO FOLLOW-description: "Learn how to automatically install the 32-bit Office apps on Windows computers and keep them updated in Microsoft 365 Business Premium." +description: "Learn how to automatically install the 32-bit Microsoft 365 apps on Windows computers and keep them updated in Microsoft 365 Business Premium." -# Prepare to automatically install Office apps to client computers +# Prepare to automatically install Microsoft 365 apps to client computers -Use Microsoft 365 Business Premium to automatically install the 32-bit Office apps on Windows computers and keep them current with updates. +Use Microsoft 365 Business Premium to automatically install the 32-bit Microsoft 365 apps on Windows computers and keep them current with updates. Automatic installation works best if the computer: Works with: Doesn't work with: -- 64-bit Office apps (example: Word, Excel, PowerPoint). If 64-bit Office apps are required, then this feature isn't a good fit because there's no support for triggering a 64-bit 2016 Click-to-Run version of Office from the Microsoft 365 for business admin console.+- 64-bit Microsoft 365 apps (example: Word, Excel, PowerPoint). If 64-bit Microsoft 365 apps are required, then this feature isn't a good fit because there's no support for triggering a 64-bit 2016 Click-to-Run version of Office from the Microsoft 365 for business admin console. - Any 2016 Windows Installer (MSI) standalone apps (for example, Visio or Project). Microsoft 365 for business upgrades Office to the Click-to-Run version of Office 2016, and that doesn't work with Office 2016 MSI standalone applications. The following table shows what action the end users or admins may need to take, |:--|:--|:--| |No Office suite installed |None |Office 2016 32-bit is installed by using Click-to-Run | |Existing Click-to-Run 32-bit version of Office (2016 or earlier) and no standalone apps |None |Upgraded to the latest 32-bit Click-to-Run version of Office 2016, as needed **\*** |-|Existing Click-to-Run 32-bit version of Office and Click-to-Run 32-bit or 64-bit standalone Office apps (for example, Visio, Project) |None |Standalone apps aren't affected. Suite is upgraded to Click-to-Run 32-bit version of Office 2016 | -|Existing Click-to-Run 32-bit version of Office and any 32-bit or 64-bit (except 2016) MSI standalone Office apps |None |Standalone apps aren't affected. Suite is upgraded to Click-to-Run 32-bit version of Office 2016 | -|Any existing Click-to-Run 64-bit version of Office |Uninstall the 64-bit Office apps, if it's OK to replace them with 32-bit Office apps |If Office 64-bit apps are removed, the Click-to-Run 32-bit version of Office 2016 is installed | +|Existing Click-to-Run 32-bit version of Office and Click-to-Run 32-bit or 64-bit standalone Microsoft 365 apps (for example, Visio, Project) |None |Standalone apps aren't affected. Suite is upgraded to Click-to-Run 32-bit version of Office 2016 | +|Existing Click-to-Run 32-bit version of Office and any 32-bit or 64-bit (except 2016) MSI standalone Microsoft 365 apps |None |Standalone apps aren't affected. Suite is upgraded to Click-to-Run 32-bit version of Office 2016 | +|Any existing Click-to-Run 64-bit version of Office |Uninstall the 64-bit Microsoft 365 apps, if it's OK to replace them with 32-bit Microsoft 365 apps |If Office 64-bit apps are removed, the Click-to-Run 32-bit version of Office 2016 is installed | |An existing MSI install of Office 2016 with or without standalone apps |Uninstall MSI Office 2016. |Click-to-Run 32-bit version of Office 2016 is installed. No change to standalone apps |-|Existing MSI install of Office 2013 (or earlier) and/or standalone Office apps |None |Click-to-Run 32-bit version of Office 2016 with the pre-existing MSI Office install (and standalone apps) exist side-by-side | +|Existing MSI install of Office 2013 (or earlier) and/or standalone Microsoft 365 apps |None |Click-to-Run 32-bit version of Office 2016 with the pre-existing MSI Office install (and standalone apps) exist side-by-side | **(\*) Note:** Does not upgrade to Click-to-Run 32-bit version of Office 2016 due to a known bug. A fix is in progress. |
| business-premium | M365bp Protect Admin Accounts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-protect-admin-accounts.md | audience: Admin Previously updated : 09/15/2022 Last updated : 10/18/2022 ms.localizationpriority: high - M365-Campaigns When you sign up for Microsoft 365 and enter your information, you automatically ## Create other admin accounts -Use admin accounts only for Microsoft 365 administration. Admins should have a separate user account for their regular use of Office apps, and only use their administrative account when necessary to manage accounts and devices, and while working on other admin functions. It's also a good idea to remove the Microsoft 365 license from your admin accounts so you don't have to pay for extra licenses. +Use admin accounts only for Microsoft 365 administration. Admins should have a separate user account for their regular use of Microsoft 365 apps, and only use their administrative account when necessary to manage accounts and devices, and while working on other admin functions. It's also a good idea to remove the Microsoft 365 license from your admin accounts so you don't have to pay for extra licenses. You'll want to set up at least one other Global admin account to give admin access to another trusted employee. You can also create separate admin accounts for user management (this role is called **User management administrator**). For more information, see [about admin roles](/office365/admin/add-users/about-admin-roles). |
| business-premium | M365bp Protect Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-protect-devices.md | audience: Admin Previously updated : 09/15/2022 Last updated : 10/18/2022 ms.localizationpriority: high - M365-Campaigns Your objectives are to: - [Upgrade Windows devices running Windows 7 Pro, Windows 8 Pro, or Windows 8.1 Pro to Windows 10 or 11 Pro](m365bp-upgrade-windows-10-pro.md). - [Onboard devices to Defender for Business and apply security policies](m365bp-onboard-devices-mdb.md). - [Use Windows Autopilot to set up and configure new devices, or to reset, repurpose, and recover devices](/mem/autopilot/windows-autopilot).-- [Install Microsoft 365 Apps](../admin/setup/install-applications.md) on any devices that don't already have Office applications+- [Install Microsoft 365 Apps](../admin/setup/install-applications.md) on any devices that don't already have Microsoft 365 apps Once these objectives have been achieved, your overall mission to protect your organization against cyberattacks and other cybersecurity threats is a success! Now, make sure to set up your response teams to deal with any situation that may arise while defending the integrity of the system. See your next steps! |
| business-premium | M365bp Set Up Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-set-up-compliance.md | audience: Admin Previously updated : 09/15/2022 Last updated : 10/18/2022 ms.localizationpriority: high - m365-security For more information about compliance features in Microsoft 365 for business, se Check out this video and others on our [YouTube channel](https://go.microsoft.com/fwlink/?linkid=2198022). -Sensitivity labels are available in Office apps (such as Outlook, Word, Excel, and PowerPoint). Examples of labels include: +Sensitivity labels are available in Microsoft 365 apps (such as Outlook, Word, Excel, and PowerPoint). Examples of labels include: - Normal - Personal |
| business-premium | M365bp Setup | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-setup.md | audience: Admin Previously updated : 09/15/2022 Last updated : 10/18/2022 ms.localizationpriority: high f1.keywords: NOCSH Microsoft 365 Business Premium includes a guided process. The following video sh As soon as you've completed the guided setup process, make sure to proceed to [bump up security](m365bp-security-overview.md). > [!TIP]-> After you have added users, give them a link to the [Employee quick setup guide](../admin/setup/employee-quick-setup.md). The guide walks them through signing in, getting Office apps, and saving, copying, and sharing files. +> After you have added users, give them a link to the [Employee quick setup guide](../admin/setup/employee-quick-setup.md). The guide walks them through signing in, getting Microsoft 365 apps, and saving, copying, and sharing files. ## Work with a Microsoft partner |
| business-premium | M365bp Trial Playbook Microsoft Business Premium | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-trial-playbook-microsoft-business-premium.md | When you [start a trial or purchase Microsoft 365 Business Premium](get-microsof - [Safe Links](../security/office-365-security/safe-links.md), [Safe Attachments](../security/office-365-security/safe-attachments.md) and [Anti-Phishing](../security/office-365-security/anti-phishing-protection.md) policies that are scoped to the entire tenant or the subset of users you may have chosen during the trial setup process. (Your trial subscription is for up to 25 users.) - - Protection for productivity apps, such as [SharePoint](/sharepoint/introduction), [OneDrive](/onedrive/one-drive-quickstart-small-business), [Office apps](/deployoffice/about-microsoft-365-apps), and [Microsoft Teams](/microsoftteams/teams-overview). + - Protection for productivity apps, such as [SharePoint](/sharepoint/introduction), [OneDrive](/onedrive/one-drive-quickstart-small-business), [Microsoft 365 apps](/deployoffice/about-microsoft-365-apps), and [Microsoft Teams](/microsoftteams/teams-overview). ## Add a domain |
| compliance | Add Your Organization Brand To Encrypted Messages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/add-your-organization-brand-to-encrypted-messages.md | search.appverid: - MOE150 ms.assetid: 7a29260d-2959-42aa-8916-feceff6ee51d -- Strat_O365_IP+- tier1 - purview-compliance - seo-marvel-apr2020 |
| compliance | Communication Compliance Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-configure.md | For more information about configuring Yammer in Native Mode, see: - Choose if you'd like to include sensitive information types. This step is where you can select default and custom sensitive info types. Pick from existing custom sensitive information types or custom keyword dictionaries in the communication compliance policy wizard. You can create these items before running the wizard if needed. You can also create new sensitive information types from within the communication compliance policy wizard. - - Choose if you'd like to enable classifiers. Classifiers can detect inappropriate language and images sent or received in the body of email messages or other types of text. You can choose the following built-in classifiers: *Threat*, *Profanity*, *Targeted harassment*, *Adult images*, *Racy images*, and *Gory images*. + - Choose if you'd like to enable classifiers. Classifiers can detect potentially inappropriate language and images sent or received in the body of email messages or other types of text. You can choose [built-in classifiers specific to communication compliance policies](/microsoft-365/compliance/communication-compliance-policies#classifiers). - Enable [optical character recognition (OCR)](/microsoft-365/compliance/communication-compliance-policies#optical-character-recognition-ocr) to scan embedded or attached images in messages for printed or handwritten text that match policy conditions. For custom policies, one or more conditional settings associated with text, keywords, classifiers, or sensitive info types must be configured in the policy to enable the selection of optical character recognition scanning. |
| compliance | Communication Compliance Investigate Remediate | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-investigate-remediate.md | After reviewing the message basics, it's time to open a message to examine the d - **Attachments**: This option allows you to examine Modern attachments that match policy conditions. Modern attachments content is extracted as text and is viewable on the Pending alerts dashboard for a policy. For more information, see the [Communication compliance feature reference](/microsoft-365/compliance/communication-compliance-channels). - **Source**: This view is the standard message view commonly seen in most web-based messaging platforms. The header information is formatted in the normal style and the message body supports imbedded graphic files and word-wrapped text. If [optical character recognition (OCR)](/microsoft-365/compliance/communication-compliance-policies#optical-character-recognition-ocr) is enabled for the policy, images containing printed or handwritten text that match policy conditional are viewed as a child item for the associated message in this view. - **Plain text**: Text view that displays a line-numbered text-only view of the message and includes keyword highlighting in messages and attachments for sensitive info type terms, terms identified by built-in classifiers assigned to a policy, or for terms included in a dedicated keyword dictionary assigned to a policy. Keyword highlighting, which is currently available for English language only, can help direct you to the area of interest in long messages and attachments. In some cases, highlighted text might be only in attachments for messages matching policy conditions. Embedded files aren't displayed and the line numbering in this view is helpful for referencing pertinent details among multiple reviewers.-- **Conversation (preview)**: Available for Microsoft Teams chat messages, this view displays up to five messages before and after an alert message to help reviewers view the activity in the conversational context. This context helps reviewers to quickly evaluate messages and make more informed message resolution decisions. Real-time message additions to conversations are displayed, including all inline images, emojis, and stickers available in Teams. Image or text file attachments to messages aren't displayed. Notifications are automatically displayed for messages that have been edited or for messages that have been deleted from the conversation window. When a message is resolved, the associated conversational messages aren't retained with the resolved message. Conversation messages are available for up to 60 days after the alert message is identified.+- **Conversation**: Available for Microsoft Teams chat messages, this view displays up to five messages before and after an alert message to help reviewers view the activity in the conversational context. This context helps reviewers to quickly evaluate messages and make more informed message resolution decisions. Real-time message additions to conversations are displayed, including all inline images, emojis, and stickers available in Teams. Image or text file attachments to messages aren't displayed. Notifications are automatically displayed for messages that have been edited or for messages that have been deleted from the conversation window. When a message is resolved, the associated conversational messages aren't retained with the resolved message. Conversation messages are available for up to 60 days after the alert message is identified. - **User history**: User history view displays all other alerts generated by any communication compliance policy for the user sending the message. - **Pattern detected notification**: Many harassing and bullying actions over time and involve reoccurring instances of the same behavior by a user. The *Pattern detected* notification is displayed in the alert details and raises attention to the alert. Detection of patterns is on a per-policy basis and evaluates behavior over the last 30 days when at least two messages are sent to the same recipient by a sender. Investigators and reviewers can use this notification to identify repeated behavior to evaluate the alert as appropriate. - **Translation**: This view automatically converts alert message text to the language configured in the *Displayed language* setting in the Microsoft 365 subscription for each reviewer. The *Translation* view helps broaden investigative support for organizations with multilingual users and eliminates the need for additional translation services outside of the communication compliance review process. Using Microsoft translation services, the *Translation* view can be turned on and off as needed and supports a wide range of languages. For a complete list of supported languages, see [Microsoft Translator Languages](https://www.microsoft.com/translator/business/languages/). Languages listed in the *Translator Language List* are supported in the *Translation* view. |
| compliance | Communication Compliance Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-policies.md | Configure custom keyword dictionaries (or lexicons) to provide simple management ### Classifiers -[Built-in trainable and global classifiers](/microsoft-365/compliance/classifier-learn-about) scan sent or received messages across all communication channels in your organization for different types of compliance issues. Classifiers use a combination of artificial intelligence and keywords to identify language in messages likely to violate anti-harassment policies. --Communication compliance uses built-in trainable and global classifiers to scan communications for terms, images, and sentiment for the following types of language and content: --- **Adult images**: Scans for images that are sexually explicit in nature.-- **Customer Complaints**: Scans for feedback and complaints made about your organization's products or services.-- **Discrimination**: Scans for explicit discriminatory language and is particularly sensitive to discriminatory language against the African American/Black communities when compared to other communities.-- **Gory images**: Scans for images that depict violence and gore.-- **Harassment**: Scans for offensive conduct targeting people regarding race, color, religion, national origin.-- **Profanity**: Scans for profane expressions that embarrass most people.-- **Racy images**: Scans for images that are sexually suggestive in nature, but contain less explicit content than images deemed Adult.-- **Threat**: Scans for threats to commit violence or physical harm to a person or property.+[Built-in trainable and global classifiers](/microsoft-365/compliance/classifier-learn-about) inspect sent or received messages across all communication channels in your organization for different types of compliance issues. Classifiers use a combination of artificial intelligence and keywords to identify language in messages likely to violate anti-harassment policies. ++Policies using classifiers will inspect and evaluate messages with a word count of six or greater. Messages containing fewer than six words aren't evaluated in policies using classifiers. To identify and take action on shorter messages containing inappropriate content, we recommend including a custom keyword dictionary to communication compliance policies detecting this type of content. ++Communication compliance can use specific built-in trainable and global classifiers to inspect communications for the following types of language and content: ++|**Classifier**|**Description**| +|:-|:--| +| **Adult images** | Detects images that are potentially sexually explicit in nature. | +| **Corporate sabotage (preview)** | Detects messages that may mention acts to damage or destroy corporate assets or property. This classifier can help customers manage regulatory compliance obligations such as NERC Critical Infrastructure Protection standards or state by state regulations like Chapter 9.05 RCW in Washington state. | +| **Customer complaints (preview)** | Detects messages that may suggest customer complaints made on your organization's products or services, as required by law for regulated industries. This classifier can help customers manage regulatory compliance obligations such as FINRA Rule 4530, FINRA 4513, FINRA 2111, Consumer Financial Protection Bureau, Code of Federal Regulations Title 21: Food and Drugs, and the Federal Trade Commission Act. | +| **Discrimination** | Detects potentially explicit discriminatory language and is particularly sensitive to discriminatory language against the African American/Black communities when compared to other communities. | +| **Gifts & entertainment (preview)** | Detects messages that may suggest exchanging gifts or entertainment in return for service, which violates regulations related to bribery. This classifier can help customers manage regulatory compliance obligations such as Foreign Corrupt Practices Act (FCPA), UK Bribery Act, and FINRA Rule 2320. | +| **Gory images** | Detects images that potentially depict violence and gore. | +| **Harassment** | Detects potentially offensive conduct targeting people regarding race, color, religion, national origin. | +| **Money laundering (preview)** | Detects signs that may suggest money laundering or engagement in acts to conceal or disguise the origin or destination of proceeds. This classifier can help customers manage regulatory compliance obligations such as the Bank Secrecy Act, the USA Patriot Act, FINRA Rule 3310, and the Anti-Money Laundering Act of 2020. | +| **Profanity** | Detects potentially profane expressions that embarrass most people. | +| **Racy images** | Detects images that are potentially sexually suggestive in nature, but contain less explicit content than images deemed Adult. | +| **Regulatory collusion (preview)** | Detects messages that may violate regulatory anti-collusion requirements such as an attempted concealment of sensitive information. This classifier can help customers manage regulatory compliance obligations such as the Sherman Antitrust Act, Securities Exchange Act 1933, Securities Exchange Act of 1934, Investment Advisers Act of 1940, Federal Commission Act, and the Robinson-Patman Act. | +| **Stock manipulation (preview)** | Detects signs of possible stock manipulation, such as recommendations to buy, sell or hold stocks that may suggest an attempt to manipulate the stock price. This classifier can help customers manage regulatory compliance obligations such as the Securities Exchange Act of 1934, FINRA Rule 2372, and FINRA Rule 5270. | +| **Threat** | Detects potential threats to commit violence or physical harm to a person or property. | +| **Unauthorized disclosure (preview)** | Detects sharing of information containing content that is explicitly designated as confidential or internal to unauthorized individuals. This classifier can help customers manage regulatory compliance obligations such as FINRA Rule 2010 and SEC Rule 10b-5. | ++> [!IMPORTANT] +> Preview classifiers may detect a large volume of bulk sender/newsletter content due to a known issue. While these classifiers are in preview, you can mitigate the detection of large volumes of bulk sender/newsletter content by adding the [*Message is not sent to any of these domains* condition](/microsoft-365/compliance/communication-compliance-policies#conditional-settings) to your polices with a list of domains to exclude. > [!NOTE] > Policies using Threat, Harassment, and Profanity classifiers in the English language will inspect and evaluate messages with a word count of three or greater. Messages containing less than three words aren't evaluated in policies using these types of classifiers. To identify and take action on shorter messages containing inappropriate content, we recommend including a custom keyword dictionary to communication compliance policies detecting this type of content. |
| compliance | Communication Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance.md | Built-in remediation workflows allow you to quickly identify and take action on - **User history**: Historical view of all user message remediation activities, such as past notifications and escalations for policy matches, now provides reviewers with more context during the remediation workflow process. First-time or repeat instances of policy matches for users are now archived and easily viewable. - **Pattern detected notification**: Many harassing and bullying actions take place over time and involve reoccurring instances of the same behavior by a user. The new pattern detected notification displayed in alert details helps raise attention to these alerts and this type of behavior. - **Translation**: Quickly investigate message details in eight languages using translate support in the remediation workflow. Messages in other languages are automatically converted to the display language of the reviewer.-- **Attachment detection**: Scan, detect, and investigate linked content (Modern attachments) from OneDrive and Microsoft Teams that match policy classifiers and conditions for Microsoft Teams messages. Attachment content is automatically extracted to a text file for detailed review and action.+- **Attachment detection**: Detect, identify, and investigate linked content (Modern attachments) from OneDrive and Microsoft Teams that match policy classifiers and conditions for Microsoft Teams messages. Attachment content is automatically extracted to a text file for detailed review and action. ### Actionable insights |
| compliance | Configure Irm To Use An On Premises Ad Rms Server | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/configure-irm-to-use-an-on-premises-ad-rms-server.md | search.appverid: ms.assetid: 3ecde857-4b7c-451d-b4aa-9eeffc8a8c61 - purview-compliance+- tier3 description: Learn how to configure Information Rights Management (IRM) in Exchange Online to use an Active Directory Rights Management Service (AD RMS) server. |
| compliance | Configure Irm To Use Azure Rights Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/configure-irm-to-use-azure-rights-management.md | search.appverid: ms.assetid: 1b1f8c8b-f3b4-439b-910c-cf2f89a07a15 - purview-compliance+- tier3 - seo-marvel-apr2020 description: "This article contains information about Microsoft Purview Message Encryption." |
| compliance | Customer Key Availability Key Roll | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/customer-key-availability-key-roll.md | search.appverid: - MET150 - purview-compliance+- tier1 description: "Learn how to roll the customer root keys stored in Azure Key Vault that are used with the Customer Key. Services include Exchange Online, Skype for Business, SharePoint Online, OneDrive for Business, and Teams files." |
| compliance | Customer Key Availability Key Understand | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/customer-key-availability-key-understand.md | audience: ITPro ms.localizationpriority: medium++- purview-compliance +- tier1 search.appverid: - MET150 description: "Learn about the availability key used to recover lost Customer Keys." |
| compliance | Customer Key Manage | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/customer-key-manage.md | search.appverid: - MET150 - purview-compliance+- tier1 description: "After you set up Customer Key, learn how to manage it by restoring AKV keys, and managing permissions and creating and assigning data encryption policies." |
| compliance | Customer Key Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/customer-key-overview.md | +- tier1 - highpri description: "In this article, you will learn about how service encryption works with Microsoft Purview Customer Key." |
| compliance | Customer Key Set Up | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/customer-key-set-up.md | search.appverid: - MET150 - purview-compliance-description: "This article describes the steps to create and configure the required Azure resources and then provides the steps for setting up Customer Key." +- tier1 +description: "This article describes the steps to create and configure the required Azure resources and then provides the steps to set up Customer Key." # Set up Customer Key |
| compliance | Customer Lockbox Requests | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/customer-lockbox-requests.md | ms.localizationpriority: medium - M365-subscription-management - Adm_O365+- tier1 search.appverid: - BCS160 - MET150 |
| compliance | Data Encryption In Odb And Spo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/data-encryption-in-odb-and-spo.md | ms.assetid: 6501b5ef-6bf7-43df-b60d-f65781847d6c - purview-compliance - SPO_Content+- tier2 description: "Understand the basic elements of encryption for data security in OneDrive for Business and SharePoint Online." |
| compliance | Define Mail Flow Rules To Encrypt Email | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/define-mail-flow-rules-to-encrypt-email.md | search.appverid: ms.assetid: 9b7daf19-d5f2-415b-bc43-a0f5f4a585e8 - purview-compliance+- tier2 - admindeeplinkMAC - admindeeplinkEXCHANGE |
| compliance | Deprecating Ome Viewer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/deprecating-ome-viewer.md | search.appverid: ms.assetid: 6336cabb-b06e-402f-9e85-8bb9eb4ce68f - purview-compliance+- tier3 - seo-marvel-apr2020 description: The Office 365 Message Encryption (OME) Viewer app was removed from Android and Apple stores in 2018. |
| compliance | Dlp Configure Endpoint Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-configure-endpoint-settings.md | For macOS devices, you must add the full file path. To find the full path of Mac > [!NOTE] > The **Service domains** setting only applies to files uploaded using Microsoft Edge or Google Chrome with the [Microsoft Purview Extension](dlp-chrome-learn-about.md#learn-about-the-microsoft-purview-extension) installed. -You can control whether sensitive files protected by your policies can be uploaded to specific service domains from Microsoft Edge. +You can control whether sensitive files that are protected by your policies can be uploaded to specific service domains from Microsoft Edge. -If the list mode is set to **Block**, then user won't be able to upload sensitive items to those domains. When an upload action is blocked because an item matches a DLP policy, DLP will either generate a warning or block the upload of the sensitive item. +##### Allow -If the list mode is set to **Allow**, then users will be able to upload sensitive items ***only*** to those domains, and upload access to all other domains isn't allowed. +When the **Service domains** list is set to **Allow**, DLP policies won't be applied when a user attempts to upload a sensitive file to any of the domains on the list. ++If the list mode is set to **Allow**, any user activity involving a sensitive item and a domain that's on the list will be audited. The activity is allowed. When a user attempts an activity involving a sensitive item and a domain that *isn't* on the list then DLP policies, and the actions defined in the polices, are applied. ++For example, with this configuration: ++- **Service domains** list mode is set to **Allow**. + - Contoso.com is on the list. +- A DLP policy is set to **Block** upload of sensitive items that contain credit card numbers. + +User attempts to: ++- Upload a sensitive file with credit card numbers to contoso.com. + - The user activity is allowed, audited, an event is generated, but it won't list the policy name or the triggering rule name in the event details, and no alert is generated. ++but if a user attempts to: ++- Upload a sensitive file with credit card numbers to wingtiptoys.com (which is not on the list). + - The policy is applied and the user activity is blocked. An event is generated, and an alert is generated. + +##### Block + +When the **Service domains** list is set to **Block**, DLP policies will be applied when a user attempts to upload a sensitive file to any of the domains on the list. ++If the list mode is set to **Block**, when a user attempts an activity involving a sensitive item and a domain that is on the list then DLP policies, and the actions defined in the polices, are applied. Any activity involving a sensitive item and a domain that is not on the list will be audited and the user activity is allowed. ++For example, with this configuration: ++- **Service domains** list mode is set to **Block**. + - Contoso.com is on the list. +- A DLP policy is set to **Block with override** for the upload of sensitive items that contain credit card numbers. + +User attempts to: ++- Upload a sensitive file with credit card numbers to contoso.com. + - The user activity is blocked, but the user can override the block, an event is generated and an alert is triggered. ++but if a user attempts to: ++- Upload a sensitive file with credit card numbers to wingtiptoys.com (which is not on the list). + - The policy *isn't* applied and the user activity is audited. An event is generated, but it won't list the policy name or the triggering rule name in the event details, and no alert is generated. > [!IMPORTANT] > When the service restriction mode is set to "Allow", you must have at least one service domain configured before restrictions are enforced. -Use the FQDN format of the service domain without the ending `.` +Use the FQDN format of the service domain without the ending `.` when you add a domain to the list. For example: - | Input | URL matching behavior | ||| | **CONTOSO.COM** |**Matches the specified domain name, and any subsite**: <p>*://contoso.com<p>*://contoso.com/ <p>*://contoso.com/anysubsite1 <p>*://contoso.com/anysubsite1/anysubsite2 (etc.) <p>**Does not match sub-domains or unspecified domains**: <p>*://anysubdomain.contoso.com <p>*://anysubdomain.contoso.com.AU | |
| compliance | Double Key Encryption Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/double-key-encryption-overview.md | +- tier1 |
| compliance | Double Key Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/double-key-encryption.md | +- tier1 |
| compliance | Email Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/email-encryption.md | search.appverid: ms.assetid: c0d87cbe-6d65-4c03-88ad-5216ea5564e8 - purview-compliance+- tier1 - m365solution-mip - m365initiative-compliance - highpri |
| compliance | Enable Mailbox Auditing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/enable-mailbox-auditing.md | +- tier1 - purview-compliance search.appverid: - MOE150 |
| compliance | Enable Message Encryption And Decryption In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/enable-message-encryption-and-decryption-in-office-365.md | ms.localizationpriority: medium ms.assetid: e313c489-ce5e-4015-aadf-981c697ab51f - purview-compliance+- tier1 description: "Microsoft Purview Message Encryption lets email users send encrypted messages to people inside our outside their organization. As an administrator, you can enable Microsoft Purview Message Encryption by creating mail flow rules (also known as transport rules) that set the conditions for encryption." |
| compliance | Encryption Office 365 Certificate Chains Itar | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/encryption-office-365-certificate-chains-itar.md | search.appverid: - MOE150 - purview-compliance-- Strat_O365_IP+- tier1 description: "View a complete list of DOD and GCC High root certificates and certificate authorities (CAs) in Microsoft 365." |
| compliance | Encryption Office 365 Certificate Chains | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/encryption-office-365-certificate-chains.md | search.appverid: - MOE150 - purview-compliance-- Strat_O365_IP+- tier1 description: "View a complete list of root certificates and certificate authorities (CAs) in Microsoft 365." |
| compliance | Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/encryption.md | search.appverid: ms.assetid: 0a322724-08ca-43db-b69a-afbfa20484cd - purview-compliance-- Strat_O365_IP+- tier1 - m365solution-mip - m365initiative-compliance - highpri |
| compliance | Exchange Online Uses Tls To Secure Email Connections | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/exchange-online-uses-tls-to-secure-email-connections.md | search.appverid: ms.assetid: 4cde0cda-3430-4dc0-b489-f2c0736c929f - purview-compliance-- Strat_O365_IP+- tier1 description: "Learn how Exchange Online and Microsoft 365 use Transport Layer Security (TLS) and Forward Secrecy (FS) to secure email communications. Also get information about the certificate issued by Microsoft for Exchange Online." |
| compliance | Information Rights Management In Exchange Online | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/information-rights-management-in-exchange-online.md | ms.localizationpriority: medium search.appverid: - MET150 ms.assetid: 2c956776-0016-4be6-b4cd-133a237f4a9e++- tier3 - seo-marvel-apr2020 description: Learn how to configure Exchange Online IRM to use on-premises Active Directory Rights Management Service (AD RMS) to satisfy your organization requirements. |
| compliance | Insider Risk Management Activities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-activities.md | -Investigating risky user activities is an important first step in minimizing insider risks for your organization. These risks may be activities that generate alerts from insider risk management policies, or risks from activities that are detected by policies but don't immediately create an insider risk management alert for users. You can investigate these types of activities by using the **User activity reports (preview)** or with the **Alert dashboard**. +Investigating risky user activities is an important first step in minimizing insider risks for your organization. These risks may be activities that generate alerts from insider risk management policies, or risks from activities that are detected by policies but don't immediately create an insider risk management alert for users. You can investigate these types of activities by using the **User activity reports** or with the **Alert dashboard**. [!INCLUDE [purview-preview](../includes/purview-preview.md)] -## User activity reports (preview) +## User activity reports User activity reports allow you to examine activities for specific users for a defined time period without having to assign them temporarily or explicitly to an insider risk management policy. In most insider risk management scenarios, users are explicitly defined in policies, and they may have policy alerts (depending on triggering events) and risk scores associated with the activities. But in some scenarios, you may want to examine the activities for users that aren't explicitly defined in a policy. These activities may be for users that you've received a tip about the user and potentially risky activities, or users that typically don't need to be assigned to an insider risk management policy. |
| compliance | Insider Risk Management Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-configure.md | If you create security violation policies, you'll need to have Microsoft Defende See the [Configure advanced features in Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/advanced-features#share-endpoint-alerts-with-microsoft-compliance-center) article for step-by-step guidance to configure Defender for Endpoint for insider risk management integration. After you've configured the Microsoft Defender for Endpoint, return to these configuration steps. -#### Configure forensic evidence (optional) +### Configure forensic evidence (optional) Having visual context is crucial for security teams during forensic investigations to get better insights into risky user activities that may lead to a security incident. With customizable event triggers and built-in user privacy protection controls, forensic evidence enables customizable capturing across devices to help your organization better mitigate, understand, and respond to potential data risks like unauthorized data exfiltration of sensitive data. -See the [Get started with insider risk management forensic evidence](/microsoft-365/compliance/insider-risk-management-forensic-evidence-configure) article for step-by-step guidance to configure forensic evidence for your organization. +See the [Get started with insider risk management forensic evidence](/microsoft-365/compliance/insider-risk-management-forensic-evidence-configure) article for step-by-step guidance to configure forensic evidence for your organization. ## Step 5 (required): Configure insider risk settings |
| compliance | Insider Risk Management Forensic Evidence | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-forensic-evidence.md | -Having visual context is crucial for security teams during forensic investigations to get better insights into potentially risky security-related user activities. With customizable event triggers and built-in user privacy protection controls, Forensic evidence enables customizable visual activity capturing across devices to help your organization better mitigate, understand, and respond to potential data risks like unauthorized data exfiltration of sensitive data. You set the right policies for your organization, including what risky events are the highest priority for capturing forensic evidence, what data is most sensitive, and whether users are notified when forensic capturing is activated. Forensic evidence capturing is off by default and policy creation requires dual authorization. +Having visual context is crucial for security teams during forensic investigations to get better insights into potentially risky security-related user activities. With customizable event triggers and built-in user privacy protection controls, forensic evidence enables customizable visual activity capturing across devices to help your organization better mitigate, understand, and respond to potential data risks like unauthorized data exfiltration of sensitive data. You set the right policies for your organization, including what risky events are the highest priority for capturing forensic evidence, what data is most sensitive, and whether users are notified when forensic capturing is activated. Forensic evidence capturing is off by default and policy creation requires dual authorization. [!INCLUDE [purview-preview](../includes/purview-preview.md)] |
| compliance | Insider Risk Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management.md | Alerts are resolved by opening a new case, assigning the alert to an existing ca ### Investigate -Quickly investigate all activities for a selected user with [User activity reports (preview)](insider-risk-management-activities.md#user-activity-reports-preview). These reports allow investigators in your organization to examine activities for specific users for a defined time period without having to assign them temporarily or explicitly to an insider risk management policy. After examining activities for a user, investigators can dismiss individual activities as benign, share or email a link to the report with other investigators, or choose to assign the user temporarily or explicitly to an insider risk management policy. +Quickly investigate all activities for a selected user with [User activity reports](insider-risk-management-activities.md#user-activity-reports). These reports allow investigators in your organization to examine activities for specific users for a defined time period without having to assign them temporarily or explicitly to an insider risk management policy. After examining activities for a user, investigators can dismiss individual activities as benign, share or email a link to the report with other investigators, or choose to assign the user temporarily or explicitly to an insider risk management policy. [Cases](insider-risk-management-cases.md) are created for alerts that require deeper review and investigation of the activity details and circumstances around the policy match. The **Case dashboard** provides an all-up view of all active cases, open cases over time, and case statistics for your organization. Reviewers can quickly filter cases by status, the date the case was opened, and the date the case was last updated. |
| compliance | Legacy Information For Message Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/legacy-information-for-message-encryption.md | search.appverid: ms.assetid: 5986b9e1-c824-4f8f-9b7d-a2b0ae2a7fe9 - purview-compliance+- tier3 - seo-marvel-apr2020 - admindeeplinkMAC |
| compliance | Manage Office 365 Message Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/manage-office-365-message-encryption.md | search.appverid: - MET150 ms.assetid: 09f6737e-f03f-4bc8-8281-e46d24ee2a74 -- Strat_O365_IP+- tier1 - purview-compliance - seo-marvel-apr2020 |
| compliance | Office 365 Azure Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/office-365-azure-encryption.md | search.appverid: - Strat_O365_Enterprise - purview-compliance+- tier3 - Strat_O365_Enterprise description: Learn about encryption available in Azure, such as Azure Disk Encryption |
| compliance | Office 365 Bitlocker And Distributed Key Manager For Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/office-365-bitlocker-and-distributed-key-manager-for-encryption.md | search.appverid: - Strat_O365_Enterprise - purview-compliance+- tier3 - Strat_O365_Enterprise description: Learn about how Office 365 uses BitLocker encryption, reducing the potential for data theft due to lost or stolen computers and disks. |
| compliance | Office 365 Customer Managed Encryption Features | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/office-365-customer-managed-encryption-features.md | +- Strat_O365_Enterprise +- purview-compliance +- tier3 - seo-marvel-mar2020 description: In this article, you'll learn about encryption technologies that you can manage and configure in Microsoft 365. |
| compliance | Office 365 Encryption In Microsoft Dynamics 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/office-365-encryption-in-microsoft-dynamics-365.md | +- Strat_O365_Enterprise +- purview-compliance +- tier3 description: Learn how Microsoft uses encryption technology to protect customer data in Microsoft Dynamics 365 while at rest in a Microsoft database and while in transit. |
| compliance | Office 365 Encryption In The Microsoft Cloud Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/office-365-encryption-in-the-microsoft-cloud-overview.md | search.appverid: - Strat_O365_Enterprise - purview-compliance+- tier3 - Strat_O365_Enterprise description: In this article, read an overview of the various forms of encryption used to keep customer data safe in the Microsoft cloud. |
| compliance | Office 365 Encryption Risks And Protections | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/office-365-encryption-risks-and-protections.md | search.appverid: - Strat_O365_Enterprise - purview-compliance+- tier3 - Strat_O365_Enterprise - seo-marvel-mar2020 |
| compliance | Office 365 Service Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/office-365-service-encryption.md | Last updated 10/3/2019 ms.localizationpriority: null search.appverid: - MET150-++- Strat_O365_Enterprise +- tier2 +- purview-compliance description: "Summary: Understand data resiliency in Microsoft Office 365." |
| compliance | Ome Advanced Expiration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ome-advanced-expiration.md | ms.localizationpriority: medium search.appverid: - MET150 -- Strat_O365_IP+- tier1 - purview-compliance description: Use Microsoft Purview Advanced Message Encryption to extend your email security by setting an expiration date on emails through a custom branded template. |
| compliance | Ome Advanced Message Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ome-advanced-message-encryption.md | +- tier1 - purview-compliance search.appverid: - MET150 |
| compliance | Ome Sensitive Info Types | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ome-sensitive-info-types.md | ms.localizationpriority: null search.appverid: - MET150 -- Strat_O365_IP+- tier1 - purview-compliance - Strat_O365_Enterprise description: Learn how to create a sensitive information type policy for your organization using Office 365 Message Encryption. |
| compliance | Ome Version Comparison | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ome-version-comparison.md | +- tier1 - purview-compliance search.appverid: - MET150 |
| compliance | Ome | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ome.md | Last updated 02/07/2020 search.appverid: - MET150 -- Strat_O365_IP+- tier1 - purview-compliance ms.assetid: f87cb016-7876-4317-ae3c-9169b311ff8a |
| compliance | Prepare Tls 1.2 In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/prepare-tls-1.2-in-office-365.md | +- tier3 +- purview-compliance appliesto: - Office 365 Business |
| compliance | Revoke Ome Encrypted Mail | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/revoke-ome-encrypted-mail.md | +- tier1 - purview-compliance search.appverid: - MET150 |
| compliance | Sensitivity Labels Aip | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-aip.md | In the [newer versions of Office](#how-to-disable-the-aip-add-in-to-use-built-in - **Use the Azure Information Protection add-in for sensitivity labeling**. Set the value to **1**. +This new setting is still rolling out. If you don't see it yet, wait a few more days and try again. + Deploy this setting by using Group Policy, or by using the [Office cloud policy service](/DeployOffice/overview-office-cloud-policy-service). Additional Office settings you might need to configure: |
| compliance | Set Up Azure Rms For Previous Version Message Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/set-up-azure-rms-for-previous-version-message-encryption.md | ms.localizationpriority: medium search.appverid: - MET150 - MOE150++- tier3 +- purview-compliance ms.assetid: 2cba47b3-f09e-4911-9207-ac056fcb9db7 description: "The previous version of Office 365 Message Encryption depends on Microsoft Azure Rights Management (previously known as Windows Azure Active Directory Rights Management)." |
| compliance | Set Up Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/set-up-encryption.md | ms.localizationpriority: medium search.appverid: - MET150 - MOE150++- tier1 +- purview-compliance ms.assetid: e86fc991-0161-4f01-9c1c-d25e87733d06 description: "With Office 365, some encryption capabilities are turned on by default; other capabilities can be configured to meet certain compliance or legal requirements." |
| compliance | Set Up Irm In Sp Admin Center | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/set-up-irm-in-sp-admin-center.md | Last updated 6/29/2018 audience: Admin --- SPO_Content ms.localizationpriority: medium search.appverid: - SPO160 - MET150 ms.assetid: 239ce6eb-4e81-42db-bf86-a01362fed65c description: "Learn how to use SharePoint Online IRM through Microsoft Azure Active Directory Rights Management Services (RMS) to protect SharePoint lists and document libraries."++- tier3 +- purview-compliance +- SPO_Content - seo-marvel-apr2020 - admindeeplinkSPO |
| compliance | Set Up New Message Encryption Capabilities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/set-up-new-message-encryption-capabilities.md | search.appverid: - MET150 ms.assetid: 7ff0c040-b25c-4378-9904-b1b50210d00e -- Strat_O365_IP+- tier1 - purview-compliance description: Learn about Microsoft Purview Message Encryption that enables protected email communication with people inside and outside your organization. |
| compliance | Sp Compatible Pdf Readers For Irm | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sp-compatible-pdf-readers-for-irm.md | search.appverid: - MET150 ms.assetid: dd197d58-5bf6-4d18-b9f8-d16db603fae2 description: Learn about how Information Rights Management (IRM) protects PDF documents uploaded to and downloaded from IRM-protected libraries in Microsoft SharePoint 2013.-++- tier3 +- purview-compliance +- # SharePoint-Compatible PDF readers that support Microsoft Information Rights Management services |
| compliance | Technical Reference Details About Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/technical-reference-details-about-encryption.md | +- tier1 search.appverid: - MET150 - MOE150 |
| compliance | Tls 1 2 In Office 365 Gcc | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/tls-1-2-in-office-365-gcc.md | ms.localizationpriority: medium search.appverid: - MET150 audience: ITPro- appliesto: - Office 365 Business++- tier2 +- purview-compliance # Disabling TLS 1.0 and 1.1 in Microsoft 365 GCC High and DoD |
| compliance | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md | Title: What's new in Microsoft Purview risk and compliance solutions +description: Whether it be adding new solutions to the compliance center, updating existing features based on your feedback, or rolling out fresh and updated documentation, Microsoft Purview helps you stay on top of the ever-changing compliance landscape. Find out what we've been up to this month. f1.keywords: - NOCSH search.appverid: ms.assetid: e3c6df61-8513-499d-ad8e-8a91770bff63 - purview-compliance-description: Whether it be adding new solutions to the compliance center, updating existing features based on your feedback, or rolling out fresh and updated documentation, Microsoft 365 helps you stay on top of the ever-changing compliance landscape. Find out what we've been up to this month. # What's new in Microsoft Purview risk and compliance solutions -Whether it be adding new solutions to the [Microsoft Purview compliance portal](microsoft-365-compliance-center.md), updating existing features based on your feedback, or rolling out fresh and updated documentation, Microsoft 365 helps you stay on top of the ever-changing compliance landscape. Take a look below to see whatΓÇÖs new in Microsoft Purview today. +Whether it be adding new solutions to the [Microsoft Purview compliance portal](microsoft-365-compliance-center.md), updating existing features based on your feedback, or rolling out fresh and updated documentation, Microsoft 365 helps you stay on top of the ever-changing compliance landscape. Take a look below to see what's new in Microsoft Purview today. > [!NOTE] > Some compliance features get rolled out at different speeds to our customers. If you aren't seeing a feature yet, try adding yourself to [targeted release](/office365/admin/manage/release-options-in-office-365). Whether it be adding new solutions to the [Microsoft Purview compliance portal]( [!INCLUDE [purview-preview](../includes/purview-preview.md)] +## October 2022 ++### Communication compliance ++- **In preview**: New communication compliance [integration with insider risk management](/microsoft-365/compliance/communication-compliance#integration-with-insider-risk-management-preview). Communication compliance can now provide disgruntlement signals detected in messages to insider risk management disgruntlement policies. Disgruntlement detected in messages by the communication compliance policy act as a triggering event to bring users into scope for the insider risk management policies. ++### Insider risk management ++- **In preview**: Insider risk management introduces [forensic evidence](/microsoft-365/compliance/insider-risk-management-forensic-evidence), which enables customizable visual activity capturing across devices to help your organization better mitigate, understand, and respond to potential data risks like unauthorized data exfiltration of sensitive data. +- **In preview**: Insider risk management [integration with communication compliance](/microsoft-365/compliance/communication-compliance#integration-with-insider-risk-management-preview) when using the *Data leaks by disgruntled users* or *Security policy violations by disgruntled users* policy templates. Communication compliance can now provide disgruntlement signals detected in messages to insider risk management disgruntlement policies. +- **In preview**: New [inline alert customization](/microsoft-365/compliance/insider-risk-management-settings#inline-alert-customization-preview) allows analysts and investigators to quickly edit policies when reviewing alerts. +- New [priority content scoring updates](/microsoft-365/compliance/insider-risk-management-policies#prioritize-content-in-policies) that allow you to choose whether to assign risk scores to all activities detected by a policy or only activities that include priority content. +- Security teams are now able to [customize a security trigger](/microsoft-365/compliance/insider-risk-management-policies#policy-templates) in the 'data leaks' policy to surface when a user performs a sequence, enabling them to respond to user actions that might be considered riskier. +- New updates now allow security teams to create [policies with sequences](/microsoft-365/compliance/insider-risk-management-policies#sequence-detection-preview) without any other required underlying policy indicator selections. + ## September 2022 +### Communication compliance ++- [Get started with communication compliance](/microsoft-365/compliance/communication-compliance-configure): New updates for recommended actions and accelerated onboarding. Recommended actions can help your organization quickly get started with communication compliance. +- [Investigate and remediate communication compliance alerts](/microsoft-365/compliance/communication-compliance-investigate-remediate): New update for keyword highlighting support for plain text view. Keyword highlighting, which is currently available for English language only, can help direct you to the area of interest in long messages and attachments. +- [Use communication compliance reports and audits](/microsoft-365/compliance/communication-compliance-reports-audits): Clarifications on permissions needed to view and manage communication compliance reports. To view and manage reports, users must be assigned to the *Communication Compliance Viewers* role group. + ### Data Classification - [Increase classifier accuracy (preview)](data-classification-increase-accuracy.md) - This article shows you how to confirm whether items matched by a classifier are true positive (a Match) or a false positive (Not a match) and provide Match, or Not a match feedback. You can use that feedback to tune your classifiers to increase accuracy. You can also send redacted versions of the document and the Match, Not a Match feedback to Microsoft if you want to help increase the accuracy of the classifiers that Microsoft provides. ### Data lifecycle management and records management+ - In preview: Retention labels now support running a Power Automate flow at the end of the retention period to support custom actions and integration with other solutions. For more information, see [Customize what happens at the end of the retention period](retention-label-flow.md).-- For records management items undergoing disposition review, when you select that item in the Disposition area of the compliance portal, a new Progress column displays the item's status. That status can be "Approved for deletion, "Awaiting deletion from SharePoint/OneDriveΓÇ¥ or ΓÇ£Awaiting deletion from ExchangeΓÇ¥, or "Permanently Deleted". When an item is approved for permanent deletion as part of the disposition review process, that deletion can take up to 15 days to complete and this new column helps you to track its progress.-- The configuration to [enable a mailbox for archiving](enable-archive-mailboxes.md) is moving to the new Exchange admin center (EAC) and instructions have been updated accordingly. +- For records management items undergoing disposition review, when you select that item in the Disposition area of the compliance portal, a new Progress column displays the item's status. That status can be "Approved for deletion, 'Awaiting deletion from SharePoint/OneDrive' or 'Awaiting deletion from Exchange', or "Permanently Deleted". When an item is approved for permanent deletion as part of the disposition review process, that deletion can take up to 15 days to complete and this new column helps you to track its progress. +- The configuration to [enable a mailbox for archiving](enable-archive-mailboxes.md) is moving to the new Exchange admin center (EAC) and instructions have been updated accordingly. - Currently, trainable classifiers for auto-apply retention labels aren't supported with adaptive scopes. As a workaround, use static scopes for this configuration combination. - Instructions to [Customize an archive and deletion policy for mailboxes](set-up-an-archive-and-deletion-policy-for-mailboxes.md) are updated to include only retention tags that that have an outcome that can't be achieved with Microsoft 365 retention. Whether it be adding new solutions to the [Microsoft Purview compliance portal]( - [Trainable classifiers definitions](classifier-tc-definitions.md) - more than 20 new classifiers have been added, so the definitions for all trainable classifiers have been broken out into this new article. - ## August 2022 ### Compliance Manager Whether it be adding new solutions to the [Microsoft Purview compliance portal]( - [Exchange (legacy)](data-lifecycle-management.md#exchange-legacy-features) configuration is moving from the Classic Exchange admin center (EAC) to the Microsoft Purview compliance portal, under **Data lifecycle management**. Existing data lifecycle management features are located under a new subnode, **Microsoft 365**. - For cloud attachments (currently rolling out in preview), automatic and temporary retention of deleted files in the Preservation Hold library to safeguard against the original file being deleted by users before the copy can be created and labeled. For more information, see [How retention works with cloud attachments](retention-policies-sharepoint.md#how-retention-works-with-cloud-attachments). -### Data Loss Prevention +### Data loss prevention - [Get started with endpoint data loss prevention](endpoint-dlp-getting-started.md) - updated links for more accessible article names - [Learn about endpoint data loss prevention](endpoint-dlp-learn-about.md) - updated links for more accessible article names; updated guidance on supported file types; updated copy-to-other-app guidance Whether it be adding new solutions to the [Microsoft Purview compliance portal]( - [Data loss prevention policy reference](dlp-policy-reference.md) - GA of Sensitive Service Domains - [Using endpoint data loss prevention](endpoint-dlp-using.md) - GA of Sensitive Service Domains +### Insider risk management ++- [Create and manage insider risk management policies](/microsoft-365/compliance/insider-risk-management-policies#general-risky-browser-usage-preview): New General risky browser usage policy template for public preview. This policy can help detect and enable risk scoring for web browsing that might be in violation of your organization's acceptable use policy, such as visiting sites that pose a threat (for example phishing sites) or contain adult content. +- [Create and manage insider risk management policies](/microsoft-365/compliance/insider-risk-management-policies#quick-policies-from-recommended-actions-preview) -New quick policies templates for public preview. You can use a quick policy to expedite the configuration of a *General data leaks* or *Data theft by departing users policy*. +- [Get started with insider risk management settings](/microsoft-365/compliance/insider-risk-management-settings#intelligent-detections): New exclusion and classifiers support in intelligent detection settings. + ### Microsoft Priva - [Microsoft Priva trial user guide](/privacy/priva/priva-trial-playbook) - refreshed and simplified guidance to align with recent documentation updates Whether it be adding new solutions to the [Microsoft Purview compliance portal]( - Label SQL database columns by using the same sensitivity labels as those used for files and emails so that the organization has a unified labeling solution that continues to protect structured data when it's exported - Apply a sensitivity label to a file after receiving an alert that content containing personal data is being shared and needs protection -## April 2022 --### Communication compliance --- [Create and manage communication compliance policies](communication-compliance-policies.md) - updated with guidance added for new user-reported message policy feature for Microsoft Teams integration.-- [Get started with communication compliance](communication-compliance-configure.md) - updated to add clarification for F5 subscription and licensing.--### Compliance Manager --- [Compliance Manager templates list](compliance-manager-templates-list.md) - added 6 new templates and navigation links on the page to more easily jump to template categories.-- [Compliance Manager overview](compliance-manager.md) - updated product overview video.--### Compliance offerings & service assurance --- [Compliance offerings](/compliance/regulatory/offering-home) - updates for service coverage and audit reporting for VPATS, SOC, ISO, and FedRAMP offerings.--### Data lifecycle management and records management --- With the [product name change](#changes-to-product-names), **Information governance** is renamed **Data lifecycle management** in the compliance portal.-- Currently rolling out: new design for the retention label settings configuration.-- Currently rolling out: new label option in preview, "Unlock this record by default". For more information, see [Configuring retention labels to declare records](declare-records.md#configuring-retention-labels-to-declare-records) and [Use record versioning to update records stored in SharePoint or OneDrive](record-versioning.md).--### Data Loss Prevention --- Articles updated for macOS device onboarding GA:- - [Learn about endpoint DLP](endpoint-dlp-learn-about.md) - - [Configure endpoint data loss prevention settings](dlp-configure-endpoint-settings.md) - - [Plan for data loss prevention (DLP)](dlp-overview-plan-for-dlp.md) - - [Data Loss Prevention policy reference](dlp-policy-reference.md) - - [Get started with Endpoint data loss prevention](endpoint-dlp-getting-started.md) -- [DLP policy conditions, exceptions, and actions](dlp-conditions-and-exceptions.md) - added guidance for Modify Subject action.-- [Data Loss Prevention policy reference](dlp-policy-reference.md) - GA SPO/ODB predicates; updated with new guidance on rule processing on endpoints.--### Device Onboarding --- Articles updated for macOS device onboarding GA:- - [Onboard macOS devices in to Microsoft 365 overview](device-onboarding-macos-overview.md) - - [Onboard and offboard macOS devices into Compliance solutions using Intune for Microsoft Defender for Endpoint customers](device-onboarding-offboarding-macos-intune-mde.md) - - [Onboard and offboard macOS devices into Microsoft Purview solutions using Intune](device-onboarding-offboarding-macos-intune.md) - - [Onboard and offboard macOS devices into Compliance solutions using JAMF Pro for Microsoft Defender for Endpoint customers](device-onboarding-offboarding-macos-jamfpro-mde.md) - - [Onboard and offboard macOS devices into Microsoft Purview solutions using JAMF Pro](device-onboarding-offboarding-macos-jamfpro.md) --### Information barriers --- [Use information barriers with SharePoint](/sharepoint/information-barriers) - guidance added for new private channel support in SharePoint.-- [Manage information barriers policies](information-barriers-edit-segments-policies.md) - guidance added for removing segments and policy/segments together.--### Microsoft Priva --- [Privacy Risk Management policies](/privacy/priva/risk-management) - new pages, significant updates, and restructuring of policies content; details below:- - [Privacy Risk Management policies](/privacy/priva/risk-management-policies) - added significant details about policy setup and management that apply to all policies; added links to new pages for each of the three policy types. - - [Data overexposure policies](/privacy/priva/risk-management-policy-data-overexposure) - articulates the need and uses for the policy; explains default settings for out-of-box creation and detailed instructions for customizing settings. - - [Data transfer policies](/privacy/priva/risk-management-policy-data-transfer) - highlights new condition for the policy to detect transfers outside of the org; articulates the need and uses for the policy; explains default settings for out-of-box creation and detailed instructions for customizing settings. - - [Data minimization policies](/privacy/priva/risk-management-policy-data-minimization) - articulates the need and uses for the policy; explains default settings for out-of-box creation and detailed instructions for customizing settings. - - [Investigate and remediate alerts](/privacy/priva/risk-management-alerts) - added clarifying details and formatting changes to improve readability. - - [User notifications](/privacy/priva/risk-management-notifications) - added info on the functionality for previewing and customizing email notification content. -- [Create a subject rights request](/privacy/priva/subject-rights-requests-create) - added section on getting started with your first request with default settings to explore functionality.-- [Review data for a subject rights request](/privacy/priva/subject-rights-requests-data-review) - added details explaining priority items to review and how to find them, and the need to set up data matching in order to get this insight.-- [Find and visualize personal data](/privacy/priva/priva-data-profile) - clarified that users need to set up data matching in order to receive insights for "Items with the most data subject content" under "Key insights".-- [Data matching for subject rights requests](/privacy/priva/subject-rights-requests-data-match) - clarified the step progression in this process and added the second step of creating sensitive info types.--### Sensitive Information Types --- [Use named entities in DLP policies](named-entities-use.md) - named entities GA.-- [Learn about named entities](named-entities-learn.md) - named entities GA.-- [Sensitive information types entity definitions](sensitive-information-type-entity-definitions.md) - named entities GA, and pattern updates.-- [Learn about sensitive information types](sensitive-information-type-learn-about.md) - named entities GA.--### Sensitivity labels --- Newly supported scenario for SharePoint sites, now in preview: [Configure site sharing permissions by using PowerShell advanced settings](sensitivity-labels-teams-groups-sites.md#configure-site-sharing-permissions-by-using-powershell-advanced-settings)-- [Co-authoring for files encrypted with sensitivity labels](sensitivity-labels-coauthoring.md) is now available for testing with the Semi-Annual Enterprise Channel (Preview) channel.-- Deleted OneDrive accounts are now correctly displayed in the simulation results for auto-labeling policies.-- Known issue if you [assign permissions to mail contacts in groups](/office365/troubleshoot/sensitivity-labels/mail-contacts-lose-access-encrypted-content) when you configure a sensitivity label for encryption.- ### Changes to product names To meet the challenges of today's decentralized, data-rich workplace, we're introducing [Microsoft Purview](https://aka.ms/microsoftpurview), a comprehensive set of solutions which helps you understand, govern, and protect your entire data estate. This new brand family combines the capabilities of the former Microsoft Purview Data Map and the Microsoft 365 compliance portfolio that customers already rely on, providing unified data governance and risk management for your organization. To meet the challenges of today's decentralized, data-rich workplace, we're intr | Microsoft data connectors | Microsoft Purview data connectors | Microsoft 365 lets administrators use data connectors to import and archive non-Microsoft, third-party data from social media platforms, instant messaging platforms, and document collaboration platforms, to mailboxes in your Microsoft 365 organization. To learn more, see [Microsoft Purview data connectors](compliance-extensibility.md). | | Microsoft 365 Advanced eDiscovery <br><br> Microsoft 365 Core eDiscovery | Microsoft Purview eDiscovery (Premium) <br><br> Microsoft Purview eDiscovery (Standard) | Electronic discovery, or eDiscovery, is the process of identifying and delivering electronic information that can be used as evidence in legal cases. To learn more, see [Microsoft Purview eDiscovery (Premium)](overview-ediscovery-20.md) and [Microsoft Purview eDiscovery (Standard)](get-started-core-ediscovery.md). | | Microsoft 365 compliance center | Microsoft Purview compliance portal | Admin portal to access solutions and solution catalog within the Microsoft 365 E5 Compliance suite. To learn more, see [Microsoft Purview compliance portal](microsoft-365-compliance-center.md). |--## March 2022 --### Communication compliance --- [Investigate and remediate communication compliance alerts](communication-compliance-investigate-remediate.md) - removed guidance for deprecated Annotation view.--### Compliance Manager --- [Working with improvement actions](compliance-manager-improvement-actions.md), [Get started with Compliance Manager](compliance-manager-setup.md) - added information about more improvement actions that can be automatically monitored and tested ("continuous compliance assessment"); this includes new abilities to parent the testing status of an action to that of another action.--### Data classification --- [Get Started with Content Explorer](data-classification-content-explorer.md) - Teams guidance added, licensing section pointed to service descriptions.--### Data lifecycle management and records management --- [Retention policies for Yammer](create-retention-policies.md#retention-policy-for-yammer-locations) are now generally available (GA).-- Support for shared channels, currently in preview. When you configure a retention policy for the Teams channel message location, any shared channels inherit retention settings from their parent team.-- [Per-tenant limits for content disposition](retention-limits.md#maximum-numbers-for-disposition).--### Data Loss Prevention --- [Data loss prevention and Microsoft Teams](dlp-microsoft-teams.md) - Public preview of Share Teams Channels content.-- [Get started with the Microsoft Compliance Extension](dlp-chrome-get-started.md) - public preview of restricted app groups, remove registry key instructions, configuration now enabled by default.-- [Configure endpoint data loss prevention settings](dlp-configure-endpoint-settings.md) - new for public preview of restricted app groups.-- [Data loss prevention policy reference](dlp-policy-reference.md) - updated for public preview of restricted app groups.-- [Get started with data loss prevention for Power BI](dlp-powerbi-get-started.md) - new for public preview.--### Information protection --- [Support for double byte character set release notes](mip-dbcs-relnotes.md) - added guidance for macOS.--### Insider risk management --- [Get started with insider risk management](insider-risk-management-configure.md) - added new tasks for the Recommended actions guidance.-- [Get started with insider risk management settings](insider-risk-management-settings.md) - new updates for the notification and email alerts features, new updates for analytics notifications.--### Microsoft Priva --- [Configure Priva settings](/privacy/priva/priva-settings) - updated clarifying information about data retention periods for subject rights requests; added details about managing and applying data review tags for subject rights requests.-- [Create a subject rights request](/privacy/priva/subject-rights-requests-create) - added details about refining searches and choosing conditions and attributes; added info about new functionality that lets users select all versions of SharePoint items in their search (vs. the default setting, which only returns current version of SharePoint items).-- [Review data for a subject rights request](/privacy/priva/subject-rights-requests-data-review) - added details in step 3 for reviewing items during the data review stage, including marking files as include/exclude, annotating files to apply redactions, applying tags, and entering notes.-- [Generate reports and fulfill a subject rights request](/privacy/priva/subject-rights-requests-reports) - added details about how to understand reports; clarified when an export package is generated and how to work with its contents; added information about audit logs, tagged files reports, and retention periods for SRR data and reports.--### Sensitivity labels --- [Sensitivity labels for Teams](sensitivity-labels-teams-groups-sites.md):- - Support for shared channels, currently in preview. If a team has any shared channels, they automatically inherit sensitivity label settings from their parent team, and that label can't be removed or replaced with a different label. - - Support for templates, previously listed as [not supported with Teams Graph APIs and PowerShell cmdlets]( /microsoftteams/sensitivity-labels#limitations). -- For auditing Word, Excel, and PowerPoint on the web, justification text is now fully rolled out.-- Applying a default label to existing documents for Word, Excel, and PowerPoint on the web is now fully rolled out. |
| frontline | Flw Scenario Posters | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/flw-scenario-posters.md | Title: Microsoft 365 for frontline workers - scenario posters -description: Learn about scenarios you can easily implement for the frontline workers in your organization with these downloadable posters. +description: Download these PDF posters to learn about scenarios you can easily implement for the frontline workers in your organization. search.appverid: MET150 + - EngageScoreOct2022 appliesto: - Microsoft Teams appliesto: # Microsoft 365 for frontline workers - scenario posters -Use these scenario overviews to start envisioning what your organization can do with Microsoft 365 for frontline workers, then follow the links to find out how to implement these scenarios. You can download these posters in PDF or Visio format and customize them for your organization. +Use these scenario overviews to start envisioning what your organization can do with Microsoft 365 for frontline workers. You can download these posters in PDF or Visio format and customize them for your organization. ++To learn more about how Microsoft 365 can help your frontline workers, see [Choose your scenarios for Microsoft 365 for frontline workers](flw-choose-scenarios.md). To learn more about planning and implementing scenarios, see [Technical planning guide for deploying frontline solutions (white paper)](flw-technical-planning-guide-deployment.md). ## Scenarios for frontline workers |
| lti | Index | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lti/index.md | These tools include: - [OneDrive LTI](#onedrive-lti-apps) - [Teams Meetings LTI](#teams-meetings-lti) - [Teams Classes LTI](#teams-classes-lti)+- [OneNote LTI)(#onenote-class-notebook-lti) For general information on managing Microsoft LTI apps, see [Manage Microsoft LTI apps for any LMS](manage-microsoft-one-lti.md). For configuration steps, see: - [Microsoft Teams Classes with Moodle](teams-classes-meetings-with-moodle.md). - [Microsoft Teams Classes with Open LMS](open-lms-teams-classes-and-meetings.md). - [Microsoft Teams Classes with Desire2Learn Brightspace](teams-classes-meetings-with-brightspace.md).++### OneNote Class Notebook LTI ++OneNote Class Notebook LTI can be used with your Learning Management System (LMS) to create a shared notebook and link it to your course. Students enrolled in your LMS course can access the notebook automatically without you having to add their names. For configuration steps, see [Microsoft OneNote Class Notebook LTI](https://www.onenote.com/lti/integratelti). + |
| security | Defender Endpoint Demonstration Network Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-demonstration-network-protection.md | Set-MpPreference -EnableNetworkProtection Enabled ## Rule states -|State | Mode| Numeric value | -|:|:|:| -| AuditMode | = Audit Mode | 2 | -| Enabled | = Block mode | 1 | -| Disabled | = Off | 0 |d +|State|Mode|Numeric value| +|||| +|AuditMode|= Audit Mode|2| +|Enabled|= Block mode|1| +|Disabled|= Off|0| ## Verify configuration Get-MpPreference 1. Turn on Network Protection using powershell command: -```powershell -Set-MpPreference -EnableNetworkProtection Enabled --``` + ```powershell + Set-MpPreference -EnableNetworkProtection Enabled + ``` 2. Using the browser of your choice (not Microsoft Edge*), navigate to the [Network Protection website test](https://smartscreentestratings2.net/). Microsoft Edge has other security measures in place to protect from this vulnerability (SmartScreen). |
| security | Defender Endpoint Plan 1 2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2.md | The following table summarizes what's included in Microsoft endpoint security pl | Plan | What's included | |:|:| | [Defender for Endpoint Plan 1](defender-endpoint-plan-1.md) | <ul><li>[Next-generation protection](defender-endpoint-plan-1.md#next-generation-protection) (includes antimalware and antivirus)</li><li>[Attack surface reduction](defender-endpoint-plan-1.md#attack-surface-reduction)</li><li> [Manual response actions](defender-endpoint-plan-1.md#manual-response-actions)</li><li>[Centralized management](defender-endpoint-plan-1.md#centralized-management)</li><li>[Security reports](defender-endpoint-plan-1.md#reporting)</li><li>[APIs](defender-endpoint-plan-1.md#apis)</li><li>[Support for Windows 10, iOS, Android OS, and macOS devices](defender-endpoint-plan-1.md#cross-platform-support)</li></ul>|-| [Defender for Endpoint Plan 2](microsoft-defender-endpoint.md) | All of the Defender for Endpoint Plan 1 capabilities, plus:<ul><li>[Device discovery](device-discovery.md)</li><li>[Device inventory](machines-view-overview.md)</li><li>[Core Defender Vulnerability Management capabilities](../defender-vulnerability-management/defender-vulnerability-management-capabilities.md)</li><li>[Threat Analytics](threat-analytics.md)</li><li>[Automated investigation and response](automated-investigations.md)</li><li>[Advanced hunting](advanced-hunting-overview.md)</li><li>[Endpoint detection and response](overview-endpoint-detection-response.md)</li><li>[Microsoft Threat Experts](microsoft-threat-experts.md)</li><li>Support for [Windows](configure-endpoints.md) (client and server) and [non-Windows platforms](configure-endpoints-non-windows.md) (macOS, iOS, Android, and Linux)</li></ul> | +| [Defender for Endpoint Plan 2](microsoft-defender-endpoint.md) | All of the Defender for Endpoint Plan 1 capabilities, plus:<ul><li>[Device discovery](device-discovery.md)</li><li>[Device inventory](machines-view-overview.md)</li><li>[Core Defender Vulnerability Management capabilities](../defender-vulnerability-management/defender-vulnerability-management-capabilities.md)</li><li>[Threat Analytics](threat-analytics.md)</li><li>[Automated investigation and response](automated-investigations.md)</li><li>[Advanced hunting](advanced-hunting-overview.md)</li><li>[Endpoint detection and response](overview-endpoint-detection-response.md)</li><li>[Microsoft Threat Experts](microsoft-threat-experts.md)</li><li>Support for [Windows](configure-endpoints.md) (client only) and [non-Windows platforms](configure-endpoints-non-windows.md) (macOS, iOS, Android, and Linux)</li></ul> | | [Defender Vulnerability Management add-on](../defender-vulnerability-management/defender-vulnerability-management-capabilities.md) | More Defender Vulnerability Management capabilities for Defender for Endpoint Plan 2:<ul><li>[Security baselines assessment](../defender-vulnerability-management/tvm-security-baselines.md)</li><li>[Block vulnerable applications](../defender-vulnerability-management/tvm-block-vuln-apps.md)</li><li>[Browser extensions](../defender-vulnerability-management/tvm-browser-extensions.md)</li><li>[Digital certificate assessment](../defender-vulnerability-management/tvm-certificate-inventory.md)</li><li>[Network share analysis](../defender-vulnerability-management/tvm-network-share-assessment.md)</li><li>Support for [Windows](configure-endpoints.md) (client and server) and [non-Windows platforms](configure-endpoints-non-windows.md) (macOS, iOS, Android, and Linux)</li></ul> | | [Defender for Business](../defender-business/mdb-overview.md) <sup>[[1](#fn1)]</sup> | [Services optimized for small and medium-sized businesses](../defender-business/compare-mdb-m365-plans.md) include: <ul><li>Email protection</li><li>Antispam protection</li><li>Antimalware protection</li><li>Next-generation protection</li><li>Attack surface reduction</li><li>Endpoint detection and response</li><li>Automated investigation and response </li><li>Vulnerability management</li><li>Centralized reporting</li><li>APIs (for integration with custom apps or reporting solutions)</li><li>[Integration with Microsoft 365 Lighthouse](../defender-business/mdb-lighthouse-integration.md)</li></ul> | |
| security | Deployment Vdi Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus.md | +- ContentEngagementFY23 search.appverid: met150 In Windows 10, version 1903, we introduced the shared security intelligence feat ### Use Group Policy to enable the shared security intelligence feature: -1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure, and then click **Edit**. +1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure, and then select **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration**. +2. In the **Group Policy Management Editor**, go to **Computer configuration**. -3. Click **Administrative templates**. +3. Select **Administrative templates**. 4. Expand the tree to **Windows components** \> **Microsoft Defender Antivirus** \> **Security Intelligence Updates**. In Windows 10, version 1903, we introduced the shared security intelligence feat 6. Enter `\\<sharedlocation\>\wdav-update` (for help with this value, see [Download and unpackage](#download-and-unpackage-the-latest-updates)). -7. Click **OK**. +7. Select **OK**. 8. Deploy the GPO to the VMs you want to test. ### Use PowerShell to enable the shared security intelligence feature -Use the following cmdlet to enable the feature. You'll need to then push this as you normally would push PowerShell-based configuration policies onto the VMs: +Use the following cmdlet to enable the feature. You'll need to then push the update as you normally would push PowerShell-based configuration policies onto the VMs: ```PowerShell Set-MpPreference -SharedSignaturesPath \\<shared location>\wdav-update This is possible when the devices have the share and NTFS permissions for the re 3. Go to the **Actions** tab. Select **New...** Enter **PowerShell** in the **Program/Script** field. Enter `-ExecutionPolicy Bypass c:\wdav-update\vdmdlunpack.ps1` in the **Add arguments** field. Select **OK**. -4. You can choose to configure additional settings if you wish. +4. You can choose to configure more settings if you wish. 5. Select **OK** to save the scheduled task. See [Schedule scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) f ## Use quick scans -You can specify the type of scan that should be performed during a scheduled scan. Quick scans are the preferred approach as they are designed to look in all places where malware needs to reside to be active. The following procedure describes how to set up quick scans using Group Policy. +You can specify the type of scan that should be performed during a scheduled scan. Quick scans are the preferred approach as they're designed to look in all places where malware needs to reside to be active. The following procedure describes how to set up quick scans using Group Policy. 1. In your Group Policy Editor, go to **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Scan**. This policy forces a scan if the VM has missed two or more consecutive scheduled 3. Set the policy to **Enabled**. -4. Click **OK**. +4. Select **OK**. 5. Deploy your Group Policy Object as you usually do. |
| security | Device Health Api Methods Properties | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-health-api-methods-properties.md | + - ContentEngagementFY23 - tier3 |
| security | Enable Network Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-network-protection.md | ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium Last updated : 10/18/2022 Check if network protection has been enabled on a local device by using Registry 2. Choose **HKEY_LOCAL_MACHINE** from the side menu. -3. Navigate through the nested menus to **SOFTWARE** \> **Policies** \> **Microsoft** \> **Windows Defender** \> **Windows Defender Exploit Guard** \> **Network Protection**. +3. Navigate through the nested menus to **SOFTWARE** \> **Policies** \> **Microsoft** \> **Windows Defender** \> **Policy Manager**. If the Key is missing, Navigate to **SOFTWARE** \> **Microsoft** \> **Windows Defender** \> **Windows Defender Exploit Guard** \> **Network Protection**. Use the following procedure to enable network protection on domain-joined comput 2. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**. -3. Expand the tree to **Windows components** \> **Microsoft Defender Antivirus** \> **Windows Defender Exploit Guard** \> **Network protection**. +3. Expand the tree to **Windows components** \> **Microsoft Defender Antivirus** \> **Microsoft Defender Exploit Guard** \> **Network protection**. > [!NOTE] > On older versions of Windows, the group policy path may say "Windows Defender Antivirus" instead of "Microsoft Defender Antivirus." |
| security | Ios Configure Features | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-configure-features.md | This configuration is available for both the enrolled (MDM) devices as well as u - In [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Apps** > **App configuration policies** > **Add** > **Managed devices**. - Give the policy a name, **Platform > iOS/iPadOS**. - Select Microsoft Defender for Endpoint as the target app.- - In Settings page, select Use configuration designer and add **WebProtection** as the key and value type as **Boolean**. + - In Settings page, select Use configuration designer and add **WebProtection** as the key and value type as **String**. - By default, **WebProtection= true**. - Admin needs to make **WebProtection = false** to switch off the web protection. - Defender will send the heartbeat to the Microsoft 365 Defender portal whenever user opens the app. |
| security | Linux Static Proxy Configuration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-static-proxy-configuration.md | Note that installation and uninstallation will not necessarily fail if a proxy i ## Post installation configuration -After installation, the `HTTPS_PROXY` environment variable must be defined in the Defender for Endpoint service file. To do this, run `sudo systemctl edit --full mdatp.service`. +After installation, configure Defender for Endpoint with static proxy using one of the following methods: ++```bash +mdatp config proxy set --value http://address:port +``` +> [!NOTE] +> This method works for every distribution of Defender for Endpoint on Linux and is **Recommended**. +++The `HTTPS_PROXY` environment variable must be defined in the Defender for Endpoint service file. To do this, run `sudo systemctl edit --full mdatp.service`. You can then propagate the variable to the service in one of two ways: - Uncomment the line `#Environment="HTTPS_PROXY=http://address:port"` and specify your static proxy address. sudo systemctl daemon-reload; sudo systemctl restart mdatp > To remove any additions you might have made before uninstalling `mdatp`, delete the custom file from `/etc/systemd/system`. > [!NOTE]-> Red Hat Enterprise Linux 6.X and CentOS 6.X don't support **systemctl**. To configure statuc proxy for MDE, use **mdatp config proxy set --value http://address:port**. This method works for all other Linux distributions as well. +> Red Hat Enterprise Linux 6.X and CentOS 6.X don't support **systemctl** and **/etc/environment** methods. To configure static proxy for MDE on these distributions, use the Recommended **mdatp config proxy set** method. |
| security | Linux Whatsnew | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-whatsnew.md | ms.pagetype: security ms.localizationpriority: medium Last updated : 10/18/2022 audience: ITPro This article is updated frequently to let you know what's new in the latest rele **What's new** -- Fixes a kernel hang observed on select customer workloads running mdatp version 101.75.43. After RCA this was attributed to a race condition while releasing the ownership of a sensor file descriptor. The race condition was exposed due to a recent product change in the shutdown path. Customers on newer Kernel versions (5.1+) are not impacted by this issue.+- Fixes a kernel hang observed on select customer workloads running mdatp version 101.75.43. After RCA this was attributed to a race condition while releasing the ownership of a sensor file descriptor. The race condition was exposed due to a recent product change in the shutdown path. Customers on newer Kernel versions (5.1+) are not impacted by this issue. More information about the underlying issue can be found at [System hang due to blocked tasks in fanotify code](https://access.redhat.com/solutions/2838901). + +**Known issues** -- When upgrading from mdatp version 101.75.43 or 101.78.13, run the following commands before attempting to upgrade to version 101.80.97+- When upgrading from mdatp version 101.75.43 or 101.78.13, you might encounter a kernel hang. Run the following commands before attempting to upgrade to version 101.80.97. This should prevent the issue from occurring. ``` sudo mdatp config real-time-protection --value=disabled sudo systemctl disable mdatp ```+After executing the above, use your package manager to perform the upgrade. + +As an alternative to the above, you can follow the instructions to [uninstall](/microsoft-365/security/defender-endpoint/linux-resources#uninstall), then [install](/microsoft-365/security/defender-endpoint/linux-install-manually#application-installation) the latest version of the package. </br> <br/><br/> |
| security | Mde Device Control Device Installation | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mde-device-control-device-installation.md | ms.pagetype: security ms.localizationpriority: medium Previously updated : 08/11/2022 Last updated : 10/18/2022 audience: ITPro Prevent installation of removable devices This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device. > [!NOTE]-> To enable the **Allow installation of devices that match any of these device instance IDs** policy setting to supersede this policy setting for applicable devices, enable the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy setting. +> To enable the **Allow installation of devices that match any of these device instance IDs** policy setting to supersede this policy setting for applicable devices, enable the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy setting. Also, the allow policy wonΓÇÖt take precedence if the **Block Removable Storage** option is selected in Device Control. If you enable this policy setting, Windows is prevented from installing a device whose hardware ID or compatible ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. |
| security | Microsoft Defender Antivirus On Windows Server | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-on-windows-server.md | +- m365-security +- tier2 - m365initiative-defender-endpoint |
| security | Microsoft Defender Endpoint Linux | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-linux.md | If you experience any installation failures, refer to [Troubleshooting installat - For 6.7: 2.6.32-573.* - For 6.8: 2.6.32-642.* - For 6.9: 2.6.32-696.* (except 2.6.32-696.el6.x86_64)- - For 6.10: 2.6.32.754.2.1.el6.x86_64 to 2.6.32-754.47.1: + - For 6.10: 2.6.32.754.2.1.el6.x86_64 to 2.6.32-754.48.1: - 2.6.32-754.10.1.el6.x86_64 - 2.6.32-754.11.1.el6.x86_64 If you experience any installation failures, refer to [Troubleshooting installat - 2.6.32-754.41.2.el6.x86_64 - 2.6.32-754.43.1.el6.x86_64 - 2.6.32-754.47.1.el6.x86_64+ - 2.6.32-754.48.1.el6.x86_64 - 2.6.32-754.6.3.el6.x86_64 - 2.6.32-754.9.1.el6.x86_64 |
| security | Professional Services | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/professional-services.md | +- m365-security +- tier3 search.appverid: met150 |
| security | Run Analyzer Macos Linux | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/run-analyzer-macos-linux.md | search.appverid: met150 1. Download the [XMDE Client Analyzer](https://aka.ms/XMDEClientAnalyzer) tool to the macOS or Linux machine you need to investigate. > [!NOTE]- > The current SHA256 hash of 'XMDEClientAnalyzer.zip' that is downloaded from the above link is: 'BF102A79626C88FE58B5BE3034640835F96F54230292486716D72F515875966C' + > The current SHA256 hash of 'XMDEClientAnalyzer.zip' that is downloaded from the above link is: 'D54FEAEB444127E486CE2B2646BCD3A076F58C44214490F60E35EDD55F763219' 2. Extract the contents of XMDEClientAnalyzer.zip on the machine. Open a terminal or SSH into the relevant machine and run the following commands: > - In addition, the tool currently requires Python version 3 or later to be installed. > > - If you are running on a machine that cannot use Python 3 or fetch the lxml component, then you can download a binary based version of the analyzer that does not have any of the requirements: [XMDE Client Analyzer Binary](https://aka.ms/XMDEClientAnalyzerBinary). <br> Note that the binary is currently unsigned. To allow the package run on MacOS, you will need to use the syntax: "spctl --add /Path/To/Application.app".-> - The current SHA256 hash of 'XMDEClientAnalyzerBinary.zip' that is downloaded from the above link is: '6FEB44EF2D9FEB8C8093A016FAB2B5F3ED580931008066BF134E8B1E04CAB222' +> - The current SHA256 hash of 'XMDEClientAnalyzerBinary.zip' that is downloaded from the above link is: '44099C0AA544B6A2E8676D5BB64BA79494E615E17329CE5ACC26C9F48E7F226B' > > - If your device is behind a proxy, then you can simply pass the proxy server as an environment variable to the mde_support_tool.sh script. For example: > `https_proxy=https://myproxy.contoso.com:8080 ./mde_support_tool.sh"` |
| security | Schedule Antivirus Scans | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/schedule-antivirus-scans.md | ms.localizationpriority: medium Previously updated : 08/09/2022 Last updated : 10/18/2022 In addition to always-on, real-time protection and [on-demand antivirus](run-sca - If a device is unplugged and running on battery during a scheduled full scan, the scheduled scan will stop with event 1002, which states that the scan stopped before completion. Microsoft Defender Antivirus will run a full scan at the next scheduled time. +- Scheduled scans run according to the local time zone of the device. + ## Quick scan, full scan, and custom scan When you set up scheduled scans, you can specify whether the scan should be a full or quick scan. In most cases, a quick scan is recommended; however, we also recommend that you run at least one full scan after installing or enabling Defender Antivirus. This scan provides an opportunity to find existing threats and helps populate the cache for future scans. |
| security | Technological Partners | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/technological-partners.md | +- m365-security +- tier3 search.appverid: met150 |
| security | Microsoft 365 Security Center Defender Cloud Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-center-defender-cloud-apps.md | f1.keywords: Previously updated : 08/21/2022 Last updated : 08/04/2022 audience: ITPro search.appverid: Learn more about the benefits: [Overview of Microsoft 365 Defender](microsoft-36 ## Quick reference -The image and the table below lists the changes in navigation between Microsoft Defender for Cloud Apps and Microsoft 365 Defender. +The images and the tables below list the changes in navigation between Microsoft Defender for Cloud Apps and Microsoft 365 Defender. -> [!NOTE] -> Some pages have not yet been migrated and should be accessed from the Defender for Cloud Apps portal. +### Discover > [!div class="mx-imgBorder"]-> :::image type="content" source="../../media/defender-cloud-apps-m365-defender.png" alt-text="The new locations in the Microsoft 365 Defender portal" lightbox="../../media/defender-cloud-apps-m365-defender.png"::: +> :::image type="content" source="../../media/defender-cloud-apps-m365-defender-discover.png" alt-text="The new locations for Cloud Discovery features in the Microsoft 365 Defender portal" lightbox="../../media/defender-cloud-apps-m365-defender-discover.png"::: | Defender for Cloud Apps | Microsoft 365 Defender | ||| The image and the table below lists the changes in navigation between Microsoft | Devices | tab on Cloud Discovery page | | Cloud app catalog | Cloud apps -> Cloud app catalog | | Create Cloud Discovery snapshot report | On the Cloud Discovery page, under Actions |++### Investigate ++> [!div class="mx-imgBorder"] +> :::image type="content" source="../../media/defender-cloud-apps-m365-defender-investigate.png" alt-text="The new locations for Investigation features in the Microsoft 365 Defender portal" lightbox="../../media/defender-cloud-apps-m365-defender-investigate.png"::: ++| Defender for Cloud Apps | Microsoft 365 Defender | +||| | Activity log | Cloud apps -> Activity log |-| Files | remaining in Defender for Cloud Apps portal | +| Files | Cloud apps -> Files | | Users and accounts | Assets -> Identities |-| Security configuration | remaining in Defender for Cloud Apps portal | +| Security configuration | available in [Microsoft Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction) | | Identity security posture | [Microsoft Defender for Identity's identity security posture assessments](/defender-for-identity/isp-overview) | | OAuth apps | Cloud apps -> OAuth apps |-| Connected apps | remaining in Defender for Cloud Apps portal | +| Connected apps | Settings -> Cloud apps -> Connected apps | ++### Control -> [!NOTE] -> The new Defender for Cloud Apps experience in the Microsoft 365 Defender portal is currently available for all users detailed in [Manage admin access](/defender-cloud-apps/manage-admins), except for: -> -> - **App/Instance admin**, **User group admin**, **Cloud Discovery global admin**, and **Cloud Discovery report admin**, as defined in [Built-in admin roles in Defender for Cloud Apps](/defender-cloud-apps/manage-admins#built-in-admin-roles-in-defender-for-cloud-apps). -> - User privacy groups as defined in [Activity privacy](/defender-cloud-apps/activity-privacy) +> [!div class="mx-imgBorder"] +> :::image type="content" source="../../media/defender-cloud-apps-m365-defender-control.png" alt-text="The new locations for Control features in the Microsoft 365 Defender portal" lightbox="../../media/defender-cloud-apps-m365-defender-control.png"::: ++| Defender for Cloud Apps | Microsoft 365 Defender | +||| +| Policies | Cloud apps -> Policy management | +| Templates | Cloud apps -> Policy templates | ++### Settings ++> [!div class="mx-imgBorder"] +> :::image type="content" source="../../media/defender-cloud-apps-m365-defender-settings.png" alt-text="The new locations for Settings in the Microsoft 365 Defender portal" lightbox="../../media/defender-cloud-apps-m365-defender-settings.png"::: ++| Defender for Cloud Apps | Microsoft 365 Defender | +||| +| Settings | Settings -> Cloud apps | +| System settings | Settings -> Cloud apps | +| Settings/Governance log | Cloud apps -> Governance log | +| Security extensions | Settings -> Cloud apps | +| Playbooks | Settings -> Cloud apps | +| SIEM agents | Settings -> Cloud apps | +| External DLP | Settings -> Cloud apps | +| API tokens | Settings -> Cloud apps | +| Manage admin access | Permissions-> Cloud apps-> Roles | +| Exported reports | Reports -> Cloud apps -> Exported reports | +| Scoped deployment and privacy | Permissions -> Cloud apps -> Activity Privacy permissions | +| Connected Apps/App connectors | Settings -> Cloud Apps -> Connected Apps | +| Conditional Access App Control | Settings -> Cloud apps -> Conditional Access App Control apps | +| IP address ranges | Settings -> Cloud apps | +| User groups | Settings -> Cloud apps | ++## Limitations ++- The new Defender for Cloud Apps experience in the Microsoft 365 Defender portal is currently available for all users detailed in [Manage admin access](/defender-cloud-apps/manage-admins), except for: + - **App/Instance admin**, **User group admin**, **Cloud Discovery global admin**, and **Cloud Discovery report admin**, as defined in [Built-in admin roles in Defender for Cloud Apps](/defender-cloud-apps/manage-admins#built-in-admin-roles-in-defender-for-cloud-apps). + - User privacy groups as defined in [Activity privacy](/defender-cloud-apps/activity-privacy) ++- The new experience is currently available for full Microsoft Defender for Cloud Apps licenses only. +- New customers need to first sign in to the Microsoft Defender for Cloud Apps portal. +- Some links may redirect you to the Defender for Cloud Apps portal. ## What's changed Global search in Microsoft 365 Defender (using the search bar at the top of the As part of the creation of a dedicated **Assets** section that spans the entire Microsoft 365 Defender experience, the **Users and Accounts** section of Defender for Cloud Apps is rebranded as the **Identities** section. No changes to functionality are expected. +## Related videos ++- [Protecting cloud apps in Microsoft 365 Defender](https://www.microsoft.com/videoplayer/embed/RE59yVU) + ## Related information - [Microsoft 365 Defender](microsoft-365-defender.md) |
| security | Allow Block Email Spoof | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/allow-block-email-spoof.md | Title: Allow or block emails using the Tenant Allow/Block List + Title: Allow or block email using the Tenant Allow/Block List f1.keywords: - NOCSH search.appverid: - MET150 - m365-security-description: Admins can learn how to allow or block emails and spoofed sender entries in the Tenant Allow/Block List in the Security portal. +description: Admins can learn how to allow or block email and spoofed sender entries in the Tenant Allow/Block List in the Security portal. -# Allow or block emails using the Tenant Allow/Block List +# Allow or block email using the Tenant Allow/Block List [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] You can't create allow entries for domains and email addresses directly in the T For instructions, see [Report good email to Microsoft](admin-submission.md#report-good-email-to-microsoft). > [!NOTE]-> Microsoft does not allow you to create allow entries directly as it leads to creation of allows that are not needed, thus exposing the customer's tenant to malicious emails which might otherwise have been filtered by the system. +> Microsoft does not allow you to create allow entries directly as it leads to creation of allows that are not needed, thus exposing your organization to malicious email which might otherwise have been filtered by the system. > > Microsoft manages the allow creation process from Submission by creating allows for those entities (domains or email addresses, spoofed senders, URLs, files) which were determined to be malicious by filters during mail flow. For example, if the sender and a URL in the message were determined to be bad, an allow entry is created for the sender, and an allow entry is created for the URL. > |
| security | Create Block Sender Lists In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/create-block-sender-lists-in-office-365.md | -In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, EOP offers multiple ways of blocking email from unwanted senders. These options include Outlook Blocked Senders, blocked sender lists or blocked domain lists in anti-spam policies, Exchange mail flow rules (also known as transport rules), and the IP Block List (connection filtering). Collectively, you can think of these options as _blocked sender lists_. +In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, EOP offers multiple ways of blocking email from unwanted senders. Collectively, you can think of these options as _blocked sender lists_. -The best method to block senders varies on the scope of impact. For a single user, the right solution could be Outlook Blocked Senders. For many users, one of the other options would be more appropriate. The following options are ranked by both impact scope and breadth. The list goes from narrow to broad, but _read the specifics_ for full recommendations. +The available blocked sender lists are described in the following list in order from most recommended to least recommended: -1. Outlook Blocked Senders (the Blocked Senders list that's stored in each mailbox) +1. Block entries for domains and email addresses (including spoofed senders) in the Tenant Allow/Block List. +2. Outlook Blocked Senders (the Blocked Senders list that's stored in each mailbox). +3. Blocked sender lists or blocked domain lists (anti-spam policies). +4. Mail flow rules (also known as transport rules). +5. The IP Block List (connection filtering). -2. Blocked sender lists or blocked domain lists (anti-spam policies) --3. Mail flow rules --4. The IP Block List (connection filtering) +The rest of this article contains specifics about each method. > [!NOTE]-> While you can use organization-wide block settings to address false negatives (missed spam), you should also submit those messages to Microsoft for analysis. Managing false negatives by using block lists significantly increases your administrative overhead. If you use block lists to deflect missed spam, you need to keep the topic [Report messages and files to Microsoft](report-junk-email-messages-to-microsoft.md) at the ready. --In contrast, you also have several options to always allow email from specific sources using _safe sender lists_. For more information, see [Create safe sender lists](create-safe-sender-lists-in-office-365.md). +> Always submit messages in your blocked sender lists to Microsoft for analysis. For instructions, see [Report questionable email to Microsoft](admin-submission.md#report-questionable-email-to-microsoft). If the messages or message sources are determined to be harmful, Microsoft can automatically block the messages, and you won't need to manually maintain the entry in blocked sender lists. +> +> Instead of blocking email, you also have several options to allow email from specific sources using _safe sender lists_. For more information, see [Create safe sender lists](create-safe-sender-lists-in-office-365.md). ## Email message basics Frequently, the `5321.MailFrom` and `5322.From` addresses are the same (person-t Blocked sender lists and blocked domain lists in anti-spam policies in EOP inspect only the `5322.From` addresses. This behavior is similar to Outlook Blocked Senders that use the `5322.From` address. +## Use block entries in the Tenant Allow/Block List ++Our number one recommended option for blocking mail from specific senders or domains is the Tenant Allow/Block List. For instructions, see [Allow or block email using the Tenant Allow/Block List](allow-block-email-spoof.md). ++Email messages from these senders are marked as _high confidence spam_ (SCL = 9). What happens to the messages is determined by the [anti-spam policy](configure-your-spam-filter-policies.md) that detected the message for the recipient. In the default anti-spam policy and new custom policies, messages that are marked as high confidence spam are delivered to the Junk Email folder by default. In Standard and Strict [preset security policies](preset-security-policies.md), high confidence spam messages are quarantined. ++As an added benefit, users in the organization can't send email to these blocked domains and addresses. They'll receive the following non-delivery report (also known as an NDR or bounce message): `5.7.1 Your message can't be delivered because one or more recipients are blocked by your organization's tenant allow/block list policy.` The entire message is blocked to all recipients if email is sent to any of the entries in the list. ++Only if you can't use the Tenant Allow/Block List for some reason should you consider using a different method to block senders. + ## Use Outlook Blocked Senders When only a small number of users received unwanted email, users or admins can add the sender email addresses to the Blocked Senders list in the mailbox. For instructions, see [Configure junk email settings on Exchange Online mailboxes](configure-junk-email-settings-on-exo-mailboxes.md). The maximum limit for these lists is approximately 1000 entries. ## Use mail flow rules -If you need to block messages that are sent to specific users or across the entire organization, you can use mail flow rules. Mail flow rules are more flexible than block sender lists or blocked sender domain lists because they can also look for keywords or other properties in the unwanted messages. +Mail flow rules can also look for keywords or other properties in the unwanted messages. Regardless of the conditions or exceptions that you use to identify the messages, you configure the action to set the spam confidence level (SCL) of the message to 9, which marks the message as **High confidence spam**. For more information, see [Use mail flow rules to set the SCL in messages](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl). > [!IMPORTANT]-> It's easy to create rules that are _overly_ aggressive, so it's important that you identify only the messages you want to block using very specific criteria. Also, be sure to enable auditing on the rule and test the results of the rule to ensure everything works as expected. +> It's easy to create rules that are _overly_ aggressive, so it's important that you identify only the messages you want to block using very specific criteria. Also, be sure to [monitor the usage of the rule](/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules#monitor-rule-usage) to ensure everything works as expected. ## Use the IP Block List |
| security | Create Safe Sender Lists In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365.md | -If you're a Microsoft 365 customer with mailboxes in Exchange Online or a standalone Exchange Online Protection (EOP) customer without Exchange Online mailboxes, EOP offers multiple ways of ensuring that users will receive email from trusted senders. These options include Exchange mail flow rules (also known as transport rules), Outlook Safe Senders, the IP Allow List (connection filtering), and allowed sender lists or allowed domain lists in anti-spam policies. Collectively, you can think of these options as _safe sender lists_. +If you're a Microsoft 365 customer with mailboxes in Exchange Online or a standalone Exchange Online Protection (EOP) customer without Exchange Online mailboxes, EOP offers multiple ways of ensuring that users will receive email from trusted senders. Collectively, you can think of these options as _safe sender lists_. The available safe sender lists are described in the following list in order from most recommended to least recommended: -1. Mail flow rules -2. Outlook Safe Senders -3. IP Allow List (connection filtering) -4. Allowed sender lists or allowed domain lists (anti-spam policies) +1. Allow entries for domains and email addresses (including spoofed senders) in the Tenant Allow/Block List. +2. Mail flow rules (also known as transport rules). +3. Outlook Safe Senders (the Safe Senders list that's stored in each mailbox). +4. IP Allow List (connection filtering) +5. Allowed sender lists or allowed domain lists (anti-spam policies) -Mail flow rules allow the most flexibility to ensure that only the right messages are allowed. Allowed sender and allowed domain lists in anti-spam policies aren't as secure as the IP Allow List, because the sender's email domain is easily spoofed. But, the IP Allow List also presents a risk, because email from _any_ domain that's sent from that IP address will bypass spam filtering. +The rest of this article contains specifics about each method. > [!IMPORTANT]+> Messages that are identified as malware or high confidence phishing are always quarantined, regardless of the safe sender list option that you use. For more information, see [Secure by default in Office 365](secure-by-default.md). >-> - Messages that are identified as malware or high confidence phishing are always quarantined, regardless of the safe sender list option that you use. For more information, see [Secure by default in Office 365](secure-by-default.md). +> Be careful to closely monitor _any_ exceptions that you make to spam filtering using safe sender lists. >-> - Be careful to closely monitor _any_ exceptions that you make to spam filtering using safe sender lists. -> -> - While you can use safe sender lists to help with false positives (good email marked as bad), you should consider the use of safe sender lists as a temporary solution that should be avoided if possible. We don't recommend managing false positives by using safe sender lists, because exceptions to spam filtering can open your organization to spoofing and other attacks. If you insist on using safe sender lists to manage false positives, you need to be vigilant and keep the topic [Report messages and files to Microsoft](report-junk-email-messages-to-microsoft.md) at the ready. -> -> - To allow a domain to send unauthenticated email (bypass anti-spoofing protection) but not bypass anti-spam and other protections, you can use the [spoof intelligence insight](learn-about-spoof-intelligence.md) and the [Tenant Allow/Block List](manage-tenant-allow-block-list.md). -> -> - EOP and Outlook inspect different message properties to determine the sender of the message. For more information, see the [Considerations for bulk email](#considerations-for-bulk-email) section later in this article. +> Always submit messages in your safe sender lists to Microsoft for analysis. For instructions, see [Report good email to Microsoft](admin-submission.md#report-good-email-to-microsoft). If the messages or message sources are determined to be benign, Microsoft can automatically allow the messages, and you won't need to manually maintain the entry in safe sender lists. >+> Instead of allowing email, you also have several options to block email from specific sources using _blocked sender lists_. For more information, see [Create block sender lists in EOP](create-block-sender-lists-in-office-365.md). ++## Use allow entries in the Tenant Allow/Block List ++Our number one recommended option for allowing mail from senders or domains is the Tenant Allow/Block List. For instructions, see [Allow or block email using the Tenant Allow/Block List](allow-block-email-spoof.md). -In contrast, you also have several options to block email from specific sources using _blocked sender lists_. For more information, see [Create block sender lists in EOP](create-block-sender-lists-in-office-365.md). +Only if you can't use the Tenant Allow/Block List for some reason should you consider using a different method to allow senders. -## (Recommended) Use mail flow rules +## Use mail flow rules > [!NOTE] > You can't use message headers and mail flow rules to designate an internal sender as a safe sender. The procedures in this section work for external senders only. The following example assumes you need email from contoso.com to skip spam filte This condition checks the email authentication status of the sending email domain to ensure that the sending domain is not being spoofed. For more information about email authentication, see [SPF](set-up-spf-in-office-365-to-help-prevent-spoofing.md), [DKIM](use-dkim-to-validate-outbound-email.md), and [DMARC](use-dmarc-to-validate-email.md). - - **IP Allow List**: Specify the source IP address or address range in the connection filter policy. + - **IP Allow List**: Specify the source IP address or address range in the connection filter policy. For instructions, see [Configure connection filtering](configure-the-connection-filter-policy.md). Use this setting if the sending domain does not use email authentication. Be as restrictive as possible when it comes to the source IP addresses in the IP Allow List. We recommend an IP address range of /24 or less (less is better). Do not use IP address ranges that belong to consumer services (for example, outlook.com) or shared infrastructures. The following example assumes you need email from contoso.com to skip spam filte > - If you allow an IP address that's behind a network address translation (NAT) gateway, you need to know the servers that are involved in the NAT pool in order to know the scope of your IP Allow List. IP addresses and NAT participants can change. You need to periodically check your IP Allow List entries as part of your standard maintenance procedures. 3. **Optional conditions**:+ - **The sender** \> **is internal/external** \> **Outside the organization**: This condition is implicit, but it's OK to use it to account for on-premises email servers that might not be correctly configured. - **The subject or body** \> **subject or body includes any of these words** \> \<keywords\>: If you can further restrict the messages by keywords or phrases in the subject line or message body, you can use those words as a condition. 4. **Action**: Configure both of these actions in the rule:+ 1. **Modify the message properties** \> **set the spam confidence level (SCL)** \> **Bypass spam filtering**. 2. **Modify the message properties** \> **set a message header**: **Set the message header** \<CustomHeaderName\> **to the value** \<CustomHeaderValue\>. The following example assumes you need email from contoso.com to skip spam filte ## Use Outlook Safe Senders > [!CAUTION]-> This method creates a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered; however, the user's Safe Senders or Safe Domains lists don't prevent malware or high confidence phishing messages from being filtered. +> This method creates a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered; however, if a message from an entry in the user's Safe Senders or Safe Domains lists is determined to be malware or high confidence phishing, the message will be filtered. -Instead of an organizational setting, users or admins can add the sender email addresses to the Safe Senders list in the mailbox. For instructions, see [Configure junk email settings on Exchange Online mailboxes in Office 365](configure-junk-email-settings-on-exo-mailboxes.md). This method is not desirable in most situations since senders will bypass parts of the filtering stack. Although you trust the sender, the sender can still be compromised and send malicious content. Itt's better when you let our filters check every message and then [report the false positive/negative to Microsoft](report-junk-email-messages-to-microsoft.md) if we got it wrong. Bypassing the filtering stack also interferes with [zero-hour auto purge (ZAP)](zero-hour-auto-purge.md). +Instead of an organizational setting, users or admins can add the sender email addresses to the Safe Senders list in the mailbox. For instructions, see [Configure junk email settings on Exchange Online mailboxes in Office 365](configure-junk-email-settings-on-exo-mailboxes.md). ++This method is not desirable in most situations since senders will bypass parts of the filtering stack. Although you trust the sender, the sender can still be compromised and send malicious content. You should let our filters check every message and then [report the false positive/negative to Microsoft](report-junk-email-messages-to-microsoft.md) if we got it wrong. Bypassing the filtering stack also interferes with [zero-hour auto purge (ZAP)](zero-hour-auto-purge.md). By design and for increased security of Exchange Online mailboxes, only the junk email settings for safe senders, blocked senders, and blocked domains are recognized. Safe mailing list settings are ignored. When messages skip spam filtering due to a user's Safe Senders list, the **X-For ## Use the IP Allow List -If you can't use mail flow rules as previously described, the next best option is to add the source email server or servers to the IP Allow List in the connection filter policy. For details, see [Configure connection filtering in EOP](configure-the-connection-filter-policy.md). +> [!CAUTION] +> Without additional verification like mail flow rules, email from sources in the IP Allow List skips spam filtering and sender authentication (SPF, DKIM, DMARC) checks. This result creates a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered; however, if a message from an entry in the IP Allow List is determined to be malware or high confidence phishing, the message will be filtered. ++The next best option is to add the source email server or servers to the IP Allow List in the connection filter policy. For details, see [Configure connection filtering in EOP](configure-the-connection-filter-policy.md). **Notes**: If you can't use mail flow rules as previously described, the next best option i - Do not use IP address ranges that belong to consumer services (for example, outlook.com) or shared infrastructures. - Regularly review the entries in the IP Allow List and remove the entries that you no longer need. -> [!CAUTION] -> Without additional verification like mail flow rules, email from sources in the IP Allow List skips spam filtering and sender authentication (SPF, DKIM, DMARC) checks. This creates a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered; however, the IP Allow List doesn't prevent malware or high confidence phishing messages from being filtered. - ## Use allowed sender lists or allowed domain lists -The least desirable option is to use the allowed sender list or allowed domain list in anti-spam policies. You should avoid this option _if at all possible_ because senders bypass all spam, spoof, and phishing protection, and sender authentication (SPF, DKIM, DMARC). This method is best used for temporary testing only. The detailed steps can be found in [Configure anti-spam policies in EOP](configure-your-spam-filter-policies.md) topic. --The maximum limit for these lists is approximately 1000 entries; although, you will only be able to enter 30 entries into the portal. You must use PowerShell to add more than 30 entries. - > [!CAUTION] >-> - This method creates a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered; however, the allowed senders or allowed domains lists don't prevent malware or high confidence phishing messages from being filtered. +> This method creates a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered; however, if a message from an entry in the allowed senders or allowed domains lists is determined to be malware or high confidence phishing, the message will be filtered. >-> - Do not use domains you own (also known as accepted domains) or popular domains (for example, microsoft.com) in allowed domain lists. +> Do not use domains you own (also known as accepted domains) or popular domains (for example, microsoft.com) in allowed domain lists. ++The least desirable option is to use the allowed sender list or allowed domain list in anti-spam policies. You should avoid this option _if at all possible_ because senders bypass all spam, spoof, phishing protection (except high confidence phishing), and sender authentication (SPF, DKIM, DMARC). This method is best used for temporary testing only. The detailed steps can be found in [Configure anti-spam policies in EOP](configure-your-spam-filter-policies.md) topic. ++The maximum limit for these lists is approximately 1000 entries; although, you will only be able to enter 30 entries into the portal. You must use PowerShell to add more than 30 entries. ## Considerations for bulk email A standard SMTP email message consists of a _message envelope_ and message conte Frequently, the `5321.MailFrom` and `5322.From` addresses are the same (person-to-person communication). However, when email is sent on behalf of someone else, the addresses can be different. This happens most often for bulk email messages. -For example, suppose that Blue Yonder Airlines has hired Margie's Travel to send out its email advertising. The message you receive in your Inbox has the following properties: +For example, suppose that Blue Yonder Airlines has hired Margie's Travel to send advertising email messages. The message you receive in your Inbox has the following properties: - The `5321.MailFrom` address is blueyonder.airlines@margiestravel.com. - The `5322.From` address is blueyonder@news.blueyonderairlines.com, which is what you'll see in Outlook. -Safe sender lists and safe domain lists in anti-spam policies in EOP inspect only the `5322.From` addresses, this is similar to Outlook Safe Senders that uses the `5322.From` address. +Safe sender lists and safe domain lists in anti-spam policies in EOP inspect only the `5322.From` addresses. This behavior is similar to Outlook Safe Senders that use the `5322.From` address. To prevent this message from being filtered, you can take the following steps: - Add blueyonder@news.blueyonderairlines.com (the `5322.From` address) as an Outlook Safe Sender.-- [Use a mail flow rule](#recommended-use-mail-flow-rules) with a condition that looks for messages from blueyonder@news.blueyonderairlines.com (the `5322.From` address, blueyonder.airlines@margiestravel.com (the `5321.MailFrom`), or both.+- [Use a mail flow rule](#use-mail-flow-rules) with a condition that looks for messages from blueyonder@news.blueyonderairlines.com (the `5322.From` address), blueyonder.airlines@margiestravel.com (the `5321.MailFrom` address), or both. |
| security | Manage Tenant Allow Block List | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/manage-tenant-allow-block-list.md | By default, allow entries for **domains and email addresses**, **files** and **U > [!NOTE] > Microsoft does not allow you to create allow entries directly as it leads to creation of allows that are not needed, thus exposing the customer's tenant to malicious emails which might otherwise have been filtered by the system. >-> Microsoft manage the allow creation process from Submission by creating allows for those entities (domains or email addresses, spoofed senders, URLs, files) which were determined to be malicious by filters during mail flow. For example, if the sender and a URL in the message were determined to be bad, an allow entry is created for the sender, and an allow entry is created for the URL. +> Microsoft manages the allow creation process from Submission by creating allows for those entities (domains or email addresses, spoofed senders, URLs, files) which were determined to be malicious by filters during mail flow. For example, if the sender and a URL in the message were determined to be bad, an allow entry is created for the sender, and an allow entry is created for the URL. > > When that entity (domain or email address, URL, file) is encountered again, all filters associated with that entity are skipped. > After you add an allow entry through the Submissions portal or a block entry in We recommend letting entries automatically expire after 30 days to see if the system has learned about the allow or block. If not, you should make another entry to give the system another 30 days to learn. -Note that with **allow expiry management** (currently in private preview), if Microsoft has not learned from the allow, Microsoft will automatically extend the expiry time of allows, which are going to expire soon, by 30 days to prevent legitimate email from going to junk or quarantine again. If Microsoft does not learn within 90 calendar days from the date of allow creation, Microsoft will remove the allow. +With **allow expiry management** (currently in Private preview), if Microsoft has not learned from the allow entry, Microsoft will automatically extend the expiry time of allow entries that will soon expire soon by another 30 days. This extension helps to prevent legitimate email from going to junk or quarantine again. If Microsoft does not learn within 90 calendar days from the date of the original creation of the allow entry, Microsoft will remove the allow entry. -If Microsoft has learned from the allow, the allow will be removed and you will get an alert informing you about it. +If Microsoft has learned from the allow entry, the entry will be removed, and you'll get an alert informing you about it. |