| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | What Is A Domain | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/get-help-with-domains/what-is-a-domain.md | +- ContentEngagementFY23 - scotvorg - highpri - M365-subscription-management |
| admin | Password Policy Recommendations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/password-policy-recommendations.md | +- ContentEngagementFY23 - scotvorg - highpri - Adm_O365 For more information about Microsoft 365 passwords, see: [Let users reset their own passwords](../add-users/let-users-reset-passwords.md) (article) [Resend a user's password - Admin Help](../add-users/resend-user-password.md) (article)++[Time to rethink mandatory password changes](https://go.microsoft.com/fwlink/p/?linkid=861018). ## Understanding password recommendations These are some of the most commonly used password management practices, but rese ### Password expiration requirements for users -Password expiration requirements do more harm than good, because these requirements make users select predictable passwords, composed of sequential words and numbers that are closely related to each other. In these cases, the next password can be predicted based on the previous password. Password expiration requirements offer no containment benefits because cybercriminals almost always use credentials as soon as they compromise them. Check out [Time to rethink mandatory password changes](https://go.microsoft.com/fwlink/p/?linkid=861018) for more info. +Password expiration requirements do more harm than good, because these requirements make users select predictable passwords, composed of sequential words and numbers that are closely related to each other. In these cases, the next password can be predicted based on the previous password. Password expiration requirements offer no containment benefits because cybercriminals almost always use credentials as soon as they compromise them. ### Minimum password length requirements |
| admin | Install Applications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/setup/install-applications.md | +- ContentEngagementFY23 - scotvorg - highpri - M365-subscription-management |
| commerce | Pay For Your Subscription | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/pay-for-your-subscription.md | +- ContentEngagementFY23 - scotvorg - highpri - M365-subscription-management |
| commerce | Understand Your Invoice | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/understand-your-invoice.md | f1.keywords: ms.localizationpriority: medium +- ContentEngagementFY23 - scotvorg - highpri - M365-subscription-management |
| compliance | Apply Retention Labels Automatically | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/apply-retention-labels-automatically.md | When you create an auto-apply policy, you select a retention label to automatica 5. Depending on your selected scope: - If you chose **Adaptive**: On the **Choose adaptive policy scopes and locations** page, select **Add scopes** and select one or more adaptive scopes that have been created. Then, select one or more locations. The locations that you can select depend on the [scope types](retention-settings.md#configuration-information-for-adaptive-scopes) added. For example, if you only added a scope type of **User**, you will be able to select **Exchange email** but not **SharePoint sites**.-+ - If you chose **Static**: On the **Choose locations** page, toggle on or off any of the locations. For each location, you can leave it at the default to [apply the policy to the entire location](retention-settings.md#a-policy-that-applies-to-entire-locations), or [specify includes and excludes](retention-settings.md#a-policy-with-specific-inclusions-or-exclusions) For information about the location choices, see [Locations](retention-settings.md#locations). Additionally, SharePoint items that are in draft or that have never been publish #### Auto-apply labels to content with specific types of sensitive information > [!IMPORTANT]-> For emails that you auto-apply by identifying sensitive information, all mailboxes are automatically included, which includes mailboxes from Microsoft 365 groups. +> For emails that you auto-apply by identifying sensitive information, all mailboxes are automatically included, which includes mailboxes from Microsoft 365 groups. By default, the **Exchange email** location isn't selected for adaptive scopes when you have this configuration. Even if you can select the location, retention labels won't apply to the Exchange items. > > Although group mailboxes would usually be included by selecting the **Microsoft 365 Groups** location, for this specific policy configuration, the groups location includes only SharePoint sites connected to a Microsoft 365 group. |
| compliance | Dlp Policy Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-policy-reference.md | audience: Admin ms.localizationpriority: medium+search.appverid: - SPO160 - MET150 ms.assetid: 6501b5ef-6bf7-43df-b60d-f65781847d6c Microsoft Purview Data Loss Prevention (DLP) policies have many components to co [!INCLUDE [purview-preview](../includes/purview-preview.md)] -## Policy templates +## Policy templates DLP policy templates are pre-sorted into four categories: DLP policy templates are pre-sorted into four categories: - Ones that can detect and protect types of **Privacy** information. - A **Custom** template that you can use to build your own policy if one of the others doesn't meet your organizations needs. -This table lists all policy templates and the sensitive information types (SIT) that they cover. +This table lists all policy templates and the sensitive information types (SIT) that they cover. updated: 06/23/2021 updated: 06/23/2021 |Privacy| France Personally Identifiable Information (PII) Data|- [France social security number (INSEE)](sit-defn-france-social-security-number.md) </br> - [France driver's license number](sit-defn-france-drivers-license-number.md) </br> - [France passport number](sit-defn-france-passport-number.md) </br> - [France national id card (CNI)](sit-defn-france-national-id-card.md)| |Privacy| General Data Protection Regulation (GDPR) Enhanced|- [Austria Physical Addresses](sit-defn-austria-physical-addresses.md) </br> - [Belgium Physical Addresses](sit-defn-belgium-physical-addresses.md) </br> - [Bulgaria Physical Addresses](sit-defn-bulgaria-physical-addresses.md) </br> - [Croatia Physical Addresses](sit-defn-croatia-physical-addresses.md) </br> - [Cyprus Physical Addresses](sit-defn-cyprus-physical-addresses.md) </br> - [Czech Republic Physical Addresses](sit-defn-czech-republic-physical-addresses.md)</br> - [Denmark Physical Addresses](sit-defn-denmark-physical-addresses.md)</br> - [Estonia Physical Addresses](sit-defn-estonia-physical-addresses.md)</br> - [Finland Physical Addresses](sit-defn-finland-physical-addresses.md)</br> - [France Physical Addresses](sit-defn-france-physical-addresses.md)</br> - [Germany Physical Addresses](sit-defn-germany-physical-addresses.md)</br> - [Greece Physical Addresses](sit-defn-greece-physical-addresses.md)</br> - [Hungary Physical Addresses](sit-defn-hungary-physical-addresses.md)</br> - [Ireland Physical Addresses](sit-defn-ireland-physical-addresses.md)</br> - [Italy Physical Addresses](sit-defn-italy-physical-addresses.md)</br> - [Latvia Physical Addresses](sit-defn-latvia-physical-addresses.md)</br> - [Lithuania Physical Addresses](sit-defn-lithuania-physical-addresses.md)</br> - [Luxembourg Physical Addresses](sit-defn-luxemburg-physical-addresses.md)</br> - [Malta Physical Addresses](sit-defn-malta-physical-addresses.md)</br> - [Netherlands Physical Addresses](sit-defn-netherlands-physical-addresses.md)</br> - [Poland Physical Addresses](sit-defn-poland-physical-addresses.md)</br> - [Portuguese Physical Addresses](sit-defn-portugal-physical-addresses.md)</br> - [Romania Physical Addresses](sit-defn-romania-physical-addresses.md)</br> - [Slovakia Physical Addresses](sit-defn-slovakia-physical-addresses.md)</br> - [Slovenia Physical Addresses](sit-defn-slovenia-physical-addresses.md)</br> - [Spain Physical Addresses](sit-defn-spain-physical-addresses.md)</br> - [Sweden Physical Addresses](sit-defn-sweden-physical-addresses.md)</br> - [Austria Social Security Number](sit-defn-austria-social-security-number.md) </br> - [France Social Security Number (INSEE)](sit-defn-france-social-security-number.md)</br> - [Greece Social Security Number (AMKA)](sit-defn-greece-social-security-number.md)</br> - [Hungarian Social Security Number (TAJ)](sit-defn-hungary-social-security-number.md)</br> - [Spain Social Security Number (SSN)](sit-defn-spain-social-security-number.md)</br> - [Austria Identity Card](sit-defn-austria-identity-card.md) </br> - [Cyprus Identity Card](sit-defn-cyprus-identity-card.md) </br> - [Germany Identity Card Number](sit-defn-germany-identity-card-number.md)</br> - [Malta Identity Card Number](sit-defn-malta-identity-card-number.md)</br> - [France National ID Card (CNI)](sit-defn-france-national-id-card.md)</br> - [Greece National ID Card](sit-defn-greece-national-id-card.md)</br> - [Finland National ID](sit-defn-finland-national-id.md)</br> - [Poland National ID (PESEL)](sit-defn-poland-national-id.md)</br> - [Sweden National ID](sit-defn-sweden-national-id.md)</br> - [Croatia Personal Identification (OIB) Number](sit-defn-croatia-personal-identification-number.md) </br> - [Czech Personal Identity Number](sit-defn-czech-personal-identity-number.md)</br> - [Denmark Personal Identification Number](sit-defn-denmark-personal-identification-number.md)</br> - [Estonia Personal Identification Code](sit-defn-estonia-personal-identification-code.md)</br> - [Hungary Personal Identification Number](sit-defn-hungary-personal-identification-number.md)</br> - [Luxemburg National Identification Number natural persons](sit-defn-luxemburg-national-identification-number-natural-persons.md)</br> - [Luxemburg National Identification Number (Non-natural persons)](sit-defn-luxemburg-national-identification-number-non-natural-persons.md)</br> - [Italy Fiscal Code](sit-defn-italy-fiscal-code.md)</br> - [Latvia Personal Code](sit-defn-latvia-personal-code.md)</br> - [Lithuania Personal Code](sit-defn-lithuania-personal-code.md)</br> - [Romania Personal Numerical Code (CNP)](sit-defn-romania-personal-numeric-code.md)</br> - [Netherlands Citizen's Service (BSN) Number](sit-defn-netherlands-citizens-service-number.md)</br> - [Ireland Personal Public Service (PPS) Number](sit-defn-ireland-personal-public-service-number.md)</br> - [Bulgaria Uniform Civil Number](sit-defn-bulgaria-uniform-civil-number.md) </br> - [Belgium National Number](sit-defn-belgium-national-number.md) </br> - [Spain DNI](sit-defn-spain-dni.md)</br> - [Slovenia Unique Master Citizen Number](sit-defn-slovenia-unique-master-citizen-number.md)</br> - [Slovakia Personal Number](sit-defn-slovakia-personal-number.md)</br> - [Portugal Citizen Card Number](sit-defn-portugal-citizen-card-number.md)</br> - [Malta Tax ID Number](sit-defn-malta-tax-identification-number.md)</br> - [Austria Tax Identification Number](sit-defn-austria-tax-identification-number.md) </br> - [Cyprus Tax Identification Number](sit-defn-cyprus-tax-identification-number.md) </br> -[France Tax Identification Number (num├⌐ro SPI.)](sit-defn-france-tax-identification-number.md)</br> - [Germany Tax Identification Number](sit-defn-germany-tax-identification-number.md)</br> - [Greek Tax identification Number](sit-defn-greece-tax-identification-number.md)</br> - [Hungary Tax identification Number](sit-defn-hungary-tax-identification-number.md)</br> - [Netherlands Tax Identification Number](sit-defn-netherlands-tax-identification-number.md)</br> - [Poland Tax Identification Number](sit-defn-poland-tax-identification-number.md)</br> - [Portugal Tax Identification Number](sit-defn-portugal-tax-identification-number.md)</br> - [Slovenia Tax Identification Number](sit-defn-slovenia-tax-identification-number.md)</br> - [Spain Tax Identification Number](sit-defn-spain-tax-identification-number.md)</br> - [Sweden Tax Identification Number](sit-defn-sweden-tax-identification-number.md)</br> - [Austria Driver's License](sit-defn-austria-drivers-license-number.md) </br> - [Belgium Driver's License Number](sit-defn-belgium-drivers-license-number.md) </br> - [Bulgaria Driver's License Number](sit-defn-bulgaria-drivers-license-number.md) </br> - [Croatia Driver's License Number](sit-defn-croatia-drivers-license-number.md) </br> - [Cyprus Driver's License Number](sit-defn-cyprus-drivers-license-number.md) </br> - [Czech Driver's License Number](sit-defn-czech-drivers-license-number.md) </br> - [Denmark Driver's License Number](sit-defn-denmark-drivers-license-number.md)</br> - [Estonia Driver's License Number](sit-defn-estonia-drivers-license-number.md)</br> - [Finland Driver's License Number](sit-defn-finland-drivers-license-number.md)</br> - [France Driver's License Number](sit-defn-france-drivers-license-number.md)</br> - [German Driver's License Number](sit-defn-germany-drivers-license-number.md)</br> - [Greece Driver's License Number](sit-defn-greece-drivers-license-number.md) </br> - [Hungary Driver's License Number](sit-defn-hungary-drivers-license-number.md)</br> - [Ireland Driver's License Number](sit-defn-ireland-drivers-license-number.md)</br> - [Italy Driver's License Number](sit-defn-italy-drivers-license-number.md)</br> - [Latvia Driver's License Number](sit-defn-latvia-drivers-license-number.md)</br> - [Lithuania Driver's License Number](sit-defn-lithuania-drivers-license-number.md)</br> - [Luxemburg Driver's License Number](sit-defn-luxemburg-drivers-license-number.md)</br> - [Malta Driver's License Number](sit-defn-malta-drivers-license-number.md)</br> - [Netherlands Driver's License Number](sit-defn-netherlands-drivers-license-number.md)</br> - [Poland Driver's License Number](sit-defn-poland-drivers-license-number.md)</br> - [Portugal Driver's License Number](sit-defn-portugal-drivers-license-number.md)</br> - [Romania Driver's License Number](sit-defn-romania-drivers-license-number.md)</br> - [Slovakia Driver's License Number](sit-defn-slovakia-drivers-license-number.md)</br> - [Slovenia Driver's License Number](sit-defn-slovenia-drivers-license-number.md)</br> - [Spain Driver's License Number](sit-defn-spain-drivers-license-number.md)</br> - [Sweden Driver's License Number](sit-defn-sweden-drivers-license-number.md)</br> - [Austria Passport Number](sit-defn-austria-passport-number.md) </br> - [Belgium Passport Number](sit-defn-belgium-passport-number.md) </br> - [Bulgaria Passport Number](sit-defn-bulgaria-passport-number.md) </br> - [Croatia Passport Number](sit-defn-croatia-passport-number.md) </br> - [Cyprus Passport Number](sit-defn-cyprus-passport-number.md) </br> - [Czech Republic Passport Number](sit-defn-czech-passport-number.md) </br> - [Denmark Passport Number](sit-defn-denmark-passport-number.md)</br> - [Estonia Passport Number](sit-defn-estonia-passport-number.md)</br> - [Finland Passport Number](sit-defn-finland-passport-number.md)</br> - [France Passport Number](sit-defn-france-passport-number.md)</br> - [German Passport Number](sit-defn-germany-passport-number.md)</br> - [Greece Passport Number](sit-defn-greece-passport-number.md)</br> - [Hungary Passport Number](sit-defn-hungary-passport-number.md)</br> - [Ireland Passport Number](sit-defn-ireland-passport-number.md)</br> - [Italy Passport Number](sit-defn-italy-passport-number.md)</br> - [Latvia Passport Number](sit-defn-latvia-passport-number.md)</br> - [Lithuania Passport Number](sit-defn-lithuania-passport-number.md)</br> - [Luxemburg Passport Number](sit-defn-luxemburg-passport-number.md)</br> - [Malta Passport Number](sit-defn-malta-passport-number.md)</br> - [Netherlands Passport Number](sit-defn-netherlands-passport-number.md)</br> - [Poland Passport](sit-defn-poland-passport-number.md)</br> - [Portugal Passport Number](sit-defn-portugal-passport-number.md)</br> - [Romania Passport Number](sit-defn-romania-passport-number.md)</br> - [Slovakia Passport Number](sit-defn-slovakia-passport-number.md)</br> - [Slovenia Passport Number](sit-defn-slovenia-passport-number.md)</br> - [Spain Passport Number](sit-defn-spain-passport-number.md)</br> - [Sweden Passport Number](sit-defn-sweden-passport-number.md)</br> - [EU Debit Card Number](sit-defn-eu-debit-card-number.md)</br> - [All Full Names](sit-defn-all-full-names.md)| |Privacy| General Data Protection Regulation (GDPR)|- [EU debit card number](sit-defn-eu-debit-card-number.md) </br> - [EU driver's license number](sit-defn-eu-drivers-license-number.md) </br> - [EU national identification number](sit-defn-eu-national-identification-number.md)</br> - [EU passport number](sit-defn-eu-passport-number.md) </br> - [EU social security number or equivalent identification](sit-defn-eu-social-security-number-equivalent-identification.md)</br> - [EU Tax identification number](sit-defn-eu-tax-identification-number.md)|-|Privacy| Germany Personally Identifiable Information (PII) Data|- [Germany driver's license number](sit-defn-germany-drivers-license-number.md) </br> - [Germany passport number](sit-defn-germany-passport-number.md)| -|Privacy| Israel Personally Identifiable Information (PII) Data|- [Israel national identification number](sit-defn-israel-national-identification-number.md)| +|Privacy| Germany Personally Identifiable Information (PII) Data|- [Germany driver's license number](sit-defn-germany-drivers-license-number.md) </br> - [Germany passport number](sit-defn-germany-passport-number.md)| +|Privacy| Israel Personally Identifiable Information (PII) Data|- [Israel national identification number](sit-defn-israel-national-identification-number.md)| |Privacy| Israel Protection of Privacy|- [Israel national identification number](sit-defn-israel-national-identification-number.md)</br> - [Israel bank account number](sit-defn-israel-bank-account-number.md)| |Privacy| Japan Personally Identifiable Information (PII) Data enhanced|- [Japan Social Insurance Number (SIN)](sit-defn-japan-social-insurance-number.md)</br> - [Japan My Number - Personal](sit-defn-japan-my-number-personal.md)</br> - [Japan passport number](sit-defn-japan-passport-number.md)</br> - [Japan driver's license number](sit-defn-japan-drivers-license-number.md)</br> - [All Full Names](sit-defn-all-full-names.md)</br> - [Japan Physical Addresses](sit-defn-all-physical-addresses.md)| |Privacy| Japan Personally Identifiable Information (PII) Data|- [Japan resident registration number](sit-defn-japan-resident-registration-number.md) </br> - [Japan Social Insurance Number (SIN)](sit-defn-japan-social-insurance-number.md)| If you choose to include or exclude specific OneDrive accounts or groups, a DLP ### Location support for how content can be defined -DLP policies detect sensitive items by matching them to a sensitive information type (SIT), or to a sensitivity label, or a retention label. Each location supports different methods of defining sensitive content. When you combine locations in a policy, how the content can be defined can change from how it can be defined by a single location. +DLP policies detect sensitive items by matching them to a sensitive information type (SIT), or to a sensitivity label, or a retention label. Each location supports different methods of defining sensitive content. When you combine locations in a policy, how the content can be defined can change from how it can be defined by a single location. > [!IMPORTANT] > When you select multiple locations for a policy, a "no" value for a content definition category takes precedence over "yes" value. For example, when you select SharePoint sites only, the policy will support detecting sensitive items by one or more of SIT, by sensitivity label, or by retention label. But, when you select SharePoint sites ***and*** Teams chat and channel messages locations, the policy will only support detecting sensitive items by SIT. Rules are the business logic of DLP policies. They consist of: #### Hosted service workloads For the hosted service workloads, like Exchange Online, SharePoint Online and OneDrive for Business, each rule is assigned a priority in the order in which it's created. That means, the rule created first has first priority, the rule created second has second priority, and so on.- +  When content is evaluated against rules, the rules are processed in priority order. If content matches multiple rules, the first rule evaluated that has the *most* restrictive action is enforced. For example, if content matches all of the following rules, *Rule 3* is enforced because it's the highest priority, most restrictive rule:- + - Rule 1: only notifies users - Rule 2: notifies users, restricts access, and allows user overrides - *Rule 3: notifies users, restricts access, and doesn't allow user overrides* When content is evaluated against rules, the rules are processed in priority ord Rules 1, 2, and 4 would be evaluated, but not applied. In this example, matches for all of the rules are recorded in the audit logs and shown in the DLP reports, even though only the most restrictive rule is applied. You can use a rule to meet a specific protection requirement, and then use a DLP policy to group together common protection requirements, such as all of the rules needed to comply with a specific regulation.- + For example, you might have a DLP policy that helps you detect the presence of information subject to the Health Insurance Portability and Accountability Act (HIPAA). This DLP policy could help protect HIPAA data (the what) across all SharePoint Online sites and all OneDrive for Business sites (the where) by finding any document containing this sensitive information that's shared with people outside your organization (the conditions) and then blocking access to the document and sending a notification (the actions). These requirements are stored as individual rules and grouped together as a DLP policy to simplify management and reporting.- +  #### For endpoints -Priority for rules on endpoints is also assigned according to the order in which it's created. That means, the rule created first has first priority, the rule created second has second priority, and so on. +Priority for rules on endpoints is also assigned according to the order in which it's created. That means, the rule created first has first priority, the rule created second has second priority, and so on. When a file on an endpoint matches multiple DLP policies, the first rule that's enabled with most restrictive enforcement on the [endpoint activities](endpoint-dlp-learn-about.md#endpoint-activities-you-can-monitor-and-take-action-on) is the one that gets enforced on the content. For example, if content matches all of the following rules, then rule 2 takes precedence over the other rules since it's the most restrictive. All the other rules are evaluated but their actions aren't enforced. Audit logs Conditions are inclusive and are where you define what you want the rule to look for and context in which those items are being used. They tell the rule — when you find an item that looks like *this* and is being used like *that* — it's a match and the rest of the actions in the policy should be taken on it. You can use conditions to assign different actions to different risk levels. For example, sensitive content shared internally might be lower risk and require fewer actions than sensitive content shared with people outside the organization. > [!NOTE]-> Users who have non-guest accounts in a host organization's Active Directory or Azure Active Directory tenant are considered as people inside the organization. +> Users who have non-guest accounts in a host organization's Active Directory or Azure Active Directory tenant are considered as people inside the organization. #### Content contains Conditions are inclusive and are where you define what you want the rule to look - [sensitive information types](sensitive-information-type-learn-about.md#learn-about-sensitive-information-types) - [sensitivity labels](sensitivity-labels.md) - [retention labels](retention.md#using-a-retention-label-as-a-condition-in-a-dlp-policy)-- [Trainable Classifiers](classifier-learn-about.md) (in preview) +- [Trainable Classifiers](classifier-learn-about.md) (in preview) depending on the [location(s)](#location-support-for-how-content-can-be-defined) you choose to apply the policy to. The available context options change depending on which location you choose. If - Message importance is ##### Conditions SharePoint supports- + - Content contains - Content is shared from Microsoft 365 - Document created by The available context options change depending on which location you choose. If - Content contains - Content is shared from Microsoft 365-- Sender is -- Sender domain is -- Recipient domain is -- Recipient is +- Sender is +- Sender domain is +- Recipient domain is +- Recipient is ##### Conditions Devices supports - Content contains-- (preview) Document or attachment is password protected (.pdf, Office files and Symantec PGP encrypted files are fully supported).This predicate doesnΓÇÖt detect digital rights managed (DRM) encrypted or permission protected files. +- (preview) Document or attachment is password protected (.pdf, Office files and Symantec PGP encrypted files are fully supported).This predicate doesnΓÇÖt detect digital rights managed (DRM) encrypted or permission protected files. - (preview) Content is not labeled (.pdf, Office files are fully supported). This predicate detects content that doesn't have a sensitivity label applied. To help ensure only supported file types are detected, you should use this condition with the **File extension is** or **File type is** conditions.-- (preview) The user accessed a sensitive website from Edge. See, [Scenario 6 Monitor or restrict user activities on sensitive service domains (preview)](endpoint-dlp-using.md#scenario-6-monitor-or-restrict-user-activities-on-sensitive-service-domains) for more information. +- (preview) The user accessed a sensitive website from Edge. See, [Scenario 6 Monitor or restrict user activities on sensitive service domains (preview)](endpoint-dlp-using.md#scenario-6-monitor-or-restrict-user-activities-on-sensitive-service-domains) for more information. - File extension is - File type is - See, [Endpoint activities you can monitor and take action on](endpoint-dlp-learn-about.md#endpoint-activities-you-can-monitor-and-take-action-on) The available context options change depending on which location you choose. If Sometimes you need a rule to only identify one thing, like all content that contains a U.S. Social Security Number, which is defined by a single SIT. But in many scenarios, where the types of items you are trying to identify are more complex and therefore harder to define, more flexibility in defining conditions is required. For example, to identify content subject to the U.S. Health Insurance Act (HIPAA), you need to look for:- + - Content that contains specific types of sensitive information, such as a U.S. Social Security Number or Drug Enforcement Agency (DEA) Number.- + AND- + - Content that's more difficult to identify, such as communications about a patient's care or descriptions of medical services provided. Identifying this content requires matching keywords from large keyword lists, such as the International Classification of Diseases (ICD-9-CM or ICD-10-CM).- + You can identify this type of data by grouping conditions and using logical operators (AND, OR) between the groups.- + For the **U.S. Health Insurance Act (HIPPA)**, conditions are grouped like this:  The first group contains the SITs that identify and individual and the second gr ### Exceptions -In rules, exceptions define conditions that are used to exclude an item from the policy. Logically, exclusive conditions that are evaluated after the inclusive conditions and context. They tell the rule — when you find an item that looks like *this* and is being used like *that* it's a match and the rest of the actions in the policy should be taken on it ***except if***... — +In rules, exceptions define conditions that are used to exclude an item from the policy. Logically, exclusive conditions that are evaluated after the inclusive conditions and context. They tell the rule — when you find an item that looks like *this* and is being used like *that* it's a match and the rest of the actions in the policy should be taken on it ***except if***... — For example, keeping with the HIPPA policy, we could modify the rule to exclude any item that contains a Belgium drivers license number, like this: Just as all locations support the inclusive condition: the exception would be: -- **Except if** content contains +- **Except if** content contains -### Actions +### Actions Any item that makes it through the inclusive ***conditions*** and exclusive ***exceptions*** filters will have any ***actions*** that are defined in the rule applied to it. You'll have to configure the required options to support the action. For example, if you select Exchange with the **Restrict access or encrypt the content in Microsoft 365 locations** action you need to choose from these options: - Block users from accessing shared SharePoint, OneDrive, and Teams content- - Block everyone. Only the content owner, last modifier, and site admin will continue to have access - - Block only people from outside your organization. Users inside your organization will continue to have access. + - Block everyone. Only the content owner, last modifier, and site admin will continue to have access + - Block only people from outside your organization. Users inside your organization will continue to have access. - Encrypt email messages (applies only to content in Exchange) The actions that are available in a rule are dependent on the locations that have been selected. If you select only one location for the policy to be applied to, the available actions are listed below. When you configure the **Allow/Block cloud service domains** and the **Unallowed With the **File activities for all apps** option, you select either **Don't restrict file activities** or **Apply restrictions to specific activities**. When you select to apply restrictions to specific activities, the actions that you select here are applied when a user has accessed a DLP protected item. You can tell DLP to `Audit only`, `Block with override`, `Block` (the actions) on these user activities: - **Copy to clipboard**-- **Copy to a USB removable drive** +- **Copy to a USB removable drive** - **Copy to a network share** - **Print** - **Copy or move using an unallowed Bluetooth app** - **Remote desktop services** --##### Restricted app activities +##### Restricted app activities Previously called Unallowed apps, you define a list of apps in Endpoint DLP settings that you want to place restrictions on. When a user attempts to access a DLP protected file using an app that is on the list, you can either `Audit only`, `Block with override`, or `Block` the activity. DLP actions defined in **Restricted app activities** are overridden if the app is a member of restricted app group. Then the actions defined in the restricted app group are applied. You define your restricted app groups in Endpoint DLP settings and add restricte When you select either of the *Apply restrictions* options, and a user attempts to access a DLP protected file using an app that is in the restricted app group, you can either `Audit only`, `Block with override`, or `Block` by activity. DLP actions that you define here override actions defined in **Restricted app activities** and **File activities for all apps** for the app. -See, [Restricted apps and app groups](dlp-configure-endpoint-settings.md#restricted-apps-and-app-groups) for more information. +See, [Restricted apps and app groups](dlp-configure-endpoint-settings.md#restricted-apps-and-app-groups) for more information. #### Microsoft Defender for Cloud Apps actions If you select two or more non-Exchange locations for the policy to be applied to AND -- all actions for non-Exchange locations +- all actions for non-Exchange locations actions will be available. If you select Devices and Microsoft Defender for Cloud Apps, these actions will - Audit or restrict activities on Windows devices - Restrict Third Party Apps -Whether an action takes effect or not depends on how you configure the mode of the policy. You can choose to run the policy in test mode with or without showing policy tip by selecting the **Test it out first** option. You choose to run the policy as soon as an hour after it is created by selecting the **Turn it on right away** option, or you can choose to just save it and come back to it later by selecting the **Keep it off** option. -+Whether an action takes effect or not depends on how you configure the mode of the policy. You can choose to run the policy in test mode with or without showing policy tip by selecting the **Test it out first** option. You choose to run the policy as soon as an hour after it is created by selecting the **Turn it on right away** option, or you can choose to just save it and come back to it later by selecting the **Keep it off** option. <!-- This section needs to explain that the actions available depend on the locations selected AND that the observed behavior of a policy is produced through an interaction of the configured actions AND the configured status (off, test, apply) of a policy. It will detail the purpose of each of the available actions and the location/desired outcome interaction and provide examples eg. how to use the Restrict Third Party apps in the context of a policy that is applied to endpoints so that users can't use a upload content to a third party site or the interaction of on-premises scanner with restrict access or remove on-premises files. Also what happens when I select multiple locations? provide abundant examples for most common scenarios--> - ### User notifications and policy tips -<!--This section introduces the business need for user notifications, what they are, their benefit, how to use them, how to customize them, and links out to +<!--This section introduces the business need for user notifications, what they are, their benefit, how to use them, how to customize them, and links out to -- https://learn.microsoft.com/microsoft-365/compliance/use-notifications-and-policy-tips?view=o365-worldwide-- https://learn.microsoft.com/microsoft-365/compliance/dlp-policy-tips-reference?view=o365-worldwide+- /microsoft-365/compliance/use-notifications-and-policy-tips +- /microsoft-365/compliance/dlp-policy-tips-reference for where they are used/expected behavior--> For example, content like an Excel workbook on a OneDrive for Business site that  > [!IMPORTANT]+> > - Notification emails are sent unprotected. > - Email notifications are only supported for the Microsoft 365 services. The user notifications and policy tips configuration options vary depending on t - Teams Chat and Channel - Defender for Cloud Apps ---- You can enable/disable user notifications for various Microsoft apps, see [Data Loss Prevention policy tips reference](dlp-policy-tips-reference.md#data-loss-prevention-policy-tips-reference) - You can enable/disable notifications with a policy tip.- - email notifications to the user who sent, shared, or last modified the content - OR - - notify specific people + - email notifications to the user who sent, shared, or last modified the content + OR + - notify specific people and customize the email text, subject, and the policy tip text. and customize the email text, subject, and the policy tip text. If you selected Devices only, you will get all the same options that are available for Exchange, SharePoint, OneDrive, Teams Chat and Channel and Defender for Cloud Apps plus the option to customize the notification title and content that appears on the Windows 10 device. - + You can customize the title and body of text with using these parameters. The body text supports these: You can customize the title and body of text with using these parameters. The bo **%%AppliedActions%%** substitutes these values into the message body: - |action common name |value substituted in for %%AppliedActions%% parameter | ||| |copy to removeable storage |*writing to removable storage* | You can customize the title and body of text with using these parameters. The bo Using this customized text -*%%AppliedActions%% File name %%FileName%% via %%ProcessName%% is not allowed by your organization. Click 'Allow' if you want to bypass the policy %%PolicyName%%* +*%%AppliedActions%% File name %%FileName%% via %%ProcessName%% is not allowed by your organization. Click 'Allow' if you want to bypass the policy %%PolicyName%%* produces this text in the customized notification: *pasting from the clipboard File Name: Contoso doc 1 via WINWORD.EXE is not allowed by your organization. Click 'Allow' button if you want to bypass the policy Contoso highly confidential*- > [!NOTE] > User notifications and policy tips are not available for the On-premises location--> [!NOTE] +> > Only the policy tip from the highest priority, most restrictive rule will be shown. For example, a policy tip from a rule that blocks access to content will be shown over a policy tip from a rule that simply sends a notification. This prevents people from seeing a cascade of policy tips. -To learn more about user notification and policy tip configuration and use, including how to customize the notification and tip text, see +To learn more about user notification and policy tip configuration and use, including how to customize the notification and tip text, see + - [Send email notifications and show policy tips for DLP policies](use-notifications-and-policy-tips.md#send-email-notifications-and-show-policy-tips-for-dlp-policies).- + <!--The email can notify the person who sent, shared, or last modified the content and, for site content, the primary site collection administrator and document owner. In addition, you can add or remove whomever you choose from the email notification.- + In addition to sending an email notification, a user notification displays a policy tip:- + - In Outlook and Outlook on the web.- + - For the document on a SharePoint Online or OneDrive for Business site.- + - In Excel, PowerPoint, and Word, when the document is stored on a site included in a DLP policy.- + The email notification and policy tip explain why content conflicts with a DLP policy. If you choose, the email notification and policy tip can allow users to override a rule by reporting a false positive or providing a business justification. This can help you educate users about your DLP policies and enforce them without preventing people from doing their work. Information about overrides and false positives is also logged for reporting (see below about the DLP reports) and included in the incident reports (next section), so that the compliance officer can regularly review this information.- + Here's what a policy tip looks like in a OneDrive for Business account.- +  To learn more about user notifications and policy tips in DLP policies, see [Use notifications and policy tips](use-notifications-and-policy-tips.md). This table shows the DLP blocking and notification behavior for policies that ar |- **Content is shared from Microsoft 365** </br>- **with people outside my organization** | - **Restrict access or encrypt the content in Microsoft 365 locations** is selected </br>- **Block users from receiving email or accessing shared SharePoint, OneDrive, and Teams files** is selected </br>- **Block everyone** is selected | - **User notifications** set to **On** </br>- **Notify users in Office 365 service with a policy tip** is selected </br>- **Notify the user who sent, shared, or last modified the content** is selected | - **Send an alert to admins when a rule match occurs** set to **On** </br>- **Send alert every time an activity matches the rule** is selected </br>- **Use email incident reports to notify you when a policy match occurs** set to **On** |Notifications are sent when a file is shared with an external user and an external user access that file. | |- **Content is shared from Microsoft 365** </br>- **with people outside my organization** |- **Restrict access or encrypt the content in Microsoft 365 locations** is selected </br>- **Block only people who were given access to the content through the "Anyone with the link" option** is selected. | - **User notifications** set to **On** </br>- **Notify users in Office 365 service with a policy tip** is selected. </br>- **Notify the user who sent, shared, or last modified the content** is selected |- **Send an alert to admins when a rule match occurs** set to **On** </br>- **Send alert every time an activity matches the rule** is selected </br>- **Use email incident reports to notify you when a policy match occurs** set to **On** |Notifications are sent as soon as a file is uploaded | - ### User overrides -The intent of **User overrides** is to give users a way to bypass, with justification, DLP policy blocking actions on sensitive items in Exchange, SharePoint, OneDrive, or Teams so that they can continue their work. User overrides are enabled only when **Notify users in Office 365 services with a policy tip** is enabled, so user overrides go hand-in-hand with Notifications and Policy tips. +The intent of **User overrides** is to give users a way to bypass, with justification, DLP policy blocking actions on sensitive items in Exchange, SharePoint, OneDrive, or Teams so that they can continue their work. User overrides are enabled only when **Notify users in Office 365 services with a policy tip** is enabled, so user overrides go hand-in-hand with Notifications and Policy tips.  > [!NOTE] > User overrides are not available for the On-premises repositories location. -Typically, user overrides are useful when your organization is first rolling out a policy. The feedback that you get from any override justifications and identifying false positives helps in tuning the policy. +Typically, user overrides are useful when your organization is first rolling out a policy. The feedback that you get from any override justifications and identifying false positives helps in tuning the policy. -<!-- This section covers what they are and how to best use them in conjunction with Test/Turn it on right away and link out to where to find the business justification for the override (DLP reports? https://learn.microsoft.com/microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide) https://learn.microsoft.com/microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide#view-the-justification-submitted-by-a-user-for-an-override--> +<!-- This section covers what they are and how to best use them in conjunction with Test/Turn it on right away and link out to where to find the business justification for the override (DLP reports? /microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide) /microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide#view-the-justification-submitted-by-a-user-for-an-override--> - If the policy tips in the most restrictive rule allow people to override the rule, then overriding this rule also overrides any other rules that the content matched.- + <!---->- + To learn more about user overrides, see: - [View the justification submitted by a user for an override](view-the-dlp-reports.md#view-the-justification-submitted-by-a-user-for-an-override) To learn more about user overrides, see: <!--DLP interacts with other M365 information protection services, like IR. Link this to a process outline for triaging/managing/resolving DLP incidents --https://learn.microsoft.com/microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide -https://learn.microsoft.com/microsoft-365/compliance/dlp-configure-view-alerts-policies?view=o365-worldwide--> +/microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide +/microsoft-365/compliance/dlp-configure-view-alerts-policies?view=o365-worldwide--> When a rule is matched, you can send an incident report to your compliance officer (or any people you choose) with details of the event. The report includes information about the item that was matched, the actual content that matched the rule, and the name of the person who last modified the content. For email messages, the report also includes as an attachment the original message that matches a DLP policy. |
| compliance | Retention Policies Teams | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention-policies-teams.md | For other workloads, see: > [!NOTE] > Retention policies support [shared channels](/MicrosoftTeams/shared-channels). Any shared channels inherit retention settings from the parent channel. > -> Retention policies also support messages posted with the [chat with yourself](https://support.microsoft.com/office/start-a-chat-in-teams-0c71b32b-c050-4930-a887-5afbe742b3d8#bkmk_chatwithself) feature. +> Retention policies also support messages posted with the [chat with yourself](https://support.microsoft.com/office/start-a-chat-in-teams-0c71b32b-c050-4930-a887-5afbe742b3d8?storagetype=live#bkmk_chatwithself) feature. Teams chats messages, channel messages, and private channel messages can be deleted by using retention policies for Teams, and in addition to the text in the messages, the following items can be retained for compliance reasons: Video clips, embedded images, tables, hypertext links, links to other Teams messages and files, and [card content](/microsoftteams/platform/task-modules-and-cards/what-are-cards). Chat messages and private channel messages include all the names of the people in the conversation, and channel messages include the team name and the message title (if supplied). |
| compliance | Sensitive Information Type Entity Definitions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitive-information-type-entity-definitions.md | This article is a list of all sensitive information type (SIT) entity definition - [Chile identity card number](sit-defn-chile-identity-card-number.md) - [China resident identity card (PRC) number](sit-defn-china-resident-identity-card-number.md) - [Client secret / API key (preview)](sit-defn-client-secret-api-key.md)-- [Credentials in URL](sit-defn-credentials-in-url.md) - [Credit card number](sit-defn-credit-card-number.md) - [Croatia driver's license number](sit-defn-croatia-drivers-license-number.md) - [Croatia identity card number](sit-defn-croatia-identity-card-number.md) |
| compliance | Sit Defn Credentials In Url | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sit-defn-credentials-in-url.md | - Title: "Crednetial in URL"-- CSH--- Previously updated :--- 'ms.o365.cc.UnifiedDLPRuleContainsSensitiveInformation'---- tier3-- purview-compliance -hideEdit: true -feedback_system: None -recommendations: false -description: "Credentials in URL sensitive information type entity definition." ---# Credentials in URL ---## Format --Paired username and password used in URL --or --Plain-text password used in script --## Pattern --Various URL username and password formats, for example: --`https://username:********@contoso.com/...` -`ftp://username:********@contoso.com:20/...` --for example: -`https://myuser:mypassword@localhost` --or --Various password formats in script, for example: --`password = ********...` --for example: --`password=ZYXWVU_1` --## Checksum --No --## Description --This SIT is designed to match the security information that's used as a token in URL to do client validation or identification [user login process](/azure/key-vault/quick-create-portal). It uses several primary resources: --- Patterns of User Login Credentials in URL.-- Patterns of Password context in script.-- Patterns of CredentialName, CredentialFeatures, AccountIdentityName, AccountIdentityValue, ResourceType, ResourceName.-- Patterns of mockup values, redactions, and placeholders.--The patterns are designed to match actual credentials with reasonable confidence. The patterns don't match credentials formatted as examples. Mockup values, redacted values, and placeholders, like credential type or usage descriptions, in the position where an actual secret value should present won't be matched. --## Keywords --### Keyword_LoginCredentialsInUrl --- ://--### Keyword_PasswordContextInScript --- secret-- password-- pw |
| frontline | Flw Pilot | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/flw-pilot.md | We recommend that you prepare for deployment by completing this 30-minute learni Assemble a group of individuals from your business, IT, and frontline communities to act as the stakeholder and decision-making group for your Teams pilot for frontline workers. Be sure to include individuals from all three communities to give yourself the best chance for success: -Next, identify your phase 1 pilot community and make sure it includes actual frontline workers in the smallest logical grouping for your organization. For example, one restaurant, one division of a department store, one store, one clinical ward, one precinct, one plant, one distribution center, etc.. The key is to optimize around the average frontline worker being part of one team only. Managers or specialists may be in more than one. +Next, identify your phase 1 pilot community and make sure it includes actual frontline workers in the smallest logical grouping for your organization. For example, one restaurant, one division of a department store, one store, one clinical ward, one precinct, one plant, one distribution center, etc. The key is to optimize around the average frontline worker being part of one team only. Managers or specialists may be in more than one.  **Best practice** |
| security | Microsoft 365 Zero Trust | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/Microsoft-365-zero-trust.md | In the illustration: For more information about Zero Trust, see Microsoft's [_**Zero Trust Guidance Center**_](/security/zero-trust). <!-For more information about this architecture, including deployment objectives for your entire digital estate, see [Zero Trust Rapid Modernization Plan (RaMP)](https://review.learn.microsoft.com/security/zero-trust/zero-trust-ramp-overview?branch=zt-content-prototype). +For more information about this architecture, including deployment objectives for your entire digital estate, see [Zero Trust Rapid Modernization Plan (RaMP)](/security/zero-trust/zero-trust-ramp-overview). --> -- ## Deploying Zero Trust for Microsoft 365 Microsoft 365 is built intentionally with many security and information protection capabilities to help you build Zero Trust into your environment. Many of the capabilities can be extended to protect access to other SaaS apps your organization uses and the data within these apps. |
| security | TOC | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/TOC.md | ##### [Power BI - How to use API - Samples](api-power-bi.md) ##### [Threat protection reports](threat-protection-reports.md) -### [Advanced hunting]() -#### [Advanced hunting overview](advanced-hunting-overview.md) -#### [Understand the schema](advanced-hunting-schema-reference.md) -#### [DeviceAlertEvents](advanced-hunting-devicealertevents-table.md) +### [Advanced hunting](/microsoft-365/security/defender/advanced-hunting-overview) ### [Threat analytics overview](threat-analytics.md) #### [Read the analyst report](threat-analytics-analyst-reports.md) ### [Managed security service provider (MSSP) integration]() #### [Configure managed security service provider integration](configure-mssp-support.md)-#### [Supported managed security service providers](mssp-list.md) #### [Grant MSSP access to the portal](grant-mssp-access.md) #### [Access the MSSP customer portal](access-mssp-portal.md) #### [Configure alert notifications](configure-mssp-notifications.md) |
| security | Advanced Hunting Devicealertevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/advanced-hunting-devicealertevents-table.md | - Title: DeviceAlertEvents table in the advanced hunting schema -description: Learn about alert generation events in the DeviceAlertEvents table of the advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, microsoft defender for endpoint, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, DeviceAlertEvents, alert, severity, category --ms.sitesec: library -ms.pagetype: security ------ m365-security-- tier3- Previously updated : 01/22/2020----# DeviceAlertEvents ---**Applies to:** -- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)--> [!IMPORTANT] -> The `AlertInfo` and `AlertEvidence` tables replace the `DeviceAlertEvents` table in the Microsoft Defender for Endpoint schema. To learn more, see [Map DeviceAlertEvents Table](/microsoft-365/security/defender/advanced-hunting-migrate-from-mde). --Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) --The `DeviceAlertEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about alerts in Microsoft 365 Defender. Use this reference to construct queries that return information from the table. --For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). --|Column name|Data type|Description| -|||| -|`AlertId`|string|Unique identifier for the alert| -|`Timestamp`|datetime|Date and time when the event was recorded| -|`DeviceId`|string|Unique identifier for the device in the service| -|`DeviceName`|string|Fully qualified domain name (FQDN) of the device| -|`Severity`|string|Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert| -|`Category`|string|Type of threat indicator or breach activity identified by the alert| -|`Title`|string|Title of the alert| -|`FileName`|string|Name of the file that the recorded action was applied to| -|`SHA1`|string|SHA-1 of the file that the recorded action was applied to| -|`RemoteUrl`|string|URL or fully qualified domain name (FQDN) that was being connected to| -|`RemoteIP`|string|IP address that was being connected to| -|`AttackTechniques`|string|MITRE ATT&CK techniques associated with the activity that triggered the alert| -|`ReportId`|long|Event identifier based on a repeating counter. To identify unique events, this column must be used with the `DeviceName` and `Timestamp` columns| -|`Table`|string|Table that contains the details of the event| --## Related topics --- [Advanced hunting overview](advanced-hunting-overview.md)-- [Learn the query language](advanced-hunting-query-language.md)-- [Understand the schema](advanced-hunting-schema-reference.md) |
| security | Advanced Hunting Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/advanced-hunting-overview.md | - Title: Overview of advanced hunting in Microsoft Defender for Endpoint -description: Use threat hunting capabilities in Microsoft Defender for Endpoint to build queries that find threats and weaknesses in your network -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, microsoft defender for endpoint, wdatp, search, query, telemetry, custom detections, schema, kusto, time zone, UTC -search.product: eADQiWindows 10XVcnh --ms.sitesec: library -ms.pagetype: security ------ m365-security-- tier1-----# Proactively hunt for threats with advanced hunting ---**Applies to:** -- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037)--> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-advancedhunting-abovefoldlink) --Advanced hunting is a query-based threat-hunting tool that lets you explore up to 30 days of raw data. You can proactively inspect events in your network to locate threat indicators and entities. The flexible access to data enables unconstrained hunting for both known and potential threats. --Watch this video for a quick overview of advanced hunting and a short tutorial that will get you started fast. --> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4bGqo] --You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and then respond to suspected breach activity, misconfigured machines, and other findings. --> [!TIP] -> Use [advanced hunting in Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-overview) to hunt for threats using data from Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity. [Turn on Microsoft 365 Defender](/microsoft-365/security/defender/m365d-enable). --Learn more about how to move your advanced hunting workflows from Microsoft Defender for Endpoint to Microsoft 365 Defender in [Migrate advanced hunting queries from Microsoft Defender for Endpoint](/microsoft-365/security/defender/advanced-hunting-migrate-from-mde). --## Get started with advanced hunting --Go through the following steps to ramp up your advanced hunting knowledge. --We recommend going through several steps to quickly get up and running with advanced hunting. --<br> --**** --|Learning goal|Description|Resource| -|||| -|**Learn the language**|Advanced hunting is based on [Kusto query language](/azure/kusto/query/), supporting the same syntax and operators. Start learning the query language by running your first query.|[Query language overview](advanced-hunting-query-language.md)| -|**Learn how to use the query results**|Learn about charts and various ways you can view or export your results. Explore how you can quickly tweak queries and drill down to get richer information.|[Work with query results](advanced-hunting-query-results.md)| -|**Understand the schema**|Get a good, high-level understanding of the tables in the schema and their columns. Learn where to look for data when constructing your queries.|[Schema reference](advanced-hunting-schema-reference.md)| -|**Use predefined queries**|Explore collections of predefined queries covering different threat hunting scenarios.|[Shared queries](advanced-hunting-shared-queries.md)| -|**Optimize queries and handle errors**|Understand how to create efficient and error-free queries.|[Query best practices](advanced-hunting-best-practices.md) <p> [Handle errors](advanced-hunting-errors.md)| -|**Get the most complete coverage**|Use audit settings to provide better data coverage for your organization.|[Extend advanced hunting coverage](advanced-hunting-extend-data.md)| -|**Run a quick investigation**|Quickly run an advanced hunting query to investigate suspicious activity.|[Quickly hunt for entity or event information with *go hunt*](advanced-hunting-go-hunt.md)| -|**Contain threats and address compromises**|Respond to attacks by quarantining files, restricting app execution, and other actions|[Take action on advanced hunting query results](advanced-hunting-take-action.md)| -|**Create custom detection rules**|Understand how you can use advanced hunting queries to trigger alerts and take response actions automatically.|[Custom detections overview](overview-custom-detections.md) <p> [Custom detection rules](custom-detection-rules.md)| -| --## Data freshness and update frequency --Advanced hunting data can be categorized into two distinct types, each consolidated differently. --- **Event or activity data**: Populates tables about alerts, security events, system events, and routine assessments. Advanced hunting receives this data almost immediately after the sensors that collect them successfully transmit them to Defender for Endpoint.-- **Entity data**: Populates tables with consolidated information about users and devices. This data comes from both relatively static data sources and dynamic sources, such as Active Directory entries and event logs. To provide fresh data, tables are updated with any new information every 15 minutes, adding rows that might not be fully populated. Every 24 hours, data is consolidated to insert a record that contains the latest, most comprehensive data set about each entity.--## Time zone --Time information in advanced hunting is currently in the UTC time zone. --## Related topics --- [Learn the query language](advanced-hunting-query-language.md)-- [Work with query results](advanced-hunting-query-results.md)-- [Use shared queries](advanced-hunting-shared-queries.md)-- [Understand the schema](advanced-hunting-schema-reference.md)-- [Apply query best practices](advanced-hunting-best-practices.md)-- [Custom detections overview](overview-custom-detections.md)-- [Storage account overview](/azure/storage/common/storage-account-overview)-- [Azure Event Hubs ΓÇö A big data streaming platform and event ingestion service](/azure/event-hubs/event-hubs-about) |
| security | Advanced Hunting Schema Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/advanced-hunting-schema-reference.md | - Title: Advanced hunting schema reference -description: Learn about the tables in the advanced hunting schema to understand the data you can run threat hunting queries on. -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, microsoft defender for endpoint, wdatp search, query, telemetry, schema reference, kusto, table, data --ms.sitesec: library -ms.pagetype: security ------ m365-security-- tier3- Previously updated : 01/14/2020----# Understand the advanced hunting schema in Microsoft Defender for Endpoint ---**Applies to:** -- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037)--> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) ---The [advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about devices and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the advanced hunting schema. --## Get schema information in the Defender for Cloud --While constructing queries, use the built-in schema reference to quickly get the following information about each table in the schema: --- **Tables description**: Type of data contained in the table and the source of that data.-- **Columns**: All the columns in the table.-- **Action types**: Possible values in the `ActionType` column representing the event types supported by the table. These values are provided only for tables that contain event information.-- **Sample query**: Example queries that feature how the table can be utilized.--### Access the schema reference --To quickly access the schema reference, select the **View reference** action next to the table name in the schema representation. You can also select **Schema reference** to search for a table. ---## Learn the schema tables --The following reference lists all the tables in the advanced hunting schema. Each table name links to a page describing the column names for that table. --Table and column names are also listed within the Microsoft 365 Defender portal, in the schema representation on the advanced hunting screen. --<br> --**** --|Table name|Description| -||| -|**[DeviceAlertEvents](advanced-hunting-devicealertevents-table.md)**|Alerts on Microsoft 365 Defender | -|**[DeviceInfo](advanced-hunting-deviceinfo-table.md)**|Device information, including OS information| -|**[DeviceNetworkInfo](advanced-hunting-devicenetworkinfo-table.md)**|Network properties of devices, including adapters, IP and MAC addresses, as well as connected networks and domains| -|**[DeviceProcessEvents](advanced-hunting-deviceprocessevents-table.md)**|Process creation and related events| -|**[DeviceNetworkEvents](advanced-hunting-devicenetworkevents-table.md)**|Network connection and related events| -|**[DeviceFileEvents](advanced-hunting-devicefileevents-table.md)**|File creation, modification, and other file system events| -|**[DeviceRegistryEvents](advanced-hunting-deviceregistryevents-table.md)**|Creation and modification of registry entries| -|**[DeviceLogonEvents](advanced-hunting-devicelogonevents-table.md)**|Sign-ins and other authentication events| -|**[DeviceImageLoadEvents](advanced-hunting-deviceimageloadevents-table.md)**|DLL loading events| -|**[DeviceEvents](advanced-hunting-deviceevents-table.md)**|Multiple event types, including events triggered by security controls such as Microsoft Defender Antivirus and exploit protection| -|**[DeviceFileCertificateInfo](advanced-hunting-devicefilecertificateinfo-table.md)**|Certificate information of signed files obtained from certificate verification events on endpoints| -|**[DeviceTvmSoftwareInventory](advanced-hunting-devicetvmsoftwareinventory-table.md)**|Inventory of software installed on devices, including their version information and end-of-support status| -|**[DeviceTvmSoftwareVulnerabilities](advanced-hunting-devicetvmsoftwarevulnerabilities-table.md)**|Software vulnerabilities found on devices and the list of available security updates that address each vulnerability| -|**[DeviceTvmSoftwareVulnerabilitiesKB](advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md)**|Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available| -|**[DeviceTvmSecureConfigurationAssessment](advanced-hunting-devicetvmsecureconfigurationassessment-table.md)**|Microsoft Defender Vulnerability Management assessment events, indicating the status of various security configurations on devices| -|**[DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md)**|Knowledge base of various security configurations used by Defender Vulnerability Management to assess devices; includes mappings to various standards and benchmarks| -| --> [!TIP] -> Use [advanced hunting at Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-overview) to hunt for threats using data from Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity. [Turn on Microsoft 365 Defender](/microsoft-365/security/defender/m365d-enable). --Learn more about how to move your advanced hunting workflows from Microsoft Defender for Endpoint to Microsoft 365 Defender in [Migrate advanced hunting queries from Microsoft Defender for Endpoint](/microsoft-365/security/defender/advanced-hunting-migrate-from-mde). --## Related topics --- [Advanced hunting overview](advanced-hunting-overview.md)-- [Learn the query language](advanced-hunting-query-language.md)-- [Work with query results](advanced-hunting-query-results.md)-- [Apply query best practices](advanced-hunting-best-practices.md)-- [Custom detections overview](overview-custom-detections.md)-- [Advanced hunting data schema changes](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/advanced-hunting-data-schema-changes/ba-p/1043914) |
| security | Api Power Bi | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/api-power-bi.md | search.appverid: met150 [!include[Improve request performance](../../includes/improve-request-performance.md)] - > [!NOTE] >**Before you begin**:-You first need to [create an app](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/apis-intro?view=o365-worldwide). -+You first need to [create an app](/microsoft-365/security/defender-endpoint/apis-intro). In this section you will learn to create a Power BI report on top of Defender for Endpoint APIs. The first example demonstrates how to connect Power BI to Advanced Hunting API, 4. Copy the below and paste it in the editor: -``` - let - AdvancedHuntingQuery = "DeviceEvents | where ActionType contains 'Anti' | limit 20", -- HuntingUrl = "https://api.securitycenter.microsoft.com/api/advancedqueries", -- Response = Json.Document(Web.Contents(HuntingUrl, [Query=[key=AdvancedHuntingQuery]])), -- TypeMap = #table( - { "Type", "PowerBiType" }, - { - { "Double", Double.Type }, - { "Int64", Int64.Type }, - { "Int32", Int32.Type }, - { "Int16", Int16.Type }, - { "UInt64", Number.Type }, - { "UInt32", Number.Type }, - { "UInt16", Number.Type }, - { "Byte", Byte.Type }, - { "Single", Single.Type }, - { "Decimal", Decimal.Type }, - { "TimeSpan", Duration.Type }, - { "DateTime", DateTimeZone.Type }, - { "String", Text.Type }, - { "Boolean", Logical.Type }, - { "SByte", Logical.Type }, - { "Guid", Text.Type } - }), -- Schema = Table.FromRecords(Response[Schema]), - TypedSchema = Table.Join(Table.SelectColumns(Schema, {"Name", "Type"}), {"Type"}, TypeMap , {"Type"}), - Results = Response[Results], - Rows = Table.FromRecords(Results, Schema[Name]), - Table = Table.TransformColumnTypes(Rows, Table.ToList(TypedSchema, (c) => {c{0}, c{2}})) -- in Table -``` + ``` + let + AdvancedHuntingQuery = "DeviceEvents | where ActionType contains 'Anti' | limit 20", + + HuntingUrl = "https://api.securitycenter.microsoft.com/api/advancedqueries", + + Response = Json.Document(Web.Contents(HuntingUrl, [Query=[key=AdvancedHuntingQuery]])), + + TypeMap = #table( + { "Type", "PowerBiType" }, + { + { "Double", Double.Type }, + { "Int64", Int64.Type }, + { "Int32", Int32.Type }, + { "Int16", Int16.Type }, + { "UInt64", Number.Type }, + { "UInt32", Number.Type }, + { "UInt16", Number.Type }, + { "Byte", Byte.Type }, + { "Single", Single.Type }, + { "Decimal", Decimal.Type }, + { "TimeSpan", Duration.Type }, + { "DateTime", DateTimeZone.Type }, + { "String", Text.Type }, + { "Boolean", Logical.Type }, + { "SByte", Logical.Type }, + { "Guid", Text.Type } + }), + + Schema = Table.FromRecords(Response[Schema]), + TypedSchema = Table.Join(Table.SelectColumns(Schema, {"Name", "Type"}), {"Type"}, TypeMap , {"Type"}), + Results = Response[Results], + Rows = Table.FromRecords(Results, Schema[Name]), + Table = Table.TransformColumnTypes(Rows, Table.ToList(TypedSchema, (c) => {c{0}, c{2}})) + + in Table + ``` 5. Select **Done**. 6. Select **Edit Credentials**.+ :::image type="content" source="images/power-bi-edit-credentials.png" alt-text="The Edit Credentials menu item" lightbox="images/power-bi-edit-credentials.png"::: 7. Select **Organizational account** \> **Sign in**.+ :::image type="content" source="images/power-bi-set-credentials-organizational.png" alt-text="The Sign in option in the Organizational account menu item" lightbox="images/power-bi-set-credentials-organizational.png"::: 8. Enter your credentials and wait to be signed in. -9. Select **Connect**. </br> +9. Select **Connect**. + :::image type="content" source="images/power-bi-set-credentials-organizational-cont.png" alt-text="The sign-in confirmation message in the Organizational account menu item" lightbox="images/power-bi-set-credentials-organizational-cont.png"::: Now the results of your query will appear as a table and you can start to build visualizations on top of it! You can duplicate this table, rename it, and edit the Advanced Hunting query ins ## Connect Power BI to OData APIs -The only difference from the previous example is the query inside the editor. Follow steps 1-3 above. +The only difference from the previous example is the query inside the editor. Follow steps 1-3 above. At step 4, instead of the code in that example, copy the code below and paste it in the editor to pull all **Machine Actions** from your organization: View the Microsoft Defender for Endpoint Power BI report samples. For more infor ## Related topics -- [Defender for Endpoint APIs](apis-intro.md) -- [Advanced Hunting API](run-advanced-query-api.md) +- [Defender for Endpoint APIs](apis-intro.md) +- [Advanced Hunting API](run-advanced-query-api.md) - [Using OData Queries](exposed-apis-odata-samples.md) |
| security | Attack Surface Reduction Rules Deployment Plan | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-plan.md | Before you test or enable Microsoft Defender for Endpoint (MDE) attack surface r > :::image type="content" source="images/asr-rules-planning-steps.png" alt-text="The ASR rules planning steps. Preparation before you test Microsoft Defender for Endpoint (MDE) ASR rules, or enable MDE ASR rules. " lightbox="images/asr-rules-planning-steps.png"::: +> [!IMPORTANT] +> +> While you're going through the process of planning, auditing, and enable ASR rules, it's recommended that you enable the following three _standard protection rules_. See [Attack surface reduction rules by type](attack-surface-reduction-rules-reference.md#attack-surface-reduction-rules-by-type) for important details about the two types of ASR rules. +> +> - [Block credential stealing from the Windows local security authority subsystem (lsass.exe)](attack-surface-reduction-rules-reference.md#block-credential-stealing-from-the-windows-local-security-authority-subsystem) +> - [Block abuse of exploited vulnerable signed drivers](attack-surface-reduction-rules-reference.md#block-abuse-of-exploited-vulnerable-signed-drivers) +> - [Block persistence through Windows Management Instrumentation (WMI) event subscription](attack-surface-reduction-rules-reference.md#block-persistence-through-wmi-event-subscription) +> +> You can typically enable the standard protection rules with minimal noticeable impact to the end user. For an easy method to enable the standard protection rules, see: [Simplified standard protection option](attack-surface-reduction-rules-report.md#simplified-standard-protection-option). + ## Start your ASR rules deployment with the right business unit How you select the business unit to roll out your ASR rules deployment will depend on factors such as: |
| security | Attack Surface Reduction Rules Deployment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment.md | As with any new, wide-scale implementation which could potentially impact your l > :::image type="content" source="images/asr-rules-deployment-phases.png" alt-text="Plan Microsoft Defender for Endpoint (MDE) attack surface reduction (ASR) rules, test MDE ASR rules, Enable MDE ASR rules, maintain ASR rules." lightbox="images/asr-rules-deployment-phases.png"::: ->[!Note] ->For Customers who are using a non-Microsoft HIPS and are transitioning to Microsoft Defender for Endpoint attack surface reduction rules: ->Microsoft advises customers to run their HIPS solution side-by-side with their ASR rules deployment until the moment you shift from Audit to Block mode. Keep in mind that you must reach out to your 3rd-party antivirus vendor for exclusion recommendations. +## Important pre-deployment caveat ++While you're going through the process of planning, auditing, and enable ASR rules, it's recommended that you enable the following three _standard protection rules_. See [Attack surface reduction rules by type](attack-surface-reduction-rules-reference.md#attack-surface-reduction-rules-by-type) for important details about the two types of ASR rules. ++- [Block credential stealing from the Windows local security authority subsystem (lsass.exe)](attack-surface-reduction-rules-reference.md#block-credential-stealing-from-the-windows-local-security-authority-subsystem) +- [Block abuse of exploited vulnerable signed drivers](attack-surface-reduction-rules-reference.md#block-abuse-of-exploited-vulnerable-signed-drivers) +- [Block persistence through Windows Management Instrumentation (WMI) event subscription](attack-surface-reduction-rules-reference.md#block-persistence-through-wmi-event-subscription) ++Typically, you can enable the standard protection rules with minimal-to-no noticeable impact to the end user. For an easy method to enable the standard protection rules, see: [Simplified standard protection option](attack-surface-reduction-rules-report.md#simplified-standard-protection-option) ++> [!NOTE] +> For Customers who are using a non-Microsoft HIPS and are transitioning to Microsoft Defender for Endpoint attack surface reduction rules: Microsoft advises customers to run their HIPS solution side-by-side with their ASR rules deployment until the moment you shift from Audit to Block mode. Keep in mind that you must reach out to your 3rd-party antivirus vendor for exclusion recommendations. ## Before you begin testing or enabling ASR rules During your initial preparation, it's vital that you understand the capabilities of the systems that you'll put in place. Understanding the capabilities will help you determine which ASR rules are most important for protecting your organization. Additionally, there are several prerequisites which you must attend to in preparation of your ASR deployment. ->[!IMPORTANT] ->This guide provides images and examples to help you decide how to configure ASR rules; these images and examples might not reflect the best configuration options for your environment. +> [!IMPORTANT] +> This guide provides images and examples to help you decide how to configure ASR rules; these images and examples might not reflect the best configuration options for your environment. Before you start, review [Overview of attack surface reduction](overview-attack-surface-reduction.md), and [Demystifying attack surface reduction rules - Part 1](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/demystifying-attack-surface-reduction-rules-part-1/ba-p/1306420) for foundational information. To understand the areas of coverage and potential impact, familiarize yourself with the current set of ASR rules; see [Attack surface reduction rules reference](attack-surface-reduction-rules-reference.md). While you are familiarizing yourself with the ASR rules set, take note of the per-rule GUID mappings; see: [ASR rule to GUID matrix](attack-surface-reduction-rules-reference.md#asr-rule-to-guid-matrix). |
| security | Attack Surface Reduction Rules Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference.md | This article provides information about Microsoft Defender for Endpoint attack s - [ASR rule modes](#asr-rule-modes) - [Per-rule-descriptions](#per-rule-descriptions) +## Attack surface reduction rules by type ++ASR rules are categorized as one of two types: ++1. **Standard protection rules**: Are the minimum set of rules which Microsoft recommends you always enable, while you are evaluating the impact and configuration needs of the other ASR rules. These rules typically have minimal-to-no noticeable impact on the end user. +1. **Other rules**: Rules which require some measure of following the documented deployment steps [Plan > Test (audit) > Enable (block/warn modes)], as documented in the [Attack surface reduction (ASR) rules deployment guide](attack-surface-reduction-rules-deployment.md) ++For the easiest method to enable the standard protection rules, see: [Simplified standard protection option](attack-surface-reduction-rules-report.md#simplified-standard-protection-option). ++| ASR rule name: | Standard protection rule? | Other rule? | +|:|:|:| +| Block abuse of exploited vulnerable signed drivers| Yes | | +| Block Adobe Reader from creating child processes | | Yes | +| Block all Office applications from creating child processes | | Yes | +| Block credential stealing from the Windows local security authority subsystem (lsass.exe) | Yes | | +| Block executable content from email client and webmail | | Yes | +| Block executable files from running unless they meet a prevalence, age, or trusted list criterion | | Yes | +| Block execution of potentially obfuscated scripts | | Yes | +| Block JavaScript or VBScript from launching downloaded executable content | | Yes | +| Block Office applications from creating executable content | | Yes | +| Block Office applications from injecting code into other processes | | Yes | +| Block Office communication application from creating child processes | | Yes | +| Block persistence through WMI event subscription | Yes | | +| Block process creations originating from PSExec and WMI commands | | Yes | +| Block untrusted and unsigned processes that run from USB | | Yes | +| Block Win32 API calls from Office macros | | Yes | +| Use advanced protection against ransomware | | Yes | + ## ASR rules supported operating systems The following table lists the supported operating systems for rules that are currently released to general availability. The rules are listed alphabetical order in this table. |
| security | Indicator Ip Domain | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/indicator-ip-domain.md | Title: Create indicators for IPs and URLs/domains description: Create indicators for IPs and URLs/domains that define the detection, prevention, and exclusion of entities. -keywords: ip, url, domain, manage, allowed, blocked, block, clean, malicious, file hash, ip address, urls, domain +keywords: ip, url, domain, manage, allowed, blocked, block, clean, malicious, file hash, ip address, urls, domain, IoC precedence, IoC conflict, ms.mktglfcycl: deploy ms.sitesec: library search.appverid: met150 > [!TIP] > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) -Defender for Endpoint can block what Microsoft deems as malicious IPs/URLs, through Windows Defender SmartScreen for Microsoft browsers, and through Network Protection for non-Microsoft browsers or calls made outside of a browser. +## Overview -The threat intelligence data set for this has been managed by Microsoft. +By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs, or domains based on your own threat intelligence. You can also warn users with a prompt if they open a risky app. The prompt won't stop them from using the app but you can provide a custom message and links to a company page that describes appropriate usage of the app. Users can still bypass the warning and continue to use the app if they need. -By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs, or domains based on your own threat intelligence. You can also warn users with a prompt if they open a risky app. The prompt won't stop them from using the app but you can provide a custom message and links to a company page that describes appropriate usage of the app. Users can still bypass the warning and continue to use the app if they need. +To block malicious IPs/URLs (as determined by Microsoft), Defender for Endpoint can use: -You can do this through the settings page or by machine groups if you deem certain groups to be more or less at risk than others. +- Windows Defender SmartScreen for Microsoft browsers +- Network Protection for non-Microsoft browsers, or calls made outside of a browser ++The threat-intelligence data set to block malicious IPs/URLs is managed by Microsoft. ++You can block malicious IPs/URLs through the settings page or by machine groups, if you deem certain groups to be more or less at risk than others. > [!NOTE] > Classless Inter-Domain Routing (CIDR) notation for IP addresses is not supported. You can do this through the settings page or by machine groups if you deem certa It's important to understand the following prerequisites prior to creating indicators for IPS, URLs, or domains: -- URL/IP allow and block relies on the Defender for Endpoint component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see [Enable network protection](enable-network-protection.md).-- The Antimalware client version must be 4.18.1906.x or later. -- Supported on machines on Windows 10, version 1709 or later, Windows 11, Windows Server 2016, Windows Server 2012 R2, Windows Server 2019, Windows Server 2022, and Android and iOS devices.+### Network Protection requirements - > [!NOTE] - > Windows Server 2016 and Windows Server 2012 R2 will need to be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016) for this feature to work. +URL/IP allow and block requires that the Microsoft Defender for Endpoint component _Network Protection_ is enabled in block mode. For more information on Network Protection and configuration instructions, see [Enable network protection](enable-network-protection.md). -- Ensure that **Custom network indicators** is enabled in **Microsoft 365 Defender** \> **Settings** \> **Advanced features**. For more information, see [Advanced features](advanced-features.md).-- For support of indicators on iOS, see [Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-configure-features#configure-custom-indicators).-- For support of indicators on Android, see [Microsoft Defender for Endpoint on Android](/microsoft-365/security/defender-endpoint/android-configure#configure-custom-indicators).+### Supported operating systems -> [!IMPORTANT] -> Only external IPs can be added to the indicator list. Indicators cannot be created for internal IPs. -> For web protection scenarios, we recommend using the built-in capabilities in Microsoft Edge. Microsoft Edge leverages [Network Protection](network-protection.md) to inspect network traffic and allows blocks for TCP, HTTP, and HTTPS (TLS). -> If there are conflicting URL indicator policies, the longer path is applied. For example, the URL indicator policy `https://support.microsoft.com/office` takes precedence over the URL indicator policy `https://support.microsoft.com`. +- Windows 10, version 1709 or later +- Windows 11 +- Windows Server 2016 +- Windows Server 2012 R2 +- Windows Server 2019 +- Windows Server 2022 +- Android and iOS devices -> [!NOTE] -> For processes other than Microsoft Edge and Internet Explorer, web protection scenarios leverage Network Protection for inspection and enforcement: -> -> - IP is supported for all three protocols (TCP, HTTP, and HTTPS (TLS)) -> - Only single IP addresses are supported (no CIDR blocks or IP ranges) in custom indicators -> - Encrypted URLs (full path) can only be blocked on first party browsers (Internet Explorer, Edge) -> - Encrypted URLs (FQDN only) can be blocked in third party browsers (i.e. other than Internet Explorer, Edge) -> - Full URL path blocks can be applied for unencrypted URLs -> -> There may be up to 2 hours of latency (usually less) between the time the action is taken, and the URL and IP being blocked. +### Windows Server 2016 and Windows Server 2012 R2 requirements ++Windows Server 2016 and Windows Server 2012 R2 must be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016). ++### Microsoft Defender Antivirus version requirements ++The _Antimalware client version_ must be 4.18.1906.x or later. ++### Custom network indicators requirements ++Ensure that **Custom network indicators** is enabled in **Microsoft 365 Defender** \> **Settings** \> **Advanced features**. For more information, see [Advanced features](advanced-features.md). ++For support of indicators on iOS, see [Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-configure-features#configure-custom-indicators). ++For support of indicators on Android, see [Microsoft Defender for Endpoint on Android](/microsoft-365/security/defender-endpoint/android-configure#configure-custom-indicators). ++### IoC indicator list limitations ++Only external IPs can be added to the indicator list. Indicators cannot be created for internal IPs. For web protection scenarios, we recommend using the built-in capabilities in Microsoft Edge. Microsoft Edge leverages [Network Protection](network-protection.md) to inspect network traffic and allows blocks for TCP, HTTP, and HTTPS (TLS). ++### Non Microsoft Edge and Internet Explorer processes ++For processes other than Microsoft Edge and Internet Explorer, web protection scenarios leverage Network Protection for inspection and enforcement: -When using the warn mode, you can configure the following controls: +- IP is supported for all three protocols (TCP, HTTP, and HTTPS (TLS)) +- Only single IP addresses are supported (no CIDR blocks or IP ranges) in custom indicators +- Encrypted URLs (full path) can only be blocked on first party browsers (Internet Explorer, Edge) +- Encrypted URLs (FQDN only) can be blocked in third party browsers (i.e. other than Internet Explorer, Edge) +- Full URL path blocks can be applied for unencrypted URLs +- If there are conflicting URL indicator policies, the longer path is applied. For example, the URL indicator policy `https://support.microsoft.com/office` takes precedence over the URL indicator policy `https://support.microsoft.com`. +There may be up to 2 hours of latency (usually less) between the time the action is taken, and the URL and IP being blocked. -**Bypass ability**: +### Warn mode controls -- Allow button in Edge-- Allow button on toast (Non-Microsoft browsers)-- Bypass duration parameter on the indicator-- Bypass enforcement across Microsoft and Non-Microsoft browsers+When using warn mode, you can configure the following controls: -**Redirect URL**: +- **Bypass ability** + - Allow button in Edge + - Allow button on toast (Non-Microsoft browsers) + - Bypass duration parameter on the indicator + - Bypass enforcement across Microsoft and Non-Microsoft browsers -- Redirect URL parameter on the indicator-- Redirect URL in Edge-- Redirect URL on toast (Non-Microsoft browsers)+- **Redirect URL** + - Redirect URL parameter on the indicator + - Redirect URL in Edge + - Redirect URL on toast (Non-Microsoft browsers) For more information, see [Govern apps discovered by Microsoft Defender for Endpoint](/cloud-app-security/mde-govern). +## IoC IP URL and domain policy conflict handling order ++Policy conflict handling follows the below order: ++- MDCA creates an unsanctioned indicator for all users but URL is allowed for a specific device group, the specific device group is Blocked access to the URL. +- If the IP, URL/Domain is allowed +- If the IP, URL/Domain is not allowed +- If the IP, URL/Domain is allowed +- If the IP, URL/Domain is not allowed +- If the IP, URL/Domain is allowed ++If there are conflicting file IoC policies with the same enforcement type and target, the policy of the more secure will be applied. ++Policy conflict handling for domains/URLs/IP addresses differ from policy conflict handling for Certs. ++Threat and vulnerability management's block vulnerable application features uses the file IoCs for enforcement and will follow the above conflict handling order. ++## Policy precedence ++Microsoft Defender for Endpoint policy has precedence over Microsoft Defender Antivirus policy. In situations when Defender for Endpoint is set to **Allow**, but Microsoft Defender Antivirus is set to **Block**, the policy will default to **Allow**. ++#### Precedence for multiple active policies ++Applying multiple different web content filtering policies to the same device will result in the more restrictive policy applying for each category. Consider the following scenario: ++- **Policy 1** blocks categories 1 and 2 and audits the rest +- **Policy 2** blocks categories 3 and 4 and audits the rest ++The result is that categories 1-4 are all blocked. This is illustrated in the following image. ++ ## Create an indicator for IPs, URLs, or domains from the settings page 1. In the navigation pane, select **Settings** \> **Endpoints** \> **Indicators** (under **Rules**). |
| security | Mssp List | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mssp-list.md | - Title: Supported managed security service providers -description: See the list of MSSPs that Microsoft Defender for Endpoint integrates with -keywords: managed security service provider, mssp, configure, integration --ms.sitesec: library -ms.pagetype: security ------ m365-security-- tier3-----# Supported managed security service providers --**Applies to:** --- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037)-- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)-- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)--> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) --The following managed security service providers can be accessed through the portal. --Logo |Partner name | Description -:|:|: -|[Accenture Managed Detection & Response (MDR)](https://go.microsoft.com/fwlink/?linkid=2164353) | Manage, maintain, and enhance global cybersecurity operations with extended capabilities that detect, proactively hunt for and respond to advanced cyber-attacks across both IT and OT environments located in the cloud and on-premise. - | [Aujas managed MDE Service](https://go.microsoft.com/fwlink/?linkid=2162429) | Aujas cybersecurity provides 24*7 managed security services across the entire enterprise spectrum, using Microsoft Defender for Endpoint through its Cyber Defense Centers. -| [BDO Digital](/openspecs/ie_standards/ms-html401/ad459f6f-5219-4f68-829c-a58f7397a11f) | BDO Digital's Managed Defense uses best practice tools, AI, and in-house security experts for 24/7/365 identity protection -| [BlueVoyant](https://go.microsoft.com/fwlink/?linkid=2121401) | MDR services that deliver comprehensive threat data analytics and advanced technology solutions with 24x7 remote monitoring and XDR incident remediation in your environment. -| [Cloud Defender for Cloud](https://go.microsoft.com/fwlink/?linkid=2099315) | InSpark's Cloud Defender for Cloud is a 24x7 managed service that delivers protect, detect & respond capabilities -| [Cloud SOC](https://go.microsoft.com/fwlink/?linkid=2104265) | Cloud SOC provides 24/7 security monitoring services based on Microsoft cloud and helps you to continuously improve your security posture -| [CSIS Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2091005) | 24/7 monitoring and analysis of security alerts giving companies actionable insights into what, when and how security incidents have taken place - |[CyberProof Managed Detection & Response (MDR)](https://go.microsoft.com/fwlink/?linkid=2163964) | 24x7 managed threat detection and response services fully integrated with Microsoft Sentinel and Defender for Endpoint. -| [Dell Technologies Advanced Threat Protection](https://go.microsoft.com/fwlink/?linkid=2091004) | Professional monitoring service for malicious behavior and anomalies with 24/7 capability - | [eSentire Managed Detection and Response](https://go.microsoft.com/fwlink/?linkid=2154970) | 24/7 threat hunting, investigation, and complete response with certified MDR expertise across the Microsoft Ecosystem, including Microsoft 365 Defender & Sentinel-plus 15-minute mean time to contain. -| [Expel Managed detection and response for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2162430) | Expel helps your security keep up by detecting security risks in Microsoft Defender for Endpoint. - | [Mandiant Managed Defense (MDR) for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2164352) | Fortify your Defender for Endpoint with 24/7 frontline MDR intelligence and expertise from Mandiant. -| [NTT Security](https://go.microsoft.com/fwlink/?linkid=2095320) | NTT's EDR Service provides 24/7 security monitoring & response across your endpoint and network - | [Onevinn MDR](https://go.microsoft.com/fwlink/?linkid=2155203)| 24/7 Managed Detection and Response built on Microsoft 365 Defender and Microsoft Sentinel, enriched with Onevinn's threat intelligence. - | [Quorum Cyber](https://go.microsoft.com/fwlink/?linkid=2155202)| A cutting-edge Threat Hunting & Security Engineering service. -| [Red Canary](https://go.microsoft.com/fwlink/?linkid=2103852) | Red Canary is a security operations partner for modern teams, MDR deployed in minutes -| [SecureWorks Managed Detection and Response Powered by Red Cloak](https://go.microsoft.com/fwlink/?linkid=2133634) | Secureworks combines threat intelligence and 20+ years of experience into SaaS and managed security solutions -| [sepagoSOC](https://go.microsoft.com/fwlink/?linkid=2090491) | Ensure holistic security through sophisticated automated workflows in your Zero Trust environment -| [Trustwave Threat Detection & Response Services](https://go.microsoft.com/fwlink/?linkid=2127542) | Threat Detection and Response services for Azure using integrations with Sentinel and Defender for Endpoint -| [White Shark Managed Security Services](https://go.microsoft.com/fwlink/?linkid=2154210) |True expert approach to cyber security with transparent pricing on every platform, mobile included. -| [Wortell's cloud SOC](https://go.microsoft.com/fwlink/?linkid=2108415) | 24x7 managed Defender for Endpoint service for monitoring & response -| [Zero Trust Analytics Platform (ZTAP)](https://go.microsoft.com/fwlink/?linkid=2090971) | Reduce your alerts by 99% and access a full range of security capabilities from mobile devices --## Related topics --- [Configure managed service security provider integration](configure-mssp-support.md) |
| security | Professional Services | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/professional-services.md | + + Title: Professional services supported by Microsoft 365 Defender +description: See the list of professional services that Microsoft 365 Defender can integrate with. +keywords: professional service, managed security services, m365 defender, m365 defender services, mssp, configure, integration, protect, evolve, educate, defender for endpoint, detection ++ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++++search.appverid: met150 +++# Professional services supported by Microsoft 365 Defender ++**Applies to:** ++- Microsoft 365 Defender +- Microsoft Defender for Endpoint +- Microsoft Defender for Vulnerability Management +- Microsoft Defender for Office 365 +- Microsoft Defender for Identity +- Microsoft Defender for Cloud Apps ++The following professional services can be integrated with Microsoft Defenders’ products: ++## Manage ++Managed security services that assist organizations to detect threats early and help minimize the impact of a breach. ++| Service name | Vendor | Description | +| -- | | | +| [Microsoft Defender Experts](https://go.microsoft.com/fwlink/?linkid=2203232)| Microsoft | Defender Experts for Hunting is a proactive threat hunting service for Microsoft 365 Defender. | +| [Cloud Security Operations Center](https://go.microsoft.com/fwlink/?linkid=2202671) | glueckkanja-gab AG| Monitors your Microsoft Security Solutions 24/7, responds to threats on your behalf and works closely with your IT to continuously improve your security posture.| +| [Wortell Protect](https://go.microsoft.com/fwlink/?linkid=2202480)| Wortell| Wortell offers a 24.7.365 Managed Detection and Response service, SOC-as-a-service, to secure your Azure subscriptions and Microsoft 365 environment. With this managed service, Wortell will provide security monitoring and incident response, and operate Microsoft Defender and (optionally) Microsoft Sentinel on your behalf. The service also includes threat intelligence feeds and custom machine learning models| +| [CRITICALSTART® Managed Detection & Response Services for Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2202761)| CRITICALSTART| Critical Start Managed Detection and Response (MDR) services for Microsoft 365 Defender (M365D) extends security defenses to provide cross-domain threat protection and simplify breach prevention. Their team of Microsoft security experts leverages integration with M365D to detect, investigate and respond with the right actions to alerts from identity, to email and cloud – before they disrupt business operations.  | +| [CRITICALSTART® Managed Detection & Response Services for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2202844)  | CRITICALSTART| Critical Start Managed Detection & Response (MDR) service for Microsoft Defender for Endpoint (MDE) simplifies security across an expanded attack surface by combining Microsoft’s cross-enterprise visibility threat detection and auto investigation capabilities with optimized threat detection and response to deliver an 80% reduction in false positives on the first day of production monitoring.  | +| [InSpark Cloud Security Center](https://go.microsoft.com/fwlink/?linkid=2202387) | InSpark| InSparks' Cloud Security Center is a 24x7 Managed Security Solution including SOC services. It continuously provides your Microsoft cloud platform with the highest level of security.   | +| [Mandiant MDR for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2202388)| Mandiant, Inc. | Mandiant Managed Defense protects your business with a managed detection and response (MDR) service fueled by dedicated and frontline IR experts who protect against motivated adversaries with a combination of up-to-the-minute threat intelligence, data science and real-world expertise. Managed Defense helps customers optimize investments in Microsoft technology, maximize resources and accelerate investigations. | +| [Onevinn MDR](https://go.microsoft.com/fwlink/?linkid=2202390) | Onevinn| Onevinn MDR, Managed Detection and Response, built on Microsoft Defender and Microsoft Sentinel is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. | +| [SepagoSOC](https://go.microsoft.com/fwlink/?linkid=2202677) | Sepago GmbH  | SepagoSOC experts ensure that your environment is constantly monitored and protected utilizing the complete range of Microsoft 365 Defender solutions and Microsoft Sentinel. They help you to constantly evolve your security landscape with both technical and organizational experience.| +| [MDR for Microsoft](https://go.microsoft.com/fwlink/?linkid=2202762) | Red Canary | MDR for Microsoft provides 24x7 managed detection, investigation, and response to threats across your Microsoft environment.  | +| [Security Operations & MDR](https://go.microsoft.com/fwlink/?linkid=2202843)  | BDO | BDO’s Security Operations Center (SOC) provides continuous detection, protection and response for organizations globally. BDO MDR is like having eyes where you don’t. It's modern technology and experts make hunting, detecting and responding one less thing to keep up with. Because they have eyes where we don’t. | +| [DXC Managed Endpoint Threat Detection and Response](https://go.microsoft.com/fwlink/?linkid=2202580) | DXC | DXC Managed Endpoint Threat Detection and Response gives your organization the capability to successfully detect and respond to threats in your environment. It's powered by Microsoft’s Defender for Endpoint and DXC Technology security experts with unparalleled knowledge of global threats, | +| [Managed Security Services for Microsoft Defender Suite](https://go.microsoft.com/fwlink/?linkid=2202476)  | Dell Technologies | Dell Technologies is a Global services delivery company with a distributed Security Operations Center that is available 24 by 7 to serve customers with security monitoring and management. They help onboard customers and improve their security posture and offload the burden of hiring and managing a full security team while reaping the benefits of 24 hour detection and response. | +| [CSIS Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202385) | CSIS | Provides 24/7 monitoring and analysis of security alerts giving companies actionable insights into what, when, and how security incidents have taken place. | +| [MDR for Endpoints](https://go.microsoft.com/fwlink/?linkid=2202676)| NTT Ltd. | MDR for Endpoints helps increase your cyber resilience with Managed Detection and Response (MDR) service. Combines 24/7 human & machine expertise, best-of-breed technologies, and global threat intelligence to detect and disrupt hard-to-find attacks, making it more secure. | +| [BlueVoyant MDR for Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2202673) | BlueVoyant | BlueVoyant’s MDR (Managed Detection and Response) for Microsoft 365 Defender combines the power of Microsoft’s Defender product suite with BlueVoyant’s elite 24x7 security operations team to identify, investigate and eradicate today’s most sophisticated and advanced cyberattacks. In addition to MDR, services can include implementation, assessments, training, concierge, third party integrations, and more. | +| [White Hat Managed Security Services](https://go.microsoft.com/fwlink/?linkid=2202391)  | White Hat IT Security| White Hat MSS offers zero trust approach to managed security on every platform – scalable and adaptive security from true experts. | +| [eSentire Managed Detection and Response](https://go.microsoft.com/fwlink/?linkid=2202582) | eSentire| MDR you can trust that provides 24/7 threat investigations and responses via Microsoft 365 Defender suite.  | +| [Aujas Managed Security Services](https://go.microsoft.com/fwlink/?linkid=2202672)| Aujas Cybersecurity   | Managed security services that assist organizations to detect threats early and help minimize the impact of a breach.| +| [Expel for Microsoft](https://go.microsoft.com/fwlink/?linkid=2202477) | Expel | Provides 24/7 detection and response for Microsoft Defender for Endpoint, Azure, and Office 365.| +| [Managed XDR for Microsoft](https://go.microsoft.com/fwlink/?linkid=2202386)  | CyberProof | CyberProof’s Managed XDR (Extended Detection and Response) for Microsoft identifies intrusions across your enterprise as you migrate to the cloud – from applications to endpoints, identities and data - enabling timely response to reduce the impact of the attack.   The combination of their human expertise and experience in security operations with Microsoft’s 365 Defender and Microsoft Sentinel technology reduces the costs and complexity of adopting and operating a cloud-native cyber defense architecture. | +| [Taegis XDR](https://go.microsoft.com/fwlink/?linkid=2202848) | Secureworks | Taegis™ ManagedXDR is Secureworks® 24x7 managed detection and response service, which helps you detect advanced threats and take the right action. Included threat hunting and incident response capabilities help you scale your security operations as Secureworks uses threat data collected across thousands of customers to improve your security posture. Secureworks' combination of proprietary security analytics software, SecOps expertise, incident response and threat hunting experience, threat intelligence capabilities, and 20-year history of service excellence helps reduce risk to your business.  | +| [Cloud Control - Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202678)  | The Collective| The Collective's Cloud Control Managed Protection, Detection and Response services is an enterprise grade managed service, delivering true Security Operations Center-as-a-Service (SOC) experience with a personal touch. | +| [Nedscaper Managed XDR](https://go.microsoft.com/fwlink/?linkid=2202478) | Nedscaper | Nedscaper Manager XDR (MDR) is a Managed Detect and Respond SaaS solution, which provides 24/7 Threat Protection, continues Vulnerability Management and combined Threat Intelligence built on Azure. The Microsoft (365 & Azure) Defender products, plus any non-Microsoft / 3P Security solution, is connected to Microsoft Sentinel as the core platform for the Security analysts. | +| [dinext. pi-SOC](https://go.microsoft.com/fwlink/?linkid=2202581)| dinext AG | Through a close integration of deployment support, security operations and consulting in hardening and architectural improvements, dinext AG accompanies customers holistically on their way to a modern security environment. | +| [Synergy Advisors Teams App](https://go.microsoft.com/fwlink/?linkid=2202392)| Synergy Advisors LLC | E-Visor Teams App is a centralized place to involve and empower your end-users in the security and productivity of the organization by presenting unique information using data from Microsoft Defenders and Azure Active Directory while ensuring identity governance, and compliance. | +| [Managed Microsoft XDR](https://go.microsoft.com/fwlink/?linkid=2202846) | Quorum Cyber | Quorum Cyber’s Managed Microsoft XDR, a solution designed to enable customers to unleash the power of Microsoft security to reduce cyber risk and maximize return of investment in security. | +|[SecureShield365](https://go.microsoft.com/fwlink/?linkid=2209718)| Patriot Consulting | SecureShield365 includes a full deployment of all Microsoft 365 Defender products including Intune plus 12 months of support. Microsoft XDR including Sentinel, Defender for Cloud, and MDR are available options.| +|[Open Systems MDR+](https://go.microsoft.com/fwlink/?linkid=2208895) | Open Systems| Built for Microsoft security customers, MDR+ combines certified experts, exemplary processes, and seamless technology to deliver tailored, 24×7 protection while reducing attack surfaces and MTTR.| ++## Respond ++Respond to security incidents quickly, effectively and at scale with complete incident response including investigation, containment, remediation, and crisis management. ++| Service name | Vendor| Description| +| -| | | +| [Microsoft Detection and Response Team (DART)](https://go.microsoft.com/fwlink/?linkid=2203105) | Microsoft | The Cybersecurity Incident Response service is an effective way to respond to incidents due to the activities of today’s adversaries and sophisticated criminal organizations. This service seeks to determine whether systems are under targeted exploitation via investigation for signs of advanced implants and anomalous behavior. | +| [Managed Microsoft XDR](https://go.microsoft.com/fwlink/?linkid=2202846)| Quorum Cyber| Quorum Cyber’s Managed Microsoft XDR, a solution designed to enable customers to unleash the power of Microsoft security to reduce cyber risk and maximize return of investment in security. | +| [Trustwave MDR](https://go.microsoft.com/fwlink/?linkid=2202849)| Trustwave | Trustwave offers a security service (Gartner Leader) for endpoint using Microsoft Defender for Endpoint. | +| [Active Remediation](https://go.microsoft.com/fwlink/?linkid=) | Red Canary | Red Canary security experts respond to remediate threats on your endpoints, 24x7. Requires Red Canary MDR for Microsoft. | +| [Onevinn DFIR](https://go.microsoft.com/fwlink/?linkid=2202584)  | Onevinn| Onevinn DFIR, Digital Defense and Incident Response team, when you're having a breach and you need urgent assistance to gain back control of your IT Environment. | +| [Cloud Security Operations Center](https://go.microsoft.com/fwlink/?linkid=2202671) | glueckkanja-gab AG| Monitors your Microsoft Security Solutions 24/7, respond to threats on your behalf and work closely with your IT to continuously improve your security posture.| +| [Wortell Protect](https://go.microsoft.com/fwlink/?linkid=2202480) | Wortell| Wortell offers a 24.7.365 Managed Detection and Response service, SOC-as-a-service, to secure your Azure subscriptions and Microsoft 365 environment. With this managed service, Wortell will provide security monitoring and incident response, and operate Microsoft Defender and (optionally) Microsoft Sentinel on your behalf. The service also includes threat intelligence feeds and custom machine learning models | +| [InSpark Cloud Security Center](https://go.microsoft.com/fwlink/?linkid=2202387) | InSpark| InSparks' Cloud Security Center is a 24x7 Managed Security Solution including SOC services. It continuously provides your Microsoft cloud platform with the highest level of security. | +| [Mandiant MDR for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2202388)| Mandiant, Inc. | Mandiant Managed Defense protects your business with a managed detection and response (MDR) service fueled by dedicated and frontline IR experts who protect against motivated adversaries with a combination of up-to-the-minute threat intelligence, data science and real-world expertise. Managed Defense helps customers optimize investments in Microsoft technology, maximize resources and accelerate investigations. | +| [Onevinn MDR](https://go.microsoft.com/fwlink/?linkid=2202390) | Onevinn| Onevinn MDR, Managed Detection and Response, built on Microsoft Defender and Microsoft Sentinel is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. | +| [MDR for Microsoft](https://go.microsoft.com/fwlink/?linkid=2202762) | Red Canary | 24x7 managed detection, investigation, and response to threats across your Microsoft environment.| +| [Security Operations & MDR](https://go.microsoft.com/fwlink/?linkid=2202843) | BDO | BDO’s Security Operations Center (SOC) provides continuous detection, protection and response for organizations globally. BDO MDR is like having eyes where you don’t. It's modern technology and experts make hunting, detecting and responding one less thing to keep up with. Because they have eyes where we don’t.  | +| [DXC Managed Endpoint Threat Detection and Response](https://go.microsoft.com/fwlink/?linkid=2202580) | DXC | DXC Managed Endpoint Threat Detection and Response gives your organization the capability to successfully detect and respond to threats in your environment. Powered by Microsoft’s Defender for Endpoint and DXC Technology security experts with unparalleled knowledge of global threats,  | +| [Managed Security Services for Microsoft Defender Suite](https://go.microsoft.com/fwlink/?linkid=2202476)  | Dell Technologies | Dell Technologies is a Global services delivery company with a distributed Security Operations Center that is available 24/7 to serve customers with security monitoring and management. They help onboard customers and improve their security posture and offload the burden of hiring and managing a full security team while reaping the benefits of 24 hour detection and response.| +| [CSIS Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202385) | CSIS | 24/7 monitoring and analysis of security alerts giving companies actionable insights into what, when, and how security incidents have taken place. | +| [MDR for Endpoints](https://go.microsoft.com/fwlink/?linkid=2202676)  | NTT Ltd. | Increase your cyber resilience with Managed Detection and Response (MDR) service. Combining 24/7 human & machine expertise, best-of-breed technologies, and global threat intelligence to detect and disrupt hard-to-find attacks, making you more secure. | +| [BlueVoyant MDR for Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2202673) | BlueVoyant | BlueVoyant’s MDR (Managed Detection and Response) for Microsoft 365 Defender combines the power of Microsoft’s Defender product suite with BlueVoyant’s elite 24x7 security operations team to identify, investigate and eradicate today’s most sophisticated and advanced cyberattacks. In addition to MDR, services can include implementation, assessments, training, concierge, third party integrations, and more. | +| [White Hat Managed Security Services](https://go.microsoft.com/fwlink/?linkid=2202391)  | White Hat IT Security| White Hat MSS offers zero trust approach to managed security on every platform – scalable and adaptive security from true experts.| +| [eSentire Managed Detection and Response](https://go.microsoft.com/fwlink/?linkid=2202582)| eSentire | MDR you can trust that provides 24/7 threat investigations and responses via Microsoft 365 Defender suite.  | +| [Aujas Managed Security Services](https://go.microsoft.com/fwlink/?linkid=2202672)| Aujas Cybersecurity   | Managed security services that assist organisations to detect threats early and help minimize the impact of a breach. | +| [Accenture Managed Extended Detection & Response (MxDR)](https://go.microsoft.com/fwlink/?linkid=2202842)  | Accenture | Accenture's Managed Extended Detection & Response (MxDR) service provides a fully managed service that proactively finds and mitigates advanced cyber-attacks and malicious activity before they cause material business impact across IT and OT environments, both in the cloud and on-premises. | +| [Taegis XDR](https://go.microsoft.com/fwlink/?linkid=2202848)  | Secureworks | Taegis™ ManagedXDR is Secureworks® 24x7 managed detection and response service, which helps you detect advanced threats and take the right action. Included threat hunting and incident response capabilities help you scale your security operations as Secureworks uses threat data collected across thousands of customers to improve your security posture. Secureworks' combination of proprietary security analytics software, SecOps expertise, incident response and threat hunting experience, threat intelligence capabilities, and 20-year history of service excellence helps reduce risk to your business.  | +| [Cloud Control - Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202678)  | The Collective | The Collective's Cloud Control Managed Protection, Detection and Response services is an enterprise grade managed service, delivering true Security Operations Center-as-a-Service (SOC) experience with a personal touch. | +| [dinext. pi-SOC](https://go.microsoft.com/fwlink/?linkid=2202581) | dinext AG | Through a close integration of deployment support, security operations and consulting in hardening and architectural improvements, dinext AG accompanies customers holistically on their way to a modern security environment. | +| [Synergy Advisors Teams App](https://go.microsoft.com/fwlink/?linkid=2202392) | Synergy Advisors LLC | E-Visor Teams App is a centralized place to involve and empower your end-users in the security and productivity of the organization by presenting unique information using data from Microsoft Defenders and Azure Active Directory while ensuring identity governance, and compliance.  | +| [SepagoSOC](https://go.microsoft.com/fwlink/?linkid=2202677)| Sepago GmbH  | SepagoSOC experts ensure that your environment is constantly monitored and protected utilizing the complete range of Microsoft 365 Defender solutions and Microsoft Sentinel. They help you to constantly evolve your security landscape with both technical and organizational experience.| +|[SecureShield365](https://go.microsoft.com/fwlink/?linkid=2209718)| Patriot Consulting | SecureShield365 includes a full deployment of all Microsoft 365 Defender products including Intune plus 12 months of support. Microsoft XDR including Sentinel, Defender for Cloud, and MDR are available options.| +|[Open Systems MDR+](https://go.microsoft.com/fwlink/?linkid=2208895) | Open Systems| Built for Microsoft security customers, MDR+ combines certified experts, exemplary processes, and seamless technology to deliver tailored, 24×7 protection while reducing attack surfaces and MTTR.| ++## Protect ++Protect your organization proactively by evaluating your organization’s ability to effectively prevent, detect, and respond to cyber threats before they disrupt your business. ++| Service name | Vendor| Description| +| - | - | -- | +| [Microsoft Defender Experts](https://go.microsoft.com/fwlink/?linkid=2203232) | Microsoft | Defender Experts for Hunting is a proactive threat hunting service for Microsoft 365 Defender.| +| [Microsoft Consulting Services - Security Operations and Threat Protection Services](https://www.microsoft.com/en-us/industrysolutions/solutions/security?activetab=pivot1:primaryr4) | Microsoft | The Microsoft Consulting Services (MCS) Security Operations and Threat Protection Services (SOTPS), provides a structured approach to modern Security Operations Center (SOC) design and implementation using effective change management techniques so your security professionals can detect attacks faster and respond more effectively. | +| [Onevinn Threat Hunting](https://go.microsoft.com/fwlink/?linkid=2202584)  | Onevinn| If your Internal SOC needs an extra pair of eyes looking for threats, Onevinn´s Threat Hunters can be purchased as your extended hunting team.  | +| [Microsoft 365 Security Assessment](https://go.microsoft.com/fwlink/?linkid=2202389)  | Nedscaper | The Microsoft 365 Security assessment provides a risk-based approach to scan and analyze the security baseline (prevention is better than the cure) and settings of the Microsoft 365 Security products, from Microsoft 365 E3 security products like Azure AD Conditional Access and Microsoft Endpoint Manager (Microsoft Defender Antivirus policies) to the Microsoft 365 E5 Security products like Microsoft 365 Defender, Azure AD identity Protection and Microsoft Defender for Identity, Devices, Office 365 and Cloud Apps.| +| [Invoke Monthly Microsoft 365 Security Assessments](https://go.microsoft.com/fwlink/?linkid=2202583)  | Invoke LLC | Provides monthly detailed assessment reports of active threats, vulnerabilities active and Phishing/malware campaigns targeted on your Microsoft 365 Environment. Helps with prescribed mitigations for active threats and improvement actions for recurring threats if any. Monitor Secure score and recommendations, giving your security teams an extra set of eyes to stay on top of risks. | +| [Cloud Security Operations Center](https://go.microsoft.com/fwlink/?linkid=2202671)| glueckkanja-gab AG| Monitors your Microsoft Security Solutions 24/7, respond to threats on your behalf and work closely with your IT to continuously improve your security posture.| +| [Wortell Protect](https://go.microsoft.com/fwlink/?linkid=2202480) | Wortell| Wortell offers a 24.7.365 Managed Detection and Response service, SOC-as-a-service, to secure your Azure subscriptions and Microsoft 365 environment. With this managed service, Wortell will provide security monitoring and incident response, and operate Microsoft Defender and (optionally) Microsoft Sentinel on your behalf. The service also includes threat intelligence feeds and custom machine learning models | +| [InSpark Cloud Security Center](https://go.microsoft.com/fwlink/?linkid=2202387)| InSpark| InSparks' Cloud Security Center is a 24x7 Managed Security Solution including SOC services. It continuously provides your Microsoft cloud platform with the highest level of security. | +| [Mandiant MDR for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2202388)| Mandiant, Inc. | Mandiant Managed Defense protects your business with a managed detection and response (MDR) service fueled by dedicated and frontline IR experts who protect against motivated adversaries with a combination of up-to-the-minute threat intelligence, data science and real-world expertise. Managed Defense helps customers optimize investments in Microsoft technology, maximize resources and accelerate investigations. | +| [Onevinn MDR](https://go.microsoft.com/fwlink/?linkid=2202390)| Onevinn| Onevinn MDR, Managed Detection and Response, built on Microsoft Defender and Microsoft Sentinel is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. | +| [MDR for Microsoft](https://go.microsoft.com/fwlink/?linkid=2202762)| Red Canary | 24x7 managed detection, investigation, and response to threats across your Microsoft environment.| +| [Security Operations & MDR](https://go.microsoft.com/fwlink/?linkid=2202843) | BDO | BDO’s Security Operations Center (SOC) provides continuous detection, protection and response for organizations globally. BDO MDR is like having eyes where you don’t. It's modern technology and experts make hunting, detecting and responding one less thing to keep up with. Because they have eyes where we don’t.  | +| [DXC Managed Endpoint Threat Detection and Response](https://go.microsoft.com/fwlink/?linkid=2202580)| DXC | DXC Managed Endpoint Threat Detection and Response gives your organization the capability to successfully detect and respond to threats in your environment. Powered by Microsoft’s Defender for Endpoint and DXC Technology security experts with unparalleled knowledge of global threats,  | +| [Managed Security Services for Microsoft Defender Suite](https://go.microsoft.com/fwlink/?linkid=2202476) | Dell Technologies | Dell Technologies is a Global services delivery company with a distributed Security Operations Center that is available 24 by 7 to serve customers with security monitoring and management. Help onboard customers and improve their security posture and offload the burden of hiring and managing a full security team while reaping the benefits of 24 hour detection and response.| +| [BlueVoyant MDR for Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2202673)| BlueVoyant | BlueVoyant’s MDR (Managed Detection and Response) for Microsoft 365 Defender combines the power of Microsoft’s Defender product suite with BlueVoyant’s elite 24x7 security operations team to identify, investigate and eradicate today’s most sophisticated and advanced cyberattacks. In addition to MDR, services can include implementation, assessments, training, concierge, third party integrations, and more. | +| [White Hat Managed Security Services](https://go.microsoft.com/fwlink/?linkid=2202391)  | White Hat IT Security| White Hat MSS offers zero trust approach to managed security on every platform – scalable and adaptive security from true experts.| +| [eSentire Managed Detection and Response](https://go.microsoft.com/fwlink/?linkid=2202582)  | eSentire | MDR you can trust that provides 24/7 threat investigations and responses via Microsoft 365 Defender suite.  | +| [Aujas Managed Security Services](https://go.microsoft.com/fwlink/?linkid=2202672) | Aujas Cybersecurity   | Managed security services that assist organizations to detect threats early and help minimize the impact of a breach. | +| [Accenture Managed Extended Detection & Response (MxDR)](https://go.microsoft.com/fwlink/?linkid=2202842) | Accenture | Accenture's Managed Extended Detection & Response (MxDR) service provides a fully managed service that proactively finds and mitigates advanced cyber-attacks and malicious activity before they cause material business impact across IT and OT environments, both in the cloud and on-premises. | +| [Taegis XDR](https://go.microsoft.com/fwlink/?linkid=2202848)  | Secureworks | Taegis™ ManagedXDR is Secureworks® 24x7 managed detection and response service, which helps you detect advanced threats and take the right action. Included threat hunting and incident response capabilities help you scale your security operations as Secureworks uses threat data collected across thousands of customers to improve your security posture. Secureworks' combination of proprietary security analytics software, SecOps expertise, incident response and threat hunting experience, threat intelligence capabilities, and 20-year history of service excellence helps reduce risk to your business.  | +| [Cloud Control - Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202678)  | The Collective | The Collective's Cloud Control Managed Protection, Detection and Response services is an enterprise grade managed service, delivering true Security Operations Center-as-a-Service (SOC) experience with a personal touch. | +| [dinext. pi-SOC](https://go.microsoft.com/fwlink/?linkid=2202581) | dinext AG | Through a close integration of deployment support, security operations and consulting in hardening and architectural improvements, dinext AG accompanies customers holistically on their way to a modern security environment. | +| [Synergy Advisors Teams App](https://go.microsoft.com/fwlink/?linkid=2202392) | Synergy Advisors LLC | E-Visor Teams App is a centralized place to involve and empower your end-users in the security and productivity of the organization by presenting unique information using data from Microsoft Defenders and Azure Active Directory while ensuring identity governance, and compliance.  | +| [Managed Microsoft XDR](https://go.microsoft.com/fwlink/?linkid=2202846)  | Quorum Cyber| Quorum Cyber’s Managed Microsoft XDR, a solution designed to enable customers to unleash the power of Microsoft security to reduce cyber risk and maximize return of investment in security. | +| [SepagoSOC](https://go.microsoft.com/fwlink/?linkid=2202677)  | Sepago GmbH  | SepagoSOC experts ensure that your environment is constantly monitored and protected utilizing the complete range of Microsoft 365 Defender solutions and Microsoft Sentinel. They help you to constantly evolve your security landscape with both technical and organizational experience.| +|[SecureShield365](https://go.microsoft.com/fwlink/?linkid=2209718)| Patriot Consulting | SecureShield365 includes a full deployment of all Microsoft 365 Defender products including Intune plus 12 months of support. Microsoft XDR including Sentinel, Defender for Cloud, and MDR are available options.| +|[Open Systems MDR+](https://go.microsoft.com/fwlink/?linkid=2208895) | Open Systems| Built for Microsoft security customers, MDR+ combines certified experts, exemplary processes, and seamless technology to deliver tailored, 24×7 protection while reducing attack surfaces and MTTR.| ++## Evolve ++Evolve your organization’s security posture through improved processes and technologies that will up-level threat detection, containment, and remediation capabilities. ++| Service name | Vendor | Description| +| -- | -- | | +| [CRITICALSTART® Cybersecurity Consulting +| [Sepago Adapt](https://go.microsoft.com/fwlink/?linkid=2202677)   | Sepago GmbH | Working with the full range of Microsoft Defender solutions requires a change in processes. Combining Microsoft and sepago best practices and your company-knowledge, together we'll build and establish processes for your organization to enable you to fully utilize the Defender solutions.| +| [Zero Trust by Onevinn](https://go.microsoft.com/fwlink/?linkid=2202584) | Onevinn | Get started with Zero Trust by fully utilize your investment in Microsoft 365 Security Features | +| [Cloud Security Operations Center](https://go.microsoft.com/fwlink/?linkid=2202671) | glueckkanja-gab AG | Monitors your Microsoft Security Solutions 24/7, respond to threats on your behalf and work closely with your IT to continuously improve your security posture.| +| [Wortell Protect](https://go.microsoft.com/fwlink/?linkid=2202480) | Wortell | Wortell offers a 24.7.365 Managed Detection and Response service, SOC-as-a-service, to secure your Azure subscriptions and Microsoft 365 environment. With this managed service, Wortell will provide security monitoring and incident response, and operate Microsoft Defender and (optionally) Microsoft Sentinel on your behalf. The service also includes threat intelligence feeds and custom machine learning models | +| [Mandiant MDR for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2202388) | Mandiant, Inc.  | Mandiant Managed Defense protects your business with a managed detection and response (MDR) service fueled by dedicated and frontline IR experts who protect against motivated adversaries with a combination of up-to-the-minute threat intelligence, data science and real-world expertise. Managed Defense helps customers optimize investments in Microsoft technology, maximize resources and accelerate investigations. | +| [MDR for Microsoft](https://go.microsoft.com/fwlink/?linkid=2202762) | Red Canary| 24x7 managed detection, investigation, and response to threats across your Microsoft environment.| +| [Security Operations & MDR](https://go.microsoft.com/fwlink/?linkid=2202843)  | BDO| BDO’s Security Operations Center (SOC) provides continuous detection, protection and response for organizations globally. BDO MDR is like having eyes where you don’t. It's modern technology and experts make hunting, detecting and responding one less thing to keep up with. Because they have eyes where we don’t.  | +| [DXC Managed Endpoint Threat Detection and Response](https://go.microsoft.com/fwlink/?linkid=2202580) | DXC| DXC Managed Endpoint Threat Detection and Response gives your organization the capability to successfully detect and respond to threats in your environment. Powered by Microsoft’s Defender for Endpoint and DXC Technology security experts with unparalleled knowledge of global threats,  | +| [BlueVoyant MDR for Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2202673) | BlueVoyant| BlueVoyant’s MDR (Managed Detection and Response) for Microsoft 365 Defender combines the power of Microsoft’s Defender product suite with BlueVoyant’s elite 24x7 security operations team to identify, investigate and eradicate today’s most sophisticated and advanced cyberattacks. In addition to MDR, services can include implementation, assessments, training, concierge, third party integrations, and more. | +| [White Hat Managed Security Services](https://go.microsoft.com/fwlink/?linkid=2202391)  | White Hat IT Security  | White Hat MSS offers zero trust approach to managed security on every platform – scalable and adaptive security from true experts.| +| [Taegis XDR](https://go.microsoft.com/fwlink/?linkid=2202848)| Secureworks | Taegis™ ManagedXDR is Secureworks® 24x7 managed detection and response service, which helps you detect advanced threats and take the right action. Included threat hunting and incident response capabilities help you scale your security operations as Secureworks uses threat data collected across thousands of customers to improve your security posture. Secureworks' combination of proprietary security analytics software, SecOps expertise, incident response and threat hunting experience, threat intelligence capabilities, and 20-year history of service excellence helps reduce risk to your business.  | +| [Cloud Control - Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202678)   | The Collective | The Collective's Cloud Control Managed Protection, Detection and Response services is an enterprise grade managed service, delivering true Security Operations Center-as-a-Service (SOC) experience with a personal touch. | +| [dinext. pi-SOC](https://go.microsoft.com/fwlink/?linkid=2202581)| dinext AG| Through a close integration of deployment support, security operations and consulting in hardening and architectural improvements, it accompanies customers holistically on their way to a modern security environment. | +| [Managed Microsoft XDR](https://go.microsoft.com/fwlink/?linkid=2202846) | Quorum Cyber | Quorum Cyber’s Managed Microsoft XDR, a solution designed to enable customers to unleash the power of Microsoft security to reduce cyber risk and maximize return of investment in security. | +| [SepagoSOC](https://go.microsoft.com/fwlink/?linkid=2202677) | Sepago GmbH | SepagoSOC experts ensure that your environment is constantly monitored and protected utilizing the complete range of Microsoft 365 Defender solutions and Microsoft Sentinel. They help you to constantly evolve your security landscape with both technical and organizational experience.| +|[SecureShield365](https://go.microsoft.com/fwlink/?linkid=2209718)| Patriot Consulting | SecureShield365 includes a full deployment of all Microsoft 365 Defender products including Intune plus 12 months of support. Microsoft XDR including Sentinel, Defender for Cloud, and MDR are available options.| +|[Open Systems MDR+](https://go.microsoft.com/fwlink/?linkid=2208895) | Open Systems| Built for Microsoft security customers, MDR+ combines certified experts, exemplary processes, and seamless technology to deliver tailored, 24×7 protection while reducing attack surfaces and MTTR.| ++## Educate ++Mature and maintain your internal team’s security capabilities to prevent, detect, contain, and remediate threats. ++| Service name | Vendor | Description| +| | -- | -- | +| [CRITICALSTART® Cybersecurity Advisory +| [Chief 365 Defender](https://go.microsoft.com/fwlink/?linkid=2202584) | Onevinn | This course is aimed at IT security professionals and IT architects who want to get "Best Practices From the Field" within Microsoft 365 security and management of the Microsoft 365 Defender security suite.| +| [Onevinn Chief Hunter](https://go.microsoft.com/fwlink/?linkid=2202584) | Onevinn | Onevinn Chief Hunter is a detection training on how to build proper detection in Microsoft Sentinel together with Microsoft 365 Defender.  | +| [Defend Against Threats with SIEM Plus XDR](https://go.microsoft.com/fwlink/?linkid=2202479)  | Netrix | Enable customers with visibility into immediate threats across email, identity & data & how Microsoft Sentinel & Defender detect & quickly stop active threats| +| [Defend Against Threats with SIEM Plus XDR Workshop](https://go.microsoft.com/fwlink/?linkid=2202479)| Netrix | Organizations today are managing a growing volume of data and alerts while dealing with tight budgets and vulnerable legacy systems. Get help achieving your broader security objectives—and identify current and real threats—by scheduling a Defend Against Threats with SIEM Plus XDR Workshop | +| [Secure Multi-Cloud Environments Workshop](https://go.microsoft.com/fwlink/?linkid=2202479)  | Netrix | As the use of cloud services continues to grow, cyber risks and threats continue to evolve. Get help achieving your hybrid and multi-cloud security objectives—and identify current and real threats—by scheduling a Secure Multi-Cloud Environments Workshop. | +| [Mitigate Compliance & Privacy Risks Workshop](https://go.microsoft.com/fwlink/?linkid=2202479)| Netrix | As your business-critical data expands and your workforce shifts to remote work, having an integrated approach that can help quickly identify, triage, and act on risky insider user activity is more important than ever. The Mitigate Compliance & Privacy Risks Workshop gives you the insights you need to understand insider and privacy risks in your organization. | +| [Secure Identities & Access Workshop](https://go.microsoft.com/fwlink/?linkid=2202479)  | Netrix | Given the complexity of identities, data, applications, and devices, it’s essential to learn how to ensure the right people are accessing the right information, securely. In this workshop, we’ll show you how identity is the fundamental pillars of an integrated security philosophy and end-to-end security strategy. | +| [Microsoft 365 Defender Professional Services](https://go.microsoft.com/fwlink/?linkid=2202675)   | Netwoven | Consulting and deployment services for the Defender suite | +| [Wortell Protect](https://go.microsoft.com/fwlink/?linkid=2202480) | Wortell | Wortell offers a 24.7.365 Managed Detection and Response service, SOC-as-a-service, to secure your Azure subscriptions and Microsoft 365 environment. With this managed service, Wortell will provide security monitoring and incident response, and operate Microsoft Defender and (optionally) Microsoft Sentinel on your behalf. The service also includes threat intelligence feeds and custom machine learning models | +| [Mandiant MDR for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2202388)| Mandiant, Inc.  | Mandiant Managed Defense protects your business with a managed detection and response (MDR) service fueled by dedicated and frontline IR experts who protect against motivated adversaries with a combination of up-to-the-minute threat intelligence, data science and real-world expertise. Managed Defense helps customers optimize investments in Microsoft technology, maximize resources and accelerate investigations.  | +| [BlueVoyant MDR for Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2202673)| BlueVoyant| BlueVoyant’s MDR (Managed Detection and Response) for Microsoft 365 Defender combines the power of Microsoft’s Defender product suite with BlueVoyant’s elite 24x7 security operations team to identify, investigate and eradicate today’s most sophisticated and advanced cyberattacks. In addition to MDR, services can include implementation, assessments, training, concierge, third party integrations, and more. | +| [White Hat Managed Security Services](https://go.microsoft.com/fwlink/?linkid=2202391)  | White Hat IT Security  | White Hat MSS offers zero trust approach to managed security on every platform – scalable and adaptive security from true experts. | +| [Cloud Control - Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202678)  | The Collective | The Collective's Cloud Control Managed Protection, Detection and Response services is an enterprise grade managed service, delivering true Security Operations Center-as-a-Service (SOC) experience with a personal touch. | +| [Synergy Advisors Teams App](https://go.microsoft.com/fwlink/?linkid=2202392) | Synergy Advisors LLC | E-Visor Teams App is a centralized place to involve and empower your end-users in the security and productivity of the organization by presenting unique information using data from Microsoft Defenders and Azure Active Directory while ensuring identity governance, and compliance.| +| [Managed Microsoft XDR](https://go.microsoft.com/fwlink/?linkid=2202846)  | Quorum Cyber | Quorum Cyber’s Managed Microsoft XDR, a solution designed to enable customers to unleash the power of Microsoft security to reduce cyber risk and maximize return of investment in security. | +|[SecureShield365](https://go.microsoft.com/fwlink/?linkid=2209718)| Patriot Consulting | SecureShield365 includes a full deployment of all Microsoft 365 Defender products including Intune plus 12 months of support. Microsoft XDR including Sentinel, Defender for Cloud, and MDR are available options.| ++## Related topics ++- [Configure managed service security provider integration](configure-mssp-support.md) |
| security | Run Analyzer Macos Linux | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/run-analyzer-macos-linux.md | search.appverid: met150 1. Download the [XMDE Client Analyzer](https://aka.ms/XMDEClientAnalyzer) tool to the macOS or Linux machine you need to investigate. > [!NOTE]- > The current SHA256 hash of 'XMDEClientAnalyzer.zip' that is downloaded from the above link is: 'bf102a79626c88fe58b5be3034640835f96f54230292486716d72f515875966c'. + > The current SHA256 hash of 'XMDEClientAnalyzer.zip' that is downloaded from the above link is: 'BF102A79626C88FE58B5BE3034640835F96F54230292486716D72F515875966C' 2. Extract the contents of XMDEClientAnalyzer.zip on the machine. Open a terminal or SSH into the relevant machine and run the following commands: > - In addition, the tool currently requires Python version 3 or later to be installed. > > - If you are running on a machine that cannot use Python 3 or fetch the lxml component, then you can download a binary based version of the analyzer that does not have any of the requirements: [XMDE Client Analyzer Binary](https://aka.ms/XMDEClientAnalyzerBinary). <br> Note that the binary is currently unsigned. To allow the package run on MacOS, you will need to use the syntax: "spctl --add /Path/To/Application.app".-> - The current SHA256 hash of 'XMDEClientAnalyzerBinary.zip' that is downloaded from the above link is: '7FE67373CDF493BF2748FD778BD106EE85A71C968D594BCC67C7374620506EF2' +> - The current SHA256 hash of 'XMDEClientAnalyzerBinary.zip' that is downloaded from the above link is: '6FEB44EF2D9FEB8C8093A016FAB2B5F3ED580931008066BF134E8B1E04CAB222' > > - If your device is behind a proxy, then you can simply pass the proxy server as an environment variable to the mde_support_tool.sh script. For example: > `https_proxy=https://myproxy.contoso.com:8080 ./mde_support_tool.sh"` |
| security | Technological Partners | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/technological-partners.md | + + Title: Technological partners of Microsoft 365 Defender ++description: View technological partners of M365 Defender to enhance detection, investigation, and threat intelligence capabilities of the platform. +keywords: partners, technological partner, applications, third-party, SIEM, threat intelligence, sentinel, SOAR, cross platform, m365 integrations, dns security, network protection ++ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++++search.appverid: met150 +++# Technological partners of Microsoft 365 Defender ++**Applies to:** ++- Microsoft 365 Defender +- Microsoft Defender for Endpoint +- Microsoft Defender for Vulnerability Management +- Microsoft Defender for Office 365 +- Microsoft Defender for Identity +- Microsoft Defender for Cloud Apps ++Microsoft 365 Defender supports third-party integrations to help secure users with effective threat protection, detection, investigation, and response, in various security fields of endpoints, vulnerability management, email, identities, cloud apps. ++The following are the solution’s categories: ++- Security information and event management (SIEM) +- Security orchestration, automation, and response (SOAR) +- Breach and attack simulation (BAS) +- Threat intelligence +- Network security/ DNS security +- Identity security +- Cross platform +- Business cloud applications +- Threat and vulnerability management +- Secure service edge +- Additional integrations ++## Supported integrations and partners ++### Security information and event management (SIEM) ++| Product name | Vendor | Description | +| ||| +| [Microsoft Sentinel](/azure/sentinel/microsoft-365-defender-sentinel-integration) | Microsoft| Microsoft Sentinel is a scalable, cloud-native, security information and event management (SIEM) and security orchestration, automation, and response (SOAR) solution. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for attack detection, threat visibility, proactive hunting, and threat response. | +| [Splunk](https://go.microsoft.com/fwlink/?linkid=2201963) | Splunk | The Microsoft Defender for Endpoint Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk.| +| [ArcSight](https://go.microsoft.com/fwlink/?linkid=2202142)| Micro Focus | ArcSight allows multiple analytics capabilities for correlation, search, UEBA, enhanced and automated response, and log management. | +| [Elastic Security](https://go.microsoft.com/fwlink/?linkid=2201772) | Elastic| Elastic Security combines SIEM threat detection features with endpoint prevention and response capabilities in one solution. | +| [IBM Security QRadar SIEM](https://go.microsoft.com/fwlink/?linkid=2201876) | IBM| IBM Security QRadar SIEM enables centralized visibility and intelligent security analytics to detect, investigate and respond to your critical cybersecurity threats. | +| [AttackIQ Platform](https://go.microsoft.com/fwlink/?linkid=2201971)| AttackIQ | AttackIQ Platform validates whether MDE is configured properly by launching continuous attacks safely on production assets.| ++### Security orchestration, automation, and response (SOAR) ++| Product name | Vendor | Description | +| - | - | - | +| [Microsoft Sentinel](https://go.microsoft.com/fwlink/?linkid=2201962)| Microsoft| Microsoft Sentinel is a scalable, cloud-native, security information and event management (SIEM) and security orchestration, automation, and response (SOAR) solution. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for attack detection, threat visibility, proactive hunting, and threat response. | +| [ArcSight](https://go.microsoft.com/fwlink/?linkid=2202142)| Micro Focus  | ArcSight provides multiple analytics capabilities for correlation, search, UEBA, enhanced and automated response, and log management. | +| [Splunk SOAR](https://go.microsoft.com/fwlink/?linkid=2201773) | Splunk | Splunk SOAR orchestrates workflows and automates tasks in seconds to work smarter and respond faster. | +| [Security Incident Response](https://go.microsoft.com/fwlink/?linkid=2201874)| ServiceNow | The ServiceNow® Security Incident Response application tracks the progress of security incidents from discovery and initial analysis, through containment, eradication, and recovery, and into the final post-incident review, knowledge base article creation, and closure.| +| [Swimlane](https://go.microsoft.com/fwlink/?linkid=2202140)| Swimlane Inc | Automates your incident response capabilities with Swimlane (SOAR) and Microsoft Defender.  | +| [InsightConnect](https://go.microsoft.com/fwlink/?linkid=2201877)  | Rapid7 | InsightConnect provides security orchestration, automation and response solution that accelerates incident response and vulnerability management processes. | +| [Demisto, a Palo Alto Networks Company](https://go.microsoft.com/fwlink/?linkid=2201777) | Palo Alto Networks | Demisto integrates with Microsoft Defender for Endpoint to enable security teams to orchestrate and automate endpoint security monitoring, enrichment and response. | ++### Breach and attack simulation (BAS) ++| Product name | Vendor| Description| +| --| -- | -- | +| [SafeBreach](https://go.microsoft.com/fwlink/?linkid=2201775)| SafeBreach| SafeBreach continuously executes attacks, correlates results to help visualize security gaps, and leverages contextual insights to highlight remediation efforts. With its Hacker’s Playbook™, the industry’s most extensive collection of attack data enabled by state-of-the-art threat intelligence research, SafeBreach empowers organizations to get proactive about security with a simple approach that replaces hope with data.  | +| [Extended Security Posture Management (XSPM)](https://go.microsoft.com/fwlink/?linkid=2201771) | Cymulate| Cymulate's Extended Security Posture Management enables companies to challenge, assess, and optimize their cybersecurity posture.  | +| [Vulnerability Control](https://go.microsoft.com/fwlink/?linkid=2201967) | SkyBox| Develops a vulnerability program strategy that accurately analyzes exposure risk across hybrid attack surface and prioritize the remediation. | +| [Attack Path Management](https://go.microsoft.com/fwlink/?linkid=2201774)| XM Cyber| Attack Path Management is a hybrid cloud security company providing attack path management changing the ways organizations approach cyber risk.  | +| [Better Mobile Security Platform](https://go.microsoft.com/fwlink/?linkid=2202043) | Better Mobile Security Inc. | Provides solution for Threat, Phishing and Privacy Protection and Simulation. | ++### Threat intelligence ++| Product name | Vendor | Description| +| - | - | | +| [ArcSight](https://go.microsoft.com/fwlink/?linkid=2202142)| Micro Focus  | Provides multiple analytics capabilities for correlation, search, UEBA, enhanced and automated response, and log management.  | +| [MineMeld](https://go.microsoft.com/fwlink/?linkid=2202044)| Palo Alto Networks | Enriches your endpoint protection by extending Autofocus and other threat feeds to Microsoft Defender for Endpoint using MineMeld. | +| [MISP (Malware Information Sharing Platform)](https://go.microsoft.com/fwlink/?linkid=2202247) | MISP | Integrates threat indicators from the Open Source Threat Intelligence Sharing Platform into your Microsoft Defender for Endpoint environment. | +| [ThreatConnect](https://go.microsoft.com/fwlink/?linkid=2202246) | ThreatConnect| Alerts and/or blocks on custom threat intelligence from ThreatConnect Playbooks using Microsoft Defender for Endpoint indicators.| ++### Network security/ DNS security ++| Product name | Vendor | Description| +| | - | - | +| [Aruba ClearPass Policy Manager](https://go.microsoft.com/fwlink/?linkid=2201878)| Aruba, a Hewlett Packard Enterprise company  | Network Access Control applies consistent policies and granular security controls to wired and wireless networks | +| [Vectra Network Detection and Response (NDR)](https://go.microsoft.com/fwlink/?linkid=2201969) | Vectra | Vectra applies AI & security research to detect and respond to cyber-attacks in real time. | +| [Blue Hexagon for Network](https://go.microsoft.com/fwlink/?linkid=2201780)| Blue Hexagon | Blue Hexagon has built the industry's first real-time deep learning platform for network threat protection.| +| [CyberMDX](https://go.microsoft.com/fwlink/?linkid=2201880)| CyberMDX | Cyber MDX integrates comprehensive healthcare assets visibility, threat prevention and repose into your Microsoft Defender for Endpoint environment. | +| [HYAS Protect](https://www.hyas.com/hyas-protect) | HYAS | HYAS Protect utilizes authoritative knowledge of attacker infrastructure to proactively protect MDE endpoints from cyber attacks. | +| [Better Mobile Security Platform](https://go.microsoft.com/fwlink/?linkid=2202043) | Better Mobile Security Inc.| Provides solution for Threat, Phishing and Privacy Protection and Simulation. | +| [Vulnerability Control](https://go.microsoft.com/fwlink/?linkid=2201965) | Skybox security| Global security posture management leader with solutions for vulnerability management and network security policy management.  | +| [Open NDR](https://go.microsoft.com/fwlink/?linkid=2201964)| Corelight| Augment device inventory in Microsoft 365 Defender with network evidence for complete visibility.  | ++### Identity security ++| Product name| Vendor | Description| +| - | | - | +| [Illusive Platform](https://go.microsoft.com/fwlink/?linkid=2201778)  | Illusive Networks  | Illusive continuously discovers and automatically remediates identity vulnerabilities, and it detects attacks using deceptive controls.  | +| [Silverfort](https://go.microsoft.com/fwlink/?linkid=2201873) | Silverfort | Enforces Azure AD Conditional Access and MFA across any user system and environment on-prem and in the cloud.  | ++### Cross platform ++| Product name | Vendor | Description | +| - | - | | +| [Corrata Mobile Security](https://go.microsoft.com/fwlink/?linkid=2201879) | Corrata | Corrata is an immune system for mobile devices and tablets that detects & protects mobile devices from the full spectrum of security threats like phishing, malware, man-in-the-middle attacks and data loss. | +| [Better Mobile Security Platform](https://go.microsoft.com/fwlink/?linkid=2202043)  | Better Mobile Security Inc. | Provides solution for Threat, Phishing and Privacy Protection and Simulation.| +| [Zimperium Mobile Threat Defense](https://go.microsoft.com/fwlink/?linkid=2202141)  | Zimperuim | Extends your Microsoft Defender for Endpoint to iOS and Android with Machine Learning-based Mobile Threat Defense. | +| [Bitdefender](https://go.microsoft.com/fwlink/?linkid=2201968)  | Bitdefender  | Bitdefender GravityZone is a layered next generation endpoint protection platform offering comprehensive protection against the full spectrum of sophisticated cyber threats. | ++### Business cloud applications ++| Product name | Vendor | Description| +| - | | --| +| [Atlassian](https://go.microsoft.com/fwlink/?linkid=2202039)| Atlassian | Atlassian provides collaboration, development, and issue tracking software for teams. | +| [Azure](https://go.microsoft.com/fwlink/?linkid=2202040) | Microsoft | Microsoft Azure provides tools and services to help you reach and scale to a global audience with cloud gaming services. | +| [AWS](https://go.microsoft.com/fwlink/?linkid=2202041)| Amazon | Amazon Web Services provides information technology infrastructure services to businesses in the form of web services. | +| [Box](https://go.microsoft.com/fwlink/?linkid=2202042)| Box | Box is an online file sharing and cloud content management service offering unlimited storage, custom branding, and administrative controls. | +| [DocuSign](https://go.microsoft.com/fwlink/?linkid=2201767) | DocuSign| DocuSign is an Electronic Signature and Agreement Cloud enabling employees to securely send, sign and manage agreements. | +| [Dropbox](https://go.microsoft.com/fwlink/?linkid=2202139) | Dropbox| Dropbox is a smart workspace company that provides secure file sharing, collaboration, and storage solutions. | +| [Egnyte](https://go.microsoft.com/fwlink/?linkid=2201956) | Egnyte | Egnyte delivers secure content collaboration, compliant data protection and simple infrastructure modernization. | +| [GITHUB](https://go.microsoft.com/fwlink/?linkid=2201957) | Microsoft | GitHub is a code hosting platform for collaboration and version control. It allows developers to work together on their projects right from planning and coding to shipping the software. | +| [Google Workspace](https://go.microsoft.com/fwlink/?linkid=2201958)| Alphabet| Google Workspace plans provide a custom email for your business and includes collaboration tools like Gmail, Calendar, Meet, Chat, Drive, Docs, Sheets, Slides, Forms, Sites, and more. | +| [Google Cloud Platform](https://go.microsoft.com/fwlink/?linkid=2202244) | Alphabet| Google Cloud Platform is a set of modular cloud-based services that allows you to create anything from simple websites to complex applications.| +| [NetDocuments](https://go.microsoft.com/fwlink/?linkid=2201768) | NetDocuments | NetDocuments enables businesses of all sizes to create, secure, manage, access, and collaborate on documents and email anywhere, anytime. | +| [Office 365](https://go.microsoft.com/fwlink/?linkid=2201959) | Microsoft | Microsoft Office 365 is a subscription-based online office and software services suite, which offers access to various services and software built around the Microsoft Office platform. | +| [OKTA](https://go.microsoft.com/fwlink/?linkid=2201867)| OKTA | Okta is a management platform that secures critical resources from cloud to ground for workforce and customers. | +| [OneLogin](https://go.microsoft.com/fwlink/?linkid=2201868) | OneLogin| OneLogin is a cloud identity and access management solution that enables enterprises to secure all apps for their users on all devices. | +| [Salesforce](https://go.microsoft.com/fwlink/?linkid=2201869) | Salesforce | Salesforce is a global cloud computing company that offers customer relationship management (CRM) software & cloud computing for businesses of all sizes. | +| [ServiceNow](https://go.microsoft.com/fwlink/?linkid=2201769) | ServiceNow | ServiceNow provides cloud-based solutions that define, structure, manage, and automate services for enterprise operations. | +| [Slack](https://go.microsoft.com/fwlink/?linkid=2201870) | Slack| Slack is an enterprise software platform that allows teams and businesses of all sizes to communicate effectively. | +| [SmartSheet](https://go.microsoft.com/fwlink/?linkid=2201871) | SmartSheet | Smartsheet is a cloud-based work management platform that empowers collaboration, drives better decision making, and accelerates innovation. | +| [Webex](https://go.microsoft.com/fwlink/?linkid=2201872) | Cisco| Webex, a Cisco company, provides on-demand applications for businesses to conduct web conferencing, telework and application remote control. | +| [Workday](https://go.microsoft.com/fwlink/?linkid=2201960) | Workday| Workday offers enterprise-level software solutions for human resource and financial management.| +| [Zendesk](https://go.microsoft.com/fwlink/?linkid=2201961) | Zendesk| Zendesk is a customer service platform that develops software to empower organization and customer relationships.| ++### Threat and vulnerability management ++| Product name| Vendor | Description | +| | -- | -- | +| [Attack Path Management](https://go.microsoft.com/fwlink/?linkid=2201774) | XM Cyber| Hybrid cloud security company providing attack path management changing the ways organizations approach cyber risk.  | +| [Corrata Mobile Security](https://go.microsoft.com/fwlink/?linkid=2201879) | Corrata | Corrata is an immune system for mobile devices and tablets that detects & protects mobile devices from the full spectrum of security threats like phishing, malware, man-in-the-middle attacks and data loss.  | +| [Zimperium Mobile Threat Defense](https://go.microsoft.com/fwlink/?linkid=2202141)  | Zimperuim| Extend your Microsoft Defender for Endpoint to iOS and Android with Machine Learning-based Mobile Threat Defense.  | +| [RiskAnalyzer](https://go.microsoft.com/fwlink/?linkid=2202245)   | DeepSurface Security  | DeepSurface RiskAnalyzer helps quickly and efficiently discover, analyze and prioritize cybersecurity risk  | +| [Vulnerability Control](https://go.microsoft.com/fwlink/?linkid=2201965)| Skybox security| Global security posture management leader with solutions for vulnerability management and network security policy management.  | +| [Vulcan Cyber risk management platform](https://go.microsoft.com/fwlink/?linkid=2201770)  | Vulcan Cyber  | Vulcan Cyber gives you the tools to effectively manage the vulnerability and risk lifecycle for all your cyber assets, including application, cloud, and infrastructure.  | +| [Extended Security Posture Management (XSPM)](https://go.microsoft.com/fwlink/?linkid=2201771) | Cymulate| Cymulate's Extended Security Posture Management enables companies to challenge, assess, and optimize their cybersecurity posture. | +| [Illusive Platform](https://go.microsoft.com/fwlink/?linkid=2201778)  | Illusive Networks  | Illusive continuously discovers and automatically remediates identity vulnerabilities, and it detects attacks using deceptive controls. | ++### Secure service edge ++| Product name | Vendor | Description | +| | - | | +| [Zscaler Internet Access](https://go.microsoft.com/fwlink/?linkid=2201779)  | Zscaler | Zscaler Internet Access is a cloud native security service edge (SSE) solution that builds on a decade of secure web gateway leadership. Offered as a scalable SaaS platform from the world’s largest security cloud, it replaces legacy network security solutions to stop advanced attacks and prevent data loss with a comprehensive zero trust approach. | ++### Additional integrations ++| Product name | Vendor | Description | +| - | | -- | +| [Morphisec](https://go.microsoft.com/fwlink/?linkid=2201966) | Morphisec | Provides Moving Target Defense-powered advanced threat prevention and integrates forensics data directly into WD Security Center dashboards to help prioritize alerts, determine device at-risk score and visualize full attack timeline including internal memory information. | +| [THOR Cloud](https://go.microsoft.com/fwlink/?linkid=2201875) | Nextron systems | Provides on-demand live forensics scans using a signature base focused on persistent threats.  | ++## Recommended content ++- [Connect apps to get visibility and control | Microsoft Docs](/defender-cloud-apps/enable-instant-visibility-protection-and-governance-actions-for-your-apps) +- [Partner applications in Microsoft Defender for Endpoint | Microsoft Docs](partner-applications.md) |
| security | Configure Global Settings For Safe Links | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-global-settings-for-safe-links.md | To verify that you've successfully configured the global settings for Safe Links - In Exchange Online PowerShell or Exchange Online Protection PowerShell, run the following command and verify the settings: ```powershell- Get-AtpPolicyForO365 | Format-List BlockUrls,EnableSafeLinksForO365Clients,AllowClickThrough,TrackClicks + Get-AtpPolicyForO365 | Format-List BlockUrls ``` For detailed syntax and parameter information, see [Get-AtpPolicyForO365](/powershell/module/exchange/get-atppolicyforo365). |
| security | Trial Playbook Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/trial-playbook-defender-for-office-365.md | Title: "Microsoft Defender for Office 365 trial playbook" + Title: "Microsoft Defender for Office 365 trial user guide" f1.keywords: - NOCSH audience: Admin ms.localizationpriority: high- search.appverid: - MOE150 - MET150-description: "Microsoft Defender for Office 365 solutions trial playbook." +description: "Microsoft Defender for Office 365 solutions trial user guide." -# Trial playbook: Microsoft Defender for Office 365 +# Trial user guide: Microsoft Defender for Office 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -Welcome to the Microsoft Defender for Office 365 trial playbook! This playbook will help you make the most of your 90-day free trial by teaching you how to safeguard your organization with Defender for Office 365. +Welcome to the Microsoft Defender for Office 365 trial user guide! This user guide will help you make the most of your free trial by teaching you how to safeguard your organization against malicious threats posed by email messages, links (URLs), and collaboration tools. -Now you have the option to try Defender for Office 365 in one of two ways: +## What is Defender for Office 365? -- **Blocking mode (recommended)**: If your mail exchanger (MX) record points to Microsoft 365, you can evaluate Defender for Office 365 capabilities in blocking mode. Defender for Office 365 automatically applies the Standard [preset security policy](preset-security-policies.md) settings.+Defender for Office 365 helps organizations secure their enterprise by offering a comprehensive slate of capabilities including threat protection policies, reports, threat investigation and response capabilities and automated investigation and response capabilities. - Throughout the evaluation period, you can choose at any time to opt into a higher protection template (our Strict preset security policy settings), or you create your own individual protection policies to suits your needs. -- **Audit mode**: If your MX record points somewhere other than to Microsoft 365 (for example, a third-party email gateway), you can evaluate Defender for Office 365 in audit mode. Defender for Office 365 will not take blocking action on messages that we determine to be harmful.+In addition to the detection of advanced threats, the following video shows how the SecOps capabilities of Defender for Office 365 can help your team respond to threats: - These threats will be logged and available for your review through the [Threat protection status report](view-email-security-reports.md#threat-protection-status-report), which gives you detailed information on the types of detected threats, who the threats were targeting, and much more. These additional "catches" indicate the additional protection capabilities of Defender for Office 365 over the standard Exchange Online Protection (EOP) capabilities, or the capabilities of other third-party email gateways. Once you're satisfied and are ready to use Defender for Office 365, you can [migrate to Defender for Office 365](migrate-to-defender-for-office-365.md). +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWMmIe] +### Audit mode vs. blocking mode for Defender for Office 365 -Using the recommendations in this guide, you'll learn how Defender for Office 365 can help you define protection policies, analyze threats to your organization, and respond to attacks. +Do you want your Defender for Office 365 experience to be active or passive? These are the two modes that you can select from: ++- **Audit mode**: Special *evaluation policies* are created for anti-phishing (which includes impersonation protection), Safe Attachments, and Safe Links. These evaluation policies are configured to *detect* threats only. Defender for Office 365 detects harmful messages for reporting, but the messages aren't acted upon (for example, detected messages aren't quarantined). The settings of these evaluation policies are described in the [Policies in audit mode](try-microsoft-defender-for-office-365.md#policies-in-audit-mode) section later in this article. ++ Audit mode provides access to customized reports for threats detected by Defender for Office 365 on the **Evaluation mode** page at <https://security.microsoft.com/atpEvaluation>. ++- **Blocking mode**: The Standard template for [preset security policies](preset-security-policies.md) is turned on and used for the trial, and the users you specify to include in the trial are added to the Standard preset security policy. Defender for Office 365 *detects* and *takes action on* harmful messages (for example, detected messages are quarantined). ++ The default and recommended selection is to scope these Defender for Office 365 policies to all users in the organization. But during or after the setup of your trial, you can change the policy assignment to specific users, groups, or email domains in the Microsoft 365 Defender portal or in [Policy settings associated with Defender for Office 365 trials](try-microsoft-defender-for-office-365.md#policy-settings-associated-with-defender-for-office-365-trials) ++ Blocking mode does not provide customized reports for threats detected by Defender for Office 365. Instead, the information is available in the regular reports and investigation features of Defender for Office 365 Plan 2. ++A key factor in audit mode vs. blocking mode is how email is delivered to your Microsoft 365 organization: ++- Mail from the internet flows directly Microsoft 365, but your current subscription has only [Exchange Online Protection (EOP)](exchange-online-protection-overview.md) or [Defender for Office 365 Plan 1](overview.md#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet). ++  ++ In these environments, you can select **audit mode** or **blocking mode**. ++- You're currently using a third-party service or device for email protection of your Microsoft 365 mailboxes. Mail from the internet flows through the protection service before delivery into your Microsoft 365 organization. Microsoft 365 protection is as low as possible (it's never completely off; for example, malware protection is always enforced). ++  ++ In these environments, you can select **audit mode** only. You don't need to change your mail flow (MX records). Let's get started! Watch this video to learn more: [Campaign Views in Microsoft Defender for Office Respond efficiently using Automated investigation and response (AIR) to review, prioritize, and respond to threats. -- [Learn more](automated-investigation-response-office.md) about investigation playbooks.+- [Learn more](automated-investigation-response-office.md) about investigation user guides. - [View details and results](email-analysis-investigations.md) of an investigation. - Eliminate threats by [approving remediation actions](air-remediation-actions.md). |
| whiteboard | Manage Sharing Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-sharing-organizations.md | These changes should take approximately 60 minutes to apply across your tenancy. |Start the whiteboard from a Surface Hub or Microsoft Teams Rooms|Storage: Azure (Whiteboard files will be moved to OneDrive for Business in the future)<br><br>Owner: Meeting participant|Not applicable|In-tenant users: Can initiate, view, and collaborate<br><br>External users: Can view and collaborate during the meeting only<br><br> Shared device accounts: Can view and collaborate during the meeting only| > [!NOTE]->If a Whiteboard is stored in OneDrive and already attached to a meeting, it cannot be initiated on a Surface Hub or Microsoft Teams Rooms device. An authenticated user on another device will need to do so. We plan to enable this functionality in a future release. --+> If a Whiteboard is stored in OneDrive and already attached to a meeting, it cannot be initiated on a Surface Hub or Microsoft Teams Rooms device. An authenticated user on another device will need to do so. We plan to enable this functionality in a future release. ## Add as a tab in Teams channels and chats When you share whiteboards from the web, desktop, or mobile clients, you can cho [Manage data for Whiteboard](manage-data-organizations.md) -[Network requirements for Microsoft Defender of Cloud Apps](https://learn.microsoft.com/defender-cloud-apps/network-requirements) +[Network requirements for Microsoft Defender of Cloud Apps](/defender-cloud-apps/network-requirements) [Deploy Whiteboard on Windows](deploy-on-windows-organizations.md) |