| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| bookings | Bookings Sms | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/bookings-sms.md | With Microsoft Bookings, you can set up SMS text notifications to be sent to the The SMS notifications will include the Teams meeting link for virtual booking appointments. > [!Note]-> We'll be providing unlimited SMS notifications through November 30th 2022, for customers with Bookings licenses. As we get closer to the end of the promotion period, we'll provide additional details on licensing requirements. Contact your account team or support to receive pricing details after the promotion period. +> We'll be providing unlimited SMS notifications through January 31, 2023 (previously November 30th 2022) for customers with Bookings licenses. As we get closer to the end of the promotion period, we'll provide additional details on licensing requirements. Contact your account team or support to receive pricing details after the promotion period. ## Before you begin You can configure SMS notification in Bookings in a couple of ways: > [!NOTE] > You need to be a Teams admin to see Teams and Bookings data on the Teams admin center. -You can track key data on SMS notifications usage in your organization in the Teams admin center. Usage reports include data such as time and date sent, origin number, message type, event type and delivery status. You can use SMS notification telemetry during the promotional period to help forecast and budget for SMS notifications after November 30, 2022. +You can track key data on SMS notifications usage in your organization in the Teams admin center. Usage reports include data such as time and date sent, origin number, message type, event type and delivery status. You can use SMS notification telemetry during the promotional period to help forecast and budget for SMS notifications after January 31, 2023. 1. On the Teams admin center, **Virtual Visits SMS notifications**. |
| frontline | Flw Choose Scenarios | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/flw-choose-scenarios.md | Last updated 10/28/2022 # Choose your scenarios for Microsoft 365 for frontline workers -Microsoft 365 for frontline workers can help you connect and engage your workforce, enhance workforce management, and increase operational efficiency. There are several solution areas that can help you achieve these goals. Think of Microsoft 365's foundational security and device management capabilities as setting a secure baseline, above which you can build scenarios that enable, empower, and transform your frontline business. You can use the capabilities included with Microsoft 365 for frontline workers, from Microsoft Teams, to SharePoint, Viva Connections, Yammer, and the Power Platform, or add in solutions from our partners in the digital ecosystem to connect with existing systems or create custom solutions for your business. +Microsoft 365 for frontline workers can help you connect and engage your workforce, enhance workforce management, and increase operational efficiency. There are several solution areas that can help you achieve these goals. Think of Microsoft 365's foundational security and device management capabilities as setting a secure baseline, above which you can build scenarios that enable, empower, and transform your frontline business. You can use the capabilities included with Microsoft 365 for frontline workers, from Microsoft Teams, to SharePoint, Viva Connections, Viva Engage, and the Power Platform, or add in solutions from our partners in the digital ecosystem to connect with existing systems or create custom solutions for your business. :::image type="content" source="media/flw-maturity-model.png" alt-text="Digital maturity model for frontline, from enable to empower to transform."::: Watch the following video to see an example of how you can help your frontline w > [!VIDEO https://www.microsoft.com/videoplayer/embed/RWRJVw] - | Scenario | Description | Services | Teams apps | | | | | | | [Team communication and collaboration](flw-team-collaboration.md) | Help your frontline workforce communicate within their store, shift, or team with Microsoft Teams. Viva Connections helps you create a dashboard that puts the information they need front and center on their devices, so they can reach out whenever they need to. | Microsoft Teams<br>Outlook<br>SharePoint<br>Viva Connections<br>Power Platform and Power Apps | Approvals, Chat, Files, Lists, Meet, Praise, Shifts, Tasks, Walkie Talkie |-| [Corporate communications](flw-corp-comms.md) | Employee engagement is a significant contributor to workplace satisfaction, loyalty, and productivity at any organization. Learn how to keep everyone informed and engaged using SharePoint, Teams, Stream, and Yammer. Bring it all together with Viva Connections. | Microsoft Teams<br>Outlook<br>SharePoint<br>Yammer<br>Viva Connections | Meet | --Also see these resources to learn how Yammer can work for your frontline workers: [Yammer Ten Communities](https://aka.ms/Yam10Communities) and [Yammer Lookbook](https://aka.ms/Yammer/Lookbook). +| [Corporate communications](flw-corp-comms.md) | Employee engagement is a significant contributor to workplace satisfaction, loyalty, and productivity at any organization. Learn how to keep everyone informed and engaged using SharePoint, Teams, Stream, and Viva Engage. Bring it all together with Viva Connections. | Microsoft Teams<br>Outlook<br>SharePoint<br>Viva Engage<br>Viva Connections | Meet | ## Wellbeing & engagement Nurture a sense of belonging with your frontline employees by helping them engag | Scenario | Description | Services | Teams apps | | | | | |-| [Engage your employees and focus on employee wellbeing](flw-wellbeing-engagement.md) | Build deeper connections across your organization and create an inclusive workplace. | Microsoft Teams <br>SharePoint <br> Microsoft Stream <br>Viva Connections <br> Yammer| Praise | +| [Engage your employees and focus on employee wellbeing](flw-wellbeing-engagement.md) | Build deeper connections across your organization and create an inclusive workplace. | Microsoft Teams <br>SharePoint <br> Microsoft Stream <br>Viva Connections <br> Viva Engage| Praise | ## Training & onboarding Promote continual growth for your employees and encourage knowledge sharing and | Scenario | Description | Services | Teams apps | | | | | |-| [Onboard new employees](flw-onboarding-training.md) | Make new employee onboarding a great experience by fostering an all-in-one hybrid work environment where new employees can find important resources, meet people in their organization, and prepare to be successful in their new role.| SharePoint<br>Viva Learning <br>Viva Connections <br>Yammer | Lists <br>Live meetings | -| [Ongoing training](flw-onboarding-training.md#ongoing-training) | After they're onboarded, help your workforce keep their skills up to date with ongoing training in Viva Learning. | SharePoint <br>Viva Learning <br>Viva Connections <br>Yammer| | +| [Onboard new employees](flw-onboarding-training.md) | Make new employee onboarding a great experience by fostering an all-in-one hybrid work environment where new employees can find important resources, meet people in their organization, and prepare to be successful in their new role.| SharePoint<br>Viva Learning <br>Viva Connections <br>Viva Engage | Lists <br>Live meetings | +| [Ongoing training](flw-onboarding-training.md#ongoing-training) | After they're onboarded, help your workforce keep their skills up to date with ongoing training in Viva Learning. | SharePoint <br>Viva Learning <br>Viva Connections <br>Viva Engage| | ## Schedule management |
| frontline | Flw Corp Comms | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/flw-corp-comms.md | Title: Corporate communications with frontline workers -description: Learn how you can use Viva Connections and Yammer to connect your frontline team to your broader organization. +description: Learn how you can use Viva Connections and Viva Engage to connect your frontline team to your broader organization. Last updated 09/27/2022 # Corporate communications with frontline workers -Keep your frontline team connected with your broader organization by using Yammer and Viva Connections. +Keep your frontline team connected with your broader organization by using Viva Engage and Viva Connections. ## Connect information from across the organization with Viva Connections Engage and inform workers with Viva Connections. Viva Connections creates a hub in Teams where your frontline team can view a tailored news feed from your organization and a personalized dashboard with resources they need. When employees use Viva Connections, theyΓÇÖre able to get important information faster, meaning that managers donΓÇÖt have to spend valuable time relaying updates. Surface key information, personalized news, tasks, announcements, and other resources on the Viva Connections Dashboard. For example, a retailer could share new product and promotion announcements with their store associates, or a fundraising coordinator for a nonprofit could share quarterly goals with volunteers. -| View for a retail worker |View for a retail manager | +| View for a retail worker |View for a retail manager | | :- | :- |-|  |  | +|  |  | Learn more about [Viva Connections](/sharepoint/viva-connections-overview) and help your employees and associates get started with [Viva Connections in Microsoft Teams](https://support.microsoft.com/office/your-intranet-is-now-in-microsoft-teams-8b4e7f76-f305-49a9-b6d2-09378476f95b). With Microsoft Teams, Viva Connections, and SharePoint, you can enable these sce [Learn more about how to drive communication in your organization](/sharepoint/corporate-communications-overview). -## Connect across your organization with Yammer and Teams +## Connect across your organization with Viva Engage -Engage with communities in Yammer. Communities in Yammer serve the needs of knowledge-sharing, employee experience, company-wide communications, and leadership engagement by providing a central place for your conversations, files, events, and updates. Associates can raise issues, provide feedback, and ask and answer questions in Yammer Communities. Hold live events and town halls to keep everyone in your organization in the loop. +Engage with communities in Viva Engage, which brings the power of Yammer into Teams. Communities in Viva Engage serve the needs of knowledge-sharing, employee experience, company-wide communications, and leadership engagement by providing a central place for your conversations, files, events, and updates. Associates can raise issues, provide feedback, and ask and answer questions in Viva Engage Communities. Hold live events and town halls to keep everyone in your organization in the loop. -You can create yammer communities for individual locations, identity or interest groups, or work groups such as nurses and financial advisors. +You can create communities for individual locations, identity or interest groups, or work groups such as nurses and financial advisors. -Learn how to [add a Yammer page to a Teams channel](https://support.microsoft.com/office/add-a-yammer-page-to-a-teams-channel-ca06ec83-f22d-4b76-83a5-c83aa2a33528) and [join and create a community in Yammer](https://support.microsoft.com/office/join-and-create-a-community-in-yammer-56aaf591-1fbc-4160-ba26-0c4723c23fd6). +Learn more about [Viva Engage](/viva/engage/overview) and help your employees and associates [Get started with Viva Engage](https://support.microsoft.com/topic/getting-started-with-microsoft-viva-engage-729f9fce-3aa6-4478-888c-a1543918c284). -More information about Yammer: +More information about Viva Engage: -- For admins: [Manage Yammer](/yammer)-- For users: [Use Yammer](https://support.microsoft.com/office/what-is-yammer-1b0f3b3e-89ee-4b66-aac5-30def12f287c)+- [Set up Viva Engage for your organization.](/viva/engage/setup) +- [Read the Viva Engage FAQ.](https://support.microsoft.com/topic/frequently-asked-questions-faq-about-microsoft-viva-engage-1209ec6f-b10d-4518-98fd-f33cca5212b8) ## Connect over email with Exchange Online and Outlook |
| frontline | Flw Licensing Options | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/flw-licensing-options.md | With this example, you can mix license types for the two types of workers in you | -- | -- | | Frontline workers need access to information on the go - they have the Office apps on phones or tablets. | Information workers write, edit, and share documents and have Office apps on desktops or laptops, plus mobile apps on phones and tablets. | | Frontline workers communicate on the go with Teams chat, schedule work with Shifts, check off to-do items with Tasks, and track items in Lists, along with other Teams functionality. | Information workers communicate over Teams with chat, meet, and call, and use other Teams apps (depending on the specific license). |-| Frontline workers can find organization-wide resources, communications, or training with SharePoint, OneDrive, Yammer, and Stream. | Information workers create or consume team or organization-wide resources and communications with included Microsoft 365 services (depending on the specific license). | +| Frontline workers can find organization-wide resources, communications, or training with SharePoint, OneDrive, Viva Engage, and Stream. | Information workers create or consume team or organization-wide resources and communications with included Microsoft 365 services (depending on the specific license). | For a detailed comparison of what's included in Microsoft 365 with various licenses, see this [Comparison table](https://go.microsoft.com/fwlink/?linkid=2139145). |
| frontline | Teams For Financial Services | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/teams-for-financial-services.md | Financial services organizations have unique needs due to the high knowledge bas **Key features and apps:** Lists, meetings -**Additional +**Additional More information: [Training and onboarding](flw-onboarding-training.md) ### Strengthen corporate communications -Employee engagement is a significant contributor to workplace satisfaction, loyalty, and productivity at any organization. Learn how to keep everyone informed and engaged using SharePoint, Teams, Yammer, Stream, and Viva Connections. +Employee engagement is a significant contributor to workplace satisfaction, loyalty, and productivity at any organization. Learn how to keep everyone informed and engaged using SharePoint, Teams, Viva Engage, Stream, and Viva Connections. -**Additional +**Additional More information: [Corporate communications with frontline workers](flw-corp-comms.md) For financial services environments, the following apps and services can help yo | SharePoint | A new, connected SharePoint site is created whenever you create a new team. You can use SharePoint to store files, post news, and make sure your workers have access to important information. | [Teams and SharePoint integration](/sharepoint/teams-connected-sites) | [Add a SharePoint page, list, or document library as a tab in Teams](https://support.microsoft.com/office/add-a-sharepoint-page-list-or-document-library-as-a-tab-in-teams-131edef1-455f-4c67-a8ce-efa2ebf25f0b)| | Viva Connections | Viva Connections creates a hub in Teams where your frontline team can view a tailored news feed from your organization and a personalized dashboard with resources they need. | [Overview of Viva Connections](/sharepoint/viva-connections-overview) | [Viva Connections in Microsoft Teams](https://support.microsoft.com/office/your-intranet-is-now-in-microsoft-teams-8b4e7f76-f305-49a9-b6d2-09378476f95b) | | Viva Learning | Provide initial and ongoing training to make sure your employees are up-to-date with their skills and knowledge base. | [Manage Viva Learning](/microsoft-365/learning/) | [Use Viva Learning](https://support.microsoft.com/office/viva-learning-preview-01bfed12-c327-41e0-a68f-7fa527dcc98a) |-| Yammer | Connect your entire organization and enable communication across departments and regions. | [Manage Yammer](/yammer) | [Use Yammer](https://support.microsoft.com/office/what-is-yammer-1b0f3b3e-89ee-4b66-aac5-30def12f287c) | +| Viva Engage | Connect your entire organization and enable communication across departments and regions. | [Overview of Viva Engage](/viva/engage/overview) | [Use Viva Engage](https://support.microsoft.com/topic/getting-started-with-microsoft-viva-engage-729f9fce-3aa6-4478-888c-a1543918c284) | For more about successfully implementing and adopting Teams, see [Adopt Microsoft Teams](/microsoftteams/adopt-microsoft-teams-landing-page). |
| frontline | Teams For Manufacturing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/teams-for-manufacturing.md | Empower your frontline workers to engage with each other and your broader organi **Key apps:** Walkie Talkie, Chat, Praise -**Additional +**Additional More information: [Frontline team collaboration](flw-team-collaboration.md) and [Corporate communications](flw-corp-comms.md) More information: [Simplify business processes](simplify-business-processes.md) Make sure that all your workers have the knowledge and capabilities they need to succeed. -**Additional +**Additional More information: [Training and onboarding](flw-onboarding-training.md) For manufacturing environments, the following apps and services can help you tra | SharePoint | A new, connected SharePoint site is created whenever you create a new team. You can use SharePoint to store files, post news, and make sure your workers have access to important information. | [Teams and SharePoint integration](/sharepoint/teams-connected-sites) | [Add a SharePoint page, list, or document library as a tab in Teams](https://support.microsoft.com/office/add-a-sharepoint-page-list-or-document-library-as-a-tab-in-teams-131edef1-455f-4c67-a8ce-efa2ebf25f0b)| | Viva Connections | Viva Connections creates a hub in Teams where your frontline team can view a tailored news feed from your organization and a personalized dashboard with resources they need. For example, you could create a Manuals card so your operators can find all the necessary manuals easily. | [Overview of Viva Connections](/sharepoint/viva-connections-overview) | [Viva Connections in Microsoft Teams](https://support.microsoft.com/office/your-intranet-is-now-in-microsoft-teams-8b4e7f76-f305-49a9-b6d2-09378476f95b) | | Viva Learning | Provide initial and ongoing training to make sure your employees are up to date with their skills and knowledge base. | [Manage Viva Learning](/microsoft-365/learning/) | [Use Viva Learning](https://support.microsoft.com/office/viva-learning-preview-01bfed12-c327-41e0-a68f-7fa527dcc98a) |-| Yammer | Connect your entire organization and enable communication across plants and regions. | [Manage Yammer](/yammer) | [Use Yammer](https://support.microsoft.com/office/what-is-yammer-1b0f3b3e-89ee-4b66-aac5-30def12f287c) | +| Viva Engage | Connect your entire organization and enable communication across plants and regions. | [Overview of Viva Engage](/viva/engage/overview) | [Use Viva Engage](https://support.microsoft.com/topic/getting-started-with-microsoft-viva-engage-729f9fce-3aa6-4478-888c-a1543918c284) | For more about successfully implementing and adopting Teams, see [Adopt Microsoft Teams](/microsoftteams/adopt-microsoft-teams-landing-page). |
| frontline | Teams For Retail Landing Page | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/teams-for-retail-landing-page.md | Staff members can communicate and collaboration across multiple stores in a regi **Key apps:** Shifts, Walkie Talkie, Tasks, Approvals, Chat, Praise, Lists, Files, Updates -**Additional +**Additional More information: [Frontline team collaboration](flw-team-collaboration.md) More information: [Simplify business processes](simplify-business-processes.md) ### Corporate communications -Employee engagement is a significant contributor to workplace satisfaction, loyalty, and productivity at any organization. Learn how to keep everyone informed and engaged using SharePoint, Teams, Yammer, Stream, and Viva Connections. +Employee engagement is a significant contributor to workplace satisfaction, loyalty, and productivity at any organization. Learn how to keep everyone informed and engaged using SharePoint, Teams, Viva Engage, Stream, and Viva Connections. -**Additional +**Additional More information: [Corporate communications with frontline workers](flw-corp-comms.md) Make new employee onboarding a great experience by fostering an all-in-one hybri **Key apps:** Lists, Live Meetings -**Additional +**Additional More information: [Onboard new employees](flw-onboarding-training.md) For retail environments, the following apps and services can help you transform | SharePoint | When you create a new team, a new SharePoint site is created and connected to the team. Many of the scenarios above rely on SharePoint features already embedded in Teams, such as sharing documents for team collaboration. | [Teams and SharePoint integration](/sharepoint/teams-connected-sites) | [Add a SharePoint page, list, or document library as a tab in Teams](https://support.microsoft.com/office/add-a-sharepoint-page-list-or-document-library-as-a-tab-in-teams-131edef1-455f-4c67-a8ce-efa2ebf25f0b)| | Viva Connections | Viva Connections creates a hub in Teams where your retail associates can view a tailored news feed from your organization and a personalized dashboard with resources they need. | [Overview of Viva Connections](/sharepoint/viva-connections-overview) | [Viva Connections in Microsoft Teams](https://support.microsoft.com/office/your-intranet-is-now-in-microsoft-teams-8b4e7f76-f305-49a9-b6d2-09378476f95b) | | Viva Learning | Provide training when needed, right in the flow of their work. | [Manage Viva Learning](/microsoft-365/learning/) | [Use Viva Learning](https://support.microsoft.com/office/viva-learning-preview-01bfed12-c327-41e0-a68f-7fa527dcc98a) |-| Yammer | Connect your organization and allow communication across departments and regions with Yammer. | [Manage Yammer](/yammer) | [Use Yammer](https://support.microsoft.com/office/what-is-yammer-1b0f3b3e-89ee-4b66-aac5-30def12f287c) | +| Viva Engage | Connect your organization and allow communication across departments and regions with Viva Engage. | [Overview of Viva Engage](/viva/engage/overview) | [Use Viva Engage](https://support.microsoft.com/topic/getting-started-with-microsoft-viva-engage-729f9fce-3aa6-4478-888c-a1543918c284) | ### Retail templates for teams |
| security | Configure Siem | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-siem.md | -> [!IMPORTANT] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. --## Ingest alerts using security information and events management (SIEM) tools --> [!NOTE] -> -> [Microsoft Defender for Endpoint Alert](alerts.md) is composed from one or more suspicious or malicious events that occurred on the device and their related details. The Microsoft Defender for Endpoint Alert API is the latest API for alert consumption and contains a detailed list of related evidence for each alert. For more information, see [Alert methods and properties](alerts.md) and [List alerts](get-alerts.md). --Microsoft Defender for Endpoint supports security information and event management (SIEM) tools ingesting information from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for a registered AAD application representing the specific SIEM solution or connector installed in your environment. --For more information, see: --- [Microsoft Defender for Endpoint APIs license and terms of use](api-terms-of-use.md)-- [Access the Microsoft Defender for Endpoint APIs](apis-intro.md)-- [Hello World example (describes how to register an application in Azure Active Directory)](api-hello-world.md)-- [Get access with application context](exposed-apis-create-app-webapp.md)- ## Use the new Microsoft 365 Defender API for all your alerts > [!IMPORTANT] The below table provides a mapping between the SIEM API to the Microsoft 365 Def | ExternalId | X | Obsolete | | IocUniqueId | X | IoC fields not supported | -For more information, see [Microsoft 365 Defender SIEM integration](../defender/configure-siem-defender.md). +## Ingest alerts using security information and events management (SIEM) tools ++> [!NOTE] +> +> [Microsoft Defender for Endpoint Alert](alerts.md) is composed from one or more suspicious or malicious events that occurred on the device and their related details. The Microsoft Defender for Endpoint Alert API is the latest API for alert consumption and contains a detailed list of related evidence for each alert. For more information, see [Alert methods and properties](alerts.md) and [List alerts](get-alerts.md). ++Microsoft Defender for Endpoint supports security information and event management (SIEM) tools ingesting information from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for a registered AAD application representing the specific SIEM solution or connector installed in your environment. ++For more information, see: ++- [Microsoft Defender for Endpoint APIs license and terms of use](api-terms-of-use.md) +- [Access the Microsoft Defender for Endpoint APIs](apis-intro.md) +- [Hello World example (describes how to register an application in Azure Active Directory)](api-hello-world.md) +- [Get access with application context](exposed-apis-create-app-webapp.md) +- [Microsoft 365 Defender SIEM integration](../defender/configure-siem-defender.md) |
| security | Gov | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/gov.md | Microsoft Defender for Endpoint for US Government customers requires one of the ### Desktop licensing -<br /> --**** - |GCC|GCC High|DoD| |||| |Microsoft 365 GCC G5|Microsoft 365 E5 for GCC High|Microsoft 365 G5 for DOD| Microsoft Defender for Endpoint for US Government customers requires one of the ### Server licensing -<br /> --**** - |GCC|GCC High|DoD| |||| |Microsoft Defender for Endpoint Server GCC|Microsoft Defender for Endpoint Server for GCC High|Microsoft Defender for Endpoint Server for DOD| The following are the Microsoft Defender for Endpoint portal URLs for US Governm <br /> -**** - |Customer type|Portal URL| ||| |GCC|<https://security.microsoft.com>| The following OS versions are supported: <br /> -**** - OS version|GCC|GCC High|DoD :|::|::|:: Windows 11||| iOS| <br /> | < **Footnotes** -<sup>1</sup> The patch must be deployed prior to device onboarding in order to configure Defender for Endpoint to the correct environment. + <sup>1</sup> The patch must be deployed prior to device onboarding in order to configure Defender for Endpoint to the correct environment. -<sup>2</sup> Learn about the [unified modern solution for Windows 2016 and 2012 R2](configure-server-endpoints.md#new-windows-server-2012-r2-and-2016-functionality-in-the-modern-unified-solution). If you have previously onboarded your servers using MMA, follow the guidance provided in [Server migration](server-migration.md) to migrate to the new solution. + <sup>2</sup> Learn about the [unified modern solution for Windows 2016 and 2012 R2](configure-server-endpoints.md#new-windows-server-2012-r2-and-2016-functionality-in-the-modern-unified-solution). If you have previously onboarded your servers using MMA, follow the guidance provided in [Server migration](server-migration.md) to migrate to the new solution. -<sup>3</sup> When using [Microsoft Monitoring Agent](onboard-downlevel.md#install-and-configure-microsoft-monitoring-agent-mma) you'll need to choose "Azure US Government" under "Azure Cloud" if using the [setup wizard](/azure/log-analytics/log-analytics-windows-agents#install-agent-using-setup-wizard), or if using a [command line](/azure/log-analytics/log-analytics-windows-agents#install-agent-using-command-line) or a [script](/azure/log-analytics/log-analytics-windows-agents#install-agent-using-dsc-in-azure-automation) - set the "OPINSIGHTS_WORKSPACE_AZURE_CLOUD_TYPE" parameter to 1. <br /> The minimum MMA supported version is 10.20.18029 (March 2020). + <sup>3</sup> When using [Microsoft Monitoring Agent](onboard-downlevel.md#install-and-configure-microsoft-monitoring-agent-mma) you'll need to choose "Azure US Government" under "Azure Cloud" if using the [setup wizard](/azure/log-analytics/log-analytics-windows-agents#install-agent-using-setup-wizard), or if using a [command line](/azure/log-analytics/log-analytics-windows-agents#install-agent-using-command-line) or a [script](/azure/log-analytics/log-analytics-windows-agents#install-agent-using-dsc-in-azure-automation) - set the "OPINSIGHTS_WORKSPACE_AZURE_CLOUD_TYPE" parameter to 1. </br> + The minimum MMA supported version is 10.20.18029 (March 2020). ### OS versions when using Microsoft Defender for servers The following OS versions are supported when using [Microsoft Defender for serve <br /> -**** - OS version|GCC|GCC High|DoD :|::|::|:: Windows Server 2022||| Instead of the public URIs listed in our [API documentation](apis-intro.md), you <br /> -**** - |Endpoint type|GCC|GCC High & DoD| |||| |Login|`https://login.microsoftonline.com`|`https://login.microsoftonline.us`| Defender for Endpoint for US Government customers doesn't have complete parity w These are the known gaps: -<br /> --**** - |Feature name|GCC|GCC High|DoD|-|-|::|::|::| -|Reports: Web content filtering|||| -|Reports: Device health|||| -|Microsoft Secure Score| <sup>1</sup>||| -|Microsoft Threat Experts|||| +||::|::|::| +|Microsoft Secure Score|||| +|Microsoft Threat Experts|||| **Footnote** -<sup>1</sup> While Microsoft Secure Score is available for GCC customers, there are some security recommendations that aren't available. + <sup>1</sup> While Microsoft Secure Score is available for GCC customers, there are some security recommendations that aren't available. These are the features and known gaps for [Mobile Threat Defense (Microsoft Defender for Endpoint on Android & iOS)](mtd.md): +<br /> + |Feature name|GCC|GCC High|DoD| ||::|::|::|+|Reports: Web content filtering|||| +|Reports: Device health|||| |Web Protection (Anti-Phishing and custom indicators)|||| |Malware Protection (Android-Only)|||| |Jailbreak Detection (iOS-Only)|||| These are the features and known gaps for [Mobile Threat Defense (Microsoft Defe |Support for MAM|||| |Privacy Controls|||| |Microsoft Defender Vulnerability Management (MDVM))||||++ |
| security | Indicator Ip Domain | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/indicator-ip-domain.md | For more information, see [Govern apps discovered by Microsoft Defender for Endp ## IoC IP URL and domain policy conflict handling order -Policy conflict handling follows the below order: +Policy conflict handling for domains/URLs/IP addresses differ from policy conflict handling for certs. ++In the case were multiple different action types are set on the same indicator (for example, **block**, **warn**, and **allow**, action types set for Microsoft.com), the order those action types would take effect is: ++1. Allow +2. Warn +3. Block ++_Allow_ overrides _warn_ which overrides _block_: Allow > Warn > Block. Therefore, in the above example, Microsoft.com would be allowed. ++### Policy conflict handling follows the order below - MDCA creates an unsanctioned indicator for all users but URL is allowed for a specific device group, the specific device group is Blocked access to the URL.-- If the IP, URL/Domain is allowed-- If the IP, URL/Domain is not allowed-- If the IP, URL/Domain is allowed+1. If the IP, URL/Domain is allowed - If the IP, URL/Domain is not allowed - If the IP, URL/Domain is allowed--If there are conflicting file IoC policies with the same enforcement type and target, the policy of the more secure will be applied. --Policy conflict handling for domains/URLs/IP addresses differ from policy conflict handling for Certs. +1. If the IP, URL/Domain is not allowed +1. If the IP, URL/Domain is allowed Threat and vulnerability management's block vulnerable application features uses the file IoCs for enforcement and will follow the above conflict handling order. +If there are conflicting file IoC policies with the same enforcement type and target, the policy of the more secure will be applied. + ## Policy precedence Microsoft Defender for Endpoint policy has precedence over Microsoft Defender Antivirus policy. In situations when Defender for Endpoint is set to **Allow**, but Microsoft Defender Antivirus is set to **Block**, the policy will default to **Allow**. |
| security | Network Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/network-protection.md | For information about network protection for Linux and macOS see: [Network prote If you're using advanced hunting to identify audit events, you'll have up to 30 days history available from the console. See [Advanced hunting](advanced-hunting-overview.md). -You can find the audit data in **Advanced hunting** in the Defender for Endpoint portal ([https://security.microsoft.com](https://security.microsoft.com)). +You can find the audit events in **Advanced hunting** in the Defender for Endpoint portal ([https://security.microsoft.com](https://security.microsoft.com)). -The events are in DeviceEvents with an ActionType of `ExploitGuardNetworkProtectionAudited`. Blocks are shown by `ExploitGuardNetworkProtectionBlocked`. +Audit events are in DeviceEvents with an ActionType of `ExploitGuardNetworkProtectionAudited`. Blocks are shown with an ActionType of `ExploitGuardNetworkProtectionBlocked`. -The following example includes the blocked actions: +Here's an example query for viewing Network Protection events for third-party browsers: ```kusto -DeviceEvents +DeviceNetworkEvents |where ActionType in ('ExploitGuardNetworkProtectionAudited','ExploitGuardNetworkProtectionBlocked') ``` The Response category tells you what caused the event, for example: For more information, see [Troubleshoot endpoint blocks](web-protection-overview.md#troubleshoot-endpoint-blocks). +Note that Microsoft Defender SmartScreen events for the Microsoft Edge browser specifically, needs a different query: ++```kusto ++DeviceEvents +| where ActionType == "SmartScreenUrlWarning" +| extend ParsedFields=parse_json(AdditionalFields) +| project DeviceName, ActionType, Timestamp, RemoteUrl, InitiatingProcessFileName ++``` + You can use the resulting list of URLs and IPs to determine what would have been blocked if the device was in block mode, and which feature blocked them. Review each item on the list to identify URLS or IPs whether any are necessary to your environment. If you find any entries that have been audited which are critical to your environment, create an Indicator to allow them in your network. Allow URL / IP indicators take precedence over any block. Once you've created an indicator, you can look at resolving the underlying issue: You can also use [audit mode](audit-windows-defender.md) to evaluate how network Defender for Endpoint provides detailed reporting into events and blocks as part of its [alert investigation scenarios](investigate-alerts.md). You can view these details in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) in the [alerts queue](review-alerts.md) or by using [advanced hunting](advanced-hunting-overview.md). If you're using [audit mode](audit-windows-defender.md), you can use advanced hunting to see how network protection settings would affect your environment if they were enabled. -Here's an example query for advanced hunting: --```kusto --DeviceNetworkEvents -|where ActionType in ('ExploitGuardNetworkProtectionAudited','ExploitGuardNetworkProtectionBlocked') --``` - ## Review network protection events in Windows Event Viewer You can review the Windows event log to see events that are created when network protection blocks (or audits) access to a malicious IP or domain: |
| security | Troubleshoot Siem | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-siem.md | search.appverid: met150 - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) - > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-pullalerts-abovefoldlink) +> [!NOTE] +> The new Microsoft 365 Defender alerts API, released to public preview in MS Graph, is the official and recommended API for customers migrating from the SIEM API. See [Migrate from the MDE SIEM API to the Microsoft 365 Defender alerts API](configure-siem.md). + You might need to troubleshoot issues while pulling detections in your SIEM tools. This page provides detailed steps to troubleshoot issues you might encounter. This page provides detailed steps to troubleshoot issues you might encounter. If your client secret expires or if you've misplaced the copy provided when you were enabling the SIEM tool application, you'll need to get a new secret. -1. Login to the [Azure management portal](https://portal.azure.com). +1. Log in to the [Azure management portal](https://portal.azure.com). 2. Select **Azure Active Directory**. If your client secret expires or if you've misplaced the copy provided when you If you encounter an error when trying to get a refresh token when using the threat intelligence API or SIEM tools, you'll need to add reply URL for relevant application in Azure Active Directory. -1. Login to the [Azure management portal](https://ms.portal.azure.com). +1. Log in to the [Azure management portal](https://ms.portal.azure.com). 2. Select **Azure Active Directory**. |
| security | Dex Xdr Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/dex-xdr-overview.md | search.appverid: met150 [!INCLUDE [Prerelease](../includes/prerelease.md)] -The **Microsoft Defender Experts for XDR** (Defender Experts for XDR) preview is a managed detection and response service that helps your security operations centers (SOCs) focus and accurately respond to incidents that matter. It provides extended detection and response for customers who use M365 Defender workloads: Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, and Azure Active Directory (Azure AD). +The **Microsoft Defender Experts for XDR** (Defender Experts for XDR) preview is a managed detection and response service that helps your security operations centers (SOCs) focus and accurately respond to incidents that matter. It provides extended detection and response for customers who use Microsoft 365 Defender workloads: Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, and Azure Active Directory (Azure AD). -Defender Experts for XDR augments your SOC with a combination of automation and MicrosoftΓÇÖs security analyst expertise to help you detect and respond to threats with confidence and improve your security posture. With deep product expertise powered by threat intelligence, weΓÇÖre uniquely positioned to help you: +Defender Experts for XDR augments your SOC by combining automation and MicrosoftΓÇÖs security analyst expertise, helping you detect and respond to threats with confidence and improve your security posture. With deep product expertise powered by threat intelligence, weΓÇÖre uniquely positioned to help you: -- **Focus on incidents that matter** - Our experts prioritize incidents and alerts that matter, alleviate alert fatigue, and drive SOC efficiency for your team.-- **Manage response your way** - Our experts provide detailed, step-by-step, actionable guidance to respond to incidents with the option to act on your behalf as needed.-- **Access expertise when you need it** - Extend your teamΓÇÖs capacity with access to Defender Experts for assistance on an investigation.-- **Stay ahead of emerging threats** - Our experts proactively hunt for emerging threats in your environment, informed by unparalleled threat intelligence and visibility.+- **Focus on incidents that matter** - Our experts prioritize incidents and alerts that matter, alleviate alert fatigue, and drive SOC efficiency for your team +- **Manage response your way** - Our experts provide detailed, step-by-step, actionable guidance to respond to incidents with the option to act on your behalf as needed +- **Access expertise when you need it** - Extend your teamΓÇÖs capacity with access to Defender Experts for assistance on an investigation +- **Stay ahead of emerging threats** - Our experts proactively hunt for emerging threats in your environment, informed by unparalleled threat intelligence and visibility In addition to the constantly updated research and intelligence tailored for the threats currently seen across the various Microsoft 365 Defender signals, as part of the preview, youΓÇÖll receive guided response from our security analysts and support from MicrosoftΓÇÖs security-focused service delivery managers (SDMs). In this preview, you can try the service for free and enjoy the following capabilities: -- **Managed detection and response** - Expert analysts manage your Microsoft 365 Defender incident queue and handle triage and investigation on your behalf. Expert analysts partner with you and your team to take action or guide you to respond to incidents.-- **Proactive threat hunting** - [Microsoft Defender Experts for Hunting](../defender/defender-experts-for-hunting.md) is built-in to extend your teamΓÇÖs threat hunting capabilities and prioritize significant threats+- **Managed detection and response** - Expert analysts manage your Microsoft 365 Defender incident queue and handle triage and investigation on your behalf; they partner with you and your team to take action or guide you to respond to incidents +- **Proactive threat hunting** - [Microsoft Defender Experts for Hunting](../defender/defender-experts-for-hunting.md) is built in to extend your teamΓÇÖs threat hunting capabilities and prioritize significant threats - **Live dashboards and reports** - Transparent view of our operations on your behalf and noise free, actionable view into what matters for you coupled with detailed analytics - **Proactive check-ins for continuous security improvements** - Periodic check-ins with your named service delivery team to guide your Defender Experts for XDR experience and improve your security posture In addition to the constantly updated research and intelligence tailored for the To enable us to get started with this managed service, we require the following prerequisites: -- Microsoft Defender for Endpoint P2 must be licensed for devices and users in scope for the preview and Microsoft Defender Antivirus-enabled in active mode and devices onboarded to Defender for Endpoint (required for endpoint detection and response capabilities).-- Azure Active Directory Premium P1 must be licensed for all users and enabled (required for enabling secure service provider access).+- Defender for Endpoint P2 must be licensed for devices and users in scope for the preview and Microsoft Defender Antivirus must be enabled in active mode on devices onboarded to Defender for Endpoint (required for endpoint detection and response capabilities) +- Azure AD Premium P1 must be licensed for all users and enabled (required for enabling secure service provider access) Aside from the requirements stated above, to get Defender Experts for XDR coverage for the following eligible products, you must have their appropriate product licenses: |
| security | Frequently Asked Questions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/frequently-asked-questions.md | search.appverid: met150 | Questions | Answers | |||-| **How is Defender Experts for XDR different from Defender Experts for Hunting?** | Defender Experts for Hunting provides threat hunting service to proactively find threats. This service is meant for customers with a robust security operations center and want that deep expertise in hunting to expose advanced threats. Defender Experts for XDR provides end-to-end security operations capabilities to monitor, investigate and respond to security alerts. This service is meant for customers with constrained security operations centers that are overburdened with alert volume, in need of skilled experts or both. Defender Experts for XDR also includes the proactive threat hunting offered by Defender Experts for Hunting| -| **What products does Defender Experts for XDR operate on?** | Refer to the [Prerequisites](../defender/dex-xdr-overview.md) section for details. | +| **How is Microsoft Defender Experts for XDR different from Microsoft Defender Experts for Hunting?** | [Microsoft Defender Experts for Hunting](../defender/defender-experts-for-hunting.md) provides threat hunting service to proactively find threats. This service is meant for customers that have a robust security operations center and want that deep expertise in hunting to expose advanced threats. Microsoft Defender Experts for XDR provides end-to-end security operations capabilities to monitor, investigate and respond to security alerts. This service is meant for customers with constrained security operations centers that are overburdened with alert volume, in need of skilled experts or both. Defender Experts for XDR also includes the proactive threat hunting offered by Defender Experts for Hunting| +| **What products does Defender Experts for XDR operate on?** | Refer to the [Prerequisites](/microsoft-365/security/defender/dex-xdr-overview#prerequisites) section for details. | | **Is there a minimum criteria or size requirements to get Defender Experts for XDR?** | Not in preview. We'll evaluate and provide these requirements as part of our general availability. |-| **Does Defender Experts for XDR replace by Security Operations Center (SOC) team?** | No. Defender Experts for XDR are meant to augment your SOC team reducing their workload and collaborating with them to protect your organization from threat actors. But we don't replace your SOC team or their processes. | -| **What actions can XDR experts take during incident investigation?** | Our expert analysts can take actions based on the roles granted to them in your Microsoft 365 Defender portal. If our analysts are granted a security reader role, they can investigate and provide guided response for your SOC team to act on. If our analysts are granted a security operator role, they can also take specific remediation actions agreed upon with your SOC team. And finally, if they are granted a security administrator role, they can take higher privilege actions like managing certain settings as agreed upon with you. | +| **Does Defender Experts for XDR replace my security operations center (SOC) team?** | No. Defender Experts for XDR is meant to augment your SOC team reducing their workload and collaborating with them to protect your organization from threat actors. But we don't replace your SOC team or their processes. | +| **What actions can XDR experts take during incident investigation?** | Our expert analysts can take actions based on the roles granted to them in your Microsoft 365 Defender portal. If our analysts are granted a security reader role, they can investigate and provide guided response for your SOC team to act on. If our analysts are granted a security operator role, they can also take specific remediation actions agreed upon with your SOC team. Finally, if they're granted a security administrator role, they can take higher privilege actions like managing certain settings as agreed upon with you. | | **Can XDR experts help me improve my security posture?** | Yes, we'll provide necessary guidance before and during the preview to improve your security posture. |-| **Can Defender Experts for XDR help with an active compromise or vulnerability?** | No, Defender Experts do not provide Incident Response services currently. Contact your Microsoft representative to engage Microsoft Detection and Response Team (DART) for incident response assistance | -| **How can my organization participate in the Defender Experts for XDR preview?** |We're gradually expanding the preview to more customers. Please contact your Microsoft representative to access the preview.| +| **Can Defender Experts for XDR help with an active compromise or vulnerability?** | No, Defender Experts currently don't provide incident response services. Contact your Microsoft representative to engage Microsoft Detection and Response Team (DART) for incident response assistance. | +| **How can my organization participate in the Defender Experts for XDR preview?** |We're gradually expanding the preview to more customers. Contact your Microsoft representative to access the preview.| | **When will Defender Experts for XDR be generally available?** | We'll announce general availability dates closer to the launch date. | |
| security | Get Started Xdr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/get-started-xdr.md | Once the Defender Experts for XDR team is ready to onboard you, weΓÇÖll reach ou By default, Defender Experts for XDR require the following permissions to investigate incidents and notify you when you need to take action: - **Service provider access** - This permission lets our experts sign in to your tenant and deliver services based on assigned security roles. For details [learn more about cross-tenant access](/azure/active-directory/external-identities/cross-tenant-access-overview).-- **Security reader** - This built-in Azure AD role lets our experts investigate incidents and provide guidance on necessary response actions.+- **Security reader** - This built-in Azure Active Directory (Azure AD) role lets our experts investigate incidents and provide guidance on necessary response actions. -You can also provide our experts the following additional permissions to investigate incidents on your behalf: +You can also provide our experts the following permissions to investigate incidents on your behalf: - **Security operator** (recommended) - In addition to the permissions provided to a security reader, this built-in Azure AD role lets our experts take necessary actions to remediate active threats. - **Security administrator** (optimal) - In addition to the permissions provided to a security operator, this built-in Azure AD role lets our experts configure security settings and deploy preventive measures. You can also provide our experts the following additional permissions to investi Follow these steps to grant our experts additional permissions: 1. In the same Defender Experts setting page mentioned earlier, select **Manage permissions**.-2. Under **Additional permissions**, select the additional role(s) you want to grant. +2. Under **Additional permissions**, select the other role(s) you want to grant. 3. Select **Give access**. > [!IMPORTANT] |
| security | Start Using Mdex Xdr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/start-using-mdex-xdr.md | search.appverid: met150 ## Run initial Defender readiness checks -Apart from onboarding service delivery, our expertise on the Microsoft 365 Defender product suite enables Defender Experts for XDR to run an initial readiness engagement to help you get the most out of your Microsoft security products. This engagement will be based on your [Microsoft Secure Score](microsoft-secure-score.md) and Defender ExpertsΓÇÖ policy recommendations. Our Experts will assist in prioritizing and customizing our recommendations to fit your environment. They will request your engagement to get those configurations implemented. +Apart from , our expertise on the Microsoft 365 Defender product suite enables Defender Experts for XDR to run an initial readiness engagement to help you get the most out of your Microsoft security products. This engagement will be based on your [Microsoft Secure Score](microsoft-secure-score.md) and Defender ExpertsΓÇÖ policy recommendations. Our Experts will help prioritizing and customizing our recommendations to fit your environment. They'll request your engagement to get those configurations implemented. ## Managed detection and response -Through a combination of automation and human expertise, our service triages Microsoft 365 Defender incidents, prioritize them on your behalf, filters out the noise, carries out detailed investigations, and provides detailed guided response to your security operations center (SOC) teams. Alternatively, our analysts can also take a response step on your behalf. +Through a combination of automation and human expertise, our service triages Microsoft 365 Defender incidents, prioritize them on your behalf, filters out the noise, carries out detailed investigations, and provides detailed guided response to your security operations center (SOC) teams. Alternatively, our analysts can take a response step on your behalf. -You'll receive detailed response playbooks via emails. You'll also be able to filter Microsoft 365 Defender portal incident view using _Defender Experts_ tags to see the current state of incidents that Defender Experts are actively investigating, or incidents that require customer action. Our analysts will also add relevant comments in Microsoft 365 Defender portalΓÇÖs **Comments & history** section so you and your SOC analysts can track the investigation progress. +You'll receive detailed response playbooks via emails. You'll also be able to filter the Microsoft 365 Defender portal incident view using the _Defender Experts_ tag to see the current state of the incidents Defender Experts are actively investigating, or the incidents that require your action. Our analysts will also add relevant comments in Microsoft 365 Defender portalΓÇÖs **Comments & history** section so you and your SOC analysts can track the investigation progress. -Response recommendations include, but are not limited to: +Response recommendations include, but aren't limited to: - Collect investigation package - Run antivirus scan Response recommendations include, but are not limited to: - Delete email - Block designated OAuth cloud apps -These recommendations also appear in the **Comments & History** section of each related incident in the Microsoft 365 Defender portal so you can view them at your convenience. +These recommendations also appear in the **Comments & history** section of each related incident in the Microsoft 365 Defender portal so you can view them at your convenience. ## Get real-time visibility with Defender Experts for XDR reports -Defender Experts for XDR will include an interactive, on-demand report that provides a clear summary of the work our expert analysts are doing on your behalf, aggregate information about your incident landscape, and granular details about specific incidents. Your service delivery manager (SDM) will also use the report to provide you with additional context regarding your XDR Experts service during a monthly business review. +Defender Experts for XDR will include an interactive, on-demand report that provides a clear summary of the work our expert analysts are doing on your behalf, aggregate information about your incident landscape, and granular details about specific incidents. Your service delivery manager (SDM) will also use the report to provide you with more context regarding your XDR Experts service during a monthly business review. ## Collaborate with a trusted advisor The SDM provides the following - Serve as a single point of contact for feedback and escalations related to Defender Experts Service. ## Proactive managed hunting-Defender Experts for XDR also includes proactive threat hunting offered by [Microsoft Defender Experts for Hunting](defender-experts-for-hunting.md). Defender Experts for hunting was created for customers who have a robust security operations center but want Microsoft to help them proactively hunt threats using Microsoft Defender data. This proactive threat hunting service goes beyond the endpoint to hunt across endpoints, Office 365, cloud applications, and identity. Our experts will investigate anything they find, then hand off the contextual alert information along with remediation instructions, so you can quickly respond. +Defender Experts for XDR also includes proactive threat hunting offered by [Microsoft Defender Experts for Hunting](defender-experts-for-hunting.md). Defender Experts for Hunting was created for customers who have a robust security operations center but want Microsoft to help them proactively hunt threats using Microsoft Defender data. This proactive threat hunting service goes beyond the endpoint to hunt across endpoints, Office 365, cloud applications, and identity. Our experts investigate anything they find, then hand off the contextual alert information along with remediation instructions, so you can quickly respond. ## Request advanced threat expertise on demand Select **Ask Defender Experts** directly inside the Microsoft 365 security portal to get swift and accurate responses to all your threat questions. Experts can provide insights to better understand the complex threats your organization may face. Consult an expert to: |
| security | Supported Event Types | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/supported-event-types.md | The following table only includes the list of the tables supported in the stream | **[EmailEvents](advanced-hunting-emailevents-table.md)** | GA |GA |GA |GA | | **[EmailPostDeliveryEvents](advanced-hunting-emailpostdeliveryevents-table.md)** | GA |GA |GA |GA | | **[EmailUrlInfo](advanced-hunting-emailurlinfo-table.md)** | GA |GA |GA |GA |-| **[IdentityLogonEvents](advanced-hunting-identitylogonevents-table.md)**|GA|||| -| **[IdentityQueryEvents](advanced-hunting-identityqueryevents-table.md)**|GA|||| -| **[IdentityDirectoryEvents](advanced-hunting-identitydirectoryevents-table.md)**|GA|||| -| **[CloudAppEvents](advanced-hunting-cloudappevents-table.md)**|GA|||| +| **[IdentityLogonEvents](advanced-hunting-identitylogonevents-table.md)**|GA|Public preview |Public preview |Public preview | +| **[IdentityQueryEvents](advanced-hunting-identityqueryevents-table.md)**|GA|Public preview |Public preview |Public preview | +| **[IdentityDirectoryEvents](advanced-hunting-identitydirectoryevents-table.md)**|GA|Public preview |Public preview |Public preview | +| **[CloudAppEvents](advanced-hunting-cloudappevents-table.md)**|GA|Public preview |Public preview |Public preview | | **[UrlClickEvents](advanced-hunting-urlclickevents-table.md)**|GA |GA |GA |GA |++ |
| security | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/whats-new.md | For more information on what's new with other Microsoft Defender security produc You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter). ## November 2022-- (Preview) Microsoft Defender Experts for XDR (Defender Experts for XDR) is now available for preview. Defender Experts for XDR is a managed detection and response service that helps your security operations centers (SOCs) focus and accurately respond to incidents that matter. It provides extended detection and response for customers who use M365 Defender workloads: Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, and Azure Active Directory (Azure AD). For details, refer to [Expanded Microsoft Defender Experts for XDR preview](dex-xdr-overview.md).+- (Preview) Microsoft Defender Experts for XDR (Defender Experts for XDR) is now available for preview. Defender Experts for XDR is a managed detection and response service that helps your security operations centers (SOCs) focus and accurately respond to incidents that matter. It provides extended detection and response for customers who use Microsoft 365 Defender workloads: Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, and Azure Active Directory (Azure AD). For details, refer to [Expanded Microsoft Defender Experts for XDR preview](dex-xdr-overview.md). ## August 2022 - (GA) [Microsoft Defender Experts for Hunting](defender-experts-for-hunting.md) is now generally available. If you're a Microsoft 365 Defender customer with a robust security operations center but want Microsoft to help you proactively hunt for threats across endpoints, Office 365, cloud applications, and identity using Microsoft Defender data, then learn more about applying, setting up, and using the service. Defender Experts for Hunting is sold separately from other Microsoft 365 Defender products. |