| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Activity Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/activity-reports/activity-reports.md | Check out this video and others on our [YouTube channel](https://go.microsoft.co 2. Click the **View more** button from the at-a-glance activity card for a service (such as email or OneDrive) to see the report detail page. On that page, different reports for the service are provided in tabs. - :::image type="content" alt-text="The Usage dashboard." source="../../media/4c0f966d-9d2b-4a6f-a106-a6e2b9a2de07.png" lightbox="../../media/4c0f966d-9d2b-4a6f-a106-a6e2b9a2de07.png"::: + :::image type="content" alt-text="The Usage dashboard." source="../../media/activity-usage-analytics3.png" lightbox="../../media/4c0f966d-9d2b-4a6f-a106-a6e2b9a2de07.png"::: ## Who can see reports People who have the following permissions: - Teams Communications Administrator +- User Experience Success Manager (with no user details) + To learn more, see [About admin roles](../add-users/about-admin-roles.md) and [Assign admin roles](../add-users/assign-admin-roles.md). ## Which activity reports are available in the admin center |
| commerce | Change Payment Frequency | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/change-payment-frequency.md | |
| commerce | Change Your Billing Addresses | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/change-your-billing-addresses.md | |
| commerce | Future Start Date | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/future-start-date.md | |
| commerce | Manage Billing Notifications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/manage-billing-notifications.md | You must be a Global admin to do the steps described in this article. Billing ad ## Change the language you receive email in -Billing notification emails are sent in your organizationΓÇÖs preferred language. To change the preferred language, use the following steps. +Billing notification emails are sent in your organization's preferred language. To change the preferred language, use the following steps. 1. In the Microsoft 365 admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=853212" target="_blank">Billing notifications</a> page. 2. In the **Billing notification settings** section, select **Edit notification settings**. Your organization's billing notifications are sent to the primary and alternate 1. In the admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=853212" target="_blank">Billing notifications</a> page. 2. In the **Admins receiving billing notifications** section, select the **Billing administrator** or **Global administrator** link in the description text. 3. In the right pane, on the **Assigned admins** tab, select **Add**.-4. In the **Add admins** pane, type the userΓÇÖs display name or username, and then select the user from the list of suggestions. -5. Add multiple users until youΓÇÖre done. +4. In the **Add admins** pane, type the user's display name or username, and then select the user from the list of suggestions. +5. Add multiple users until you're done. 6. Select **Save**. The user is added to the list of assigned admins. ### Remove admin roles by using the Billing notifications page Billing notification emails are sent to the primary and alternate email addresse To learn more about billing profile roles and how to manage them, see [Understand Microsoft Customer Agreement administrative roles in Azure](/azure/cost-management-billing/manage/understand-mca-roles). -To change who receives your organizationΓÇÖs billing notifications, use the following steps to change the roles assigned to users. +To change who receives your organization's billing notifications, use the following steps to change the roles assigned to users. 1. In the admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=2102895" target="_blank">Bills & payments</a> page. 2. On the **Billing profile** tab, select a billing profile. |
| commerce | Manage Billing Profiles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/manage-billing-profiles.md | Roles on billing profiles have permissions to control purchases, and view and ma > [!NOTE] >-> If you follow these steps and the billing profiles list is empty, it means that you donΓÇÖt have a billing profile, and canΓÇÖt use this feature. +> If you follow these steps and the billing profiles list is empty, it means that you don't have a billing profile, and can't use this feature. 1. In the admin center, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2102895" target="_blank">Bills & payments</a> page. 2. Select the **Billing profile** tab, then select a billing profile from the list. |
| commerce | Manage Multi Tenant Billing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/manage-multi-tenant-billing.md | |
| commerce | Manage Payment Methods | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/manage-payment-methods.md | Last updated 06/01/2022 # Manage payment methods > [!IMPORTANT]-> As of January 26, 2021, new bank accounts are no longer supported for customers in Belgium, France, Italy, Luxembourg, Portugal, Spain, and the United States. If youΓÇÖre an existing customer in one of those countries, you can continue paying for your subscription with an existing bank account that is in good standing. However, you can't add new subscriptions to the bank account. +> As of January 26, 2021, new bank accounts are no longer supported for customers in Belgium, France, Italy, Luxembourg, Portugal, Spain, and the United States. If you're an existing customer in one of those countries, you can continue paying for your subscription with an existing bank account that is in good standing. However, you can't add new subscriptions to the bank account. When you buy business products or services from Microsoft, you can use an existing payment method, or add a new one. You can use a credit or debit card, or bank account to pay for the things you buy. |
| commerce | Mexico Billing Info | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/mexico-billing-info.md | |
| commerce | Pay For Subscription Billing Profile | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/pay-for-subscription-billing-profile.md | Last updated 05/26/2022 When you buy a subscription, you pay for it with a billing profile. The billing profile is linked to a specific payment method and can be a credit or debit card, or an invoice, but not a bank account. -If youΓÇÖre not sure if your account has a billing profile, see [Understand billing profiles](manage-billing-profiles.md). If you donΓÇÖt have a billing profile, see [How to pay for your subscription](pay-for-your-subscription.md). +If you're not sure if your account has a billing profile, see [Understand billing profiles](manage-billing-profiles.md). If you don't have a billing profile, see [How to pay for your subscription](pay-for-your-subscription.md). ## Paying with recurring billing turned on or off If recurring billing is turned off for a billing profile, you can use the **Pay ## New regulations from the Reserve Bank of India -As of 1 October 2021, automatic payments in India might block some credit card transactions, especially transactions exceeding 5,000 INR. Because of this regulation, you might have to make payments manually in the Microsoft 365 admin center. These regulations won't affect the total amount youΓÇÖre charged for your usage. +As of 1 October 2021, automatic payments in India might block some credit card transactions, especially transactions exceeding 5,000 INR. Because of this regulation, you might have to make payments manually in the Microsoft 365 admin center. These regulations won't affect the total amount you're charged for your usage. [Learn more about the Reserve Bank of India regulation for recurring payments](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11668&Mode=0). To be eligible to pay by invoice, you must: - Have a subscription cost that exceeds a certain amount (this amount varies by service location) - Pass a credit check -If a credit check is required, youΓÇÖre notified when you buy your subscription. If you agree to be contacted, you get an email that includes more information about applying for credit approval. Credit checks are usually completed within two business days. +If a credit check is required, you're notified when you buy your subscription. If you agree to be contacted, you get an email that includes more information about applying for credit approval. Credit checks are usually completed within two business days. -If your billing profile is backed by an invoice, you get an email when your billing statement is ready to view. This email doesnΓÇÖt contain a copy of your billing statement. However, you can choose to [receive your organization's invoices as email attachments](manage-billing-notifications.md#receive-your-organizations-invoices-as-email-attachments). Your billing statement includes details about your options for making a payment, and where to send it. If you enter a purchase order (PO) number in your billing profile, the number appears on your billing statement. For information about accessing billing statements, see [View your bill or invoice](view-your-bill-or-invoice.md). +If your billing profile is backed by an invoice, you get an email when your billing statement is ready to view. This email doesn't contain a copy of your billing statement. However, you can choose to [receive your organization's invoices as email attachments](manage-billing-notifications.md#receive-your-organizations-invoices-as-email-attachments). Your billing statement includes details about your options for making a payment, and where to send it. If you enter a purchase order (PO) number in your billing profile, the number appears on your billing statement. For information about accessing billing statements, see [View your bill or invoice](view-your-bill-or-invoice.md). ## Where do I send my check or EFT payment? If recurring billing is turned off for your billing profile, you can use a credi ## Can I change from my current payment method to paying by invoice? -If your billing profile is backed by credit or debit card, you can only change the payment method to another credit or debit card. You canΓÇÖt change to paying by invoice. +If your billing profile is backed by credit or debit card, you can only change the payment method to another credit or debit card. You can't change to paying by invoice. ## Can I change from paying by invoice to using a different payment method? -If your billing profile is backed by invoice payments, you canΓÇÖt change the payment method. You can use the **Pay now** button on your invoice to pay with a credit or debit card, or by check or EFT. +If your billing profile is backed by invoice payments, you can't change the payment method. You can use the **Pay now** button on your invoice to pay with a credit or debit card, or by check or EFT. ## Related content |
| commerce | Pay For Your Subscription | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/pay-for-your-subscription.md | |
| commerce | Tax Information | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/tax-information.md | |
| commerce | Understand Your Invoice | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/understand-your-invoice.md | |
| commerce | Understand Your Invoice2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/understand-your-invoice2.md | |
| commerce | View Your Bill Or Invoice | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/view-your-bill-or-invoice.md | |
| commerce | Withholding Tax Credit Global | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/withholding-tax-credit-global.md | Submit the WHT request by opening a ticket with Microsoft support. After you submit the request, it goes into the approval process where it is either approved for completion or is sent back to you for correction. -If thereΓÇÖs a problem with your request, the review team might require corrections to the withholding amount or replacement of the certificate or receipt. You must resubmit the request before it can be approved. The review team will either approve the request or ask for more changes. +If there's a problem with your request, the review team might require corrections to the withholding amount or replacement of the certificate or receipt. You must resubmit the request before it can be approved. The review team will either approve the request or ask for more changes. ## Approved requests **For customers paying by check or wire:** Approved WHT requests are settled against the unpaid portion of the invoice amount reflected in Withholding Tax Credit Form. -After your claim is approved, itΓÇÖs reflected in the next billing cycle. The WHT amount paid is included in the payment section of your next invoice. The amount is also displayed under the paid amount in the customer portal. +After your claim is approved, it's reflected in the next billing cycle. The WHT amount paid is included in the payment section of your next invoice. The amount is also displayed under the paid amount in the customer portal. **For customers paying by credit card:** After your claim is approved, your overpayment is refunded to your credit card. |
| commerce | Withholding Tax Credit India | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/withholding-tax-credit-india.md | The following table shows the due dates and timelines to submit digitally signed After you submit the request, it goes into the approval process where it is either approved for completion or is sent back to you for correction. -If thereΓÇÖs a problem with your request, the review team might require corrections to the withholding amount or replacement of the TDS certificate. You must resubmit the request before it can be approved. The review team will either approve the request or ask for more changes. +If there's a problem with your request, the review team might require corrections to the withholding amount or replacement of the TDS certificate. You must resubmit the request before it can be approved. The review team will either approve the request or ask for more changes. ## Approved requests **For customers paying by check and wire:** Approved WHT requests are settled against the unpaid portion of the invoice amount reflected in the Withholding Tax Credit Form. -After your claim is approved, itΓÇÖs reflected in the next billing cycle. The WHT amount paid is included in the payment section of your next invoice. The amount is also displayed under the paid amount in the customer portal. +After your claim is approved, it's reflected in the next billing cycle. The WHT amount paid is included in the payment section of your next invoice. The amount is also displayed under the paid amount in the customer portal. **For customers paying by credit card:** After your claim is approved, your overpayment is refunded to your credit card. |
| commerce | Allotment Basics | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/allotment-basics.md | |
| commerce | Buy Licenses | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/buy-licenses.md | |
| commerce | Manage Auto Claim Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/manage-auto-claim-policies.md | |
| commerce | Manage License Requests | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/manage-license-requests.md | Last updated 04/22/2022 > [!NOTE] > The information in this article only applies to self-service purchased products. To learn more, see [Self-service purchase FAQ](../subscriptions/self-service-purchase-faq.yml). -If you disable self-service purchases in your organization, you can use licenses requests to manage the license request process for your users. When a user tries to make a self-service purchase for a product that youΓÇÖve blocked, they can submit a request for a license to you, the admin. When they make a request, they can add the names of other users who also need licenses for the product. +If you disable self-service purchases in your organization, you can use licenses requests to manage the license request process for your users. When a user tries to make a self-service purchase for a product that you've blocked, they can submit a request for a license to you, the admin. When they make a request, they can add the names of other users who also need licenses for the product. > [!NOTE]-> If you block users from making self-service purchases, Microsoft doesnΓÇÖt send them marketing emails. Also, if theyΓÇÖre using a trial version of a product, they donΓÇÖt see prompts to buy it. To learn more, see [Manage self-service purchases (Admin)](../subscriptions/manage-self-service-purchases-admins.md). +> If you block users from making self-service purchases, Microsoft doesn't send them marketing emails. Also, if they're using a trial version of a product, they don't see prompts to buy it. To learn more, see [Manage self-service purchases (Admin)](../subscriptions/manage-self-service-purchases-admins.md). To see and manage license requests, admin uses the **Requests** tab on the **Licensing** page. The list shows the name of the product that is requested, name of the person requesting a license, date requested, and status of the request. Admins can filter the list to show requests that are pending or completed. Requests are held for 30 days. If your organization has its own request process, you can use it instead. You cr 3. In the right pane, in the **Message** box, type the message you want users to see when they request a license. If you want to also include a link to your organizations policy or other documentation, enter the URL in the **Link to documentation (optional)** text box. 4. Select **Save**. -When you return to the **Requests** list, you see the message **YouΓÇÖre using your own license request process**. To make changes to the message that is sent to users, select **Use your existing request process instead**. +When you return to the **Requests** list, you see the message **You're using your own license request process**. To make changes to the message that is sent to users, select **Use your existing request process instead**. ## Stop using your own request process 1. In the admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842264" target="_blank">Licenses</a> page, then select the **Requests** tab. 2. Select **Use your existing request process instead**.-3. In the right pane, clear the **Use my organizationΓÇÖs request process** check box. +3. In the right pane, clear the **Use my organization's request process** check box. 4. Select **Save**. ## Approve or deny a license request 1. In the admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842264" target="_blank">Licenses</a> page, then select the **Requests** tab. 2. Select the row that contains the request you want to review. The right pane shows details about which users want licenses to the product.-3. To deny the entire request, select **DonΓÇÖt approve**, and in the dialog box, select **DonΓÇÖt approve**. +3. To deny the entire request, select **Don't approve**, and in the dialog box, select **Don't approve**. 4. To deny some users for the request, but approve others, select the X by the name of the users that you want to remove. Their names are moved under **Do not assign to these users**. 5. If you have more than one product, under **Select a product**, select the one that you want to use to assign licenses for. 6. To deny users access to certain app and services, expand **Turn apps and services on or off**, then clear the check boxes for the ones you want to exclude. 7. At the bottom of the pane, type an optional message in the text box.-8. When youΓÇÖre finished, select **Approve**. The right pane shows the details of the request. +8. When you're finished, select **Approve**. The right pane shows the details of the request. 9. Close the right pane. Users receive an email that says their request was approved or denied. |
| commerce | Manage Licenses For Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/manage-licenses-for-devices.md | |
| commerce | Manage Third Party App Licenses | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/manage-third-party-app-licenses.md | If you bought an ISV app through an app vendor, contact the vendor to add or rem ## Next steps -Depending on the ISV app that you bought, your next step might be to install the app into your organizationΓÇÖs environment. Installing the app makes it available for your users. Use the following steps to install an ISV app to your environment. +Depending on the ISV app that you bought, your next step might be to install the app into your organization's environment. Installing the app makes it available for your users. Use the following steps to install an ISV app to your environment. 1. In the admin center, **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842264" target="_blank">Licenses</a> page. 2. Select the app that you want to install into your account. |
| commerce | Volume Licensing Invoices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/volume-licensing-invoices.md | The following table explains the terms in the **Summary** section of your invoic The addresses shown on your invoice might be different, depending on the size and configuration of your organization. The following table explains the terms for the addresses section of your invoice. |
| commerce | Cancel Your Subscription | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/cancel-your-subscription.md | -If you want to cancel your subscription, the easiest way to do that is to [turn off recurring billing](renew-your-subscription.md). When you turn off recurring billing, you can continue to use your subscription until it expires at the end of the subscription term. If you want to cancel immediately, use the information and steps in this article to do that. +This article only applies to canceling **Dynamics 365**, **Intune**, **Power Platform**, **Windows 365**, and **Microsoft 365 for business** subscriptions. If you have Microsoft 365 Family or Personal, see [Cancel a Microsoft 365 subscription](https://support.microsoft.com/office/cancel-a-microsoft-365-subscription-46e2634c-c64b-4c65-94b9-2cc9c960e91b?OCID=M365_DocsCancel_Link). -You can cancel your free trial at any time to stop future charges. After your 1-month free trial ends, you will be charged the applicable subscription fee. +> [!WARNING] +> Before you cancel a subscription, make sure your users [save their data](#save-your-data). -> [!IMPORTANT] -> - This article only applies to Dynamics 365, Intune, Power Platform, Windows 365, and Microsoft 365 for business subscriptions. If you have Microsoft 365 Family or Personal, see [Cancel a Microsoft 365 subscription](https://support.microsoft.com/office/cancel-a-microsoft-365-subscription-46e2634c-c64b-4c65-94b9-2cc9c960e91b?OCID=M365_DocsCancel_Link). -> - If you bought your subscription through a Microsoft representative or a reseller partner, you have seven days to cancel for a pro-rated refund. Contact your seller or partner to help you cancel your subscription. [Learn more about partners](../manage-partners.md#what-can-a-partner-do-for-my-organization-or-school). -> - If your organization is located in Chile, and you bought your subscription through a partner in Chile, you have 10 days to cancel for a pro-rated refund. +**In this article:** ++[Before you begin](#before-you-begin)\ +[What's the easiest way to cancel?](#whats-the-easiest-way-to-cancel)\ +[How do I cancel my free trial?](#how-do-i-cancel-my-free-trial)\ +[What if I bought my subscription through a partner?](#what-if-i-bought-my-subscription-through-a-partner)\ +[Determine your cancellation options](#determine-your-cancellation-options)\ +[Steps to cancel your subscription](#steps-to-cancel-your-subscription)\ +[Save your data](#save-your-data)\ +[Next steps](#next-steps)\ +[Related content](#related-content) ## Before you begin - You must be a Global or Billing admin to do the tasks in this article. For more information, see [About admin roles](../../admin/add-users/about-admin-roles.md).-- Before you cancel a subscription, make sure your users [save their data](#save-your-data). - If you added your own domain name to use with your subscription, you must [remove the domain](../../admin/get-help-with-domains/remove-a-domain.md) before you cancel your subscription. - If you have a domain subscription, to prevent any other charges for that subscription, [turn off recurring billing](renew-your-subscription.md). +## What's the easiest way to cancel? ++The easiest way to cancel your subscription is to [turn off recurring billing](renew-your-subscription.md#turn-recurring-billing-off-or-on). When you turn off recurring billing, you can continue to use your subscription until it expires at the end of the subscription term. If you want to cancel immediately, use the information and steps in this article to do that. ++## How do I cancel my free trial? ++You can cancel your free trial at any time to stop future charges. To cancel a free trial, [turn off recurring billing](renew-your-subscription.md#turn-recurring-billing-off-or-on). If you don't turn off recurring billing, after your one month free trial ends, you're charged the applicable subscription fee. If your trial subscription doesn't have a payment method associated with it, you can just let it expire at the end of the trial period, and you won't be charged. ++## What if I bought my subscription through a partner? ++If you bought your subscription through a Microsoft representative or a reseller partner, you have seven days to cancel for a pro-rated refund. Contact your seller or partner to help you cancel your subscription. [Learn more about partners](../manage-partners.md#what-can-a-partner-do-for-my-organization-or-school). ++If your organization is in Chile, and you bought your subscription through a partner in Chile, you have 10 days to cancel for a prorated refund. + ## Determine your cancellation options > [!IMPORTANT] You can only cancel and receive a prorated credit or refund if you cancel within If you need to cancel within seven days after the start or renewal of your subscription, go to [Steps to cancel your subscription](#steps-to-cancel-your-subscription) later in this article. -If more than seven days have passed, [turn off recurring billing](renew-your-subscription.md). This prevents your subscription from renewing at the end of its term. You keep access to your products and services for the remainder of your subscription. If you have an annual subscription and are paying monthly, you are charged each month for the remainder of your subscription term. +If more than seven days have passed, [turn off recurring billing](renew-your-subscription.md). Turning off recurring billing prevents your subscription from renewing at the end of its term. You keep access to your products and services for the remainder of your subscription. If you have an annual subscription and are paying monthly, you're charged each month for the remainder of your subscription term. ### If you don't have a billing profile If you cancel after you start or renew your subscription, you receive a prorated credit or refund. The amount is either credited towards your next invoice or returned to you in the next billing cycle. -The steps to cancel your trial or paid subscription depend on the number of licenses in your subscription. The following table explains what steps you can take, based on your number of licenses. +The steps to cancel your trial or paid subscription depend on the number of licenses in your subscription. The following table explains what steps you can take, based on the number of licenses in your subscription. |If your subscription has |You can | |--|--| |25 or fewer licenses | [Use the steps below to cancel](#steps-to-cancel-your-subscription) your trial or paid subscription online in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>. | |More than 25 licenses | Reduce the number of licenses to 25 or fewer and then [use the steps below to cancel](#steps-to-cancel-your-subscription). | -If you can't reduce the number of licenses, [turn off recurring billing](renew-your-subscription.md). This prevents you from being charged again for your subscription, and lets you keep your access to your products and services for the remainder of your subscription. +If you can't reduce the number of licenses, [turn off recurring billing](renew-your-subscription.md). Turning off recurring billing prevents you from being charged again for your subscription, and lets you keep your access to your products and services for the remainder of your subscription. If you're unable to cancel your subscription, [contact support](../../admin/get-help-support.md) for help. ## Steps to cancel your subscription > [!NOTE]-> If you have multiple subscriptions to the same product, such as Microsoft 365 Business Premium, canceling one subscription won't impact the purchased licenses or services inside the others. +> If you have multiple subscriptions to the same product, such as Microsoft 365 Business Premium, canceling one subscription won't impact the licenses or services that you bought inside inside the other subscriptions. ::: moniker range="o365-worldwide" If you're unable to cancel your subscription, [contact support](../../admin/get- 4. Select **Save**. -Your subscription now appears in a **Disabled** state, and has reduced functionality until it's deleted. For more information about what you can expect when a paid Microsoft 365 for business subscription is canceled, see [What happens to my data and access when my Microsoft 365 for business subscription ends?](what-if-my-subscription-expires.md) +Your subscription now appears in a **Disabled** state, and has reduced functionality until it's deleted. For information about what you can expect when you cancel a paid Microsoft 365 for business subscription, see [What happens to my data and access when my Microsoft 365 for business subscription ends?](what-if-my-subscription-expires.md) -> [!IMPORTANT] -> If you explicitly delete a subscription, then it skips the **Expired** and **Disabled** states and the SharePoint Online data and content, including OneDrive, is deleted immediately. +> [!WARNING] +> If you explicitly delete a subscription, it skips the **Expired** and **Disabled** states and the SharePoint Online data and content, including OneDrive content, is deleted immediately. ## Save your data |
| compliance | Advanced Ediscovery Cloud Attachments | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/advanced-ediscovery-cloud-attachments.md | Cloud attachments are links to documents that are typically stored in SharePoint ## Collecting cloud attachments -When you create a draft collection and the search results contain items that include cloud attachments, you have to the option of collecting the target of the cloud attachment when you commit the draft collection to a review set. When you select this option, eDiscovery (Premium) adds the documents that are linked to in the cloud attachment to the review set. This allows you to review the target documents and determine if the document is relevant to your case or investigation. +When you create a collection estimate and the search results contain items that include cloud attachments, you have to the option of collecting the target of the cloud attachment when you commit the collection estimate to a review set. When you select this option, eDiscovery (Premium) adds the documents that are linked to in the cloud attachment to the review set. This allows you to review the target documents and determine if the document is relevant to your case or investigation. The following screenshot shows the option to include the targets of cloud attachments when you commit a collection to a review set. The following screenshot shows the option to include the targets of cloud attach > [!NOTE] >- If you use the [new case format](advanced-ediscovery-new-case-format.md) in eDiscovery (Premium), the option to include cloud attachments in the review set is selected by default and can't be unselected.<br/> >- You also have the option to include all versions (in addition to the version that was shared) of cloud attachments in the review set. -For instructions committing a collection to a review set, see [Commit a draft collection to a review set](commit-draft-collection.md). +For instructions committing a collection to a review set, see [Commit a collection estimate to a review set](commit-draft-collection.md). ## Collecting the version shared in a cloud attachment (preview) The following screenshot shows a cloud attachment document, named *XYZ Research. Additionally, the current live version and the version that was shared have the same **FamilyId** property value, which is the same as the **FamilyId** for the parent object (such as an email message or a Teams chat conversation). This lets you group cloud attachments with the item in which they were shared. -After you've implemented the retention label and auto-apply the label to SharePoint documents, you still select the option to collect cloud attachments when committing a draft collection to a review set. When the cloud attachments are collected, both the current live version and the version that was originally shared are added to the review set. +After you've implemented the retention label and auto-apply the label to SharePoint documents, you still select the option to collect cloud attachments when committing a collection estimate to a review set. When the cloud attachments are collected, both the current live version and the version that was originally shared are added to the review set. |
| compliance | Advanced Ediscovery Historical Versions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/advanced-ediscovery-historical-versions.md | After you turn on historical versions for your organization, the last step is to ## Frequently asked questions -**How are historical versions different that the option to "collect all versions" when you commit a draft collection to a review set?** +**How are historical versions different that the option to "collect all versions" when you commit a collection estimate to a review set?** -Currently, only the latest version of documents is indexed for search. That means when you run a draft collection, only the latest versions of documents are searched. If a document matches the keyword query for the collection, it is returned in the collection results. However, if the latest version of a document doesn't match a search query, the document won't be returned event if older versions of the document contain the keyword. To help mitigate this situation, eDiscovery (Premium) gives you the ability to collect all versions of the document when you [commit a collection to a review set](commit-draft-collection.md#commit-a-draft-collection-to-a-review-set). That means any older version that may contain the keyword will be added to the review set. +Currently, only the latest version of documents is indexed for search. That means when you run a collection estimate, only the latest versions of documents are searched. If a document matches the keyword query for the collection, it is returned in the collection results. However, if the latest version of a document doesn't match a search query, the document won't be returned event if older versions of the document contain the keyword. To help mitigate this situation, eDiscovery (Premium) gives you the ability to collect all versions of the document when you [commit a collection to a review set](commit-draft-collection.md#commit-a-collection-estimate-to-a-review-set). That means any older version that may contain the keyword will be added to the review set. Historical versions are different and more efficient than "collecting all versions" because when you activate a site, all versions of a document (and not just the last version) are indexed for search. The result is that if an older version of a document contains a keyword that matches the search query, it will be returned by the collection. |
| compliance | Classifier Tc Definitions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/classifier-tc-definitions.md | Microsoft Purview comes with multiple pre-trained classifiers. They appear in th - **Agreements**: Detects content related to legal agreements such as non-disclosure agreements, statements of work, loan and lease agreements, employment and non-compete agreements. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files. -- **Bank Statement (preview)**: Detects items that contain a financial transaction of a bank account including account information, deposits, withdrawals, account balance, interest accrued and bank charges within a given period. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt files.+- **Bank Statement**: Detects items that contain a financial transaction of a bank account including account information, deposits, withdrawals, account balance, interest accrued and bank charges within a given period. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt files. -- **Budget (preview)**: Detects budget documents, budget forecasts and current budget statements including income and expenses of an organization. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, .xla files.+- **Budget**: Detects budget documents, budget forecasts and current budget statements including income and expenses of an organization. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, .xla files. -- **Business Plan (preview)**: Detects components of a business plan including business opportunity, plan of achieving the outcomes, market study and competitor analysis. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files.+- **Business Plan**: Detects components of a business plan including business opportunity, plan of achieving the outcomes, market study and competitor analysis. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files. -- **Construction specifications (preview)**: Detects construction specifications for commercial and industrial projects like factories, plants, commercial offices, airports, roads. Captures guidelines on the quality, quantity, types of building material, processes etc. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files.+- **Construction specifications**: Detects construction specifications for commercial and industrial projects like factories, plants, commercial offices, airports, roads. Captures guidelines on the quality, quantity, types of building material, processes etc. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files. -- **Corporate Sabotage (preview)**: Detects messages that may mention acts to damage or destroy corporate assets or property. This classifier can help customers manage regulatory compliance obligations such as NERC Critical Infrastructure Protection standards or state by state regulations like Chapter 9.05 RCW in Washington state. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files. -> [!IMPORTANT] -> While in preview, this classifier may capture a large volume of bulk sender/newsletter content due to a known issue. While they're in preview, you can address large volumes of bulk sender/newsletter content by adding the **Message is not sent to any of these domains condition** with a list of domains to exclude. +- **Corporate Sabotage <!--(preview)-->**: Detects messages that may mention acts to damage or destroy corporate assets or property. This classifier can help customers manage regulatory compliance obligations such as NERC Critical Infrastructure Protection standards or state by state regulations like Chapter 9.05 RCW in Washington state. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files. +<!--> [!IMPORTANT] +> While in preview, this classifier may capture a large volume of bulk sender/newsletter content due to a known issue. While they're in preview, you can address large volumes of bulk sender/newsletter content by adding the **Message is not sent to any of these domains condition** with a list of domains to exclude.--> - **Customer complaints**: The customer complaints classifier detects feedback and complaints made about your organization's products or services. This classifier can help you meet regulatory requirements on the detection and triage of complaints, like the Consumer Financial Protection Bureau and Food and Drug Administration requirements. For Communications Compliance, it detects content in .msg, and .eml files. For the rest of Microsoft Purview Information Protection services, it detects content in .docx, .pdf, .txt, .rtf, .jpg, .jpeg, .png, .gif, .bmp, .svg files. - **Discrimination**: Detects explicit discriminatory language and is sensitive to discriminatory language against the African American/Black communities when compared to other communities. This applies to Communications Compliance, it's a text based classifier. -- **Employee disciplinary action files (preview)**: Detects files relating to disciplinary action including a reprimand or corrective action in response to employee misconduct, rule violation, or poor performance. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files.+- **Employee disciplinary action files**: Detects files relating to disciplinary action including a reprimand or corrective action in response to employee misconduct, rule violation, or poor performance. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files. -- **Employee Insurance files (preview)**: Detects documents pertaining to employee medical insurance and workplace disability insurance. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files.+- **Employee Insurance files**: Detects documents pertaining to employee medical insurance and workplace disability insurance. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files. -- **Employment Agreement (preview)**: Detects employment agreement containing details like the starting date, salary, compensation, duties of employment. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt files.+- **Employment Agreement**: Detects employment agreement containing details like the starting date, salary, compensation, duties of employment. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt files. - **Finance**: Detects content in corporate finance, accounting, economy, banking, and investment categories. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, .xla files. -- **Financial Audit Reports (preview)**: Detects files, documents and reports pertaining to financial audit, both external or internal audit undertaken in an organization. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files.+- **Financial Audit Reports**: Detects files, documents and reports pertaining to financial audit, both external or internal audit undertaken in an organization. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files. -- **Financial Statement (preview)**: Detects financial statements like income statement, balance sheet, cash flow statement, statement of changes in equity. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, .xla files.+- **Financial Statement**: Detects financial statements like income statement, balance sheet, cash flow statement, statement of changes in equity. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, .xla files. -- **Gifts & entertainment (preview)**: Detects messages that may suggest exchanging gifts or entertainment in return for service, which violates regulations related to bribery. This classifier can help customers manage regulatory compliance obligations such as Foreign Corrupt Practices Act (FCPA), UK Bribery Act and FINRA Rule 2320. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files.-> [!IMPORTANT] -> While in preview, this classifier may capture a large volume of bulk sender/newsletter content due to a known issue. While they're in preview, you can address large volumes of bulk sender/newsletter content by adding the **Message is not sent to any of these domains condition** with a list of domains to exclude. +- **Gifts & entertainment <!--(preview)-->**: Detects messages that may suggest exchanging gifts or entertainment in return for service, which violates regulations related to bribery. This classifier can help customers manage regulatory compliance obligations such as Foreign Corrupt Practices Act (FCPA), UK Bribery Act and FINRA Rule 2320. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files. +<!--> [!IMPORTANT] +> While in preview, this classifier may capture a large volume of bulk sender/newsletter content due to a known issue. While they're in preview, you can address large volumes of bulk sender/newsletter content by adding the **Message is not sent to any of these domains condition** with a list of domains to exclude.--> - **Harassment**: Detects a specific category of offensive language text items related to offensive conduct targeting one or multiple individuals based on the following traits: race, ethnicity, religion, national origin, gender, sexual orientation, age, disability. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files. -- **Health/Medical forms (preview)**: Detects various forms and files that are used for systematic documentation of a patient's admission details, medical history, patient information and prior authorization request and are typically used in medical/health services. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files.+- **Health/Medical forms**: Detects various forms and files that are used for systematic documentation of a patient's admission details, medical history, patient information and prior authorization request and are typically used in medical/health services. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files. - **Healthcare**: Detects content in medical and healthcare administration aspects such as medical services, diagnoses, treatment, claims, etc. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, .xla files. - **HR**: Detects content in human resources related categories of recruitment, interviewing, hiring, training, evaluating, warning, and termination. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, .xla files. -- **Invoice (preview)**: Detects invoices containing an itemized summary of the purchase, the total balance owed, current payment due, and various payment methods. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .eml, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, .xla files.+- **Invoice**: Detects invoices containing an itemized summary of the purchase, the total balance owed, current payment due, and various payment methods. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .eml, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, .xla files. - **IP**: Detects content in Intellectual Property related categories such as trade secrets and similar confidential information. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, .xla files. Microsoft Purview comes with multiple pre-trained classifiers. They appear in th - **Legal affairs**: Detects content in legal affairs-related categories such as litigation, legal process, legal obligation, legal terminology, law, and legislation. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files. -- **License Agreement (preview)**: Detects license agreements, contains terms and conditions for use and compensation for the licensor. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt files.+- **License Agreement**: Detects license agreements, contains terms and conditions for use and compensation for the licensor. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt files. -- **Loan Agreements and offer letters (preview)**: Detects loan agreements, offer letters and terms and conditions contained within the document. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files.+- **Loan Agreements and offer letters**: Detects loan agreements, offer letters and terms and conditions contained within the document. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files. -- **Merger and Acquisition Files (preview)**: This classifier detects documents including letter of intent, term sheets and related files. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files.+- **Merger and Acquisition Files**: This classifier detects documents including letter of intent, term sheets and related files. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files. -- **Manufacturing batch records (preview)**: This classifier detects manufacturing batch documents that include details around the entire manufacturing process and the history of a product batch. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files.+- **Manufacturing batch records**: This classifier detects manufacturing batch documents that include details around the entire manufacturing process and the history of a product batch. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files. -- **Meeting Notes** (preview): This classifier detects meeting notes. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files.+- **Meeting Notes**: This classifier detects meeting notes. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files. -- **Money laundering (preview)**: Detects signs that may suggest money laundering or engagement in acts to conceal or disguise the origin or destination of proceeds. This classifier can help customers manage regulatory compliance obligations such as the Bank Secrecy Act, the USA Patriot Act, FINRA Rule 3310 and Anti-Money Laundering Act of 2020. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files.-> [!IMPORTANT] -> While in preview, this classifier may capture a large volume of bulk sender/newsletter content due to a known issue. While they're in preview, you can address large volumes of bulk sender/newsletter content by adding the **Message is not sent to any of these domains condition** with a list of domains to exclude. +- **Money laundering <!--(preview)-->**: Detects signs that may suggest money laundering or engagement in acts to conceal or disguise the origin or destination of proceeds. This classifier can help customers manage regulatory compliance obligations such as the Bank Secrecy Act, the USA Patriot Act, FINRA Rule 3310 and Anti-Money Laundering Act of 2020. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files. +<!--> [!IMPORTANT] +> While in preview, this classifier may capture a large volume of bulk sender/newsletter content due to a known issue. While they're in preview, you can address large volumes of bulk sender/newsletter content by adding the **Message is not sent to any of these domains condition** with a list of domains to exclude.--> -- **Network Design files (preview)**: This classifier detects technical documentation about networks of computers including various components of network, how they're connected, their architecture, how they perform and where they troubleshoot Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files.+- **Network Design files**: This classifier detects technical documentation about networks of computers including various components of network, how they're connected, their architecture, how they perform and where they troubleshoot Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files. -- **Non Disclosure Agreement (preview)**: This classifier detects non-disclosure agreements. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt files.+- **Non Disclosure Agreement**: This classifier detects non-disclosure agreements. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt files. -- **Paystub (preview)**: This classifier detects paystub/salary statement files. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, .xla files.+- **Paystub**: This classifier detects paystub/salary statement files. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, .xla files. - **Procurement**: Detects content in categories of bidding, quoting, purchasing, and paying for supply of goods and services. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, .xla files. -- **Project Documents (preview)**: This classifier detects project reports and documents, which include project planning documents, project charter documents and schedules. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files.+- **Project Documents**: This classifier detects project reports and documents, which include project planning documents, project charter documents and schedules. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files. - **Profanity**: Detects a specific category of offensive language text items that contain expressions that embarrass most people. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files. -- **Regulatory collusion (preview)**: Detects messages that may violate regulatory anti-collusion requirements such as an attempted concealment of sensitive information. This classifier can help customers manage regulatory compliance obligations such as the Sherman Antitrust Act, Securities Exchange Act 1933, Securities Exchange Act of 1934, Investment Advisers Act of 1940, Federal Commission Act, and Robinson-Patman Act. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files.-> [!IMPORTANT] -> While in preview, this classifier may capture a large volume of bulk sender/newsletter content due to a known issue. While they're in preview, you can address large volumes of bulk sender/newsletter content by adding the **Message is not sent to any of these domains condition** with a list of domains to exclude. +- **Regulatory collusion <!--(preview)-->**: Detects messages that may violate regulatory anti-collusion requirements such as an attempted concealment of sensitive information. This classifier can help customers manage regulatory compliance obligations such as the Sherman Antitrust Act, Securities Exchange Act 1933, Securities Exchange Act of 1934, Investment Advisers Act of 1940, Federal Commission Act, and Robinson-Patman Act. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files. +<!--> [!IMPORTANT] +> While in preview, this classifier may capture a large volume of bulk sender/newsletter content due to a known issue. While they're in preview, you can address large volumes of bulk sender/newsletter content by adding the **Message is not sent to any of these domains condition** with a list of domains to exclude.--> - **Resume**: This classifier detects resume. A resume is a document that a job applicant provides an employer, which has a detailed statement of the candidate's prior work experience, education, and accomplishments. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .txt files. -- **Sales and revenue (preview)**: This classifier detects sales reports, revenue/income statement and sales/demand forecasting reports for organizations. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files.+- **Sales and revenue**: This classifier detects sales reports, revenue/income statement and sales/demand forecasting reports for organizations. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa files. -- **Software Product Development Files (preview)**: This classifier detects files used in software development including product requirements document, product testing and planning, files including test cases, and test reports. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files.+- **Software Product Development Files**: This classifier detects files used in software development including product requirements document, product testing and planning, files including test cases, and test reports. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files. - **Source code**: detects items that contain a set of instructions and statements written computer programming languages on GitHub: ActionScript, C, C#, C++, Clojure, CoffeeScript, Go, Haskell, Java, JavaScript, Lua, MATLAB, Objective-C, Perl, PHP, Python, R, Ruby, Scala, Shell, Swift, TeX, Vim Script. Detects content in .msg, .as, .h, .c, .cs, .cc, .cpp, .hpp, .cxx, .hh, .c++, .clj, .edn, .cljc, .cljs, .coffee, .litcoffee, .go, .hs, .lhs, .java, .jar, .js, .mjs, .lua, .m, .mm, .pl, .pm, .t, .xs, .pod, .php, .phar, .php4, .pyc, .R, .r, .rda, .RData, .rds, .rb, .scala, .sc, .sh, .swift files. > [!NOTE] > Source Code is trained to detect when the bulk of the text is source code. It does not detect source code text that is interspersed with plain text. -- **Statement of Work (preview)**: This classifier detects statement of work containing details like requirements, responsibilities, terms and conditions for both parties. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt files.+- **Statement of Work**: This classifier detects statement of work containing details like requirements, responsibilities, terms and conditions for both parties. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt files. -- **Stock manipulation (preview)**: Detects signs of possible stock manipulation, such as recommendations to buy, sell or hold stocks that may suggest an attempt to manipulate the stock price. This classifier can help customers manage regulatory compliance obligations such as the Securities Exchange Act of 1934, FINRA Rule 2372, and FINRA Rule 5270. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files.-> [!IMPORTANT] -> While in preview, this classifier may capture a large volume of bulk sender/newsletter content due to a known issue. While they're in preview, you can address large volumes of bulk sender/newsletter content by adding the **Message is not sent to any of these domains condition** with a list of domains to exclude. +- **Stock manipulation <!--(preview)-->**: Detects signs of possible stock manipulation, such as recommendations to buy, sell or hold stocks that may suggest an attempt to manipulate the stock price. This classifier can help customers manage regulatory compliance obligations such as the Securities Exchange Act of 1934, FINRA Rule 2372, and FINRA Rule 5270. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files. +<!--> [!IMPORTANT] +> While in preview, this classifier may capture a large volume of bulk sender/newsletter content due to a known issue. While they're in preview, you can address large volumes of bulk sender/newsletter content by adding the **Message is not sent to any of these domains condition** with a list of domains to exclude.--> - **Tax**: Detects tax related content such as tax planning, tax forms, tax filing, tax regulations. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, xla files. - **Threat**: Detects a specific category of offensive language text items related to threats to commit violence or do physical harm or damage to a person or property. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files. -- **Unauthorized disclosure (preview)**: Detects sharing of information containing content that is explicitly designated as confidential or internal to unauthorized individuals. This classifier can help customers manage regulatory compliance obligations such as FINRA Rule 2010 and SEC Rule 10b-5. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files.-> [!IMPORTANT] -> While in preview, this classifier may capture a large volume of bulk sender/newsletter content due to a known issue. While they're in preview, you can address large volumes of bulk sender/newsletter content by adding the **Message is not sent to any of these domains condition** with a list of domains to exclude. ---+- **Unauthorized disclosure <!--(preview)-->**: Detects sharing of information containing content that is explicitly designated as confidential or internal to unauthorized individuals. This classifier can help customers manage regulatory compliance obligations such as FINRA Rule 2010 and SEC Rule 10b-5. Detects content in .msg, .docx, .pdf, .txt, .rtf, .jpeg, .jpg, .png, .gif, .bmp, .svg files. +<!--> [!IMPORTANT] +> While in preview, this classifier may capture a large volume of bulk sender/newsletter content due to a known issue. While they're in preview, you can address large volumes of bulk sender/newsletter content by adding the **Message is not sent to any of these domains condition** with a list of domains to exclude.--> > [!IMPORTANT] |
| compliance | Collection Statistics Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/collection-statistics-reports.md | Title: "Collection statistics and reports" -description: "Learn how to access and use statistics and reports for draft collections and collections that have been committed to a review set in Microsoft Purview eDiscovery (Premium)." +description: "Learn how to access and use statistics and reports for collection estimates and collections that have been committed to a review set in Microsoft Purview eDiscovery (Premium)." f1.keywords: - NOCSH Previously updated : 04/08/2022 audience: Admin search.appverid: # Collection statistics and reports in Microsoft Purview eDiscovery (Premium) -After you create a draft collection, you can view statistics on the retrieved items, such as the content locations that contain the most items that matched the search criteria and the number of items returned by the search query. You can also preview a subset of the results. +After you create a collection estimate, you can view statistics on the retrieved items, such as the content locations that contain the most items that matched the search criteria and the number of items returned by the search query. You can also preview a subset of the results. When you've identified the set of documents you want to further examine, you can add the search results to a review set to collect and process. [!INCLUDE [purview-preview](../includes/purview-preview.md)] -## Statistics and reports for draft collections +## Search statistics for collection estimates -This section describes the statistics that are available for draft collections. These statistics are available on the **Search statistics** tab on the flyout page of a draft collection. +This section describes the statistics that are available for collection estimates. These statistics are available on the **Search statistics** tab on the flyout page of a collection estimate. ### Collection estimates This section displays a graphical summary of the estimated items returned by the collection. This indicates the number of items that match the search criteria of the collection. This information gives you an idea about the estimated number of items returned by the collection. - - - **Estimated items by locations**: The total number of estimated items returned by the collection. The specific number of items located in mailboxes and located in sites is also displayed.- - **Estimated locations with hits**: The total number of content locations that contain items returned by the collection. The specific number of mailbox and site locations is also displayed.- - **Data volume by location (in MB)**: The total size of all estimated items returned by the collection. The specific size of mailbox items and site items is also displayed. + + ### Condition report This section displays statistics about the collection search query and the number of estimated items that matched different parts of the search query. You can use these statistics to analyze the number of items that match each component of search query. This can help you refine the search criteria for the collection and if necessary narrow the scope of the collection. - **Location type**: The type of content location that the query statistics are applicable to. The value of **Exchange** indicates a mailbox location; a value of **SharePoint** indicates a site location.- - **Part**: The part of the search query the statistics are applicable to. **Primary** indicates the entire search query. **Keyword** indicates the statistics in the row are for a specific keyword. If you use a keyword list when for the search query in the collection, statistics for each component of the query are included in this table.--- **Condition**: The actual component (keyword or condition) of the search query that was run for the draft collection that returned the statistics displayed in the corresponding row.-+- **Condition**: The actual component (keyword or condition) of the search query that was run for the collection estimate that returned the statistics displayed in the corresponding row. - **Locations with hits**: The number of the content locations (specified by the **Location type** column) that contain items that match the primary or keyword query listed in the **Condition** column.- - **Items**: The number of items (from the specified content location) that match the query listed in the **Condition** column. As previously explained, if an item contains multiple instances of a keyword that is being searched for, it's only counted once in this column.- - **Size (MB)**: The total size of all items that were found (in the specified content location) that match the search query in the **Condition** column. + + ### Top locations This section displays statistics about the specific content locations with the most items returned by the collection. -- The name of the location name (the email address of mailboxes and the URL for sites).--- Location type (a mailbox or site).--- Estimated number of items in the content location returned by the collection.+- **Location**: The name of the location (the email address of mailboxes and the URL for sites). +- **Location type**: A mailbox will have an *Exchange* type and SharePoint sites will have a *SharePoint* type. +- **Items**: Estimated number of items in the content location returned by the collection. +- **Size**: The total size of estimated items in each content location. -- The total size of estimated items in each content location.+ ## Statistics and reports for committed collections This section describes the statistics that are available after you commit a coll After you commit a collection to a review set, the following tabs are displayed on the flyout page of the committed connection. Each of these tabs contains different types of information about the collection. - + ++### Summary tab for collections ++The **Summary** tab for committed collections contains several sections that provide information about the collection items, item estimates and locations, indexing, file types, and more. ++#### Collection overview (preview) -### Collection contents +The **Collection overview (preview)** section on the **Summary** tab of a committed review set contains information about how items were found, retrieved, and processed as part of the collection. The information in this section is a summary of the information gathered and displayed during the initial collection estimate and includes information gathered and processed during the collection committal to the the review set. You can use the information in this section to help improve understanding on how the final collection data evolves from the estimate data during collection committal and processing. -This section of the **Summary** tab contains statistics and other information about the items that were collected from the data sources in the collection and added to the review set. +This information is segmented and displayed in the following sub-sections: ++- **Locations with hits**: This section summarizes the number of locations searched and the number of location with hits based on the conditions defined in the collection estimate. It also displays the number and type of locations searched. ++  ++- **Pre-collection estimates**: This section summarizes number of items and size of the total items calculated for the collection estimate (before the collection is committed). A count of any items that were [partially indexed](/microsoft-365/compliance/partially-indexed-items-in-content-search) is also displayed. ++  ++- **Collection items**: This section displays the type, count, and a description of all items retrieved from locations with hits during the committal of the collection to the review set. During this process, there may be some addition and consolidation of items during processing. Additions and consolidations may include types included in the following table: ++ |**Item type**|**Item type description**| + |:|:| + | Items with hits | Estimated number of items found by search. | + | Review set duplicates | Items that are already in the same review set are not collected. | + | Search duplicates | Duplicate instances of the same items are not collected. | + | All versions | All versions of items in SharePoint are collected. | + | Historical versions | Historical versions maintained by SharePoint are collected. | + | Cloud attachments | Cloud attachments are identified and collected from SharePoint links. | + | Version as shared | The shared versions of items are collected in addition to their latest versions. | + | Contextual Teams conversations | Additional chat messages that might be relevant are collected. | + | Consolidated chat transcripts | Collected chat messages are consolidated into fewer HTML transcripts. | + | Retrieval exceptions | Access time outs, empty files, and other exceptions. | + | Total items collected | Total number of items collected from various locations. | ++- **Processing to review set**: This section displays the type, count, and description of the items that were added to the review set from the collection estimate. Items are decompressed, scanned for text, reindexed, and processed in preparation for the review. ++  ++#### Collection contents ++The **Collection contents** section on the **Summary** tab of a committed review set contains statistics and other information about the items that were collected from the data sources in the collection and added to the review set. - **Total extracted items**. The total number of items added to the review set. This number indicates the sum of parent items and child items added to the review set. This section of the **Summary** tab contains statistics and other information ab > Hover the cursor over the parent or child item bars to display the total number of parent or child items. - **Parent items**. The number of items returned by the collection that was used to collect the items that were added to the review set. This number corresponds to (and is equal to) the estimated number of items that is displayed in the **Collection parameters** section. The number of parent items he collection information that was used to collect the items that were added to the review set.- + A parent item might contain multiple child items. For example, an email message is a parent item if it contains an attached file or has a cloud attachment. In this case, the attached file or the target file of the cloud attachment is considered a child item. When you commit a collection, parent items and any corresponding child items (like attached files and cloud attachments) are added to the review set as individual items or files. - **Child items**. The number of child items added to the review set. Only child items that are file attachments and cloud attachments are added to the review set as individual files. Other types of child items, such as email signatures and images, are extracted from a parent item and then processed by Optical Character Recognition (OCR) to extract any text from the child item. Text extracted from these types of child items is then added to its parent item so you can view it in the review set. By not adding child items to the review set as a separate file, eDiscovery (Premium) helps streamline the review process by limiting the number of potentially immaterial items in the review set.- - **Unique items**. The number of unique items added to the review set. Unique items are unique to the review set. All items are unique when the first collection is added to a new review set because there were no previous items in the review set.+- **Identified duplicate items**. The number of items from the collection that weren't added to the review set because the same item already exists in the review set. Statistics about duplicate items can help explain the differences between the number of estimated items from a collection estimate and the actual number of items added to the review set. -- **Identified duplicate items**. The number of items from the collection that weren't added to the review set because the same item already exists in the review set. Statistics about duplicate items can help explain the differences between the number of estimated items from a draft collection and the actual number of items added to the review set.--### Indexing +#### Indexing The **Indexing** section on the **Summary** tab of a committed review set contains indexing information about the items added to the review set. -**New indexed items**. The number of items that were newly indexed before they were added to the review set. Examples of a newly indexed item are child items extracted from a parent item and then indexed before they're added to the review set. Also, items that aren't located in custodial data sources and non-custodial content locations listed on the **Data sources** tab in the case are indexed before they're added to the review. For example, newly indexed items would include items collected from additional locations. +- **New indexed items**. The number of items that were newly indexed before they were added to the review set. Examples of a newly indexed item are child items extracted from a parent item and then indexed before they're added to the review set. Also, items that aren't located in custodial data sources and non-custodial content locations listed on the **Data sources** tab in the case are indexed before they're added to the review. For example, newly indexed items would include items collected from additional locations. ++- **Updated indexed items**. The number of partially indexed items that were successfully indexed and added to the review set. This statistic indicates the partially indexed items from custodial and non-custodial content locations **Data sources** tab that were successfully indexed when the collection was committed to the review set. -**Updated indexed items**. The number of partially indexed items that were successfully indexed and added to the review set. This statistic indicates the partially indexed items from custodial and non-custodial content locations **Data sources** tab that were successfully indexed when the collection was committed to the review set. +- **Indexing errors**. The number of partially indexed items that couldn't be indexed before they were added to the review set. These items might require error remediation. -**Indexing errors**. The number of partially indexed items that couldn't be indexed before they were added to the review set. These items might require error remediation. +#### Collection file types -### Collection parameters +The **Collection file types** section on the **Summary** tab of a committed review set displays the item count for each file type included in the collection. File types include email, image, document, audio, video file types and more. For a complete list of the supported file types, see [Supported file types in eDiscovery (Premium)](supported-filetypes-ediscovery20.md). -This section displays the collection information that was used to collect the items that were added to the review set. This tab displays information that is similar to the information on the **Search statistics** tab. This section provides a quick snap shot of the search query used by the collection, the content locations that were searched, and the estimated collection results. As previously explained, the number of estimated items in this section would be equal to the number of parent items shown in the **Collection contents** section. +#### Errors -### Search statistics tab +The **Errors** section on the **Summary** tab of a committed review set displays the type and number of errors encountered during the collection committal. Errors may include files with a zero size, protected files, malformed files, internal errors, and more. An error report in .csv format can be downloaded by selecting **Download your errors report** in this section. -The statistics displayed on the **Search statistics** tab are the same statistics from the last time that a draft collection was run. This includes collection estimates, condition report, and top locations. This information is preserved from the draft collection for historical reference, and can be compared to the actual collection that was committed to the review set. +#### Collection parameters -## Differences between draft collection estimates and the actual committed collection +The **Collection parameters** section on the **Summary** tab of a committed review set displays the collection information that was used to collect the items that were added to the review set. This tab displays information that is similar to the information on the **Search statistics** tab. This section provides a quick snap shot of the search query used by the collection, the content locations that were searched, and the estimated collection results. As previously explained, the number of estimated items in this section would be equal to the number of parent items shown in the **Collection contents** section. -When you run a draft collection, an estimate of the number of items (and their total size) that meet the collection criteria is displayed on the **Summary** tab and in **Collection estimates** section of the **Search statistics** tab. After you commit a draft collection to a review set, the actual number of items (and their total size) added the review set are often different from the estimates. In most cases, more items are added to the review set than were estimated from the draft collection. The following list describes the most common reasons for these differences and tips for identifying them: +## Data sources tab for collections -- **Child items**. Child items (such as files attachments and cloud attachments) that are extracted from their parent items and added as individual files. The number of child items may increase the number of items that are actually added to the review set. In general, the number of parent items identified in the **Collection contents** section on the **Summary** tab of a committed collection should be equal to the number of estimated items from the draft collection.+The **Data sources** tab contains information about custodial and non-custodial data sources. The **Custodial data sources** section displays the all custodial data sources for each custodian included in the collection. The **Non-custodial data sources** section displays the all non-custodial data sources for the collection. The data source information displayed here is also available on the main **Data sources** tab for each case. -- **Duplicate items**. Items from the draft collection that have already been added to the review set in a previous collection won't be added. As previously explained, the number of duplicate items in the collection is displayed in the **Collection contents** section on the **Summary** tab.+## Search statistics tab for collections -- **Collection configuration options**. When you commit a draft collection to a review set, you have to option to include conversation threads, cloud attachments, and document versions. Any of these items that are added to the review set aren't included in the estimates of the draft collection. They're identified and collected only when you commit the collection. Selecting these options will most likely increase the number of items added to the review set. +The statistics displayed on the **Search statistics** tab are the same statistics from the last time that a collection estimate was run. This includes collection estimates, condition report, and top locations. This information is preserved from the collection estimate for historical reference, and can be compared to the actual collection that was committed to the review set. - For example, multiple versions of SharePoint documents aren't included in the estimate for the draft collection. But if you select the option to include all document versions when you commit a draft collection, the actual number (and total size) of items added to the review set will increase. +## Differences between collection estimates and the actual committed collection - For more information about these options, see [Commit a draft collection to a review set](commit-draft-collection.md#commit-a-draft-collection-to-a-review-set-in-ediscovery-premium). +When you run a collection estimate, an estimate of the number of items (and their total size) that meet the collection criteria is displayed on the **Summary** tab and in **Collection estimates** section of the **Search statistics** tab. After you commit a collection estimate to a review set, the actual number of items (and their total size) added the review set are often different from the estimates. In most cases, more items are added to the review set than were estimated from the collection estimate. The following list describes the most common reasons for these differences and tips for identifying them: -Here are other reasons why the estimated results from a draft collection can be different that the actual committed results. +- **Child items**. Child items (such as files attachments and cloud attachments) that are extracted from their parent items and added as individual files. The number of child items may increase the number of items that are added to the review set. In general, the number of parent items identified in the **Collection contents** section on the **Summary** tab of a committed collection should be equal to the number of estimated items from the collection estimate. +- **Duplicate items**. Items from the collection estimate that have already been added to the review set in a previous collection won't be added. As previously explained, the number of duplicate items in the collection is displayed in the **Collection contents** section on the **Summary** tab. +- **Collection configuration options**. When you commit a collection estimate to a review set, you have to option to include conversation threads, cloud attachments, and document versions. Any of these items that are added to the review set aren't included in the estimates of the collection estimate. They're identified and collected only when you commit the collection. Selecting these options will most likely increase the number of items added to the review set. -- **The way results are estimated for draft collections**. An estimate of the search results returned by a draft collection is just that, an estimate (and not an actual count) of the items that meet the collection query criteria. To compile the estimate of email items, a list of the message IDs that meet the search criteria is requested from the Exchange database. But when you commit the collection to a review set, the collection is rerun and the actual messages are retrieved from the Exchange database. So differences might result because of how the estimated number of items and the actual number of items are determined.+ For example, multiple versions of SharePoint documents aren't included in the estimate for the collection estimate. But if you select the option to include all document versions when you commit a collection estimate, the actual number (and total size) of items added to the review set will increase. -- **Changes that happen between the time when estimating and committing draft collections**. When you commit a draft collection to a review set, the search is rerun to collect that most recent items in the search index that meet the search criteria. It's possible that additional items were created, sent, or deleted that meet the search criteria in the time between when the draft collection was last run and when the draft collection is committed to a review set. It's also possible that items that were in the search index when the draft collection results were estimated are no longer there because they were purged from a data source before committing the collection. One way to mitigate this issue is to specify a date range for a collection. Another way is to place a hold on content locations so that items are preserved and can't be purged.+ For more information about these options, see [Commit a collection estimate to a review set](commit-draft-collection.md#commit-a-collection-estimate-to-a-review-set-in-ediscovery-premium). -- **Unindexed items**. If the draft collection included searching all Exchange mailboxes or all SharePoint sites, then only unindexed items from content locations that contain items that match the collection criteria will be added to the review set. In other words, if no results are found in a mailbox or site, then any unindexed items in that mailbox or site won't be added to the review set. However, unindexed items from all content locations (even those that don't contain items that match the collection query) will be included in the estimated collection results.+Here are other reasons why the estimated results from a collection estimate can be different that the actual committed results. +- **The way results are estimated for collection estimates**. An estimate of the search results returned by a collection estimate is just that, an estimate (and not an actual count) of the items that meet the collection query criteria. To compile the estimate of email items, a list of the message IDs that meet the search criteria is requested from the Exchange database. But when you commit the collection to a review set, the collection is rerun and the actual messages are retrieved from the Exchange database. So differences might result because of how the estimated number of items and the actual number of items are determined. +- **Changes that happen between the time when estimating and committing collection estimates**. When you commit a collection estimate to a review set, the search is rerun to collect that most recent items in the search index that meet the search criteria. It's possible that additional items were created, sent, or deleted that meet the search criteria in the time between when the collection estimate was last run and when the collection estimate is committed to a review set. It's also possible that items that were in the search index when the collection estimate results were estimated are no longer there because they were purged from a data source before committing the collection. One way to mitigate this issue is to specify a date range for a collection. Another way is to place a hold on content locations so that items are preserved and can't be purged. +- **Unindexed items**. If the collection estimate included searching all Exchange mailboxes or all SharePoint sites, then only unindexed items from content locations that contain items that match the collection criteria will be added to the review set. In other words, if no results are found in a mailbox or site, then any unindexed items in that mailbox or site won't be added to the review set. However, unindexed items from all content locations (even those that don't contain items that match the collection query) will be included in the estimated collection results. - **Partially indexed items**: Selection of this option adds partially indexed items from additional data sources to the review set. If the collection searched additional data sources (as specified on the **Additional locations** page in the collections wizard), there may be partially indexed items from these locations that you want to add to the review set. Custodial and non-custodial data sources typically don't have partially indexed items. That's because the Advanced indexing process reindexes items when custodial and non-custodial data sources are added to a case. Also, Adding partially indexed items will increase the number of items added to the review set. <p> After partially indexed items are added to the review set, you can apply a filter to specifically view these items. For more information, see [Filter partially indexed items](review-set-search.md#filter-partially-indexed-items) - Alternatively, if the draft collection included specific content locations (which means that specific mailboxes or sites where specified on the **Additional locations** page in the draft collection wizard), then unindexed items (that aren't excluded by the collection criteria) from the content locations specified in the search will be exported. In this case, the estimated number of unindexed items and the number of unindexed items that are added to the review set should be the same. + Alternatively, if the collection estimate included specific content locations (which means that specific mailboxes or sites where specified on the **Additional locations** page in the collection estimate wizard), then unindexed items (that aren't excluded by the collection criteria) from the content locations specified in the search will be exported. In this case, the estimated number of unindexed items and the number of unindexed items that are added to the review set should be the same. |
| compliance | Collections Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/collections-overview.md | search.appverid: # Learn about collections in eDiscovery (Premium) -When organizations are faced with gathering the communications and content that may be relevant to an investigation or potential litigation, they face a significant challenge under the best of circumstances. In todayΓÇÖs modern workplace, the volume, variety, and velocity of content is enabling innovation and remote work, while also expanding the requirements and process for managing collections for eDiscovery investigations. +When organizations are faced with gathering the communications and content that may be relevant to an investigation or potential litigation, they face a significant challenge under the best of circumstances. In today's modern workplace, the volume, variety, and velocity of content is enabling innovation and remote work, while also expanding the requirements and process for managing collections for eDiscovery investigations. -The collection workflow poses significant technical challenges around extracting content from native locations and sources. It's also a critical point in the assessment and strategy for common litigation or investigations scenarios. As organizations begin to assess an investigation, the first questions asked are who was involved? After identifying who was involved, these custodians can quickly be placed on hold to preserve relevant content. The next question is what took place? To answer this second fundamental question of any investigation, managers must turn to the data. To quickly assess the most relevant content to the question of what took place, managers start to refine the target of the question to ensure that the collection results are comprehensive without being too broad. +Collections in eDiscovery (Premium) help eDiscovery managers quickly scope a search for content across email, documents, Teams reactions, and other content in Microsoft 365. Collections provide managers with an estimate of the content that may be relevant to the case. This estimate allows managers to make quick, informed decisions about the size and scope of content relevant to a case. eDiscovery managers can create a collection to search custodial data sources (such as mailboxes and SharePoint sites), non-custodial data sources (such as SharePoint sites, Group mailboxes, and Microsoft Teams), and by using specific search criteria (such as keywords and date ranges) to quickly define the scope of their collection. -Collections in eDiscovery (Premium) help eDiscovery managers quickly scope a search for content across email, documents, Teams reactions, and other content in Microsoft 365. Collections provide managers with an estimate of the content that may be relevant to the case. This allows managers to make quick, informed decisions about the size and scope of content relevant to a case. eDiscovery managers can create a collection to search custodial data sources (such as mailboxes and SharePoint sites) and by using specific search criteria (such as keywords and date ranges) to quickly define the scope of their collection. +After the collection is defined, eDiscovery managers must first submit the collection to create an estimate. The estimate includes estimates for data volume, the content locations that contain results, and the number of hits for search query condition, and more. These insights can help to inform if the collection should be revised to narrow or expand the scope of the collection before moving on the review and analyze stages in the eDiscovery workflow. -After the collection is defined, eDiscovery managers can save the collection as a draft and get estimates, including estimates for data volume, the content locations that contain results, and the number of hits for search query condition. These insights can help to inform if the collection should be revised to narrow or expand the scope of the collection before moving on the review and analyze stages in the eDiscovery workflow. --When the manager is satisfied with the scope of the collection and the estimated amount of content that's likely to be responsive, the manager can add or *commit* the content to a review set. When committing a collection to a review set, that manager also has the options to include chat conversations, cloud attachments, and document versions. The content in the collection also goes through another level of processing during ingestion into the review set. and the collection will be updated with the final collection summary. After content is added to the review set, eDiscovery managers can continue to query, group, and refine the content in to help with minimization and review. Additionally, the collection is updated with information and statistics about the content committed to the review set. This provides a historical reference about the content in the collection. --With the release of collections in an eDiscovery (Premium), the **Searches** tab has been renamed to **Collections** in an eDiscovery (Premium) case in the Microsoft Purview compliance portal. The steps to define the scope and size of the collection follow the same process as search to define locations and conditions. Save as draft and get preview estimates enables quick validation of targeted scope of collections prior to committing a full search and collection into the review set. This enables improved job management, and targeted iterations for starting to minimize content during the search and collection process. +When the manager is satisfied with the scope of the collection and the estimated amount of content that's likely to be responsive, the manager can add or *commit* the content to a review set. When committing a collection to a review set, that manager also has the options to include chat conversations, cloud attachments, partially indexed items, and document versions. The content in the collection also goes through another level of processing during ingestion into the review set. and the collection will be updated with the final collection summary. After content is added to the review set, eDiscovery managers can continue to query, group, and refine the content in to help with minimization and review. Additionally, the collection is updated with information and statistics about the content committed to the review set. This information provides a historical reference about the content in the collection. [!INCLUDE [purview-preview](../includes/purview-preview.md)] With the release of collections in an eDiscovery (Premium), the **Searches** tab To get started using collections in eDiscovery (Premium), here's a basic workflow and descriptions of each step in the process. - + -1. **Create and run a draft collection**. The first step is to create a draft collection and define the custodial and non-custodial data sources to search. You can also search other data sources that haven't been added to the case. After you add the data sources, you configure the search query to search the data sources for content relevant to the case. You can keywords, properties, and conditions to build search queries that return content that's likely most relevant to the case. For more information, see [Create a draft collection](create-draft-collection.md). +1. **Create and run a collection estimate**. The first step is to create a collection estimate and define the custodial and non-custodial data sources to search. You can also search other data sources that haven't been added to the case. After you add the data sources, you configure the search query to search the data sources for content relevant to the case. You can keywords, properties, and conditions to build search queries that return content that's likely most relevant to the case. For more information, see [Create a collection estimate](create-draft-collection.md). -2. **Review estimates and statistics**. After you create a draft collection and run it, the next step is to view collection statistics to help you verify whether relevant content is being found and the content locations with the most hits. You can also preview a sample of the search results to further help you determine if the content is within scope of your investigation. For more information, see [Statistics and reports for draft collections](collection-statistics-reports.md#statistics-and-reports-for-draft-collections). +2. **Review estimate and statistics**. After you create a collection estimate and run it, the next step is to view collection statistics to help you verify whether relevant content is being found and the content locations with the most hits. You can also review a sample of the search results to further help you determine if the content is within scope of your investigation. For more information, see [Search statistics for collection estimates](collection-statistics-reports.md#search-statistics-for-collection-estimates). -3. **Revise and rerun a draft collection**. Based on the estimates and statistics returned by the collection, you can edit the draft collection by changing the data sources that are searched and the search query to expand or narrow the collection. You can update and rerun the draft collection until you're confident that collection contains the content that's most relevant to your case. +3. **Revise & rerun a collection estimate**. Based on the estimates and statistics returned by the collection, you can edit the collection estimate by changing the data sources that are searched and the search query to expand or narrow the collection. You can update and rerun the collection estimate until you're confident that collection contains the content that's most relevant to your case. -4. **Commit a draft collection to a review set**. When you're satisfied that the collection returns the type content that is relevant to the case, you can commit the collection to the review set. When you commit a collection, you have the option to add conversation threads, cloud attachments, and document versions to the review set, all of which might be relevant to the case. +4. **Commit a collection estimate to a review set**. When you're satisfied that the collection returns the type content that is relevant to the case, you can commit the collection to the review set. When you commit a collection, you have the option to add conversation threads, cloud attachments, and document versions to the review set, all of which might be relevant to the case. When you commit a collection, child items such as email signatures and images are extracted from a parent item (such as an email message, chat message, or document) and then processed by Optical Character Recognition (OCR) to extract any text from the child item. Text extracted from child items is then added to its parent item so you can view it in the review set. By not adding child items to the review set as a separate file, eDiscovery (Premium) helps limit the number of potentially immaterial items added to the review set. For more information about how child items are handled, see [Collection statistics and reports](collection-statistics-reports.md#collection-contents). - For more information, see [Commit a draft collection to a review set](commit-draft-collection.md). + For more information, see [Commit a collection estimate to a review set](commit-draft-collection.md). -5. **Review collection summary and statistics**. After you commit a collection to a review set, information about the collection is retained, such as statistics about extracted items, deep indexing, the search query used for the collection, and the content locations that items were collected from. Also, committed collections can't be edited or rerun. You can only copy or delete them. Preserving collections provides a historical record of the collected items that were added to a review set. For more information, see [Statistics and reports for committed collections](collection-statistics-reports.md#statistics-and-reports-for-committed-collections). +5. **Review collection overview**. After you commit a collection to a review set, information about the collection is retained, such as statistics about extracted items, deep indexing, the search query used for the collection, and the content locations that items were collected from. Also, committed collections can't be edited or rerun. You can only copy or delete them. Preserving collections provides a historical record of the collected items that were added to a review set. For more information, see [Statistics and reports for committed collections](collection-statistics-reports.md#statistics-and-reports-for-committed-collections). |
| compliance | Commit Draft Collection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/commit-draft-collection.md | Title: "Commit a draft collection to a review set" -description: "After you create and iterate on a draft collection, you can commit it to a review set. When you commit a draft collection, the collected items are added to review set in the case. After the collected items are in the review set, you can analyze, review, and export them." + Title: "Commit a collection estimate to a review set" +description: "After you create and iterate on a collection estimate, you can commit it to a review set. When you commit a collection estimate, the collected items are added to review set in the case. After the collected items are in the review set, you can analyze, review, and export them." f1.keywords: - NOCSH Previously updated : audience: Admin search.appverid: - MET150 -# Commit a draft collection to a review set in eDiscovery (Premium) +# Commit a collection estimate to a review set in eDiscovery (Premium) -When you're satisfied with the items you've collected in a draft collection and are ready to analyze, tag, and review them, you can add a collection to a review set in the case. When you commit a draft collection to a review set, collected items are copied from their original content location in Microsoft 365 to a review set. A review set is a secure, Microsoft-provided Azure Storage location in the Microsoft cloud. +When you're satisfied with the items you've collected in a collection estimate and are ready to analyze, tag, and review them, you can commit a collection to a review set in the case. When you commit a collection estimate to a review set, collected items are copied from their original content location in Microsoft 365 services and added to a review set. A review set is a secure, Microsoft-provided Azure Storage location in the Microsoft cloud. [!INCLUDE [purview-preview](../includes/purview-preview.md)] -## Commit a draft collection to a review set +## Commit a collection estimate to a review set -1. In the Microsoft Purview compliance portal, open the Microsoft Purview eDiscovery (Premium) case, and then select the **Collections** tab to display a list of the collections in the case. +1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com/), navigate to **eDiscovery** > **Premium**. ++2. Select the **Cases** tab and open an eDiscovery (Premium) case, and then select the **Collections** tab.  > [!TIP]- > A value of `Estimated` in the **Status** column identifies the draft collections that can be added to a review set. A status of `Committed` indicates that a collection has already been added to a review set. --2. On the **Collections** page, select the draft collection that you want to commit to a review set. + > A value of `Estimated` in the **Status** column identifies the collection estimates that can be added to a review set. A status of `Committed` indicates that a collection has already been added to a review set. -3. On the bottom of the flyout page, select **Actions** > **Edit collection**. +3. On the **Collections** page, select the collection estimate that you want to commit to a review set. -4. In the edit collection wizard, click **Next** until the **Save draft or collect** page is displayed. +4. On the bottom of the flyout page, select **Actions** > **Commit collection**. 5. Configure the following settings: - 1. Select **Collect items and add to review set**. -- 2. Decide whether to add the collection to a new review set (which is created after you submit the collection) or add it to an existing review set. Complete this section based on your decision. + 1. Decide whether to **Add to a new review set** (which is created after you submit the collection) or **Add to an existing review set**. Complete this section based on your decision. - 3. Configure the additional collection settings: + 2. Configure the **Additional collection settings**: - . + . - a. **Teams and Yammer messages**: Select this option to add conversation threads to the collection that include the chat items returned by the search query in the collection. This means that the chat conversation that contains items that match the search criteria is reconstructed. This lets you review chat items in the context of the back and forth conversation. For more information, see [Conversation threading in eDiscovery (Premium)](conversation-review-sets.md). + A. **Teams and Yammer messages**: Select this option to add conversation threads to the collection that include the chat items returned by the search query in the collection. This means that the chat conversation that contains items that match the search criteria is reconstructed. This lets you review chat items in the context of the back and forth conversation. For more information, see [Conversation threading in eDiscovery (Premium)](conversation-review-sets.md). - b. **Cloud attachments**: Select this option to include modern attachments or linked files when the collection results are added to the review set. This means the target file of a modern attachment or linked file is added to the review set. + B. **Cloud attachments**: Select this option to include modern attachments or linked files when the collection results are added to the review set. This means the target file of a modern attachment or linked file is added to the review set. > [!NOTE] > The two options to collect contextual Teams and Yammer messages and cloud attachments are selected by default (and grayed out) for cases that were created using the new case format. For more information, see [Use the new case format](advanced-ediscovery-new-case-format.md). - c. **Partially indexed items**: Select this option to add partially indexed items from additional data sources to the review set. If the collection searched additional data sources (as specified on the **Additional locations** page in the collections wizard), there may be partially indexed items from these locations that you want to add to the review set. Custodial and non-custodial data sources typically don't have partially indexed items. That's because the Advanced indexing process reindexes items when custodial and non-custodial data sources are added to a case. Also, Adding partially indexed items will increase the number of items added to the review set. <p> After partially indexed items are added to the review set, you can apply a filter to specifically view these items. For more information, see [Filter partially indexed items](review-set-search.md#filter-partially-indexed-items) + C. **Partially indexed items**: Select this option to add partially indexed items from additional data sources to the review set. If the collection searched additional data sources (as specified on the **Additional locations** page in the collections wizard), there may be partially indexed items from these locations that you want to add to the review set. Custodial and non-custodial data sources typically don't have partially indexed items. That's because the Advanced indexing process reindexes items when custodial and non-custodial data sources are added to a case. Also, Adding partially indexed items will increase the number of items added to the review set. - d. **SharePoint versions**: Select this option to enable the collection of all versions of a SharePoint document per the version limits and search parameters of the collection. Selecting this option will significantly increase the size of items that are added to the review set. After document versions are added to the review set, + D. **Collect all SharePoint versions**: Select this option to enable the collection of all versions of a SharePoint document per the version limits and search parameters of the collection. Selecting this option will significantly increase the size of items that are added to the review set. - 4. Configure the settings to define the scale of the collection to add to the review set: +6. Configure the settings to define the scale of the collection to add to the review set: - - **Add all collection results**: Select this option to add all the items that match the search criteria of the collection to the review set. + - **Add all of collection to review set**: Select this option to add all the items that match the search criteria of the collection to the review set. - - **Add a sample of the collection results**: Select this option to add a sample of the collection results to the review set instead of adding all results. If you select this option, click **Edit sample parameters** and choose one of the following options: + - **Add only collection sample to review set**: Select this option to add a sample of the collection results to the review set instead of adding all results. If you select this option, select **Edit sample parameters** and choose one of the following options: - - **Sample based on confidence**: Items from the collection are added to the review set will be determined by the statistical parameters that you set. If you typically use a confidence level and interval when sampling results, specify them in the drop-down boxes. Otherwise, use the default settings. + - **Sample based on confidence**: Items from the collection are added to the review set will be determined by the statistical parameters that you set. If you typically use a confidence level and confidecne interval when sampling results, specify them in the drop-down boxes. Otherwise, use the default settings. - - **Randomly sample**: Items from the collection are added to the review set based on a random selection of the specified percentage of the total number of items returned by the search. + - **Randomly sample**: Items from the collection are added to the review set based on a random selection of the specified sample size percentage of the total number of items returned by the search. -6. On the **Review your collection** page, you can review the collection settings that you configured on the previous page. Click **Edit** if you want to change them. +7. Select **Submit** to commit the collection to the review set. -7. Click **Submit** to create the draft collection. A page is displayed confirming that the collection was created. +## What happens after you commit a collection estimate -## What happens after you commit a draft collection +When you commit a collection estimate to a review set, the following things happen: -When you commit a draft collection to a review set, the following things happen: --- If you created a new review set to commit the collection to, the review set is created and displayed on the **Review sets** tab in the case. The status of the new review set is **Ready**. This status value means the review set has been created; it doesn't mean that the collection has been added to the review set. The status of adding items in the collection to the review set is displayed on the **Collections** tab.+- If you created a new review set to commit the collection to, the review set is created and displayed on the **Review sets** tab in the case. This status value means the review set has been created; it doesn't mean that the collection has been added to the review set. The status of adding items in the collection to the review set is displayed on the **Collections** tab and in the **Summary** tab on the collection flyout page. - The collection search query is run again. This means the actual search results copied to the review set may be different than the estimated results that were returned when the collection search was last run. +- The progress of the collection commitment is displayed on the collection estimate flyout page. From here, you can monitor the progress and status of the collection, including information about sources and items collected. During the collection process, the status of the collection is shown as *Adding to review set* on the **Collection** tab. ++ . + - All items in the search results are copied from the original data source in the live service, and copied to a secure Azure Storage location in the Microsoft cloud. - Encrypted SharePoint and OneDrive documents and encrypted files attached email messages that's returned in the search results are decrypted when you commit the collection to a review set. You can review and query the decrypted files in the review set. For more information, see [Decryption in Microsoft 365 eDiscovery tools](ediscovery-decryption.md). - Optical character recognition (OCR) functionality extracts text from images, and includes the image text with the content that's added to a review set. For more information, see the [Optical character recognition](#optical-character-recognition) section in this article. -- After the commit is successfully completed, the value of the status column of on the **Collections** tab is changed to `Committed`.+- After the commit is successfully completed, the value of the status column of on the **Collections** tab is changed to *Committed* and the **Summary** tab on the collection flyout page is updated with the full results of the committed collection. ## Optical character recognition |
| compliance | Compliance Easy Trials Compliance Playbook | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-easy-trials-compliance-playbook.md | Set up compliance boundaries for eDiscovery investigations: ### Step 5 (optional): eDiscovery PremiumΓÇÖs collection tool -Use the [eDiscovery (Premium) collection workflow](create-draft-collection.md#create-a-draft-collection) to quickly find email in Exchange mailboxes, documents in SharePoint sites and OneDrive locations, and instant messaging conversations in Teams. Collections in eDiscovery (Premium) help eDiscovery managers quickly scope a search for content across email, documents, Teams reactions, and other content in Microsoft 365. Collections provide managers with an estimate of the content that may be relevant to the case. +Use the [eDiscovery (Premium) collection workflow](create-draft-collection.md#create-a-collection-estimate) to quickly find email in Exchange mailboxes, documents in SharePoint sites and OneDrive locations, and instant messaging conversations in Teams. Collections in eDiscovery (Premium) help eDiscovery managers quickly scope a search for content across email, documents, Teams reactions, and other content in Microsoft 365. Collections provide managers with an estimate of the content that may be relevant to the case. [Learn more about collection queries and estimates.](building-search-queries.md) |
| compliance | Conversation Review Sets | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/conversation-review-sets.md | Here are few definitions to help you get start using conversation reconstruction In other apps (such as group chat messages in Teams), there is not a formal reply chain and instead messages appear as a "flat river of messages" within a single thread. In these types apps, conversations are inferred from a group of messages that occur within a certain time. This "soft-grouping" of messages (as opposed to a reply chain) represent the "back and forth" conversation about a specific topic of interest. -## Step 1: Create a draft collection +## Step 1: Create a collection estimate -After you have identified relevant custodians and content locations, you can create a search to find potentially relevant content. On the **Collections** tab in the eDiscovery (Premium) case, you can create a collection by clicking **New collection** and following the wizard. For information about how you can create a collection, build a search query, and preview the search results, see [Create a draft collection](create-draft-collection.md). +After you have identified relevant custodians and content locations, you can create a search to find potentially relevant content. On the **Collections** tab in the eDiscovery (Premium) case, you can create a collection by clicking **New collection** and following the wizard. For information about how you can create a collection, build a search query, and preview the search results, see [Create a collection estimate](create-draft-collection.md). -## Step 2: Commit a draft collection to a review set +## Step 2: Commit a collection estimate to a review set -After you have reviewed and finalized the search query in a collection, you can add the search results to a review set. When you add your search results into a review set, the original data is copied to an Azure Storage area to facilitate the review and analysis process. For more information about adding search results to a review set, see [Commit a draft collection to a review set](commit-draft-collection.md). +After you have reviewed and finalized the search query in a collection, you can add the search results to a review set. When you add your search results into a review set, the original data is copied to an Azure Storage area to facilitate the review and analysis process. For more information about adding search results to a review set, see [Commit a collection estimate to a review set](commit-draft-collection.md). When you add items from conversations to a review set, you can use the threaded conversations option to collect contextual messages from conversations that contain items that match the search criteria of the collection. After you select the thread conversations option, the following things can happen: When you add items from conversations to a review set, you can use the threaded 3. After the items have been added to the review set, you can review all the individual messages from *CRC1*. -To enable the threaded conversations option, see [Commit a draft collection to a review set](commit-draft-collection.md#commit-a-draft-collection-to-a-review-set). +To enable the threaded conversations option, see [Commit a collection estimate to a review set](commit-draft-collection.md#commit-a-collection-estimate-to-a-review-set). ## Step 3: Review and export threaded conversations |
| compliance | Create Apply Retention Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-apply-retention-labels.md | As with the desktop version of Outlook on the web, you can also apply retention #### Applying retention labels in OneDrive and SharePoint -Manually applying retention labels is supported in the new SharePoint experience only, and not the classic experience. +Manually applying retention labels is supported in the new experience only, and not the classic experience. To label a document (including OneNote files) in OneDrive or SharePoint, select the item \> in the upper-right corner, choose **Open the details pane** \> **Apply retention label** \> choose the retention label. |
| compliance | Create Draft Collection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-draft-collection.md | Title: "Create a draft collection" -description: "A draft collection is an eDiscovery search of custodial and non-custodial data sources in an eDiscovery (Premium) case that returns a search estimate that matches the search query of the collection. You can review search statistics, preview a sampling of items, and revise and rerun the collection before you commit the results to a review set." + Title: "Create a collection estimate" +description: "A collection estimate is an eDiscovery search of custodial and non-custodial data sources in an eDiscovery (Premium) case that returns a search estimate that matches the search query of the collection. You can review search statistics, preview a sampling of items, and revise and rerun the collection before you commit the results to a review set." f1.keywords: - NOCSH search.appverid: - MET150 -# Create a draft collection in eDiscovery (Premium) +# Create a collection estimate in eDiscovery (Premium) -After you've identified custodians and any non-custodian data sources for the case, you're ready to identify and locate a set of documents that are relevant. You do this by using the Collections tool to search data sources for relevant content. You do this by creating a collection that searches specified data sources for content that matches your search criteria. You have the option to create a *draft collection*, which is an estimate of the items are found or you can create a collection that automatically adds the items to a review set. When you create a draft collection, you can views information about the estimated results that matched the search query, such as the total number and size of items found, the different data sources where they were found, and statistics about the search query. You can also preview a sample of items that were returned by the collection. Using these statistics, you can change the search query and rerun the draft collection to narrow your results. Once you're satisfied with the collection results, you can commit the collection to a review set. When you commit a draft collection, the items returned by the collection are added to a review set for review, analysis, and export. +After you've identified custodians and any non-custodian data sources for the case, you're ready to identify and locate a set of documents that are relevant. You do this by using the Collections tool to search data sources for relevant content. You can create a collection that searches specified data sources for content that matches your search criteria. You must create a *collection estimate*, which is an estimate of the items are found. When you create a collection estimate, you can views information about the estimated results that matched the search query, such as the total number and size of items found, the different data sources where they were found, and statistics about the search query. You can also review a sample of items that were returned by the collection. Using these statistics, you can change the search query and rerun the collection estimate to narrow your results. Once you're satisfied with the collection results, you can commit the collection to a review set. When you commit a collection estimate, the items returned by the collection are added to a review set for review, analysis, and export. [!INCLUDE [purview-preview](../includes/purview-preview.md)] -## Before you create a draft collection +## Recommendations when creating collection estimates -- Add custodians and non-custodial data sources to the case before you create a draft collection. This is required so that you can select the data sources when you create a draft collection. For more information, see:+- Consider [adding custodians](add-custodians-to-case.md) and [non-custodial data sources](non-custodial-data-sources.md) to the case before you create a collection estimate. - - [Add custodians to a case](add-custodians-to-case.md) + This is recommended so that you can quickly select the data sources when you create a collection estimate in the wizard. If you choose to skip adding custodians or non-custodial data sources, you'll have the option to search for these and any additional data sources (ones that haven't been added to the case as custodial or non-custodial locations) in a collection estimate for content that may be relevant to the case. These data sources might include mailboxes, SharePoint sites, and Teams. If this situation is applicable to your case, use additional locations to add these sources to your collection. - - [Add non-custodial data sources to a case](non-custodial-data-sources.md) +- Verify that you have [permissions](/microsoft-365/compliance/assign-ediscovery-permissions) to create a collection estimate for a case. -- You can search additional data sources (ones that haven't been added to the case as custodial or non-custodial locations) in a draft collection for content that may be relevant to the case. These data sources might include mailboxes, SharePoint sites, and Teams. If this situation is applicable to your case, compile a list of these data sources so you can add them to the collection.+## Create a collection estimate -## Create a draft collection +1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com/), navigate to **eDiscovery** > **Premium**. -1. In the Microsoft Purview compliance portal, open the eDiscovery (Premium) case, and then select the **Collections** tab. +2. Select the **Cases** tab and open an eDiscovery (Premium) case, and then select the **Collections** tab. -2. On the **Collections** page, select **New collection** > **Standard collection**. +3. On the **Collections** page, select **New collection**. -3. Type a name (required) and description (optional) for the collection. After the collection is created, you can't change the name, but you can modify the description. +4. On the **Name and description** page, enter a name (required) and description (optional) for the collection. After the collection is created, you can't change the name, but you can modify the description. -4. On the **Custodial data sources** page, do one of the following things to identify the custodial data sources to collect content from: +5. On the **Custodial data sources** page, select one of the following options to identify the custodial data sources to collect content from: - - Click **Select custodians** to search specific custodians that were added to the case. If you use this option, a list of the case custodians is displayed. Select one or more custodians. After you select and add the custodians, you can also select the specific data sources to search for each custodian. These data sources that are displayed were specified when the custodian was added to the case. + - Select **Select custodians** to search specific custodians that were added to the case. If you use this option, a list of the case custodians is displayed. Select one or more custodians. After you select and add the custodians, you can also select the specific data sources to search for each custodian. Data sources that are displayed are specified when the custodian is added to the case. - - Click the **Select all** toggle to search all custodians that were added to the case. When you select this option, all data sources for all custodians are searched. + - Select the **Select all** toggle to search all custodians that were added to the case. When you select this option, all data sources for all custodians are searched. -5. On the **Non-custodial data sources** page, do one of the following things to identify the non-custodial data sources to collect content from: +6. On the **Non-custodial data sources** page, select one of the following options to identify the non-custodial data sources to collect content from: - - Click **Select non-custodial data sources** to select specific non-custodial data sources that were added to the case. If you use this option, a list of data sources displayed. Select one or more of these data sources. + - Select **Select non-custodial data sources** to select specific non-custodial data sources that were added to the case. If you use this option, a list of data sources displayed. Select one or more of these data sources. - - Click the **Select all** toggle to select all non-custodial data sources that were added to the case. + - Select the **Select all** toggle to select all non-custodial data sources that were added to the case. -6. On the **Additional data sources** page, you can select other mailboxes and sites to search as part of the collection. These types of data sources weren't added as custodial or non-custodial data locations in the case. You also have two options when searching additional data sources: +7. On the **Additional locations** page, you can select other mailboxes and sites to search as part of the collection. These types of data sources weren't added as custodial or non-custodial data locations in the case. You also have two options when searching additional data sources: - - To search all content locations for a specific service (Exchange mailboxes, SharePoint and OneDrive sites, or Exchange public folders), click the corresponding **Select all** toggle in the **Status** column. This option will search all content locations in the selected service. + - To search all content locations for a specific service (Exchange mailboxes, SharePoint and OneDrive sites, or Exchange public folders), select the corresponding **Select all** toggle in the **Status** column. This option will search all content locations in the selected service. - - To search specific content location for a service, click the corresponding **Select all** toggle in the **Status** column, and then click **Users, groups or teams** (for Exchange mailboxes) or **Choose sites** for (SharePoint and OneDrive sites) to search specific content locations. + - To search specific content location for a service, select the corresponding **Select all** toggle in the **Status** column, and then select **Users, groups or teams** (for Exchange mailboxes) or **Choose sites** for (SharePoint and OneDrive sites) to search specific content locations. -7. On the **Conditions** page, you can create the search query that is used to collect items from the data sources that you've identified in the previous wizard pages. You can search for keywords, property:value pairs, or use a keyword list. You can also add various search conditions to narrow the scope of the collection. For more information, see [Build search queries for collections](building-search-queries.md). +8. On the **Conditions** page, you can create the search query that is used to collect items from the data sources that you've identified in the previous wizard pages. You can search for keywords, property:value pairs, or use a keyword list. You can also add various search conditions to narrow the scope of the collection. For more information, see [Build search queries for collections](building-search-queries.md). -8. On the **Save as draft or add to review set** page, select **Save collection as draft**. +9. On the **Review your collection and get estimates** page, you'll see a summary of the collection estimate process. Note that the collection estimate will be saved for further review and refinement, but the results won't be automatically committed to a review set. You'll need to decide to commit to a review set later. - > [!NOTE] - > The other option on this page lets you collect items and add them direct to a review set. Instead of creating a draft collection that you can review statistics for and preview a sample of the collection results, this option skips that process and automatically adds the collection to a review set. If you select the second option to add the collection to a review set, you have additional settings to configure, such as collecting entire chat conversation threads in Microsoft Teams and Yammer and collecting cloud attachments (also called *modern attachments*). For more information about these settings, see [Commit a draft collection to a review set](commit-draft-collection.md). +10. On the **Review your collection** page, you can review and update the collection selection, data sources, and conditions that you configured on the previous pages. Select **Edit** for any of the selections and update if needed. -9. On the **Review your collection** page, you can review and update the collection settings that you configured on the previous pages. +11. Select **Submit** to create the collection estimate. A page is displayed confirming that the collection was created. - - **Summary** tab: Review and modify the name and description of the collection, the collection search criteria, additional data locations, and the collection type. +## What happens after you create a collection estimate - - **Sources** tab: Review and modify the custodial and non-custodial data sources for the collection. +After you create a collection estimate, it listed on the **Collections** page in the case and the status shows that it's in progress. A job named **Preparing search preview and estimates** is also created and displayed on the **Jobs** page in the case. During the collection estimate process, eDiscovery (Premium) performs a search estimate using the search criteria and data sources that you specified in the collection. eDiscovery (Premium) also prepares a sampling of items that you can preview. -10. Click **Submit** to create the draft collection. A page is displayed confirming that the collection was created. +Additionally, you can now monitor the progress of the estimate that shows how many sources and items have been completed when building the estimate. As part of the estimate progress, you can see statistics for the following areas: -## What happens after you create a draft collection +- **Status**: The status of the estimate. Values are *In progress*, *Successful*, or *UNSUCCESSFUL VALUE?* +- **Sources searched**: The number of sources searched in the estimate. + - **Sources with Hits**: Sources in the estimate that meet the conditions configured for the collection. + - **Sources with No Hits**: Sources in the estimate that do not have any items that meet the conditions configured for the collection. + - **Sources Unavailable**: Sources that were unavailable during the period that the estimate was in progress. +- **Collection estimate items and size**: The number of items and size of the collection estimate. -After you create a draft collection, it listed on the **Collections** page in the case and the status shows that it's in progress. A job named **Preparing search preview and estimates** is also created and displayed on the **Jobs** page in the case. + -During the draft collection process, eDiscovery (Premium) performs a search estimate using the search criteria and data sources that you specified in the collection. eDiscovery (Premium) also prepares a sampling of items that you can preview. When the collection is complete, the following columns and corresponding values on the **Collection** page are updated: +When the collection is complete, the following columns and corresponding values on the **Collection** page are updated: - + -- **Status**: Indicates the status and type of collection. A value of **Estimated** indicates that a draft collection is complete. This same value also indicates that the collection is a draft collection, and that it hasn't been added to a review set. A value of **Committed** in the **Status** column indicates that the collection has been added to a review set.+- **Status**: Indicates the status and type of collection. A value of **Estimated** indicates that a collection estimate is complete. This same value also indicates that the collection is a collection estimate, and that it hasn't been added to a review set. A value of **Committed** in the **Status** column indicates that the collection has been added to a review set. -- **Estimate status**: Indicates the status of the estimated search results and whether or not the search estimates and statistics are ready for review. A value of **Successful** indicates the results of the draft collection are ready for review. After you first submit a draft collection, a value of **In progress** is displayed to indicate the collection is still running+- **Estimate status**: Indicates the status of the estimated search results and whether or not the search estimates and statistics are ready for review. A value of **Successful** indicates the results of the collection estimate are ready for review. After you first submit a collection estimate, a value of **In progress** is displayed to indicate the collection is still running -- **Preview status**: Indicates the status of the sample items that you can preview. A value of **Successful** indicates the items are ready for preview. After you first submit a draft collection, a value of **In progress** is displayed to indicate that the collection is still running.+- **Preview status**: Indicates the status of the sample items that you can preview. A value of **Successful** indicates the items are ready for preview. After you first submit a collection estimate, a value of **In progress** is displayed to indicate that the collection estimate is still running. -## Next steps after a draft collection is complete +## Next steps after a collection estimate is complete -After the draft collection is successfully completed, you can perform various tasks. To perform most of these tasks, just go the **Collections** tab and click the name of the draft collection to display the flyout page. +After the collection estimate is successfully completed, you can perform various tasks. To perform most of these tasks, go the **Collections** tab and select the name of the collection estimate to display the flyout page. - + Here's a list of things you can do from the collection flyout page: -- Select the **Summary** tab to view summary information about the collection and the estimated search results returned by the collection. This includes that total number of items and size of the estimated search results, the number of mailboxes and sites contained search results, and the search conditions (if used) used to scope the collection.+- Select the **Summary** tab to view summary information about the collection and the estimated search results returned by the collection. This includes: ++ - **Collection overview (preview)** section: This section includes the **Locations with hits** sub-section that provides data on the total number of locations searched and the number of locations that contained items resulting in hits. For example, a collection scoped to Exchange Online mailboxes and SharePoint sites may summarize results by the number of mailboxes and sites searched, and the combined number of mailboxes and sites that had hits. This section also includes the **Pre-collection estimate** sub-section that displays the total number of items and size of the estimated search results. You have the option to add these items to the review set for inspection. + - **Collection parameters** section: This section includes information about additional locations, when the collection was created and modified, and a summary of the estimate items, size, and any unindexed items and size. - Select the **Data sources** tab to view a list of custodians and non-custodial data sources) that were searched in the collection. Any additional content locations that were search are listed under **Locations** on the **Summary** tab. - Select the **Search statistics** tab to view statistics about the collection. This includes the total number and size of items found in each service (for example, Exchange mailboxes or SharePoint sites) and a condition report that displays statistics about the number of items returned by different components of the search query used by the collection. For more information, see [Collection statistics and reports](collection-statistics-reports.md). -- Click **Review sample** (located at the bottom of the flyout page) to preview a sample of the items returned by the collection.--- Commit the draft collection to a review set (by clicking **Actions** > **Edit collection**). This means that you rerun the collection (using the current settings) and add the items returned by the collection to a review set. As previously explained, you can also configure additional settings (such as conversation threading and cloud-based attachments) when you add the collection to a review set. For more information and step-by-step instructions, see [Commit a draft collection to a review set](commit-draft-collection.md).--## Manage a draft collection +- Select **Review sample** (located at the bottom of the flyout page) to preview a sample of the items returned by the collection. -You can use the options in the **Actions** menu on the flyout page of a draft collection to perform various management tasks. +- Take actions on the collection estimate by selecting choices in the **Actions** menu. See the following section for more information about the available management options. - +## Manage a collection estimate -Here's are descriptions of the management options. +You can use the options in the **Actions** menu on the flyout page of a collection estimate to perform various management tasks. -- **Edit collection**: Change the settings of the draft collection. After you make changes, you can rerun the collection and update the search estimates and statistics. As previously explained, you use this option to commit a draft collection to a review set. + -- **Delete collection**: Delete a draft collection. Note that after a draft collection is committed to a review set, it can't be deleted.+Here's the descriptions of the management options. -- **Refresh estimates**: Rerun the query (against the data sources) specified in the draft collection to update the search estimates and statistics.+- **Edit collection**: Change the settings of the collection estimate. After you make changes, you can rerun the collection and update the search estimates and statistics. As previously explained, you use this option to commit a collection estimate to a review set. +- **Commit collection**: Commit a collection to a review set. This means that you rerun the collection (using the current settings) and add the items returned by the collection to a review set. As previously explained, you can also configure additional settings (such as conversation threading and cloud-based attachments) when you add the collection to a review set. For more information and step-by-step instructions, see [Commit a collection estimate to a review set](commit-draft-collection.md). +- **Delete collection**: Delete a collection estimate. After a collection estimate is committed to a review set, it can't be deleted. +- **Refresh estimates**: Rerun the query (against the data sources) specified in the collection estimate to update the search estimates and statistics. +- **Export as report**: Exports information about the collection estimate to a CSV file that you can download to your local computer. The export report contains the following information: -- **Export as report**: Exports information about the draft collection to a CSV file that you can download to your local computer. The export report contains the following information:-- - The identity of each content location that contains items that match the search query in the draft collection. These locations are typically mailboxes or sites. - + - The identity of each content location that contains items that match the search query in the collection estimate. These locations are typically mailboxes or sites. - The total number of items in each content location.- - The total size (in bytes) of the items in each content location.- - The service (such as Exchange or SharePoint) in which the content location is located. -- **Copy collection**: Create a new draft collection by copying the settings from an existing collection. You have to use a different name for the new collection. You also have the option to modify the settings before you submit the new collection. After you submit it, the search query is run and new estimates and statistics are generated. The is a good way to quickly create additional draft collection and then modify selected settings as necessary while still preserving information in the original collection. This also lets you easily compare the results of two similar collections.+- **Copy collection**: Create a new collection estimate by copying the settings from an existing collection. You have to use a different name for the new collection. You also have the option to modify the settings before you submit the new collection. After you submit it, the search query is run and new estimates and statistics are generated. This is a good way to quickly create additional collection estimate and then modify selected settings as necessary while still preserving information in the original collection. This also lets you easily compare the results of two similar collections. > [!NOTE]-> After a draft collection is committed to a review set, you can only copy the collection and export a report. +> After a collection estimate is committed to a review set, you can only copy the collection and export a report. |
| compliance | Ediscovery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery.md | Here's a description of each eDiscovery capability. - **Conversation threading**. When chat messages from Teams and Yammer conversations are added to a review set, you can collect the entire conversation thread. This means that the entire chat conversation that contains items that match the collection criteria is added to the review set. This lets you review chat items in the context of the back-and-forth conversation. -- **Collection statistics and reports**. After you create a draft collection or commit a collection to a review set, you can view a rich set of statistics on the retrieved items, such as the content locations that contain the most items that matched the search criteria and the number of items returned by the search query. You can also preview a subset of the results.+- **Collection statistics and reports**. After you create a collection estimate or commit a collection to a review set, you can view a rich set of statistics on the retrieved items, such as the content locations that contain the most items that matched the search criteria and the number of items returned by the search query. You can also preview a subset of the results. - **Review set filtering**. After content is added to a review set, you can apply filters to display only the set of items that match your filtering criteria. Then you can save the filter sets as a query, which lets you quickly reapply the saved filters. Review set filtering and saved queries help you quickly select content items that are most relevant to your investigation. |
| compliance | Keyword Queries And Search Conditions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/keyword-queries-and-search-conditions.md | For step-by-step instructions on how to create different eDiscovery searches, se - [Content search](content-search.md) - [Search for content in eDiscovery (Standard)](search-for-content-in-core-ediscovery.md)-- [Create a draft collection in eDiscovery (Premium)](create-draft-collection.md)+- [Create a collection estimate in eDiscovery (Premium)](create-draft-collection.md) > [!NOTE] > eDiscovery searches in the compliance portal and the corresponding **\*-ComplianceSearch** cmdlets in Security & Compliance PowerShell use the Keyword Query Language (KQL). For more detailed information, see [Keyword Query Language syntax reference](/sharepoint/dev/general-development/keyword-query-language-kql-syntax-reference). |
| compliance | Limits Ediscovery20 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/limits-ediscovery20.md | The limits described in this section are related to using the search tool on the |Maximum number of items per public folder mailbox displayed on preview page for searches.|100| |Maximum number of items found in all public folder mailbox items displayed on preview page for searches.|200| |Maximum number of public folder mailboxes that can be previewed for search results. If there are more than 500 public folder mailboxes that contain items that match the search query, only the top 500 mailboxes with the most results are available for preview.|500|-|The maximum size of an item that can be viewed on the sample page of a draft collection.|10,000,000 bytes (approximately 9.5 MB)| +|The maximum size of an item that can be viewed on the sample page of a collection estimate.|10,000,000 bytes (approximately 9.5 MB)| ## Search times |
| compliance | Managing Jobs Ediscovery20 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/managing-jobs-ediscovery20.md | Here's a list of the jobs (which are typically long-running processes) that are |Comparing load sets|A user looks at the differences between different load sets in a review set. A load set is an instance of adding data to a review set. For example, if you add the results of two different searches to the same review set, each would represent a load set.| |Conversation reconstruction|When a user adds the results of a search to a conversation review set, instant message conversations (also called *threaded conversations*) in services like Microsoft Teams are reconstructed in a PDF file. This job is also triggered when a user clicks **Action > Create conversation PDFs** in a review set. For more information, see [Review conversations in eDiscovery (Premium)](conversation-review-sets.md). |Converting redacted documents to PDF|After a user annotates a document in a review set and redacts a portion of it, they can choose to convert the redacted document to a PDF file. This ensures that the redacted portion will not be visible if the document is exported for presentation. For more information, see [View documents in a review set](view-documents-in-review-set.md).|-|Estimating search results|After a user creates and runs or reruns a draft collection, the search tool searches the index for items that match the search query and prepares an estimate that includes the number and total size of all items by the search, and the number of data sources searched. For more information, see [Collect data for a case](collecting-data-for-ediscovery.md).| +|Estimating search results|After a user creates and runs or reruns a collection estimate, the search tool searches the index for items that match the search query and prepares an estimate that includes the number and total size of all items by the search, and the number of data sources searched. For more information, see [Collect data for a case](collecting-data-for-ediscovery.md).| |Preparing data for export|A user exports documents from a review set. When the export process is complete, they can download the exported data to a local computer. For more information, see [Export case data](exporting-data-ediscover20.md).| |Preparing for error resolution|When a user selects a file and creates a new error remediation in the Error view on the **Processing** tab of a case, the first step in the process is to upload the file that has the processing error to an Azure Storage location in the Microsoft cloud. This job tracks the progress of the upload process. For more information about the error remediation workflow, see [Error remediation when processing data](error-remediation-when-processing-data-in-advanced-ediscovery.md).|-|Preparing search preview|After a user creates and runs a new draft collection (or reruns an existing draft collection), the search tool prepares a sample subset of items (that match the search query) that can be previewed. Previewing search results help you determine the effectiveness of the search. For more information, see [Collect data for a case](collecting-data-for-ediscovery.md#view-search-results-and-statistics).| +|Preparing search preview|After a user creates and runs a new collection estimate (or reruns an existing collection estimate), the search tool prepares a sample subset of items (that match the search query) that can be previewed. Previewing search results help you determine the effectiveness of the search. For more information, see [Collect data for a case](collecting-data-for-ediscovery.md#view-search-results-and-statistics).| |Re-indexing custodian data|When you add a custodian to a case, all partially indexed items in the custodian's selected data sources are reindexed by a process called *Advanced indexing*. This job is also triggered when you click **Update index** on the **Processing** tab of a case, and when you update the index for a specific custodian on the custodian properties flyout page. For more information, see [Advanced indexing of custodian data](indexing-custodian-data.md). |Running analytics|A user analyzes data in a review set by running eDiscovery (Premium) analytics tools such as near duplicate detection, email threading analysis, and themes analysis. For more information, see [Analyze data in a review set](analyzing-data-in-review-set.md).| |Tagging documents|This job is triggered when a user clicks **Start tagging job** in the **Tagging panel** when reviewing documents in a review set. A user can start this job after tagging documents in a review set and then bulk-selecting them in the view document panel. For more information, see [Tag documents in a review set](tagging-documents.md).| |
| compliance | Review Set Search | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/review-set-search.md | You can also build more advanced queries to search for documents in a review set ## Filter partially indexed items -If you selected the option to add partially indexed items from additional data sources when you committed the draft collection to a review set. You'll probably want to identify and view those items to determine if an item might be relevant to your investigation and whether you need to remediate the error that resulted in the item being partially indexed. +If you selected the option to add partially indexed items from additional data sources when you committed the collection estimate to a review set. You'll probably want to identify and view those items to determine if an item might be relevant to your investigation and whether you need to remediate the error that resulted in the item being partially indexed. At this time, there isn't a filter option in a review set to display partially indexed items. But we're working on it. Until then, here's a way you can filter and display the partially indexed items that you added to a review set. |
| compliance | Search And Delete Teams Chat Messages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/search-and-delete-Teams-chat-messages.md | Here's the process to search for and purge Teams chat messages: The first step is to create a case in eDiscovery (Premium) to manage the search and purge process. For information about creating a case, see [Use the new case format](advanced-ediscovery-new-case-format.md). -## Step 2: Create a draft collection +## Step 2: Create a collection estimate -After you create a case, the next step is to create a draft collection to search for the Teams chat messages that you want to purge. The purge process you perform is Step 5 will purge all items that are found in the draft collection. +After you create a case, the next step is to create a collection estimate to search for the Teams chat messages that you want to purge. The purge process you perform is Step 5 will purge all items that are found in the collection estimate. -In eDiscovery (Premium), a *collection* is an eDiscovery search of the Teams content locations that contain the chat messages that you want to purge. Create the draft collection in the case that you created in the previous step. For more information, see [Create a draft collection](create-draft-collection.md). +In eDiscovery (Premium), a *collection* is an eDiscovery search of the Teams content locations that contain the chat messages that you want to purge. Create the collection estimate in the case that you created in the previous step. For more information, see [Create a collection estimate](create-draft-collection.md). ### Data sources for chat messages Use the following table to determine which data sources to search depending on t ### Tips for searching for chat messages -To help ensure the most comprehensive collection of Teams chat conversations (including 1:1 and group chats, and chats from standard, shared, and private chats) use the **Type** condition and select the **Instant messages** option when you build the search query for the draft collection. We also recommend including a date range or several keywords to narrow the scope of the collection to items relevant to your search a purge investigation. +To help ensure the most comprehensive collection of Teams chat conversations (including 1:1 and group chats, and chats from standard, shared, and private chats) use the **Type** condition and select the **Instant messages** option when you build the search query for the collection estimate. We also recommend including a date range or several keywords to narrow the scope of the collection to items relevant to your search a purge investigation. Here's a screenshot of a sample query using the **Type** and **Date** options: For more information, see [Build search queries for collections](building-search ## Step 3: Review and verify chat messages to purge -As previously mentioned, the purge process in Step 5 will delete the items returned by the collection. So it's important that you review the draft collection results to ensure that the collection only returns the items that you want to purge. To review a sample of items in a draft collection, see the "Next steps after a draft collection is complete" section in [Create a draft collection](create-draft-collection.md#next-steps-after-a-draft-collection-is-complete). +As previously mentioned, the purge process in Step 5 will delete the items returned by the collection. So it's important that you review the collection estimate results to ensure that the collection only returns the items that you want to purge. To review a sample of items in a collection estimate, see the "Next steps after a collection estimate is complete" section in [Create a collection estimate](create-draft-collection.md#next-steps-after-a-collection-estimate-is-complete). Additionally, you can use the collection statistics (specifically the Top Locations statistics) to generate a list of the data sources that contain items returned by the collection. Use this list in the next step to remove hold and retention policies from the data sources that contain search results. For more information, see [Collection statistics and reports](collection-statistics-reports.md). |
| compliance | Teams Workflow In Advanced Ediscovery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/teams-workflow-in-advanced-ediscovery.md | After adding custodians to the case and preserving content in custodian data sou When you collect Teams content for a case, there are two steps in the workflow: -1. **Create a draft collection**. The first step is to create a *draft collection*, which is an estimate of the items that match your search criteria. You can view information about the results that matched the search query, such as the total number and size of items found, the different data sources where they were found, and statistics about the search query. You can also preview a sample of items that were returned by the collection. Using these statistics, you can change the search query and rerun the draft collection as many times as is necessary to narrow the results until you're satisfied you're collecting the content relevant to your case. +1. **Create a collection estimate**. The first step is to create a *collection estimate*, which is an estimate of the items that match your search criteria. You can view information about the results that matched the search query, such as the total number and size of items found, the different data sources where they were found, and statistics about the search query. You can also preview a sample of items that were returned by the collection. Using these statistics, you can change the search query and rerun the collection estimate as many times as is necessary to narrow the results until you're satisfied you're collecting the content relevant to your case. -2. **Commit a draft collection to a review set**. Once you're satisfied with the results of a draft collection, you can commit the collection to a review set. When you commit a draft collection, the items returned by the collection are added to a review set for review, analysis, and export. +2. **Commit a collection estimate to a review set**. Once you're satisfied with the results of a collection estimate, you can commit the collection to a review set. When you commit a collection estimate, the items returned by the collection are added to a review set for review, analysis, and export. -You also have the option of not running a draft collection and adding the collection results directly to a review set when you create and run the collection. +You also have the option of not running a collection estimate and adding the collection results directly to a review set when you create and run the collection. To create a collection of Teams content: To create a collection of Teams content: We recommend doing the following things when collecting Teams content: - - Remove custodians' OneDrive accounts from the collection scope (by unselecting the checkbox in the **Custodian's OneDrive** column for each custodian). This prevents the collection of duplicate files that were attached to 1:1 chats and group chats. Cloud attachments are automatically collected from each conversation found in the collection when you commit the draft collection to the review set. By using this method (instead of searching OneDrive accounts as part of the collection), files attached to 1:1 and group chats are grouped in the conversation they were shared in. + - Remove custodians' OneDrive accounts from the collection scope (by unselecting the checkbox in the **Custodian's OneDrive** column for each custodian). This prevents the collection of duplicate files that were attached to 1:1 chats and group chats. Cloud attachments are automatically collected from each conversation found in the collection when you commit the collection estimate to the review set. By using this method (instead of searching OneDrive accounts as part of the collection), files attached to 1:1 and group chats are grouped in the conversation they were shared in. - - Unselect the checkbox in the **Additional site** column to remove the SharePoint sites containing files shared in private or shared channels. Doing this eliminates collecting duplicate files that were attached to private or shared channel conversations because these cloud attachments are automatically added to the review set when you commit the draft collection and grouped in the conversations they were shared in. + - Unselect the checkbox in the **Additional site** column to remove the SharePoint sites containing files shared in private or shared channels. Doing this eliminates collecting duplicate files that were attached to private or shared channel conversations because these cloud attachments are automatically added to the review set when you commit the collection estimate and grouped in the conversations they were shared in. 6. If you previously followed the steps to add Teams content as custodian data sources, you can skip this step and select **Next**. Otherwise, on the **Non-custodial data sources** wizard page, you can choose non-custodial data sources that contain Teams content that you may have added to the case to search in the collection. To create a collection of Teams content:  -9. On the **Save draft or collect** wizard page, do one of the following depending on whether you want to create a draft collection or commit the collection to a review set. +9. On the **Save draft or collect** wizard page, do one of the following depending on whether you want to create a collection estimate or commit the collection to a review set. -  +  - 1. **Save collection as draft**. Choose this option to create a draft collection. As previously explained, a draft collection doesn't add the collection results to a review set. It returns an estimate of the search results that match the search query for the data sources in the collection scope. This gives you the opportunity to view [collection statistics and reports[(collection-statistics-reports.md)] and edit and rerun the draft collection. When you satisfied with the result of a draft collection, you can commit it to a review set. For more information, see [Create a draft collection](create-draft-collection.md). + 1. **Save collection as draft**. Choose this option to create a collection estimate. As previously explained, a collection estimate doesn't add the collection results to a review set. It returns an estimate of the search results that match the search query for the data sources in the collection scope. This gives you the opportunity to view [collection statistics and reports[(collection-statistics-reports.md)] and edit and rerun the collection estimate. When you satisfied with the result of a collection estimate, you can commit it to a review set. For more information, see [Create a collection estimate](create-draft-collection.md). - 2. **Collect items and add to a review set**. Choose this option to run the collection and then add the results to a review set. You can add the collection to a new or existing review set. The options to collect contextual Teams conversation messages (also called *conversation threading*) and collect cloud attachments are selected by default and can't be unselected. These options are automatically applied because of the new case format that you used when you initially created the case for Teams content. For more information about committing collections to a review set, see [Commit a draft collection to a review set](commit-draft-collection.md). + 2. **Collect items and add to a review set**. Choose this option to run the collection and then add the results to a review set. You can add the collection to a new or existing review set. The options to collect contextual Teams conversation messages (also called *conversation threading*) and collect cloud attachments are selected by default and can't be unselected. These options are automatically applied because of the new case format that you used when you initially created the case for Teams content. For more information about committing collections to a review set, see [Commit a collection estimate to a review set](commit-draft-collection.md). -10. After you're finished configuring the collection, submit the collection to create a draft collection or collect items and add them to a review set. +10. After you're finished configuring the collection, submit the collection to create a collection estimate or collect items and add them to a review set. When the process of adding the collection to the review set is completed, the status value for the collection on the **Collections** tab is set to **Committed**. |
| compliance | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md | Whether it be adding new solutions to the [Microsoft Purview compliance portal]( - [Conduct an eDiscovery investigation of content in Microsoft Teams](/microsoftteams/ediscovery-investigation) - expanded reactions in Microsoft Teams chats are now supported in eDiscovery (Premium). - [Create an eDiscovery hold](/microsoft-365/compliance/create-ediscovery-holds) - clarified how eDiscovery holds are handled when a user's OneDrive URL changes. +### On-premises scanner ++- **General availability (GA)**: Configuration for the Microsoft Purview Information Protection scanner (formerly named Azure Information Protection unified labeling scanner) in the Microsoft Purview compliance portal. For more information, see [Configure & install the information protection scanner](deploy-scanner-configure-install.md). + ### Sensitivity labels - **General availability (GA)**: Trainable classifiers for [auto-labeling policies](apply-sensitivity-label-automatically.md#how-to-configure-auto-labeling-policies-for-sharepoint-onedrive-and-exchange). Trainable classifiers are now available for both auto-labeling for Office apps that use label settings (known as client-side auto-labeling) and auto-labeling policies (known as service-side auto-labeling). As a result, trainable classifiers are removed from the [comparison table](apply-sensitivity-label-automatically.md#compare-auto-labeling-for-office-apps-with-auto-labeling-policies) that lists only the differences between the two auto-labeling methods. |
| lighthouse | M365 Lighthouse Dismiss Task | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-dismiss-task.md | + + Title: "Dismiss a task in Microsoft 365 Lighthouse" +f1.keywords: CSH +++++audience: Admin +++ms.localizationpriority: medium ++- scotvorg +- M365-subscription-management +- Adm_O365 ++- AdminSurgePortfolio +- M365-Lighthouse +search.appverid: MET150 +description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn how to dismiss a deployment task." +++# Dismiss a task in Microsoft 365 Lighthouse ++You can dismiss tasks from the deployment plan where a Managed Service Provider (MSP) chooses to accept the associated risk of not completing the task or to resolve the task through a third party or other alternate mitigation. The dismissal of a task doesn’t affect the configuration of the managed tenant. Once dismissed, Microsoft 365 Lighthouse will no longer detect configurations or report the deployment status for that task. Tasks can be dismissed or reinstated at any time. ++## Before you begin ++Make sure you and your customer tenants meet the requirements listed in [Requirements for Microsoft 365 Lighthouse](m365-lighthouse-requirements.md). ++Additionally, each partner tenant user must meet the following requirements: ++- The partner tenant user must have DAP/GDAP access to the applicable tenant. ++ 1. For DAP, an admin agent group membership. ++ 2. For GDAP, a role that can create Conditional Access (CA) policies. ++- The partner tenant user must enable MFA for their user account in the partner tenant. ++## Dismiss a task ++1. In the left navigation in Lighthouse, select **Tenants**. ++2. Select the appropriate tenant from the list. ++3. Select **Deployment plan** tab. ++4. From the task list, select the task you want to dismiss. ++5. From the task details pane, select **Dismiss**. ++6. Select one of the following reasons for dismissing the task: ++ 1. Risk accepted ++ 2. Resolved through third party ++ 3. Resolved through alternate mitigation ++7. In the Justification field, provide a reason for dismissing the task. ++8. Select **Save**. ++You can also select **More actions** (ellipsis icon) option directly from the task list to dismiss the task. ++## Related content ++[Overview of using Microsoft 365 Lighthouse baselines to deploy standard tenant configurations](m365-lighthouse-deploy-standard-tenant-configurations-overview.md) (article)\ +[Overview of permissions in Microsoft 365 Lighthouse](m365-lighthouse-overview-of-permissions.md) (article)\ +[Configure Microsoft 365 Lighthouse portal security](m365-lighthouse-configure-portal-security.md) (article)\ +[Microsoft 365 Lighthouse FAQ](m365-lighthouse-faq.yml) (article) |
| lighthouse | M365 Lighthouse Reinstate Task | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-reinstate-task.md | + + Title: "Reinstate a task in Microsoft 365 Lighthouse" +f1.keywords: NOCSH +++++audience: Admin +++ms.localizationpriority: medium ++- scotvorg +- M365-subscription-management +- Adm_O365 ++- AdminSurgePortfolib +- M365-Lighthouse +search.appverid: MET150 +description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn how to reinstate a deployment task in Lighthouse." +++# Reinstate a task in Microsoft 365 Lighthouse ++You can reinstate a dismissed deployment task within Microsoft 365 Lighthouse. ++## Before you begin ++Make sure you and your customer tenants meet the requirements listed in [Requirements for Microsoft 365 Lighthouse](m365-lighthouse-requirements.md). ++Additionally, each partner tenant user must meet the following requirements: ++- The partner tenant user must have DAP/GDAP access to the applicable tenant. ++ 1. For DAP, an admin agent group membership. ++ 2. For GDAP, a role that can create Conditional Access (CA) policies. ++- The partner tenant user must enable MFA for their user account in the partner tenant. ++## Reinstate a task ++1. In the left navigation in Lighthouse, select **Tenants**. +2. Select the appropriate tenant from the list. +3. Select **Deployment plan** tab. +4. From the task list, select the task you want to reinstate. +5. From the task details pane, select **Reinstate.** +6. From the **Reinstate task** dialog box, select **Reinstate**. ++You can also select **More actions** (ellipsis icon) option directly from the task list to reinstate the task. Once a task is reinstated, status detection and reporting will update accordingly. ++## Related content ++[Overview of using Microsoft 365 Lighthouse baselines to deploy standard tenant configurations](m365-lighthouse-deploy-standard-tenant-configurations-overview.md) (article)\ +[Overview of permissions in Microsoft 365 Lighthouse](m365-lighthouse-overview-of-permissions.md) (article)\ +[Configure Microsoft 365 Lighthouse portal security](m365-lighthouse-configure-portal-security.md) (article)\ +[Microsoft 365 Lighthouse FAQ](m365-lighthouse-faq.yml) (article) |
| lti | Index | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lti/index.md | These tools include: - [OneDrive LTI](#onedrive-lti-apps) - [Teams Meetings LTI](#teams-meetings-lti) - [Teams Classes LTI](#teams-classes-lti)-- [OneNote LTI)(#onenote-class-notebook-lti) For general information on managing Microsoft LTI apps, see [Manage Microsoft LTI apps for any LMS](manage-microsoft-one-lti.md). For configuration steps, see: - [Microsoft Teams Classes with Moodle](teams-classes-meetings-with-moodle.md). - [Microsoft Teams Classes with Open LMS](open-lms-teams-classes-and-meetings.md). - [Microsoft Teams Classes with Desire2Learn Brightspace](teams-classes-meetings-with-brightspace.md).--### OneNote Class Notebook LTI --OneNote Class Notebook LTI can be used with your LMS to create a shared notebook and link it to educators' courses. Students enrolled in the LMS course can access the notebook automatically without having to add their names. --For configuration steps, see [Microsoft OneNote Class Notebook LTI](https://www.onenote.com/lti/integratelti). |
| lti | Manage Microsoft One Lti | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lti/manage-microsoft-one-lti.md | If you would like to delete an LTI registration, follow the steps below. ## Edit an LTI registration -Currently, we don't support editing an existing LTI registration after it's added. +If you would like to edit an LTI registration, follow the steps below. -To change an LTI registration, you'll need to: --1. [Delete the existing registration](#delete-an-lti-registration). -2. Add a new registration. +1. Visit the [Microsoft LMS Gateway](https://lti.microsoft.com/). +2. Sign in with a Microsoft 365 administrator account. +3. In the registration list, find the LTI registration you wish to edit. +4. Select the **edit pencil icon** next to the listing. +5. Edit the registration details. +6. Select the **Save and exit** button. ## Troubleshoot issues with Microsoft LMS Gateway |
| security | TOC | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/TOC.md | #### [Deploy and report on Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) ##### [Deploy and enable Microsoft Defender Antivirus](deploy-microsoft-defender-antivirus.md) -##### [Deployment guide for Microsoft Defender Antivirus in a virtual desktop infrastructure (VDI) environment](deployment-vdi-microsoft-defender-antivirus.md) +##### [Configure Microsoft Defender Antivirus in a remote desktop or virtual desktop infrastructure environment](deployment-vdi-microsoft-defender-antivirus.md) ##### [Report on Microsoft Defender Antivirus](report-monitor-microsoft-defender-antivirus.md) #### [Scans and remediation](review-scan-results-microsoft-defender-antivirus.md) ##### [Investigate files](investigate-files.md) ##### [Investigate devices](investigate-machines.md) ##### [Investigate an IP address](investigate-ip.md)-##### [Investigate domains and URLs associated with a Microsoft Defender for Endpoint alert](investigate-domain.md) ###### [Investigate connection events that occur behind forward proxies](investigate-behind-proxy.md) ##### [Investigate a user account](investigate-user.md) |
| security | Common Errors | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/common-errors.md | -# Common REST API error codes --+# Handling REST API errors [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] +HTTP error responses are divided into two categories: +* Client error (400-code level) ΓÇô the client sent an invalid request or the request is not in accordance with definitions. +* Server error (500-level) ΓÇô the server temporarily failed to fulfill the request or a server error occurred. Try sending the HTTP request again. -* The error codes listed in the following table may be returned by an operation on any of Microsoft Defender for Endpoint APIs. +The error codes listed in the following table may be returned by an operation on any of Microsoft Defender for Endpoint APIs. * In addition to the error code, every error response contains an error message, which can help resolve the problem. * The message is a free text that can be changed. * At the bottom of the page, you can find response examples. DisabledFeature|Forbidden (403)|Tenant feature is not enabled. DisallowedOperation|Forbidden (403)|{the disallowed operation and the reason}. NotFound|Not Found (404)|General Not Found error message. ResourceNotFound|Not Found (404)|Resource {the requested resource} was not found.-InternalServerError|Internal Server Error (500)|(No error message, retry the operation) TooManyRequests|Too Many Requests (429)|Response will represent reaching quota limit either by number of requests or by CPU.+InternalServerError|Internal Server Error (500)|(No error message, retry the operation.) ++## Throttling +The HTTP client may receive a 'Too Many Requests error (429)' when the number of HTTP requests in a given time frame exceeds the allowed number of calls per API. ++The HTTP client should delay resubmitting further HTTPS requests and then submit them in a way that complies with the rate limitations. A Retry-After in the response header indicating how long to wait (in seconds) before making a new request ++Ignoring the 429 response or trying to resubmit HTTP requests in a shorter time frame will cause a return of the 429 error code. ## Body parameters are case-sensitive |
| security | Configure Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-exclusions-microsoft-defender-antivirus.md | To configure and validate exclusions, see the following: ## Recommendations for defining exclusions > [!IMPORTANT]-> Microsoft Defender Antivirus includes many automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations. +> Microsoft Defender Antivirus includes many automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations. For more information, refer to the [list of automatic exclusions](/configure-exclusions-microsoft-defender-antivirus#the-list-of-automatic-exclusions). > > Defining exclusions lowers the protection offered by Microsoft Defender Antivirus. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious. Keep the following points in mind when you are defining exclusions: Exchange has supported integration with the Antimalware Scan Interface (AMSI) since the June 2021 Quarterly Updates for Exchange. It is highly recommended to ensure these updates are installed and AMSI is working using the guidance provided by the Exchange Team as this integration will allow the best ability for Defender Antivirus to detect and block exploitation of Exchange. -Many organizations exclude the Exchange directories from antivirus scans for performance reasons. Microsoft recommendeds to audit AV exclusions on Exchange systems and assess if they can be removed without impacting performance in your environment to ensure the highest level of protection. Exclusions can managed by using Group Policy, PowerShell, or systems management tools like Microsoft Endpoint Configuration Manager. +Many organizations exclude the Exchange directories from antivirus scans for performance reasons. Microsoft recommends to audit AV exclusions on Exchange systems and assess if they can be removed without impacting performance in your environment to ensure the highest level of protection. Exclusions can be managed by using Group Policy, PowerShell, or systems management tools like Microsoft Endpoint Configuration Manager. To audit AV exclusions on an Exchange Server running Defender Antivirus, run the **Get-MpPreference** command from an elevated PowerShell prompt. |
| security | Data Collection Analyzer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/data-collection-analyzer.md | When collaborating with Microsoft support professionals, you may be asked to use Run '**MDEClientAnalyzer.cmd /?**' to see the list of available parameters and their description: > [!NOTE] > When any advanced troubleshooting parameter is used, the analyzer also calls into [MpCmdRun.exe](/microsoft-365/security/defender-endpoint/command-line-arguments-microsoft-defender-antivirus) to collect Microsoft Defender Antivirus related support logs. Run '**MDEClientAnalyzer.cmd /?**' to see the list of available parameters and t **-b** - Same as '-c' but the process monitor trace will be initiated during next boot and stopped only when the -b is used again. +**-e** - Calls into [Windows Performance Recorder](/windows-hardware/test/wpt/wpr-command-line-options) to collect Defender AV Client tracing (AM-Engine and AM-Service) for analysis of Antivirus cloud connectivity issues. + **-a** - Calls into [Windows Performance Recorder](/windows-hardware/test/wpt/wpr-command-line-options) to collect a verbose performance trace specific to analysis of high CPU issues related to the antivirus process (MsMpEng.exe). **-v** - Uses antivirus [MpCmdRun.exe command line argument](/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) with most verbose -trace flags. |
| security | Deployment Vdi Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus.md | Title: Microsoft Defender Antivirus Virtual Desktop Infrastructure deployment guide -description: Learn how to deploy Microsoft Defender Antivirus in a remote desktop or non-persistent virtual desktop environment. + Title: Configure Microsoft Defender Antivirus on a remote desktop or virtual desktop infrastructure environment +description: Get an overview of how to configure Microsoft Defender Antivirus in a remote desktop or non-persistent virtual desktop environment. keywords: vdi, hyper-v, vm, virtual machine, windows defender, antivirus, av, virtual desktop, rds, remote desktop ms.mktglfcycl: manage ms.sitesec: library-# Deployment guide for Microsoft Defender Antivirus in a virtual desktop infrastructure (VDI) environment +# Configure Microsoft Defender Antivirus on a remote desktop or virtual desktop infrastructure environment **Applies to:** -- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - Microsoft Defender Antivirus **Platforms**+ - Windows -In addition to standard on-premises or hardware configurations, you can use Microsoft Defender Antivirus in a remote desktop (RDS) or non-persistent virtual desktop infrastructure (VDI) environment. With the ability to easily deploy updates to virtual machines (VMs) running in VDIs, you can get updates on your machines quickly and easily. You no longer need to create and seal golden images on a periodic basis, as updates are expanded into their component bits on the host server and are then downloaded directly to each VM when it's turned on. +> [!TIP] +> This article is designed for customers who are using Microsoft Defender Antivirus capabilities only. If you have Microsoft Defender for Endpoint (which includes Microsoft Defender Antivirus alongside additional device protection capabilities), skip this article and proceed to [Onboard devices and configure Microsoft Defender for Endpoint capabilities](onboard-configure.md). ++You can use Microsoft Defender Antivirus in a remote desktop (RDS) or non-persistent virtual desktop infrastructure (VDI) environment. Following the guidance in this article, you can configure updates to download directly to your RDS or VDI environments when a user signs in. -This guide describes how to configure your VMs for optimal protection and performance, including how to: +This guide describes how to configure Microsoft Defender Antivirus on your VMs for optimal protection and performance, including how to: -- [Set up a dedicated VDI file share for security intelligence updates](#set-up-a-dedicated-vdi-file-share)+- [Set up a dedicated VDI file share for security intelligence updates](#set-up-a-dedicated-vdi-file-share-for-security-intelligence) - [Randomize scheduled scans](#randomize-scheduled-scans) - [Use quick scans](#use-quick-scans) - [Prevent notifications](#prevent-notifications) This guide describes how to configure your VMs for optimal protection and perfor - [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline) - [Apply exclusions](#exclusions) -For more information on Microsoft Remote Desktop Services and VDI support, see [Azure Virtual Desktop Documentation](/azure/virtual-desktop). --For Azure-based virtual machines, see [Install Endpoint Protection in Microsoft Defender for Cloud](/azure/defender-for-cloud/endpoint-protection-recommendations-technical). > [!IMPORTANT]-> Although the VDI can be hosted on Windows Server 2012 or Windows Server 2016, the virtual machines (VMs) should be running Windows 10, 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows. -> There are performance and feature improvements to the way in which Microsoft Defender Antivirus operates on virtual machines in Windows 10 Insider Preview, build 18323 (and later). We'll identify in this guide if you need to be using an Insider Preview build; if it isn't specified, then the minimum required version for the best protection and performance is Windows 10 1607. --## Set up a dedicated VDI file share --In Windows 10, version 1903, we introduced the shared security intelligence feature, which offloads the unpackaging of downloaded security intelligence updates onto a host machine, thus saving previous CPU, disk, and memory resources on individual machines. This feature has been backported and now works in Windows 10 version 1703 and above. You can set this feature with a Group Policy, or PowerShell. --### Use Group Policy to enable the shared security intelligence feature: --1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure, and then select **Edit**. --2. In the Group Policy Management Editor, go to **Computer configuration**. --3. Select **Administrative templates**. --4. Expand the tree to **Windows components** \> **Microsoft Defender Antivirus** \> **Security Intelligence Updates**. --5. Double-click **Define security intelligence location for VDI clients**, and then set the option to **Enabled**. A field automatically appears. +> Although a VDI can be hosted on Windows Server 2012 or Windows Server 2016, virtual machines (VMs) should be running Windows 10, version 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows. -6. Enter `\\<sharedlocation\>\wdav-update` (for help with this value, see [Download and unpackage](#download-and-unpackage-the-latest-updates)). +## Set up a dedicated VDI file share for security intelligence -7. Select **OK**. +In Windows 10, version 1903, Microsoft introduced the shared security intelligence feature, which offloads the unpackaging of downloaded security intelligence updates onto a host machine. This method reduces the usage of CPU, disk, and memory resources on individual machines. Shared security intelligence now works on Windows 10, version 1703 and later. You can set up this capability by using Group Policy or PowerShell, as described in the following table: -8. Deploy the GPO to the VMs you want to test. --### Use PowerShell to enable the shared security intelligence feature --Use the following cmdlet to enable the feature. You'll need to then push the update as you normally would push PowerShell-based configuration policies onto the VMs: --```PowerShell -Set-MpPreference -SharedSignaturesPath \\<shared location>\wdav-update -``` --See the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what the \<shared location\> will be. +|Method | Procedure | +||| +| Group Policy | <ol><li>On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure, and then select **Edit**.</li><li>In the Group Policy Management Editor, go to **Computer configuration**.</li><li>Select **Administrative templates**.</li><li>Expand the tree to **Windows components** \> **Microsoft Defender Antivirus** \> **Security Intelligence Updates**.</li><li>Double-click **Define security intelligence location for VDI clients**, and then set the option to **Enabled**. A field automatically appears.</li><li>Enter `\\<sharedlocation\>\wdav-update` (for help with this value, see [Download and unpackage](#download-and-unpackage-the-latest-updates)).</li><li>Select **OK**.</li><li>Deploy the GPO to the VMs you want to test.</li></ol> | +| PowerShell | <ol><li>On each RDS or VDI device, use the following cmdlet to enable the feature: `Set-MpPreference -SharedSignaturesPath \\<shared location>\wdav-update`. </li><li>Push the update as you normally would push PowerShell-based configuration policies onto your VMs. (See the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what the \<shared location\> will be.) </li></ol> | ## Download and unpackage the latest updates We suggest starting with once a day, but you should experiment with increasing o Security intelligence packages are typically published once every three to four hours. Setting a frequency shorter than four hours isn't advised because it will increase the network overhead on your management machine for no benefit. You can also set up your single server or machine to fetch the updates on behalf of the VMs at an interval and place them in the file share for consumption.-This is possible when the devices have the share and NTFS permissions for the read access to the share so they can grab the updates. To do this: +This configuration is possible when the devices have the share and read access (NTFS permissions) to the share so they can grab the updates. To set this configuration up, follow these steps: 1. Create an SMB/CIFS file share. This is possible when the devices have the share and NTFS permissions for the re 3. Go to the **Actions** tab. Select **New...** Enter **PowerShell** in the **Program/Script** field. Enter `-ExecutionPolicy Bypass c:\wdav-update\vdmdlunpack.ps1` in the **Add arguments** field. Select **OK**. -4. You can choose to configure more settings if you wish. +4. Configure any oher settings as appropriate. 5. Select **OK** to save the scheduled task. -You can initiate the update manually by right-clicking on the task and clicking **Run**. +You can initiate the update manually by right-clicking on the task and then selecting **Run**. ### Download and unpackage manually This policy hides the entire Microsoft Defender Antivirus user interface from en ## Exclusions -Exclusions can be added, removed, or customized to suit your needs. +If you think you need to add exclusions, see [Manage exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md). -For more information, see [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-exclusions-microsoft-defender-antivirus.md). --> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) --## Additional resources +## See also - [Tech Community Blog: Configuring Microsoft Defender Antivirus for non-persistent VDI machines](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/configuring-microsoft-defender-antivirus-for-non-persistent-vdi/ba-p/1489633) - [TechNet forums on Remote Desktop Services and VDI](https://social.technet.microsoft.com/Forums/windowsserver/home?forum=winserverTS) - [SignatureDownloadCustomTask PowerShell script](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4)++If you're looking for information about Defender for Endpoint on non-Windows platforms, see the following resources: ++- [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) +- [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) +- [Configure Defender for Endpoint on Android features](android-configure.md) +- [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) |
| security | Export Firmware Hardware Assessment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/export-firmware-hardware-assessment.md | + + Title: Hardware and firmware assessment methods and properties per device +description: Provides information about the Firmware and Hardware APIs that pull "Microsoft Defender Vulnerability Management" data. There are different API calls to get different types of data. In general, each API call contains the requisite data for devices in your organization. +keywords: api, apis, export assessment, per device assessment, per machine assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, secure configuration assessment, secure configuration report, software vulnerabilities assessment, software vulnerability report, vulnerability report by machine, firmware and hardware assessment ++ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++- m365-security +- tier2 ++++search.appverid: met150 +++# Export Hardware and firmware assessment inventory per device +++**Applies to:** ++- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) +- [Microsoft Defender Vulnerability Management](../defender-vulnerability-management/index.yml) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ++> Want to experience Microsoft Defender Vulnerability Management? Learn more about how you can sign up to the [Microsoft Defender Vulnerability Management public preview trial](../defender-vulnerability-management/get-defender-vulnerability-management.md). ++There are different API calls to get different types of data. In general, each API call contains the requisite data for devices in your organization. ++- **JSON response** The API pulls all data in your organization as JSON responses. This method is best for _small organizations with less than 100-K devices_. The response is paginated, so you can use the \@odata.nextLink field from the response to fetch the next results. ++- **via files** This API solution enables pulling larger amounts of data faster and more reliably. So, it's recommended for large organizations, with more than 100-K devices. This API pulls all data in your organization as download files. The response contains URLs to download all the data from Azure Storage. You can download data from Azure Storage as follows: + - Call the API to get a list of download URLs with all your organization data. + - Download all the files using the download URLs and process the data as you like. ++Data that is collected using either '_JSON response_ or _via files_' is the current snapshot of the current state. It doesn't contain historic data. To collect historic data, customers must save the data in their own data storages. ++> [!NOTE] +> Unless indicated otherwise, all export hardware and firmware assessment assessment methods listed are **_full export_** and **_by device_** (also referred to as **_per device_**) ++## 1. Export hardware and firmware assessment (JSON response) ++### 1.1 API method description ++Returns all hardware and firmware assessments for all devices, on a per-device basis. It returns a table with a separate entry for every unique combination of deviceId and componentType. ++#### 1.1.1 Limitations ++- Maximum page size is 200,000. +- Rate limitations for this API are 30 calls per minute and 1000 calls per hour. ++### 1.2 Permissions ++One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs for details.](apis-intro.md) ++Permission type|Permission|Permission display name +:|:|: +Application|Software.Read.All|'Read Threat and Vulnerability Management software information' +Delegated (work or school account)|Software.Read|'Read Threat and Vulnerability Management software information' ++### 1.3 URL ++```http +GET api/machines/HardwareFirmwareInventoryProductCodeByMachine +``` ++### 1.4 Parameters ++- pageSize (default = 50,000): Number of results in response. +- $top: Number of results to return (doesn't return @odata.nextLink and so doesn't pull all the data). +++### 1.5 Properties (JSON response) ++> [!NOTE] +> Each record is approximately 1 KB of data. You should take this into account when choosing the correct pageSize parameter. +> +> Some additional columns might be returned in the response. These columns are temporary and might be removed. Only use the documented columns. +> +> The properties defined in the following table are listed alphabetically by property ID. When running this API, the resulting output will not necessarily be returned in the same order listed in this table. ++Property (ID)|Data type|Description +:|:|: +deviceId|String|Unique identifier for the device in the service. +|rbacGroupId|Int|The role-based access control (RBAC) group Id. If the device isn't assigned to any RBAC group, the value will be "Unassigned." If the organization doesn't contain any RBAC groups, the value will be "None." +|rbacGroupName|String|The role-based access control (RBAC) group. If the device isn't assigned to any RBAC group, the value will be "Unassigned." If the organization doesn't contain any RBAC groups, the value will be "None." +|deviceName|String|Fully qualified domain name (FQDN) of the device. +|componentType|String|Type of hardware or firmware component. +|manufacturer|String|Manufacturer of a specific hardware or firmware component. +|componentName|String|Name of a specific hardware or firmware component. +|componentVersion|String|Version of a specific hardware or firmware component. +|additionalFields|String|Additional information about the components in JSON array format. ++## 1.6 Example ++### 1.6.1 Request example ++```http +GET https://api.security.microsoft.com/api/machines/HardwareFirmwareInventoryProductCodeByMachine +``` ++### 1.6.2 Response example ++```json + { + "@odata.context": "https://api-df.securitycenter.microsoft.com/api/$metadata#Collection(microsoft.windowsDefenderATP.api.AssetHardwareFirmware)", + "value":[ + { + "deviceId": "49126b9e4a5473b5229c73799e9e55c48668101b", + "rbacGroupId": 39, + "rbacGroupName": "testO6343398Gq31", + "deviceName": "testmachine5", + "componentType": "Hardware", + "manufacturer": "razer", + "componentName": "blade_15_advanced_model_(mid_2021)_-_rz09-0409", + "componentVersion": "7.04", + "additionalFields": "{\"SystemSKU\":\"RZ09-0409CE53\",\"BaseBoardManufacturer\":\"Razer\",\"BaseBoardProduct\":\"CH570\",\"BaseBoardVersion\":\"4\",\"DeviceFamily\":\"Workstation\"}" + } + ] + }, + +``` ++## 2. Export certificate assessment (via files) ++### 2.1 API method description ++Returns all hardware and firmware assessments for all devices, on a per-device basis. It returns a table with a separate entry for every unique combination of DeviceId, ComponentType and ComponentName. ++#### 2.1.1 Limitations ++- Rate limitations for this API are 5 calls per minute and 20 calls per hour. ++### 2.2 Permissions ++One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs for details.](apis-intro.md) ++Permission type|Permission|Permission display name +:|:|: +Application|Software.Read.All|'Read Threat and Vulnerability Management software information' +Delegated (work or school account)|Software.Read|'Read Threat and Vulnerability Management software information' ++### 2.3 URL ++```http +GET /api/machines/HardwareFirmwareInventoryExport +``` ++### 2.4 Parameters ++- sasValidHours: The number of hours that the download URLs will be valid for (Maximum 24 hours). ++### 2.5 Properties (JSON response) ++> [!NOTE] +> The files are gzip compressed & in multiline Json format. +> +> The download URLs are only valid for 3 hours; otherwise, you can use the parameter. +> +> To maximize download speeds, make sure you are downloading the data from the same Azure region where your data resides. +> +> Each record is approximately 1KB of data. You should take this into account when choosing the pageSize parameter that works for you. +> +> Some additional columns might be returned in the response. These columns are temporary and might be removed. Only use the documented columns. ++Property (ID)|Data type|Description +:|:|: +|Export files|String[array]|A list of download URLs for files holding the current snapshot of the organization. +|GeneratedTime|DateTime|The time the export was generated. +++## 2.6 Example ++### 2.6.1 Request example ++```http +GET https://api.security.microsoft.com/api/machines/HardwareFirmwareInventoryExport +``` ++### 2.6.2 Response example ++```json + { + "@odata.context":"https://api-df.securitycenter.microsoft.com/api/$metadata#microsoft.windowsDefenderATP.api.ExportFilesResponse", + "exportFiles": [ + "https://tvmexportstrprdcane.blob.core.windows.net/tvm-firmware-export/2022-07-11/1101/FirmwareHardwareExport/json/OrgId=d7c7c745-195f-4223-9c7a-99fb420fd000/_RbacGroupId=39/part-00999-71eea973-1bb1-4d0a-829d-80cb07aff5d8.c000.json.gz?sv=2020-08-04&st=2022-07-11T13%3A10%3A06Z&se=2022-07-11T16%3A10%3A06Z&sr=b&sp=r&sig=muN8Sq6rVN6bFMtR0u3S5Wzh3D9qNPgN5vpU7lWvULg%3D", + "https://tvmexportstrprdcane.blob.core.windows.net/tvm-firmware-export/2022-07-11/1101/FirmwareHardwareExport/json/OrgId=d7c7c745-195f-4223-9c7a-99fb420fd000/_RbacGroupId=9/part-00968-71eea973-1bb1-4d0a-829d-80cb07aff5d8.c000.json.gz?sv=2020-08-04&st=2022-07-11T13%3A10%3A06Z&se=2022-07-11T16%3A10%3A06Z&sr=b&sp=r&sig=%2BA0%2B4qOOBCS5E4UenJPbMdLM%2FkbXHnz%2F1pvfSOCq%2F2s%3D", + "https://tvmexportstrprdcane.blob.core.windows.net/tvm-firmware-export/2022-07-11/1101/FirmwareHardwareExport/json/OrgId=d7c7c745-195f-4223-9c7a-99fb420fd000/_RbacGroupId=9/part-00969-71eea973-1bb1-4d0a-829d-80cb07aff5d8.c000.json.gz?sv=2020-08-04&st=2022-07-11T13%3A10%3A06Z&se=2022-07-11T16%3A10%3A06Z&sr=b&sp=r&sig=sZUgYMwSr5zk6BZvS%2BoYIWlHJWk2oJ7YjiC8R26S1X4%3D" + ], + "generatedTime": "2022-07-11T11:01:00Z" ++ } +``` |
| security | Linux Schedule Scan Mde | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-schedule-scan-mde.md | crontab -u username -r ### Explanation +``` +ΓÇöΓÇöΓÇöΓÇöΓÇö- minute (values: 0 - 59) (special characters: , \- \* /) <br> | +ΓÇöΓÇöΓÇöΓÇö- hour (values: 0 - 23) (special characters: , \- \* /) <br> | | +ΓÇöΓÇöΓÇö- day of month (values: 1 - 31) (special characters: , \- \* / L W C) <br> | | | +ΓÇöΓÇö- month (values: 1 - 12) (special characters: , \- \* /) <br> | | | | +ΓÇö- day of week (values: 0 - 6) (Sunday=0 or 7) (special characters: , \- \* / L W C) <br> | | | | |*****command to be executed+``` |
| security | Live Response Command Examples | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/live-response-command-examples.md | run get-process-by-name.ps1 -parameters "-processName Registry" > For long running commands such as '**run**' or '**getfile**', you may want to use the '**&**' symbol at the end of the command to perform that action in the background. > This will allow you to continue investigating the machine and return to the background command when done using '**fg**' [basic command](live-response.md#basic-commands). +> [!NOTE] +> +> When passing parameters to a live response script, do not include the following forbidden characters: **';'**, **'&'**, **'|'**, **'!'**, and **'$'**. + ## `scheduledtask` ```console |
| security | Whats New In Microsoft Defender Endpoint | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint.md | ms.pagetype: security ms.localizationpriority: medium Previously updated : 11/01/2022 Last updated : 11/28/2022 audience: ITPro For more information on Microsoft Defender for Endpoint on specific operating sy ## November 2022 -**Zeek is now generally available as a component of Microsoft Defender for Endpoint.** +- [Built-in protection](built-in-protection.md) is now generally available. Built-in protection helps protect your organization from ransomware and other threats with default settings that help ensure your devices are protected. -Microsoft has partnered with [Corelight](https://corelight.com/company/zeek-now-component-of-microsoft-windows), a leader in open source Network Detection and Response (NDR), to provide a new open-source integration with [Zeek](https://corelight.com/about-zeek/how-zeek-works) for Microsoft Defender for Endpoint. With this integration organizations can super-charge their investigation efforts with rich network signals and reduce the time it takes to detect network-based threats by having unprecedented visibility into network traffic from the endpoints' perspective. +- Zeek is now generally available as a component of Microsoft Defender for Endpoint. -The new Zeek integration is available in the latest version of the Microsoft Defender for Endpoint agent via the following knowledge base articles: [KB5016691](https://support.microsoft.com/topic/august-25-2022-kb5016691-os-build-22000-918-preview-59097044-915a-49a0-8870-49823236adbd), [KB5016693](https://support.microsoft.com/topic/august-16-2022-kb5016693-os-build-20348-946-preview-ee90d0bc-c162-4124-b7c6-f963ee7b17ed), [KB5016688](https://support.microsoft.com/topic/august-26-2022-kb5016688-os-builds-19042-1949-19043-1949-and-19044-1949-preview-ec31ebdc-067d-44dd-beb0-eabcc984d843), and [KB5016690](https://support.microsoft.com/topic/august-23-2022-kb5016690-os-build-17763-3346-preview-b81d1ac5-75c7-42c1-b638-f13aa4242f42). + Microsoft has partnered with [Corelight](https://corelight.com/company/zeek-now-component-of-microsoft-windows), a leader in open source Network Detection and Response (NDR), to provide a new open-source integration with [Zeek](https://corelight.com/about-zeek/how-zeek-works) for Defender for Endpoint. With this integration, organizations can super-charge their investigation efforts with rich network signals and reduce the time it takes to detect network-based threats by having unprecedented visibility into network traffic from the endpoints' perspective. -> [!NOTE] -> This integration doesn’t currently support the use of custom scripts to gain visibility into extra signals. + The new Zeek integration is available in the latest version of the Defender for Endpoint agent via the following knowledge base articles: + - [KB5016691](https://support.microsoft.com/topic/august-25-2022-kb5016691-os-build-22000-918-preview-59097044-915a-49a0-8870-49823236adbd) + - [KB5016693](https://support.microsoft.com/topic/august-16-2022-kb5016693-os-build-20348-946-preview-ee90d0bc-c162-4124-b7c6-f963ee7b17ed) + - [KB5016688](https://support.microsoft.com/topic/august-26-2022-kb5016688-os-builds-19042-1949-19043-1949-and-19044-1949-preview-ec31ebdc-067d-44dd-beb0-eabcc984d843) + - [KB5016690](https://support.microsoft.com/topic/august-23-2022-kb5016690-os-build-17763-3346-preview-b81d1ac5-75c7-42c1-b638-f13aa4242f42) ++ > [!NOTE] + > This integration doesn’t currently support the use of custom scripts to gain visibility into extra signals. ## October 2022 The new Zeek integration is available in the latest version of the Microsoft Def ## August 2022 - [Device health status](investigate-machines.md#device-health-status)<br>The Device health status card shows a summarized health report for the specific device.+ - [Device health reporting (Preview)](/microsoft-365/security/defender-endpoint/machine-reports)<br> The devices status report provides high-level information about the devices in your organization. The report includes trending information showing the sensor health state, antivirus status, OS platforms, and Windows 10 versions.+ - [Tamper protection on macOS is now generally available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/tamper-protection-on-macos-is-now-generally-available/ba-p/3595422)<br> This feature will be released with audit mode enabled by default, and you can decide whether to enforce (block) or turn off the capability. Later this year, we'll offer a gradual rollout mechanism that will automatically switch endpoints to block mode; note this will only apply if you have not made a choice to either enable (block mode) or disable the capability.+ - [Network Protection and Web Protection for macOS and Linux is now in Public Preview!](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/network-protection-and-web-protection-for-macos-and-linux-is-now/ba-p/3601576)<br>Network Protection helps reduce the attack surface of your devices from Internet-based events. It prevents employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. It's the foundation on which our Web Protection for Microsoft Defender for Endpoint is built. These capabilities include Web threat protection, Web content filtering, and IP/URL Custom indicators. Web protection enables you to secure your devices against web threats and helps to regulate unwanted content.+ - [Improved Microsoft Defender for Endpoint (MDE) onboarding for Windows Server 2012 R2 and Windows Server 2016](/mem/configmgr/core/plan-design/changes/whats-new-in-version-2207#improved-microsoft-defender-for-endpoint-mde-onboarding-for-windows-server-2012-r2-and-windows-server-2016)<br>Configuration Manager version 2207 now supports automatic deployment of modern, unified Microsoft Defender for Endpoint for Windows Server 2012 R2 & 2016. Windows Server 2012 and 2016 devices that are targeted with Microsoft Defender for Endpoint onboarding policy will use the unified agent versus the existing Microsoft Monitoring Agent based solution, if configured through Client Settings. ## July 2022+ - [Add domain controller devices - Evaluation lab enhancement](evaluation-lab.md#add-a-domain-controller)<br>Now generally available - Add a domain controller to run complex scenarios such as lateral movement and multistage attacks across multiple devices.+ - [Announcing File page enhancements in Microsoft Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-file-page-enhancements-in-microsoft-defender-for/ba-p/3584004)<br>Have you ever investigated files in Microsoft Defender for Endpoint? We now make it even easier with our recent announcement of enhancements to the File page and side panel. Users can now streamline processes by having a more efficient navigation experience that hosts all this information in one place.+ - [Introducing the new alert suppression experience](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/introducing-the-new-alert-suppression-experience/ba-p/3562719)<br>We're excited to share the new and advanced alert suppression experience is now Generally Available. The new experience provides tighter granularity and control, allowing users to tune Microsoft Defender for Endpoint alerts.+ - [Prevent compromised unmanaged devices from moving laterally in your organization with “Contain](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/prevent-compromised-unmanaged-devices-from-moving-laterally-in/ba-p/3482134)<br>Starting today, when a device that isn't enrolled in Microsoft Defender for Endpoint is suspected of being compromised, as a SOC analyst, you'll be able to “Contain” it. As a result, any device enrolled in Microsoft Defender for Endpoint will now block any incoming/outgoing communication with the suspected device.+ - [Mobile device support is now available for US Government Customers using Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/mobile-device-support-is-now-available-for-us-government/ba-p/3472590)<br>Microsoft Defender for Endpoint for US Government customers is built in the Azure US Government environment and uses the same underlying technologies as Defender in Azure Commercial. This offering is available to GCC, GCC High and DoD customers and further extends our platform availability from Windows, macOS, and Linux, to Android and iOS devices as well. ## June 2022+ - [Defender for Servers Plan 2 now integrates with MDE unified solution](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/defender-for-servers-plan-2-now-integrates-with-mde-unified/ba-p/3527534)<br>You can now start deploying the modern, unified solution for Windows Server 2012 R2 and 2016 to servers covered by Defender for Servers Plan 2 using a single button.+ - [Mobile Network Protection in Microsoft Defender for Endpoint on Android & iOS now in Public Preview](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/mobile-network-protection-in-microsoft-defender-for-endpoint-on/ba-p/3559121)<br>Microsoft offers a mobile network protection feature in Defender for Endpoint that helps organizations identify, assess, and remediate endpoint weaknesses with the help of robust threat intelligence. We're delighted to announce that users can now benefit from this new feature on both Android and iOS platforms with Microsoft Defender for Endpoint. ## May 2022+ - [Tamper protection for macOS (preview)](tamperprotection-macos.md)<br>Tamper protection helps prevent unauthorized removal of Microsoft Defender for Endpoint on macOS.+ - [Add domain controller devices - Evaluation lab enhancement (preview)](evaluation-lab.md#add-a-domain-controller)<br>Add a domain controller to run complex scenarios such as lateral movement and multistage attacks across multiple devices.+ - [Troubleshooting mode for Microsoft Defender for Endpoint now Generally Available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/troubleshooting-mode-for-microsoft-defender-for-endpoint-now/ba-p/3347344)<br>Introducing troubleshooting mode, a unique, innovative, and secure way to investigate and adjust configurations on your devices. This mode will enable the local admin on the device to override Microsoft Defender Antivirus security policy configurations on the device, including tamper protection. + - [Announcing the public preview of Defender for Endpoint personal profile for Android Enterprise](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-the-public-preview-of-defender-for-endpoint-personal/ba-p/3370979)<br>We're happy to announce that users who wish to enroll their own devices in their workplace’s BYOD program can now benefit from the protection provided by Microsoft Defender for Endpoint in their personal profile as well.+ - [Security Settings Management in Microsoft Defender for Endpoint is now generally available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/security-settings-management-in-microsoft-defender-for-endpoint/ba-p/3356970)<br>In late 2021, we announced that Microsoft Defender for Endpoint expanded its configuration management capabilities. This release empowered security teams to configure devices with their desired security settings without needing to deploy and implement other tools or infrastructure. Made possible with Microsoft Endpoint Manager, organizations have been able to manage antivirus (AV), endpoint detection and response (EDR), and firewall (FW) policies from a single view for all enlisted devices. Today, we're announcing that this capability is now generally available for Windows client and Windows server, supporting Windows 10, Windows 11, and Windows Server 2012 R2 or later. ## April 2022+ - [Updated onboarding and feature parity for Windows Server 2012 R2 and Windows Server 2016)](configure-server-endpoints.md)<br/> The new unified solution package is now generally available and makes it easier to onboard servers by removing dependencies and installation steps. In addition, this unified solution package comes with many new feature improvements.+ - [Integration with Tunnel for iOS](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/what-s-new-in-microsoft-endpoint-manager-2204-april-edition/ba-p/3297995). Microsoft Defender for Endpoint on iOS can now integrate with Microsoft Tunnel, a VPN gateway solution to enable security and connectivity in a single app. This feature was earlier available only on Android.+ - [Enhanced Antimalware Protection in Microsoft Defender for Endpoint Android](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/enhanced-antimalware-protection-in-microsoft-defender-for/ba-p/3290320)<br>We're excited to share major updates to the Malware protection capabilities of Microsoft Defender for Endpoint on Android. These new capabilities form a major component of your next-generation protection in Microsoft Defender for Endpoint. This protection brings together machine learning, big-data analysis, in-depth threat research, and the Microsoft cloud infrastructure to protect Android devices (or endpoints) in your organization.+ - [Enhanced antimalware engine capabilities for Linux and macOS](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/enhanced-antimalware-engine-capabilities-for-linux-and-macos/ba-p/3292003)<br>We're announcing a significant upgrade to our next-generation protection on Linux and macOS with a new, enhanced engine. The Microsoft Defender Antivirus antimalware engine is a key component of next-generation protection. This protection brings machine learning, big-data analysis, in-depth threat research, and the Microsoft cloud infrastructure, to protect devices (or endpoints) in your organization. The main benefits of this major update include performance and prevention improvements, as well as adding support for custom file indicators on macOS and Linux.+ - [New Reporting Functionality for Device Control and Windows Defender Firewall](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/new-reporting-functionality-for-device-control-and-windows/ba-p/3290601)<br>We're excited to announce the new Endpoint reporting capabilities within the Microsoft 365 Defender portal. This work brings new endpoint reports together so you can see what is happening in your environment with just a couple clicks. Our reports are designed to provide insight into device behavior and activity while allowing you to take full advantage of the integrated experiences within Microsoft 365 Defender portal, such as device timeline and advanced hunting.+ - [Unified submissions in Microsoft 365 Defender now Generally Available!](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/unified-submissions-in-microsoft-365-defender-now-generally/ba-p/3270770)<br>Your security team now has a “one-stop shop” for submitting emails, URLs, email attachments, and files in one, easy-to-use submission experience. To simplify the submission process, we're excited to announce a new unified submissions experience in the Microsoft 365 Defender portal (https://security.microsoft.com). With unified submissions, you can submit files to Microsoft 365 Defender for review from within the portal. We're also adding the ability to submit a file directly from a Microsoft Defender for Endpoint Alert page. + - [Announcing expanded support and functionality for Live Response APIs](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-expanded-support-and-functionality-for-live-response/ba-p/3178432)<br>We're happy to share that we continue to expand support of existing APIs across all of our supported platforms in Microsoft Defender for Endpoint, alongside announcing new ones that will help simplify and augment organization's response automation and orchestration. ## February 2022 - [The Splunk Add-on for Microsoft Security is now available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/the-splunk-add-on-for-microsoft-security-is-now-available/ba-p/3171272)<br>We're happy to share that the Splunk-supported Splunk Add-on for Microsoft Security is now available. This add-on builds on the Microsoft 365 Defender Add-on for Splunk 1.3.0 and maps the Microsoft Defender for Endpoint Alerts API properties or the Microsoft 365 Defender Incidents API properties onto Splunk's Common Information Model (CIM).+ - [Deprecating the legacy SIEM API - Postponed](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/deprecating-the-legacy-siem-api-postponed/ba-p/3139643)<br>We previously announced the SIEM REST API would be deprecated on 4/1/2022. We've listened to customer feedback and the API deprecation has been postponed for now, more details expected in Q3, 2022. We look forward to sharing exciting details about the ​Microsoft 365 Defender APIs in Microsoft Graph in Q3 2022. ## January 2022 - [Vulnerability management for Android and iOS is now generally available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-general-availability-of-vulnerability-management/ba-p/3071663)<br>With this new cross-platform coverage, threat and vulnerability management capabilities now support all major device platforms across the organization - spanning workstations, servers, and mobile devices. + - [Microsoft Defender for Endpoint Plan 1 Now Included in Microsoft 365 E3/A3 Licenses](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-for-endpoint-plan-1-now-included-in-m365-e3/ba-p/3060639)<br>Starting January 14, Microsoft Defender for Endpoint Plan 1 (P1) will be automatically included in Microsoft 365 E3/A3 licenses.+ - [Zero-touch onboarding of Microsoft Defender for Endpoint on iOS now in public preview](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/zero-touch-onboarding-of-microsoft-defender-for-endpoint-on-ios/ba-p/3038045)<br>With this new capability, enterprises can now deploy Microsoft Defender for Endpoint on iOS devices that are enrolled with Microsoft Endpoint Manager automatically, without needing end-users to interact with the app. This eases the deployment frictions and significantly reduces the time needed to deploy the app across all devices as Microsoft Defender for Endpoint gets silently activated on targeted devices and starts protecting your iOS estate. ## December 2021 - [Microsoft Defender Vulnerability Management can help identify Log4j vulnerabilities in applications and components](https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/#TVM)<br>Threat and vulnerability management automatically and seamlessly identifies devices affected by the Log4j vulnerabilities and the associated risk in the environment and significantly reduces time-to-mitigate. Microsoft continues to iterate on these features based on the latest information from the threat landscape.+ - Discover IoT devices (preview): [Device discovery](device-discovery.md) now has the ability to help you find unmanaged IoT devices connected to your corporate network. This gives you a single unified view of your IoT inventory alongside the rest of your IT devices (workstations, servers, and mobile).+ - [Microsoft Defender for IoT integration (preview)](enable-microsoft-defender-for-iot-integration.md): This integration enhances your device discovery capabilities with the agentless monitoring capabilities provided by Microsoft Defender for IoT. This provides increased visibility to help locate, identify, and secure the IoT devices in your network. ## November 2021 - [Security configuration management](security-config-management.md) <br/> A capability for devices that aren't managed by a Microsoft Endpoint Manager, either Microsoft Intune or Microsoft Endpoint Configuration Manager, to receive security configurations for Microsoft Defender directly from Endpoint Manager.+ - [Evaluation Lab: Expanded OS support & Atomic Red Team simulations](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/evaluation-lab-expanded-os-support-amp-atomic-red-team/ba-p/2993927)<br>the Evaluation Lab now supports adding Windows 11, Windows Server 2016, and Linux devices. In addition, we’d also like to announce a new partnership with Red Canary’s open-source simulation library, Atomic Red Team!+ - [Announcing the public preview of Microsoft Defender for Endpoint Mobile - Tamper protection](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-the-public-preview-of-microsoft-defender-for-endpoint/ba-p/2971038)<br>Mark a device non-compliant after seven days of inactivity in the Microsoft Defender for Endpoint mobile app.+ - [Boost protection of your Linux estate with behavior monitoring, extended distro coverage, and more](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/boost-protection-of-your-linux-estate-with-behavior-monitoring/ba-p/2909320)<br>We're thrilled to share the latest news about Microsoft Defender for Endpoint on Linux next generation protection, endpoint detection and response (EDR), threat and vulnerability management (TVM). Microsoft protection for your Linux estate is getting an impressive boost across the full spectrum of the security suite. With recent Microsoft Defender for Endpoint on Linux integration into Azure Security Center, the benefits of our Linux EDR and TVM now extend to Azure Defender customers. ## October 2021 - [Updated onboarding and feature parity for Windows Server 2012 R2 and Windows Server 2016 (preview)](configure-server-endpoints.md)<br/> The new unified solution package makes it easier to onboard servers by removing dependencies and installation steps. In addition, this unified solution package comes with many new feature improvements.+ - Windows 11 support added to Microsoft Defender for Endpoint and Microsoft 365 Defender. ## September 2021 The new Zeek integration is available in the latest version of the Microsoft Def - (Preview) [Microsoft Defender for Endpoint Plan 1](defender-endpoint-plan-1.md) <br/>Defender for Endpoint Plan 1 (preview) is an endpoint protection solution that includes next-generation protection, attack surface reduction, centralized management and reporting, and APIs. Defender for Endpoint Plan 1 (preview) is a new offering for customers who want to try our endpoint protection capabilities, have Microsoft 365 E3, and do not yet have Microsoft 365 E5. To learn more, see [Microsoft Defender for Endpoint Plan 1 (preview)](defender-endpoint-plan-1.md). Existing [Defender for Endpoint](microsoft-defender-endpoint.md) capabilities will be known as Defender for Endpoint Plan 2. + - (Preview) [Web Content Filtering](web-content-filtering.md)<br> Web content filtering is part of web protection capabilities in Microsoft Defender for Endpoint. It enables your organization to track and regulate access to websites based on their content categories. Many of these websites, while not malicious, might be problematic because of compliance regulations, bandwidth usage, or other concerns. ## July 2021 The new Zeek integration is available in the latest version of the Microsoft Def ## June 2021 - [Delta export software vulnerabilities assessment](get-assessment-methods-properties.md#31-methods) API <br> An addition to the [Export assessments of vulnerabilities and secure configurations](get-assessment-methods-properties.md) API collection. <br> Unlike the full software vulnerabilities assessment (JSON response) - which is used to obtain an entire snapshot of the software vulnerabilities assessment of your organization by device - the delta export API call is used to fetch only the changes that have happened between a selected date and the current date (the "delta" API call). Instead of getting a full export with a large amount of data every time, you'll only get specific information on new, fixed, and updated vulnerabilities. Delta export API call can also be used to calculate different KPIs such as "how many vulnerabilities were fixed" or "how many new vulnerabilities were added to an organization."+ - [Export assessments of vulnerabilities and secure configurations](get-assessment-methods-properties.md) API <br> Adds a collection of APIs that pull Defender Vulnerability Management data on a per-device basis. There are different API calls to get different types of data: secure configuration assessment, software inventory assessment, and software vulnerabilities assessment. Each API call contains the requisite data for devices in your organization.+ - [Remediation activity](get-remediation-methods-properties.md) API <br> Adds a collection of APIs with responses that contain Defender Vulnerability Management remediation activities that have been created in your tenant. Response information types include one remediation activity by ID, all remediation activities, and exposed devices of one remediation activity.+ - [Device discovery](device-discovery.md) <br> Helps you find unmanaged devices connected to your corporate network without the need for extra appliances or cumbersome process changes. Using onboarded devices, you can find unmanaged devices in your network and assess vulnerabilities and risks. You can then onboard discovered devices to reduce risks associated with having unmanaged endpoints in your network. > [!IMPORTANT] > Standard discovery will be the default mode for all customers starting July 19, 2021. You can choose to retain the basic mode through the settings page. + - [Device group definitions](/microsoft-365/security/defender-endpoint/machine-groups) can now include multiple values for each condition. You can set multiple tags, device names, and domains to the definition of a single device group.+ - [Mobile Application management support](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-new-capabilities-on-android-and-ios/ba-p/2442730) <br> This enhancement enables Microsoft Defender for Endpoint protect an organization's data within a managed application when Intune is being used to manage mobile applications. For more information about mobile application management, see [this documentation](/mem/intune/apps/mam-faq).+ - [Microsoft Tunnel VPN integration](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-new-capabilities-on-android-and-ios/ba-p/2442730) <br> Microsoft Tunnel VPN capabilities are now integrated with Microsoft Defender for Endpoint app for Android. This unification enables organizations to offer a simplified end user experience with one security app – offering both mobile threat defense and the ability to access on-premises resources from their mobile device, while security and IT teams are able to maintain the same admin experiences they are familiar with.+ - [Jailbreak detection on iOS](/microsoft-365/security/defender-endpoint/ios-configure-features#conditional-access-with-defender-for-endpoint-on-ios) <br> Jailbreak detection capability in Microsoft Defender for Endpoint on iOS is now generally available. This adds to the phishing protection that already exists. For more information, see [Setup Conditional Access Policy based on device risk signals](/microsoft-365/security/defender-endpoint/ios-configure-features). ## March 2021+ - [Manage tamper protection for your organization using Microsoft 365 Defender portal](manage-tamper-protection-microsoft-365-defender.md) <br> You can manage tamper protection settings on Windows 10, Windows Server 2016, Windows Server 2019, and Windows Server 2022 by using a method called *tenant attach*. |
| security | Tvm Hardware And Firmware | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-hardware-and-firmware.md | + + Title: Firmware and hardware assessment +description: Find out about the firmware and hardware installed in your environment +keywords: Microsoft Defender for Endpoint, hardware assessment, firmware assessment, hardware and firmare assessment, mdvm, threat & vulnerability management, Microsoft Defender Vulnerability Management +++ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++ - m365-security-compliance + - tier1 ++search.appverid: met150 +++# Hardware and firmware assessment +++**Applies to:** ++- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) +- [Microsoft Defender Vulnerability Management](index.yml) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) +++>[!Note] +> Want to experience Microsoft Defender Vulnerability Management? Learn more about how you can sign up to the [Microsoft Defender Vulnerability Management public preview trial](../defender-vulnerability-management/get-defender-vulnerability-management.md). ++Firmware and hardware attacks are on the rise. Attackers are increasingly targeting firmware and device drivers of hardware components to gain high privilege and persistence. Visibility into the threat posture of your firmware and hardware, and timely remediation of identified vulnerabilities is a vital part of keeping your organization secure. ++Microsoft Defender Vulnerability Management hardware and firmware assessment provides a list of known hardware and firmware in your organization. It provides individual inventories for system models, processors, and BIOS. Each view includes details such as the name of the vendor, number of weaknesses, threats insights, and the number of exposed devices. ++## View your hardware and firmware ++To access the hardware and firmware assessment page: ++1. Go to **Vulnerability management** \> **Inventories** in the [Microsoft 365 Defender portal](https://security.microsoft.com). +2. Select the **Hardware and Firmware** tab. ++The **Hardware and Firmware** page opens with individual pages available for: ++- [Laptop, desktop, and server modals inventory](#laptop-desktop-and-server-modals-inventory) +- [Processor inventory](#processor-inventory) +- [BIOS inventory](#bios-inventory) ++>[!Note] +> Weaknesses and exposed devices information is based on security advisories from HP, Dell, and Lenovo and relates to processors and BIOS only. Weaknesses for other vendors are not reported. +> +> Inventory and weaknesses data is collected on Windows, Linux, and MacOS (refer to the [list of supported platforms](tvm-supported-os.md)). +> +> **Note**: processor and BIOS information is not reported on Mac devices with M1 processor. ++### Laptop, desktop, and server modals inventory ++Select the **Laptop, desktop, and server modals** page to see a list of all system models in the organization. ++ :::image type="content" source=" ../../media/defender-vulnerability-management/firmware-laptop-desktop-server-modals.png" alt-text="Screenshot of the Laptop, desktop, and server modals page" lightbox=" ../../media/defender-vulnerability-management/firmware-laptop-desktop-server-modals.png"::: ++[test](../../media/defender-vulnerability-management/firmware-laptop-desktop-server-modals.png) ++At the top of the page, you can view the number of models per vendor.   ++When you select a model from the list, a flyout panel will open with the model software details: ++ :::image type="content" source="../defender-vulnerability-management/media/image2.png" alt-text="Screenshot of the Laptop, desktop, and server modals flyout page" lightbox="../defender-vulnerability-management/media/image2.png"::: ++### Processor inventory ++Select the **Processors** page to see a list of all processors in the organization. ++ :::image type="content" source="../defender-vulnerability-management/media/image3.png" alt-text="Screenshot of the Processors page" lightbox="../defender-vulnerability-management/media/image3.png"::: ++At the top of the page, you can view the number of processors per vendor. ++When you select a processor from the list, a flyout panel will open with the processor software details. ++### BIOS inventory ++Select the **BIOS** page to view a list of all BIOS firmware in the organization. ++ :::image type="content" source="../defender-vulnerability-management/media/image5.png" alt-text="Screenshot of the BIOS page" lightbox="../defender-vulnerability-management/media/image5.png"::: ++At the top of the page, you can view the number of BIOS per vendor. ++### View BIOS firmware details ++To view more details on a BIOS firmware: ++1. Open the **Hardware and Firmware** page in the [Microsoft 365 Defender portal](https://security.microsoft.com/vulnerability-management-inventories/hardwareAndFirmware) +2. Select the BIOS page and choose a BIOS in the list to open a flyout panel. +3. Select **Open firmware page** to view more details about the BIOS firmware. ++ :::image type="content" source="../defender-vulnerability-management/media/image7.png" alt-text="Screenshot of BIOS firmware details" lightbox="../defender-vulnerability-management/media/image7.png"::: ++You can select the **Version distribution** tab to see BIOS versions that are deployed in the organization. ++### Get more information on missing security updates ++Select the **Missing security updates** tab to see the security updates that should be installed on the device to remediate discovered BIOS vulnerabilities. ++When you select an item from the list, a flyout panel will open with a link to the BIOS vendor advisory, a list of exposed devices, and a list of CVEs. ++ :::image type="content" source="../defender-vulnerability-management/media/image11.png" alt-text="Screenshot missing security updates details" lightbox="../defender-vulnerability-management/media/image11.png"::: ++## Hardware and firmware on devices ++To view the system model, processor, and BIOS information on the device page, select the device from the **Installed devices** tab and in the flyout panel and select **Open device page** or select the device directly from the Device inventory page. ++ :::image type="content" source="../defender-vulnerability-management/media/image12.png" alt-text="Screenshot of the hardware and firmware on the device page" lightbox="../defender-vulnerability-management/media/image12.png"::: ++Select **See all details** to get a flyout panel with more information. ++## Find processor and BIOS weaknesses ++To actively search for processor and BIOS weaknesses: ++1. Go to **Vulnerability management** \> **Weaknesses** in the [Microsoft 365 Defender portal](https://security.microsoft.com). +2. Search for ‘BIOS’ CVEs that relate to the processor or BIOS will be returned. +3. Select an item from the list to open a flyout panel with more details on the CVE. ++On individual devices view processor and BIOS CVEs by selecting the **Discovered vulnerabilities** tab. Select a CVE to see a flyout panel with more information: ++ :::image type="content" source="../defender-vulnerability-management/media/bios-vulnerability-details.png" alt-text="Screenshot of the bios-vulnerability-details page per device" lightbox="../defender-vulnerability-management/media/bios-vulnerability-details.png"::: ++## Recommendations for firmware updates ++To actively search for firmware recommendations: ++1. Go to **Vulnerability management** \> **Recommendations** in the [Microsoft 365 Defender portal](https://security.microsoft.com). +2. Filter on Remediation type ‘Firmware update’ ++Recommendations will appear to update a specific BIOS version if it's installed on at least 5% of devices across all organizations. ++ :::image type="content" source="../defender-vulnerability-management/media/image16.png" alt-text="Screenshot of firmware recommendations page" lightbox="../defender-vulnerability-management/media/image16.png"::: ++### UEFI Secure Boot mode recommendations ++Defender Vulnerability Management finds devices where UEFI Secure Boot mode is disabled and recommends enabling it. ++To find these recommendations, search for 'scid-2100' or 'boot' in the recommendations page. On selecting a recommendation, a flyout panel will open with more information: ++ :::image type="content" source="../defender-vulnerability-management/media/image18.png" alt-text="Screenshot of UEFI Secure Boot mode recommendations" lightbox="../defender-vulnerability-management/media/image18.png"::: ++>[!Note] +> This capability is currently supported only on Windows. ++## Advanced Hunting ++You can use advanced hunting queries to gain visibility on hardware and firmware in your organization. Find details about the hardware and firmware installed per device in the **DeviceTvmHardwareFirmware** table. This table contains hardware and firmware information per device, including system model, processor, and BIOS. ++For more information, see [advanced hunting](../defender/advanced-hunting-devicetvmhardwarefirmware-table.md). ++## Hardware and firmware API ++You can use APIs to view all hardware and firmware installed in your organization, including component type, vendor, and version. ++- [Export firmware and hardware assessment per device](../defender-endpoint/export-firmware-hardware-assessment.md) ++## Related articles ++- [Vulnerabilities in my organization](tvm-weaknesses.md) +- [Advanced hunting schema reference](../defender-endpoint/advanced-hunting-schema-reference.md) +- [Security recommendations](tvm-end-of-support-software.md) |
| security | Advanced Hunting Devicetvmhardwarefirmware Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvmhardwarefirmware-table.md | + + Title: DeviceTvmHardwareFirmware table in the advanced hunting schema +description: Learn about the DeviceTvmHardwareFirmware table in the advanced hunting schema, which includes information on devices like processor, BIOS, and others, as checked in threat and vulnerability management in Microsoft 365 Defender. +keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, DeviceTvmHardwareFirmware +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +++ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +++ms.localizationpriority: medium ++audience: ITPro ++- m365-security +- tier3 ++++# DeviceTvmHardwareFirmware ++++**Applies to:** +- Microsoft 365 Defender ++> [!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ++The `DeviceTvmHardwareFirmware` table in the advanced hunting schema contains hardware and firmware information of devices as checked by [Microsoft Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt). The information includes the system model, processor, and BIOS, among others. ++For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md). ++| Column name | Data type | Description | +|-|--|-| +| `DeviceId` | `string` | Unique identifier for the device in the service | +| `DeviceName` | `string` | Fully qualified domain name (FQDN) of the device | +| `ComponentType` | `string` | Type of hardware or firmware component | +| `Manufacturer` | `string` | Manufacturer of hardware or firmware component | +| `ComponentName` | `string` | Name of hardware or firmware component | +| `ComponentFamily` | `string` | Component family or class, a grouping of components that have similar features or characteristics as determined by the manufacturer | +| `ComponentVersion` | `string` | Component version (for example, BIOS version) | +| `AdditionalFields` | `string` | Additional information about the components in JSON array format| ++You can try the following sample queries to use the information available in the `DeviceTvmHardwareFirmware` table: ++```kusto +// Count the number of Lenovo devices +DeviceTvmHardwareFirmware +| where ComponentType == "Hardware" and Manufacturer == "lenovo" +| summarize count() +``` ++```kusto +// Find all devices with a specific BIOS version, replace ComponentVersion with what you are looking for +DeviceTvmHardwareFirmware +| where ComponentType == "Bios" and ComponentVersion contains "N2VET29W" +|project DeviceId, DeviceName +``` ++## Related topics ++- [Proactively hunt for threats](advanced-hunting-overview.md) +- [Learn the query language](advanced-hunting-query-language.md) +- [Understand the schema](advanced-hunting-schema-tables.md) +- [Apply query best practices](advanced-hunting-best-practices.md) +- [Overview of Microsoft Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) |
| security | Advanced Hunting Devicetvmsoftwareinventory Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvmsoftwareinventory-table.md | |
| security | Advanced Hunting Devicetvmsoftwarevulnerabilities Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvmsoftwarevulnerabilities-table.md | |
| security | Advanced Hunting Devicetvmsoftwarevulnerabilitieskb Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md | |
| security | Advanced Hunting Emailattachmentinfo Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-emailattachmentinfo-table.md | |
| security | Advanced Hunting Emailevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-emailevents-table.md | |
| security | Advanced Hunting Emailpostdeliveryevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-emailpostdeliveryevents-table.md | |
| security | Advanced Hunting Emailurlinfo Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-emailurlinfo-table.md | |
| security | Advanced Hunting Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-overview.md | Advanced hunting is a query-based threat hunting tool that lets you explore up t Advanced hunting supports two modes, guided and advanced. Use [guided mode](advanced-hunting-query-builder.md) if you are not yet familiar with Kusto Query Language (KQL) or prefer the convenience of a query builder. Use [advanced mode](advanced-hunting-query-language.md) if you are comfortable using KQL to create queries from scratch. **To start hunting, read [Choose between guided and advanced modes to hunt in Microsoft 365 Defender](advanced-hunting-modes.md).**-<br><br> > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4G6DO] You can use the same threat hunting queries to build custom detection rules. These rules run automatically to check for and then respond to suspected breach activity, misconfigured machines, and other findings. -This capability is similar to [advanced hunting in Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview) and supports queries that check a broader data set coming from: +Advanced hunting supports queries that check a broader data set coming from: - Microsoft Defender for Endpoint - Microsoft Defender for Office 365 This capability is similar to [advanced hunting in Microsoft Defender for Endpoi To use advanced hunting, [turn on Microsoft 365 Defender](m365d-enable.md). + For more information on advanced hunting in Microsoft Defender for Cloud Apps data, see the [video](https://www.microsoft.com/en-us/videoplayer/embed/RWFISa). |
| security | Frequently Asked Questions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/frequently-asked-questions.md | search.appverid: met150 | Questions | Answers | |||-| **How is Microsoft Defender Experts for XDR different from Microsoft Defender Experts for Hunting?** | [Microsoft Defender Experts for Hunting](../defender/defender-experts-for-hunting.md) provides threat hunting service to proactively find threats. This service is meant for customers that have a robust security operations center and want that deep expertise in hunting to expose advanced threats. Microsoft Defender Experts for XDR provides end-to-end security operations capabilities to monitor, investigate and respond to security alerts. This service is meant for customers with constrained security operations centers that are overburdened with alert volume, in need of skilled experts or both. Defender Experts for XDR also includes the proactive threat hunting offered by Defender Experts for Hunting| +| **How is Microsoft Defender Experts for XDR different from Microsoft Defender Experts for Hunting?** | [Microsoft Defender Experts for Hunting](../defender/defender-experts-for-hunting.md) provides threat hunting service to proactively find threats. This service is meant for customers that have a robust security operations center and want that deep expertise in hunting to expose advanced threats. Microsoft Defender Experts for XDR provides end-to-end security operations capabilities to monitor, investigate, and respond to security alerts. This service is meant for customers with constrained security operations centers (SOCs) that are overburdened with alert volume, in need of skilled experts, or both. Defender Experts for XDR also includes the proactive threat hunting offered by Defender Experts for Hunting| | **What products does Defender Experts for XDR operate on?** | Refer to the [Prerequisites](/microsoft-365/security/defender/dex-xdr-overview#prerequisites) section for details. | | **Is there a minimum criteria or size requirements to get Defender Experts for XDR?** | Not in preview. We'll evaluate and provide these requirements as part of our general availability. |-| **Does Defender Experts for XDR replace my security operations center (SOC) team?** | No. Defender Experts for XDR is meant to augment your SOC team reducing their workload and collaborating with them to protect your organization from threat actors. But we don't replace your SOC team or their processes. | -| **What actions can XDR experts take during incident investigation?** | Our expert analysts can take actions based on the roles granted to them in your Microsoft 365 Defender portal. If our analysts are granted a security reader role, they can investigate and provide guided response for your SOC team to act on. If our analysts are granted a security operator role, they can also take specific remediation actions agreed upon with your SOC team. Finally, if they're granted a security administrator role, they can take higher privilege actions like managing certain settings as agreed upon with you. | -| **Can XDR experts help me improve my security posture?** | Yes, we'll provide necessary guidance before and during the preview to improve your security posture. | +| **Does Defender Experts for XDR replace my SOC team?** | No. Defender Experts for XDR is meant to augment your SOC team reducing their workload and collaborating with them to protect your organization from threat actors. But we don't replace your SOC team or their processes. | +| **What actions can your experts take during incident investigation?** | Our expert analysts can take actions based on the roles granted to them in your Microsoft 365 Defender portal. If our analysts are granted a security reader role, they can investigate and provide guided response for your SOC team to act on. If our analysts are granted a security operator role, they can also take specific remediation actions agreed upon with your SOC team. Finally, if they're granted a security administrator role, they can take higher privilege actions like managing certain settings as agreed upon with you. | +| **Can your experts help me improve my security posture?** | Yes, our experts will provide necessary guidance before and during the preview to improve your security posture. | | **Can Defender Experts for XDR help with an active compromise or vulnerability?** | No, Defender Experts currently don't provide incident response services. Contact your Microsoft representative to engage Microsoft Detection and Response Team (DART) for incident response assistance. | | **How can my organization participate in the Defender Experts for XDR preview?** |We're gradually expanding the preview to more customers. Contact your Microsoft representative to access the preview.| | **When will Defender Experts for XDR be generally available?** | We'll announce general availability dates closer to the launch date. | |
| security | Get Started Xdr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/get-started-xdr.md | Once the Defender Experts for XDR team is ready to onboard you, weΓÇÖll reach ou ## Grant permissions to our experts -By default, Defender Experts for XDR require the following permissions to investigate incidents and notify you when you need to take action: +By default, Defender Experts for XDR requires the following permissions to investigate incidents and notify you when you need to take action: -- **Service provider access** - This permission lets our experts sign in to your tenant and deliver services based on assigned security roles. For details [learn more about cross-tenant access](/azure/active-directory/external-identities/cross-tenant-access-overview).+- **Service provider access** - This permission lets our experts sign in to your tenant and deliver services based on assigned security roles. For details, [learn more about cross-tenant access](/azure/active-directory/external-identities/cross-tenant-access-overview). - **Security reader** - This built-in Azure Active Directory (Azure AD) role lets our experts investigate incidents and provide guidance on necessary response actions. You can also provide our experts the following permissions to investigate incidents on your behalf: You can also provide our experts the following permissions to investigate incide Follow these steps to grant our experts additional permissions: -1. In the same Defender Experts setting page mentioned earlier, select **Manage permissions**. +1. In the same Defender Experts settings page mentioned earlier, select **Manage permissions**. 2. Under **Additional permissions**, select the other role(s) you want to grant. 3. Select **Give access**. |
| security | Start Using Mdex Xdr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/start-using-mdex-xdr.md | search.appverid: met150 ## Run initial Defender readiness checks -Apart from onboarding service delivery, our expertise on the Microsoft 365 Defender product suite enables Defender Experts for XDR to run an initial readiness engagement to help you get the most out of your Microsoft security products. This engagement will be based on your [Microsoft Secure Score](microsoft-secure-score.md) and Defender ExpertsΓÇÖ policy recommendations. Our Experts will help prioritizing and customizing our recommendations to fit your environment. They'll request your engagement to get those configurations implemented. +Apart from onboarding service delivery, our expertise on the Microsoft 365 Defender product suite enables Defender Experts for XDR to run an initial readiness engagement to help you get the most out of your Microsoft security products. This engagement will be based on your [Microsoft Secure Score](microsoft-secure-score.md) and Defender ExpertsΓÇÖ policy recommendations. Our experts will help prioritizing and customizing our recommendations to fit your environment. They'll request your engagement to get those configurations implemented. ## Managed detection and response -Through a combination of automation and human expertise, our service triages Microsoft 365 Defender incidents, prioritize them on your behalf, filters out the noise, carries out detailed investigations, and provides detailed guided response to your security operations center (SOC) teams. Alternatively, our analysts can take a response step on your behalf. +Through a combination of automation and human expertise, our service triages Microsoft 365 Defender incidents, prioritizes them on your behalf, filters out the noise, carries out detailed investigations, and provides detailed guided response to your security operations center (SOC) teams. Alternatively, our analysts can take a response step on your behalf. You'll receive detailed response playbooks via emails. You'll also be able to filter the Microsoft 365 Defender portal incident view using the _Defender Experts_ tag to see the current state of the incidents Defender Experts are actively investigating, or the incidents that require your action. Our analysts will also add relevant comments in Microsoft 365 Defender portalΓÇÖs **Comments & history** section so you and your SOC analysts can track the investigation progress. |
| security | Air About Office | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-about-office.md | + + Title: How automated investigation and response works in Microsoft Defender for Office 365 +f1.keywords: +- NOCSH ++++audience: ITPro ++ms.localizationpriority: medium +search.appverid: +- MET150 +- MOE150 ++- m365-security +- m365initiative-defender-office365 +keywords: automated incident response, investigation, remediation, threat protection Last updated : 01/29/2021+description: See how automated investigation and response capabilities work in Microsoft Defender for Office 365 ++- air +- seo-marvel-mar2020 +++++# How automated investigation and response works in Microsoft Defender for Office 365 +++**Applies to** +- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md) +- [Microsoft 365 Defender](../defender/microsoft-365-defender.md) ++As security alerts are triggered, it's up to your security operations team to look into those alerts and take steps to protect your organization. Sometimes, security operations teams can feel overwhelmed by the volume of alerts that are triggered. Automated investigation and response (AIR) capabilities in Microsoft Defender for Office 365 can help. ++AIR enables your security operations team to operate more efficiently and effectively. AIR capabilities include automated investigation processes in response to well-known threats that exist today. Appropriate remediation actions await approval, enabling your security operations team to respond to detected threats. ++This article describes how AIR works through several examples. When you're ready to get started using AIR, see [Automatically investigate and respond to threats](office-365-air.md). ++- [Example 1: A user-reported phish message launches an investigation playbook](#example-a-user-reported-phish-message-launches-an-investigation-playbook) +- [Example 2: A security administrator triggers an investigation from Threat Explorer](#example-a-security-administrator-triggers-an-investigation-from-threat-explorer) +- [Example 3: A security operations team integrates AIR with their SIEM using the Office 365 Management Activity API](#example-a-security-operations-team-integrates-air-with-their-siem-using-the-office-365-management-activity-api) ++## Example: A user-reported phish message launches an investigation playbook ++Suppose that a user in your organization receives an email that they think is a phishing attempt. The user, trained to report such messages, uses the [Report Message add-in](enable-the-report-message-add-in.md) or the [Report Phishing add-in](enable-the-report-phish-add-in.md) to send it to Microsoft for analysis. The submission is also sent to your system and is visible in Explorer in the **Submissions** view (formerly referred to as the **User-reported** view). In addition, the user-reported message now triggers a system-based informational alert, which automatically launches the investigation playbook. ++During the root investigation phase, various aspects of the email are assessed. These aspects include: ++- A determination about what type of threat it might be; +- Who sent it; +- Where the email was sent from (sending infrastructure); +- Whether other instances of the email were delivered or blocked; +- An assessment from our analysts; +- Whether the email is associated with any known campaigns; +- and more. ++After the root investigation is complete, the playbook provides a list of recommended actions to take on the original email and entities associated with it. ++Next, several threat investigation and hunting steps are executed: ++- Similar email messages are identified via email cluster searches. +- The signal is shared with other platforms, such as [Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection). +- A determination is made on whether any users have clicked through any malicious links in suspicious email messages. +- A check is done across Exchange Online Protection ([EOP](exchange-online-protection-overview.md) and ([Microsoft Defender for Office 365](defender-for-office-365.md) to see if there are any other similar messages reported by users. +- A check is done to see if a user has been compromised. This check leverages signals across Office 365, [Microsoft Defender for Cloud Apps](/cloud-app-security), and [Azure Active Directory](/azure/active-directory), correlating any related user activity anomalies. ++During the hunting phase, risks and threats are assigned to various hunting steps. ++Remediation is the final phase of the playbook. During this phase, remediation steps are taken, based on the investigation and hunting phases. ++## Example: A security administrator triggers an investigation from Threat Explorer ++In addition to automated investigations that are triggered by an alert, your organization's security operations team can trigger an automated investigation from a view in [Threat Explorer](threat-explorer.md). This investigation also creates an alert, so Microsoft 365 Defender incidents and external SIEM tools can see that this investigation was triggered. ++For example, suppose that you are using the **Malware** view in Explorer. Using the tabs below the chart, you select the **Email** tab. If you select one or more items in the list, the **+ Actions** button activates. +++Using the **Actions** menu, you can select **Trigger investigation**. +++Similar to playbooks triggered by an alert, automatic investigations that are triggered from a view in Explorer include a root investigation, steps to identify and correlate threats, and recommended actions to mitigate those threats. ++## Example: A security operations team integrates AIR with their SIEM using the Office 365 Management Activity API ++AIR capabilities in Microsoft Defender for Office 365 include [reports & details](air-view-investigation-results.md) that security operations teams can use to monitor and address threats. But you can also integrate AIR capabilities with other solutions. Examples include a security information and event management (SIEM) system, a case management system, or a custom reporting solution. These kinds of integrations can be done by using the [Office 365 Management Activity API](/office/office-365-management-api/office-365-management-activity-api-reference). ++For example, recently, an organization set up a way for their security operations team to view user-reported phish alerts that were already processed by AIR. Their solution integrates relevant alerts with the organization's SIEM server and their case-management system. The solution greatly reduces the number of false positives so that their security operations team can focus their time and effort on real threats. To learn more about this custom solution, see [Tech Community blog: Improve the Effectiveness of your SOC with Microsoft Defender for Office 365 and the O365 Management API](https://techcommunity.microsoft.com/t5/microsoft-security-and/improve-the-effectiveness-of-your-soc-with-office-365-atp-and/ba-p/1525185). ++## Next steps ++- [Get started using AIR](office-365-air.md) +- [View pending or completed remediation actions](air-review-approve-pending-completed-actions.md) |
| security | Air About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-about.md | + + Title: Automated investigation and response in Microsoft Defender for Office 365 +keywords: AIR, autoIR, Microsoft Defender for Endpoint, automated, investigation, response, remediation, threats, advanced, threat, protection +f1.keywords: +- NOCSH ++++audience: ITPro + Last updated : 11/22/2022+ms.localizationpriority: medium +search.appverid: +- MET150 +- MOE150 ++- m365-security +- m365initiative-defender-office365 +description: Get started using automated investigation and response capabilities in Microsoft Defender for Office 365. ++- air +- seo-marvel-mar2020 +++++# Automated investigation and response (AIR) in Microsoft Defender for Office 365 +++**Applies to** +- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) +- [Microsoft 365 Defender](../defender/microsoft-365-defender.md) ++[Microsoft Defender for Office 365](defender-for-office-365.md) includes powerful automated investigation and response (AIR) capabilities that can save your security operations team time and effort. As alerts are triggered, it's up to your security operations team to review, prioritize, and respond to those alerts. Keeping up with the volume of incoming alerts can be overwhelming. Automating some of those tasks can help. ++AIR enables your security operations team to operate more efficiently and effectively. AIR capabilities include automated investigation processes in response to well-known threats that exist today. Appropriate remediation actions await approval, enabling your security operations team to respond effectively to detected threats. With AIR, your security operations team can focus on higher-priority tasks without losing sight of important alerts that are triggered. ++This article describes: ++- The [overall flow of AIR](#the-overall-flow-of-air); +- [How to get AIR](#how-to-get-air); and +- The [required permissions](#required-permissions-to-use-air-capabilities) to configure or use AIR capabilities. ++This article also includes [next steps](#next-steps), and resources to learn more. ++## The overall flow of AIR ++An alert is triggered, and a security playbook starts an automated investigation, which results in findings and recommended actions. Here's the overall flow of AIR, step by step: ++1. An automated investigation is initiated in one of the following ways: + - Either [an alert is triggered](#which-alert-policies-trigger-automated-investigations) by something suspicious in email (such as a message, attachment, URL, or compromised user account). An incident is created, and an automated investigation begins; or + - A security analyst [starts an automated investigation](automated-investigation-response-office.md#example-a-security-administrator-triggers-an-investigation-from-threat-explorer) while using [Explorer](threat-explorer.md). +2. While an automated investigation runs, it gathers data about the email in question and entities related to that email. Such entities can include files, URLs, and recipients. The investigation's scope can increase as new and related alerts are triggered. ++3. During and after an automated investigation, [details and results](air-view-investigation-results.md) are available to view. Results might include [recommended actions](air-remediation-actions.md) that can be taken to respond to and remediate any existing threats that were found. ++4. Your security operations team reviews the [investigation results and recommendations](air-view-investigation-results.md), and [approves or rejects remediation actions](air-review-approve-pending-completed-actions.md). ++5. As pending remediation actions are approved (or rejected), the automated investigation completes. ++Note: If the investigation does not result in recommended actions the automated investigation will close and the details of what was reviewed as part of the automated investigation will still be available on the investigation page. ++In Microsoft Defender for Office 365, no remediation actions are taken automatically. Remediation actions are taken only upon approval by your organization's security team. AIR capabilities save your security operations team time by identifying remediation actions and providing the details needed to make an informed decision. ++During and after each automated investigation, your security operations team can: ++- [View details about an alert related to an investigation](air-view-investigation-results.md#view-details-about-an-alert-related-to-an-investigation) +- [View the results details of an investigation](air-view-investigation-results.md#view-details-of-an-investigation) +- [Review and approve actions as a result of an investigation](air-review-approve-pending-completed-actions.md) ++> [!TIP] +> For a more detailed overview, see [How AIR works](automated-investigation-response-office.md). ++## How to get AIR ++AIR capabilities are included in [Microsoft Defender for Office 365](defender-for-office-365.md#whats-the-difference-between-microsoft-defender-for-office-365-plan-1-and-plan-2), provided your policies and alerts are configured. Need some help? Follow the guidance in [Protect against threats](protect-against-threats.md) to set up or configure the following protection settings: ++- [Audit logging](../../compliance/turn-audit-log-search-on-or-off.md) (should be turned on) +- [Anti-malware protection](protect-against-threats.md#part-1anti-malware-protection-in-eop) +- [Anti-phishing protection](../office-365-security/protect-against-threats.md#part-2anti-phishing-protection-in-eop-and-defender-for-office-365) +- [Anti-spam protection](protect-against-threats.md#part-3anti-spam-protection-in-eop) +- [Safe Links and Safe Attachments](protect-against-threats.md#part-4protection-from-malicious-urls-and-files-safe-links-and-safe-attachments-in-defender-for-office-365) ++In addition, make sure to [review your organization's alert policies](../../compliance/alert-policies.md), especially the [default policies in the Threat management category](../../compliance/alert-policies.md#default-alert-policies). ++## Which alert policies trigger automated investigations? ++Microsoft 365 provides many built-in alert policies that help identify Exchange admin permissions abuse, malware activity, potential external and internal threats, and information governance risks. Several of the [default alert policies](../../compliance/alert-policies.md#default-alert-policies) can trigger automated investigations. The following table describes the alerts that trigger automated investigations, their severity in the Microsoft 365 Defender portal, and how they're generated: ++|Alert|Severity|How the alert is generated| +|||| +|A potentially malicious URL click was detected|**High**|This alert is generated when any of the following occurs: <ul><li>A user protected by [Safe Links](safe-links.md) in your organization clicks a malicious link</li><li>Verdict changes for URLs are identified by Microsoft Defender for Office 365</li><li>Users override Safe Links warning pages (based on your organization's [Safe Links policy](set-up-safe-links-policies.md).</li></ul> <p> For more information on events that trigger this alert, see [Set up Safe Links policies](set-up-safe-links-policies.md).| +|An email message is reported by a user as malware or phish|**Informational**|This alert is generated when users in your organization report messages as phishing email using the [Report Message add-in](enable-the-report-message-add-in.md) or the [Report Phishing add-in](enable-the-report-phish-add-in.md).| +|Email messages containing malicious file removed after delivery|**Informational**|This alert is generated when any messages containing a malicious file are delivered to mailboxes in your organization. If this event occurs, Microsoft removes the infected messages from Exchange Online mailboxes using [zero-hour auto purge (ZAP)](zero-hour-auto-purge.md).| +|Email messages containing malware are removed after delivery|**Informational**|This alert is generated when any email messages containing malware are delivered to mailboxes in your organization. If this event occurs, Microsoft removes the infected messages from Exchange Online mailboxes using [zero-hour auto purge (ZAP)](zero-hour-auto-purge.md).| +|Email messages containing malicious URL removed after delivery|**Informational**|This alert is generated when any messages containing a malicious URL are delivered to mailboxes in your organization. If this event occurs, Microsoft removes the infected messages from Exchange Online mailboxes using [zero-hour auto purge (ZAP)](zero-hour-auto-purge.md).| +|Email messages containing phish URLs are removed after delivery|**Informational**|This alert is generated when any messages containing phish are delivered to mailboxes in your organization. If this event occurs, Microsoft removes the infected messages from Exchange Online mailboxes using [ZAP](zero-hour-auto-purge.md).| +|Suspicious email sending patterns are detected|**Medium**|This alert is generated when someone in your organization has sent suspicious email and is at risk of being restricted from sending email. The alert is an early warning for behavior that might indicate that the account is compromised, but not severe enough to restrict the user. <p> Although it's rare, an alert generated by this policy may be an anomaly. However, it's a good idea to [check whether the user account is compromised](responding-to-a-compromised-email-account.md).| +|A user is restricted from sending email|**High**|This alert is generated when someone in your organization is restricted from sending outbound mail. This alert typically results when an [email account is compromised](responding-to-a-compromised-email-account.md). <p> For more information about restricted users, see [Remove blocked users from the Restricted Users portal in Microsoft 365](removing-user-from-restricted-users-portal-after-spam.md).| +|Admin triggered manual investigation of email|**Informational**|This alert is generated when an admin triggers the manual investigation of an email from Threat Explorer. This alert notifies your organization that the investigation was started.| +|Admin triggered user compromise investigation|**Medium**|This alert is generated when an admin triggers the manual user compromise investigation of either an email sender or recipient from Threat Explorer. This alert notifies your organization that the user compromise investigation was started.| ++> [!TIP] +> To learn more about alert policies or edit the default settings, see [Alert policies in the Microsoft Purview compliance portal](../../compliance/alert-policies.md). ++## Required permissions to use AIR capabilities ++Permissions are granted through certain roles, such as those that are described in the following table: ++|Task|Role(s) required| +||| +|Set up AIR features|One of the following roles: <ul><li>Global Administrator</li><li>Security Administrator</li></ul> <p> These roles can be assigned in [Azure Active Directory](/azure/active-directory/roles/permissions-reference) or in the [Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md).| +|Start an automated investigation <p> or <p> Approve or reject recommended actions|One of the following roles, assigned in [Azure Active Directory](/azure/active-directory/roles/permissions-reference) or in the [Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md): <ul><li>Global Administrator</li><li>Security Administrator</li><li>Security Operator</li><li>Security Reader <br> and </li><li>Search and Purge (this role is assigned only in the [Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md). You might need to create a new **Email & collaboration** role group there and add the Search and Purge role to that new role group.</li></ul>| ++## Required licenses ++[Microsoft Defender for Office 365 Plan 2](defender-for-office-365.md#whats-the-difference-between-microsoft-defender-for-office-365-plan-1-and-plan-2) licenses should be assigned to: ++- Security administrators (including global administrators) +- Your organization's security operations team (including security readers and those with the **Search and Purge** role) +- End users ++## Next steps ++- [Get started using AIR](office-365-air.md) +- [See details and results of an automated investigation](air-view-investigation-results.md#view-details-of-an-investigation) +- [Review and approve pending actions](air-remediation-actions.md) +- [View pending or completed remediation actions](air-review-approve-pending-completed-actions.md) |
| security | Attack Simulation Training Payload Automations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-payload-automations.md | To create a payload automation, do the following steps: > [!NOTE] > At any point during the creation wizard, you can click **Save and close** to save your progress and continue configuring the payload automation later. You can pick up where you left off by selecting the payload automation in **Payload automations**, and then clicking  **Edit automation**. The partially-completed payload automation will have the **Status** value **Draft**.+ > + > Currently, payload harvesting is enabled in GCC environments due to data gathering restrictions. 2. On the **Automation name** page, configure the following settings: |
| security | Attack Simulation Training Simulation Automations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-simulation-automations.md | On the **Select social engineering techniques** page, select one or more of the - **Credential harvest**: Attempts to collect credentials by taking users to a well-known looking website with input boxes to submit a username and password. - **Malware attachment**: Adds a malicious attachment to a message. When the user opens the attachment, arbitrary code is run that will help the attacker compromise the target's device. - **Link in attachment**: A type of credential harvest hybrid. An attacker inserts a URL into an email attachment. The URL within the attachment follows the same technique as credential harvest.-- **Link to malware**: Runs some arbitrary code from a file hosted on a well-known file sharing service. The message sent to the user will contain a link to this malicious file. Opening the file and help the attacker compromise the target's device.+- **Link to malware**: Runs some arbitrary code from a file hosted on a well-known file sharing service. The message sent to the user will contain a link to this malicious file, opening the file and helping the attacker compromise the target's device. - **Drive-by URL**: The malicious URL in the message takes the user to a familiar-looking website that silently runs and/or installs code on the user's device. - **OAuth Consent Grant**: The malicious URL asks users to grant permissions to data for a malicious Azure Application. On the **Target users** page, select who will receive the simulation. Configure -  **Import**: In the dialog that opens, specify a CSV file that contains one email address per line. - After you find an select the CSV file, the list of users are imported and shown on the **Targeted users** page. You can use the  **Search** box to find affected users. You can also click  **Delete** to remove specific users. + After you find and select the CSV file, the list of users are imported and shown on the **Targeted users** page. You can use the  **Search** box to find affected users. You can also click  **Delete** to remove specific users. When you're finished, click **Next**. When you're finished, click **Next**. ### Landing page -On the **Landing page** page, you configure the web page that user are taken to if they open the payload in the simulation. +On the **Landing page** page, you configure the web page that users are taken to if they open the payload in the simulation. - **Select landing page preference**: The available values depend on your previous payload selections on the [Select a payload and login page](#select-a-payload-and-login-page) page as described in the following table: On the **Review simulation automation** page, you can review the details of your You can select **Edit** in each section to modify the settings within the section. Or you can click **Back** or select the specific page in the wizard. When you're finished, click **Submit**.++## Frequently asked questions (FAQ) ++This section contains some of the most common questions about Simulation automations. ++### Why is the Status value under Automation showing Completed, but the Status value under Simulation showing In progress? ++**Completed** on the **Simulation automation** page means the job of simulation automation is complete, and no more simulations will be created by it. Simulation is a separate entity that will complete after 30 days of simulation launch time. ++### Why is the simulation end date 30 days after creation, even though I selected an automation end date of one week? ++A one week end date for the simulation automation means no new simulations will be created by it after one week. For simulations created by a simulation automation, the default end date is 30 days after the creation of the simulation. ++### If we have multiple payload techniques (for example, Credential harvest, Link to Malware, and Drive by URL) targeting 300 users, how are the techniques sent to users? Do all payload techniques go to all users, or is the selection random? ++If you don't select the **Target All Selected Users In Every Run** option, all targeted users will be distributed over the maximum number of simulations that are created by the simulation automation. + +If you select **Target All Selected Users In Every Run**, all targeted users will be part of every simulation that's created by the simulation automation. ++### How does the Randomize option on the Simulation schedule page work? ++The **Randomize launch&& option optimally selects a day within the start date and end date range to launch simulations. ++### How does the Randomize option on the Select payloads page work? ++For every run, a technique from the list of selected techniques is chosen, and then a random payload from both Tenant and Global payloads will be chosen. This behavior helps to ensure that the selected payload wasn't part of any previous run for this particular automation. ++### With a randomized schedule, the maximum number of simulations is between 1 and 10. How does this work? ++This number is the maximum number of runs that can be created by this automation. For example, if you select 10, the maximum number of simulations that will be created by this automation is 10. The number of simulations can be fewer depending on the number of targeted users and the availability of payloads. ++### If I select only one specific day between two days (for example, Wednesday), how many simulations will I see on the Simulation tab? ++If there's only one Wednesday between the start date and end date, the automation will have only one valid day to send out the simulation. Even if you selected a higher value for **Max number of simulations**, this value will get overwritten to one. ++### How does randomize send times currently work? ++Randomize send time works in batches of 1000 users and is meant to be used with a large number of targeted users. If less than 1000 users are involved in simulations created by automations, a randomize send time will not trigger. |
| security | Quarantine Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-policies.md | The global settings for quarantine policies allow you to customize the quarantin > [!NOTE] > We don't allow the same display name, subject, or disclaimer text for different languages. You need to provide a different display name, subject, and disclaimer text for each language that you select.+ > + > The same sender address is used for all languages. Although you can select a different sender email address for each language, the last sender you specify is used for all languages. - Customize quarantine notifications based on the recipient's language: The global settings for quarantine policies allow you to customize the quarantin :::image type="content" source="../../media/quarantine-tags-esn-customization-display-name.png" alt-text="A customized sender display name in a quarantine notification." lightbox="../../media/quarantine-tags-esn-customization-display-name.png"::: + - The **Subject** field of the quarantine notification messages. + - The **Disclaimer** text that's added to the bottom of quarantine notifications. The localized text, **A disclaimer from your organization:** is always included first, followed by the text you specify as show in the following screenshot: :::image type="content" source="../../media/quarantine-tags-esn-customization-disclaimer.png" alt-text="A custom disclaimer at the bottom of a quarantine notification." lightbox="../../media/quarantine-tags-esn-customization-disclaimer.png"::: - - The language identifier for the **Display name** and **Disclaimer** values. Quarantine notifications are already localized based on the recipient's language settings. The **Display name** and **Disclaimer** values are used in quarantine notifications that apply to the recipient's language. + - The language identifier for the **Display name**, **Subject**, and **Disclaimer** values. Quarantine notifications are already localized based on the recipient's language settings. The **Display name**, **Subject**, and **Disclaimer** values are used in quarantine notifications that apply to the recipient's language. - Select the language in the **Choose language** box _before_ you enter values in the **Display name** and **Disclaimer** boxes. When you change the value in the **Choose language** box, the values in the **Display name** and **Disclaimer** boxes are emptied. + Select the language in the **Choose language** box _before_ you enter values in the **Display name**, **Subject** and **Disclaimer** boxes. When you change the value in the **Choose language** box, the values in the **Display name**, **Subject**, and **Disclaimer** boxes are emptied. Follow these steps to customize quarantine notifications based on the recipient's language: 1. Select the language from the **Choose language** box. The default value is **Default**, which means the default language for the Microsoft 365 organization. For more information, see [How to set language and region settings for Microsoft 365](/office365/troubleshoot/access-management/set-language-and-region).- 2. Enter values for **Display name** and **Disclaimer**. The values must be unique for each language. If you try to reuse a **Display name** or **Disclaimer** value for multiple languages, you'll get an error when you click **Save**. - 3. Click the **Add** button. - 4. Repeat the previous steps to create a maximum of three customized quarantine notifications based on the recipient's language. An unlabeled box shows the languages that you've configured: + 2. Enter values for **Display name**, **Subject**, and **Disclaimer**. The values must be unique for each language. If you try to reuse a **Display name**, **Subject**, or **Disclaimer** value for multiple languages, you'll get an error when you click **Save**. + 3. Use **Specify sender address** to select an existing recipient to use as the sender of quarantine notifications. If you've already specified a sender for a different language, the sender you specify will overwrite your previous selection (the same sender email address is used for all languages). + 4. Click the **Add** button. + 5. Repeat the previous steps to create a maximum of three customized quarantine notifications based on the recipient's language. An unlabeled box shows the languages that you've configured: :::image type="content" source="../../media/quarantine-tags-esn-customization-selected-languages.png" alt-text="The selected languages in the global quarantine notification settings of quarantine policies." lightbox="../../media/quarantine-tags-esn-customization-selected-languages.png"::: - - **Use my company logo**: Select this option to replace the default Microsoft logo that's used at the top of quarantine notifications. Before you do this step, you need to follow the instructions in [Customize the Microsoft 365 theme for your organization](../../admin/setup/customize-your-organization-theme.md) to upload your custom logo. This option is not supported if your organization has custom logo pointing to a URL instead of an uploaded custom logo file. + - **Use my company logo**: Select this option to replace the default Microsoft logo that's used at the top of quarantine notifications. Before you do this step, you need to follow the instructions in [Customize the Microsoft 365 theme for your organization](../../admin/setup/customize-your-organization-theme.md) to upload your custom logo. This option is not supported if your organization has a custom logo pointing to a URL instead of an uploaded image file. The following screenshot shows a custom logo in a quarantine notification: |
| security | Recommended Settings For Eop And Office365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365.md | In PowerShell, you use the [New-SafeLinksPolicy](/powershell/module/exchange/new |**Action for potentially malicious URLs in Microsoft Office apps**|||||| |**On: Safe Links checks a list of known, malicious links when users click links in Microsoft Office apps** <br><br> _EnableSafeLinksForOffice_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Use Safe Links in supported Office 365 desktop and mobile (iOS and Android) apps. For more information, see [Safe Links settings for Office apps](safe-links.md#safe-links-settings-for-office-apps).| |**Click protection settings**||||||-|**Track user clicks** <br><br> _TrackUserClicks_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| +|**Track user clicks** <br><br> _TrackClicks_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| |**Let users click through to the original URL** <br><br> _AllowClickThrough_|Selected <br><br> `$true`|Selected <br><br> `$true`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|Turning off this setting (setting _AllowClickThrough_ to `$false`) prevents click through to the original URL.| |**Display the organization branding on notification and warning pages** <br><br> _EnableOrganizationBranding_|Not selected <br><br> `$false`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|We have no specific recommendation for this setting. <br><br> Before you turn on this setting, you need to follow the instructions in [Customize the Microsoft 365 theme for your organization](../../admin/setup/customize-your-organization-theme.md) to upload your company logo.| |**Notification**|||||| |
| security | Threat Hunting In Threat Explorer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/threat-hunting-in-threat-explorer.md | In Microsoft Defender for Office 365, there are two subscription plansΓÇöPlan 1 Defender for Office 365 Plan 1 uses *Real-time detections*, which is a subset of the *Threat Explorer* (also called *Explorer*) hunting tool in Plan 2. In this series of articles, most of the examples were created using the full Threat Explorer. Admins should test any steps in Real-time detections to see where they apply. -After you go to **Explorer**, by default, you'll arrive on the **Malware** page, but use the **View** drop down to get familiar with your options. If you're hunting Phish, or digging into a threat campaign, choose those views. +After you go to **Explorer**, by default, you'll arrive on the **All email** page, but use the tabs to navigate to the available views. If you're hunting phish or digging into a threat campaign, choose those views. --Once a security operations (Sec Ops) person selects the data they want to see, whether the scope is narrow view like user **Submissions**, or a wider view, like **All email**, they can use the **Sender** button to further filter. Remember to select Refresh to complete your filtering actions. +Once a security operations (Sec Ops) person selects the data they want to see, they can further narrow down the data by applying filters such as Sender, Recipient, and Subject, or select an appropriate date range to get the desired results. Remember to select Refresh to complete your filtering actions. :::image type="content" source="../../media/sender-drop-down.png" alt-text="The Sender button in Threat Explorer" lightbox="../../media/sender-drop-down.png"::: Refining focus in Explorer or Real-time detection can be thought of in layers. T > [!TIP] > If Sec Ops uses **Tags** to mark accounts they consider high valued targets, they can make selections like *Phish View with a Tags filter focus (include a date range if used)*. This will show them any phishing attempts directed at their high value user targets during a time-range (like dates when certain phishing attacks are happening a lot for their industry). -Refinements can be made on date ranges by using the date range controls. Here you can see Explorer in **Malware** view, with a **Detection Technology** filter focus. But it's the **Advanced filter** button that lets Sec Ops teams dig deep. ---Clicking the **Advanced filter** pops a panel that will let Sec Ops hunters build queries themselves, letting them include or exclude the information they need to see. Both the chart and table on the Explorer page will reflect their results. +With the new version of Threat Explorer, users can use the following new dropdown options with four new operators on the filters: + - Equals any of ΓÇô returns values matching the exact user input. + - Equals none of ΓÇô returns values not matching the exact user input. + - Contains any of ΓÇô returns values partially matching user input. + - Contains none of ΓÇô returns values not partially matching user input. +Note that these filter conditions are available based on filter types and input types. Use the **Column options** button to get the kind of information on the table that would be most helpful: |
| whiteboard | Manage Sharing Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-sharing-organizations.md | Title: Manage sharing for Microsoft Whiteboard-+ This setting applies only to whiteboards and replaces the previously shared sett > [!NOTE] > If you would like shared device accounts to have access to Whiteboard in Teams meetings but not anonymous users, you can disable **Anonymous users can interact with apps in meetings** while having **AllowAnonymousMeetingParticipantsToAccessWhiteboards** enabled +> [!NOTE] +> Even when AllowAnonymousMeetingParticipantsToAccessWhiteboards enabled, Teams Channel meetings have a limitation that anonymous users **cannot** see the whiteboard share. + These changes should take approximately 60 minutes to apply across your tenancy. |Scenario|Storage and ownership|Sharing settings|Sharing experience| |