| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | About Admin Roles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/about-admin-roles.md | +- business_assist search.appverid: - BCS160 - MET150 Microsoft 365 or Office 365 subscription comes with a set of admin roles that yo The <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a> lets you manage Azure AD roles and Microsoft Intune roles. However, these roles are a subset of the roles available in the Azure AD portal and the Intune admin center. +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Watch: What is an admin? > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE1SRc0] |
| admin | Add Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/add-users.md | +- business_assist search.appverid: - MET150 description: "Each team member needs a user account before they can sign in and access Microsoft 365 for business. Learn how to add users and assign licenses." Last updated 07/01/2020 The people on your team each need a user account before they can sign in and access [Microsoft 365 for business](https://www.microsoft.com/microsoft-365/business). The easiest way to add user accounts is to add them one at a time in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>. After you do this step, your users have Microsoft 365 licenses, sign in credentials, and Microsoft 365 mailboxes. +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Before you begin You must be a global, license, or a user admin to add users and assign licenses. For more information, see [About admin roles](../../admin/add-users/about-admin-roles.md). |
| admin | Change A User Name And Email Address | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/change-a-user-name-and-email-address.md | +- business_assist search.appverid: - BCS160 - MET150 description: "Learn how a Microsoft 365 global admin can change a user's email a You may need to change someone's email address and display name if, for example, they get married and their last name changes. +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Watch: Change a user's name or email address > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE1SJuc] |
| admin | Give Mailbox Permissions To Another User | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/give-mailbox-permissions-to-another-user.md | +- business_assist search.appverid: - BCS160 - MET150 description: "Give a user the right to access another user's mailbox, which allo As the admin, you may have company requirements to allow some users access to another user's mailbox. For example, you may want to enable an assistant to send or read email from their manager's mailbox, or one of your user's the ability to send email on behalf of another user. This topic shows you how to accomplish this. If you're looking for information about creating and managing shared mailboxes, check out [Create a shared mailbox](../email/create-a-shared-mailbox.md).++> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. ## Looking to set up mailbox permissions? |
| admin | Let Users Reset Passwords | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/let-users-reset-passwords.md | +- business_assist search.appverid: - BCS160 - MET150 description: "Learn how you can set a policy to allow users to reset their own p # Let users reset their own passwords As the Microsoft 365 admin, you can let people use the [self-service password reset tool](https://go.microsoft.com/fwlink/p/?LinkId=522677) so you don't have to reset passwords for them. Less work for you!++> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. ## Watch: Let users reset their own passwords |
| admin | Remove Former Employee Step 3 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/remove-former-employee-step-3.md | Title: "Step 3 - Forward a former employee's email to another employee or convert to a shared mailbox" + Title: "Step 3 - Wipe and block a former employee's mobile device" f1.keywords: - NOCSH +- admindeeplinkEXCHANGE search.appverid: - BCS160 - MET150 - MOE150-description: "Follow these steps to forward a former employee's email to another employee or convert to a shared mailbox." +description: "Follow these steps to block a former employee's mobile device access." -# Step 3 - Forward a former employee's email to another employee or convert to a shared mailbox +# Step 3 - Wipe and block a former employee's mobile device -In this step, you assign the former employee's email address to another employee, or convert the user's mailbox to a shared mailbox. +If your former employee had an organization phone, you can use the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a> to wipe and block that device so that all organization data is removed from the device and it can no longer connect to Office 365. If your organization uses Basic Mobility and Security to manage mobile devices, you can wipe and block those devices using Basic Mobility and Security. -## Convert former employee's mailbox to a shared mailbox +## Wipe mobile device using the Exchange admin center -When you convert a user's mailbox to a shared mailbox, all of the existing email and calendar is retained. Only now it's in a shared mailbox where several people will be able to access it instead of one person. You can convert a shared mailbox back to a user (private) mailbox at a later date if you want. --- Creating a shared mailbox is the less expensive way to go because you won't have to pay for a license **as long as the mailbox is smaller than 50GB**. Over 50GB and you'll need to assign a license to it.-- If you convert the mailbox to a shared mailbox, all the old email will be available, too. This can take up a lot of space.-- If you set up email forwarding, only *new* emails sent to the former employee will now be sent to the current employee.--Follow these steps on how to [convert the user's mailbox to a shared mailbox](../email/convert-user-mailbox-to-shared-mailbox.md). --## Forward a former employee's email to another employee -- > [!IMPORTANT] - > If you're setting up email forwarding or a shared mailbox, at the end, don't delete the former employee's account. The account needs to be there to anchor the email forwarding or shared mailbox. --1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a> page. -2. Select the name of the employee that you want to block, and then select the **Mail** tab. -3. Under **Email Forwarding**, select **Manage email forwarding**. -4. Turn on **Forward all email sent to this mailbox**. In the **Forwarding address** box, type the email address of the current employee who's going to get the email. -5. Select **Save**. -6. Remember, don't delete the former employee's account. +1. Go to the Exchange admin center > **Recipients** \> <a href="https://go.microsoft.com/fwlink/?linkid=2183135" target="_blank">Mailboxes</a>. +1. Select the user, and under **Mobile Devices**, select **View details**. +1. On the **Mobile Device Details** page, under **Mobile devices**, select the mobile device, select **Wipe Data**, and then select **Block**. +1. Select **Save**. + > [!TIP] + > Be sure you remove or disable the user from your on-premises Blackberry Enterprise Service. You should also disable any Blackberry devices for the user. Refer to the Blackberry Business Cloud Services Administration Guide if you need specific steps on how to disable the user. ## Related content -[Open and use a shared mailbox in Outlook](https://support.microsoft.com/office/open-and-use-a-shared-mailbox-in-outlook-d94a8e9e-21f1-4240-808b-de9c9c088afd) --[Access another person's mailbox](https://support.microsoft.com/office/access-another-person-s-mailbox-a909ad30-e413-40b5-a487-0ea70b763081) - [Exchange admin center in Exchange Online](/exchange/exchange-admin-center)--[Manager another person's mail and calendar items](https://support.microsoft.com/office/manage-another-person-s-mail-and-calendar-items-afb79d6b-2967-43b9-a944-a6b953190af5) |
| admin | Remove Former Employee Step 4 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/remove-former-employee-step-4.md | Title: "Step 4 - Give another employee access to OneDrive and Outlook data" + Title: "Step 4 - Forward a former employee's email to another employee or convert to a shared mailbox" f1.keywords: - NOCSH -description: "Follow the steps in this article to give another employee access to the former employee's OneDrive and Outlook data." +description: "Follow these steps to forward a former employee's email to another employee or convert to a shared mailbox." -# Step 4 - Give another employee access to OneDrive and Outlook data +# Step 4 - Forward a former employee's email to another employee or convert to a shared mailbox -When an employee leaves your organization, you'll want to access their OneDrive and Outlook data, back it up, and choose whether to give it to another employee. - -## Access a former user's OneDrive documents +In this step, you assign the former employee's email address to another employee, or convert the user's mailbox to a shared mailbox. -If you remove a user's license but don't delete the account, you can give yourself access to the content in the user's OneDrive. If you delete the user's account, you have 30 days by default to access the former user's OneDrive data. [Learn how to set the OneDrive retention for deleted users](/onedrive/set-retention). If you don't [restore a user account](/office365/admin/add-users/restore-user) within this time, their OneDrive content is deleted. +## Convert former employee's mailbox to a shared mailbox -To preserve a former user's OneDrive files, first give yourself access to their OneDrive, and then move the files you want to keep. +When you convert a user's mailbox to a shared mailbox, all of the existing email and calendar are retained. Only now it's in a shared mailbox where several people will be able to access it instead of one person. You can convert a shared mailbox back to a user (private) mailbox at a later date if you want. -1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a> page. +- Creating a shared mailbox is the less expensive way to go because you won't have to pay for a license **as long as the mailbox is smaller than 50 GB**. If it is over 50 GB, you'll need to assign a license to it. +- If you convert the mailbox to a shared mailbox, all the old email will be available, too. This can take up a lot of space. +- If you set up email forwarding, only *new* emails sent to the former employee will be sent to the current employee. -2. Select a user. +Follow these steps to [convert the user's mailbox to a shared mailbox](../email/convert-user-mailbox-to-shared-mailbox.md). -3. On the user properties page, select **OneDrive**. Under **Get access to files**, select **Create link to files**. +## Forward a former employee's email to another employee -4. Select the link to open the file location. Download the files to your computer, or select **Move to** or **Copy to** to move or copy them to your own OneDrive or to a shared library. + > [!IMPORTANT] + > If you're setting up email forwarding or a shared mailbox, in the end, don't delete the former employee's account. The account needs to be there to anchor the email forwarding or shared mailbox. -> [!NOTE] -> You can move or copy up to 500 MB of files and folders at a time.<br/> -> When you move or copy documents that have version history, only the latest version is moved. --You can also grant access to another user to access a former employee's OneDrive. --1. Sign in to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">admin center</a> as a global admin or SharePoint admin. -- If you get a message that you don't have permission to access the admin center, then you don't have administrator permissions in your organization. --2. In the left pane, select **Admin centers** \> **SharePoint**. (You might need to select **Show all** to see the list of admin centers.) --3. If the classic SharePoint admin center appears, select **Open it now** at the top of the page to open the SharePoint admin center. --4. In the left pane, select **More features**. --5. Under **User profiles**, select **Open**. --6. Under **People**, select **Manage User Profiles**. --7. Enter the former employee's name and select **Find**. --8. Right-click the user, and then choose **Manage site collection owners**. --9. Add the user to **Site collection administrators** and select **Ok**. --10. The user will now be able to access the former employee's OneDrive using the OneDrive URL. --### Revoke admin access to a user's OneDrive --You can give yourself access to the content in a user's OneDrive, but you may want to remove your access when you no longer need it. --1. Sign in to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">admin center</a> as a global admin or SharePoint admin. -- If you get a message that you don't have permission to access the admin center, then you don't have administrator permissions in your organization. --2. In the left pane, select **Admin centers** \> **SharePoint**. (You might need to select **Show all** to see the list of admin centers.) --3. If the classic SharePoint admin center appears, select **Open it now** at the top of the page to open the SharePoint admin center. --4. In the left pane, select **More features**. --5. Under **User profiles**, select **Open**. --6. Under **People**, select **Manage User Profiles**. --7. Enter the user's name and select **Find**. --8. Right-click the user, and then choose **Manage site collection owners**. --9. Remove the person who no longer needs access to the user's data, and then select **OK**. --## Access the Outlook data of a former user --To save the email messages, calendar, tasks, and contacts of the former employee, export the information to an Outlook Data File (.pst). - -1. [Add the former employee's email](https://support.microsoft.com/office/6e27792a-9267-4aa4-8bb6-c84ef146101b) to your Outlook (If you [reset the user's password](reset-passwords.md), you can set it to something only you know.) --2. In Outlook, select **File**. --  - -3. Select **Open & Export** \> **Import/Export**. --  - -4. Select **Export to a file**, and then select **Next**. --  - -5. Select **Outlook Data File (.pst)**, and then select **Next**. --6. Select the account you want to export by selecting the name or email address, such as Mailbox - Anne Weiler or anne@contoso.com. If you want to export everything in your account, including mail, calendar, contacts, tasks, and notes, make sure the **Include subfolders** check box is selected. -- > [!NOTE] - > You can export one account at a time. If you want to export multiple accounts, after one account is exported, repeat these steps. - -  - -7. Select **Next**. --8. Select **Browse** to select where to save the Outlook Data File (.pst). Type a *file name*, and then select **OK** to continue. -- > [!NOTE] - > If you've used export before, the previous folder location and file name appear. Type a *different file name* before selecting **OK**. - -9. If you are exporting to an existing Outlook Data File (.pst), under **Options**, specify what to do when exporting items that already exist in the file. --10. Select **Finish**. --Outlook begins the export immediately unless a new Outlook Data File (.pst) is created or a password-protected file is used. - -- If you're creating an Outlook Data File (.pst), an optional password can help protect the file. When the **Create Outlook Data File** dialog box appears, type the *password* in the **Password** and **Verify Password** boxes, and then select **OK**. In the **Outlook Data File Password** dialog box, type the *password*, and then select **OK**.--- If you're exporting to an existing Outlook Data File (.pst) that is password protected, in the **Outlook Data File Password** dialog box, type the *password*, and then select **OK**.--See how to [Export or backup email, contacts, and calendar to an Outlook .pst file](https://support.microsoft.com/office/14252b52-3075-4e9b-be4e-ff9ef1068f91) in Outlook 2010. -- > [!NOTE] - > By default, your email is available offline for a period of 12 months. If required, see how to [increase the data available offline](/outlook/troubleshoot/mailboxes/only-subset-items-synchronized). --### Give another user access to a former user's email --To give access to the email messages, calendar, tasks, and contacts of the former employee to another employee, import the information to another employee's Outlook inbox. --> [!NOTE] -> You can also [convert the former user's mailbox to a shared mailbox](/office365/admin/email/convert-user-mailbox-to-shared-mailbox) or [forward a former employee's email to another employee](/office365/admin/add-users/remove-former-employee#forward-a-former-employees-email-to-another-employee-or-convert-to-a-shared-mailbox). --1. In Outlook, go to **File** \> **Open & Export** \> **Import/Export**. -- This starts the Import and Export Wizard. --2. Select **Import from another program or file**, and then select **Next**. --  - -3. Select **Outlook Data File (.pst)**, and select **Next**. --4. Browse to the .pst file you want to import. --5. Under **Options**, choose how you want to deal with duplicates --6. Select **Next**. --7. If a password was assigned to the Outlook Data File (.pst), enter the password, and then select **OK**. --8. Set the options for importing items. The default settings usually don't need to be changed. --9. Select **Finish**. --> [!NOTE] -> The steps remain the same for accessing an existing user's OneDrive and email data. --> [!TIP] -> If you want to import or restore only a few items from an Outlook Data File (.pst), you can open the Outlook Data File. Then, in the navigation pane, drag the items from Outlook Data File folders to your existing Outlook folders. +1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a> page. +2. Select the name of the employee that you want to block, and then select the **Mail** tab. +3. Under **Email Forwarding**, select **Manage email forwarding**. +4. Turn on **Forward all email sent to this mailbox**. In the **Forwarding address** box, type the email address of the current employee who's going to get the email. +5. Select **Save**. +6. Remember, don't delete the former employee's account. ### Cancel Outlook meetings If the person had meetings that booked equipment or rooms, they won't be availab ## Related content -[Add and remove admins on a OneDrive account](/sharepoint/manage-user-profiles#add-and-remove-admins-for-a-users-onedrive) (article) +[Open and use a shared mailbox in Outlook](https://support.microsoft.com/office/open-and-use-a-shared-mailbox-in-outlook-d94a8e9e-21f1-4240-808b-de9c9c088afd) -[Restore a deleted OneDrive](/onedrive/restore-deleted-onedrive) (article) +[Access another person's mailbox](https://support.microsoft.com/office/access-another-person-s-mailbox-a909ad30-e413-40b5-a487-0ea70b763081) -[OneDrive retention and deletion](/onedrive/retention-and-deletion) (article) +[Exchange admin center in Exchange Online](/exchange/exchange-admin-center) -[Share OneDrive files and folders](https://support.microsoft.com/office/share-onedrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07) +[Manager another person's mail and calendar items](https://support.microsoft.com/office/manage-another-person-s-mail-and-calendar-items-afb79d6b-2967-43b9-a944-a6b953190af5) |
| admin | Remove Former Employee Step 5 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/remove-former-employee-step-5.md | Title: "Step 5 - Wipe and block a former employee's mobile device" + Title: "Step 5 - Give another employee access to OneDrive and Outlook data" f1.keywords: - NOCSH +- AdminTemplateSet - m365solution-removeemployee-- admindeeplinkEXCHANGE search.appverid: - BCS160 - MET150 - MOE150-description: "Follow these steps to block a former employee's mobile device access." +description: "Follow the steps in this article to give another employee access to the former employee's OneDrive and Outlook data." -# Step 5 - Wipe and block a former employee's mobile device +# Step 5 - Give another employee access to OneDrive and Outlook data -If your former employee had an organization phone, you can use the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a> to wipe and block that device so that all organization data is removed from the device and it can no longer connect to Office 365. If your organization uses Basic Mobility and Security to manage mobile devices, you can wipe and block those devices using Basic Mobility and Security. +When an employee leaves your organization, you'll want to access their OneDrive and Outlook data, back it up, and choose whether to give it to another employee. + +## Access a former user's OneDrive documents -## Wipe mobile device using the Exchange admin center +If you remove a user's license but don't delete the account, you can give yourself access to the content in the user's OneDrive. If you delete the user's account, you have 30 days by default to access the former user's OneDrive data. [Learn how to set the OneDrive retention for deleted users](/onedrive/set-retention). If you don't [restore a user account](/office365/admin/add-users/restore-user) within this time, their OneDrive content is deleted. -1. Go to the Exchange admin center > **Recipients** \> <a href="https://go.microsoft.com/fwlink/?linkid=2183135" target="_blank">Mailboxes</a>. -1. Select the user, and under **Mobile Devices**, select **View details**. -1. On the **Mobile Device Details** page, under **Mobile devices**, select the mobile device, select **Wipe Data**, and then select **Block**. -1. Select **Save**. - > [!TIP] - > Be sure you remove or disable the user from your on-premises Blackberry Enterprise Service. You should also disable any Blackberry devices for the user. Refer to the Blackberry Business Cloud Services Administration Guide if you need specific steps on how to disable the user. +To preserve a former user's OneDrive files, first give yourself access to their OneDrive, and then move the files you want to keep. ++1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a> page. ++2. Select a user. ++3. On the user properties page, select **OneDrive**. Under **Get access to files**, select **Create link to files**. ++4. Select the link to open the file location. Download the files to your computer, or select **Move to** or **Copy to** to move or copy them to your own OneDrive or to a shared library. ++> [!NOTE] +> You can move or copy up to 500 MB of files and folders at a time.<br/> +> When you move or copy documents that have version history, only the latest version is moved. ++You can also grant access to another user to access a former employee's OneDrive. ++1. Sign in to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">admin center</a> as a global admin or SharePoint admin. ++ If you get a message that you don't have permission to access the admin center, then you don't have administrator permissions in your organization. ++2. In the left pane, select **Admin centers** \> **SharePoint**. (You might need to select **Show all** to see the list of admin centers.) ++3. If the classic SharePoint admin center appears, select **Open it now** at the top of the page to open the SharePoint admin center. ++4. In the left pane, select **More features**. ++5. Under **User profiles**, select **Open**. ++6. Under **People**, select **Manage User Profiles**. ++7. Enter the former employee's name and select **Find**. ++8. Right-click the user, and then choose **Manage site collection owners**. ++9. Add the user to **Site collection administrators** and select **OK**. ++10. The user will now be able to access the former employee's OneDrive using the OneDrive URL. ++### Revoke admin access to a user's OneDrive ++You can give yourself access to the content in a user's OneDrive, but you may want to remove your access when you no longer need it. ++1. Sign in to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">admin center</a> as a global admin or SharePoint admin. ++ If you get a message that you don't have permission to access the admin center, then you don't have administrator permissions in your organization. ++2. In the left pane, select **Admin centers** \> **SharePoint**. (You might need to select **Show all** to see the list of admin centers.) ++3. If the classic SharePoint admin center appears, select **Open it now** at the top of the page to open the SharePoint admin center. ++4. In the left pane, select **More features**. ++5. Under **User profiles**, select **Open**. ++6. Under **People**, select **Manage User Profiles**. ++7. Enter the user's name and select **Find**. ++8. Right-click the user, and then choose **Manage site collection owners**. ++9. Remove the person who no longer needs access to the user's data, and then select **OK**. ++## Access the Outlook data of a former user ++To save the email messages, calendar, tasks, and contacts of the former employee, export the information to an Outlook Data File (.pst). + +1. [Add the former employee's email](https://support.microsoft.com/office/6e27792a-9267-4aa4-8bb6-c84ef146101b) to your Outlook. (If you [reset the user's password](reset-passwords.md), you can set it to something only you know.) ++2. In Outlook, select **File**. ++  + +3. Select **Open & Export** \> **Import/Export**. ++  + +4. Select **Export to a file**, and then select **Next**. ++  + +5. Select **Outlook Data File (.pst)**, and then select **Next**. ++6. Select the account you want to export by selecting the name or email address, such as Mailbox - Anne Weiler or anne@contoso.com. If you want to export everything in your account, including mail, calendar, contacts, tasks, and notes, make sure the **Include subfolders** check box is selected. ++ > [!NOTE] + > You can export one account at a time. If you want to export multiple accounts, after one account is exported, repeat these steps. + +  + +7. Select **Next**. ++8. Select **Browse** to select where to save the Outlook Data File (.pst). Type a *file name*, and then select **OK** to continue. ++ > [!NOTE] + > If you've used export before, the previous folder location and file name appear. Type a *different file name* before selecting **OK**. + +9. If you are exporting to an existing Outlook Data File (.pst), under **Options**, specify what to do when exporting items that already exist in the file. ++10. Select **Finish**. ++Outlook begins the export immediately unless a new Outlook Data File (.pst) is created or a password-protected file is used. + +- If you're creating an Outlook Data File (.pst), an optional password can help protect the file. When the **Create Outlook Data File** dialog box appears, type the *password* in the **Password** and **Verify Password** boxes, and then select **OK**. In the **Outlook Data File Password** dialog box, type the *password*, and then select **OK**. ++- If you're exporting to an existing Outlook Data File (.pst) that is password protected, in the **Outlook Data File Password** dialog box, type the *password*, and then select **OK**. ++See how to [Export or backup email, contacts, and calendar to an Outlook .pst file](https://support.microsoft.com/office/14252b52-3075-4e9b-be4e-ff9ef1068f91) in Outlook 2010. ++ > [!NOTE] + > By default, your email is available offline for a period of 12 months. If required, see how to [increase the data available offline](/outlook/troubleshoot/mailboxes/only-subset-items-synchronized). ++### Give another user access to a former user's email ++To give access to the email messages, calendar, tasks, and contacts of the former employee to another employee, import the information to another employee's Outlook inbox. ++> [!NOTE] +> You can also [convert the former user's mailbox to a shared mailbox](/office365/admin/email/convert-user-mailbox-to-shared-mailbox) or [forward a former employee's email to another employee](/office365/admin/add-users/remove-former-employee#forward-a-former-employees-email-to-another-employee-or-convert-to-a-shared-mailbox). ++1. In Outlook, go to **File** \> **Open & Export** \> **Import/Export**. ++ This starts the Import and Export Wizard. ++2. Select **Import from another program or file**, and then select **Next**. ++  + +3. Select **Outlook Data File (.pst)**, and select **Next**. ++4. Browse to the .pst file you want to import. ++5. Under **Options**, choose how you want to deal with duplicates. ++6. Select **Next**. ++7. If a password was assigned to the Outlook Data File (.pst), enter the password, and then select **OK**. ++8. Set the options for importing items. The default settings usually don't need to be changed. ++9. Select **Finish**. ++> [!NOTE] +> The steps remain the same for accessing an existing user's OneDrive and email data. ++> [!TIP] +> If you want to import or restore only a few items from an Outlook Data File (.pst), you can open the Outlook Data File. Then, in the navigation pane, drag the items from Outlook Data File folders to your existing Outlook folders. ## Related content -[Exchange admin center in Exchange Online](/exchange/exchange-admin-center) +[Add and remove admins on a OneDrive account](/sharepoint/manage-user-profiles#add-and-remove-admins-for-a-users-onedrive) (article) ++[Restore a deleted OneDrive](/onedrive/restore-deleted-onedrive) (article) ++[OneDrive retention and deletion](/onedrive/retention-and-deletion) (article) ++[Share OneDrive files and folders](https://support.microsoft.com/office/share-onedrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07) |
| admin | Remove Former Employee | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/remove-former-employee.md | +- business_assist search.appverid: - BCS160 - MET150 description: "Follow the steps in this solution to remove a former employee from A question we often get is, "What should I do to secure data and protect access when an employee leaves my organization?" This article series explains how to block access to Microsoft 365 so these user's can't sign in to Microsoft 365, the steps you should take to secure organization data, and how to allow other employees to access email and OneDrive data. +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Before you begin You need to be a global administrator to complete the steps in this solution. |
| admin | Reset Passwords | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/reset-passwords.md | +- business_assist - adminvideo search.appverid: - BCS160 This article explains how to reset passwords for yourself and for your users whe > [!NOTE] > You can also set up self-service password reset for your users so they can reset their own passwords. To learn more, see [Let users reset their own passwords](let-users-reset-passwords.md). +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Before you begin This article is for people who set password expiration policy for a business, school, or nonprofit. To complete these steps, you need to sign in with your Microsoft 365 admin account. [What's an admin account?](Overview of the Microsoft 365 admin center](../admin-overview/admin-center-overview.md). |
| admin | Add Another Email Alias For A User | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/email/add-another-email-alias-for-a-user.md | +- business_assist search.appverid: - BCS160 - MET150 You can create up to 400 aliases for a user. No additional fees or licenses are > [!Tip] > If you want multiple people to manage email sent to a single email address like info@NodPublishers.com or sales@NodPublishers.com, create a shared mailbox. To learn more, see [Create a shared mailbox](create-a-shared-mailbox.md).++> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. ## Add email aliases to a user |
| admin | Configure Email Forwarding | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/email/configure-email-forwarding.md | +- business_assist search.appverid: - BCS160 - MET150 As the admin of an organization, you might have company requirements to set up e > [!IMPORTANT] > You can use outbound spam filter policies to control automatic forwarding to external recipients. For more information, see [Control automatic external email forwarding in Microsoft 365](/microsoft-365/security/office-365-security/external-email-forwarding#how-the-outbound-spam-filter-policy-settings-work-with-other-automatic-email-forwarding-controls). +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Configure email forwarding Before you set up email forwarding, note the following: |
| admin | Convert User Mailbox To Shared Mailbox | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox.md | +- business_assist search.appverid: - BCS160 - MET150 description: "Learn to convert a private mailbox to a shared mailbox that can be When you convert a user's mailbox to a shared mailbox, all of the existing email and calendar is retained. Only now it's in a shared mailbox where several people will be able to access it instead of one person. At a later date, you can convert a shared mailbox back to a user (private) mailbox. +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Before you begin **Here are some really important things that you need to know:** |
| admin | Create A Shared Mailbox | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/email/create-a-shared-mailbox.md | +- business_assist search.appverid: - BCS160 - MET150 Shared mailboxes include a shared calendar. A lot of small businesses like to us Before creating a shared mailbox, be sure to read [About shared mailboxes](about-shared-mailboxes.md) for more information. +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Create a shared mailbox and add members 1. Sign in with a global admin account or Exchange admin account. If you get the message "**You don't have permission to access this page or perform this action**," then you aren't an admin. |
| admin | Create Dns Records At Any Dns Hosting Provider | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/get-help-with-domains/create-dns-records-at-any-dns-hosting-provider.md | +- business_assist - admindeeplinkMAC If you don't add a domain, people in your organization will use the onmicrosoft. [Check the Domains FAQ](../setup/domains-faq.yml) if you don't find what you're looking for below. +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Step 1: Add a TXT or MX record to verify you own the domain ### Recommended: Verify with a TXT record |
| admin | Remove A Domain | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/get-help-with-domains/remove-a-domain.md | +- business_assist search.appverid: - BCS160 - MET150 description: "Learn how to remove an old domain from Microsoft 365 and move user Are you removing your domain because you want to add it to a different Microsoft 365 subscription plan? Or do you just want to cancel your subscription? You can [change your plan or subscription](../../commerce/subscriptions/switch-to-a-different-plan.md) or [cancel your subscription](../../commerce/subscriptions/cancel-your-subscription.md). +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ### Step 1: Move users to another domain #### Move users |
| admin | Assign Licenses To Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/assign-licenses-to-users.md | +- business_assist - okr_SMB - manage_licenses - commerce_licensing You can assign licenses to users on either the **Active users** page, or on the [Learn how to add a user and assign a license at the same time](../add-users/add-users.md). +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Before you begin - You must be a Global, License, or User admin to assign licenses. For more information, see [About Microsoft 365 admin roles](../add-users/about-admin-roles.md). |
| admin | Set Password Expiration Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/set-password-expiration-policy.md | +- business_assist search.appverid: - BCS160 - MET150 You must be a [global admin](../add-users/about-admin-roles.md) to perform these If you're a user, you don't have the permissions to set your password to never expire. Ask your work or school technical support to do the steps in this article for you. +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Set password expiration policy Follow the steps below if you want to set user passwords to expire after a specific amount of time. -1. In the Microsoft 365 admin center, go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2072756" target="_blank">**Security & privacy** tab</a>. +1. In the Microsoft 365 admin center, go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2072756" target="_blank">**Security & privacy** tab</a> under **Org Settings**. If you aren't a global admin, you won't see the Security and privacy option. Follow the steps below if you want to set user passwords to expire after a speci 1. In the second box type when users are notified that their password will expire, and then select **Save**. Choose a number of days from 1 to 30. > [!IMPORTANT]-> Password expiration notifications are no longer supported in the Microsoft 365 admin center or any Office apps. +> Password expiration notifications are no longer supported in Office web apps or the [admin center](https://portal.office.com). ## Important things you need to know about the password expiration feature |
| admin | Secure Your Business Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/security-and-compliance/secure-your-business-data.md | +- business_assist search.appverid: - BCS160 - MET150 description: "How to protect your business email and data from cyberthreats, inc If you are a small or medium-size organization using one of Microsoft's business plans and your type of organization is targeted by cybercriminals and hackers, use the guidance in this article to increase the security of your organization. This guidance helps your organization achieve the goals described in the Harvard Kennedy School [Cybersecurity Campaign Handbook](https://go.microsoft.com/fwlink/p/?linkid=2015598). +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Watch: Overview of security > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4mzxI?autoplay=false] |
| admin | Set Up Multi Factor Authentication | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication.md | +- business_assist search.appverid: - BCS160 - MET150 Multifactor authentication means you and your employees must provide more than o > [!IMPORTANT] > If you purchased your subscription or trial after October 21, 2019, and you're prompted for MFA when you sign in, [security defaults](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults) have been automatically enabled for your subscription. +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Watch: Turn on multifactor authentication > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE2MuO3?autoplay=false] |
| admin | Add Domain | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/setup/add-domain.md | +- business_assist - AdminSurgePortfolio - AdminTemplateSet search.appverid: description: "Use the setup wizard to add your domain to Microsoft 365 in the Mi To add, modify, or remove domains, you **must** be a **Domain Name Administrator** or **Global Administrator** of a [business or enterprise plan](https://products.office.com/business/office). These changes affect the whole tenant; *Customized administrators* or *regular users* won't be able to make these changes. +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Watch: Add a domain > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4dN8c?autoplay=false] |
| admin | Migrate Email And Contacts Admin | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/setup/migrate-email-and-contacts-admin.md | +- business_assist search.appverid: - MET150 - MOE150 description: "Learn to import contacts, calendars, and emails from Gmail or anot Import or migrate email from Gmail or another email provider to Microsoft 365. **Want help with this?** [Contact Microsoft 365 for business support](../../business-video/get-help-support.md). ++> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. You need to use a version of Outlook that is installed on your desktop for this task. Outlook is included in most Microsoft 365 [plans](https://go.microsoft.com/fwlink/p/?LinkId=723731). |
| commerce | Add Storage Space | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/add-storage-space.md | +- business_assist - AdminTemplateSet search.appverid: MET150 description: "Add file storage in your Microsoft 365 subscription. With extra file storage, you can store more content in SharePoint." If you start to run out of storage for your SharePoint sites, you can add storag > If you bought your subscription through Volume Licensing or a CSP, you can't buy **Office 365 Extra File Storage** for your organization directly from Microsoft. Contact your representative or partner for help. > For information about OneDrive storage, see [Set the default storage space for OneDrive users](/onedrive/set-default-storage-space). +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Before you begin You must be a Global or SharePoint admin to do the tasks in this article. For more information, see [About admin roles](../admin/add-users/about-admin-roles.md). |
| commerce | Manage Payment Methods | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/manage-payment-methods.md | +- business_assist search.appverid: MET150 description: "Buy business products or services from Microsoft by using an existing payment method or adding a new one in the Microsoft 365 admin center." Last updated 04/02/2021 If your business account doesn't have a billing profile, any Global or Billing a > > You must use a payment method issued from the same country as your tenant. +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Watch: Update your payment method > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3AVxy?autoplay=false] |
| commerce | Pay For Your Subscription | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/pay-for-your-subscription.md | +- business_assist - AdminTemplateSet Last updated 10/28/2021 You can use a credit or debit card, or bank account to pay for your subscription **Just want to find out where to send your invoice payment?** If you pay your invoice by check or electronic funds transfer (EFT), see [Where do I send my check or EFT payment?](#where-do-i-send-my-check-or-eft-payment) +> [!TIP] +> If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. + ## Before you begin - You must be a Global or Billing admin to do the steps described in this article. For more information, see [About admin roles](../../admin/add-users/about-admin-roles.md). |
| commerce | Subscriptions And Licenses | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/subscriptions-and-licenses.md | The following table lists what automatically happens when you assign a license t |Exchange Online <br/> |A mailbox is created for that person. <br/> To learn about the SLA for this task to be completed, see ["Setting up..." messages in the Microsoft 365 admin center](https://support.microsoft.com/help/2635238/setting-up-messages-in-the-office-365-admin-center). | |SharePoint Online <br/> |Edit permissions to the default SharePoint Online team site are assigned to that person. <br/> | |Skype for Business Online <br/> |The person has access to the features associated with the license. <br/> |-|Microsoft 365 Apps for enterprise <br/> |The person can download Office apps on up to five Macs or PCs, five tablets, and five smartphones. <br/> | +|Microsoft 365 Apps for enterprise and Microsoft 365 Apps for business <br/> |The person can download Office apps on up to five Macs or PCs, five tablets, and five smartphones. <br/> | ## Understand licenses for non-user mailboxes |
| commerce | Allowselfservicepurchase Powershell | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/allowselfservicepurchase-powershell.md | search.appverid: - MET150 description: "Learn how to use the AllowSelfServicePurchase PowerShell cmdlet to turn self-service purchase on or off." Previously updated : 07/16/2021 Last updated : 12/15/2021 # Use AllowSelfServicePurchase for the MSCommerce PowerShell module The following table lists the available products and their **ProductId**. | Windows 365 Business | CFQ7TTC0J203 | | Windows 365 Business with Windows Hybrid Benefit | CFQ7TTC0HX99 | -## View or set the status for AllowSelfServicePurchase +*These IDs have changed. If you previously blocked products using the old IDs, they are automatically blocked using the new IDs. No additional work is required. ->[!NOTE] -> These IDs have changed. If you previously blocked products using the old IDs, they are automatically blocked using the new IDs. No additional work is required. +## View or set the status for AllowSelfServicePurchase After you view the list of products available for self-service purchase, you can view or modify the setting for a specific product. |
| compliance | Create Retention Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-retention-policies.md | When you have more than one retention policy, and when you also use retention la ### Retention policy for Teams locations -1. From the [Microsoft 365 compliance center](https://compliance.microsoft.com/), select **Policies** > **Retention**. +1. From the [Microsoft 365 compliance center](https://compliance.microsoft.com/), select **Information Governance** > **Retention Policies**. 2. Select **New retention policy** to start the **Create retention policy** configuration, and name your new retention policy. It's possible that a retention policy that's applied to Microsoft 365 groups, Sh > > To use this feature, your Yammer network must be [Native Mode](/yammer/configure-your-yammer-network/overview-native-mode), not Hybrid Mode. -1. From the [Microsoft 365 compliance center](https://compliance.microsoft.com/), select **Policies** > **Retention**. +1. From the [Microsoft 365 compliance center](https://compliance.microsoft.com/), select **Information Governance** > **Retention Policies**. 2. Select **New retention policy** to create a new retention policy. Use the following instructions for retention policies that apply to any of these - Microsoft 365 groups - Skype for Business -1. From the [Microsoft 365 compliance center](https://compliance.microsoft.com/), select **Policies** > **Retention**. +1. From the [Microsoft 365 compliance center](https://compliance.microsoft.com/), select **Information Governance** > **Retention Policies**. 2. Select **New retention policy** to start the **Create retention policy** configuration, and name your new retention policy. Some settings can't be changed after the policy is created and saved, which incl If some items for Exchange, SharePoint, OneDrive, or Microsoft 365 Groups need different retention settings from the retention policy settings you've configured, [create retention labels for these exceptions](create-retention-labels-information-governance.md). -However, if you're looking for lifecycle management of high-value items for business, legal, or regulatory record-keeping requirements, [use file plan to create and manage retention labels](file-plan-manager.md). +However, if you're looking for lifecycle management of high-value items for business, legal, or regulatory record-keeping requirements, [use file plan to create and manage retention labels](file-plan-manager.md). |
| compliance | Double Key Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/double-key-encryption.md | For more information about the default, cloud-based tenant root keys, see [Plann ## When your organization should adopt DKE -Double Key Encryption is intended for your most sensitive data that is subject to the strictest protection requirements. DKE is not intended for all data. In general, you'll be using Double Key Encryption to protect only a small part of your overall data. You should do due diligence in identifying the right data to cover with this solution before you deploy. In some cases, you might need to narrow your scope and make use of other solutions for most your data such as Microsoft Information Protection with Microsoft-managed keys or BYOK. These solutions are sufficient for documents that aren't subject to enhanced protections and regulatory requirements. Also, these solutions enable you to use the most powerful Office 365 services; services that you can't use with DKE encrypted content. For example: +Double Key Encryption is intended for your most sensitive data that is subject to the strictest protection requirements. DKE isn't intended for all data. In general, you'll be using Double Key Encryption to protect only a small part of your overall data. You should do due diligence in identifying the right data to cover with this solution before you deploy. In some cases, you might need to narrow your scope and use other solutions for most of your data, such as Microsoft Information Protection with Microsoft-managed keys or BYOK. These solutions are sufficient for documents that aren't subject to enhanced protections and regulatory requirements. Also, these solutions enable you to use the most powerful Office 365 services; services that you can't use with DKE encrypted content. For example: - Transport rules including anti-malware and spam that require visibility into the attachment - Microsoft Delve Double Key Encryption is intended for your most sensitive data that is subject t - Content search and indexing - Office Web Apps including coauthoring functionality -Any external applications or services that are not integrated with DKE through the MIP SDK will be unable to perform actions on the encrypted data. +Any external applications or services that aren't integrated with DKE through the Microsoft Information Protection (MIP) SDK will be unable to perform actions on the encrypted data. -The Microsoft Information Protection SDK 1.7+ supports Double Key Encryption; applications that integrate with our SDK will be able to reason over this data with sufficient permissions and integrations in place. +The Microsoft Information Protection SDK 1.7+ supports Double Key Encryption. Applications that integrate with our SDK can reason over this data with sufficient permissions and integrations in place. -We recommend organizations use Microsoft Information protection capabilities (classification and labeling) to protect most of their sensitive data and only use DKE for their mission-critical data. Double Key Encryption is relevant for sensitive data in highly regulated industries such as Financial services and Healthcare. +Use Microsoft Information protection capabilities (classification and labeling) to protect most of your sensitive data and only use DKE for your mission-critical data. Double Key Encryption is relevant for sensitive data in highly regulated industries such as Financial services and Healthcare. If your organizations have any of the following requirements, you can use DKE to help secure your content: DKE sensitivity labels are made available to end users through the sensitivity b **Supported applications**. [Microsoft 365 Apps for enterprise](https://www.microsoft.com/microsoft-365/business/microsoft-365-apps-for-enterprise-product) clients on Windows, including Word, Excel, and PowerPoint. -**Online content support**. You can store documents and files protected with Double Key Encryption online in both Microsoft SharePoint and OneDrive for Business. You must label and protect documents and files with DKE by supported applications before you upload to these locations. You can share encrypted content by email, but you can't view encrypted documents and files online. Instead, you must view protected content using the supported desktop applications and clients on your local computer. +**Online content support**. You can store documents and files that are protected with Double Key Encryption online in both Microsoft SharePoint and OneDrive for Business. You must label and protect documents and files with DKE by supported applications before you upload to these locations. You can share encrypted content by email, but you can't view encrypted documents and files online. Instead, you must view protected content using the supported desktop applications and clients on your local computer. ## Overview of deploying DKE -You'll follow these general steps to set up DKE. Once you've completed these steps, your end users will can protect your highly sensitive data with Double Key Encryption. +You'll follow these general steps to set up DKE. Once you've completed these steps, your end users can protect your highly sensitive data with Double Key Encryption. 1. Deploy the DKE service as described in this article. -2. Create a label with Double Key Encryption. Navigate to Information protection under the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft 365 compliance center</a> and create a new label with Double Key Encryption. See [Restrict access to content by using sensitivity labels to apply encryption](./encryption-sensitivity-labels.md). +2. Create a label with Double Key Encryption. In the Microsoft 365 compliance center, navigate to **Information protection** and create a new label with Double Key Encryption. See [Restrict access to content by using sensitivity labels to apply encryption](./encryption-sensitivity-labels.md). 3. Use Double Key Encryption labels. Protect data by selecting the Double Key Encrypted label from the Sensitivity ribbon in Microsoft Office. To generate keys: 1. From the Windows Start menu, run the OpenSSL Command Prompt. -2. Change to the folder where you want to save the test keys. The files you create by completing the steps in this task are stored in the same folder. +1. Change to the folder where you want to save the test keys. The files you create by completing the steps in this task are stored in the same folder. -3. Generate the new test key. +1. Generate the new test key. ```console openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 ``` -4. Generate the private key. +1. Generate the private key. If you installed OpenSSL version 3 or later, run the following command: To generate keys: > openssl rsa -in key.pem -out privkeynopass.pem -outform PEM > ``` -5. Generate the public key. +1. Generate the public key. ```console openssl rsa -in key.pem -pubout > pubkeyonly.pem ``` -6. In a text editor, open **pubkeyonly.pem**. Copy all of the content in the **pubkeyonly.pem** file, except the first and last lines, into the `PublicPem` section of the **appsettings.json** file. +1. In a text editor, open **pubkeyonly.pem**. Copy all of the content in the **pubkeyonly.pem** file, except the first and last lines, into the `PublicPem` section of the **appsettings.json** file. -7. In a text editor, open **privkeynopass.pem**. Copy all of the content in the **privkeynopass.pem** file, except the first and last lines, into the `PrivatePem` section of the **appsettings.json** file. +1. In a text editor, open **privkeynopass.pem**. Copy all of the content in the **privkeynopass.pem** file, except the first and last lines, into the `PrivatePem` section of the **appsettings.json** file. -8. Remove all blank spaces and newlines in both the `PublicPem` and `PrivatePem` sections. +1. Remove all blank spaces and newlines in both the `PublicPem` and `PrivatePem` sections. > [!IMPORTANT] > When you copy this content, do not delete any of the PEM data. -9. In Visual Studio Code, browse to the **Startup.cs** file. This file is located in the DoubleKeyEncryptionService repo you cloned locally under DoubleKeyEncryptionService\src\customer-key-store\. +1. In Visual Studio Code, browse to the **Startup.cs** file. This file is located in the DoubleKeyEncryptionService repo you cloned locally under DoubleKeyEncryptionService\src\customer-key-store\. -10. Locate the following lines: +1. Locate the following lines: ```csharp #if USE_TEST_KEYS To generate keys: #endif ``` -11. Replace these lines with the following text: +1. Replace these lines with the following text: ```csharp services.AddSingleton<ippw.IKeyStore, ippw.TestKeyStore>(); To publish the key store, you'll create an Azure App Service instance to host yo 1. Go to `https://<WebAppInstanceName>.scm.azurewebsites.net/ZipDeployUI`. - For example: https://dkeservice.scm.azurewebsites.net/ZipDeployUI + For example: `https://dkeservice.scm.azurewebsites.net/ZipDeployUI` 2. In the codebase for the key store, go to the **customer-key-store\src\customer-key-store** folder, and verify that this folder contains the **customerkeystore.csproj** file. To publish the key store, you'll create an Azure App Service instance to host yo 4. Send all files in the publish directory to a .zip file. When creating the .zip file, make sure that all files in the directory are at the root level of the .zip file. -5. Drag and drop the .zip file you create to the ZipDeployUI site you opened above. For example: https://dkeservice.scm.azurewebsites.net/ZipDeployUI +5. Drag and drop the .zip file you create to the ZipDeployUI site you opened above. For example: `https://dkeservice.scm.azurewebsites.net/ZipDeployUI` DKE is deployed and you can browse to the test keys you've created. Continue to [Validate your deployment](#validate-your-deployment) below. key_store_tester.ps1 https://mydkeservice.com/mykey Ensure that no errors appear in the output. When you're ready, [register your key store](#register-your-key-store). -The key name is case sensitive. Enter the key name as it appears in the appsettings.json file. +The key name is case-sensitive. Enter the key name as it appears in the appsettings.json file. ## Register your key store To register the DKE service: 8. Under **Redirect URIs**, enter the URI of your double key encryption service. Enter the App Service URL, including both the hostname and domain. - For example: https://mydkeservicetest.com + For example: `https://mydkeservicetest.com` - The URL you enter must match the hostname where your DKE service is deployed.- - If you're testing locally with Visual Studio, use **https://localhost:5001**. + - The domain must be a [registered domain](/azure/active-directory/develop/reference-breaking-changes#appid-uri-in-single-tenant-applications-will-require-use-of-default-scheme-or-verified-domains). + - If you're testing locally with Visual Studio, use `https://localhost:5001`. - In all cases, the scheme must be **https**. Ensure the hostname exactly matches your App Service hostname. You may have changed it to `localhost` to troubleshoot the build. In **appsettings.json**, this value is the hostname you set for `JwtAudience`. To register the DKE service: 10. Select **Save** to save your changes. -11. On the left pane, select **Expose an API**, then next to Application ID URI, select **Set**. +11. On the left pane, select **Expose an API**, next to Application ID URI, enter your App Service URL, including both hostname and domain, and then select **Set**. 12. Still on the **Expose an API** page, in the **Scopes defined by this API** area, select **Add a scope**. In the new scope: Your DKE service is now registered. Continue by [creating labels using DKE](#cre ## Create sensitivity labels using DKE -In the Microsoft 365 compliance center, create a new sensitivity label and apply encryption as you would otherwise. Select **Use Double Key Encryption** and enter the endpoint URL for your key. You need to include the key name you have provided within the "TestKeys" section of the appsettings.json file in the URL. --For example: https://testingdke1.azurewebsites.net/**KEYNAME** +In the Microsoft 365 compliance center, create a new sensitivity label and apply encryption as you would otherwise. Select **Use Double Key Encryption** and enter the endpoint URL for your key. You need to include the key name you've provided within the "TestKeys" section of the appsettings.json file in the URL. +For example: `https://testingdke1.azurewebsites.net/KEYNAME` > [!div class="mx-imgBorder"] >  If you don't migrate content, your HYOK protected content will remain unaffected ## Other deployment options -We realize that for some customers in highly regulated industries, this standard reference implementation using software-based keys may not be sufficient to meet their enhanced compliance obligations and needs. -We have partnered with various third-party hardware security module (HSM) vendors to bring support for enhanced key management options to the DKE service, including: -+We realize that for some customers in highly regulated industries, this standard reference implementation using software-based keys may not be sufficient to meet their enhanced compliance obligations and needs. We've partnered with third-party hardware security module (HSM) vendors to support enhanced key management options in the DKE service, including: -- [Thales](https://cpl.thalesgroup.com/cloud-security/encryption/double-key-encryption) + - [Entrust](https://www.entrust.com/digital-security/hsm/services/packaged-services/double-key-encryption-integration#:~:text=Entrust%20Double%20Key%20Encryption%20for%20Microsoft%20AIP%2C%20offered,trust%20for%20the%20protection%20of%20sensitive%20cryptographic%20keys.) -Reach out directly to these vendors for more information and guidance on their in-market DKE HSM solutions. +- [Thales](https://cpl.thalesgroup.com/cloud-security/encryption/double-key-encryption) +Reach out directly to these vendors for more information and guidance on their in-market DKE HSM solutions. |
| compliance | Retention Limits | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention-limits.md | A maximum of 1,000 retention labels are supported per tenant. ## Maximum number of policies per tenant -A single tenant can have a maximum of 10,000 policies (any configuration). This maximum number includes the different policies for retention, and other policies for compliance such as policies for DLP, information barriers, eDiscovery holds, and sensitivity labels. +A single tenant can have a maximum of 10,000 policies (any configuration). This maximum number includes the different policies for retention, and other policies for compliance such as policies for DLP, information barriers, eDiscovery holds, Litigation holds, In-Place Holds, and sensitivity labels. However, this maximum excludes: ++- Label policies for SharePoint and OneDrive that delete-only, rather than retain-only or retain and then delete. The exception is auto-apply label policies for cloud attachments, which are always included in the 10,000 maximum. +- Exchange retention policies from [messaging records management (MRM)](/exchange/security-and-compliance/messaging-records-management/messaging-records-management). Within this 10,000 policies limit, there are also some limits on the maximum number of policies for retention per workload: - Exchange (any configuration): 1,800+ - Per mailbox: 25 is the recommended maximum before performance might be impacted; 50 is the supported limit. - SharePoint or OneDrive: (all sites automatically included): 13 - SharePoint or OneDrive (specific locations included or excluded): 2,600 +> [!NOTE] +> These maximum numbers for Exchange and SharePoint are not exclusive to retention but are shared with other types of hold policies that include eDiscovery holds, Litigation holds, and In-Place Holds. + Although retention policies for Microsoft Teams and Yammer use mailboxes to store data for retention purposes, the maximum number of policies for Exchange Online exclude retention policies for Teams and Yammer. ## Maximums for adaptive policy scopes |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | The numbers listed are the minimum Office application versions required for each |[Audit label-related user activity](data-classification-activity-explorer.md) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ | 2.46+ | 16.0.13628+ | Yes <sup>\*</sup> | |[Require users to apply a label to their email and documents](#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.45+ | 2.47+ | 16.0.13628+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |-|[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2018+ | Under review | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | +|[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2018+ | 16.49+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Support co-authoring and AutoSave](sensitivity-labels-coauthoring.md) for labeled and encrypted documents | Current Channel: 2107+ <br /><br> Monthly Enterprise Channel: 2107+ <br /><br> Semi-Annual Enterprise Channel: 2202+ | 16.51+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | | The numbers listed are the minimum Office application versions required for each |[Require users to apply a label to their email and documents](#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes | |[Audit label-related user activity](data-classification-activity-explorer.md) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2202+ | 16.51+ <sup>\*</sup> | 4.2126+ | 4.2126+ | Yes | |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ <sup>\*</sup> | Under review | Under review | Yes |-|[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | Under review | Under review | Under review | Yes | +|[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | Yes | |[Different settings for default label and mandatory labeling](#outlook-specific-options-for-default-label-and-mandatory-labeling) | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes | | |
| lighthouse | M365 Lighthouse Review Audit Logs | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-review-audit-logs.md | The following table is a list of activity types captured within Lighthouse audit |**restartDevice** | Devices | Restart | Microsoft Endpoint Manager | | **syncDevice** | Devices | Sync | Microsoft Endpoint Manager | | **rebootNow** | Threat management | Reboot | Microsoft Endpoint Manager |-| **reprovision** | Tenants | Retry Provisioning | Windows 365 | +| **reprovision** | Windows 365 | Retry Provisioning | Windows 365 | | **windowsDefenderScanFull** | Threat management | Full scan | Microsoft Endpoint Manager | | **windowsDefenderScan** | Threat management | Quick scan | Microsoft Endpoint Manager | | **windowsDefenderUpdateSignatures** | Threat management | Update antivirus | Microsoft Endpoint Manager | |
| managed-desktop | Index | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/get-ready/index.md | audience: Admin # Get ready for enrollment in Microsoft Managed Desktop -These topics describe the steps you'll need to take in your organization to prepare for enrollment, including checking that your environment meets key prerequisites, configuring networks, setting up certificates, and preparing your apps for inclusion in the service. Once you have run the readiness assessment tools, you can complete the other steps in any order or in parallel. Depending on your environment, some of the steps might not be relevant to you. +These articles describe the steps you'll need to take in your organization to prepare for enrollment, including: ++- Checking that your environment meets key prerequisites +- Configuring networks +- Setting up certificates +- Preparing your apps for inclusion in the service ++Once you've run the readiness assessment tools, you can complete the other steps in any order or in parallel. Depending on your environment, some of the steps might not be relevant to you.  1. Review [prerequisites for Microsoft Managed Desktop](prerequisites.md).-2. Run [readiness assessment tools](readiness-assessment-tool.md). +1. Run [readiness assessment tools](readiness-assessment-tool.md). 1. Buy [Company Portal](../get-started/company-portal.md). 1. Review [prerequisites for guest accounts](guest-accounts.md). 1. Check [network configuration](network.md). |
| managed-desktop | Prerequisites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/get-ready/prerequisites.md | audience: Admin <!--This topic is the target for a "Learn more" link in the Admin Portal (aka.ms/prereq-azure). DO NOT DELETE.--> <!--from Prerequisites --> -This topic outlines the infrastructure requirements you must meet to assure success with Microsoft Managed Desktop. +This article outlines the infrastructure requirements you must meet to assure success with Microsoft Managed Desktop. +| Area | Prerequisite details | +| -- | -- | +| Licensing | Microsoft Managed Desktop requires the Microsoft 365 E3 license with Microsoft Defender for Endpoint (or equivalents) assigned to your users. <ul><li>For details about the specific service plans, see [More about licenses](#more-about-licenses).</li><li> For more information on available licenses, see [Microsoft 365 licensing](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans).</li></ul> +| Connectivity | All Microsoft Managed Desktop devices require connectivity to numerous Microsoft service endpoints from the corporate network.<br><br> For the full list of required IPs and URLs, see [Network configuration](../get-ready/network.md). +| Azure Active Directory | Azure Active Directory (Azure AD) must either be the source of authority for all user accounts, or user accounts must be synchronized from on-premises Active Directory using the latest supported version of Azure AD Connect. <ul><li>For more information, see [Azure AD Connect](/azure/active-directory/hybrid/whatis-azure-ad-connect).</li><li> For more information on supported Azure AD Connect versions, see [Azure AD Connect:Version release history](/azure/active-directory/hybrid/reference-connect-version-history).</li></ul> +| Authentication | If Azure AD isn't the source of primary authentication for user accounts, you must configure one of the following authentication methods in Azure AD Connect:<ul><li> Password hash synchronization.</li> <li> Pass-through authentication.</li><li>An external identity provider (including Windows Server ADFS and non-Microsoft IDPs) configured to meet Azure AD integration requirements. For more information, see the [guidelines](https://www.microsoft.com/download/details.aspx?id=56843).</li></ul> <br> When setting authentication options with Azure AD Connect, password writeback is also recommended. For more information, see [Password writeback](/azure/active-directory/authentication/howto-sspr-writeback). <br><br> If an external identity provider is implemented, you must validate the solution:<ul><li>Meets Azure AD integration requirements.</li><li>Supports Azure AD Conditional Access, which allows the Microsoft Managed Desktop device compliance policy to be configured.</li><li>Enables device enrollment, use of Microsoft 365 services, or features required as part of Microsoft Managed Desktop.</li></ul> <br>For more information on authentication options with Azure AD, see [Azure AD Connect user sign in options](/azure/active-directory/connect/active-directory-aadconnect-user-signin). +| Microsoft 365 | OneDrive for Business must be enabled for Microsoft Managed Desktop users.<br><br>Though it isn't required to enroll with Microsoft Managed Desktop, we highly recommended that the following services be migrated to the cloud:<ul><li>Email: Migrate to cloud-based mailboxes, Exchange online, or configure with Exchange Online Hybrid with Exchange 2013 or higher, on-premises.</li><li>Files and folders: Migrate to OneDrive for Business or SharePoint Online.</li><li>Online collaboration tools: Migrate to Teams.</ul> | +| Device management | Microsoft Managed Desktop devices require management using Microsoft Intune. Intune must be set as the Mobile Device Management authority.<br><br> For more information, see [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune). +| Data backup and recovery | Microsoft Managed Desktop requires files to be synced to OneDrive for Business for protection. Any files not synced to OneDrive for Business aren't guaranteed by Microsoft Managed Desktop. The files might be lost during device exchanges or support calls requiring a device reset.<br><br>Though not required, Microsoft Managed Desktop strongly recommends migration from mapped network drives to the appropriate cloud solution. For more information, see [Prepare mapped drives for Microsoft Managed Desktop](mapped-drives.md) -Area | Prerequisite details - | -Licensing |Microsoft Managed Desktop requires the Microsoft 365 E3 license with Microsoft Defender for Endpoint (or equivalents) assigned to your users.<br>For details about the specific service plans, see [More about licenses](#more-about-licenses) in this topic.<br>For more information on available licenses, see [Microsoft 365 licensing](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans). -Connectivity | All Microsoft Managed Desktop devices require connectivity to numerous Microsoft service endpoints from the corporate network.<br><br>For the full list of required IPs and URLs, see [Network configuration](../get-ready/network.md). -Azure Active Directory | Azure Active Directory (Azure AD) must either be the source of authority for all user accounts, or user accounts must be synchronized from on-premises Active Directory using the latest supported version of Azure AD Connect.<br><br>For more information, see [Azure AD Connect](/azure/active-directory/hybrid/whatis-azure-ad-connect).<br><br>For more information on supported Azure AD Connect versions, see [Azure AD Connect:Version release history](/azure/active-directory/hybrid/reference-connect-version-history). -Authentication | If Azure AD is not the source of primary authentication for user accounts, you must configure one of these in Azure AD Connect:<br>- Password hash synchronization<br>- Pass-through authentication<br>- An external identity provider (including Windows Server ADFS and non-Microsoft IDPs) configured to meet Azure AD integration requirements. See the [guidelines](https://www.microsoft.com/download/details.aspx?id=56843) for more information. <br><br>When setting authentication options with Azure AD Connect, password writeback is also recommended. For more information, see [Password writeback](/azure/active-directory/authentication/howto-sspr-writeback). <br><br>If an external identity provider is implemented, you must validate the solution:<br>- Meets Azure AD integration requirements<br>- Supports Azure AD Conditional Access, which allows the Microsoft Managed Desktop device compliance policy to be configured<br>- Enables device enrollment and use of Microsoft 365 services or features required as part of Microsoft Managed Desktop <br><br>For more information on authentication options with Azure AD, see [Azure AD Connect user sign-in options](/azure/active-directory/connect/active-directory-aadconnect-user-signin). -Microsoft 365 | OneDrive for Business must be enabled for Microsoft Managed Desktop users.<br><br>Though it is not required to enroll with Microsoft Managed Desktop, we highly recommended that the following services be migrated to the cloud:<br>- Email: Migrate to cloud-based mailboxes, Exchange online, or configure with Exchange Online Hybrid with Exchange 2013 or higher, on-premises.<br>- Files and folders: Migrate to OneDrive for Business or SharePoint Online.<br>- Online collaboration tools: Migrate to Teams. -Device management | Microsoft Managed Desktop devices require management using Microsoft Intune. Intune must be set as the Mobile Device Management authority.<br><br>For more information, see [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune). -Data backup and recovery | Microsoft Managed Desktop requires files to be synced to OneDrive for Business for protection. Any files not synced to OneDrive for Business are not guaranteed by Microsoft Managed Desktop and might be lost during device exchanges or support calls requiring a device reset.<br><br>Though not required, Microsoft Managed Desktop strongly recommends migration from mapped network drives to the appropriate cloud solution. For more information, see [Prepare mapped drives for Microsoft Managed Desktop](mapped-drives.md) --When you're ready to get started with Microsoft Managed Desktop, contact your Microsoft Account Manager. +When you're ready to get started with Microsoft Managed Desktop, contact your Microsoft Account Manager. ## More about licenses Microsoft Managed Desktop requires certain license options in order to function. - [Exchange Online Plan 2](https://www.microsoft.com/microsoft-365/exchange/compare-microsoft-exchange-online-plans) > [!TIP]-> Your Microsoft Account Manager will help you review your current licenses and service plans and find the most efficient path for you to get any additional licenses or service plans you might need, while avoiding duplication. +> Your Microsoft Account Manager will help you review your current licenses, service plans, and find the most efficient path for you to get any additional licenses or service plans you might need, while avoiding duplication. ## Steps to get ready for Microsoft Managed Desktop 1. Review prerequisites (this article).-2. Run [readiness assessment tools](readiness-assessment-tool.md). +1. Run [readiness assessment tools](readiness-assessment-tool.md). 1. Buy [Company Portal](../get-started/company-portal.md). 1. Review [prerequisites for guest accounts](guest-accounts.md). 1. Check [network configuration](network.md). Microsoft Managed Desktop requires certain license options in order to function. 1. [Prepare apps](apps.md). 1. [Prepare mapped drives](mapped-drives.md). 1. [Prepare printing resources](printing.md).-1. Address [device names](address-device-names.md). +1. Address [device names](address-device-names.md). |
| managed-desktop | Readiness Assessment Downloadable | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/get-ready/readiness-assessment-downloadable.md | audience: Admin # Downloadable readiness assessment checker -To work well with Microsoft Managed Desktop, devices must meet certain requirements for hardware and settings. Also, each device must be able to reach key endpoints. Download and run this tool to obtain an HTML report, view results, and then take action. You will need to download the tool and supporting files, and then run it manually on each device you want to enroll in Microsoft Managed Desktop. +To work well with Microsoft Managed Desktop, devices must meet certain requirements for hardware and settings. Each device must be able to reach key endpoints. -For each check, the tool will report one of three possible results: +Download and run the readiness assessment checker tool to obtain an HTML report, view results, and take action. You must download the tool and supporting files. Then, run it manually on each device you want to enroll in Microsoft Managed Desktop. +For each check, the tool will report one of three possible results: -|Result |Meaning | -||| -|Ready | No action is required before you complete enrollment. | -|Advisory | Follow the steps in the tool for the best experience with enrollment and for users. You *can* complete enrollment, but you must fix these issues before you deploy your first device. | -|Not ready | *Enrollment will fail* if you don't fix these issues. Follow the steps in the tool to resolve them. | +| Result | Meaning | +| -- | -- | +| Ready | No action is required before you complete enrollment. | +| Advisory | Follow the steps in the tool for the best experience with enrollment and for users. <br><br> You *can* complete enrollment, but you must fix these issues before you deploy your first device. | +| Not ready | **Enrollment will fail** if you don't fix these issues. <br><br> Follow the steps in the tool to resolve them. | ## Obtain the checker Download the .zip file from https://aka.ms/mmddratoolv0. > [!NOTE] > The user running the tool must have local Administrator rights on the device where they're running it. - Then run the tool by following these steps: +**To run the tool:** 1. Copy the downloaded .zip file to each device you want to check. 2. Extract all files in the compressed download. 3. Run **Microsoft.MMD.DeviceReadinessAssessmentTool.exe**. 4. When the User Access Control prompt appears, select **Yes**. The tool runs and opens a report in your default browser. -You could also download and extract the .zip archive to a shared location, access **Microsoft.MMD.DeviceReadinessAssessmentTool.exe** from each device, and then run it locally. -+You could also download and extract the .zip archive to a shared location, access **Microsoft.MMD.DeviceReadinessAssessmentTool.exe** from each device. Then, run it locally. ## Checks -The downloadable tool checks these device- and network-related items: --### Hardware --Devices must meet specific hardware requirements to work with Microsoft Managed Desktop. For more information, see [Device requirements](../service-description/device-list.md). +The downloadable tool checks these device and network-related items: -If your device fails any of the checks, it's not compatible with Microsoft Managed Desktop. --### Network endpoints --Devices much be able to reach several [key endpoints](network.md) to work with Microsoft Managed Desktop. --If the tool reports a **Not ready** result, see the detailed report to find out which endpoints weren't reachable. Then adjust your firewall or other network settings to ensure those endpoints can be reached. +| Check | Description | +| -- | -- | +| Hardware | Devices must meet specific hardware requirements to work with Microsoft Managed Desktop. For more information, see [Device requirements](../service-description/device-list.md). <br><br> If your device fails any of the checks, it's not compatible with Microsoft Managed Desktop. | +| Network endpoints | Devices much be able to reach several [key endpoints](network.md) to work with Microsoft Managed Desktop. <br><br> If the tool reports a **Not ready** result, see the detailed report to find out which endpoints weren't reachable. Then, adjust your firewall or other network settings to ensure those endpoints can be reached. | ### Other settings -#### Enterprise wi-fi profiles --An **Advisory** result means that you are using some wi-fi profiles that need certificates and profiles to work properly. For more information, see [Deploy certificates and Wi-Fi/VPN profile](certs-wifi-lan.md#deploy-certificates-and-wi-fivpn-profile). --#### LAN profiles --An **Advisory** result means that you have LANs that need certificates and profiles to work properly. For more information, see [Prepare certificates and network profiles for Microsoft Managed Desktop](certs-wifi-lan.md). --#### VPN profiles --An **Advisory** result means that you're using a virtual private network (VPN). Create a VPN profile that deploys certificates integrated with Microsoft Intune. For more information, see [Prepare certificates and network profiles for Microsoft Managed Desktop](certs-wifi-lan.md). --#### Mapped drives --An **Advisory** result means that you have some mapped drives, which aren't recommended. For more information, see [Prepare mapped drives for Microsoft Managed Desktop](mapped-drives.md). --#### Print queues --An **Advisory** result means that you have some outstanding print queues, which aren't recommended. One solution is to use cloud printing. For more information, see [Prepare printing resources for Microsoft Managed Desktop](printing.md). --#### Proxies --An **Advisory** result means that you have a proxy server in use. For more information, see [Network configuration for Microsoft Managed Desktop](network.md). -+| Setting | Description | +| -- | -- | +| Enterprise Wi-Fi profiles | An **Advisory** result means that you're using some Wi-Fi profiles that need certificates and profiles to work properly. For more information, see [Deploy certificates and Wi-Fi/VPN profile](certs-wifi-lan.md#deploy-certificates-and-wi-fivpn-profile). | +| LAN profiles | An **Advisory** result means that you have LANs that need certificates and profiles to work properly. For more information, see [Prepare certificates and network profiles for Microsoft Managed Desktop](certs-wifi-lan.md). | +| VPN profiles | An **Advisory** result means that you're using a virtual private network (VPN). Create a VPN profile that deploys certificates integrated with Microsoft Intune. For more information, see [Prepare certificates and network profiles for Microsoft Managed Desktop](certs-wifi-lan.md). | +| Mapped drives | An **Advisory** result means that you have some mapped drives, which aren't recommended. For more information, see [Prepare mapped drives for Microsoft Managed Desktop](mapped-drives.md). | +| Print queues | An **Advisory** result means that you have some outstanding print queues, which aren't recommended. One solution is to use cloud printing. For more information, see [Prepare printing resources for Microsoft Managed Desktop](printing.md). | +| Proxies | An **Advisory** result means that you have a proxy server in use. For more information, see [Network configuration for Microsoft Managed Desktop](network.md). | |
| managed-desktop | Readiness Assessment Fix | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/get-ready/readiness-assessment-fix.md | audience: Admin For each check, the tool will report one of four possible results: --|Result |Meaning | -||| -|Ready | No action is required before completing enrollment. | -|Advisory | Follow the steps in the tool or this article for the best experience with enrollment and for users. You *can* complete enrollment, but you must fix these issues before you deploy your first device. | -|Not ready | *Enrollment will fail if you don't fix these issues.* Follow the steps in the tool or this article to resolve them. | -|Error | The Azure Active Directory (AD) role you're using doesn't have sufficient permission to run this check. | +| Result | Meaning | +| -- | -- | +| Ready | No action is required before completing enrollment. | +| Advisory | Follow the steps in the tool or this article for the best experience with enrollment and for users. <br><br> You *can* complete enrollment, but you must fix these issues before you deploy your first device. | +| Not ready | **Enrollment will fail if you don't fix these issues.** <br><br> Follow the steps in the tool or this article to resolve them. | +| Error | The Azure Active Directory (AD) role you're using doesn't have sufficient permission to run this check. | > [!NOTE]-> The results reported by this tool reflect the status of your settings only at the specific point in time that you ran it. If you later make any changes to policies in Microsoft Intune, Azure Active Directory, or Microsoft 365, items that were "Ready" can become "Not ready." To avoid problems with Microsoft Managed Desktop operations, check the specific settings described in this article before you change any policies. +> The results reported by this tool reflect the status of your settings only at the time that you ran it. If you make changes later to policies in Microsoft Intune, Azure Active Directory, or Microsoft 365, items that were "Ready" can become "Not ready." To avoid problems with Microsoft Managed Desktop operations, check the specific settings described in this article before you change any policies. ## Microsoft Intune settings You can access Intune settings at the Microsoft Endpoint Manager [admin center]( ### Autopilot deployment profile -You shouldn't have any existing Autopilot profiles that target assigned or dynamic groups with Microsoft Managed Desktop devices. Microsoft Managed Desktop uses Autopilot to provision new devices. If you have an existing Autopilot deployment profile, the "Convert all targeted devices to Autopilot" setting must be set to "No" for the managed desktop readiness test for Autopilot to succeed. --**Not ready** --You have an Autopilot profile that is assigned to all devices. For steps, see -[Enroll Windows devices in Intune by using Windows Autopilot](/mem/autopilot/enrollment-autopilot). After Microsoft Managed Desktop enrollment, set your Autopilot policy to exclude the **Modern Workplace Devices -All** Azure AD group. --**Advisory** --Make sure that your Autopilot profiles target an assigned or dynamic Azure AD group that doesn't include Microsoft Managed Desktop devices. For steps, see -[Enroll Windows devices in Intune by using Windows Autopilot](/mem/autopilot/enrollment-autopilot). After Microsoft Managed Desktop enrollment, set your Autopilot profiles to exclude the **Modern Workplace Devices -All** Azure AD group. +You shouldn't have any existing Autopilot profiles that target assigned or dynamic groups with Microsoft Managed Desktop devices. Microsoft Managed Desktop uses Autopilot to configure new devices. If you have an existing Autopilot deployment profile, the **Convert all targeted devices to Autopilot** setting must be set to **No** for the Microsoft Managed Desktop Autopilot readiness test to succeed. +| Result | Meaning | +| -- | -- | +| Not ready | You have an Autopilot profile that is assigned to all devices. For more information, see [Enroll Windows devices in Intune by using Windows Autopilot](/mem/autopilot/enrollment-autopilot). After Microsoft Managed Desktop enrollment, set your Autopilot policy to exclude the **Modern Workplace Devices -All** Azure AD group. +| Advisory | Make sure that your Autopilot profiles target an assigned or dynamic Azure AD group that doesn't include Microsoft Managed Desktop devices. For more information, see [Enroll Windows devices in Intune by using Windows Autopilot](/mem/autopilot/enrollment-autopilot). After Microsoft Managed Desktop enrollment, set your Autopilot profiles to exclude the **Modern Workplace Devices -All** Azure AD group. | ### Certificate connectors -If you have any certificate connectors that will be used by the devices you want to enroll in Microsoft Managed Desktop, the connectors should not have any errors. Only one of the following advisories will apply to your situation, so check them carefully. --**Advisory** --No certificate connectors are present. It's possible you don't need any connectors, but you should evaluate whether you might need some for network connectivity on your Microsoft Managed Desktop devices. For more information, see [Prepare certificates and network profiles for Microsoft Managed Desktop](certs-wifi-lan.md). --**Advisory** --At least one certificate connector has an error. If you need this connector for providing certificates to Microsoft Managed Desktop devices, you must resolve the error. For more information, see [Prepare certificates and network profiles for Microsoft Managed Desktop](certs-wifi-lan.md). -+If you have any certificate connectors that will be used by the devices you want to enroll in Microsoft Managed Desktop, the connectors shouldn't have any errors. Only one of the following advisories will apply to your situation, so check them carefully. -**Advisory** --You have at least one certificate connector and no errors are reported. However, in preparation for deployment, you might need to create a profile to reuse the connector for Microsoft Managed Desktop devices. For more information, see [Prepare certificates and network profiles for Microsoft Managed Desktop](certs-wifi-lan.md). +| Result | Meaning | +| -- | -- | +| Advisory | No certificate connectors are present. It's possible you don't need any connectors, but you should evaluate whether you might need some for network connectivity on your Microsoft Managed Desktop devices. For more information, see [Prepare certificates and network profiles for Microsoft Managed Desktop](certs-wifi-lan.md). | +| Advisory | At least one certificate connector has an error. If you need this connector for providing certificates to Microsoft Managed Desktop devices, you must resolve the error. For more information, see [Prepare certificates and network profiles for Microsoft Managed Desktop](certs-wifi-lan.md). | +| Advisory | You have at least one certificate connector, and no errors are reported. However, in preparation for deployment, you might need to create a profile to reuse the connector for Microsoft Managed Desktop devices. For more information, see [Prepare certificates and network profiles for Microsoft Managed Desktop](certs-wifi-lan.md). | ### Company Portal -Microsoft Managed Desktop requires that IT administrators install Intune Company Portal for their users with Microsoft Managed Desktop devices. --**Not ready** --You do not have Company Portal installed for your users. Purchase Company Portal and force a sync between Intune and Microsoft Store for Business. For more information, see [Install Intune Company Portal on devices](../get-started/company-portal.md). +Microsoft Managed Desktop requires that IT administrators install Intune Company Portal for their users with Microsoft Managed Desktop devices. +| Result | Meaning | +| -- | -- | +| Not ready | You don't have Company Portal installed for your users. Purchase Company Portal and force a sync between Intune and Microsoft Store for Business. For more information, see [Install Intune Company Portal on devices](../get-started/company-portal.md). ### Conditional access policies -Conditional access policies must not prevent Microsoft Managed Desktop from managing your Azure AD organization (tenant) in Intune and Azure AD. --**Not ready** --You have at least one conditional access policy that targets all users. During enrollment, we will exclude Microsoft Managed Desktop service accounts from relevant conditional access policies and apply new conditional access policies to restrict access to these accounts. After enrollment, you can review the Microsoft Managed Desktop conditional access policy in Microsoft Endpoint Manager. For more about these service accounts, see [Standard operating procedures](../service-description/operations-and-monitoring.md#standard-operating-procedures). --**Advisory** --You have conditional access policies that could prevent Microsoft Managed Desktop from managing the Microsoft Managed Desktop service. During enrollment, we will exclude Microsoft Managed Desktop service accounts from relevant conditional access policies and apply new conditional access policies to restrict access to these accounts. For more about these service accounts, see [Standard operating procedures](../service-description/operations-and-monitoring.md#standard-operating-procedures). --**Error** --The Intune Administrator role doesn't have sufficient permissions for this check. You'll also need any of these Azure AD roles assigned to run this check: --- Security Reader-- Security Administrator-- Conditional Access Administrator-- Global Reader-- Devices Administrator-+Conditional access policies can't prevent Microsoft Managed Desktop from managing your Azure AD organization (tenant) in Intune and Azure AD. +| Result | Meaning | +| -- | -- | +| Not ready | You have at least one conditional access policy that targets all users. During enrollment, we'll exclude Microsoft Managed Desktop service accounts from relevant conditional access policies and apply new conditional access policies to restrict access to these accounts. After enrollment, you can review the Microsoft Managed Desktop conditional access policy in Microsoft Endpoint Manager. For more about these service accounts, see [Standard operating procedures](../service-description/operations-and-monitoring.md#standard-operating-procedures). | +| Advisory | You have conditional access policies that could prevent Microsoft Managed Desktop from managing the Microsoft Managed Desktop service. During enrollment, we'll exclude Microsoft Managed Desktop service accounts from relevant conditional access policies and apply new conditional access policies to restrict access to these accounts. For more information about these service accounts, see [Standard operating procedures](../service-description/operations-and-monitoring.md#standard-operating-procedures). | +| Error | The Intune Administrator role doesn't have sufficient permissions for this check. You'll also need to have these Azure AD roles assigned to run this check: <ul><li>Security Reader</li><li>Security Administrator</li><li>Conditional Access Administrator</li><li>Global Reader</li><li>Devices Administrator</li></ul> ### Device Compliance policies -Intune Device Compliance policies in your Azure AD organization might impact Microsoft Managed Desktop devices. --**Advisory** --You have at least one compliance policy that applies all users. Microsoft Managed Desktop also includes compliance policies that will apply to your Microsoft Managed Desktop devices. Review all of the compliance policies created by your organization that apply to Microsoft Managed Desktop devices to ensure there are no conflicts. For steps, see [Create a compliance policy in Microsoft Intune](/mem/intune/protect/create-compliance-policy). -+Intune Device Compliance policies in your Azure AD organization might affect Microsoft Managed Desktop devices. +| Result | Meaning | +| -- | -- | +| Advisory | You have at least one compliance policy that applies all users. Microsoft Managed Desktop also includes compliance policies that will apply to your Microsoft Managed Desktop devices. Review all of the compliance policies created by your organization that apply to Microsoft Managed Desktop devices to ensure there are no conflicts. For more information, see [Create a compliance policy in Microsoft Intune](/mem/intune/protect/create-compliance-policy). | ### Device Configuration profiles -Intune Device Configuration profiles in your Azure AD organization must not target any Microsoft Manage Desktop devices or users. --**Not ready** --You have at least one configuration profile that applies to all users, all devices, or both. Reset the profile to apply to a specific Azure AD group that does not include any Microsoft Managed Desktop devices. For steps, see [Create a profile with custom settings in Microsoft Intune](/mem/intune/configuration/custom-settings-configure). --**Advisory** --Make sure that any configuration policies you have don't include any Microsoft Managed Desktop devices or users. For steps, see [Create a profile with custom settings in Microsoft Intune](/mem/intune/configuration/custom-settings-configure). -+Intune Device Configuration profiles in your Azure AD organization can't target any Microsoft Manage Desktop devices or users. +| Result | Meaning | +| -- | -- | +| Not ready | You have at least one configuration profile that applies to all users, all devices, or both. Reset the profile to apply to a specific Azure AD group that doesn't include any Microsoft Managed Desktop devices. For more information, see [Create a profile with custom settings in Microsoft Intune](/mem/intune/configuration/custom-settings-configure). | +| Advisory | Make sure that any configuration policies you have don't include any Microsoft Managed Desktop devices or users. For more information, see [Create a profile with custom settings in Microsoft Intune](/mem/intune/configuration/custom-settings-configure). | ### Device type restrictions Microsoft Managed Desktop devices must be allowed to enroll in Intune. -**Not ready** --You currently have at least one enrollment restriction policy configured to prevent Windows devices from enrollment in Intune. Follow the steps in [Set enrollment restrictions](/mem/intune/enrollment/enrollment-restrictions-set) for each enrollment restriction policy that targets Microsoft Managed Desktop users and change the **Windows (MDM)** setting to **Allow**. You can, however, set any **personally owned** **Windows (MDM)** devices to **Block**. -+| Result | Meaning | +| -- | -- | +| Not ready | You currently have at least one enrollment restriction policy configured to prevent Windows devices from enrollment in Intune. Follow the steps in [Set enrollment restrictions](/mem/intune/enrollment/enrollment-restrictions-set) for each enrollment restriction policy that targets Microsoft Managed Desktop users and change the **Windows (MDM)** setting to **Allow**. You can, however, set any **personally owned** **Windows (MDM)** devices to **Block**. | ### Enrollment Status Page You currently have the Enrollment Status Page (ESP) enabled. If you intend to participate in the Microsoft Managed Desktop public preview of this feature, you can ignore this item. For more information, see [First-run experience with Autopilot and the Enrollment Status Page](../get-started/esp-first-run.md). -**Not ready** --You have the ESP default profile set to **Show app and profile configuration progress**. Disable this setting or make sure that assignments to any Azure AD group do not include Microsoft Managed Desktop devices by following the steps in [Set up the Enrollment Status Page](/mem/intune/enrollment/windows-enrollment-status). --**Advisory** --Make sure that any profiles that have the **Show app and profile configuration progress** setting are not assigned to any Azure AD group that includes Microsoft Managed Desktop devices. For more information, see [Set up the Enrollment Status Page](/mem/intune/enrollment/windows-enrollment-status). +| Result | Meaning | +| -- | -- | +| Not ready | You have the ESP default profile set to **Show app and profile configuration progress**. Disable this setting or ensure that assignments to any Azure AD group don't include Microsoft Managed Desktop devices by following the steps in [Set up the Enrollment Status Page](/mem/intune/enrollment/windows-enrollment-status). | +| Advisory | Make sure that any profiles that have the **Show app and profile configuration progress** setting aren't assigned to any Azure AD group that includes Microsoft Managed Desktop devices. For more information, see [Set up the Enrollment Status Page](/mem/intune/enrollment/windows-enrollment-status). | ### Microsoft Store for Business -We use Microsoft Store for Business and deploy the Company Portal app on Microsoft Managed Desktop to allow users to optionally install some apps, such as Microsoft Project and Microsoft Visio (where permitted). --**Not ready** --Microsoft Store for Business either isn't enabled or isn't synced with Intune. For more information, see [How to manage volume purchased apps from the Microsoft Store for Business with Microsoft Intune](/mem/intune/apps/windows-store-for-business) and [Install Intune Company Portal on devices](../get-started/company-portal.md). --### Multifactor authentication --Multifactor authentication must not prevent Microsoft Managed Desktop from managing your Azure AD organization (tenant) in Intune and Azure AD. ---**Not ready** +We use Microsoft Store for Business and deploy the Company Portal app on Microsoft Managed Desktop. This method allows users to optionally install some apps, such as Microsoft Project and Microsoft Visio (where permitted). -You have some multifactor authentication policies set as **required** for conditional access policies that are assigned to all users. During enrollment, we will exclude Microsoft Managed Desktop service accounts from relevant conditional access policies and apply new conditional access policies to restrict access to these accounts. For more about these service accounts, see [Standard operating procedures](../service-description/operations-and-monitoring.md#standard-operating-procedures). +| Result | Meaning | +| -- | -- | +| Not ready | Microsoft Store for Business either isn't enabled or isn't synced with Intune. For more information, see [How to manage volume purchased apps from the Microsoft Store for Business with Microsoft Intune](/mem/intune/apps/windows-store-for-business) and [Install Intune Company Portal on devices](../get-started/company-portal.md). | -**Advisory** +### Multi-factor authentication -You have multifactor authentication required on conditional access policies that could prevent Microsoft Managed Desktop from managing the Microsoft Managed Desktop service. During enrollment, we will exclude Microsoft Managed Desktop service accounts from relevant conditional access policies and apply new conditional access policies to restrict access to these accounts. For more about these service accounts, see [Standard operating procedures](../service-description/operations-and-monitoring.md#standard-operating-procedures). --**Error** --The Intune Administrator role doesn't have sufficient permissions for this check. You'll also need any of these Azure AD roles assigned to run this check: --- Security Reader-- Security Administrator-- Conditional Access Administrator-- Global Reader-- Devices Administrator+Multi-factor authentication can't prevent Microsoft Managed Desktop from managing your Azure AD organization (tenant) in Intune and Azure AD. +| Result | Meaning | +| -- | -- | +| Not ready | You have some multi-factor authentication policies set as **required** for conditional access policies that are assigned to all users. During enrollment, we'll exclude Microsoft Managed Desktop service accounts from relevant conditional access policies and apply new conditional access policies to restrict access to these accounts. For more information about these service accounts, see [Standard operating procedures](../service-description/operations-and-monitoring.md#standard-operating-procedures). | +| Advisory | You have multi-factor authentication required on conditional access policies that could prevent Microsoft Managed Desktop from managing the Microsoft Managed Desktop service. During enrollment, well exclude Microsoft Managed Desktop service accounts from relevant conditional access policies and apply new conditional access policies to restrict access to these accounts. For more information about these service accounts, see [Standard operating procedures](../service-description/operations-and-monitoring.md#standard-operating-procedures). | +| Error | The Intune Administrator role doesn't have sufficient permissions for this check. You'll also need to have these Azure AD roles assigned to run this check: <ul><li>Security Reader</li><li>Security Administrator</li><li>Conditional Access Administrator</li><li>Global Reader</li><li>Devices Administrator</li></ul> ### PowerShell scripts -Windows PowerShell scripts can't be assigned in a way that would target Microsoft Managed Desktop devices. +Windows PowerShell scripts can't be assigned in a way that would target Microsoft Managed Desktop devices. -**Advisory** --Make sure that Windows PowerShell scripts in your Azure AD organization don't target any Microsoft Manage Desktop devices or users. Do not assign a PowerShell script to target all users, all devices, or both. Change the policy to use an Assignment that targets a specific Azure AD group that doesn't include any Microsoft Managed Desktop devices or users. For more information, see [Use PowerShell scripts on Windows 10 devices in Intune](/mem/intune/apps/intune-management-extension). +| Result | Meaning | +| -- | -- | +| Advisory | Make sure that Windows PowerShell scripts in your Azure AD organization don't target any Microsoft Manage Desktop devices or users. Don't assign a PowerShell script to target all users, all devices, or both. Change the policy to use an Assignment that targets a specific Azure AD group that doesn't include any Microsoft Managed Desktop devices or users. For more information, see [Use PowerShell scripts on Windows 10 devices in Intune](/mem/intune/apps/intune-management-extension). | ### Region Your region must be supported by Microsoft Managed Desktop. -**Not ready** --Your Azure AD organization region isn't currently supported by Microsoft Managed Desktop. For more information, see [Microsoft Managed Desktop supported regions and languages](../service-description/regions-languages.md). --**Advisory** --One or more of the countries where your Azure AD organization is located isn't supported by Microsoft Managed Desktop. For more information, see [Microsoft Managed Desktop supported regions and languages](../service-description/regions-languages.md). -+| Result | Meaning | +| -- | -- | +| Not ready | Your Azure AD organization region isn't currently supported by Microsoft Managed Desktop. For more information, see [Microsoft Managed Desktop supported regions and languages](../service-description/regions-languages.md). | +| Advisory | One or more of the countries where your Azure AD organization is located isn't supported by Microsoft Managed Desktop. For more information, see [Microsoft Managed Desktop supported regions and languages](../service-description/regions-languages.md). | ### Security baselines -Security baseline policies should not target any Microsoft Managed Desktop devices. --**Not ready** --You have a security baseline profile that targets all users, all devices, or both. Change the policy to use an assignment that targets a specific Azure AD group that doesn't include any Microsoft Managed Desktop devices. For steps, see [Use security baselines to configure Windows 10 devices in Intune](/mem/intune/protect/security-baselines). During enrollment, we apply a new security baseline to all Microsoft Managed Desktop devices. After enrollment, you can review the Microsoft Managed Desktop security baseline policy in the **Configuration policy** area of Microsoft Endpoint Manager. +Security baseline policies shouldn't target any Microsoft Managed Desktop devices. -**Advisory** --Make sure that any security baseline policies you have exclude Microsoft Managed Desktop devices. For steps, see [Use security baselines to configure Windows 10 devices in Intune](/mem/intune/protect/security-baselines). During enrollment, we apply a new security baseline to all Microsoft Managed Desktop devices. The **Modern Workplace Devices -All** Azure AD group is a dynamic group that we create when you enroll in Microsoft Managed Desktop, so you'll have to come back to exclude this group after enrollment. +| Result | Meaning | +| -- | -- | +| Not ready | You have a security baseline profile that targets all users, all devices, or both. Change the policy to use an assignment that targets a specific Azure AD group that doesn't include any Microsoft Managed Desktop devices. <br><br> For more information, see [Use security baselines to configure Windows 10 devices in Intune](/mem/intune/protect/security-baselines). During enrollment, we apply a new security baseline to all Microsoft Managed Desktop devices. After enrollment, you can review the Microsoft Managed Desktop security baseline policy in the **Configuration policy** area of Microsoft Endpoint Manager. | +| Advisory | Make sure that any security baseline policies you have exclude Microsoft Managed Desktop devices. For more information, see [Use security baselines to configure Windows 10 devices in Intune](/mem/intune/protect/security-baselines). <br><br> During enrollment, we apply a new security baseline to all Microsoft Managed Desktop devices. The **Modern Workplace Devices -All** Azure AD group is a dynamic group that we create when you enroll in Microsoft Managed Desktop. You'll have to come back to exclude this group after enrollment. | ### Unlicensed admins -This setting must be enabled to avoid a "lack of permissions" error when we interact with your Azure AD organization. --**Not ready** +This setting must be enabled to avoid a "lack of permissions" error when we interact with your Azure AD organization. -**Allow access to unlicensed admins** should be enabled. For steps, see [Prerequisites for guest accounts](/microsoft-365/managed-desktop/get-ready/guest-accounts). +| Result | Meaning | +| -- | -- | +| Not ready | **Allow access to unlicensed admins** should be enabled. For more information, see [Prerequisites for guest accounts](/microsoft-365/managed-desktop/get-ready/guest-accounts). | ### Windows apps Review apps you want your Microsoft Managed Desktop users to have. -**Advisory** --You should prepare an inventory of the apps that you want your Microsoft Managed Desktop users to have. Since these apps must be deployed by Intune, evaluate reusing existing Intune apps. Consider using Company Portal (see [Install Intune Company Portal on devices](../get-started/company-portal.md) and Enrollment Status Page (ESP) to distribute apps to your users. For more information, see [Apps in Microsoft Managed Desktop](apps.md) and [First-run experience with Autopilot and the Enrollment Status Page](../get-started/esp-first-run.md). --You can ask your Microsoft account representative for a query in Microsoft Endpoint Configuration Manager to identify those apps that are ready to migrate to Intune or need adjustment. -+| Result | Meaning | +| -- | -- | +| Advisory | You should prepare an inventory of the apps that you want your Microsoft Managed Desktop users to have. Since these apps must be deployed by Intune, evaluate reusing existing Intune apps. Consider using Company Portal (see [Install Intune Company Portal on devices](../get-started/company-portal.md) and Enrollment Status Page (ESP) to distribute apps to your users. <br><br> For more information, see [Apps in Microsoft Managed Desktop](apps.md) and [First-run experience with Autopilot and the Enrollment Status Page](../get-started/esp-first-run.md). <br><br> You can ask your Microsoft account representative for a query in Microsoft Endpoint Configuration Manager to identify those apps that are ready to migrate to Intune or need adjustment. | ### Windows Hello for Business Microsoft Managed Desktop requires Windows Hello for Business to be enabled. -**Advisory** --Windows Hello for Business is either disabled or not set up. Enable it by following the steps in [Create a Windows Hello for Business policy](/mem/intune/protect/windows-hello#create-a-windows-hello-for-business-policy). -+| Result | Meaning | +| -- | -- | +| Advisory | Windows Hello for Business is either disabled or not set up. Enable it by following the steps in [Create a Windows Hello for Business policy](/mem/intune/protect/windows-hello#create-a-windows-hello-for-business-policy). | ### Windows 10 update rings Your "Windows 10 update ring" policy in Intune must not target any Microsoft Managed Desktop devices. -**Not ready** --You have an "update ring" policy that targets all devices, all users, or both. Change the policy to use an Assignment that targets a specific Azure AD group that doesn't include any Microsoft Managed Desktop devices. For steps, see [Manage Windows 10 software updates in Intune](/mem/intune/protect/windows-update-for-business-configure). --**Advisory** --Make sure that any update ring policies you have exclude the **Modern Workplace Devices -All** Azure AD group. If you have assigned Azure AD user groups to these policies, make sure that any update ring policies you have also excluded the **Modern Workplace -All** Azure AD group that you add your Microsoft Managed Desktop users to (or an equivalent group). For steps, see [Manage Windows 10 software updates in Intune](/mem/intune/protect/windows-update-for-business-configure). Both the **Modern Workplace Devices -All** and **Modern Workplace -All** Azure AD groups are groups that we create when you enroll in Microsoft Managed Desktop, so you'll have to come back to exclude this group after enrollment. -+| Result | Meaning | +| -- | -- | +| Not ready | You have an "update ring" policy that targets all devices, all users, or both. Change the policy to use an Assignment that targets a specific Azure AD group that doesn't include any Microsoft Managed Desktop devices. For steps, see [Manage Windows 10 software updates in Intune](/mem/intune/protect/windows-update-for-business-configure). | +| Advisory | Make sure that any update ring policies you have exclude the **Modern Workplace Devices -All** Azure AD group. If you have assigned Azure AD user groups to these policies, make sure that any update ring policies you have also excluded the **Modern Workplace -All** Azure AD group that you add your Microsoft Managed Desktop users to (or an equivalent group). <br><br> For more information, see [Manage Windows 10 software updates in Intune](/mem/intune/protect/windows-update-for-business-configure). Both the **Modern Workplace Devices -All** and **Modern Workplace -All** Azure AD groups are groups that we create when you enroll in Microsoft Managed Desktop. You'll have to come back to exclude this group after enrollment. | ## Azure Active Directory settings -You can access Azure Active Directory settings at the [Azure portal](https://portal.azure.com). +You can access Azure Active Directory settings in the [Azure portal](https://portal.azure.com). ### Intune enrollment Windows 10 devices in your Azure AD organization must be able to automatically enroll in Intune. -**Advisory** --Make sure the **MDM User scope** is set to **Some** or **All**, not **None**. If you choose **Some**, come back after enrollment and select the **Modern Workplace -All** Azure AD group for **Groups** or an equivalent group targeting all of your Microsoft Managed Desktop users. See [Set up enrollment for Windows devices by using Microsoft Intune](/mem/intune/enrollment/windows-enroll#enable-windows-10-automatic-enrollment). +| Result | Meaning | +| -- | -- | +| Advisory | Make sure the **MDM User scope** is set to **Some** or **All**, not **None**. <br><br> If you choose **Some**, come back after enrollment and select the **Modern Workplace -All** Azure AD group for **Groups** or an equivalent group targeting all of your Microsoft Managed Desktop users. For more information, see [Set up enrollment for Windows devices by using Microsoft Intune](/mem/intune/enrollment/windows-enroll#enable-windows-10-automatic-enrollment). | ### Ad hoc subscriptions -Advises how to check a setting that (if set to "false") might prevent Enterprise State Roaming from working correctly. --**Advisory** --Ensure that **AllowAdHocSubscriptions** is set to **True**. Otherwise, Enterprise State Roaming might not work. For more information, see [Set-MsolCompanySettings](/powershell/module/msonline/set-msolcompanysettings). +Advises how to check a setting that, if set to "false", might prevent Enterprise State Roaming from working correctly. +| Result | Meaning | +| -- | -- | +| Advisory | Ensure that **AllowAdHocSubscriptions** is set to **True**. Otherwise, Enterprise State Roaming might not work. For more information, see [Set-MsolCompanySettings](/powershell/module/msonline/set-msolcompanysettings). | ### Enterprise State Roaming Enterprise State Roaming should be enabled. -**Advisory** --Make sure that Enterprise State Roaming is enabled for **All** or for **Selected** groups. For more information, see [Enable Enterprise State Roaming in Azure Active Directory](/azure/active-directory/devices/enterprise-state-roaming-enable). +| Result | Meaning | +| -- | -- | +| Advisory | Make sure that Enterprise State Roaming is enabled for **All** or for **Selected** groups. For more information, see [Enable Enterprise State Roaming in Azure Active Directory](/azure/active-directory/devices/enterprise-state-roaming-enable). | ### Guest invitation settings Microsoft Managed Desktop recommends adjusting guest invitation settings, since the default setting allows all users and guests in your directory to invite guests. -**Advisory** --**Member users and users assigned to specific admin roles can invite guest users including guests with member permissions** should be enabled. For steps, see [Prerequisites for guest accounts](/microsoft-365/managed-desktop/get-ready/guest-accounts). +| Result | Meaning | +| -- | -- | +| Advisory | **Member users and users assigned to specific admin roles can invite guest including guests with member permissions** should be enabled. For more information, see [Prerequisites for guest accounts](/microsoft-365/managed-desktop/get-ready/guest-accounts). | ### Guest user access -Microsoft Managed Desktop recommends adjusting guest user access, since the default setting allows all guest users in your directory to have the same access as members. --**Advisory** +Microsoft Managed Desktop recommends adjusting guest access, since the default setting allows all guest in your directory to have the same access as members. -**Guest users have limited access to properties and memberships of directory objects** should be enabled. For steps, see [Prerequisites for guest accounts](/microsoft-365/managed-desktop/get-ready/guest-accounts). +| Result | Meaning | +| -- | -- | +| Advisory | **Guest users have limited access to properties and memberships of directory objects** should be enabled. For more information, see [Prerequisites for guest accounts](/microsoft-365/managed-desktop/get-ready/guest-accounts). | ### Licenses -A number of licenses are required to use Microsoft Managed Desktop. --**Not Ready** --You don't have all the licenses you need to use Microsoft Managed Desktop. For more information, see [Microsoft Managed Desktop technologies](../intro/technologies.md) and [More about licenses](prerequisites.md#more-about-licenses). +Many licenses are required to use Microsoft Managed Desktop. +| Result | Meaning | +| -- | -- | +| Not Ready | You don't have all the licenses you need to use Microsoft Managed Desktop. For more information, see [Microsoft Managed Desktop technologies](../intro/technologies.md) and [More about licenses](prerequisites.md#more-about-licenses). | ### Microsoft Managed Desktop service accounts Certain account names could conflict with account names created by Microsoft Managed Desktop to manage the Microsoft Managed Desktop service. -**Not ready** --You have at least one account name that will conflict with account names created by Microsoft Managed Desktop. Work with your Microsoft account representative to exclude these account names. We don't list the account names publicly to minimize security risk. -+| Result | Meaning | +| -- | -- | +| Not ready | You have at least one account name that will conflict with account names created by Microsoft Managed Desktop. Work with your Microsoft account representative to exclude these account names. We don't list the account names publicly to minimize security risk. ### Security administrator roles Users with certain security roles must have those roles assigned in Microsoft Defender for Endpoint. -**Advisory** --If you have users assigned to any of these roles in your Azure AD organization, make sure they also have these roles assigned in Microsoft Defender for Endpoint. Otherwise, administrators with these roles won't be able to access the Admin portal. --- Security Operator-- Global Reader--For more information, see [Create and manage roles for role-based access control](/windows/security/threat-protection/microsoft-defender-atp/user-roles). -+| Result | Meaning | +| -- | -- | +| Advisory | If you have users assigned to any of these roles in your Azure AD organization, make sure they also have these roles assigned in Microsoft Defender for Endpoint. Otherwise, administrators with these roles won't be able to access the Admin portal. <ul><li>Security Operator</li><li>Global Reader</li></ul> <br> For more information, see [Create and manage roles for role-based access control](/windows/security/threat-protection/microsoft-defender-atp/user-roles). ### Security default Security defaults in Azure Active Directory will prevent Microsoft Managed Desktop from managing your devices. -**Not ready** --You have Security defaults turned on. Turn off Security defaults and set up conditional access policies. For more information, see [Common Conditional Access policies](/azure/active-directory/conditional-access/concept-conditional-access-policy-common). +| Result | Meaning | +| -- | -- | +| Not ready | You have Security defaults turned on. Turn off Security defaults and set up conditional access policies. For more information, see [Common Conditional Access policies](/azure/active-directory/conditional-access/concept-conditional-access-policy-common). | ### Self-service Password Reset Self-service Password Reset (SSPR) can be enabled for all Microsoft Managed Desktop users excluding Microsoft Managed Desktop service accounts. For more information, see [Tutorial: Enable users to unlock their account or reset passwords using Azure Active Directory self-service password reset](/azure/active-directory/authentication/tutorial-enable-sspr). -**Advisory** --Make sure that the SSPR **Selected** setting includes Microsoft Managed Desktop users but excludes Microsoft Managed Desktop service accounts. Microsoft Managed Desktop service accounts cannot work as expected when SSPR is enabled. -+| Result | Meaning | +| -- | -- | +| Advisory | Make sure that the SSPR **Selected** setting includes Microsoft Managed Desktop users, but excludes Microsoft Managed Desktop service accounts. Microsoft Managed Desktop service accounts can't work as expected when SSPR is enabled. | ### Standard user role -Other than those users who are assigned Azure AD roles of Global administrator and Device administrator, Microsoft Managed Desktop users will be standard users without local administrator privileges. All other users will be assigned a standard user role when they start their Microsoft Managed Desktop device. +Other than the users who are assigned Global administrator and Device administrator Azure Active Directory roles, Microsoft Managed Desktop users will be standard users without local administrator privileges. All other users will be assigned a standard user role when they start their Microsoft Managed Desktop device. -**Advisory** --Microsoft Managed Desktop users will not have local administrator privileges on their Microsoft Managed Desktop devices after enrolling. +| Result | Meaning | +| -- | -- | +| Advisory | Microsoft Managed Desktop users won't have local administrator privileges on their Microsoft Managed Desktop devices after enrolling. | ## Microsoft 365 Apps for enterprise Microsoft Managed Desktop users will not have local administrator privileges on The **Allow syncing only on PCs joined to specific domains** setting will conflict with Microsoft Managed Desktop. You can access OneDrive settings at the OneDrive [admin center](https://admin.onedrive.com). -**Advisory** --You're using the **Allow syncing only on PCs joined to specific domains** setting. This setting won't work with Microsoft Managed Desktop. Disable this setting, and instead set up OneDrive to use a conditional access policy. See [Plan a Conditional Access deployment](/azure/active-directory/conditional-access/plan-conditional-access) for help. +| Result | Meaning | +| -- | -- | +| Advisory | You're using the **Allow syncing only on PCs joined to specific domains** setting. This setting won't work with Microsoft Managed Desktop. Disable this setting. Instead, set up OneDrive to use a conditional access policy. For more information, see [Plan a Conditional Access deployment](/azure/active-directory/conditional-access/plan-conditional-access) for help. | |
| managed-desktop | Readiness Assessment Tool | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/get-ready/readiness-assessment-tool.md | audience: Admin # Readiness assessment tools -For the smoothest possible experience when you enroll in Microsoft Managed Desktop, there are settings and other parameters you must set ahead of time, and certain device and network requirements to meet. One tool, accessed through the Microsoft Managed Desktop Admin portal, checks management-related settings. Another tool, which is downloadable, checks individual device requirements and network settings. You can use these tools to check those settings and receive detailed steps for fixing any that aren't right. +For the smoothest possible experience when you enroll in Microsoft Managed Desktop, there are settings and other parameters you must set ahead of time, and certain device and network requirements to meet. ++One tool, accessed through the Microsoft Managed Desktop Admin portal, checks management-related settings. Another tool, which is downloadable, checks individual device requirements and network settings. You can use these tools to check those settings and receive detailed steps for fixing any that aren't right. ## Downloadable readiness assessment checker for devices and network For details about using the downloadable readiness assessment checker, see [Down ## Online readiness assessment tool for management settings -The [online tool](https://aka.ms/mmdart) checks settings in Microsoft Endpoint Manager (specifically, Microsoft Intune), Azure Active Directory (Azure AD), and Microsoft 365 to ensure they will work with Microsoft Managed Desktop. Microsoft Managed Desktop retains the data associated with these checks for 12 months after the last time you run a check in your Azure AD organization (tenant). After 12 months, we retain it in de-identified form. You can choose to delete the data we collect. +The [online tool](https://aka.ms/mmdart) checks settings in Microsoft Endpoint Manager (specifically, Microsoft Intune), Azure Active Directory (Azure AD), and Microsoft 365 to ensure they'll work with Microsoft Managed Desktop. ++Microsoft Managed Desktop retains the data associated with these checks for 12 months after the last time you run a check in your Azure AD organization (tenant). After 12 months, we retain it in de-identified form. You can choose to delete the data we collect. -Anyone with at least the Global Reader or Intune Administrator role will be able to run this tool, but two of the checks ([Conditional access policies](readiness-assessment-fix.md#conditional-access-policies) and [Multifactor authentication](readiness-assessment-fix.md#multifactor-authentication) require additional permissions. +Anyone with at least the Global Reader or Intune Administrator role will be able to run this tool, but two of the checks ([Conditional access policies](readiness-assessment-fix.md#conditional-access-policies) and [Multi-factor authentication](readiness-assessment-fix.md#multi-factor-authentication) require extra permissions. > [!IMPORTANT] > The online readiness assessment tool helps you check your readiness to enroll in Microsoft Managed Desktop for the first time. If your organization is already enrolled in Microsoft Managed Desktop, don't use this tool. The assessment tool checks these items: ## Microsoft Intune settings -|Check |Description | -||| -|Autopilot deployment profile | Verifies that assignment of the Autopilot deployment profile does not apply to all devices (The profile should *not* be assigned to any Microsoft Managed Desktop devices.) | -|Certificate connectors | Checks the state of certificate connectors to ensure they are active | -|Conditional access | Verifies that conditional access policies are not assigned to all users (Conditional access policies should *not* be assigned to Microsoft Managed Desktop service accounts.) | -|Device Compliance policies | Checks that Intune compliance policies are not assigned to all users (The policies should *not* be assigned to any Microsoft Managed Desktop devices.) | -|Device Configuration profiles | Confirms that configuration profiles are not assigned to all users or all devices (Configuration profiles should *not* be assigned to any Microsoft Managed Desktop devices.) | -|Device type restrictions | Checks that Windows 10 devices in your organization are allowed to enroll in Intune | -|Enrollment Status Page | Confirms that Enrollment Status Page is not enabled | -|Intune enrollment | Verifies that Windows 10 devices in your Azure AD organization are automatically enrolled in Intune | -|Microsoft Store for Business | Confirms that Microsoft Store for Business is enabled and synced with Intune | -|Multi-factor authentication | Verifies that multi-factor authentication isn't applied to Microsoft Managed Desktop service accounts. -|PowerShell scripts | Checks that Windows PowerShell scripts are *not* assigned in a way that would target Microsoft Managed Desktop devices | -|Region | Checks that your region is supported by Microsoft Managed Desktop | -|Security baselines | Checks that the security baseline profile doesn't target all users or all devices (Security baseline policies should *not* target any Microsoft Managed Desktop devices.) | -|Windows apps | Review which apps you want to assign to Microsoft Managed Desktop devices | -|Windows Hello for Business | Checks that Windows Hello for Business is enabled | -|Windows 10 update ring | Checks that Intune's "Windows 10 update ring" policy doesn't target all users or all devices (The policy should *not* target any Microsoft Managed Desktop devices.) | +The following are the Microsoft Intune settings: ++| Check | Description | +| | | +| Autopilot deployment profile | Verifies that assignment of the Autopilot deployment profile doesn't apply to all devices. <br><br> The profile should **not** be assigned to any Microsoft Managed Desktop devices. | +| Certificate connectors | Checks the state of certificate connectors to ensure they're active. | +| Conditional access | Verifies that conditional access policies aren't assigned to all users. <br><br> Conditional access policies should **not** be assigned to Microsoft Managed Desktop service accounts. | +| Device Compliance policies | Checks that Intune compliance policies aren't assigned to all users. <br><br> The policies should **not** be assigned to any Microsoft Managed Desktop devices. | +| Device Configuration profiles | Confirms that configuration profiles aren't assigned to all users or all devices. <br><br> Configuration profiles should **not** be assigned to any Microsoft Managed Desktop devices. | +| Device type restrictions | Checks that Windows 10 devices in your organization are allowed to enroll in Intune. | +| Enrollment Status Page | Confirms that Enrollment Status Page isn't enabled. | +| Intune enrollment | Verifies that Windows 10 devices in your Azure AD organization are automatically enrolled in Intune. | +| Microsoft Store for Business | Confirms that Microsoft Store for Business is enabled and synced with Intune. | +| Multi-factor authentication | Verifies that multi-factor authentication isn't applied to Microsoft Managed Desktop service accounts. | +| PowerShell scripts | Checks that Windows PowerShell scripts are **not** assigned in a way that would target Microsoft Managed Desktop devices. | +| Region | Checks that your region is supported by Microsoft Managed Desktop. | +| Security baselines | Checks that the security baseline profile doesn't target all users or all devices. <br><br> Security baseline policies should **not** target any Microsoft Managed Desktop devices. | +| Windows apps | Review which apps you want to assign to Microsoft Managed Desktop devices. | +| Windows Hello for Business | Checks that Windows Hello for Business is enabled. | +| Windows 10 update ring | Checks that Intune's "Windows 10 update ring" policy doesn't target all users or all devices. <br><br> The policy should **not** target any Microsoft Managed Desktop devices. | ## Azure Active Directory settings -|Check |Description | -||| -|"Ad hoc" subscriptions for Enterprise State Roaming | Advises how to check a setting that (if set to "false") might prevent Enterprise State Roaming from working correctly | -|Enterprise State Roaming | Advises how to check that Enterprise State Roaming is enabled | -|Licenses | Checks that you have obtained the necessary [licenses](prerequisites.md#more-about-licenses) | -|Multi-factor authentication | Checks that multi-factor authentication is not applied to all users (multi-factor authentication must not accidentally be applied to Microsoft Managed Desktop service accounts.)| -|Security account names | Checks that no user names conflict with ones that Microsoft Managed Desktop reserves for its own use | -|Security administrator roles | Confirms that users with Security Reader, Security Operator, or Global Reader roles have been assigned those roles in Microsoft Defender for Endpoint | -|Security defaults | Checks whether your Azure AD organization has security defaults enabled in Azure Active Directory | -|Self-service password reset | Confirms that self-service password reset is enabled | -|Standard user role | Verifies that users are standard users and do not have local administrator rights | +The following are the Azure Active Directory settings: ++| Check | Description | +| -- | -- | +| "Ad hoc" subscriptions for Enterprise State Roaming | Advises how to check a setting that, if set to "false", might prevent Enterprise State Roaming from working correctly. | +| Enterprise State Roaming | Advises how to check that Enterprise State Roaming is enabled. | +| Licenses | Checks that you've obtained the necessary [licenses](prerequisites.md#more-about-licenses). | +| Multi-factor authentication | Checks that multi-factor authentication isn't applied to all users. <br><br> Multi-factor authentication must **not** accidentally be applied to Microsoft Managed Desktop service accounts. | +| Security account names | Checks that no user names conflict with ones that Microsoft Managed Desktop reserves for its own use. | +| Security administrator roles | Confirms that users with Security Reader, Security Operator, or Global Reader roles have been assigned those roles in Microsoft Defender for Endpoint. | +| Security defaults | Checks whether your Azure AD organization has security defaults enabled in Azure Active Directory. | +| Self-service password reset | Confirms that self-service password reset is enabled. | +| Standard user role | Verifies that users are standard users and don't have local administrator rights. | ++## Microsoft 365 Apps for Enterprise settings -## Microsoft 365 Apps for enterprise settings +The following are the Microsoft 365 Apps for Enterprise settings: -|Check |Description | -||| -|OneDrive for Business | Checks whether OneDrive for Business is using unsupported settings. | +| Check | Description | +| -- | -- | +| OneDrive for Business | Checks whether OneDrive for Business is using unsupported settings. | For each check, the tool will report one of four possible results: -|Result |Meaning | -||| -|Ready | No action is required before you complete enrollment. | -|Advisory | Follow the steps in the tool for the best experience with enrollment and for users. You *can* complete enrollment, but you must fix these issues before you deploy your first device. | -|Not ready | *Enrollment will fail* if you don't fix these issues. Follow the steps in the tool to resolve them. | -|Error | The Azure Active Director (AD) role you're using doesn't have sufficient permission to run this check. | +| Result | Meaning | +| -- | -- | +| Ready | No action is required before you complete enrollment. | +| Advisory | Follow the steps in the tool for the best experience with enrollment and for users. <br><br> You *can* complete enrollment, but you must fix these issues before you deploy your first device. | +| Not ready | **Enrollment will fail** if you don't fix these issues. <br><br> Follow the steps in the tool to resolve them. | +| Error | The Azure Active Director (AD) role you're using doesn't have sufficient permission to run this check. | ## After enrollment -After you've completed enrollment in Microsoft Managed Desktop, remember to go back and adjust certain Intune and Azure AD settings. For details, see [Adjust settings after enrollment](../get-started/conditional-access.md). +After you've completed enrollment in Microsoft Managed Desktop, remember to go back and adjust certain Intune and Azure AD settings. For more information, see [Adjust settings after enrollment](../get-started/conditional-access.md). ## Steps to get ready for Microsoft Managed Desktop |
| managed-desktop | Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/working-with-managed-desktop/reports.md | When you select the **Reports** tab, you'll see descriptions for the available d | **Device status trend** (*in preview*) | This monitors trends in device status over the last 60 days for your Microsoft Managed Desktop devices. Trends can help you associate device status with other changes over time, for example, new deployments. | | [**Windows security updates** report](security-updates-report.md) (*in preview*) | This report shows how Windows security updates are released across your Microsoft Managed Desktop devices. | | [**Application usage** report](app-usage-report.md) | This report provides information about typical app usage across your Microsoft Managed Desktop devices. For devices to provide data to this report, they must be set to the Optional diagnostic data level. |+| **Service Metrics Report** (*in preview*) | This report provides straightforward summaries of key metrics for Microsoft Managed Desktop month over month. | ## Endpoint analytics If Endpoint analytics weren't automatically configured for your Azure AD organiz ## Intune reports -Microsoft Intune is one of the services we use to manage devices on your behalf. In some cases, it can be helpful to use Intune reports to specifically monitor administration of your Microsoft Managed Desktop devices. You can exclude the devices we manage from the report you use to manage other devices. The following reports let you filter capability to include or exclude Microsoft Managed Desktop devices. +Microsoft Intune is one of the services we use to manage devices on your behalf. ++In some cases, it can be helpful to use Intune reports to specifically monitor administration of your Microsoft Managed Desktop devices. You can exclude the devices we manage from the report you use to manage other devices. The following reports let you filter capability to include or exclude Microsoft Managed Desktop devices. - [All devices](/mem/intune/remote-actions/device-management#get-to-your-devices) - [Device compliance](/mem/intune/fundamentals/reports#device-compliance-report-organizational) |
| security | Microsoft 365 Zero Trust | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/Microsoft-365-zero-trust.md | In the illustration: For more information about this architecture, including deployment objectives for your entire digital estate, see [Zero Trust Rapid Modernization Plan (RaMP)](https://review.docs.microsoft.com/security/zero-trust/zero-trust-ramp-overview?branch=zt-content-prototype). --> -For more information about Zero Trust, see Microsoft's [**Zero Trust Guidance Center**](/security/zero-trust). +For more information about Zero Trust, see Microsoft's [_**Zero Trust Guidance Center**_](/security/zero-trust). ## Deploying Zero Trust for Microsoft 365 The first step is to build your Zero Trust foundation by configuring identity an -Go to [**Zero Trust identity and device access protection**](office-365-security/microsoft-365-policies-configurations.md) for prescriptive guidance to accomplish this. This series of articles describes a set of identity and device access prerequisite configurations and a set of Azure Active Directory (Azure AD) Conditional Access, Microsoft Intune, and other policies to secure access to Microsoft 365 for enterprise cloud apps and services, other SaaS services, and on-premises applications published with Azure AD Application Proxy. +Go to [**_Zero Trust identity and device access protection_**](office-365-security/microsoft-365-policies-configurations.md) for prescriptive guidance to accomplish this. This series of articles describes a set of identity and device access prerequisite configurations and a set of Azure Active Directory (Azure AD) Conditional Access, Microsoft Intune, and other policies to secure access to Microsoft 365 for enterprise cloud apps and services, other SaaS services, and on-premises applications published with Azure AD Application Proxy. Next, enroll your devices into management and begin protecting these with more s :::image type="content" source="../media/zero-trust/m365-zero-trust-architecture-step-2.png" alt-text="Manage endpoints with Intune" lightbox="../media/zero-trust/m365-zero-trust-architecture-step-2.png"::: -Go to [**Manage devices with Intune**](../solutions/manage-devices-with-intune-overview.md) for prescriptive guidance to accomplish this. +Go to [**_Manage devices with Intune_**](../solutions/manage-devices-with-intune-overview.md) for prescriptive guidance to accomplish this. |Includes |Prerequisites |Doesn't include | With devices enrolled into management, you can now implement the full set of rec :::image type="content" source="../media/zero-trust/m365-zero-trust-architecture-enterprise-policies.png" alt-text="Zero Trust identity and access policies with device management" lightbox="../media/zero-trust/m365-zero-trust-architecture-enterprise-policies.png"::: -Return to [**Common identity and device access policies**](office-365-security/identity-access-policies.md) and add the policies in the Enterprise tier. +Return to [**_Common identity and device access policies_**](office-365-security/identity-access-policies.md) and add the policies in the Enterprise tier. :::image type="content" source="../media/zero-trust/identity-access-enterprise-tier.png" alt-text="Zero Trust identity and access policies ΓÇö Enterprise (recommended) tier" lightbox="../media/zero-trust/identity-access-enterprise-tier.png"::: Microsoft 365 Defender is an extended detection and response (XDR) solution that :::image type="content" source="../media/zero-trust/m365-zero-trust-architecture-defender.png" alt-text="Adding Microsoft 365 Defender to the Zero Trust architecture" lightbox="../media/zero-trust/m365-zero-trust-architecture-defender.png"::: -Go to [**Evaluate and pilot Microsoft 365 Defender**](defender/eval-overview.md) for a methodical guide to piloting and deploying Microsoft 365 Defender components. +Go to [**_Evaluate and pilot Microsoft 365 Defender_**](defender/eval-overview.md) for a methodical guide to piloting and deploying Microsoft 365 Defender components. |Includes |Prerequisites |Doesn't include | |||| Microsoft Information Protection provides a framework, process, and capabilities  -For more information on how to plan and deploy information protection, see [**Deploy a Microsoft Information Protection solution**](../compliance/information-protection-solution.md). +For more information on how to plan and deploy information protection, see [**_Deploy a Microsoft Information Protection solution_**](../compliance/information-protection-solution.md). -If you're deploying information protection for data privacy regulations, this solution guide provides a recommended framework for the entire process: [**Deploy information protection for data privacy regulations with Microsoft 365**](../solutions/information-protection-deploy.md). +If you're deploying information protection for data privacy regulations, this solution guide provides a recommended framework for the entire process: [**_Deploy information protection for data privacy regulations with Microsoft 365_**](../solutions/information-protection-deploy.md). |
| security | Old Index | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/old-index.md | - Title: Threat Protection (Windows 10) -description: Microsoft Defender for Endpoint is a unified platform for preventative protection, post-breach detection, automated investigation, and response. -keywords: threat protection, Microsoft Defender for Endpoint, attack surface reduction, next-generation protection, endpoint detection and response, automated investigation and response, microsoft threat experts, Microsoft Secure Score for Devices, advanced hunting, cyber threat hunting, web threat protection -search.product: eADQiWindows 10XVcnh -ms.sitesec: library -ms.pagetype: security ------- -# Threat Protection --**Applies to** -- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)--[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-advanced-threat-protection) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Defender for Endpoint protects endpoints from cyber threats, detects advanced attacks and data breaches, automates security incidents, and improves security posture. --> [!TIP] -> Enable your users to access cloud services and on-premises applications with ease and enable modern management capabilities for all devices. For more information, see [Secure your remote workforce](/enterprise-mobility-security/remote-work/). --<center><h2>Microsoft Defender for Endpoint</center></h2> -<table> -<tr> -<td><a href="#tvm"><center><img src="images/TVM_icon.png" alt="threat and vulnerability icon"> <br><b>Threat & vulnerability management</b></center></a></td> -<td><a href="#asr"><center><img src="images/asr-icon.png" alt="attack surface reduction icon"> <br><b>Attack surface reduction</b></center></a></td> -<td><center><a href="#ngp"><img src="images/ngp-icon.png" alt="next generation protection icon"><br> <b>Next-generation protection</b></a></center></td> -<td><center><a href="#edr"><img src="images/edr-icon.png" alt="endpoint detection and response icon"><br> <b>Endpoint detection and response</b></a></center></td> -<td><center><a href="#ai"><img src="images/air-icon.png" alt="automated investigation and remediation icon"><br> <b>Automated investigation and remediation</b></a></center></td> -<td><center><a href="#mte"><img src="images/mte-icon.png" alt="microsoft threat experts icon"><br> <b>Microsoft Threat Experts</b></a></center></td> -</tr> -<tr> -<td colspan="7"> -<a href="#apis"><center><b>Centralized configuration and administration, APIs</a></b></center></td> -</tr> -<tr> -<td colspan="7"><a href="#mtp"><center><b>Microsoft 365 Defender</a></center></b></td> -</tr> -</table> -<br> --<a name="tvm"></a> --> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4obJq] --**[Threat & vulnerability management](next-gen-threat-and-vuln-mgt.md)**<br> -This built-in capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations. --- [Threat & vulnerability management overview](next-gen-threat-and-vuln-mgt.md)-- [Get started](tvm-prerequisites.md)-- [Access your security posture](tvm-dashboard-insights.md)-- [Improve your security posture and reduce risk](tvm-security-recommendation.md)-- [Understand vulnerabilities on your devices](tvm-software-inventory.md)--<a name="asr"></a> --**[Attack surface reduction](overview-attack-surface-reduction.md)**<br> -The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitation. --- [Hardware based isolation](overview-hardware-based-isolation.md)-- [Application control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)-- [Device control](/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control)-- [Exploit protection](exploit-protection.md)-- [Network protection](network-protection.md), [web protection](web-protection-overview.md)-- [Controlled folder access](controlled-folders.md)-- [Network firewall](/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security)-- [Attack surface reduction rules](attack-surface-reduction.md)--<a name="ngp"></a> --**[Next-generation protection](/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10)**<br> -To further reinforce the security perimeter of your network, Microsoft Defender for Endpoint uses next-generation protection designed to catch all types of emerging threats. --- [Behavior monitoring](/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus)-- [Cloud-based protection](/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus)-- [Machine learning](/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus)-- [URL Protection](/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus)-- [Automated sandbox service](/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus)--<a name="edr"></a> --**[Endpoint detection and response](overview-endpoint-detection-response.md)**<br> -Endpoint detection and response capabilities are put in place to detect, investigate, and respond to intrusion attempts and active breaches. With Advanced hunting, you have a query-based threat-hunting tool that lets your proactively find breaches and create custom detections. --- [Alerts](alerts-queue.md)-- [Historical endpoint data](investigate-machines.md#timeline)-- [Response orchestration](/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts)-- [Forensic collection](respond-machine-alerts.md#collect-investigation-package-from-devices)-- [Threat intelligence](threat-indicator-concepts.md)-- [Advanced detonation and analysis service](respond-file-alerts.md#deep-analysis)-- [Advanced hunting](advanced-hunting-overview.md)- - [Custom detections](overview-custom-detections.md) --<a name="ai"></a> --**[Automated investigation and remediation](automated-investigations.md)**<br> -In addition to quickly responding to advanced attacks, Microsoft Defender for Endpoint offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale. --- [Automated investigation and remediation](automated-investigations.md)-- [View details and results of automated investigations](auto-investigation-action-center.md)-- [View and approve remediation actions](manage-auto-investigation.md)--<a name="mte"></a> --**[Microsoft Threat Experts](microsoft-threat-experts.md)**<br> -Microsoft Defender for Endpoint's new managed threat hunting service provides proactive hunting, prioritization, and additional context and insights. Microsoft Threat Experts further empowers Security Operation Centers (SOCs) to identify and respond to threats quickly and accurately. --- [Targeted attack notification](microsoft-threat-experts.md)-- [Experts-on-demand](microsoft-threat-experts.md)-- [Configure your Microsoft 365 Defender managed hunting service](configure-microsoft-threat-experts.md)--<a name="apis"></a> --**[Centralized configuration and administration, APIs](management-apis.md)**<br> -Integrate Microsoft Defender for Endpoint into your existing workflows. -- [Onboarding](onboard-configure.md)-- [API and SIEM integration](configure-siem.md)-- [Exposed APIs](apis-intro.md)-- [Role-based access control (RBAC)](rbac.md)-- [Reporting and trends](threat-protection-reports.md)--<a name="integration"></a> -**[Integration with Microsoft solutions](threat-protection-integration.md)** <br> - Microsoft Defender for Endpoint directly integrates with various Microsoft solutions, including: -- Intune-- Microsoft Defender for Office 365-- Microsoft Defender for Identity-- Microsoft Defender for Cloud-- Skype for Business-- Microsoft Defender for Cloud Apps--<a name="mtp"></a> -**[Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-threat-protection)**<br> - With Microsoft 365 Defender, Microsoft Defender for Endpoint and various Microsoft security solutions form a unified pre- and post-breach enterprise defense suite that natively integrates across endpoint, identity, email, and applications to detect, prevent, investigate, and automatically respond to sophisticated attacks. |
| security | Partner Applications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/partner-applications.md | Logo|Partner name|Description :|:|: |[Aruba ClearPass Policy Manager](https://go.microsoft.com/fwlink/?linkid=2127544)|Ensure Defender for Endpoint is installed and updated on each endpoint before allowing access to the network |[Blue Hexagon for Network](https://go.microsoft.com/fwlink/?linkid=2104613)|Blue Hexagon has built the industry's first real-time deep learning platform for network threat protection+| [Corelight]( https://corelight.com/integrations/iot-security)| Using data, sent from Corelight network appliances, Microsoft 365 Defender gains increased visibility into the network activities of unmanaged devices, including communication with other unmanaged devices or external networks. |[CyberMDX](https://go.microsoft.com/fwlink/?linkid=2135620)|Cyber MDX integrates comprehensive healthcare assets visibility, threat prevention and repose into your Defender for Endpoint environment |[HYAS Protect](https://go.microsoft.com/fwlink/?linkid=2156763)|HYAS Protect utilizes authoritative knowledge of attacker infrastructure to proactively protect Microsoft Defender for Endpoint endpoints from cyberattacks |[Vectra Network Detection and Response (NDR)](https://go.microsoft.com/fwlink/?linkid=866934)|Vectra applies AI & security research to detect and respond to cyber-attacks in real time |
| security | Alert Grading Playbook Email Forwarding | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/alert-grading-playbook-email-forwarding.md | CloudAppEvents Run this query to find out if there were any anomalous login events from this user. For example: unknown IPs, new applications, uncommon countries, multiple LogonFailed events. ```kusto-let sender = "{SENDER}"; //Replace {SENDER} with email of the Forwarder IdentityLogonEvents +let sender = "{SENDER}"; //Replace {SENDER} with email of the Forwarder +IdentityLogonEvents | where AccountUpn == sender ``` |
| security | Alert Grading Playbook Inbox Forwarding Rules | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/alert-grading-playbook-inbox-forwarding-rules.md | let user_id = ""; // enter here the user id CloudAppEvents | where Timestamp between (start_date .. end_date) | where AccountObjectId == user_id+| where Application == @"Microsoft Exchange Online" | where ActionType in ("Set-Mailbox", "New-InboxRule", "Set-InboxRule") //set new inbox rule related operations | project Timestamp, ActionType, CountryCode, City, ISP, IPAddress, RuleConfig = RawEventData.Parameters, RawEventData ``` |
| security | Alert Grading Playbook Inbox Manipulation Rules | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/alert-grading-playbook-inbox-manipulation-rules.md | let user_id = ""; // enter here the user id CloudAppEvents | where Timestamp between (start_date .. end_date) | where AccountObjectId == user_id+| where Application == @"Microsoft Exchange Online" | where ActionType in ("Set-Mailbox", "New-InboxRule", "Set-InboxRule") //set new inbox rule related operations | project Timestamp, ActionType, CountryCode, City, ISP, IPAddress, RuleConfig = RawEventData.Parameters, RawEventData ``` |
| security | Custom Detection Rules | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/custom-detection-rules.md | DeviceEvents With the query in the query editor, select **Create detection rule** and specify the following alert details: -- **Detection name**ΓÇöname of the detection rule+- **Detection name**ΓÇöname of the detection rule; this name needs to be unique. - **Frequency**ΓÇöinterval for running the query and taking action. [See additional guidance below](#rule-frequency)-- **Alert title**ΓÇötitle displayed with alerts triggered by the rule+- **Alert title**ΓÇötitle displayed with alerts triggered by the rule; this title needs to be unique. - **Severity**ΓÇöpotential risk of the component or activity identified by the rule - **Category**ΓÇöthreat component or activity identified by the rule - **MITRE ATT&CK techniques**ΓÇöone or more attack techniques identified by the rule as documented in the [MITRE ATT&CK framework](https://attack.mitre.org/). This section is hidden for certain alert categories, including malware, ransomware, suspicious activity, and unwanted software |
| security | M365d Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-whats-new.md | - Title: What's new in Microsoft 365 security -description: Learn about new capabilities in Microsoft 365 security -keywords: new, m365 security, security, 365, capabilities -search.product: eADQiWindows 10XVcnh -ms.sitesec: library -ms.pagetype: security - - NOCSH ------ - MOE150 - - MET150 ---# What's new in Microsoft 365 Security ----**Applies to:** -- Microsoft 365 Defender----This topic will cover capabilities that are generally available (GA) in the latest release of Microsoft 365 Security. --For more information on preview features, see [Preview features](preview.md) -- |
| security | Configure Groups And Users For A Political Campaign Dev Test Environment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-groups-and-users-for-a-political-campaign-dev-test-environment.md | - Title: Configure groups & users - Political campaign dev/test environment - - NOCSH --- Previously updated : 12/15/2017--- - Ent_O365 - - Strat_O365_Enterprise -- - MET150 -description: "Summary: Create Office 365 and Enterprise Mobility + Security (EMS) trial subscriptions with users and groups for a political campaign dev/test environment." ----# Configure groups and users for a political campaign dev/test environment ---**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)-- **Summary:** Create Office 365 and Enterprise Mobility + Security (EMS) trial subscriptions with users and groups for a political campaign dev/test environment. --Use the instructions in this article to create a dev/test environment that includes simplified user accounts and groups for the [Microsoft Security Guidance for Political Campaigns, Nonprofits, and Other Agile Organizations](microsoft-security-guidance-for-political-campaigns-nonprofits-and-other-agile-o.md) solution. --## Phase 1: Create your Office 365 dev/test environment --In this phase, you obtain trial subscriptions for Office 365 E5 and Enterprise Mobility + Security (EMS) E5 for a fictional organization that represents a political campaign. --First, follow the instructions in **Phase 2** of [The lightweight base configuration](../../enterprise/lightweight-base-configuration-microsoft-365-enterprise.md). --Next, sign up for the EMS E5 trial subscription and add it to the same organization as your trial subscription. --1. If needed, sign in to the admin center with the credentials of the global administrator account of your trial subscription. For help, see [Where to sign in](https://support.microsoft.com/office/e9eb7d51-5430-4929-91ab-6157c5a050b4). --2. Click the **Admin** tile. --3. On the **Microsoft 365 admin center** tab in your browser, in the left navigation, click **Billing > Purchase services**. --4. On the **Purchase services** page, find the **Enterprise Mobility + Security E5** item. Hover your mouse pointer over it and click **Start free trial**. --5. On the **Confirm your order** page, click **Try now**. --6. On the **Order receipt** page, click **Continue**. --Next, enable the EMS E5 license for your global administrator account. --1. On the **Microsoft 365 admin center** tab in your browser, in the left navigation, click **Users > Active users**. --2. Click your global administrator account, and then click **Edit** for **Product licenses**. --3. On the **Product licenses** pane, turn the product license for **Enterprise Mobility + Security E5** to **On**, click **Save,** and then click **Close** twice. --## Phase 2: Create and configure your Azure Active Directory (AD) groups --In this phase, you create and configure the Azure AD groups for your campaign. --First, create a set of groups for a typical political campaign with the Azure portal. --1. On a separate tab in your browser, go to the Azure portal at <https://portal.azure.com>. If needed, sign in with the credentials of the global administrator account for your Office 365 E5 trial subscription. --2. In the Azure portal, click **Azure Active Directory > Users and groups > All groups**. --3. Do the following steps for each group name in this list: -- - Senior and strategic staff -- - IT staff -- - Analytics staff -- - Regular core staff -- - Operations staff -- - Field staff --1. On the **All groups** blade, click **+ New group**. --2. Type the group name from the list in **Name**. --3. Select **Dynamic user** in **Membership**. --4. Click **Yes** for **Enable Office features**. --5. Click **Add dynamic query**. --6. In **Add users where**, select **department**. --7. In the next field, select **Equals**. --8. In the next field, type the group name from the list. --9. Click **Add query**, and then click **Create**. --10. Click **Users and groups - All groups**. --Next, you configure the groups so that members are automatically assigned Office 365 E5 and EMS E5 licenses. --1. In the Azure portal, click **Azure Active Directory > Licenses > All products**. --2. In the list, select **Enterprise Mobility + Security E5** and **Office 365 Enterprise E5**, and then click **+ Assign**. --3. In the **Assign license** blade, click **Users and groups**. --4. In the list of groups, select the following: -- - Analytics staff -- - Field staff -- - IT staff -- - Operations staff -- - Regular core staff -- - Senior and strategic staff --5. Click **Select**, and then click **Assign**. --6. Close the Azure portal tab in your browser. --## Phase 3: Add your user accounts --In this phase, you add the example user accounts for your political campaign. --First, you [Connect with the Azure Active Directory PowerShell for Graph module](../../enterprise/connect-to-microsoft-365-powershell.md). --Next, you fill in your organization name, your location, and a common password, and then run these commands from the PowerShell command prompt or Integrated Script Environment (ISE): --```powershell -$orgName="<organization name, such as contoso for the contoso.onmicrosoft.com trial subscription domain name>" -$location="<the ISO ALPHA2 country code, such as US for the United States>" -$commonPassword="<common password for all the new accounts>" --$PasswordProfile=New-Object -TypeName Microsoft.Open.AzureAD.Model.PasswordProfile -$PasswordProfile.Password=$commonPassword --$deptName="Senior and strategic staff" -$userNames=@("Candidate","ChiefOfStaff","Strategic1") -foreach ($element in $userNames){ New-AzureADUser -DisplayName $element -PasswordProfile $PasswordProfile -UserPrincipalName ($element + "@" + $orgName + ".onmicrosoft.com") -AccountEnabled $true -MailNickName $element -Department $deptName -UsageLocation $location } -$deptName="IT staff" -$userNames=@("ITAdmin1","ITAdmin2") -foreach ($element in $userNames){ New-AzureADUser -DisplayName $element -PasswordProfile $PasswordProfile -UserPrincipalName ($element + "@" + $orgName + ".onmicrosoft.com") -AccountEnabled $true -MailNickName $element -Department $deptName -UsageLocation $location } -$deptName="Analytics staff" -$userNames=@("DataScientist1") -foreach ($element in $userNames){ New-AzureADUser -DisplayName $element -PasswordProfile $PasswordProfile -UserPrincipalName ($element + "@" + $orgName + ".onmicrosoft.com") -AccountEnabled $true -MailNickName $element -Department $deptName -UsageLocation $location } -$deptName="Regular core staff" -$userNames=@("Regular1","Regular2") -foreach ($element in $userNames){ New-AzureADUser -DisplayName $element -PasswordProfile $PasswordProfile -UserPrincipalName ($element + "@" + $orgName + ".onmicrosoft.com") -AccountEnabled $true -MailNickName $element -Department $deptName -UsageLocation $location } -$deptName="Operations staff" -$userNames=@("Operations1") -foreach ($element in $userNames){ New-AzureADUser -DisplayName $element -PasswordProfile $PasswordProfile -UserPrincipalName ($element + "@" + $orgName + ".onmicrosoft.com") -AccountEnabled $true -MailNickName $element -Department $deptName -UsageLocation $location } -$deptName="Field staff" -$userNames=@("FieldConsultant1") -foreach ($element in $userNames){ New-AzureADUser -DisplayName $element -PasswordProfile $PasswordProfile -UserPrincipalName ($element + "@" + $orgName + ".onmicrosoft.com") -AccountEnabled $true -MailNickName $element -Department $deptName -UsageLocation $location } -``` --> [!IMPORTANT] -> The use of a common password here is for automation and ease of configuration for a dev/test environment. This is not recommended for production subscriptions. As you sign in with each of these new user accounts, you will be prompted to change the password. --Use these steps to verify that dynamic group membership and group-based licensing are working correctly. --1. From the **Microsoft Office Home** tab of your browser, click the **Admin** tile. --2. From the new **Microsoft 365 admin center** tab of your browser, click **Users**. --3. In the list of users, click **Candidate**. --4. In the pane that lists the properties of the **Candidate** user account, verify that: -- - It is a member of the **Senior and strategic staff** group (in **Group memberships**). -- - It has been assigned the **Enterprise Mobility + Security E5** and **Office 365 Enterprise E5** licenses (in **Product licenses**). --5. Close the **Candidate** user account pane. --## Record values for future reference --Record these values for working with the Office 365 and EMS trial subscriptions for this dev/test environment: --- Your trial subscription organization name: -- For example, for the trial subscription domain name of contoso.onmicrosoft.com, the organization name is "contoso". --- The global administrator name: .onmicrosoft.com-- Record the password for this account and the common initial password for the other user accounts in a secure location. --## Next step --Build the four different types of SharePoint Online team sites in this dev/test environment with [Create team sites in a political campaign dev/test environment](create-team-sites-in-a-political-campaign-dev-test-environment.md). --## See also --[Microsoft Security Guidance for Political Campaigns, Nonprofits, and Other Agile Organizations](microsoft-security-guidance-for-political-campaigns-nonprofits-and-other-agile-o.md) --[Create team sites in a political campaign dev/test environment](create-team-sites-in-a-political-campaign-dev-test-environment.md) --[Cloud adoption Test Lab Guides (TLGs)](../../enterprise/cloud-adoption-test-lab-guides-tlgs.md) --[Cloud adoption and hybrid solutions](/office365/enterprise/cloud-adoption-and-hybrid-solutions) |
| security | Create Team Sites In A Political Campaign Dev Test Environment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/create-team-sites-in-a-political-campaign-dev-test-environment.md | - Title: Create team sites - Political campaign dev environment - - NOCSH --- Previously updated : 05/21/2018--- - Ent_O365 - - Strat_O365_Enterprise -- - MET150 --description: "Summary: Create public, private, sensitive, and highly confidential SharePoint Online team sites in your political campaign dev/test environment." ---# Create team sites in a political campaign dev/test environment ---**Applies to** --- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)-- **Summary:** Create public, private, sensitive, and highly confidential SharePoint Online team sites in your political campaign dev/test environment. --Use the instructions in this article to create a dev/test environment that includes the four different types of SharePoint Online team sites for the [Microsoft Security Guidance for Political Campaigns, Nonprofits, and Other Agile Organizations](microsoft-security-guidance-for-political-campaigns-nonprofits-and-other-agile-o.md) solution. These sites are described in detail on Topic 10, titled **SharePoint and OneDrive for Business**. --## Phase 1: Create your political campaign dev/test environment --First, follow the instructions in [Configure groups and users for a political campaign dev/test environment](configure-groups-and-users-for-a-political-campaign-dev-test-environment.md) to create your subscriptions, users, and groups. --## Phase 2: Create labels --In this phase, you create the labels for the different levels of security for SharePoint Online team site document folders. --1. If needed, sign in to the Microsoft 365 admin center (<https://admin.microsoft.com>) with the credentials of the global administrator account of your trial subscription. For help, see [Where to sign in to Microsoft 365](https://support.microsoft.com/office/e9eb7d51-5430-4929-91ab-6157c5a050b4). --2. From the **Home** page where you start, click **Show all**. In the **Admin centers** section that appears, click **Compliance**. --3. From the **Home** page of the Microsoft 365 compliance center, go to the **Solutions** section \> **Information protection**. To go directly to the **Information protection** page, use <https://compliance.microsoft.com//informationprotection>. --4. On the **Information protection** page, verify that the **Label** tag is selected, and then click  **Create a label**. --5. The **New sensitivity label** wizard opens. On the **Name & description** step, enter the following values: - - **Name**: Type **Internal**. - - **Display name** - - **Description for users** -- When you're finished, click **Next**. --6. On the **Label settings** pane, click **Next**. --7. On the **Review your settings** pane, click **Create this label**, and then click **Close**. --8. Repeat steps 5-8 for these additional labels: -- - Private - - Sensitive - - Highly Confidential --9. From the **Home > Labels** pane, click **Publish labels**. --10. On the **Choose labels to publish** pane, click **Choose labels to publish**. --11. On the **Choose labels** pane, click **Add** and select all four labels. --12. Click **Done**. --13. On the **Choose labels to publish** pane, click **Next**. --14. On the **Choose locations** pane, click **Next**. --15. On the **Name your policy** pane, type **Campaign** in **Name**, and then click **Next**. --16. On the **Review your settings** pane, click **Publish labels**, and then click **Close**. --## Phase 3: Create your SharePoint Online team sites --In this phase, you create and configure SharePoint Online team sites for your political campaign corresponding to the four types of SharePoint Online team sites. --### Campaign wide team site --To create a baseline public SharePoint Online team site, do the following: --1. If needed, use a browser on your local computer and sign in to the admin center (<https://admin.microsoft.com>) using your global administrator account. --2. In the list of tiles, click **SharePoint**. --3. On the new **SharePoint** tab in your browser, click **+ Create site**. --4. On the **Create a site** page, click **Team site**. --5. In **Site name**, type **Campaign wide**. --6. In **Team site description**, type **SharePoint site for the entire campaign**. --7. In **Privacy settings**, select **Public - anyone in the organization can access this site**, and then click **Next**. --8. On the **Who do you want to add?** pane, click **Finish**. --Next, configure the documents folder of the Campaign wide team site for the Internal label. --1. In the **Campaign wide-Home** tab of your browser, click **Documents**. --2. Click the settings icon, and then click **Library settings**. --3. Under **Permissions and Management**, click **Apply label to items in this library**. --4. In **Settings-Apply Label**, select **Internal**, and then click **Save**. --### Campaign project 1 team site --To create a baseline private SharePoint Online team site for a project within the campaign, do the following: --1. If needed, use a browser on your local computer and sign in to the admin center (<https://admin.microsoft.com>) using your global administrator account. --2. In the list of tiles, click **SharePoint**. --3. On the new **SharePoint** tab in your browser, click **+ Create site**. --4. On the **Create a site** page, click **Team site**. --5. In **Site name**, type **Campaign project 1**. --6. In **Team site description,** type **SharePoint site for Campaign project 1**. --7. In **Privacy settings**, select **Private - only members can access this site**, and then click **Next**. --8. On the **Who do you want to add?** pane, click **Finish**. --Next, configure the documents folder of the Campaign project 1 team site for the Private label. --1. In the **Campaign project 1-Home** tab of your browser, click **Documents**. --2. Click the settings icon, and then click **Library settings**. --3. Under **Permissions and Management**, click **Apply label to items in this library**. --4. In **Settings-Apply Label**, select **Private**, and then click **Save**. --### Campaign marketing team site --To create a sensitive-level isolated SharePoint Online team site for campaign marketing resources, do the following: --1. Using a browser on your local computer, sign in to the admin center (<https://admin.microsoft.com>) using your global administrator account. --2. In the list of tiles, click **SharePoint**. --3. On the new **SharePoint** tab in your browser, click **+ Create site**. --4. On the **Create a site** page, click **Team site**. --5. In **Team site name**, type **Campaign marketing**. --6. In **Team site description**, type **SharePoint site for campaign marketing (sensitive)**. --7. In **Privacy settings**, select **Private - only members can access this site**, and then click **Next**. --8. On the **Who do you want to add?** pane, click **Finish**. --9. On the new **Campaign marketing** tab in your browser, in the tool bar, click the settings icon, and then click **Site permissions**. --10. In the **Site permissions** pane, click **Advanced permissions settings**. --11. In the new **Permissions** tab in your browser, click **Access Request Settings**. --12. In the **Access Request Settings** dialog box, clear the **Allow members to share the site and individual files and folders** and **Allow members to invite others to the site members group** check boxes, type **ITAdmin1@**\<your organization name\>**.onmicrosoft.com** in **Send all requests for access**, and then click **OK**. --13. Click **Campaign marketing Members** in the list. --14. On the **People and Groups** page, click **New**. --15. In the **Share** dialog box, type **Senior and strategic staff**, select it, and then click **Share**. --16. Repeat steps 14 and 15 for the **Analytics staff** group and the **Regular1** user account. --17. Click the back button on your browser. --18. Click **Campaign marketing Owners** in the list. --19. On the **People and Groups** page, click **New**. --20. In the **Share** dialog box, type **IT staff**, select it, and then click **Share**. --21. Click the back button on your browser. --22. Close the **People and Groups** tab in your browser, click the **Campaign marketing-Home** tab in your browser, and then close the **Site permissions** pane. --Here are the results of configuring permissions: --- The **Campaign marketing-Members** SharePoint group contains only the **Senior and strategic staff** group (which contains the Candidate, ChiefOfStaff, and Strategic1 user accounts), the **Campaign marketing** group (which contains the global administrator user account), the **Analytics staff** group (which contains the DataScientist1 user account), and the **Regular1** user account.--- The **Campaign marketing-Owners** SharePoint group contains only the **IT staff** group (which contains only the ITAdmin1 and ITAdmin2 user accounts).--- The **Campaign marketing-Visitors** SharePoint group contains no groups or user accounts.--- Members cannot modify site-level permissions (this can only be done by members of the **Campaign marketing-Owners** group).--- Other user accounts cannot access the site or its resources, but can request access to the site, which will send an email to the ITAdmin1 user account mailbox.--Next, configure the documents folder of the Campaign marketing team site for the Sensitive label. --1. In the **Campaign marketing-Home** tab of your browser, click **Documents**. --2. Click the settings icon, and then click **Library settings**. --3. Under **Permissions and Management**, click **Apply label to items in this library**. --4. In **Settings-Apply Label**, select **Sensitive**, and then click **Save**. --Next, configure a data loss prevention (DLP) policy that notifies users when they share a document on a SharePoint Online team site with the Sensitive label outside the organization. This DLP policy will apply to resources in the Campaign marketing site. --1. From the **Microsoft Office Home** tab in your browser, click the **Security & Compliance** tile. --2. On the new **Security & Compliance** tab in your browser, click **Data loss prevention > Policy**. --3. In the **Data loss prevention** pane, click **+ Create a policy**. --4. In the **Start with a template or create a custom policy** pane, click **Custom**, and then click **Next**. --5. In the **Name your policy** pane, type **Sensitive label SharePoint Online team sites** in **Name**, and then click **Next**. --6. In the **Choose locations** pane, click **Let me choose specific locations**, and then click **Next**. --7. In the list of locations, disable the **Exchange email** and **OneDrive accounts** locations, and then click **Next**. --8. In the **Customize the types of sensitive info you want to protect** pane, click **Edit**. --9. In the **Choose the types of content to protect** pane, click **Add** in the drop-down box, and then click **Labels**. --10. In the **Labels** pane, click **+ Add**, select the **Sensitive** label, click **Add**, and then click **Done**. --11. In the **Choose the types of content to protect** pane, click **Save**. --12. In the **Customize the types of sensitive info you want to protect** pane, click **Next**. --13. In the **What do you want to do if we detect sensitive info?** pane, click **Customize the tip and email**. --14. In the **Customize policy tips and email notifications** pane, click **Customize the policy tip text**. --15. In the text box, type or paste in the following: -- - To share with a user outside the organization, download the file and then open it. Click File, then Protect Document, and then Encrypt with Password, and then specify a strong password. Send the password in a separate email or other means of communication. --16. Click **OK**. --17. In the **What do you want to do if we detect sensitive info?** pane, clear the **Block people from sharing, and restrict access to shared content** check box, and then click **Next**. --18. In the **Do you want to turn on the policy or test things out first?** pane, click **Yes, turn it on right away**, and then click **Next**. --19. In the **Review your settings** pane, click **Create**, and then click **Close**. --### Campaign strategy team site --To create an isolated SharePoint Online team site at the highly confidential level for campaign strategy resources, do the following: --1. If needed, use a browser on your local computer and sign in to the admin center (<https://admin.microsoft.com>) using your global administrator account. --2. In the list of tiles, click **SharePoint**. --3. On the new **SharePoint** tab in your browser, click **+ Create site**. --4. On the **Create a site** page, click **Team site**. --5. In **Team site name**, type **Campaign strategy**. --6. In **Team site description**, type **SharePoint site for campaign strategy (highly confidential)**. --7. In **Privacy settings**, select **Private - only members can access this site**, and then click **Next**. --8. On the **Who do you want to add?** pane, click **Finish**. --9. On the new **Campaign strategy** tab in your browser, in the tool bar, click the settings icon, and then click **Site permissions**. --10. In the **Site permissions** pane, click **Advanced permissions settings**. --11. In the new **Permissions** tab in your browser, click **Access Request Settings**. --12. In the **Access Request Settings** dialog box, clear **Allow members to share the site and individual files and folders** and **Allow members to invite others to the site members group** (so that all three check boxes are cleared), and then click **OK**. --13. Click **Campaign strategy Members** in the list. --14. On the **People and Groups** page, click **New**. --15. In the **Share** dialog box, type **Senior and strategic staff**, select it, and then click **Share**. --16. Click **Campaign strategy Owners** in the list. --17. On the **People and Groups** page, click **New**. --18. In the **Share** dialog box, type **IT staff**, select it, and then click **Share**. --19. Click the back button on your browser. --20. Close the **People and Groups** tab in your browser, click the **Campaign strategy-Home** tab in your browser, and then close the **Site permissions** pane. --Here are the results of configuring permissions: --- The **Campaign strategy-Members** SharePoint group contains only the **Senior and strategic staff** group (which contains only the Candidate, ChiefOfStaff, and Strategic1 user accounts) and the **Campaign strategy** group (which contains only the global administrator user account).--- The **Campaign strategy-Owners** SharePoint group contains only the **IT staff** group (which contains only the ITAdmin1 and ITAdmin2 user accounts).--- The **Campaign strategy-Visitors** SharePoint group contains no groups or user accounts.--- Members cannot modify site-level permissions (this can only be done by members of the **Campaign strategy-Owners** group).--- Other user accounts cannot access the site or its resources or request access to the site. Additional permissions to the site must be done by the global administrator or by a member of the **Campaign strategy-Owners** group.--Next, configure the documents folder of the Campaign strategy team site for the Highly Confidential label. --1. In the **Campaign strategy-Home** tab of your browser, click **Documents**. --2. Click the settings icon, and then click **Library settings**. --3. Under **Permissions and Management**, click **Apply label to items in this library**. --4. In **Settings-Apply Label**, select **Highly Confidential**, and then click **Save**. --Next, configure a DLP policy that blocks users when they share a document on a SharePoint Online team site with the Highly Confidential label outside the organization. This DLP policy will apply to resources in the Campaign strategy site. --1. If needed, use a browser on your local computer and sign in to the admin center (<https://admin.microsoft.com>) with an account that has the Security Administrator or Company Administrator role. --2. From the **Microsoft Office Home** tab in your browser, click the **Security & Compliance** tile. --3. On the new **Security & Compliance** tab in your browser, click **Data loss prevention > Policy**. --4. In the **Data loss prevention** pane, click **+ Create a policy**. --5. In the **Start with a template or create a custom policy** pane, click **Custom**, and then click **Next**. --6. In the **Name your policy** pane, type **Highly Confidential label SharePoint Online team sites** in **Name**, and then click **Next**. --7. In the **Choose locations** pane, click **Let me choose specific locations**, and then click **Next**. --8. In the list of locations, disable the **Exchange email** and **OneDrive accounts** locations, and then click **Next**. --9. In the **Customize the types of sensitive info you want to protect** pane, click **Edit**. --10. In the **Choose the types of content to protect** pane, click **Add** in the drop-down box, and then click **Labels**. --11. In the **Labels** pane, click **+ Add**, select the **Highly Confidential** label, click **Add**, and then click **Done**. --12. In the **Choose the types of content to protect** pane, click **Save**. --13. In the **Customize the types of sensitive info you want to protect** pane, click **Next**. --14. In the **What do you want to do if we detect sensitive info?** pane, click **Customize the tip and email**. --15. In the **Customize policy tips and email notifications** pane, click **Customize the policy tip text**. --16. In the text box, type or paste in the following: -- - To share with a user outside the organization, download the file and then open it. Click File, then Protect Document, and then Encrypt with Password, and then specify a strong password. Send the password in a separate email or other means of communication. --17. Click **OK**. --18. In the **What do you want to do if we detect sensitive info?** pane, select **Require a business justification to override**, and then click **Next**. --19. In the **Do you want to turn on the policy or test things out first?** pane, click **Yes, turn it on right away**, and then click **Next**. --20. In the **Review your settings** pane, click **Create**, and then click **Close**. --Use the instructions in [Activate Azure RMS with the Microsoft 365 admin center](/information-protection/deploy-use/activate-office365). --Next, configure Azure Information Protection with a new scoped policy and sub-label for protection and permissions with the following steps: --1. Sign in to the admin center with an account that has the Security Administrator or Company Administrator role. For help, see [Where to sign in to Office 365](https://support.microsoft.com/office/e9eb7d51-5430-4929-91ab-6157c5a050b4). --2. In a separate tab of your browser, go to the Azure portal (<https://portal.azure.com>). --3. In the search pane, type **information**, and then click **Azure Information Protection**. --4. Click **Labels**. --5. Right-click the **Highly Confidential** label, and then click **Add a sub-label**. --6. Type **CampaignStrategy** in **Name** and **Label for documents in the Campaign strategy team site** in **Description**. --7. In **Set permissions for documents and emails containing this label**, click **Protect**. --8. In the **Protection** section, click **Azure (cloud key)**. --9. On the **Protection** blade, under **Protection settings**, click **+ Add permissions**. --10. On the **Add permissions** blade, under **Specify users and groups**, click **+ Browse directory**. --11. On the **AAD Users and Groups** pane, select **Senior and strategic staff**, and then click **Select**. --12. Under **Choose permissions from the preset or set custom**, click **Custom**, and then click the **View Rights**, **Edit Content**, **Save**, **Reply**, and **Reply all** check boxes. --13. Click **OK** twice. --14. On the **Sub-label** blade, click **Save**, and then click **OK**. --15. On the **Azure Information protection** blade, click **Policies > + Add a new policy**. --16. Type **CampaignStrategy** in **Name** and **Documents in the Campaign strategy team site** in **Description**. --17. Click **Select which users or groups get this policy > User/Groups**, and then select **Senior and strategic staff**. --18. Click **Select \> OK**. --19. Click **Add or remove labels**. In the **Policy: Add or remove labels** pane, click **CampaignStrategy**, and then click **OK**. --20. Click **Save**, and then click **OK**. --You are now ready to begin creating documents in these four sites and test access to them with various user accounts. --To protect a document with Azure Information Protection and this new label, you must [install the Azure Information Protection client](/information-protection/rms-client/install-client-app) on a test machine, install Office from the admin center, and then sign in from Microsoft Word with an account in the **Senior and strategic staff** group of your trial subscription. --## See Also --[Microsoft Security Guidance for Political Campaigns, Nonprofits, and Other Agile Organizations](microsoft-security-guidance-for-political-campaigns-nonprofits-and-other-agile-o.md) --[Configure groups and users for a political campaign dev/test environment](configure-groups-and-users-for-a-political-campaign-dev-test-environment.md) --[Cloud adoption Test Lab Guides (TLGs)](../../enterprise/cloud-adoption-test-lab-guides-tlgs.md) --[Microsoft 365 solution and architecture center](../../solutions/index.yml) |
| security | Microsoft Security Guidance For Political Campaigns Nonprofits And Other Agile O | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/microsoft-security-guidance-for-political-campaigns-nonprofits-and-other-agile-o.md | This guidance describes how to implement a secure cloud environment. The solutio |**Microsoft Security Guidance for Nonprofits** <br> [](https://download.microsoft.com/download/9/4/3/94389612-C679-4061-8DF2-D9A15D72B65F/Microsoft_Cloud%20Architecture_Security%20for%20Nonprofits.pdf) <br> [PDF](https://download.microsoft.com/download/9/4/3/94389612-C679-4061-8DF2-D9A15D72B65F/Microsoft_Cloud%20Architecture_Security%20for%20Nonprofits.pdf) \| [Visio](https://download.microsoft.com/download/9/4/3/94389612-C679-4061-8DF2-D9A15D72B65F/Microsoft_Cloud%20Architecture_Security%20for%20Nonprofits.vsdx)|This guide is slightly revised for nonprofit organizations. For example, it references Office 365 Nonprofit plans. The technical guidance is the same as the political campaign solution guide.| | -## Test Lab Guides --To create a dev/test environment for this solution, use the following test lab guides: --- [Configure groups and users for a political campaign dev/test environment](configure-groups-and-users-for-a-political-campaign-dev-test-environment.md)-- Create trial subscriptions for Office 365 and EMS and then create groups and users for a representative political campaign. --- [Create team sites in a political campaign dev/test environment](create-team-sites-in-a-political-campaign-dev-test-environment.md)-- Create four SharePoint Online team sites with Internal, Private, Sensitive, and Highly Confidential levels of security. --For additional security features for demonstration or proof of concept, see [Office 365 Test Lab Guides](../../enterprise/cloud-adoption-test-lab-guides-tlgs.md). - ## See Also [Microsoft Cloud IT architecture resources](../../solutions/cloud-architecture-models.md) |
| solutions | Contoso Case Study Solutions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/contoso-case-study-solutions.md | Title: "Microsoft 365 solutions for the Contoso Corporation"- f1.keywords: - NOCSH--+++ Last updated 06/17/2020 audience: ITPro |
| solutions | Contoso Team For Top Secret Project | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/contoso-team-for-top-secret-project.md | Title: "Isolated team for a top-secret project of the Contoso Corporation" f1.keywords: - NOCSH---+++ Last updated 08/14/2020 audience: ITPro |
| solutions | Team Security Isolation Dev Test | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/team-security-isolation-dev-test.md | Title: "Configure a team with security isolation in a dev/test environment"- f1.keywords: - NOCSH--+++ Last updated 08/14/2020 audience: ITPro |
| solutions | Tenant Management Device Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/tenant-management-device-management.md | Title: Step 5. Device and app management for your Microsoft 365 for enterprise tenants---+++ ms.audience: ITPro ms.prod: microsoft-365-enterprise |
| solutions | Tenant Management Identity | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/tenant-management-identity.md | Title: Step 3. Identity for your Microsoft 365 for enterprise tenants---+++ ms.audience: ITPro ms.prod: microsoft-365-enterprise Here are the two types of identity models and their best fit and benefits. | Model | Description | How Microsoft 365 authenticates user credentials | Best for | Greatest benefit | |:-|:--|:--|:--|:--|-| Cloud-only | User account only exists in the Azure AD tenant for your Microsoft 365 tenant. | The Azure AD tenant for your Microsoft 365 tenant performs the authentication with the cloud identity account. | Organizations that do not have or need an on-premises AD DS. | Simple to use. No extra directory tools or servers required. | +| Cloud-only | User account only exists in the Azure AD tenant for your Microsoft 365 tenant. | The Azure AD tenant for your Microsoft 365 tenant performs the authentication with the cloud identity account. | Organizations that don't have or need an on-premises Active Directory. | Simple to use. No extra directory tools or servers required. | | Hybrid | User account exists in your on-premises Active Directory Domain Services (AD DS) and a copy is also in the Azure AD tenant for your Microsoft 365 tenant. Azure AD Connect runs on an on-premises server to synchronize AD DS changes to your Azure AD tenant. The user account in Azure AD might also include a hashed version of the already hashed AD DS user account password. | The Azure AD tenant for your Microsoft 365 tenant either handles the authentication process or redirects the user to another identity provider. | Organizations using AD DS or another identity provider. | Users can use the same credentials when accessing on-premises or cloud-based resources. | |||||| Here are the two types of authentication when using the hybrid identity model. | Authentication type | Description | |:-|:--|-| Managed authentication | Azure AD handles the authentication process by using a locally-stored hashed version of the password or sends the credentials to an on-premises software agent to be authenticated by the on-premises AD DS. <br> <br> There are two types of managed authentication: Password hash synchronization (PHS) and Pass-through authentication (PTA). With PHS, Azure AD performs the authentication itself. With PTA, Azure AD has AD DS perform the authentication. | +| Managed authentication | Azure AD handles the authentication process by using a locally stored hashed version of the password or sends the credentials to an on-premises software agent to be authenticated by the on-premises AD DS. <br> <br> There are two types of managed authentication: Password hash synchronization (PHS) and Pass-through authentication (PTA). With PHS, Azure AD performs the authentication itself. With PTA, Azure AD has AD DS perform the authentication. | | Federated authentication | Azure AD redirects the client computer requesting authentication to another identity provider. | | | | To increase the security of user sign-ins, use the features and capabilities in |:-|:--|:--|:--|:--| | Windows Hello for Business | Replaces passwords with strong two-factor authentication when signing on a Windows device. The two factors are a new type of user credential that is tied to a device and a biometric or PIN. | [Windows Hello for Business Overview](/windows/security/identity-protection/hello-for-business/hello-overview) | Microsoft 365 E3 or E5 | | Azure AD Password Protection | Detects and blocks known weak passwords and their variants and can also block additional weak terms that are specific to your organization. | [Configure Azure AD password protection](/azure/active-directory/authentication/concept-password-ban-bad) | Microsoft 365 E3 or E5 |-| Use multi-factor authentication (MFA) | MFA requires that user sign-ins be subject to an additional verification beyond the user account password, such as verification with a smartphone app or a text message sent to a smartphone. See [this video](https://support.microsoft.com/office/set-up-multi-factor-authentication-in-microsoft-365-business-a32541df-079c-420d-9395-9d59354f7225) for instructions on how users set up MFA. | [MFA for Microsoft 365 for enterprise](../enterprise/microsoft-365-secure-sign-in.md#mfa) | Microsoft 365 E3 or E5 | +| Use multi-factor authentication (MFA) | MFA requires that user sign-ins be subject to another verification beyond the user account password, such as verification with a smartphone app or a text message sent to a smartphone. See [this video](https://support.microsoft.com/office/set-up-multi-factor-authentication-in-microsoft-365-business-a32541df-079c-420d-9395-9d59354f7225) for instructions on how users set up MFA. | [MFA for Microsoft 365 for enterprise](../enterprise/microsoft-365-secure-sign-in.md#mfa) | Microsoft 365 E3 or E5 | | Identity and device access configurations | Settings and policies that consist of recommended prerequisite features and their settings combined with Conditional Access, Intune, and Azure AD Identity Protection policies that determine whether a given access request should be granted and under what conditions. | [Identity and device access configurations](../security/office-365-security/microsoft-365-policies-configurations.md) | Microsoft 365 E3 or E5 | | Azure AD Identity Protection | Protect against credential compromise, where an attacker determines a userΓÇÖs account name and password to gain access to an organizationΓÇÖs cloud services and data. | [Azure AD Identity Protection](/azure/active-directory/active-directory-identityprotection) | Microsoft 365 E5 or Microsoft 365 E3 with the Identity & Threat Protection add-on | | | | | Here is an example a tenant with the new hybrid identity elements highlighted. In this illustration, the tenant has: -- An AD DS forest that is being synchronized with the Azure AD tenant using a DirSync server and Azure AD Connect.+- An AD DS forest that is being synchronized with the Azure AD tenant using a directory synchronization server and Azure AD Connect. - A copy of the AD DS user accounts and other objects from the AD DS forest. - A set of Conditional Access policies to enforce secure user sign-ins and access based on the user account. |
| solutions | Tenant Management Migration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/tenant-management-migration.md | Title: Step 4. Migration for your Microsoft 365 for enterprise tenants---+++ ms.audience: ITPro ms.prod: microsoft-365-enterprise |
| solutions | Tenant Management Networking | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/tenant-management-networking.md | Title: Step 2. Optimal networking for your Microsoft 365 for enterprise tenants---+++ ms.audience: ITPro ms.prod: microsoft-365-enterprise |
| solutions | Tenant Management Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/tenant-management-overview.md | Title: Tenant management for Microsoft 365 for enterprise---+++ ms.audience: ITPro ms.prod: microsoft-365-enterprise |
| solutions | Tenant Management Tenants | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/tenant-management-tenants.md | Title: Step 1. Your Microsoft 365 for enterprise tenants---+++ ms.audience: ITPro ms.prod: microsoft-365-enterprise description: "Deploy and manage single or multiple Microsoft 365 tenants, with o # Step 1. Your Microsoft 365 for enterprise tenants -One of your first tenant decisions is how many to have. Each Microsoft 365 tenant is distinct, unique, and separate from all other Microsoft 365 tenants. ItΓÇÖs corresponding Azure AD tenant is also distinct, unique, and separate from all other Microsoft 365 tenants. +One of your first tenant decisions is how many to have. Each Microsoft 365 tenant is distinct, unique, and separate from all other Microsoft 365 tenants. Its corresponding Azure AD tenant is also distinct, unique, and separate from all other Microsoft 365 tenants. ## Single tenant Having a single tenant simplifies many aspects of your organizationΓÇÖs use of Microsoft 365. A single tenant means a single Azure AD tenant with a single set of accounts, groups, and policies. Permissions and sharing of resources across your organization can be done through this central identity provider. |
| solutions | Test Lab Guides Overview Solutions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/test-lab-guides-overview-solutions.md | Title: "Test Lab Guides for solutions and scenarios" f1.keywords: - NOCSH---+++ Last updated 02/09/2021 audience: ITPro |