| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| business-premium | Index | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/index.md | description: "Learn how to collaborate securely in your small business or campai In our current world, keeping data and communications secure is a priority, particularly for medical and legal practices, political campaigns, and many other smaller businesses. Take advantage of the security features in Microsoft 365 Business Premium to collaborate safely within your small business. This solution provides a set of recommendations designed to help protect you and your data. This library includes help for setting up and using this recommended environment, no matter your business type. -- This configuration includes the following guidance for productivity, collaboration, file storage, email, devices, and identity to protect your business: |
| contentunderstanding | Apply A Model | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/apply-a-model.md | After publishing your document understanding model, you can apply it to one or m ## Apply your model to a document library -To apply your model to to a SharePoint document library: +To apply your model to a SharePoint document library: 1. On model home page, on the **Apply model to libraries** tile, select **Apply model**. Or, in the **Where the model is applied** section, select **+Add library**.  -2. You can then select the SharePoint site that contains the document library that you want to apply the model to. If the site does not show in the list, use the search box to find it. +2. You can then select the SharePoint site that contains the document library that you want to apply the model to. If the site doesn't show in the list, use the search box to find it.  To apply your model to to a SharePoint document library:  -4. Because the model is associated to a content type, when you apply it to the library it will add the content type and its view with the labels you extracted showing as columns. By default, this view is the library's default view. However, you can optionally choose to not have it be the default view by selecting **Advanced settings** and clearing the **Set this new view as the default** checkbox. +4. Because the model is associated to a content type, when you apply it to the library it will add the content type and update the default view with the labels you extracted showing as columns. However, you can select **Advanced settings** to optionally choose to retain the current library view or to use a new view with model information and file thumbnails. If you choose to keep the current library view, the new views with model information are still available under the library's view menu. -  +  ++ For more information, see [Change the view in a document library](#change-the-view-in-a-document-library) later in this article. 5. Select **Add** to apply the model to the library. To apply your model to to a SharePoint document library: After applying the model to the document library, you can begin uploading documents to the site and see the results. -The model identifies any files and folders with the modelΓÇÖs associated content type and lists them in your view. If your model has any extractors, the view displays columns for the data you are extracting from each file or folder. +The model identifies any files and folders with the modelΓÇÖs associated content type and lists them in your view. If your model has any extractors, the view displays columns for the data you're extracting from each file or folder. > [!NOTE] > If two or more document understanding models are applied to the same library, the uploaded file is classified using the model that has the highest average confidence score. The extracted entities will be from the applied model only. <br><br>If a custom form processing model and document understanding model are applied to the same library, the file is classified using the document understanding model and any trained extractors for that model. If there are any empty columns that match the form processing model, the columns will be populated using those extracted values. To sync changes to one or only selected libraries: ## Apply the model to files and folder content already in the document library -While an applied model processes all files and folder content uploaded to the document library after it is applied, you can also do the following to run the model on files and folder content that already exist in the document library prior to the model being applied: +While an applied model processes all files and folder content uploaded to the document library after it's applied, you can also do the following to run the model on files and folder content that already exist in the document library prior to the model being applied: 1. In your document library, select the files and folders that you want to be processed by your model. To run the flow:  +## Change the view in a document library ++There are multiple ways to view how you see the information in a SharePoint document library. You can change the view in your document library to fit your needs or preferences. ++To change the view on the library page, select the view dropdown menu to show the options, and then select the view you want to use. ++  ++For example, if you select **Tiles** from the list, the page will display as shown. ++  ++The **Tiles** view displays up to eight user-created fields. If there are fewer than eight, up to four system-generated fields are shown: Sensitivity (if available), Retention (if available), Content type, Modified date, Modified by, and Classification date. ++To edit any current view, on the view dropdown menu, select **Edit current view**. + ## See Also [Create a classifier](create-a-classifier.md) |
| managed-desktop | Privacy Personal Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/service-description/privacy-personal-data.md | audience: Admin, ITPro ms.localizationpriority: medium -# Overview +# Privacy -Microsoft Managed Desktop is an IT-as-a-Service (ITaaS) service for enterprise cloud customers designed to keep employeesΓÇÖ Windows devices deployed and updated. It also provides IT service management and operations, monitors security and incident response, as well as providing user support. This documentation provides additional details on data platform and privacy compliance for Microsoft Managed Desktop. +Microsoft Managed Desktop is an IT-as-a-Service (ITaaS) service for enterprise cloud customers designed to keep employees' Windows devices deployed and updated. ++It also provides IT service management and operations, monitors security and incident response, and user support. This article provides more details on data platform and privacy compliance for Microsoft Managed Desktop. ## Microsoft Managed Desktop data sources and purpose -Microsoft Managed Desktop provides its service to enterprise customers and properly administers customersΓÇÖ enrolled devices by using data from various sources. These sources, including Azure Active Directory, Microsoft Intune, Microsoft Windows 10, and Microsoft Defender for Endpoint, provide a comprehensive view of the devices that Microsoft Managed Desktop manages. The service also uses these Microsoft services to enable Microsoft Managed Desktop to provide ITaaS capabilities: +Microsoft Managed Desktop provides its service to enterprise customers, and properly administers customers' enrolled devices by using data from various sources. ++These sources include Azure Active Directory, Microsoft Intune, Microsoft Windows 10, and Microsoft Defender for Endpoint. They provide a comprehensive view of the devices that Microsoft Managed Desktop manages. The service also uses these Microsoft services to enable Microsoft Managed Desktop to provide ITaaS capabilities: -- [Microsoft Windows 10 Enterprise](/windows/windows-10/) - for management of device setup experience, managing connections to other services, and operational support for IT pros.-- [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb) - uses Windows 10 Enterprise diagnostic data to provide additional information on Windows 10 update. -- [Microsoft Endpoint Manager](/mem/endpoint-manager-overview) ΓÇô for device management and to keep your data secure.- - [Microsoft Azure Active Directory](/azure/active-directory/) - for authentication and identification of all user accounts. - - [Microsoft Intune](/mem/intune/) ΓÇô for distributing device configurations, device management and application management. - - [Endpoint Analytics](/mem/analytics/overview) ΓÇô for analytical insights about device and app usage. - - [Windows Autopilot](/microsoft-365/windows/windows-autopilot) ΓÇô for device provisioning and deployment. - - [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) ΓÇô provides security services such as device security monitoring and security intelligence data. -- [Microsoft Managed Desktop](https://endpoint.microsoft.com/#home) ΓÇô Data provided by the customer or generated by the service during running of the service.-- [Microsoft 365 apps for enterprise](https://www.microsoft.com/en-us/microsoft-365/enterprise/compare-office-365-plans?rtc=1) ΓÇô for management of Microsoft 365 Apps.+| Data source | Purpose | +| | | +| [Microsoft Windows 10 Enterprise](/windows/windows-10/) | Management of device setup experience, managing connections to other services, and operational support for IT pros. | +| [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb) | Uses Windows 10 Enterprise diagnostic data to provide additional information on Windows 10 update. | +| [Microsoft Endpoint Manager](/mem/endpoint-manager-overview) | Device management and to keep your data secure. The following data sources fall under Microsoft Endpoint +| [Microsoft Managed Desktop](https://endpoint.microsoft.com/#home) | Data provided by the customer or generated by the service during running of the service. | +| [Microsoft 365 apps for enterprise](https://www.microsoft.com/en-us/microsoft-365/enterprise/compare-office-365-plans?rtc=1)| Management of Microsoft 365 Apps. ## Microsoft Managed Desktop data process and storage -Microsoft Managed Desktop relies on data from multiple Microsoft products and services to provide its service to enterprise customers. To accomplish the goal of protecting and maintaining enrolled devices, we process and copy data from these services to Microsoft Managed Desktop. When we process data, we follow the documented directions you provide, as referenced in the [Online Services Terms](https://www.microsoft.com/licensing/product-licensing/products) and [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft Managed DesktopΓÇÖs processor duties include ensuring appropriate confidentiality, security, and resilience. Microsoft Managed Desktop employs additional privacy and security measures to ensure proper handling of personal identifiable data. +Microsoft Managed Desktop relies on data from multiple Microsoft products and services to provide its service to enterprise customers. ++To protect and maintain enrolled devices, we process and copy data from these services to Microsoft Managed Desktop. When we process data, we follow the documented directions you provide, as referenced in the [Online Services Terms](https://www.microsoft.com/licensing/product-licensing/products) and [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). +Microsoft Managed Desktop's processor duties include ensuring appropriate confidentiality, security, and resilience. Microsoft Managed Desktop employs additional privacy and security measures to ensure proper handling of personal identifiable data. ## Microsoft Managed Desktop data storage and staff location -Microsoft Managed Desktop stores its data in the Azure data centers in the United States. Personal data obtained by Microsoft Managed Desktop and other services are required to keep the service operational. If a device is removed from Microsoft Managed Desktop, we keep personal data for a maximum of 30 days except for alert data collected by Microsoft Defender for Endpoint, which is stored for 180 days for security purposes. For more information on data retention, see [Data retention, deletion, and destruction in Microsoft 365](/compliance/assurance/assurance-data-retention-deletion-and-destruction-overview). +Microsoft Managed Desktop stores its data in the Azure data centers in the United States. -Microsoft Managed Desktop Engineering Operations and Security Operations teams are located in the United States and India. +Personal data obtained by Microsoft Managed Desktop and other services are required to keep the service operational. If a device is removed from Microsoft Managed Desktop, we keep personal data for a maximum of 30 days. However, alert data, collected by Microsoft Defender for Endpoint, is stored for 180 days for security purposes. For more information on data retention, see [Data retention, deletion, and destruction in Microsoft 365](/compliance/assurance/assurance-data-retention-deletion-and-destruction-overview). ++Microsoft Managed Desktop Engineering Operations and Security Operations teams are located in the United States and India. ### Microsoft Windows 10 diagnostic data -Microsoft Managed Desktop uses [Windows 10 Enhanced diagnostic data](/windows/privacy/windows-diagnostic-data) to keep Windows secure, up to date, troubleshoot problems, and make product improvements. The enhanced diagnostic data setting includes more detailed information about the devices enrolled in Microsoft Managed Desktop and their settings, capabilities, and device health. When enhanced diagnostic data is selected, data, including required diagnostic data, are collected. See [Changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection) for more information about the Windows 10 diagnostic data setting and data collection. +Microsoft Managed Desktop uses [Windows 10 Enhanced diagnostic data](/windows/privacy/windows-diagnostic-data) to keep Windows secure, up to date, troubleshoot problems, and make product improvements. ++The enhanced diagnostic data setting includes more detailed information about the devices enrolled in Microsoft Managed Desktop and their settings, capabilities, and device health. When enhanced diagnostic data is selected, data, including required diagnostic data, are collected. For more information, see [Changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection) about the Windows 10 diagnostic data setting and data collection. -The diagnostic data terminology will change in future versions of Windows. Microsoft Managed Desktop is committed to processing only the data that the service needs. While this will mean the diagnostic level will change to **Optional**, Microsoft Managed Desktop will implement the limited diagnostic policies to fine-tune diagnostic data collection required for the service. For more details, see [Changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection). +The diagnostic data terminology will change in future versions of Windows. Microsoft Managed Desktop is committed to processing only the data that the service needs. While this will mean the diagnostic level will change to **Optional**, Microsoft Managed Desktop will implement the limited diagnostic policies to fine-tune diagnostic data collection required for the service. For more information, see [Changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection). -Microsoft Managed Desktop only processes and stores system-level data from Windows 10 optional diagnostic data originating from enrolled devices such as application and device reliability and performance information. Microsoft Managed Desktop does not process and store customersΓÇÖ personal data such as chat and browser history, voice, text, or speech data. +Microsoft Managed Desktop only processes and stores system-level data from Windows 10 optional diagnostic data that originates from enrolled devices such as application and device reliability, and performance information. Microsoft Managed Desktop doesn't process and store customers' personal data such as chat and browser history, voice, text, or speech data. For more information about the diagnostic data collection of Microsoft Windows 10, see the [Where we store and process personal data](https://privacy.microsoft.com/privacystatement#mainwherewestoreandprocessdatamodule) section of the Microsoft Privacy Statement. ### Microsoft Windows Update for Business-Microsoft Windows Update for Business uses data from Windows diagnostics to analyze update status and failures. Microsoft Managed Desktop leverages this data and uses it to mitigate and resolve problems to ensure that all registered devices are up to date based on a predefined update cadence. ++Microsoft Windows Update for Business uses data from Windows diagnostics to analyze update status and failures. Microsoft Managed Desktop uses this data and uses it to mitigate, and resolve problems to ensure that all registered devices are up to date based on a predefined update cadence. ### Microsoft Azure Active Directory-Identifying data used by Microsoft Managed Desktop is stored by Azure Active Directory (Azure AD) in a geographical location based on the location provided by the organization when subscribing to Microsoft online services, such as Microsoft Apps for enterprise and Azure. Identifying data used by Microsoft Managed Desktop is stored by Azure AD in a geographical location based on the location provided by the organization when subscribing to Microsoft online services such as Microsoft Apps for enterprise and Azure. For more information on where your Azure AD data is located, see [Azure Active Directory - Where is your data located?](https://msit.powerbi.com/view?r=eyJrIjoiODdjOWViZDctMWRhZS00ODUzLWI4MmQtNWM5NjBkZTBkNjFlIiwidCI6IjcyZjk4OGJmLTg2ZjEtNDFhZi05MWFiLTJkN2NkMDExZGI0NyIsImMiOjV9) ++Identifying data used by Microsoft Managed Desktop is stored by Azure Active Directory (Azure AD) in a geographical location. The geographical location is based on the location provided by the organization upon subscribing to Microsoft online services, such as Microsoft Apps for Enterprise and Azure. For more information on where your Azure AD data is located, see [Azure Active Directory - Where is your data located?](https://msit.powerbi.com/view?r=eyJrIjoiODdjOWViZDctMWRhZS00ODUzLWI4MmQtNWM5NjBkZTBkNjFlIiwidCI6IjcyZjk4OGJmLTg2ZjEtNDFhZi05MWFiLTJkN2NkMDExZGI0NyIsImMiOjV9) ### Microsoft Intune-Microsoft Intune collects, processes, and shares data to Microsoft Managed Desktop to support business operations and services. See [Data collection in Intune](/mem/intune/protect/privacy-data-collect) for more information about the data collected in Intune. ++Microsoft Intune collects, processes, and shares data to Microsoft Managed Desktop to support business operations and services. For more information about the data collected in Intune, see [Data collection in Intune](/mem/intune/protect/privacy-data-collect) For more information on Microsoft Intune data locations, see [Where your Microsoft 365 customer data is stored](/microsoft-365/enterprise/o365-data-locations). Intune respects the storage location selections made by the administrator for customer data. ### Microsoft Defender for Endpoint-Microsoft Defender for Endpoint collects and stores information for devices enrolled in Microsoft Managed Desktop for administration, tracking, and reporting purposes. Information collected includes file data (such as file names, size, and hashes), process data (running processes, hashes), registry data, network connection data, and device details (such as device identifiers, device names, and the operating system version). See [Microsoft Defender for Endpoint data storage and privacy](/microsoft-365/security/defender-endpoint/data-storage-privacy#what-data-does-microsoft-defender-atp-collect) for more information on Microsoft Defender for EndpointΓÇÖs data collection and storage locations. -### Microsoft 365 Apps for enterprise -Microsoft 365 Apps for enterprise collects and shares data with Microsoft Managed Desktop to ensure those apps are up to date with the latest version based on predefined update channels managed by Microsoft Managed Desktop. See [Microsoft Defender for Endpoint data storage and privacy](/microsoft-365/security/defender-endpoint/data-storage-privacy#what-data-does-microsoft-defender-atp-collect) for more information on Microsoft 365 Apps's data collection and storage locations. +Microsoft Defender for Endpoint collects and stores information for devices enrolled in Microsoft Managed Desktop for administration, tracking, and reporting purposes. Information collected includes: ++- File data (such as file names, size, and hashes) +- Process data (running processes, hashes) +- Registry data +- Network connection data +- Device details (such as device identifiers, device names, and the operating system version) ++For more information on Microsoft Defender for Endpoint's data collection and storage locations, see [Microsoft Defender for Endpoint data storage and privacy](/microsoft-365/security/defender-endpoint/data-storage-privacy#what-data-does-microsoft-defender-atp-collect). ++### Microsoft 365 Apps for Enterprise ++Microsoft 365 Apps for Enterprise collects and shares data with Microsoft Managed Desktop to ensure those apps are up to date with the latest version. These updates are based on predefined update channels managed by Microsoft Managed Desktop. For more information on Microsoft 365 Apps's data collection and storage locations, see [Microsoft Defender for Endpoint data storage and privacy](/microsoft-365/security/defender-endpoint/data-storage-privacy#what-data-does-microsoft-defender-atp-collect). ## Major data change notification-Microsoft Managed Desktop follows a change control process as outlined in our service communication framework. We notify customers through the Microsoft 365 Message Center and Microsoft Managed Desktop Admin portal of both security incidents and major changes to the service. Changes to the types of data gathered and where it is stored are considered a material change. We will provide a minimum of 30 days of advanced notification of this change as is standard practice for Microsoft 365 products and services. For more information, see [Service changes and communication](/microsoft-365/managed-desktop/service-description/servicechanges). ++Microsoft Managed Desktop follows a change control process as outlined in our service communication framework. ++We notify customers through the Microsoft 365 Message Center, and Microsoft Managed Desktop Admin portal of both security incidents and major changes to the service. ++Changes to the types of data gathered and where it's stored are considered a material change. We'll provide a minimum of 30 days of advanced notification of this change as is standard practice for Microsoft 365 products and services. For more information, see [Service changes and communication](/microsoft-365/managed-desktop/service-description/servicechanges). ## Compliance-Microsoft Managed Desktop has undergone external audits and obtained a comprehensive set of compliance offerings. You can find more information in Microsoft Managed Desktop [Compliance](/microsoft-365/managed-desktop/intro/compliance). Audit reports are available for download at the Microsoft [Service Trust Portal](https://aka.ms/stp), which serves as a central repository for Microsoft Enterprise Online Services. (Microsoft Managed Desktop is listed within these documents under the category ΓÇ£Monitoring and Management.ΓÇ¥) ++Microsoft Managed Desktop has undergone external audits and obtained a comprehensive set of compliance offerings. You can find more information in [Compliance](/microsoft-365/managed-desktop/intro/compliance). Audit reports are available for download at the Microsoft [Service Trust Portal](https://aka.ms/stp), which serves as a central repository for Microsoft Enterprise Online Services. Microsoft Managed Desktop is listed within these documents under the "Monitoring and Management" category. ### Data subject requests-Microsoft Managed Desktop follows GDPR and CCPA privacy regulations, which give data subjects specific rights to their personal data. These rights include obtaining copies of personal data, requesting corrections to it, restricting the processing of it, deleting it, or receiving it in an electronic format so it can be moved to another controller. For more information about Data Subject Requests (DSRs) generally, see [Data Subject Requests and the GDPR and CCPA](/compliance/regulatory/gdpr-data-subject-requests). -To exercise data subject requests on data collected by the Microsoft Managed Desktop case management system, see the following: +Microsoft Managed Desktop follows GDPR and CCPA privacy regulations, which give data subjects specific rights to their personal data. ++These rights include: ++- Obtaining copies of personal data +- Requesting corrections to it +- Restricting the processing of it +- Deleting it +- Receiving it in an electronic format so it can be moved to another controller. -- Data from Microsoft Defender for Endpoint alerts: Your security administrator can request deletion or extraction of personal data related to Microsoft Defender for Endpoint alerts by submitting a report request at the [Admin Portal](https://aka.ms/memadmin). In the request, select request type **Change request**, category **Security**, and subcategory **Other**. Provide the relevant device names in the request description.-- Data from Microsoft Managed Desktop support requests: Your IT administrator can request deletion or extraction of personal data related support requests by submitting a report request at the [Admin Portal](https://aka.ms/memadmin). In the request, select request type **Change request**, category **Security**, and subcategory **Other**. Provide the relevant device names or user names in the request description.+For more general information about Data Subject Requests (DSRs), see [Data Subject Requests and the GDPR and CCPA](/compliance/regulatory/gdpr-data-subject-requests). ++To exercise data subject requests on data collected by the Microsoft Managed Desktop case management system, see the following data subject requests: ++| Data subject requests | Description | +| | | +| Data from Microsoft Defender for Endpoint alerts | Your security administrator can request deletion, or extraction of personal data related to Microsoft Defender for Endpoint alerts by submitting a report request in the [Admin Portal](https://aka.ms/memadmin). <br><br> Provide the following information: <br><ul><li>Request type: Change request</li><li>Category: Security</li><li>Subcategory: Other</li><li>Description: Provide the relevant device names.</li></ul> | +| Data from Microsoft Managed Desktop support requests | Your IT administrator can request deletion, or extraction of personal data related support requests by submitting a report request at the [Admin Portal](https://aka.ms/memadmin). <br><br> Provide the following information: <ul><li>Request type: Change request</li><li>Category: Security</li><li>Subcategory: Other</li><li>Description: Provide the relevant device names or user names.</li></ul> For DSRs from other products related to the service, see the following articles: For DSRs from other products related to the service, see the following articles: - Azure Active [Directory data](/compliance/regulatory/gdpr-dsr-azure) ## Legal-**MicrosoftΓÇÖs privacy notice to end users of products provided by organizational customers** - The [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) notifies end users that when they sign in to Microsoft products with a work account, a) their organization can control and administer their account (including controlling privacy-related settings) and access and process their data, and b) Microsoft may collect and process the data to provide the service to the organization and end users. ++**Microsoft's privacy notice to end users of products provided by organizational customers**: ++The [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) notifies end users that when they sign in to Microsoft products with a work account: ++1. Their organization can control and administer their account (including controlling privacy-related settings), and access and process their data. +1. Microsoft may collect and process the data to provide the service to the organization and end users. |
| managed-desktop | Security Operations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/service-description/security-operations.md | -The Microsoft Managed Desktop Security Operations Center (SOC) partners with your information security staff to keep your desktop environment secure. Our team receives and responds to all security alerts on managed devices with expert analysis and, when needed, we drive security incident response activities. For more information about working with the SOC, review operational documentation at your Admin portal. +The Microsoft Managed Desktop Security Operations Center (SOC) partners with your information security staff to keep your desktop environment secure. Our team receives and responds to all security alerts on managed devices with expert analysis. When needed, we drive security incident response activities. For more information about working with the SOC, review operational documentation in your Admin portal. The SOC offers 24/7/365 coverage from Microsoft full-time employees with expertise in the current and emerging threat landscape, including common attack methods through software, network, or human adversaries. The SOC provides these -- Quick and accurate response to detected events, with analysis of data to identify the impact and assess the overall risk to a device or your environment-- Device management and isolation actions to protect your environment from known or suspected compromises, reducing risk by preventing spread-- Driving the security incident response process, ensuring timely and accurate communication with your security team-- Analysis and recommendations based on threat and vulnerability data to identify and address risks before they're exploited-- Advanced hunting across the managed devices to identify indicators and entities for both known and potential threats++| Service | Description | +| | | +| Quick and accurate response to detected events | <ul><li>Analyze data to identify the impact.</li><li>Assess the overall risk to a device or your environment.</li></ul> +| Device management and isolation actions | <ul><li>Protect your environment from known or suspected compromises</li><li>Reduce the risk by preventing spread.</li></ul> +| Drive the security incident response | Ensure timely and accurate communication with your security team. | +| Analysis and recommendations | Provide analysis and recommendations based on threat, and vulnerability data to identify and address risks before they're exploited. +| Advanced hunting | Across the managed devices to identify indicators and entities for both known and potential threats.| ## Processes -- Microsoft Managed Desktop Security Operations is staffed by full-time Microsoft employees in partnership with MicrosoftΓÇÖs [Cyber Defense Operations Center](https://www.microsoft.com/msrc/cdoc). -- Our SOC uses collective signals from across our company, both internal and external, to protect your devices--even from things we have not yet seen in Microsoft Managed Desktop.-- Microsoft security solutions align to many cybersecurity protection standards. SOC operations are based on the National Institute of Standards and Technology Computer Security Incident Response Handling Guide (NIST 800-61 r2).-- The process allows for proper collection of information and evidence, for analysis and documentation and post-recovery insights into ways to better defend your environment through these phases:- - Preparation, detection, and analysis - - Containment - - Eradication - - Recovery - - Post-incident activity -- Microsoft Managed Desktop customers are eligible to enroll in the Microsoft Threat Experts service. The SOC liaises with this service to understand better the complex threats affecting your organization, including alert inquiries, potentially compromised devices, root cause of a suspicious network connection, and other threat intelligence regarding ongoing advanced persistent threat campaigns. For more information, see [Microsoft Threat Experts](/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts).-- SOCΓÇÖs Threat and Vulnerability Management process uses some of MicrosoftΓÇÖs services to help inform recommendations for your organization to protect against threats. The SOC consumes data from your Microsoft Defender for Endpoint Security Center and from relevant vulnerability data sources within and outside of Microsoft to discover vulnerabilities and misconfigurations and provide actionable reporting.+| Process | Description | +| | | +| Microsoft Managed Desktop Security Operations | Microsoft Managed Desktop Security Operations is staffed by full-time Microsoft employees in partnership with Microsoft's [Cyber Defense Operations Center](https://www.microsoft.com/msrc/cdoc). | +| SOC | Our SOC uses collective signals from across our company, both internal and external, to protect your devicesΓÇöeven from things we haven't yet seen in Microsoft Managed Desktop. +| Microsoft security solutions | Microsoft security solutions align to many cybersecurity protection standards. SOC operations are based on the National Institute of Standards and Technology Computer Security Incident Response Handling Guide (NIST 800-61 r2). <br><br> The process allows for proper collection of information and evidence, for analysis and documentation and post-recovery insights into ways to better defend your environment through these phases: <ul><li>Preparation, detection, and analysis</li><li>Containment</li><li>Eradication</li><li>Recovery</li><li>Post-incident activity</li></ul> +| Microsoft Threats Experts service | Microsoft Managed Desktop customers are eligible to enroll in the Microsoft Threat Experts service. The SOC liaises with this service to understand better the complex threats affecting your organization, including: <br><ul><li>Alert inquiries</li><li>Potentially compromised devices</li><li>Root cause of a suspicious network connection</li><li>Other threat intelligence regarding ongoing advanced persistent threat campaigns.</li></ul><br>For more information, see [Microsoft Threat Experts](/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts).| +| SOC's Threat and Vulnerability Management | SOC's Threat and Vulnerability Management process uses some of Microsoft's services to help inform recommendations for your organization to protect against threats. <br><br>The SOC consumes data from your Microsoft Defender for Endpoint Security Center and from relevant vulnerability data sources, within and outside of Microsoft, to discover vulnerabilities and misconfigurations to provide actionable reporting. | |
| managed-desktop | Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/service-description/updates.md | Microsoft Managed Desktop uses four Azure AD groups to manage updates: | Group | Description | | | |-| Test | Used to validate Microsoft Managed Desktop policy changes, operating system updates, feature updates, and other changes pushed to the Azure AD organization ("tenant"). The Test group is: <ul><li>Best for testing or users who can provide early feedback.</li><li>Exempt from any established service level agreements and user support.</li><li>Available to validate compatibility of applications with new policy or operating system changes.</li></ul> | +| Test | Used to validate Microsoft Managed Desktop policy changes, operating system updates, feature updates, and other changes pushed to the Azure AD organization ("tenant"). The Test group is: <br><ul><li>Best for testing or users who can provide early feedback.</li><li>Exempt from any established service level agreements and user support.</li><li>Available to validate compatibility of applications with new policy or operating system changes.</li></ul> | | First | Contains early software adopters and devices that could be subject to pre-release updates. <br><br> Devices in this group might experience outages if there are scenarios that weren't covered during testing in the test ring. |-| Fast | Prioritizes speed over stability. The Fast group is: <ul><li>Useful for detecting quality issues before they're offered to the Broad group.</li> <li>The next layer of validation, and is typically more stable than the Test and First groups.</li></ul> | +| Fast | Prioritizes speed over stability. The Fast group is: <br><ul><li>Useful for detecting quality issues before they're offered to the Broad group.</li> <li>The next layer of validation, and is typically more stable than the Test and First groups.</li></ul> | | Broad | This group is the last group to have feature and quality updates available. <br><br> The Broad group contains most of users in the Azure AD organization, and therefore favors stability over speed in deployment. Testing of apps should be done with this group because the environment is the most stable. | ### Moving devices between update groups |
| security | Configure Proxy Internet | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-proxy-internet.md | The \*.blob.core.windows.net URL endpoint can be replaced with the URLs shown in Verify, the proxy configuration is completed successfully. The WinHTTP can then discover and communicate through the proxy server in your environment, and then the proxy server will allow traffic to the Defender for Endpoint service URLs. -1. Download the [Microsoft Defender for Endpoint Client Analyzer tool](https://aka.ms/mdeanalyzer) to the PC, where Defender for Endpoint sensor is running on. +1. Download the [Microsoft Defender for Endpoint Client Analyzer tool](https://aka.ms/mdeanalyzer) to the PC, where Defender for Endpoint sensor is running on. For downlevel servers, use the latest preview edition is available for download [Microsoft Defender for Endpoint Client Analyzer tool Beta](https://aka.ms/BetaMDEAnalyzer). 2. Extract the contents of MDEClientAnalyzer.zip on the device. |
| security | Tvm Weaknesses | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tvm-weaknesses.md | The **Weaknesses** page lists the software vulnerabilities your devices are expo Access the Weaknesses page a few different ways: -- Selecting **Weaknesses** from the **Vulnerability management** navigation menu in the [Microsoft 365 Defender portal] (portal-overview.md)+- Selecting **Weaknesses** from the **Vulnerability management** navigation menu in the [Microsoft 365 Defender portal](portal-overview.md) - Global search ### Navigation menu |
| security | Microsoft Secure Score | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-secure-score.md | Secure Score helps organizations: * Improve their security posture by providing discoverability, visibility, guidance, and control. * Compare with benchmarks and establish key performance indicators (KPIs). +Watch this video for a quick overview of Secure score. +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWUPrP] + Organizations gain access to robust visualizations of metrics and trends, integration with other Microsoft products, score comparison with similar organizations, and much more. The score can also reflect when third-party solutions have addressed recommended actions.  |
| security | Attack Simulation Training Simulation Automations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-simulation-automations.md | To create a simulation automation, do the following steps: To go directly to the **Simulation automations** tab, use <https://security.microsoft.com/attacksimulator?viewid=simulationautomation>. -2. On the **Simulation automations** tab, select  **Create simulation**. +2. On the **Simulation automations** tab, select  **Create automation**. -  +  3. The creation wizard opens. The rest of this article describes the pages and the settings they contain. |
| security | Create Block Sender Lists In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/create-block-sender-lists-in-office-365.md | ms.prod: m365-security In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, EOP offers multiple ways of blocking email from unwanted senders. These options include Outlook Blocked Senders, blocked sender lists or blocked domain lists in anti-spam policies, Exchange mail flow rules (also known as transport rules), and the IP Block List (connection filtering). Collectively, you can think of these options as _blocked sender lists_. -The best method to block senders varies on the scope of impact. For a single user, the right solution could be Outlook Blocked Senders. For many users, one of the other options would be more appropriate. The following options are ranked by both impact scope and breadth. The list goes from narrow to broad, but *read the specifics* for full recommendations. +The best method to block senders varies on the scope of impact. For a single user, the right solution could be Outlook Blocked Senders. For many users, one of the other options would be more appropriate. The following options are ranked by both impact scope and breadth. The list goes from narrow to broad, but _read the specifics_ for full recommendations. 1. Outlook Blocked Senders (the Blocked Senders list that's stored in each mailbox) In contrast, you also have several options to always allow email from specific s ## Email message basics -A standard SMTP email message consists of a *message envelope* and message content. The message envelope contains information that's required for transmitting and delivering the message between SMTP servers. The message content contains message header fields (collectively called the *message header*) and the message body. The message envelope is described in RFC 5321, and the message header is described in RFC 5322. Recipients never see the actual message envelope because it's generated by the message transmission process, and it isn't actually part of the message. +A standard SMTP email message consists of a _message envelope_ and message content. The message envelope contains information that's required for transmitting and delivering the message between SMTP servers. The message content contains message header fields (collectively called the _message header_) and the message body. The message envelope is described in RFC 5321, and the message header is described in RFC 5322. Recipients never see the actual message envelope because it's generated by the message transmission process, and it isn't actually part of the message. - The `5321.MailFrom` address (also known as the **MAIL FROM** address, P1 sender, or envelope sender) is the email address that's used in the SMTP transmission of the message. This email address is typically recorded in the **Return-Path** header field in the message header (although it's possible for the sender to designate a different **Return-Path** email address). If the message can't be delivered, it's the recipient for the non-delivery report (also known as an NDR or bounce message). When messages are successfully blocked due to a user's Blocked Senders list, the ## Use blocked sender lists or blocked domain lists -When multiple users are affected, the scope is wider, so the next best option is blocked sender lists or blocked domain lists in anti-spam policies. Messages from senders on the lists are marked as **High confidence spam**, and the action that you've configured for the **High confidence spam** filter verdict is taken on the message. For more information, see [Configure anti-spam policies](configure-your-spam-filter-policies.md). +When multiple users are affected, the scope is wider, so the next best option is blocked sender lists or blocked domain lists in anti-spam policies. Messages from senders on the lists are marked as **Spam** (not **High confidence spam**), and the action that you've configured for the **Spam** filter verdict is taken on the message. For more information, see [Configure anti-spam policies](configure-your-spam-filter-policies.md). The maximum limit for these lists is approximately 1000 entries. The maximum limit for these lists is approximately 1000 entries. If you need to block messages that are sent to specific users or across the entire organization, you can use mail flow rules. Mail flow rules are more flexible than block sender lists or blocked sender domain lists because they can also look for keywords or other properties in the unwanted messages. -Regardless of the conditions or exceptions that you use to identify the messages, you configure the action to set the spam confidence level (SCL) of the message to 9, which marks the message a **High confidence spam**. For more information, see [Use mail flow rules to set the SCL in messages](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl). +Regardless of the conditions or exceptions that you use to identify the messages, you configure the action to set the spam confidence level (SCL) of the message to 9, which marks the message as **High confidence spam**. For more information, see [Use mail flow rules to set the SCL in messages](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl). > [!IMPORTANT]-> It's easy to create rules that are *overly* aggressive, so it's important that you identify only the messages you want to block using very specific criteria. Also, be sure to enable auditing on the rule and test the results of the rule to ensure everything works as expected. +> It's easy to create rules that are _overly_ aggressive, so it's important that you identify only the messages you want to block using very specific criteria. Also, be sure to enable auditing on the rule and test the results of the rule to ensure everything works as expected. ## Use the IP Block List -When it's not possible to use one of the other options to block a sender, *only then* should you use the IP Block List in the connection filter policy. For more information, see [Configure the connection filter policy](configure-the-connection-filter-policy.md). It's important to keep the number of blocked IPs to a minimum, so blocking entire IP address ranges is *not* recommended. +When it's not possible to use one of the other options to block a sender, _only then_ should you use the IP Block List in the connection filter policy. For more information, see [Configure the connection filter policy](configure-the-connection-filter-policy.md). It's important to keep the number of blocked IPs to a minimum, so blocking entire IP address ranges is _not_ recommended. -You should *especially* avoid adding IP address ranges that belong to consumer services (for example, outlook.com) or shared infrastructures, and also ensure that you review the list of blocked IP addresses as part of regular maintenance. +You should _especially_ avoid adding IP address ranges that belong to consumer services (for example, outlook.com) or shared infrastructures, and also ensure that you review the list of blocked IP addresses as part of regular maintenance. |
| security | Exchange Online Protection Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/exchange-online-protection-overview.md | For more information, see [Order and precedence of email protection](how-policie EOP runs on a worldwide network of datacenters that are designed to provide the best availability. For example, if a datacenter becomes unavailable, email messages are automatically routed to another datacenter without any interruption in service. Servers in each datacenter accept messages on your behalf, providing a layer of separation between your organization and the internet, thereby reducing load on your servers. Through this highly available network, Microsoft can ensure that email reaches your organization in a timely manner. -EOP performs load balancing between datacenters but only within a region. If you're provisioned in one region all your messages will be processed using the mail routing for that region. The following list shows the how regional mail routing works for the EOP datacenters: --- In Europe, the Middle East, and Africa (EMEA), all Exchange Online mailboxes are located in EMEA datacenters, and all messages are routed through EMEA datacenters for EOP filtering.-- In Asia-Pacific (APAC), all Exchange Online mailboxes are located in APAC datacenters, and messages are currently routed through APAC datacenters for EOP filtering.-- In the Americas, services are distributed in the following locations:- - South America: Exchange Online mailboxes are located in datacenters in Brazil and Chile. All messages are routed through local datacenters for EOP filtering. Quarantined messages are stored in the datacenter where the tenant is located. - - Canada: Exchange Online mailboxes are located in datacenters in Canada. All messages are routed through local datacenters for EOP filtering. Quarantined messages are stored in the datacenter where the tenant is located. - - United States: Exchange Online mailboxes are located in U.S. datacenters. All messages are routed through local datacenters for EOP filtering. Quarantined messages are stored in the datacenter where the tenant is located. -- For the Government Community Cloud (GCC), all Exchange Online mailboxes are located in U.S. datacenters and all messages are routed through U.S. datacenters for EOP filtering.+EOP performs load balancing between datacenters but only within a region. If you're provisioned in one region, all your messages will be processed using the mail routing for that region. ### EOP features |
| security | Preset Security Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/preset-security-policies.md | A profile determines the level of protection. The following profiles are availab You can only use a condition or exception once, but you can specify multiple values for the condition or exception. Multiple values of the same condition or exception use OR logic (for example, _\<recipient1\>_ or _\<recipient2\>_). Different conditions or exceptions use AND logic (for example, _\<recipient1\>_ and _\<member of group 1\>_). -- **Built-in protection** (Defender for Office 365 only): A profile that enables Safe Links and Safe Attachments protection only. This setting effectively provide default policies for Safe Links and Safe Attachments, which never had default policies.-- > [!NOTE] - > The **Built-in protection** preset security policy is currently in General Availability, available to all organizations. +- **Built-in protection** (Defender for Office 365 only): A profile that enables Safe Links and Safe Attachments protection only. This profile effectively provides default policies for Safe Links and Safe Attachments, which never had default policies. For **Built-in protection**, the preset security policy is on by default for all Defender for Office 365 customers. Although we don't recommend it, you can also configure exceptions based on **Users**, **Groups**, and **Domains** so the protection isn't applied to specific users. |
| solutions | Empower People To Work Remotely Manage Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-manage-endpoints.md | With hybrid workers, you need to support a growing number of personal devices. E [Microsoft Endpoint Manager](/mem/endpoint-manager-overview) provides services and tools for managing mobile devices, desktop computers, virtual machines, embedded devices, and servers by combining the following services you may already know and be using. - ## Microsoft Intune Microsoft Intune is a cloud-based service that focuses on mobile device manageme - **MDM:** For organization-owned devices, you can exercise full control including settings, features, and security. Devices are "enrolled" in Intune where they receive Intune policies with rules and settings. For example, you can set password and PIN requirements, create a VPN connection, set up threat protection, and more. -- **MAM:** Remote workers might not want you to have full control on their personal devices, also known as bring-your-own device (BYOD) devices. You can give your hybrid workers options and still protect your organization. For example, hybrid workers can enroll their devices if they want full access to your organization resources. Or, if these users only want access to email or Microsoft Teams, then use app protection policies that require multi-factor authentication (MFA) to use these apps.+- **MAM:** Remote workers might not want you to have full control of their personal devices, also known as bring-your-own device (BYOD) devices. You can give your hybrid workers options and still protect your organization. For example, hybrid workers can enroll their devices if they want full access to your organization resources. Or, if these users only want access to email or Microsoft Teams, then use app protection policies that require multi-factor authentication (MFA) to use these apps. -For more information, see the [Manage endpoints with Intune and Microsoft 365](manage-devices-with-intune-overview.md) foundation solution. +For more information, see the [Manage devices with Intune](manage-devices-with-intune-overview.md) foundation solution. ## Configuration Manager For more information, see this [overview of co-management](/mem/configmgr/comana ## Endpoint Analytics -Endpoint Analytics is a cloud-based service that integrates with Configuration Manager and provides you with insight and intelligence so you can make informed decisions about your Windows clients. It combines data from your organization with data aggregated from millions of other devices connected to Microsoft cloud services. +Endpoint analytics aims to improve user productivity and reduce IT support costs by providing insights into the user experience. The insights enable IT to optimize the end-user experience with proactive support and to detect regressions to the user experience by assessing user impact of configuration changes. -With Endpoint Analytics, you can: --- Create an inventory of apps running in your organization.-- Assess app compatibility with the latest Windows 10 feature updates.-- Identify compatibility issues and receive mitigation suggestions based on cloud-enabled data insights.-- Create pilot groups that represent the entire application and driver estate across a minimal set of devices.-- Deploy Windows 10 to pilot and production-managed devices.--For more information, see this [overview of Endpoint Analytics](/mem/configmgr/desktop-analytics/overview) +For more information, see this [overview of Endpoint Analytics](/mem/analytics/overview) ## Windows Autopilot |
| solutions | Empower People To Work Remotely Remote Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-remote-access.md | With split tunneling, you can configure your VPN client to exclude specific type To optimize access to Microsoft 365 cloud resources, configure your split tunneling VPN clients to exclude traffic to the **Optimize** category Microsoft 365 endpoints over the VPN connection. For more information, see [Office 365 endpoint categories](../enterprise/microsoft-365-network-connectivity-principles.md#new-office-365-endpoint-categories). See [this list](../enterprise/urls-and-ip-address-ranges.md) of Optimize category endpoints. -Here is the resulting traffic flow, in which most of the traffic to Microsoft 365 cloud apps bypass the VPN connection. +Here is the resulting traffic flow, in which most of the traffic to Microsoft 365 cloud apps bypasses the VPN connection. :::image type="content" source="../media/empower-people-to-work-remotely-remote-access/empower-people-to-work-remotely-remote-access-after-tunneling.png" alt-text="Network traffic from VPN clients with tunneling." lightbox="../media/empower-people-to-work-remotely-remote-access/empower-people-to-work-remotely-remote-access-after-tunneling.png"::: |
| solutions | Empower People To Work Remotely Security Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-security-compliance.md | Remote work needs these elements of security and compliance: Here are the features of Microsoft 365 that provide security and compliance services for hybrid workers. - ## Security For your hybrid workers, you have implemented: - Malware protection for cloud service data, email, and Windows 11 or 10 devices - Compliance - Consistent labeling for levels of sensitivity and protection- - Policies to prevention information leakage + - Policies to prevent information leakage - Adherence to regional data regulations ## Next step |
| solutions | Empower People To Work Remotely Teams Productivity Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely-teams-productivity-apps.md | To be productive, people need to communicate and collaborate with one another. T ## Keep people connected with Microsoft Teams -Teams allows you to chat, meet, call, and collaborate all in one place. Millions of people get their work done in Teams every day because it brings together everything you need to work on-site or remotely into a hub for teamwork. +Teams with Microsoft Teams allows your organization to chat, meet, call, and collaborate all in one place. Millions of people get their work done with teams every day because it brings together everything you need to work on-site or remotely into a hub for teamwork. For detailed guidance, see [Support remote workers using Microsoft Teams](/microsoftteams/support-remote-work-with-teams). Watch the [Enabling hybrid work with Microsoft Teams webcasts](https://resources ### Chat and conversations -Chat and threaded conversations are at the center of Teams with support for individual 1:1 chats and group chats and conversations. Remote workers can share information, opinions, and personality by using gifs, stickers, and emojis in group chats or one-to-one messages. +Chat and threaded conversations are at the center of Teams with support for individual 1:1 chats and group chats and conversations. Remote workers can share information, opinions, and personality by using pictures, stickers, and emojis in group chats or one-to-one messages. ### Meetings and conferencing Teams can certainly help maintain communications and information sharing with hy ### Calling -Teams supports direct VoIP calling between users and even other organizations using federation. It uses the same codecs as meetings and provide great audio world-wide without additional PSTN charges. However, some users may need a dedicated phone number to take external calls when working on-site or remotely. Teams can quickly provide cloud phone service for these users to make and receive phone calls. +Teams supports direct VoIP calling between users and even other organizations using federation. It uses the same codecs as meetings and provides great audio world-wide without additional PSTN charges. However, some users may need a dedicated phone number to take external calls when working on-site or remotely. Teams can quickly provide cloud phone service for these users to make and receive phone calls. ### Apps and workflows |
| solutions | Empower People To Work Remotely | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/empower-people-to-work-remotely.md | description: Step through the layers of infrastructure so your hybrid workers ca # Set up your infrastructure for hybrid work with Microsoft 365 -To secure and optimize your workerΓÇÖs productivity and collaboration, you need to allow on-site and remote workers to easily and securely access your organization's on-premises and cloud-based information, tools, and resources. This solution steps through the deployment of key layers of infrastructure that empower your workers to do their best work, wherever they are. +To secure and optimize your workerΓÇÖs productivity and collaboration, you need to allow on-site and remote workers to access your organization's on-premises and cloud-based information, tools, and resources easily and securely. This solution steps through the deployment of key layers of infrastructure that empower your workers to do their best work, wherever they are. Hybrid workers can work on-site or remotely in a combination of locations. Allowing workers to work away from a traditional office is important for many organizations to: - Hire and retain workers who are unwilling to relocate or require a flexible work environment. - Reduce worker commuting, leaving workers with more time to be productive and for stress-reducing activities outside of work.-- Save on office space.+- Save office space. Microsoft 365 has the capabilities to empower your hybrid workers to work either on-site or remotely. |
| solutions | Ransomware Protection Microsoft 365 Attack Detection Response | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/ransomware-protection-microsoft-365-attack-detection-response.md | description: Use Microsoft 365 Defender and its security signal sources to prote # Step 2. Deploy attack detection and response -As a strongly recommended first step for ransomware attack detection and response in your Microsoft 365 tenant, [set up a trial environment](/microsoft-365/security/defender/eval-overview) to evaluate the features and capabilities of Microsoft 365 Defender. +As a strongly recommended initial step for ransomware attack detection and response in your Microsoft 365 tenant, [set up a trial environment](/microsoft-365/security/defender/eval-overview) to evaluate the features and capabilities of Microsoft 365 Defender. For additional information, see these resources. | Feature | Description | Where to start | How to use it for detection and response | |:-|:--|:-|:-|-| [Microsoft 365 Defender](/microsoft-365/security/defender) | Combines signals and orchestrates capabilities into a single solution <br><br> Enables security professionals to stitch together threat signals and determine the full scope and impact of a threat <br><br> Automates actions to prevent or stop the attack and self-heal affected mailboxes, endpoints, and user identities | [Get started](/microsoft-365/security/defender/get-started) | [Incident response](/microsoft-365/security/defender/incidents-overview) | -| [Microsoft Defender for Identity](/defender-for-identity/what-is) | Identifies, detects, and investigates advanced threats, compromised identities, and malicious insider actions directed at your organization through a cloud-based security interface uses your on-premises Active Directory Domain Services (AD DS) signals | [Overview](/defender-for-identity/what-is) | [Working with the Microsoft Defender for Identity portal](/defender-for-identity/workspace-portal) | -| [Microsoft Defender for Office 365](/microsoft-365/security/office-365-security) | Safeguards your organization against malicious threats posed by email messages, links (URLs), and collaboration tools <br><br> Protects against malware, phishing, spoofing, and other attack types | [Overview](/microsoft-365/security/office-365-security/overview) | [Threat hunting](/microsoft-365/security/office-365-security/threat-hunting-in-threat-explorer) | -| [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint) | Enables detection and response to advanced threats across endpoints (devices) | [Overview](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint) | [Endpoint detection and response](/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response) | -| [Azure Active Directory (Azure AD) Identity Protection](/azure/active-directory/identity-protection/) | Automates detection and remediation of identity-based risks and investigation of those risks | [Overview](/azure/active-directory/identity-protection/overview-identity-protection) | [Investigate risk](/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk) | +| [Microsoft 365 Defender](/microsoft-365/security/defender) | Combines signals and orchestrates capabilities into a single solution. <br><br> Enables security professionals to stitch together threat signals and determine the full scope and impact of a threat. <br><br> Automates actions to prevent or stop the attack and self-heal affected mailboxes, endpoints, and user identities. | [Get started](/microsoft-365/security/defender/get-started) | [Incident response](/microsoft-365/security/defender/incidents-overview) | +| [Microsoft Defender for Identity](/defender-for-identity/what-is) | Identifies, detects, and investigates advanced threats, compromised identities, and malicious insider actions directed at your organization through a cloud-based security interface uses your on-premises Active Directory Domain Services (AD DS) signals. | [Overview](/defender-for-identity/what-is) | [Working with the Microsoft Defender for Identity portal](/defender-for-identity/workspace-portal) | +| [Microsoft Defender for Office 365](/microsoft-365/security/office-365-security) | Safeguards your organization against malicious threats posed by email messages, links (URLs), and collaboration tools. <br><br> Protects against malware, phishing, spoofing, and other attack types. | [Overview](/microsoft-365/security/office-365-security/overview) | [Threat hunting](/microsoft-365/security/office-365-security/threat-hunting-in-threat-explorer) | +| [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint) | Enables detection and response to advanced threats across endpoints (devices). | [Overview](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint) | [Endpoint detection and response](/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response) | +| [Azure Active Directory (Azure AD) Identity Protection](/azure/active-directory/identity-protection/) | Automates detection and remediation of identity-based risks and investigation of those risks. | [Overview](/azure/active-directory/identity-protection/overview-identity-protection) | [Investigate risk](/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk) | | [Microsoft Defender for Cloud Apps](/cloud-app-security) | A cloud access security broker for discovery, investigation, and governance across all your Microsoft and third-party cloud services. | [Overview](/cloud-app-security/what-is-cloud-app-security) | [Investigate](/cloud-app-security/investigate) | >[!Note]->All of these tools require Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on. +>All of these services require Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on. > -Use these tools to detect and respond to the following common threats from ransomware attackers: +Use these services to detect and respond to the following common threats from ransomware attackers: - Credential theft - Azure AD Identity Protection- - Microsoft Defender for Identity - - Microsoft Defender for Office 365 + - Defender for Identity + - Defender for Office 365 - Device compromise - - Microsoft Defender for Endpoint - - Microsoft Defender for Office 365 + - Defender for Endpoint + - Defender for Office 365 - Escalation of privilege - Azure AD Identity Protection- - Microsoft Defender for Cloud Apps + - Defender for Cloud Apps - Malicious app behavior - - Microsoft Defender for Cloud Apps + - Defender for Cloud Apps - Data exfiltration, deletion, or uploading - - Microsoft Defender for Office 365 - - Microsoft Defender for Cloud Apps with [anomaly detection policies](/cloud-app-security/anomaly-detection-policy#ransomware-activity) + - Defender for Office 365 + - Defender for Cloud Apps with [anomaly detection policies](/cloud-app-security/anomaly-detection-policy#ransomware-activity) -The following tools use Microsoft 365 Defender and its portal (https://security.microsoft.com) as a common threat collection and analysis point: +The following services use Microsoft 365 Defender and its portal (https://security.microsoft.com) as a common threat collection and analysis point: -- Microsoft Defender for Identity-- Microsoft Defender for Office 365-- Microsoft Defender for Endpoint-- Microsoft Defender for Cloud Apps+- Defender for Identity +- Defender for Office 365 +- Defender for Endpoint +- Defender for Cloud Apps Microsoft 365 Defender combines threat signals into alerts and connected alerts into an incident so that your security analysts can more quickly detect, investigate, and remediate the phases of a ransomware attack. ## Resulting configuration -Here is the ransomware protection for your tenant for steps 1 and 2. +Here's the ransomware protection for your tenant for steps 1 and 2.  Here is the ransomware protection for your tenant for steps 1 and 2. [ -Continue with [Step 3](ransomware-protection-microsoft-365-identities.md) to protect identities in your Microsoft 365 tenant. +Continue with [Step 3](ransomware-protection-microsoft-365-identities.md) to protect the identities in your Microsoft 365 tenant. |
| solutions | Ransomware Protection Microsoft 365 Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/ransomware-protection-microsoft-365-devices.md | description: Use Windows Intune as an MDA and MAM provider and Windows 10 securi # Step 4. Protect devices -To help protect devices against the initial access part of a ransomware attack: +To help protect devices (endpoints) against the initial access part of a ransomware attack: - Deploy [Intune](/mem/intune/fundamentals/what-is-intune) as a mobile device management (MDM) and mobile application management (MAM) provider for your devices and enroll your organization-owned devices.-- Implement the [Common identity and device access policies](/microsoft-365/security/office-365-security/identity-access-policies) to validate the user account credentials and device health and compliance requirements.+- Implement the [Common identity and device access policies](/microsoft-365/security/office-365-security/identity-access-policies) to validate the user account credentials and enforce device health and compliance requirements. - Enable [Network Protection](/microsoft-365/security/defender-endpoint/network-protection) in Microsoft Defender for Endpoint and Microsoft 365 Defender. - Configure [site and download checking](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings) and [app and file checking](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings) in Microsoft Defender SmartScreen to block or warn. - Enable [Microsoft Defender Antivirus scanning](/microsoft-365/security/defender-endpoint/configure-advanced-scan-types-microsoft-defender-antivirus) of downloaded files and attachments. - Set **Remote Desktop security level** to **TLS** in Microsoft Defender for Endpoint and Microsoft 365 Defender. -## Windows 10 devices +## Windows 11 or 10 devices -To help protect against the lateral movement part of an attack from a Windows 10 device: +To help protect against the lateral movement part of an attack from a Windows 11 or 10 device: - [Turn on Microsoft Defender Firewall](https://support.microsoft.com/windows/turn-microsoft-defender-firewall-on-or-off-ec0844f7-aebd-0583-67fe-601ecf5d774f).-- [Update Microsoft Defender Antivirus definitions](/en-us/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus).+- [Update Microsoft Defender Antivirus definitions](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus). To reduce the impact of the attack: -- Use [advanced protection](/Microsoft-365/security/defender-endpoint/attack-surface-reduction#use-advanced-protection-against-ransomware) against ransomware.+- Use [attack surface reduction rules and advanced protection against ransomware](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference#use-advanced-protection-against-ransomware). To help protect against an attacker evading your security defenses: To help protect against an attacker executing code as part of an attack: As you implement these protections, perform change management for the following: -- The [Common identity and device access policies](/microsoft-365/security/office-365-security/identity-access-policies) can deny access to users who have non-compliant devices.+- The [common Zero Trust identity and device access policies](/microsoft-365/security/office-365-security/identity-access-policies) can deny access to users who have non-compliant devices. - Downloading files might warn users before the download or it might be blocked. - Some Office, Excel 4.0, XLM, or VBA macros might no longer run. ## Resulting configuration -Here is the ransomware protection for your tenant for steps 1-4. +Here's the ransomware protection for your tenant for steps 1-4.  |
| solutions | Ransomware Protection Microsoft 365 Identities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/ransomware-protection-microsoft-365-identities.md | Next, implement the [Common identity and device access policies](/microsoft-365/ For user sign-ins, these policies include: -- Requiring MFA for priority accounts (immediately) and eventually all user accounts.+- Requiring multi-factor authentication (MFA) for [priority accounts](/microsoft-365/admin/setup/priority-accounts) (immediately) and eventually all user accounts. - Requiring high-risk sign-ins to use MFA. - Requiring high-risk users with high-risk sign-ins to change their passwords. For user sign-ins, these policies include: Use these best practices: -- Implement the principle of [least-privilege](/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models) and use password protection as described in [Increase sign-in security](#increase-sign-in-security) for those user accounts that still use passwords for their sign-ins. +- Implement the principle of [least privilege](/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models) and use password protection as described in [Increase sign-in security](#increase-sign-in-security) for those user accounts that still use passwords for their sign-ins. - Avoid the use of domain-wide, admin-level service accounts. - Restrict local administrative privileges to limit installation of Remote Access Trojans (RATs) and other unwanted applications. - Use Azure AD Conditional Access to explicitly validate the trust of users and workstations before allowing access to administrative portals. See [this example](/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management) for the Azure portal. You must make the users in your organization aware of: ## Resulting configuration -Here is the ransomware protection for your tenant for steps 1-3. +Here's the ransomware protection for your tenant for steps 1-3.  |
| solutions | Ransomware Protection Microsoft 365 Information | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/ransomware-protection-microsoft-365-information.md | description: Use controlled folder access, MIP, DLP, and Microsoft Defender for Because ransomware attackers will also look at your on-premises data located on file, database, and other types of servers, one of the best ways to protect that data is to migrate it to your Microsoft 365 tenant. Once there, it can be protected by built-in mitigation and recovery features such as [versioning, recycle bin, and Files Restore](ransomware-protection-microsoft-365.md#ransomware-mitigation-and-recovery-capabilities-provided-with-microsoft-365). -To provide additional protection of your sensitive information in your Microsoft 365 tenant: +To provide additional protection of sensitive information in your Microsoft 365 tenant: - Locate your sensitive information.-- Implement strict permissions and eliminating broad access (for example, too many users having write, edit, and delete abilities).+- Implement strict permissions and eliminating broad access (for example, prevent too many users having write, edit, and delete capabilities). - Protect your sensitive information. >[!Note] For each type of sensitive information, determine the following: - Its current location, such as a OneDrive or SharePoint folder or collaboration venue such as a Microsoft Teams team - The current permissions, which consist of: - - The user accounts who have access to it + - The user accounts who have access - - The actions that are allowed to each account that has access to it + - The actions that are allowed to each account that has access ## Implement strict permissions for locations with sensitive information -Using strict permissions within your Microsoft 365 tenant is the principle of least privilege for locations and communications venues, which in Microsoft 365 are typically OneDrive folders, SharePoint sites and folders, and teams. +Implementing strict permissions within your Microsoft 365 tenant uses the principle of least privilege for locations and communications venues, which in Microsoft 365 are typically OneDrive folders, SharePoint sites and folders, and teams. While it is easier to create file storage locations or teams with broad access (such as the default of everyone in your organization), for sensitive information, the user accounts that are permitted and the actions that are allowed must be confined to the minimum set required to meet collaboration and business requirements. -Once a ransomware attacker has infiltrated your tenant, they try to escalate their privileges by compromising the credentials of user accounts with wider scope of permissions across your tenant, such as administrator role accounts or user accounts that have access to sensitive information. +Once a ransomware attacker has infiltrated your tenant, they try to escalate their privileges by compromising the credentials of user accounts with wider scopes of permissions across your tenant, such as administrator role accounts or user accounts that have access to sensitive information. Based on this typical attacker behavior, there are two levels of difficulty for the attacker: You can ensure strict permissions in your tenant with these steps: 3. Perform change management for your users so that future locations for sensitive information are created and maintained with strict permissions. 4. Audit and monitor the locations for sensitive information to ensure that broad permissions aren't being granted. -See [Set up secure collaboration with Microsoft 365 and Microsoft Teams](setup-secure-collaboration-with-teams.md) for detailed guidance. An example of a communication and collaboration venue with strict permissions for sensitive information is a [team with security isolation](/microsoft-365/solutions/secure-teams-security-isolation). +See [Set up secure file sharing and collaboration with Microsoft Teams](setup-secure-collaboration-with-teams.md) for detailed guidance. An example of a communication and collaboration venue with strict permissions for sensitive information is a [team with security isolation](/microsoft-365/solutions/secure-teams-security-isolation). ## Protect your sensitive information -To protect your sensitive information in case a ransomware attacker has access to it: +To protect your sensitive information in case a ransomware attacker obtains access to it: - Use [controlled folder access](/windows/security/threat-protection/microsoft-defender-atp/controlled-folders) to make it more difficult for unauthorized applications to modify the data in controlled folders. Administrative changes to broad permissions can lead to users being denied acces Additionally, for the protection of sensitive information in your Microsoft 365 tenant, train your users to: -- Create communication and collaboration venues with strict permissions (the minimum set of user accounts for access and the minimum allowed actions for each). +- Create communication and collaboration venues with strict permissions (the minimum set of user accounts for access and the minimum allowed actions for each account). - Apply the proper sensitivity labels to sensitive information. - Use controlled folder access. ## Resulting configuration -Here is the ransomware protection for your tenant for steps 1-5. +Here's the ransomware protection for your tenant for steps 1-5.  Key information from Microsoft: - [Rapidly protect against ransomware and extortion](/security/compass/protect-against-ransomware) - [2021 Microsoft Digital Defense Report](https://www.microsoft.com/security/business/microsoft-digital-defense-report) (see pages 10-19) - [Ransomware: A pervasive and ongoing threat](https://security.microsoft.com/threatanalytics3/05658b6c-dc62-496d-ad3c-c6a795a33c27/overview) threat analytics report in the Microsoft 365 Defender portal+- Microsoft's Detection and Response Team (DART) ransomware [approach and best practices](/security/compass/incident-response-playbook-dart-ransomware-approach) and [case study](/security/compass/dart-ransomware-case-study) Microsoft 365: Microsoft 365: - [Handling ransomware in SharePoint Online](/sharepoint/troubleshoot/security/handling-ransomware-in-sharepoint-online) - [Threat analytics reports for ransomware](https://security.microsoft.com/threatanalytics3?page_size=30&filters=tags%3DRansomware&ordering=-lastUpdatedOn&fields=displayName,alertsCount,impactedEntities,reportType,createdOn,lastUpdatedOn,tags,flag) in the Microsoft 365 Defender portal - Microsoft 365 Defender: - [Find ransomware with advanced hunting](/microsoft-365/security/defender/advanced-hunting-find-ransomware) |
| solutions | Ransomware Protection Microsoft 365 Security Baselines | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/ransomware-protection-microsoft-365-security-baselines.md | Next, use [attack surface reduction rules](/microsoft-365/security/defender-endp Help prevent initial access to your tenant from an email-based attack with these Exchange email baseline settings: -- Enable Microsoft Defender Antivirus email scanning.+- Enable [Microsoft Defender Antivirus email scanning](/microsoft-365/security/defender-endpoint/configure-advanced-scan-types-microsoft-defender-antivirus). - Use Microsoft Defender for Office 365 for [enhanced phishing protection](/microsoft-365/security/office-365-security/anti-phishing-protection) and coverage against new threats and polymorphic variants. - Check your Office 365 email filtering settings to ensure you block spoofed emails, spam, and emails with malware. Use Defender for Office 365 for enhanced phishing protection and coverage against new threats and polymorphic variants. Configure Defender for Office 365 to [recheck links on click](/microsoft-365/security/office-365-security/atp-safe-links) and [delete delivered mails](/microsoft-365/security/office-365-security/zero-hour-auto-purge) in response to newly acquired threat intelligence. - Review and update to the latestΓÇ»[recommended settings for EOP and Defender for Office 365 security](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365-atp). Help prevent initial access to your tenant from an email-based attack with these Apply [security baselines](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines) for: -- Microsoft Windows 10+- Microsoft Windows 11 or 10 - Microsoft 365 Apps for Enterprise - Microsoft Edge Additionally, Exchange email baseline settings can block incoming email and prev ## Resulting configuration -Here is the ransomware protection for your tenant after this step. +Here's the ransomware protection for your tenant after this step.  |
| solutions | Ransomware Protection Microsoft 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/ransomware-protection-microsoft-365.md | For more information about ransomware protection across Microsoft products, see The security of your Microsoft cloud services is a partnership between you and Microsoft: -- Microsoft cloud services are built on a foundation of trust and security. Microsoft provides you security controls and capabilities to help you protect your data and applications.+- Microsoft cloud services are built on a foundation of trust and security. Microsoft provides you with security controls and capabilities to help you protect your data and applications. - You own your data and identities and the responsibility for protecting them, the security of your on-premises resources, and the security of cloud components you control. By combining these capabilities and responsibilities, we can provide the best protection against a ransomware attack. A ransomware attacker that has infiltrated a Microsoft 365 tenant can hold your - Encrypting files in place - Copying files outside your tenant (data exfiltration) -However, Microsoft 365 online services have many built-in capabilities and controls to protect customer data from ransomware attacks. The following sections provide a summary. For more details about how Microsoft protects customer data, [Malware and ransomware protection in Microsoft 365](/compliance/assurance/assurance-malware-and-ransomware-protection). +However, Microsoft 365 online services have many built in capabilities and controls to protect customer data from ransomware attacks. The following sections provide a summary. For more details about how Microsoft protects customer data, [Malware and ransomware protection in Microsoft 365](/compliance/assurance/assurance-malware-and-ransomware-protection). >[!Note] >A ransomware attack on a Microsoft 365 tenant assumes that the attacker has valid user account credentials for a tenant and has access to all of the files and resources that are permitted to the user account. An attacker without any valid user account credentials would have to decrypt the data at rest that has been encrypted by Microsoft 365 default and enhanced encryption. For more information, see [Encryption and key management overview](/compliance/assurance/assurance-encryption). Files in SharePoint and OneDrive for Business are protected by: If the ransomware creates a new encrypted copy of the file and deletes the old file, customers have 93 days to restore it from the recycle bin. After 93 days, there is a 14-day window where Microsoft can still recover the data. - To minimize the burden on your security and helpdesk staff, train your users on how to [restore files from the recycle bin](https://support.microsoft.com/en-us/office/restore-deleted-items-from-the-site-collection-recycle-bin-5fa924ee-16d7-487b-9a0a-021b9062d14b). + To minimize the burden on your security and helpdesk staff, train your users on how to [restore files from the recycle bin](https://support.microsoft.com/office/restore-deleted-items-from-the-site-collection-recycle-bin-5fa924ee-16d7-487b-9a0a-021b9062d14b). -- [Files Restore](https://techcommunity.microsoft.com/t5/microsoft-onedrive-blog/announcing-new-onedrive-for-business-feature-files-restore/ba-p/147436)+- [Files Restore](https://support.microsoft.com/office/restore-your-onedrive-fa231298-759d-41cf-bcd0-25ac53eb8a15) A complete self-service recovery solution for SharePoint and OneDrive that allows administrators and end users to restore files from any point in time during the last 30 days. - To minimize the burden on your security and IT helpdesk staff, train your users on [Files Restore](https://techcommunity.microsoft.com/t5/microsoft-onedrive-blog/announcing-new-onedrive-for-business-feature-files-restore/ba-p/147436). + To minimize the burden on your security and IT helpdesk staff, train your users on [Files Restore](https://support.microsoft.com/office/restore-your-onedrive-fa231298-759d-41cf-bcd0-25ac53eb8a15). For OneDrive and SharePoint files, Microsoft can roll back to a previous point in time for up to 14 days if you are hit by a mass attack. You can prevent a ransomware attacker from copying files outside your tenant wit Block downloads of sensitive information such as files. - You can also use session policies for [Microsoft Defender for Cloud Apps Conditional Access App Control](/cloud-app-security/tutorial-dlp#how-to-discover-and-protect-sensitive-information-in-your-organization) to monitor the flow of information between a user and an application in real time. + You can also use session policies for [Defender for Cloud Apps Conditional Access App Control](/cloud-app-security/tutorial-dlp#how-to-discover-and-protect-sensitive-information-in-your-organization) to monitor the flow of information between a user and an application in real time. ## WhatΓÇÖs in this solution -This solution steps you through the deployment of Microsoft 365 protection and mitigation features, configurations, and ongoing operations to minimize the ability of a ransomware attacker to use the critical data in your Microsoft 365 tenant to hold your organization for ransom. +This solution steps you through the deployment of Microsoft 365 protection and mitigation features, configurations, and ongoing operations to minimize the ability of a ransomware attacker to use the critical data in your Microsoft 365 tenant and hold your organization for ransom.  To protect your Microsoft 365 tenant from a ransomware attack, use these Microso | Capability or feature | Description | Helps... | Licensing | |:-|:--|:-|:-|-| Microsoft Secure Score | Measures the security posture of a Microsoft 365 tenant | Assess your security configuration and suggests improvements. | Microsoft 365 E3 or Microsoft 365 E5 | -| Attack surface reduction rules | Reduces your organization's vulnerability to cyber attacks using a variety of configuration settings | Block suspicious activity and vulnerable content. | Microsoft 365 E3 or Microsoft 365 E5 | -| Exchange email settings | Enables services that reduce your organization's vulnerability to an email-based attack | Prevent initial access to your tenant through phishing and other email-based attacks. | Microsoft 365 E3 or Microsoft 365 E5 | -| Microsoft Windows, Microsoft Edge, and Microsoft 365 Apps for Enterprise settings | Provides industry-standard security configurations that are broadly known and well-tested | Prevent attacks through Windows, Edge, and Microsoft 365 Apps for Enterprise. | Microsoft 365 E3 or Microsoft 365 E5 | +| Microsoft Secure Score | Measures the security posture of a Microsoft 365 tenant. | Assess your security configuration and suggests improvements. | Microsoft 365 E3 or Microsoft 365 E5 | +| Attack surface reduction rules | Reduces your organization's vulnerability to cyber attacks using a variety of configuration settings. | Block suspicious activity and vulnerable content. | Microsoft 365 E3 or Microsoft 365 E5 | +| Exchange email settings | Enables services that reduce your organization's vulnerability to an email-based attack. | Prevent initial access to your tenant through phishing and other email-based attacks. | Microsoft 365 E3 or Microsoft 365 E5 | +| Microsoft Windows, Microsoft Edge, and Microsoft 365 Apps for Enterprise settings | Provides industry-standard security configurations that are broadly known and well-tested. | Prevent attacks through Windows, Edge, and Microsoft 365 Apps for Enterprise. | Microsoft 365 E3 or Microsoft 365 E5 | | ### 2. Detection and response | Capability or feature | Description | Helps detect and respond to... | Licensing | |:-|:--|:-|:-|-| Microsoft 365 Defender | Combines signals and orchestrates capabilities into a single solution <br><br> Enables security professionals to stitch together threat signals and determine the full scope and impact of a threat <br><br> Automates actions to prevent or stop the attack and self-heal affected mailboxes, endpoints, and user identities | Incidents, which are the combined alerts and data that make up an attack. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | -| Microsoft Defender for Identity | Identifies, detects, and investigates advanced threats, compromised identities, and malicious insider actions directed at your organization through a cloud-based security interface uses your on-premises Active Directory Domain Services (AD DS) signals | Credential compromise for AD DS accounts. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | -| Microsoft Defender for Office 365 | Safeguards your organization against malicious threats posed by email messages, links (URLs), and collaboration tools <br><br> Protects against malware, phishing, spoofing, and other attack types | Phishing attacks. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | -| Microsoft Defender for Endpoint | Enables detection and response to advanced threats across endpoints (devices) | Malware installation and device compromise. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | -| Azure Active Directory (Azure AD) Identity Protection | Automates detection and remediation of identity-based risks and investigation of those risks | Credential compromise for Azure AD accounts and privilege escalation. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | -| Microsoft Defender for Cloud Apps | A cloud access security broker for discovery, investigation, and governance across all your Microsoft and third-party cloud services | Lateral movement and data exfiltration. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | +| Microsoft 365 Defender | Combines signals and orchestrates capabilities into a single solution. <br><br> Enables security professionals to stitch together threat signals and determine the full scope and impact of a threat. <br><br> Automates actions to prevent or stop the attack and self-heal affected mailboxes, endpoints, and user identities. | Incidents, which are the combined alerts and data that make up an attack. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | +| Microsoft Defender for Identity | Identifies, detects, and investigates advanced threats, compromised identities, and malicious insider actions directed at your organization through a cloud-based security interface uses your on-premises Active Directory Domain Services (AD DS) signals. | Credential compromise for AD DS accounts. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | +| Microsoft Defender for Office 365 | Safeguards your organization against malicious threats posed by email messages, links (URLs), and collaboration tools. <br><br> Protects against malware, phishing, spoofing, and other attack types. | Phishing attacks. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | +| Microsoft Defender for Endpoint | Enables detection and response to advanced threats across endpoints (devices). | Malware installation and device compromise. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | +| Azure Active Directory (Azure AD) Identity Protection | Automates detection and remediation of identity-based risks and investigation of those risks. | Credential compromise for Azure AD accounts and privilege escalation. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | +| Defender for Cloud Apps | A cloud access security broker for discovery, investigation, and governance across all your Microsoft and third-party cloud services. | Lateral movement and data exfiltration. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | | ### 3. Identities | Capability or feature | Description | Helps prevent... | Licensing | |:-|:--|:-|:-|-|Azure AD Password Protection|Block passwords from a common list and custom entries.|Cloud or on-premises user account password determination.|Microsoft 365 E3 or Microsoft 365 E5| -|MFA enforced with Conditional Access|Require MFA based on the properties of user sign-ins with Conditional Access policies.|Credential compromise and access.|Microsoft 365 E3 or Microsoft 365 E5| -|MFA enforced with risk-based Conditional Access|Require MFA based on the risk of user sign-ins with Azure AD Identity protection |Credential compromise and access.|Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on| +|Azure AD Password Protection | Block passwords from a common list and custom entries. | Cloud or on-premises user account password determination. |Microsoft 365 E3 or Microsoft 365 E5| +|MFA enforced with Conditional Access | Require MFA based on the properties of user sign-ins with Conditional Access policies. | Credential compromise and access. | Microsoft 365 E3 or Microsoft 365 E5| +|MFA enforced with risk-based Conditional Access | Require MFA based on the risk of user sign-ins with Azure AD Identity protection. |Credential compromise and access. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on| | ### 4. Devices For device and app management: | Capability or feature | Description | Helps prevent... | Licensing | |:-|:--|:-|:-|-| Microsoft Intune | Manage devices and the applications that run on them | Device or app compromise and access. | Microsoft 365 E3 or E5 | +| Microsoft Intune | Manage devices and the applications that run on them. | Device or app compromise and access. | Microsoft 365 E3 or E5 | | | | | | -For Windows 10 devices: +For Windows 11 or 10 devices: | Capability or feature | Description | Helps... | Licensing | |:-|:--|:-|:-| For Windows 10 devices: | Capability or feature | Description | Helps... | Licensing | |:-|:--|:-|:-|-| Controlled folder access | Protects your data by checking apps against a list of known, trusted apps | Prevent files from being altered or encrypted by ransomware. | Microsoft 365 E3 or Microsoft 365 E5 | +| Controlled folder access | Protects your data by checking apps against a list of known, trusted apps. | Prevent files from being altered or encrypted by ransomware. | Microsoft 365 E3 or Microsoft 365 E5 | | Microsoft Information Protection | Enables sensitivity labels to be applied to information that is ransomable | Prevent use of exfiltrated information. | Microsoft 365 E3 or Microsoft 365 E5 |-| Data loss prevention (DLP) | Protects sensitive data and reduces risk by preventing users from sharing it inappropriately | Prevent data exfiltration. | Microsoft 365 E3 or Microsoft 365 E5 | -| Microsoft Defender for Cloud Apps | A cloud access security broker for discovery, investigation, and governance | Detect lateral movement and prevent data exfiltration. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | +| Data loss prevention (DLP) | Protects sensitive data and reduces risk by preventing users from sharing it inappropriately. | Prevent data exfiltration. | Microsoft 365 E3 or Microsoft 365 E5 | +| Defender for Cloud Apps | A cloud access security broker for discovery, investigation, and governance. | Detect lateral movement and prevent data exfiltration. | Microsoft 365 E5 or Microsoft 365 E3 with the Microsoft 365 E5 Security add-on | | ## Impact on users and change management Key information from Microsoft: - [Rapidly protect against ransomware and extortion](/security/compass/protect-against-ransomware) - [2021 Microsoft Digital Defense Report](https://www.microsoft.com/security/business/microsoft-digital-defense-report) (see pages 10-19) - [Ransomware: A pervasive and ongoing threat](https://security.microsoft.com/threatanalytics3/05658b6c-dc62-496d-ad3c-c6a795a33c27/overview) threat analytics report in the Microsoft 365 Defender portal+- Microsoft's Detection and Response Team (DART) ransomware [approach and best practices](/security/compass/incident-response-playbook-dart-ransomware-approach) and [case study](/security/compass/dart-ransomware-case-study) Microsoft 365: |
| test-base | Buildpackage | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/test-base/buildpackage.md | + + Title: 'Build a package' +description: How to build your package +search.appverid: MET150 ++++audience: Software-Vendor + Last updated : 02/28/2022++ms.localizationpriority: medium ++++f1.keywords: NOCSH +++# Build a package +A package is a .zip file containing your application binary and test scripts, which is the prerequisite to use Test Base. This QuickStart will guide you to build your first package, with which you can perform Out-of-box testing on your application. + +* *An **Out-of-Box (OOB)** test performs an install, launch, close, and uninstall of your application. After the install, the launch-close routine is repeated 30 times before a single uninstall is run. The OOB test provides you with standardized telemetry on your package to compare across Windows builds.* + +Optionally, you can download our [sample package](https://aka.ms/testbase-sample-package) to reference and begin with. ++## Create a folder structure ++In your local computer, create a folder structure as follows:<br> + ++These folders are used: +* **App\bin**: save the application and dependency binaries.<br> +* **App\scripts**: save scripts to install, launch, close and uninstall your application.<br> +* **App\logs**: scripts should output logs to this folder, then you can download and analyze logs after test is finished.<br> ++## Copy binary file(s) +Copy your application installation files to **App\bin**. If your application has dependencies, they need to be installed first. Also, copy the dependency installation files to **App\bin**.<br> + ++## Add PowerShell scripts +To perform OOB test, you will need to add PowerShell scripts to install, launch, close, and uninstall your application. +> [!NOTE] +> *In OOB test, install, launch, and close scripts are required, while uninstall script is optional*. + +The script should be added to the folder as follows: + ++A script usually includes the following behaviors:<br> +- **Run the commands to install/launch/close/uninstall the application**. E.g., if your application is an MSI file, run [msiexec](/windows-server/administration/windows-commands/msiexec) to install it. <br> +- **Check the result of install/launch/close/uninstall operation**, return zero exit code if the result is expected. Test Base will mark a script run as failure if it returns a non-zero exit code.<br> +- **Save enough logs**, save proper logs for future use.<br> ++Please refer to the following examples. You can simply copy them to your files and make changes accordingly. <br> ++**Example of install script (App\scripts\install\job.ps1)** +```powershell + push-location $PSScriptRoot + $exit_code = 0 + $script_name = $myinvocation.mycommand.name + $log_dir = "$PSScriptRoot\..\..\logs" + $log_file = "$log_dir\$script_name.log" +++ if(-not (test-path -path $log_dir )) { + new-item -itemtype directory -path $log_dir + } ++ Function log { + Param ([string]$log_string) + write-host $log_string + add-content $log_file -value $log_string + } ++ log("Installing TestBaseM365 Digital Clock") + push-location "..\..\bin" + if ([Environment]::Is64BitProcess) { + $installer_name = "TestBaseM365DigitalClock.msi" + } + else { + $installer_name = "TestBaseM365DigitalClock.msi" + } + $arguments = "/i "+$installer_name+" /quiet /L*v "+"$log_dir"+"\atp-client-installation.log" ++ $installer = Start-Process msiexec.exe $arguments -wait -passthru + pop-location ++ if ($installer.exitcode -eq 0) { + log("Installation succesful as $($installer.exitcode)") + } + else { + log("Error: Installation failed as $($installer.exitcode)") + $exit_code = $installer.exitcode + } ++ log("Installation script finished as $exit_code") + pop-location + exit $exit_code +``` ++**Example of launch script (App\scripts\launch\job.ps1)** +```powershell + push-location $PSScriptRoot + $exit_code = 0 + $script_name = $myinvocation.mycommand.name + $log_dir = "$PSScriptRoot\..\..\logs" + $log_file = "$log_dir\$script_name.log" ++ if(-not (test-path -path $log_dir )) { + new-item -itemtype directory -path $log_dir + } ++ Function log { + Param ([string]$log_string) + write-host $log_string + add-content $log_file -value $log_string + } ++ log("Launch TestBaseM365 Digital Clock") ++ $PROCESS_NAME = "DigitalClock" + $exePath = "C:\Program Files\Test Base M365\DigitalClock\DigitalClock.exe" ++ Start-Process -FilePath $exePath ++ if (Get-Process -Name $PROCESS_NAME) { + log("Launch successfully $PROCESS_NAME...") + $exit_code = 0 + } + else { + log("Not launched $PROCESS_NAME...") + $exit_code = 1 + } ++ log("Launch script finished as $exit_code") + pop-location + exit $exit_code +``` ++## Compress to zip file +After scripts and binaries are prepared, you proceed to compress the folder to a zip file. Right click on the App folder, select **Compress to ZIP file**.<br> + +++## Verify your package locally (optional) +After building the zip package, you can upload it to your Test Base account. <br> +However, it's best practice to run the test locally to ensure the scripts work properly before uploading. A local test can quickly identify issues and speed up your uploading process. To verify locally follow the steps below:<br> +1. Prepare a VM (Virtual Machine)<br> + We recommend using a virtual machine for this local test since a clean Windows environment is currently needed for each test. It's easy to create a Windows VM on Azure ([Quickstart: Windows virtual machine](/azure/virtual-machines/windows/quick-create-portal)), you can select a proper Windows version (image) for your test, e.g., *Windows 10 Pro, version 21H2.*<br> ++2. Copy your package to the VM<br> + There are many ways to copy your package file to the VM. If you're using an Azure VM, you can choose to: + - Copy file directly in your Remote Desktop connection. <br> + - Use Azure file share ([Quickstart: Create and manage Azure file](/azure/storage/files/storage-files-quick-create-use-windows)) + + You can create a specific folder for this test and copy the package file under this folder. e.g., *C:\TestBase*.<br> +3. Test the package<br> + Open Windows PowerShell, switch to the directory containing the package, e.g., cd C:\TestBase, and start to run your tests on the package:<br> + a. Extract the package file. + - *Expand-Archive -LiteralPath C:\TestBase\App.zip -DestinationPath C:\TestBase*<br> + + b. Run install script. + - *C:\TestBase\App\scripts\install\job.ps1*<br> + + c. Restart the VM if necessary.<br> + + d. Run launch script. + - *C:\TestBase\App\scripts\install\job.ps1*<br> + + e. Run close script. + - *C:\TestBase\App\scripts\close\job.ps1*<br> + + f. Run uninstall script (if you have one). + - *C:\TestBase\App\scripts\uninstall\job.ps1*<br> + + After each step, you can check if there are any issues in your script. If all scripts run as expected, your package is ready to be uploaded to your Test Base account. +++## Next steps +[Upload a package](uploadApplication.md) + + |