-> [!NOTE]

-> Web grounding in Copilot uses only the Bing Search service. Copilot with commercial data protection (previously named Bing Chat Enterprise) is a separate offering and not involved with web grounding.

-> - As an admin, you can't assign or unassign licenses for a self-service purchase subscription bought by a user in your organization. You can [take over a purchase or trial subscription](../../commerce/subscriptions/manage-self-service-purchases-admins.md#take-over-a-purchase-or-trial-subscription), and then assign or unassign licenses.

-Centralized deployment of add-ins requires that the users are using Microsoft 365 Business licenses (Business Basic, Business Standard, Business Premium), Office 365 Enterprise licenses (E1/E3/E5/F3), or Microsoft 365 Enterprise licenses (E3/E5/F3) (and are signed in Microsoft 365 using their organizational ID), Office 365 Education licenses (A1/A3/A5), or Microsoft 365 Education licenses (A3/A5), and have Exchange Online and active Exchange Online mailboxes. Your subscription directory must either be in or federated to Microsoft Entra ID.

-Multifactor authentication (MFA) is a very important first step in securing your organization. Microsoft 365 for Business gives you the option to use security defaults or Conditional Access policies to turn on MFA for your admins and user accounts. For most organizations, **Security defaults** offer a good level of sign-in security. But if your organization must meet more stringent requirements, you can use **Conditional Access policies** instead.

-> [!IMPORTANT]

-> If you purchased your subscription or trial after October 21, 2019, and you're prompted for MFA when you sign in, [security defaults](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults) have been automatically enabled for your subscription.

-## Watch: Turn on multifactor authentication

-Check out this video and others on our [YouTube channel](https://go.microsoft.com/fwlink/?linkid=2197909).

-## Before you begin

-### Turn off legacy per-user MFA

-Per-user MFA is a legacy service and you should give consideration to using the newer Security defaults or Conditional Access policies.

-## Turn Security defaults on or off

-For most organizations, Security defaults offer a good level of additional sign-in security. For more information, see [What are security defaults?](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults)

-If your subscription is new, Security defaults might already be turned on for you automatically.

-You enable or disable security defaults from the **Properties** pane in the Microsoft Entra admin center.

-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as least a [Security Administrator](/entra/identity/role-based-access-control/permissions-reference#security-administrator).

-If your organization has more granular sign-in security needs, Conditional Access policies can offer you more control. Conditional Access lets you create and define policies that react to sign in events and request additional actions before a user is granted access to an application or service.

-Conditional Access is available for customers who have purchased Microsoft Entra ID P1, or licenses that include this, such as Microsoft 365 Business Premium, and Microsoft 365 E3. For more information, see [create a Conditional Access policy](/azure/active-directory/authentication/tutorial-enable-azure-mfa).

-Risk-based conditional access is available through Microsoft Entra ID P2 license, or licenses that include this, such as Microsoft 365 E5. For more information, see [risk-based Conditional Access](/azure/active-directory/conditional-access/howto-conditional-access-policy-risk).

-### Turn on Modern authentication for your organization

-For most subscriptions modern authentication is automatically turned on, but if you purchased your subscription before August 2017, it's likely that you'll need to turn on Modern Authentication in order to get features like multifactor authentication to work in Windows clients like Outlook.

-1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>, in the left nav choose **Settings** \> **Org settings**.

-2. Under the **Services** tab, choose **Modern authentication**, and in the **Modern authentication** pane, make sure **Enable Modern authentication** is selected. Choose **Save changes**.

-[Set up multifactor authentication](set-up-multi-factor-authentication.md) (video)\

-[Turn on multifactor authentication for your phone](https://support.microsoft.com/office/ace1d096-61e5-449b-a875-58eb3d74de14) (article)\

-> [!IMPORTANT]

-> As of April 1, 2023, we no longer accept checks as a payment method for subscriptions paid by invoice. Pay by check is no longer available as a payment option, and check payment instructions have been removed from invoices. You can still pay for your invoice by wire transfer. See your invoice for wire transfer payment information. If you're an existing customer who currently pays by check, you have until September 30, 2023 to change to paying by wire transfer, and avoid possible service disruption.

-| Subtotal |The pre-tax amount due |

-Payment instructions depend on your payment method and are provided at the bottom of the invoice PDF. If your payment method is a credit or debit card, it's automatically charged within 10 days of the invoice date. If your payment method is by wire transfer, see the information under **Payment Instructions** in the PDF.

-If you have an MCA billing account type, you can buy more licenses for your subscription at any time. However, you can only remove licenses from your subscription if itΓÇÖs within seven days of you buying or renewing your subscription. For more information, see [Remove licenses from your subscription](#remove-licenses-from-your-subscription).

-If you have an MCA billing account type and buy licenses in the middle of your billing period, you have seven days from when you buy them to reduce the number of licenses you bought.

-3. On the subscription details page, select **Buy licenses**.

-If you have an MCA billing account type, you can only remove licenses from your subscription during a limited time window after you buy or renew your subscription, or if you recently bought more licenses. If the window is closed, the subscription details page lists the date when your plan changes take effect.

-3. On the subscription details page, select **Remove licenses**.

-3. On the subscription details page, select **Buy licenses** or **Remove licenses**.

-## Add licenses to a prepaid subscription by using a product key

-> If you don't want to buy a new product key, you can always choose to add a credit card or debit card to your subscription to pay for more licenses. For more information, see [Renew your subscription](../subscriptions/renew-your-subscription.md).

-

-1. Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">admin center</a>.

-|A credit check is pending. |If a credit check is pending, you can't buy or remove licenses until the credit check is complete. | Check back later to see if the credit check is complete. Credit checks typically take up to two working days to complete. After the credit check is complete, you should be able to select the **Buy licenses** and **Remove licenses** buttons. |

-## How does buying or removing licenses affect my billing statements?

-If you have an MOSA billing account type, the previous charge for the original number of licenses is deducted on your next billing statement. We add a prorated charge for the time period with the original number of licenses and add a charge for the new license count. There's also a charge for the current license count for the remainder of your billing period.

- - has-azure-ad-ps-ref, azure-ad-ref-level-one-done

-As an admin, you can use the Microsoft 365 admin center to see self-service purchases and trials (referred to in this article as *purchases and trials*) made by people in your organization. You can see the product name, purchaser name, subscriptions purchased, expiration date, purchase price, and assigned users for each purchase or trial subscription. You have the same data management and access policies over products bought through self-service purchase or centrally.

-You can also control whether users in your organization can make purchases or sign up for trials. To learn how to manage these settings, see [Use AllowSelfServicePurchase for the MSCommerce PowerShell module](allowselfservicepurchase-powershell.md).

-## Understand purchases and trials

-Purchases require a payment method at sign-up, and automatically renew at the end of the subscription term.

-Some trials require a payment method at sign-up, and automatically convert to a paid version when the trial ends.

-Other trials don't require a payment method at sign-up, and don't automatically renew. Trials without a payment method are only available to select customers with an existing subscription agreement.

-## How we use a user's directory data

-When you enable the **AllowSelfServicePurchase** policy, you permit Microsoft's Commerce service to process a user's directory data, which is outside the boundaries of the Microsoft 365 tenant. Specifically, Microsoft Commerce collects an Azure Active Directory v1.0 access token, which contains the user's first and last name, email address, IP address, and tenant and user GUID. For a full list of attributes included in the access token, see [Microsoft identity platform access tokens](/azure/active-directory/develop/access-tokens).

-We use the directory data to provide the user with a license and to send email about the subscription to the user. The directory data processed by Microsoft Commerce is governed by the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). To learn more about the terms that apply to self-service trials, see [Organizational trial ΓÇô Terms of service](/legal/microsoft-365/in-app-trials-terms-of-service). Like other Microsoft products used by your organization, use of a self-service purchase or trial product is governed by the [Microsoft Product Terms](https://www.microsoft.com/licensing/terms). Before a user makes a purchase or starts a trial, we advise the user of the personal data that we process and the terms that apply.

-## View self-service subscriptions

-1. In the Microsoft 365 admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page.

-1. In the admin center, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=850626" target="_blank">Your products</a> page.

-2. On the **Products** tab, select the filter icon, then select **Self-service**.

-3. To view more details about a subscription, choose one from the list.

-## View who has licenses for a purchase or trial subscription

-> [!NOTE]

-> As an admin, you can't assign or unassign licenses for a purchase or trial subscription bought by a user in your organization. You can [take over a purchase or trial subscription](#take-over-a-purchase-or-trial-subscription), and then assign or unassign licenses.

-1. In the Microsoft 365 admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page.

- 1. In the Microsoft 365 admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page.

-5. To export a list of users with licenses for these subscriptions, choose the subscriptions that you want to export, then choose **Export users**.

-## Enable or disable purchases and trials

-You can enable or disable purchases and trials for users in your organization. The **MSCommerce** PowerShell module includes a **PolicyID** parameter value for **AllowSelfServicePurchase** that lets you control whether users in your organization can make purchases or start trials, and for which products.

-You can use the **MSCommerce** PowerShell module to:

-<a name='use-powershell-and-azure-ad-to-enable-or-disable-all-self-service-sign-ups'></a>

-## Use PowerShell and Microsoft Entra ID to enable or disable all self-service sign-ups

-You can use PowerShell commands to change the settings that control self-service sign-ups. To turn off all self-service sign-ups, use the **Microsoft Graph** PowerShell module to change the **MgPolicyAuthorizationPolicy** setting for **AllowedToSignUpEmailBasedSubscriptions** in Microsoft Entra ID. For the steps to turn off self-service sign-ups, see [Update-MgPolicyAuthorizationPolicy](/powershell/module/microsoft.graph.identity.signins/update-mgpolicyauthorizationpolicy).

-You can assign existing licenses or buy extra subscriptions through existing agreements for users assigned to purchases or trials. After you assign these centrally purchased licenses, you can request that users cancel their existing subscriptions. Alternatively, you can take over the subscription and cancel it yourself in the admin center. For steps to do that, see [Take over a purchase or trial subscription](#take-over-a-purchase-or-trial-subscription).

-1. In the admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=868433" target="_blank">Purchase services</a> page.

-1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=850627" target="_blank">admin center</a>, go to the **Billing** > **Purchase services** page.

-2. Find and choose the product that you want to buy, then choose **Buy**.

-4. Follow the steps in [View who has licenses for a purchase or trial subscription](#view-who-has-licenses-for-a-purchase-or-trial-subscription) to export a list of users to reference in the next step.

-5. Assign licenses to everyone who has a license in the other subscription. For full steps, see [Assign licenses to users](../../admin/manage/assign-licenses-to-users.md).

-## Take over a purchase or trial subscription

-You can take over a purchase or trial subscription made by a user in your organization. When you take over a purchase or trial subscription, you have two options:

-When you move users to a different subscription, the old subscription is automatically canceled. The user who originally bought the purchase or trial subscription receives an email that says the subscription was canceled.

-1. In the admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page.

-1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=850627" target="_blank">admin center</a>, go to the **Billing** > **Your products** page.

-5. In the right pane, select **Move users**.

-### Cancel a purchase or trial subscription

-When you choose to cancel a purchase or trial subscription, users with licenses lose access to the product. The user who originally signed up for the purchase or trial subscription receives an email that says the subscription was canceled.

-1. In the admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page.

-1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=850627" target="_blank">admin center</a>, go to the **Billing** > **Your products** page.

-5. In the right pane, select **Cancel subscription**.

-8. Close the right pane.

-For common questions about purchases and trials, see [Self-service purchases FAQ](self-service-purchase-faq.yml).

-If you have questions or need help with purchases and trials, [contact support](../../admin/get-help-support.md).

-## Use the Azure Active Directory PowerShell for Graph module

-First, use a **Microsoft Entra DC admin**, **Cloud Application Admin**, or **Global admin** account to [connect to your Microsoft 365 tenant](connect-to-microsoft-365-powershell.md#connect-with-the-azure-active-directory-powershell-for-graph-module).

-

-Next, fill in the sign-in and role names and run these commands:

-$userName="<sign-in name of the account>"

-$roleName="<admin role name>"

-$role = Get-AzureADDirectoryRole | Where {$_.displayName -eq $roleName}

-$roleTemplate = Get-AzureADDirectoryRoleTemplate | Where {$_.displayName -eq $roleName}

-Enable-AzureADDirectoryRole -RoleTemplateId $roleTemplate.ObjectId

-$role = Get-AzureADDirectoryRole | Where {$_.displayName -eq $roleName}

-Add-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -RefObjectId (Get-AzureADUser | Where {$_.UserPrincipalName -eq $userName}).ObjectID

-

-$userName="belindan@contoso.com"

-$roleName="SharePoint Service Administrator"

-$role = Get-AzureADDirectoryRole | Where {$_.displayName -eq $roleName}

-$roleTemplate = Get-AzureADDirectoryRoleTemplate | Where {$_.displayName -eq $roleName}

-Enable-AzureADDirectoryRole -RoleTemplateId $roleTemplate.ObjectId

-$role = Get-AzureADDirectoryRole | Where {$_.displayName -eq $roleName}

-Add-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -RefObjectId (Get-AzureADUser | Where {$_.UserPrincipalName -eq $userName}).ObjectID

-To display the list of user names for a specific admin role, use these commands.

-Get-AzureADDirectoryRole | Where { $_.DisplayName -eq $roleName } | Get-AzureADDirectoryRoleMember | Ft DisplayName

-```

-## Use the Microsoft Azure Active Directory module for Windows PowerShell

-First, use a global administrator account to [connect to your Microsoft 365 tenant](connect-to-microsoft-365-powershell.md#connect-with-the-microsoft-azure-active-directory-module-for-windows-powershell).

-

-### For a single role change

-The most common ways to specify the user account is by using its display name or its email name, which also known as its sign-in name or user principal name (UPN).

-#### Display names of user accounts

-If you're used to working with the display names of user accounts, determine the following information:

-

-

- To specify the user account, you must determine its Display Name. To get a complete list of accounts, use this command:

-

- ```powershell

- Get-MsolUser -All | Sort DisplayName | Select DisplayName | More

- ```

- This command lists the Display Name of your user accounts, sorted by the Display Name, one screen at a time. You can filter the list to a smaller set by using the **Where** cmdlet. See the following example.

- >[!Note]

- >PowerShell Core doesn't support the Microsoft Azure Active Directory module for Windows PowerShell module and cmdlets with *Msol* in their name. Run these cmdlets from Windows PowerShell.

- >

-

- ```powershell

- Get-MsolUser -All | Where DisplayName -like "John*" | Sort DisplayName | Select DisplayName | More

- ```

- This command lists only the user accounts for which the Display Name starts with "John".

-

-

- To display the list of available admin roles that you can assign to user accounts, use this command:

-

- ```powershell

- Get-MsolRole | Sort Name | Select Name,Description

- ```

-After you determine the Display Name of the account and the name of the role, use these commands to assign the role to the account:

-

-```powershell

-$dispName="<The Display Name of the account>"

-$roleName="<The admin role name you want to assign to the account>"

-Add-MsolRoleMember -RoleMemberEmailAddress (Get-MsolUser -All | Where DisplayName -eq $dispName).UserPrincipalName -RoleName $roleName

-```

-Paste the commands into Notepad. For the *$dispName* and *$roleName* variables, replace the description text with their values. Remove the \< and > characters but keep the quotation marks. Paste the modified lines into the Microsoft Azure Active Directory module for Windows PowerShell window to run them. Alternately, you can use the Windows PowerShell Integrated Script Environment (ISE).

-

-Here's an example of a completed command set:

-

-```powershell

-$dispName="Scott Wallace"

-$roleName="SharePoint Service Administrator"

-Add-MsolRoleMember -RoleMemberEmailAddress (Get-MsolUser -All | Where DisplayName -eq $dispName).UserPrincipalName -RoleName $roleName

-```

-#### Sign-in names of user accounts

-If you're used to working with the sign-in names or UPNs of user accounts, determine the following information:

-

-

- If you don't know the UPN, use this command:

-

- ```powershell

- Get-MsolUser -All | Sort UserPrincipalName | Select UserPrincipalName | More

- ```

- This command lists the UPN of your user accounts, sorted by UPN, one screen at a time. You can use the **Where** cmdlet to filter the list. Here's an example:

-

- ```powershell

- Get-MsolUser -All | Where DisplayName -like "John*" | Sort UserPrincipalName | Select UserPrincipalName | More

- ```

- This command lists only the user accounts for which the Display Name starts with "John".

-

-

- To display the list of available roles that you can assign to user accounts, use this command:

-

- ```powershell

- Get-MsolRole | Sort Name | Select Name,Description

- ```

-After you have the UPN of the account and the name of the role, use these commands to assign the role to the account:

-

-```powershell

-$upnName="<The UPN of the account>"

-$roleName="<The role name you want to assign to the account>"

-Add-MsolRoleMember -RoleMemberEmailAddress $upnName -RoleName $roleName

-```

-Copy the commands and paste them into Notepad. For the **$upnName** and **$roleName** variables. Replace the description text with their values. Remove the \< and > characters but keep the quotation marks. Paste the modified lines into Microsoft Azure Active Directory module for Windows PowerShell window to run them. Alternately, you can use the Windows PowerShell ISE.

-

-Here's an example of a completed command set:

-

-```powershell

-$upnName="scottw@contoso.com"

-$roleName="SharePoint Service Administrator"

-Add-MsolRoleMember -RoleMemberEmailAddress $upnName -RoleName $roleName

-```

-### Multiple role changes

-For multiple role changes, determine the following information:

-

-

-

- ```powershell

- Get-MsolRole | Sort Name | Select Name,Description

- ```

-Next, create a comma-separated value (CSV) text file that has the display name or UPN and role name fields. You can do this easily in Microsoft Excel.

-Here's an example for display names:

-

-```powershell

-DisplayName,RoleName

-"Belinda Newman","Billing Administrator"

-"Scott Wallace","SharePoint Service Administrator"

-```

-Next, fill in the location of the CSV file and run the resulting commands at the PowerShell command prompt.

-

-```powershell

-$fileName="<path and file name of the input CSV file that has the role changes, example: C:\admin\RoleUpdates.CSV>"

-$roleChanges=Import-Csv $fileName | ForEach {Add-MsolRoleMember -RoleMemberEmailAddress (Get-MsolUser | Where DisplayName -eq $_.DisplayName).UserPrincipalName -RoleName $_.RoleName }

-```

-Here's an example for UPNs:

-

-```powershell

-UserPrincipalName,RoleName

-"belindan@contoso.com","Billing Administrator"

-"scottw@contoso.com","SharePoint Service Administrator"

-```

-Next, fill in the location of the CSV file and run the resulting commands at the PowerShell command prompt.

-

-```powershell

-$fileName="<path and file name of the input CSV file that has the role changes, example: C:\admin\RoleUpdates.CSV>"

-$roleChanges=Import-Csv $fileName | ForEach { Add-MsolRoleMember -RoleMemberEmailAddress $_.UserPrincipalName -RoleName $_.RoleName }

-The FastTrack request for assistance (RFA) form is now available in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2226341" target="_blank">Microsoft 365 admin center</a> and the <a href="https://setup.microsoft.com/" target="_blank">Microsoft 365 Setup portal</a>. Submit this form to request guidance from FastTrack specialists with your Microsoft 365 deployment and migration efforts. FastTrack assistance is available for tenants with 150 or more licenses for the following Microsoft product families: Microsoft 365, Office 365, Microsoft Viva, Enterprise Mobility + Security, and Windows 10/11. See <a href="https://learn.microsoft.com/microsoft-365/fasttrack/eligibility" target="_blank">eligible plans</a> for details.

-1. Select the **FastTrack assistance** tab and then select **Submit a new request**

- a. After submission, receipt is confirmed with an RFA ID number, and the option to provide feedback about your experience.

-1. Select **Submit a new request**

- a. After submission, receipt is confirmed with an RFA ID number, and the option to provide feedback about your experience.

-1. Go to <a href="https://setup.microsoft.com/microsoft-365-fasttrack-assistance" target="_blank">setup.microsoft.com/microsoft-365-fasttrack-assistance</a>.

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-description: Learn how to use the get scan history by session api

-keywords: apis, graph api, supported apis, scan history by session

-ms.sitesec: library

-ms.pagetype: security

-1. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.

-> - To view data the user needs to have at least the following role permission: 'ViewData' or 'TvmViewData' (See [Create and manage roles](../user-roles.md) for more information)

-Here is an example of the request.

-description: Learn how to use the Add, update or delete scan definitions.

-keywords: apis, graph api, supported apis, scans, network scans, authenticated scan

-ms.sitesec: library

-ms.pagetype: security

-# Add, update or delete a scan definition

-API to add, update or delete an authenticated scan.

-Rate limitations for this API are 100 calls per minute and 1500 calls per hour.

-> - To view data the user needs to have at least the following role permission: 'ViewData' or 'TvmViewData' (See [Create and manage roles](../user-roles.md) for more information)

-> - To edit data the user needs to have at least the following role permission: 'ManageSecurity' (See [Create and manage roles](../user-roles.md) for more information)

-keywords: apis, graph api, supported apis, tags, machine tags

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, tags, machine tags

-ms.sitesec: library

-ms.pagetype: security

-2. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.

-3. We can add or remove tag a for up to 500 machines per API call.

-> - The user needs to have at least the following role permission: 'Manage security setting'. For more (See [Create and manage roles](../user-roles.md) for more information).

-MachineIds|List (String)|List of machine ids to update. Required.|

-Here is an example of a request that adds a tag to multiple machines.

-keywords: apis, graph api, supported apis, get, alerts, recent

-ms.sitesec: library

-ms.pagetype: security

-|resolvedTime|Nullable DateTimeOffset|The date and time in which the status of the alert was changed to 'Resolved'.|

-|investigationState|Nullable Enum|The current state of the [Investigation](../automated-investigations.md). Possible values are: 'Unknown', 'Terminated', 'SuccessfullyRemediated', 'Benign', 'Failed', 'PartiallyRemediated', 'Running', 'PendingApproval', 'PendingResource', 'PartiallyInvestigated', 'TerminatedByUser', 'TerminatedBySystem', 'Queued', 'InnerFailure', 'PreexistingAlert', 'UnsupportedOs', 'UnsupportedAlertType', 'SuppressedAlert'.|

-|severity|Enum|Severity of the alert. Possible values are: 'UnSpecified', 'Informational', 'Low', 'Medium' and 'High'.|

-|status|Enum|Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'.|

-|determination|Nullable Enum|Specifies the determination of the alert. <p>Possible determination values for each classification are: <br><li> <b>True positive</b>: `Multistage attack` (MultiStagedAttack), `Malicious user activity` (MaliciousUserActivity), `Compromised account` (CompromisedUser) ΓÇô consider changing the enum name in public api accordingly, `Malware` (Malware), `Phishing` (Phishing), `Unwanted software` (UnwantedSoftware), and `Other` (Other). <li> <b>Informational, expected activity:</b> `Security test` (SecurityTesting), `Line-of-business application` (LineOfBusinessApplication), `Confirmed activity` (ConfirmedUserActivity) - consider changing the enum name in public api accordingly, and `Other` (Other). <li> <b>False positive:</b> `Not malicious` (Clean) - consider changing the enum name in public api accordingly, `Not enough data to validate` (InsufficientData), and `Other` (Other).|

-> Around August 29, 2022, previously supported alert determination values ('Apt' and 'SecurityPersonnel') will be deprecated and no longer available via the API.

-keywords: api, explorer, send, request, get, post,

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, supported apis, advanced hunting, query, microsoft defender atp, microsoft defender for endpoint

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, supported apis, Power BI, reports

-ms.sitesec: library

-ms.pagetype: security

-In this section you will learn to create a Power BI report on top of Defender for Endpoint APIs.

-Now the results of your query will appear as a table and you can start to build visualizations on top of it!

-At step 4, instead of the code in that example, copy the code below and paste it in the editor to pull all **Machine Actions** from your organization:

-You also can use OData queries for queries filters, see [Using OData Queries](exposed-apis-odata-samples.md).

-For more information see the [Power BI report templates](https://github.com/microsoft/MicrosoftDefenderATP-PowerBI).

-## Related topics

-keywords: Microsoft Defender for Endpoint API release notes, mde, APIs, Microsoft Defender for Endpoint API, updates, notes, release

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, api, wdatp, open api, microsoft defender for endpoint api, microsoft defender atp, public api, supported apis, alerts, device, user, domain, ip, file, advanced hunting, query

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, public api, supported apis, delete, ti indicator, entity, id

-Rate limitations for this API are 30 calls per minute and 1500 calls per hour.

-One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Get started](apis-intro.md)

-Permission type | Permission | Permission display name

-:|:|:

-Application | Ti.ReadWrite | 'Read and write TI Indicators'

-Application | Ti.ReadWrite.All | 'Read and write Indicators'

-If Indicators all existed and were deleted successfully - 204 OK without content

-if indicator IDs list is empty or exceeds size limit - 400 Bad Request

-if any indicator ID is invalid - 400 Bad Request

-if requestor is not exposed to any indicator's device groups - 403 Forbidden

-If any Indicator ID was not found - 404 Not Found

-keywords: apis, graph api, supported apis, get, alert, information, id

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api,

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, collect investigation package

-ms.sitesec: library

-ms.pagetype: security

-keywords: APIs, Microsoft Defender for Endpoint API, errors, troubleshooting

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, alert, information, id

-ms.sitesec: library

-ms.pagetype: security

-One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md)

-> - The user needs to have at least the following role permission: 'Alerts investigation' (For more information see [Create and manage roles](../user-roles.md))

-> - The user needs to have access to the device associated with the alert, based on device group settings (For more information, see [Create and manage device groups](../machine-groups.md)

-eventTime | DateTime(UTC) | The precise time of the event as string, as obtained from advanced hunting. e.g., ```2018-08-03T16:45:21.7115183Z``` **Required**.

-If successful, this method returns 200 OK, and a new [alert](alerts.md) object in the response body. If event with the specified properties (_reportId_, _eventTime_ and _machineId_) was not found - 404 Not Found.

-keywords: apis, graph api, supported apis, delete from library

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, public api, supported apis, delete, ti indicator, entity, id

-ms.sitesec: library

-ms.pagetype: security

-Rate limitations for this API are 100 calls per minute and 1500 calls per hour.

-One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Get started](apis-intro.md)

-Permission type | Permission | Permission display name

-:|:|:

-Application | Ti.ReadWrite | 'Read and write TI Indicators'

-Application | Ti.ReadWrite.All | 'Read and write Indicators'

-If Indicator exists and deleted successfully - 204 OK without content

-If Indicator with the specified id wasn't found - 404 Not Found

-keywords: apis, graph api, supported apis, get, device health api, Microsoft Defender for Endpoint report api microsoft defender reports api, microsoft defender for endpoint reporting api, windows defender reporting api, defender for endpoint reporting api, windows defender report api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, device health api, Microsoft Defender for Endpoint report api microsoft defender reports api, microsoft defender for endpoint reporting api, windows defender reporting api, defender for endpoint reporting api, windows defender report api

-ms.sitesec: library

-ms.pagetype: security

-keywords: api, apis, export assessment, per device assessment, per machine assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, secure configuration assessment, secure configuration report, software vulnerabilities assessment, software vulnerability report, vulnerability report by machine,

-ms.sitesec: library

-ms.pagetype: security

-keywords: api, apis, export assessment, per device assessment, per machine assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, secure configuration assessment, secure configuration report, software vulnerabilities assessment, software vulnerability report, vulnerability report by machine, firmware and hardware assessment

-ms.sitesec: library

-ms.pagetype: security

-keywords: api, apis, export assessment, per device assessment, per machine assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, secure configuration assessment, secure configuration report, software vulnerabilities assessment, software vulnerability report, vulnerability report by machine,

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, actor, alerts, device, user, domain, ip, file, advanced hunting, query

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, actor, alerts, device, user, domain, ip, file, advanced hunting, query

-ms.sitesec: library

-ms.pagetype: security

-Microsoft Defender for Endpoint exposes much of its data and actions through a set of programmatic APIs. Those APIs will help you automate work flows and innovate based on Microsoft Defender for Endpoint capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).

-In general, you'll need to take the following steps to use the APIs:

-The following steps will guide you how to create a Microsoft Entra application, get an access token to Microsoft Defender for Endpoint and validate the token.

-## Create the multi-tenant app

- - **Note**: *WindowsDefenderATP* does not appear in the original list. Start writing its name in the text box to see it appear.

-To determine which permission you need, review the **Permissions** section in the API you are interested to call. For instance:

-In the following example we will use **'Read all alerts'** permission:

- **Important**: After click Add, **copy the generated secret value**. You won't be able to retrieve after you leave!

- You need your application to be approved in each customer tenant where you intend to use it. This is because your application interacts with Microsoft Defender for Endpoint application on behalf of your customer.

- In addition, you will need to ask your customer for their tenant ID and save it for future use when acquiring the token.

-6. **Done!** You have successfully registered an application! See examples below for token acquisition and validation.

-For more information on Microsoft Entra token, see [Microsoft Entra tutorial](/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds)

-Refer to [Get token using Python](run-advanced-query-sample-python.md#get-token)

-```curl

-curl -i -X POST -H "Content-Type:application/x-www-form-urlencoded" -d "grant_type=client_credentials" -d "client_id=%CLIENT_ID%" -d "scope=https://securitycenter.onmicrosoft.com/windowsatpservice/.default" -d "client_secret=%CLIENT_SECRET%" "https://login.microsoftonline.com/%TENANT_ID%/oauth2/v2.0/token" -k

-```

-You will get an answer of the form:

-```console

-{"token_type":"Bearer","expires_in":3599,"ext_expires_in":0,"access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIn <truncated> aWReH7P0s0tjTBX8wGWqJUdDA"}

-```

-Sanity check to make sure you got a correct token:

- ```csharp

- var httpClient = new HttpClient();

- var request = new HttpRequestMessage(HttpMethod.Get, "https://api.securitycenter.microsoft.com/api/alerts");

- request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);

- var response = httpClient.SendAsync(request).GetAwaiter().GetResult();

-keywords: apis, graph api, supported apis, actor, alerts, device, user, domain, ip, file, advanced hunting, query

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, supported apis, advanced hunting, query

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, supported apis, actor, alerts, device, user, domain, ip, file, advanced queries, advanced hunting

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, supported apis, odata, query

-ms.sitesec: library

-ms.pagetype: security

-keywords: managed security service provider, mssp, configure, integration

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, alerts, recent

-ms.sitesec: library

-ms.pagetype: security

-Method|Return Type |Description

-:|:|:

-[Get file](get-file-information.md) | [file](files.md) | Get a single file

-[List file related alerts](get-file-related-alerts.md) | [alert](alerts.md) collection | Get the [alert](alerts.md) entities that are associated with the file.

-[List file related machines](get-file-related-machines.md) | [machine](machine.md) collection | Get the [machine](machine.md) entities associated with the alert.

-[file statistics](get-file-statistics.md) | Statistics summary | Retrieves the prevalence for the given file.

-|isPeFile | Boolean | true if the file is portable executable (e.g. "DLL", "EXE", etc.) |

-keywords: ip, apis, graph api, supported apis, find device, device information

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, device, IP, find, find device, by ip, ip

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, supported apis, get, device, find, find device, by tag, tag

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, alert, information, id

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get alert information, alert information, related domain

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get alert information, alert information, related files

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get alert information, alert information, related ip

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get alert information, alert information, related device

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, alert, information, related, user

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, alerts, recent

-ms.sitesec: library

-ms.pagetype: security

-<br>Supports [OData V4 queries](https://www.odata.org/documentation/).

-<br>OData supported operators:

-<br>```$filter``` on: ```alertCreationTime```, ```lastUpdateTime```, ```incidentId```, ```InvestigationId```, ```id```, ```asssignedTo```, ```detectionSource```, ```lastEventTime```, ```status```, ```severity``` and ```category``` properties.

-<br>```$top``` with max value of 10,000

-<br>```$skip```

-<br>```$expand``` of ```evidence```

-<br>See examples at [OData queries with Microsoft Defender for Endpoint](exposed-apis-odata-samples.md)

-3. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.

-One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md)

-Permission type | Permission | Permission display name

-:|:|:

-Application | Alert.Read.All | 'Read all alerts'

-Application | Alert.ReadWrite.All | 'Read and write all alerts'

-Delegated (work or school account) | Alert.Read | 'Read alerts'

-Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts'

-> - The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](../user-roles.md) for more information)

-> - The response will include only alerts that are associated with devices that the user can access, based on device group settings (See [Create and manage device groups](../machine-groups.md) for more information)

-Name|Type|Description

-:|:|:

-Authorization | String | Bearer {token}. **Required**.

-Here is an example of the request.

-Here is an example of the response.

-Here is an example of the request.

-Here is an example of the response.

-keywords: apis, graph api, supported apis, get, security recommendations, Microsoft Defender for Endpoint tvm api, threat and vulnerability management, threat and vulnerability management api, mdvm

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, scan, authenticated scan, agent

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, scan, authenticated scan

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, vulnerability information, Microsoft Defender for Endpoint tvm api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, vulnerability information, Microsoft Defender for Endpoint tvm api

-ms.sitesec: library

-ms.pagetype: security

-keywords: api, apis, export assessment, per device assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, browser extension assessment

-ms.sitesec: library

-ms.pagetype: security

-keywords: api, apis, export assessment, per device assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, information gathering assessment

-ms.sitesec: library

-ms.pagetype: security

-keywords: api, apis, export assessment, per device assessment, per machine assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, secure configuration assessment, secure configuration report, software vulnerabilities assessment, software vulnerability report, vulnerability report by machine,

-ms.sitesec: library

-ms.pagetype: security

-keywords: api, apis, export assessment, per device assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, secure configuration assessment, secure configuration report, software vulnerabilities assessment, software vulnerability report, vulnerability report by machine,

-ms.sitesec: library

-ms.pagetype: security

-keywords: api, apis, export assessment, per device assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, secure configuration assessment, secure configuration report, software vulnerabilities assessment, software vulnerability report, vulnerability report by machine,

-ms.sitesec: library

-ms.pagetype: security

-keywords: api, apis, export assessment, per device assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, secure configuration assessment, secure configuration report, software vulnerabilities assessment, software vulnerability report, vulnerability report by machine,

-ms.sitesec: library

-ms.pagetype: security

-keywords: api, apis, export assessment, per device assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, secure configuration assessment, secure configuration report, software vulnerabilities assessment, software vulnerability report, vulnerability report by machine,

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, scan, authenticated scan, get, authenticated methods, authenticated properties,

-ms.sitesec: library

-ms.pagetype: security

-[Add, delete or update a scan definition](add-a-new-scan-definition.md)|Add, delete, or update a new scan definition.

-[Get scan agent by Id](Get-agent-details.md)| Retrieves the details for a specified agent by its Id.

-scanType|Enum|The type of scan. Possible values are: "Windows", "Network".

-targetType|String|The target type in the target field. Possible types are "IP Address" or "Hostname". Default value is IP Address.

-@odata.type|Enum|The scan type authentication parameters. Possible values are: "#microsoft.windowsDefenderATP.api.SnmpAuthParams" for "Network" scan type, and "#microsoft.windowsDefenderATP.api.WindowsAuthParams" for "Windows" scan type.

-type|Enum|The authentication method. Possible values vary based on @odata.type property. <br/> - If @odata.type is "SnmpAuthParams", possible values are "CommunityString", "NoAuthNoPriv", "AuthNoPriv", "AuthPriv". <br/> - If @odata.type is "WindowsAuthParams" possible values are "Kerberos" or "Negotiate".

-KeyVaultUrl|String (Optional)|An optional property that specifies from which KeyVault the scanner should retrieve credentials. If KeyVault is specified there's no need to specify username, password.

-KeyVaultSecretName|String (Optional)|An optional property that specifies KeyVault secret name from which the scanner should retrieve credentials. If KeyVault is specified there's no need to specify username, password.

-Domain|String (Optional)|Domain name when using "WindowsAuthParams".

-Username|String (Optional)|Username when using "WindowsAuthParams" or the username when choosing "SnmpAuthParams" with any type other than "CommunityString".

-IsGMSAUser|Boolean (Optional)|Must be set to true when choosing "WindowsAuthParams".

-CommunityString|String (Optional)|Community string to use when choosing "SnmpAuthParams" with "CommunityString"

-AuthProtocol|String (Optional)|Auth protocol to use with "SnmpAuthParams" and "AuthNoPriv" or "AuthPriv". Possible values are "MD5", "SHA1".

-AuthPassword|String (Optional)|Auth password to use with "SnmpAuthParams" and "AuthNoPriv" or "AuthPriv".

-PrivProtocol|String (Optional)|Priv protocol to use with "SnmpAuthParams" and "AuthPriv". Possible values are "DES", "3DES", "AES".

-PrivPassword|String (Optional)|Priv password to use with "SnmpAuthParams" and "AuthPriv".

-keywords: apis, graph api, supported apis, get, browser extension information, Microsoft Defender for Endpoint, Microsoft Defender Vulnerability Management

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, alerts, recent

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, list, file, information, discovered vulnerabilities, threat & vulnerability management api, Microsoft Defender for Endpoint tvm api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, domain, related, alerts

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, domain, related, devices

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, domain, domain related devices

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, exposure score, organizational exposure score

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, file, information, sha1, sha256, md5

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, file, hash

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, devices, hash

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, file, statistics

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, list, file, information, software inventory, installed software per device, threat & vulnerability management api, Microsoft Defender for Endpoint tvm api

-ms.sitesec: library

-ms.pagetype: security

-description: Use this API to create calls related to get Investigations collection

-keywords: apis, graph api, supported apis, Investigations collection

-ms.sitesec: library

-ms.pagetype: security

-The OData's `$filter` query is supported on: `startTime`, `id`, `state`, `machineId` and `triggeringAlertId` properties.

-2. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.

-One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md)

-Permission type|Permission|Permission display name

-:|:|:

-Application|Alert.Read.All|'Read all alerts'

-Application|Alert.ReadWrite.All|'Read and write all alerts'

-Delegated (work or school account)|Alert.Read|'Read alerts'

-Delegated (work or school account)|Alert.ReadWrite|'Read and write alerts'

-> - The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](../user-roles.md) for more information)

-Name|Type|Description

-:|:|:

-Authorization|String|Bearer {token}. **Required**.

-Here is an example of a request to get all investigations:

-Here is an example of the response:

-keywords: apis, graph api, supported apis, Investigation object

-ms.sitesec: library

-ms.pagetype: security

-description: Retrieve a collection of alerts related to a given IP address using Microsoft Defender for Endpoint

-keywords: apis, graph api, supported apis, get, ip, related, alerts

-ms.sitesec: library

-ms.pagetype: security

-1. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.

-One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Defender for Endpoint APIs](apis-intro.md)

-Permission type|Permission|Permission display name

-:|:|:

-Application|Alert.Read.All|'Read all alerts'

-Application|Alert.ReadWrite.All|'Read and write all alerts'

-Delegated (work or school account) | Alert.Read | 'Read alerts'

-Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts'

-> - The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](../user-roles.md) for more information)

-> - Response will include only alerts, associated with devices, that the user have access to, based on device group settings (See [Create and manage device groups](../machine-groups.md) for more information)

-If successful and IP exists - 200 OK with list of [alert](alerts.md) entities in the body. If IP address is unknown but valid, it will return an empty set.

-If the IP address is invalid, it will return HTTP 400.

-Here is an example of the request.

-keywords: apis, graph api, supported apis, get, ip, statistics, prevalence

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, upload to library

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, devices, entity, id

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, exposure score, device group, device group exposure score

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, device, log on, users

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, devices, related, alerts

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, machineaction object

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, machineaction collection

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, list devices, devices list, list devices by software, Microsoft Defender for Endpoint tvm api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, devices list, vulnerable devices, Microsoft Defender for Endpoint tvm api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, list, file, information, device id, threat & vulnerability management api, Microsoft Defender for Endpoint tvm api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, list, file, information, software id, threat & vulnerability management api, Microsoft Defender for Endpoint tvm api, mdvm, Microsoft Defender Vulnerability Management

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get package, sas, uri

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, security recommendation, security recommendation by ID, threat and vulnerability management, threat and vulnerability management api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, security recommendation for vulnerable devices, threat and vulnerability management, threat and vulnerability management api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, list of vulnerabilities, security recommendation, security recommendation for vulnerabilities, threat and vulnerability management, threat and vulnerability management api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, remediation, remediation api, get, remediation tasks, all remediation,

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, remediation, remediation api, get, remediation tasks, remediation exposed devices

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, remediation, remediation api, get, remediation tasks, remediation methods, remediation properties,

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, remediation, remediation api, get, remediation tasks, remediation by ID,

-ms.sitesec: library

-ms.pagetype: security

-keywords: api, apis, export assessment, per device assessment, per machine assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, secure configuration assessment, secure configuration report, software vulnerabilities assessment, software vulnerability report, vulnerability report by machine,

-ms.sitesec: library

-ms.pagetype: security

-keywords: api, apis, export assessment, per device assessment, per machine assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, secure configuration assessment, secure configuration report, software vulnerabilities assessment, software vulnerability report, vulnerability report by machine,

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, list, file, information, security recommendation per device, threat & vulnerability management api, Microsoft Defender for Endpoint tvm api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, software, Microsoft Defender for Endpoint tvm api, mdvm, Microsoft Defender Vulnerability Management

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, software version distribution, Microsoft Defender for Endpoint tvm api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, list, file, information, software inventory, threat & vulnerability management api, Microsoft Defender for Endpoint tvm api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, public api, supported apis, Indicators collection

-ms.sitesec: library

-ms.pagetype: security

-See examples at [OData queries with Microsoft Defender for Endpoint](exposed-apis-odata-samples.md)

-1. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.

-One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Get started](apis-intro.md)

-Permission type|Permission|Permission display name

-:|:|:

-Application|Ti.ReadWrite|'Read and write Indicators'

-Application|Ti.ReadWrite.All|'Read and write All Indicators'

-Delegated (work or school account)|Ti.ReadWrite|'Read and write Indicators'

-Name|Type|Description

-:|:|:

-Authorization|String|Bearer {token}. **Required**.

-> If the Application has 'Ti.ReadWrite.All' permission, it will be exposed to all Indicators. Otherwise, it will be exposed only to the Indicators it created.

-Here is an example of a request that gets all Indicators

-Here is an example of the response.

-Here is an example of a request that gets all Indicators with 'AlertAndBlock' action

-Here is an example of the response.

-keywords: apis, graph api, supported apis, get, user, related, alerts

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, user, user related alerts

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, vulnerabilities list, Microsoft Defender for Endpoint tvm api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, vulnerability information, Microsoft Defender for Endpoint tvm api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, supported apis, submit, ti, indicator, update

-ms.sitesec: library

-ms.pagetype: security

-CIDR notation for IPs is not supported.

-2. There is a limit of 15,000 active [Indicators](ti-indicator.md) per tenant.

-One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Get started](apis-intro.md)

-Permission type|Permission|Permission display name

-:|:|:

-Application|Ti.ReadWrite|'Read and write Indicators'

-Application|Ti.ReadWrite.All|'Read and write All Indicators'

-Delegated (work or school account)|Ti.ReadWrite|'Read and write Indicators'

-Name|Type|Description

-:|:|:

-Authorization|String|Bearer {token}. **Required**.

-Content-Type|string|application/json. **Required**.

-Parameter|Type|Description

-:|:|:

-Indicators|List<[Indicator](ti-indicator.md)>|List of [Indicators](ti-indicator.md). **Required**

-Here is an example of the request.

-Here is an example of the response.

-## Related topic

-keywords: apis, graph api, supported apis, investigation

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, alerts, investigations

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, isolate device

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, devices

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-1. Rate limitations for this API are 100 calls per minute and 1500 calls per

-Here is an example of a request that gets all live response library files

-Here is an example of the response.

-## Related topic

-keywords: apis, graph api, supported apis, get, security recommendation, security recommendation for software, threat and vulnerability management, threat and vulnerability management api

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, supported apis, get, machines

-ms.sitesec: library

-ms.pagetype: security

-|onboardingstatus|String|Status of machine onboarding. Possible values are: "onboarded", "CanBeOnboarded", "Unsupported", and "InsufficientInfo".|

-|healthStatus|Enum|[machine](machine.md) health status. Possible values are: "Active", "Inactive", "ImpairedCommunication", "NoSensorData", "NoSensorDataImpairedCommunication" and "Unknown".|

-|riskScore|Nullable Enum|Risk score as evaluated by Microsoft Defender for Endpoint. Possible values are: 'None', 'Informational', 'Low', 'Medium' and 'High'.|

-|exposureLevel|Nullable Enum|Exposure level as evaluated by Microsoft Defender for Endpoint. Possible values are: 'None', 'Low', 'Medium' and 'High'.|

-|deviceValue|Nullable Enum|The [value of the device](../tvm-assign-device-value.md). Possible values are: 'Normal', 'Low' and 'High'.|

-|osArchitecture|String|Operating system architecture. Possible values are: "32-bit", "64-bit". Use this property instead of osProcessor.|

-keywords: apis, supported apis, get, machineaction, recent

-ms.sitesec: library

-ms.pagetype: security

-|type|Enum|Type of the action. Possible values are: "RunAntiVirusScan", "Offboard", "LiveResponse", "CollectInvestigationPackage", "Isolate", "Unisolate", "StopAndQuarantineFile", "RestrictCodeExecution", and "UnrestrictCodeExecution".|

-|scope|string|Scope of the action. "Full" or "Selective" for Isolation, "Quick" or "Full" for Anti-Virus scan.|

-|status|Enum|Current status of the command. Possible values are: "Pending", "InProgress", "Succeeded", "Failed", "TimeOut", and "Cancelled".|

-|relatedFileInfo|Class|Contains two Properties. string `fileIdentifier`, Enum `fileIdentifierType` with the possible values: "Sha1", "Sha256", and "Md5".|

-keywords: onboarding, api, siem, rbac, access, portal, integration, investigation, response, entities, entity, user context, application context, streaming

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, collect investigation package

-keywords: apis, graph api, supported apis, submit, ti, indicator, update

-ms.sitesec: library

-ms.pagetype: security

-CIDR notation for IPs is not supported.

-1. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.

-2. There is a limit of 15,000 active indicators per tenant.

-One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Get started](apis-intro.md)

-Permission type|Permission|Permission display name

-:|:|:

-Application|Ti.ReadWrite|'Read and write Indicators'

-Application|Ti.ReadWrite.All|'Read and write All Indicators'

-Delegated (work or school account)|Ti.ReadWrite|'Read and write Indicators'

-indicatorType|Enum|Type of the indicator. Possible values are: "FileSha1", "FileMd5", "CertificateThumbprint", "FileSha256", "IpAddress", "DomainName" and "Url". **Required**

-action|Enum|The action that will be taken if the indicator will be discovered in the organization. Possible values are: "Alert", "Warn", "Block", "Audit, "BlockAndRemediate", "AlertAndBlock", and "Allowed". **Required**. The "GenerateAlert" parameter must be set to "TRUE" when creating an action with "Audit".

-application|String|The application associated with the indicator. This field only works for new indicators. It will not update the value on an existing indicator. **Optional**

-severity|Enum|The severity of the indicator. Possible values are: "Informational", "Low", "Medium", and "High". **Optional**

-generateAlert|Enum|**True** if alert generation is required, **False** if this indicator should not generate an alert.

-Here is an example of the request.

-## Related topic

-keywords: raw data export, streaming API, API, Azure Event Hubs, Azure storage, storage account, Advanced Hunting, raw data sharing

-keywords: raw data export, streaming API, API, Event Hubs, Azure storage, storage account, Advanced Hunting, raw data sharing

-ms.sitesec: library

-ms.pagetype: security

-2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to Microsoft.insights**.

-1. Log in to [Microsoft Defender XDR](https://security.microsoft.com) as a ***Global Administrator*** or ***Security Administrator***.

-3. Click on **Add data export settings**.

-7. Choose the events you want to stream and click **Save**.

-1. Log in to [Microsoft Defender XDR](https://security.microsoft.com) and go to [Advanced Hunting page](https://security.microsoft.com/hunting-package).

-## Related topics

-keywords: raw data export, streaming API, API, Event hubs, Azure storage, storage account, Advanced Hunting, raw data sharing

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, alerts, recent

-ms.sitesec: library

-ms.pagetype: security

-|recommendationCategory|String|Recommendation category. Possible values are: "Accounts", "Application", "Network", "OS", "SecurityControls"|

-|subCategory|String|Recommendation sub-category|

-|remediationType|String|Remediation type. Possible values are: "ConfigurationChange","Update","Upgrade","Uninstall"|

-|Status|Enum|Recommendation exception status. Possible values are: "Active" and "Exception"|

-|nonProductivityImpactedAssets|Long|Number of devices that are not affected|

-keywords: apis, graph api, supported apis, collect investigation package

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, supported apis, advanced hunting, query

-ms.sitesec: library

-ms.pagetype: security

-2. The results will include a maximum of 100,000 rows.

- - API calls: Up to 45 calls per minute, up to 1500 calls per hour.

-5. `429` response will represent reaching quota limit either by number of requests or by CPU. Read response body to understand what limit has been reached.

-6. The maximum query result size of a single request cannot exceed 124 MB. If exceeded, HTTP 400 Bad Request with the message "Query execution has exceeded the allowed result size. Optimize your query by limiting the number of results and try again" will appear.

-Permission type|Permission|Permission display name

-:|:|:

-Application|AdvancedQuery.Read.All|'Run advanced queries'

-Delegated (work or school account)|AdvancedQuery.Read|'Run advanced queries'

-> - The user needs to have 'View Data' AD role

-Here is an example of the request.

-Here is an example of the response.

-## Related topics

-keywords: apis, supported apis, advanced hunting, query

-ms.sitesec: library

-ms.pagetype: security

-Run advanced queries using PowerShell, see [Advanced Hunting API](run-advanced-query-api.md).

-For more information, see [PowerShell documentation](/powershell/module/microsoft.powershell.security/set-executionpolicy)

-where

-## Related topic

-keywords: apis, supported apis, advanced hunting, query

-ms.sitesec: library

-ms.pagetype: security

-where

-To iterate over the results do the below:

-To output the results of the query in CSV format in file file1.csv do the below:

-To output the results of the query in JSON format in file file1.json do the below:

-keywords: apis, graph api, supported apis, remove device from isolation

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, upload to library

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, score, exposure score, device secure score, exposure score by device group

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, tags, machine tags

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, alerts, recent

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, stop and quarantine file

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, supported apis, get, TiIndicator, Indicator, recent

-ms.sitesec: library

-ms.pagetype: security

-Property|Type|Description

-:|:|:

-id|String|Identity of the [Indicator](../ti-indicator.md) entity.

-indicatorValue|String|The value of the [Indicator](../ti-indicator.md).

-indicatorType|Enum|Type of the indicator. Possible values are: "FileSha1", "FileSha256", "FileMd5", "CertificateThumbprint", "IpAddress", "DomainName" and "Url".

-application|String|The application associated with the indicator.

-action|Enum|The action that is taken if the indicator will be discovered in the organization. Possible values are: "Warn", "Block", "Audit", "Alert", "AlertAndBlock", "BlockAndRemediate" and "Allowed".

-sourceType|Enum|"User" in case the Indicator created by a user (for example, from the portal), "AadApp" in case it submitted using automated application via the API.

-createdBySource|string|The name of the user/application that submitted the indicator.

-createdBy|String|Unique identity of the user/application that submitted the indicator.

-lastUpdatedBy|String|Identity of the user/application that last updated the indicator.

-creationTimeDateTimeUtc|DateTimeOffset|The date and time when the indicator was created.

-expirationTime|DateTimeOffset|The expiration time of the indicator.

-lastUpdateTime|DateTimeOffset|The last time the indicator was updated.

-severity|Enum|The severity of the indicator. possible values are: "Informational", "Low", "Medium" and "High".

-title|String|Indicator title.

-description|String|Description of the indicator.

-recommendedActions|String|Recommended actions for the indicator.

-rbacGroupNames|List of strings|RBAC device group names where the indicator is exposed and active. Empty list in case it exposed to all devices.

-rbacGroupIds|List of strings|RBAC device group IDs where the indicator is exposed and active. Empty list in case it exposed to all devices.

-generateAlert|Enum|**True** if alert generation is required, **False** if this indicator shouldn't generate an alert.

-> [!Note]

-> The prior response actions (AlertAndBlock, and Alert) will be supported until January 2022. After this date, all customers must be use one of the action types listed above.

-keywords: apis, graph api, supported apis, remove device from isolation

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, remove device from isolation

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, alert, information, id

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, alert, information, id

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, upload to library

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, alerts, recent

-ms.sitesec: library

-ms.pagetype: security

-keywords: apis, graph api, supported apis, get, vulnerability

-ms.sitesec: library

-ms.pagetype: security

-ms.pagetype: security

-ms.pagetype: security

-keywords: health state, antivirus, os platform, windows 10 version, version, health, compliance, state

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-ms.pagetype: security

-keywords: microsoft, defender, Microsoft Defender for Endpoint, mac, exclusions, scans, antivirus

-ms.sitesec: library

-ms.pagetype: security

-keywords: microsoft, defender, Microsoft Defender for Endpoint, mac, installation, deploy, uninstallation, intune, jamf, macos, big sur, monterey, ventura, mde for mac

-ms.sitesec: library

-ms.pagetype: security

-keywords: microsoft, defender, Microsoft Defender for Endpoint, mac, performance, big sur, monterey, ventura, mde for mac

-ms.sitesec: library

-ms.pagetype: security

-keywords: updates, security baselines, schedule updates

-ms.sitesec: library

-ms.pagetype: security

-keywords: manage suppression, rules, rule name, scope, action, alerts, turn on, turn off

-ms.sitesec: library

-ms.pagetype: security

-keywords: microsoft, defender, Microsoft Defender for Endpoint, mac, performance, big sur, monterey, ventura, mde for mac

-ms.sitesec: library

-ms.pagetype: security

-keywords: microsoft, defender, Microsoft Defender for Endpoint, mac, performance, big sur, monterey, ventura, mde for mac

-ms.sitesec: library

-ms.pagetype: security

-1. Select **Computers > Configuration Profiles**, and then select **Options > System Extensions**.

-2. Select **Allowed System Extensions** from the **System Extension Types** drop-down list.

-3. Use **UBF8T346G9** for Team ID.

-4. Add the following bundle identifiers to the **Allowed System Extensions** list:

- - com.microsoft.wdav.epsext

- - com.microsoft.wdav.netext

-1. Use **com.microsoft.wdav.epsext** as the Identifier and **Bundle ID** as Bundle type.

-1. Set Code Requirement to **identifier com.microsoft.wdav.epsext and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9**.

-1. Set **App or service** to **SystemPolicyAllFiles** and access to **Allow**.

-5. Follow the instructions on [this page](https://learn.jamf.com/bundle/technical-articles/page/Welcome.html) to create a signing certificate using JAMF's built-in certificate authority.

-keywords: updates, protection, schedule updates, battery, mobile device, laptop, notebook, opt-in, microsoft update, wsus, override

-ms.sitesec: library

-ms.pagetype: security

-description: Learn how to get started with the deploy, setup, licensing validation, tenant configuration, network configuration stages

-Maximize available security capabilities and better protect your enterprise from cyber threats by deploying Microsoft Defender for Endpoint and onboarding your devices. Onboarding your devices will enable you to identify and stop threats quickly, prioritize risks, and evolve your defenses across operating systems and network devices.

-This guide provides five steps to help deploy Defender for Endpoint as your multi-platform endpoint protection solution. It will help you choose the best deployment tool, onboard devices, and configure capabilities. Each step corresponds to a separate article.

-The following is a list of pre-requisites required to deploy Defender for Endpoint:

-1. The plug-in doesn't yet automatically update. When a new plug-in version is released, the new MSI package needs to be applied to perform the update. You can apply the new package by using any tool that deploys software. Updates are coming soon through Microsoft Update. If preferred, you can continue to use the MSI package method.

-2. As it takes a few minutes for the plug-in to fully instantiate and up to 30 minutes for a WSL2 instance to onboard itself, short-lived WSL container instances might result in the WSL2 instance not showing up in the Microsoft Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). Once a (any) distribution has been running long enough (at least 30 minutes), it does show up.

-3. If you're using a proxy in your (test) environment, make sure that the plug-in is set up to use it correctly. WSL is typically not automatically configured to use a proxy. For more information, see the section, [Setting a proxy for Defender running in WSL](#setting-a-proxy-for-defender-running-in-wsl).

-4. The use of a custom kernel in combination with the plug-in is not supported. When you attempt to launch WSL with the plugin installed, you will encounter the error *A fatal error was returned by plugin 'DefenderforEndpointPlug-in'. Error message: 'Custom Kernel/Configuration not supported.'*.

-keywords: cloud, app, security, settings, integration, discovery, report

-ms.sitesec: library

-ms.pagetype: security

-keywords: cloud, app, networking, visibility, usage

-ms.sitesec: library

-ms.pagetype: security

-keywords: windows defender, server, scep, system center endpoint protection, server 2016, current branch, server 2012

-keywords: Deploy Microsoft Defender Antivirus updates, pilot ring deployment Microsoft Defender Antivirus, Microsoft Defender Antivirus Group Policy, Microsoft Defender Antivirus Windows Server Update Services (WSUS), Microsoft Defender Antivirus Group Policy Windows Server Update Services (WSUS), threat intelligence, cybersecurity, cloud security,

-ms.sitesec: library

-ms.pagetype: security

-keywords: Deploy Microsoft Defender Antivirus updates, ring deployment Microsoft Defender Antivirus, Microsoft Defender Antivirus Group Policy, Microsoft Defender Antivirus Windows Server Update Services (WSUS), Microsoft Defender Antivirus Group Policy Windows Server Update Services (WSUS), threat intelligence, cybersecurity, cloud security,

-ms.sitesec: library

-ms.pagetype: security

-keywords: Deploy Microsoft Defender Antivirus updates, ring deployment Microsoft Defender Antivirus, Microsoft Defender Antivirus Group Policy, Microsoft Defender Antivirus Microsoft Update (MU), Microsoft Defender Antivirus Group Policy and Microsoft Update, threat intelligence, cybersecurity, cloud security,

-ms.sitesec: library

-ms.pagetype: security

-keywords: Deploy Microsoft Defender Antivirus updates, ring deployment Microsoft Defender Antivirus, Microsoft Defender Antivirus Group Policy, Microsoft Defender Antivirus network share, Microsoft Defender Antivirus Group Policy network share, threat intelligence, cybersecurity, cloud security,

-ms.sitesec: library

-ms.pagetype: security

-keywords: deploy Microsoft Defender Antivirus updates, ring deployment Microsoft Defender Antivirus, Microsoft Defender Antivirus Intune Microsoft Defender Antivirus Microsoft Update, Microsoft Defender Antivirus Intune MU, threat intelligence, cybersecurity, cloud security,

-ms.sitesec: library

-ms.pagetype: security

-keywords: deploy Microsoft Defender Antivirus updates, ring deployment Microsoft Defender Antivirus, Microsoft Defender Antivirus Intune Microsoft Defender Antivirus Microsoft Update, Microsoft Defender Antivirus Intune MU, threat intelligence, cybersecurity, cloud security,

-ms.sitesec: library

-ms.pagetype: security

-keywords: deploy Microsoft Defender Antivirus updates, ring deployment Microsoft Defender Antivirus, Microsoft Defender Antivirus SCCM, Microsoft Defender Antivirus WSUS, Microsoft Defender Antivirus SCCM and WSUS, threat intelligence, cybersecurity, cloud security,

-ms.sitesec: library

-ms.pagetype: security

-keywords: deploy Microsoft Defender Antivirus updates, ring deployment Microsoft Defender Antivirus, threat intelligence, cybersecurity, cloud security,

-ms.sitesec: library

-ms.pagetype: security

-keywords: microsoft, defender, Microsoft Defender for Endpoint, android, installation, deploy, uninstallation, intune

-ms.sitesec: library

-ms.pagetype: security

-keywords: microsoft, defender, Microsoft Defender for Endpoint, ios, overview, installation, deploy, uninstallation, intune

-ms.sitesec: library

-ms.pagetype: security

-keywords: microsoft, defender, Microsoft Defender for Endpoint, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos

-keywords: scan, defender, offline

-ms.sitesec: library

-ms.pagetype: security

-description: Describes how to approach a migration from a third-party Host Intrusion Prevention System (HIPS) solution into ASR rules.

-keywords: Attack surface reduction rules, asr, asr rules, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, Microsoft Defender for Endpoint

-ms.sitesec: library

-ms.pagetype: security

-# Migrating from a third-party HIPS to ASR rules

-## Scenarios when migrating from a third-party HIPS product to ASR rules

-keywords: migrate server, server, Microsoft Defender for Endpoint server, Microsoft Defender for Cloud, MDE, azure, azure cloud, CSPM, CWP, cloud workload protection, threat protection, advanced threat protection, Microsoft Azure, multi-cloud connector

-[Microsoft Defender for Cloud](https://azure.microsoft.com/services/defender-for-cloud/) is a solution for cloud security posture management (CSPM) and cloud workload protection (CWP) that finds weak spots across your cloud configuration. It also helps strengthen the overall security posture of your environment, and can protect workloads across multi-cloud and hybrid environments from evolving threats.

-2. Enable [Microsoft Defender for Cloud](/azure/defender-for-cloud/get-started) on your subscription(s).

-3. Enable one of the Microsoft Defender for Server plans on your [subscription(s)](/azure/defender-for-cloud/enable-enhanced-security). In case you're using Defender for Servers Plan 2, make sure to also enable it on the Log Analytics workspace your machines are connected to; it enables you to use optional features like File Integrity Monitoring, Adaptive Application Controls and more.

-4. Make sure the [MDE integration](/azure/defender-for-cloud/integration-defender-for-endpoint?tabs=windows) is enabled on your subscription. If you have pre-existing Azure subscriptions, you may see one (or both) of the two opt-in buttons shown in the image below.

- If you have any of these buttons in your environment, make sure to enable integration for both. On new subscriptions, both options are enabled by default. In this case, you won't see these buttons in your environment.

-1. Create a new multi-cloud connector on your subscription. (For more information on connector, see [AWS accounts](/azure/defender-for-cloud/quickstart-onboard-aws?pivots=env-settings) or [GCP projects](/azure/defender-for-cloud/quickstart-onboard-gcp?pivots=env-settings).

-2. On your multi-cloud connector, enable Defender for Servers on [AWS](/azure/defender-for-cloud/quickstart-onboard-aws?pivots=env-settings#prerequisites) or [GCP](/azure/defender-for-cloud/quickstart-onboard-gcp?pivots=env-settings#configure-the-servers-plan) connectors.

-3. Enable auto-provisioning on the multi-cloud connector for the Azure Arc agent, Microsoft Defender for Endpoint extension, Vulnerability Assessment and, optionally, Log Analytics extension.

- :::image type="content" source="images/select-plans-aws-gcp.png" alt-text="Screenshot that shows how to enable auto-provisioning for Azure Arc agent." lightbox="images/select-plans-aws-gcp.png":::

-Once you've completed the relevant migration steps, Microsoft Defender for Cloud deploys the `MDE.Windows` or `MDE.Linux` extension to your Azure VMs and non-Azure machines connected through Azure Arc (including VMs in AWS and GCP compute).

-In case you have Windows Server 2012 R2 or 2016 machines that are provisioned with the legacy, Log Analytics-based Microsoft Defender for Endpoint solution, Microsoft Defender for Cloud's deployment process deploys the Defender for Endpoint [unified solution](configure-server-endpoints.md#new-windows-server-2012-r2-and-2016-functionality-in-the-modern-unified-solution). After successful deployment, it will stop and disable the legacy Defender for Endpoint process on these machines.

-keywords: microsoft, defender, Microsoft Defender for Endpoint, mac, installation, macos, whatsnew

-ms.sitesec: library

-ms.pagetype: security

-1. Create service principal for the apps that needs to be excluded. [Steps to create service principal.](/graph/api/serviceprincipal-post-serviceprincipals?view=graph-rest-1.0&tabs=powershell#request)

-1. While creating the service principal object above, use these app IDs: **Xplat Broker App ( a0e84e36-b067-4d5c-ab4a-3db38e598ae2), TVM app (e724aa31-0f56-4018-b8be-f8cb82ca1196).**

-keywords: month report, security summary, managed devices, secure score, incidents

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-keywords: mssp, integration, managed, security, service, provider

-ms.sitesec: library

-ms.pagetype: security

-keywords: mobile, defender, Microsoft Defender for Endpoint, ios, mtd, android, security

-keywords: network devices, network devices vulnerability detection, operating systems of switches, routers, WLAN controllers, and firewalls

-ms.sitesec: library

-ms.pagetype: security

-keywords: Network protection, Linux exploits, malicious website, ip, domain, domains, command and control, SmartScreen, toast notification

-ms.sitesec: library

-ms.pagetype: security

-keywords: Network protection, MacOS exploits, malicious website, ip, domain, domains, command and control, SmartScreen, toast notification

-Microsoft Network protection helps reduce the attack surface of your devices from Internet-based events. It prevents employees from using any application to access dangerous domains that may host:

-Network Protection for macOS is now available for all Microsoft Defender for Endpoint onboarded macOS devices that meet the minimum requirements. All of your currently configured Network Protection and Web Threat Protection policies will be enforced on macOS devices where Network Protection is configured for block mode.

-To roll out Network Protection for macOS, we recommend the following:

- - Block website categories scoped to device groups through policies created in the MDEP portal.

- - Customer feedback is being collected to drive further design improvements

- - This incompatibility might result in an inability to block traffic that goes through the "Per-App Tunnel."

- - This incompatibility might result in network layer crashes in unrelated applications when both Blue Coat Proxy and Network Protection are enabled.

-#### mobileconfig deployment

-To deploy the configuration via a .mobileconfig file, which can be used with 3rd party MDM solutions or distributed to devices directly:

-4. [Integrate Microsoft Defender for Endpoint with Defender for Cloud Apps](/defender-cloud-apps/mde-integration) and your network protection-enabled macOS devices will have endpoint policy enforcement capabilities.

-Web threat protection is part of web protection in Microsoft Defender XDR for Endpoint. It uses network protection to secure your devices against web threats. By integrating with Microsoft Edge for macOS and popular third-party browsers like Chrome and Firefox, web threat protection stops web threats without a web proxy. Web threat protection can protect devices while they're on premises or away. Web threat protection stops access to the following types of sites:

-Configure policies across your device groups to block certain categories. Blocking a category prevents users within specified device groups from accessing URLs associated with the category. For any category that's not blocked, the URLs are automatically audited. Your users can access the URLs without disruption, and you'll gather access statistics to help create a more custom policy decision. Your users will see a block notification if an element on the page they're viewing is making calls to a blocked resource.

-Within 10-15 minutes, these domains will be listed in Microsoft Defender XDR under Indicators > URLs/Domains with Action=Warn. Within the enforcement SLA (see details at the end of this article), end users will be getting warn messages when attempting to access these domains:

-When the end user will be attempting to access monitored domains, they'll be warned by Microsoft Defender XDR for Endpoint.

-If the end user encounters a _block_, the user will have two possible resolutions:

-Upon facing an unexpected behavior, users' confusion may be reduced by providing them as much information as possible, not only to explain about what has happened but to also educate them to be more aware the next time they choose a cloud app to complete their job. For example, this information can include:

-2. By default, action will be taken for all apps and domains that were marked as Monitored in Microsoft Defender for Cloud Apps portal for all the onboarded endpoints in the organization.

-No End-user notification on third party browsers? Check your toast message settings

-keywords: non windows, mac, macos, linux, android

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-keywords: offboarding, Microsoft Defender for Endpoint offboarding, offboarding

-ms.sitesec: library

-ms.pagetype: security

-keywords: windows defender, antivirus, office 365, onedrive, restore, ransomware

-ms.sitesec: library

-ms.pagetype: security

-keywords: onboarding, Microsoft Defender for Endpoint onboarding, sccm, group policy, mdm, local script, detection test

-ms.sitesec: library

-ms.pagetype: security

-keywords: onboard, windows, 7, 81, oms, sp1, enterprise, pro, down level

-keywords: onboarding, Microsoft Defender for Endpoint onboarding, sccm, group policy, mdm, local script, detection test

-ms.sitesec: library

-ms.pagetype: security

-keywords: onboarding, Microsoft Defender for Endpoint onboarding, sccm, group policy, mdm, local script, detection test

-ms.sitesec: library

-ms.pagetype: security

-keywords: onboarding, configuration, deploy, deployment, configuration manager, Microsoft Defender for Endpoint, collection creation, endpoint detection response, next generation protection, attack surface reduction, microsoft configuration manager

-ms.sitesec: library

-ms.pagetype: security

-description: Learn how to onboard to Microsoft Defender for Endpoint using Microsoft Intune

-keywords: onboarding, configuration, deploy, deployment, endpoint manager, Microsoft Defender for Endpoint, collection creation, endpoint detection response, next generation protection, attack surface reduction, microsoft intune

-ms.sitesec: library

-ms.pagetype: security

-In the [Planning](deployment-strategy.md) topic, there were several methods provided to onboard devices to the service. This topic covers the cloud-native architecture.

-While Defender for Endpoint supports onboarding of various endpoints and tools, this article does not cover them. For information on general onboarding using other supported deployment tools and methods, see [Onboarding overview](onboarding.md).

-This topic guides users in:

-This onboarding guidance will walk you through the following basic steps that you need to take when using Microsoft Intune:

- - In Microsoft Intune, we'll guide you in creating a separate policy for each capability.

-Here are the links you'll need for the rest of the process:

-In this section, we will create a test group to assign your configurations on.

-In the following section, you'll create a number of configuration policies.

-First is a configuration policy to select which groups of users or devices will be onboarded to Defender for Endpoint:

-Then you will continue by creating several different types of endpoint security policies:

-2. Navigate to **Endpoint security > Endpoint detection and response**. Click on **Create Policy**.

-9. You'll see the configuration policy you created.

-6. In the **Configuration settings page**: Set the configurations you require for

- Attack surface reduction rules, then select **Next**.

-Once the Configuration policy has been assigned, it will take some time to apply.

-To confirm that the configuration policy has been applied to your test device, follow the following process for each configuration policy.

- steps above. The following example shows the next generation protection settings.

-1. Before applying the configuration, the Defender for Endpoint Protection service should not be started.

-2. After the configuration has been applied, the Defender for Endpoint Protection Service should be started.

- manage the settings as shown below.

-2. After the policy has been applied, you should not be able to manually manage

-2. This should respond with the following lines with no content:

-4. This should respond with the following lines with content as shown below:

-2. This should respond with a 0 as shown below.

-4. This should respond with a 1 as shown below.

-keywords: onboarding, offboarding, local, script, notification, rule

-ms.sitesec: library

-ms.pagetype: security

-Create a notification rule so that when a local onboarding or offboarding script is used, you'll be notified.

-You'll need to have access to:

-4. Select the + button to add a new action. The new action will be an HTTP request to the Defender for Endpoint device(s) API. You can also replace it with the out-of-the-box "WDATP Connector" (action: "Machines - Get list of machines").

- - Method: "GET" as a value to get the list of devices.

- - Authentication: Select "Active Directory OAuth".

- - Credential Type: Select "Secret".

-10. Extract the values from the JSON call and check if the onboarded device(s) is / are already registered at the SharePoint list as an example:

- - If yes, no notification will be triggered

- - If no, will register the new onboarded device(s) in the SharePoint list and a notification will be sent to the Defender for Endpoint admin

- - Take all devices last seen in the past 7 days.

-In this solution you will not have duplicate alerts:

-There are tenants that have numerous devices. Getting all those devices might be very expensive and might require paging.

-keywords: microsoft defender for endpoint, onboard, deploy

-ms.sitesec: library

-ms.pagetype: security

-keywords: sensor, sensor health, misconfigured, inactive, no sensor data, sensor data, impaired communications, communication

-ms.sitesec: library

-ms.pagetype: security

-keywords: Microsoft Defender for Endpoint, endpoint detection and response, response, detection, cybersecurity, protection

-keywords: partners, applications, third-party, connections, sentinelone, lookout, bitdefender, corrata, morphisec, paloalto, ziften, better mobile

-ms.sitesec: library

-ms.pagetype: security

-|[Cyren Web Filter](https://go.microsoft.com/fwlink/?linkid=2108221)|Enhance your Defender for Endpoint with advanced Web Filtering

-description: Learn how you can extend existing security offerings on top of the open framework and a rich set of APIs to build extensions and integrations with Microsoft Defender for Endpoint

-keywords: API, partner, extend, open framework, apis, extensions, integrations, detection, management, response, vulnerabilities, intelligence

-ms.sitesec: library

-ms.pagetype: security

-Integrating the automated investigation and response capability with other solutions such as network security products or other endpoint security products will help to address alerts. The integration also minimizes the complexities surrounding network and device signal correlation, effectively streamlining the investigation and threat remediation actions on devices.

-Orchestration solutions can help build playbooks and integrate the rich data model and actions that Defender for Endpoint APIs expose to orchestrate responses, such as query for device data, trigger device isolation, block/allow, resolve alert and others.

-The above scenarios serve as examples of the extensibility of the platform. You are not limited to the examples and we certainly encourage you to leverage the open framework to discover and explore other scenarios.

-## Related topic

-keywords: deploy, prepare, permissions, environment, endpoint, server

-ms.sitesec: library

-ms.pagetype: security

-In Windows 10, versions 1703, hiding the interface will hide Microsoft Defender Antivirus notifications and prevent the Virus & threat protection tile from appearing in the Windows Security app.

-In earlier versions of Windows 10, the setting will hide the Windows Defender client interface. If the user attempts to open it, they will receive a warning that says, "Your system administrator has restricted access to this app."

-1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**.

-3. Click **Administrative templates**.

-5. Double-click the **Enable headless UI mode** setting and set the option to **Enabled**. Click **OK**.

-See [Prevent users from locally modifying policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) for more options on preventing users form modifying protection on their PCs.

-You can prevent users from pausing scans, which can be helpful to ensure scheduled or on-demand scans are not interrupted by users.

-1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**.

-3. Click **Administrative templates**.

-5. Double-click the **Allow users to pause scan** setting and set the option to **Disabled**. Click **OK**.

-Indicates whether to disable UI Lockdown mode. If you specify a value of `$True`, Microsoft Defender Antivirus disables UI Lockdown mode. If you specify a value of `$False` or do not specify a value, UI Lockdown mode is enabled.

-keywords: advanced features, settings, block file

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-keywords: preview, preview experience, Microsoft Defender for Endpoint, features, updates

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-keywords: deploy, setup, licensing validation, tenant configuration, network configuration

-keywords: professional service, managed security services, m365 defender, m365 defender services, mssp, configure, integration, protect, evolve, educate, defender for endpoint, detection

-ms.sitesec: library

-ms.pagetype: security

-Managed security services that assist organizations to detect threats early and help minimize the impact of a breach.

-|[Wortell Protect](https://go.microsoft.com/fwlink/?linkid=2202480)|Wortell|Wortell offers a 24.7.365 Managed Detection and Response service, SOC-as-a-service, to secure your Azure subscriptions and Microsoft 365 environment. With this managed service, Wortell will provide security monitoring and incident response, and operate Microsoft Defender and (optionally) Microsoft Sentinel on your behalf. The service also includes threat intelligence feeds and custom machine learning models|

-|[CRITICALSTART® Managed Detection & Response Services for Microsoft Defender XDR](https://go.microsoft.com/fwlink/?linkid=2202761)|CRITICALSTART|Critical Start Managed Detection and Response (MDR) services for Microsoft Defender XDR (M365D) extends security defenses to provide cross-domain threat protection and simplify breach prevention. Their team of Microsoft security experts leverages integration with M365D to detect, investigate and respond with the right actions to alerts from identity, to email and cloud – before they disrupt business operations.|

-|[CRITICALSTART® Managed Detection & Response Services for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2202844)|CRITICALSTART|Critical Start Managed Detection & Response (MDR) service for Microsoft Defender for Endpoint simplifies security across an expanded attack surface by combining Microsoft's cross-enterprise visibility threat detection and auto investigation capabilities with optimized threat detection and response to deliver an 80% reduction in false positives on the first day of production monitoring.|

-|[Mandiant MDR for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2202388)|Mandiant, Inc.|Mandiant Managed Defense protects your business with a managed detection and response (MDR) service fueled by dedicated and frontline IR experts who protect against motivated adversaries with a combination of up-to-the-minute threat intelligence, data science and real-world expertise. Managed Defense helps customers optimize investments in Microsoft technology, maximize resources and accelerate investigations.|

-|[Security Operations & MDR](https://go.microsoft.com/fwlink/?linkid=2202843)|BDO|BDO's Security Operations Center (SOC) provides continuous detection, protection and response for organizations globally. BDO MDR is like having eyes where you don't. It's modern technology and experts make hunting, detecting and responding one less thing to keep up with. Because they have eyes where we don't.|

-|[BlueVoyant MDR for Microsoft Defender XDR](https://www.bluevoyant.com/platform/mdr/mdr-for-microsoft)|BlueVoyant|BlueVoyant's MDR (Managed Detection and Response) for Microsoft Defender XDR combines the power of Microsoft's Defender product suite with BlueVoyant's elite 24x7 security operations team to identify, investigate and eradicate today's most sophisticated and advanced cyberattacks. In addition to MDR, services can include implementation, assessments, training, concierge, third party integrations, and more.|

-|[Managed XDR for Microsoft](https://www.cyberproof.com/security-services/managed-xdr-for-microsoft/)|CyberProof|CyberProof's Managed XDR (Extended Detection and Response) for Microsoft identifies intrusions across your enterprise as you migrate to the cloud ΓÇô from applications to endpoints, identities and data - enabling timely response to reduce the impact of the attack. The combination of their human expertise and experience in security operations with Microsoft's 365 Defender and Microsoft Sentinel technology reduces the costs and complexity of adopting and operating a cloud-native cyber defense architecture.|

-|[Cloud Control - Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202678)|The Collective|The Collective's Cloud Control Managed Protection, Detection and Response services is an enterprise grade managed service, delivering true Security Operations Center-as-a-Service (SOC) experience with a personal touch.|

-|[Nedscaper Managed XDR](https://go.microsoft.com/fwlink/?linkid=2202478)|Nedscaper|Nedscaper Manager XDR (MDR) is a Managed Detect and Respond SaaS solution, which provides 24/7 Threat Protection, continues Vulnerability Management and combined Threat Intelligence built on Azure. The Microsoft (365 & Azure) Defender products, plus any non-Microsoft / 3P Security solution, is connected to Microsoft Sentinel as the core platform for the Security analysts.|

-|[dinext. pi-SOC](https://go.microsoft.com/fwlink/?linkid=2202581)|dinext AG|Through a close integration of deployment support, security operations and consulting in hardening and architectural improvements, dinext AG accompanies customers holistically on their way to a modern security environment.|

-|[Kroll](https://www.kroll.com/en/services/cyber-risk/managed-security/kroll-responder)|Kroll|Kroll provides proprietary data, technology and insights to help our clients stay ahead of complex demands related to risk, governance and growth. Our solutions deliver a powerful competitive advantage, enabling faster, smarter and more sustainable decisions. With 5,000 experts around the world, we create value and impact for our clients and communities.|

-|[Wortell Protect](https://go.microsoft.com/fwlink/?linkid=2202480)|Wortell|Wortell offers a 24.7.365 Managed Detection and Response service, SOC-as-a-service, to secure your Azure subscriptions and Microsoft 365 environment. With this managed service, Wortell will provide security monitoring and incident response, and operate Microsoft Defender and (optionally) Microsoft Sentinel on your behalf. The service also includes threat intelligence feeds and custom machine learning models|

-|[Mandiant MDR for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2202388)|Mandiant, Inc.|Mandiant Managed Defense protects your business with a managed detection and response (MDR) service fueled by dedicated and frontline IR experts who protect against motivated adversaries with a combination of up-to-the-minute threat intelligence, data science and real-world expertise. Managed Defense helps customers optimize investments in Microsoft technology, maximize resources and accelerate investigations.|

-|[Security Operations & MDR](https://go.microsoft.com/fwlink/?linkid=2202843)|BDO|BDO's Security Operations Center (SOC) provides continuous detection, protection and response for organizations globally. BDO MDR is like having eyes where you don't. It's modern technology and experts make hunting, detecting and responding one less thing to keep up with. Because they have eyes where we don't.|

-|[Managed Security Services for Microsoft Defender Suite](https://go.microsoft.com/fwlink/?linkid=2202476)|Dell Technologies|Dell Technologies is a Global services delivery company with a distributed Security Operations Center that is available 24/7 to serve customers with security monitoring and management. They help onboard customers and improve their security posture and offload the burden of hiring and managing a full security team while reaping the benefits of 24 hour detection and response.|

-|[CSIS Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202385)|CSIS|24/7 monitoring and analysis of security alerts giving companies actionable insights into what, when, and how security incidents have taken place.|

-|[BlueVoyant MDR for Microsoft Defender XDR](https://www.bluevoyant.com/platform/mdr/mdr-for-microsoft)|BlueVoyant|BlueVoyant's MDR (Managed Detection and Response) for Microsoft Defender XDR combines the power of Microsoft's Defender product suite with BlueVoyant's elite 24x7 security operations team to identify, investigate and eradicate today's most sophisticated and advanced cyberattacks. In addition to MDR, services can include implementation, assessments, training, concierge, third party integrations, and more.|

-|[Aujas Managed Security Services](https://go.microsoft.com/fwlink/?linkid=2202672)|Aujas Cybersecurity|Managed security services that assist organizations to detect threats early and help minimize the impact of a breach.|

-|[Cloud Control - Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202678)|The Collective|The Collective's Cloud Control Managed Protection, Detection and Response services is an enterprise grade managed service, delivering true Security Operations Center-as-a-Service (SOC) experience with a personal touch.|

-|[dinext. pi-SOC](https://go.microsoft.com/fwlink/?linkid=2202581)|dinext AG|Through a close integration of deployment support, security operations and consulting in hardening and architectural improvements, dinext AG accompanies customers holistically on their way to a modern security environment.|

-|[SepagoSOC](https://go.microsoft.com/fwlink/?linkid=2202677)|Sepago GmbH|SepagoSOC experts ensure that your environment is constantly monitored and protected utilizing the complete range of Microsoft Defender XDR solutions and Microsoft Sentinel.They help you to constantly evolve your security landscape with both technical and organizational experience.|

-|[Microsoft 365 Security Assessment](https://go.microsoft.com/fwlink/?linkid=2202389)|Nedscaper|The Microsoft 365 Security assessment provides a risk-based approach to scan and analyze the security baseline (prevention is better than the cure) and settings of the Microsoft 365 Security products, from Microsoft 365 E3 security products like Microsoft Entra Conditional Access and Microsoft Intune (Microsoft Defender Antivirus policies) to the Microsoft 365 E5 Security products like Microsoft Defender XDR, Microsoft Entra ID Protection and Microsoft Defender for Identity, Devices, Office 365 and Cloud Apps.|

-|[Wortell Protect](https://go.microsoft.com/fwlink/?linkid=2202480)|Wortell|Wortell offers a 24.7.365 Managed Detection and Response service, SOC-as-a-service, to secure your Azure subscriptions and Microsoft 365 environment. With this managed service, Wortell will provide security monitoring and incident response, and operate Microsoft Defender and (optionally) Microsoft Sentinel on your behalf. The service also includes threat intelligence feeds and custom machine learning models|

-|[Mandiant MDR for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2202388)|Mandiant, Inc.|Mandiant Managed Defense protects your business with a managed detection and response (MDR) service fueled by dedicated and frontline IR experts who protect against motivated adversaries with a combination of up-to-the-minute threat intelligence, data science and real-world expertise. Managed Defense helps customers optimize investments in Microsoft technology, maximize resources and accelerate investigations.|

-|[Security Operations & MDR](https://go.microsoft.com/fwlink/?linkid=2202843)|BDO|BDO's Security Operations Center (SOC) provides continuous detection, protection and response for organizations globally. BDO MDR is like having eyes where you don't. It's modern technology and experts make hunting, detecting and responding one less thing to keep up with. Because they have eyes where we don't.|

-|[BlueVoyant MDR for Microsoft Defender XDR](https://www.bluevoyant.com/platform/mdr/mdr-for-microsoft)|BlueVoyant|BlueVoyant's MDR (Managed Detection and Response) for Microsoft Defender XDR combines the power of Microsoft's Defender product suite with BlueVoyant's elite 24x7 security operations team to identify, investigate and eradicate today's most sophisticated and advanced cyberattacks. In addition to MDR, services can include implementation, assessments, training, concierge, third party integrations, and more.|

-|[dinext. pi-SOC](https://go.microsoft.com/fwlink/?linkid=2202581)|dinext AG|Through a close integration of deployment support, security operations and consulting in hardening and architectural improvements, dinext AG accompanies customers holistically on their way to a modern security environment.|

-Evolve your organization's security posture through improved processes and technologies that will up-level threat detection, containment, and remediation capabilities.

-|[CRITICALSTART® Cybersecurity Consulting

-|[Wortell Protect](https://go.microsoft.com/fwlink/?linkid=2202480)|Wortell|Wortell offers a 24.7.365 Managed Detection and Response service, SOC-as-a-service, to secure your Azure subscriptions and Microsoft 365 environment. With this managed service, Wortell will provide security monitoring and incident response, and operate Microsoft Defender and (optionally) Microsoft Sentinel on your behalf. The service also includes threat intelligence feeds and custom machine learning models|

-|[Mandiant MDR for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2202388)|Mandiant, Inc.|Mandiant Managed Defense protects your business with a managed detection and response (MDR) service fueled by dedicated and frontline IR experts who protect against motivated adversaries with a combination of up-to-the-minute threat intelligence, data science and real-world expertise. Managed Defense helps customers optimize investments in Microsoft technology, maximize resources and accelerate investigations.|

-|[Security Operations & MDR](https://go.microsoft.com/fwlink/?linkid=2202843)|BDO|BDO's Security Operations Center (SOC) provides continuous detection, protection and response for organizations globally. BDO MDR is like having eyes where you don't. It's modern technology and experts make hunting, detecting and responding one less thing to keep up with. Because they have eyes where we don't.|

-|[BlueVoyant MDR for Microsoft Defender XDR](https://www.bluevoyant.com/platform/mdr/mdr-for-microsoft)|BlueVoyant|BlueVoyant's MDR (Managed Detection and Response) for Microsoft Defender XDR combines the power of Microsoft's Defender product suite with BlueVoyant's elite 24x7 security operations team to identify, investigate and eradicate today's most sophisticated and advanced cyberattacks. In addition to MDR, services can include implementation, assessments, training, concierge, third party integrations, and more.|

-|[Cloud Control - Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202678)|The Collective|The Collective's Cloud Control Managed Protection, Detection and Response services is an enterprise grade managed service, delivering true Security Operations Center-as-a-Service (SOC) experience with a personal touch.|

-|[dinext. pi-SOC](https://go.microsoft.com/fwlink/?linkid=2202581)|dinext AG|Through a close integration of deployment support, security operations and consulting in hardening and architectural improvements, it accompanies customers holistically on their way to a modern security environment.|

-|[CRITICALSTART® Cybersecurity Advisory

-|[Secure Multi-Cloud Environments Workshop](https://go.microsoft.com/fwlink/?linkid=2202479)|Netrix|As the use of cloud services continues to grow, cyber risks and threats continue to evolve. Get help achieving your hybrid and multi-cloud security objectivesΓÇöand identify current and real threatsΓÇöby scheduling a Secure Multi-Cloud Environments Workshop.|

-|[Secure Identities & Access Workshop](https://go.microsoft.com/fwlink/?linkid=2202479)|Netrix|Given the complexity of identities, data, applications, and devices, it's essential to learn how to ensure the right people are accessing the right information, securely. In this workshop, we'll show you how identity is the fundamental pillars of an integrated security philosophy and end-to-end security strategy.|

-|[Wortell Protect](https://go.microsoft.com/fwlink/?linkid=2202480)|Wortell|Wortell offers a 24.7.365 Managed Detection and Response service, SOC-as-a-service, to secure your Azure subscriptions and Microsoft 365 environment. With this managed service, Wortell will provide security monitoring and incident response, and operate Microsoft Defender and (optionally) Microsoft Sentinel on your behalf. The service also includes threat intelligence feeds and custom machine learning models|

-|[Mandiant MDR for Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2202388)|Mandiant, Inc.|Mandiant Managed Defense protects your business with a managed detection and response (MDR) service fueled by dedicated and frontline IR experts who protect against motivated adversaries with a combination of up-to-the-minute threat intelligence, data science and real-world expertise. Managed Defense helps customers optimize investments in Microsoft technology, maximize resources and accelerate investigations.|

-|[BlueVoyant MDR for Microsoft Defender XDR](https://www.bluevoyant.com/platform/mdr/mdr-for-microsoft)|BlueVoyant|BlueVoyant's MDR (Managed Detection and Response) for Microsoft Defender XDR combines the power of Microsoft's Defender product suite with BlueVoyant's elite 24x7 security operations team to identify, investigate and eradicate today's most sophisticated and advanced cyberattacks. In addition to MDR, services can include implementation, assessments, training, concierge, third party integrations, and more.|

-|[Cloud Control - Managed Detection & Response](https://go.microsoft.com/fwlink/?linkid=2202678)|The Collective|The Collective's Cloud Control Managed Protection, Detection and Response services is an enterprise grade managed service, delivering true Security Operations Center-as-a-Service (SOC) experience with a personal touch.|

-## Related topics

-keywords: rbac, role, based, access, control, groups, control, tier, aad

-ms.sitesec: library

-ms.pagetype: security

-keywords: incident, incidents, machines, devices, users, alerts, alert, investigation, graph, evidence

-ms.pagetype: security

-keywords: detect, threats, detected threats, devices, URL,

-ms.sitesec: library

-ms.pagetype: security

-keywords: client analyzer, troubleshoot sensor, analyzer, mdeanalyzer, windows

-ms.sitesec: library

-ms.pagetype: security

-# Run a detection test on a newly onboarded Microsoft Defender for Endpoint device

-When you add a device to the Microsoft Defender for Endpoint service for management, this is also called onboarding devices. Onboarding allows devices to report signals about their health status to the service.

-Making sure, or verifying, that a device has been added to the service successfully is a critical step in the entire deployment process. It assures that all the devices expected are being managed.

-## Related topics

-keywords: microsoft, defender, Microsoft Defender for Endpoint, linux, scans, antivirus, microsoft defender for endpoint on linux

-ms.sitesec: library

-ms.pagetype: security

-keywords: quick scan, full scan, schedule, group policy, antivirus

-ms.sitesec: library

-ms.pagetype: security

-keywords: quick scan, full scan, antivirus, schedule, PowerShell

-ms.sitesec: library

-ms.pagetype: security

-keywords: quick scan, full scan, WMI, schedule, antivirus

-ms.sitesec: library

-ms.pagetype: security

-keywords: migrate server, server, 2012r2, 2016, server migration, device management, configure Microsoft Defender for Endpoint servers, onboard Microsoft Defender for Endpoint servers

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-keywords: onboarding, Microsoft Defender for Endpoint onboarding, sccm, group policy, mdm, local script, detection test

-ms.sitesec: library

-ms.pagetype: security

-keywords: migration, windows defender, advanced endpoint protection, antivirus, antimalware, passive mode, active mode

-ms.sitesec: library

-ms.pagetype: security

-keywords: device timeline, endpoint, MITRE, MITRE ATT&CK, techniques, tactics

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-description: View technological partners of M365 Defender to enhance detection, investigation, and threat intelligence capabilities of the platform.

-|[Security Incident Response](https://go.microsoft.com/fwlink/?linkid=2201874)|ServiceNow|The ServiceNow® Security Incident Response application tracks the progress of security incidents from discovery and initial analysis, through containment, eradication, and recovery, and into the final post-incident review, knowledge base article creation, and closure.|

-|[InsightConnect](https://go.microsoft.com/fwlink/?linkid=2201877)|Rapid7|InsightConnect provides security orchestration, automation and response solution that accelerates incident response and vulnerability management processes.|

-|[Demisto, a Palo Alto Networks Company](https://go.microsoft.com/fwlink/?linkid=2201777)|Palo Alto Networks|Demisto integrates with Microsoft Defender for Endpoint to enable security teams to orchestrate and automate endpoint security monitoring, enrichment and response.|

-|[SafeBreach](https://go.microsoft.com/fwlink/?linkid=2201775)|SafeBreach|SafeBreach continuously executes attacks, correlates results to help visualize security gaps, and leverages contextual insights to highlight remediation efforts. With its Hacker's PlaybookΓäó, the industry's most extensive collection of attack data enabled by state-of-the-art threat intelligence research, SafeBreach empowers organizations to get proactive about security with a simple approach that replaces hope with data.|

-|[Better Mobile Security Platform](https://go.microsoft.com/fwlink/?linkid=2202043)|Better Mobile Security Inc.|Provides solution for Threat, Phishing and Privacy Protection and Simulation.|

-|[Blue Hexagon for Network](https://go.microsoft.com/fwlink/?linkid=2201780)|Blue Hexagon|Blue Hexagon has built the industry's first real-time deep learning platform for network threat protection.|

-|[Better Mobile Security Platform](https://go.microsoft.com/fwlink/?linkid=2202043)|Better Mobile Security Inc.|Provides solution for Threat, Phishing and Privacy Protection and Simulation.|

-|[Silverfort](https://go.microsoft.com/fwlink/?linkid=2201873)|Silverfort|Enforces Microsoft Entra Conditional Access and MFA across any user system and environment on-prem and in the cloud.|

-|[Corrata Mobile Security](https://go.microsoft.com/fwlink/?linkid=2201879)|Corrata|Corrata is an immune system for mobile devices and tablets that detects & protects mobile devices from the full spectrum of security threats like phishing, malware, man-in-the-middle attacks and data loss.|

-|[Better Mobile Security Platform](https://go.microsoft.com/fwlink/?linkid=2202043)|Better Mobile Security Inc.|Provides solution for Threat, Phishing and Privacy Protection and Simulation.|

-|[Webex](https://go.microsoft.com/fwlink/?linkid=2201872)|Cisco|Webex, a Cisco company, provides on-demand applications for businesses to conduct web conferencing, telework and application remote control.|

-|[Corrata Mobile Security](https://go.microsoft.com/fwlink/?linkid=2201879)|Corrata|Corrata is an immune system for mobile devices and tablets that detects & protects mobile devices from the full spectrum of security threats like phishing, malware, man-in-the-middle attacks and data loss.|

-keywords: analyst report, threat analytics, detections, advanced hunting queries, mitigations,

-ms.sitesec: library

-ms.pagetype: security

-keywords: threat analytics, risk evaluation, OS mitigation, microcode mitigation, mitigation status

-search.product: eADQiWindows 10XVcnh

-ms.sitesec: library

-ms.pagetype: security

-keywords: threat intelligence, alert definitions, indicators of compromise, ioc

-ms.sitesec: library

-ms.pagetype: security

-keywords: Microsoft Defender XDR, conditional access, office, Microsoft Defender for Endpoint, microsoft defender for identity, microsoft defender for office, Microsoft Defender for Cloud, microsoft cloud app security, azure sentinel

-ms.sitesec: library

-ms.pagetype: security

-ms.pagetype: security

- :::image type="content" source="../../media/defender/m365-defender-rbac-permissions-secops-flyout.png" alt-text="Screenshot of the permissions flyout screen" lightbox="../../media/defender/m365-defender-rbac-permissions-secops-flyout.png":::

-|Email quarantine|Manage|View and release email from quarantine.|

-|Email advanced actions|Manage|Move or Delete email to the junk email folder, deleted items or inbox, including soft and hard delete of email.|

-|Email message headers|Read|View email and collaboration data in a hunting scenarios, including advanced hunting, threat explorer, campaigns, and email entity.|

-|Email content|Read|View and download email content and attachments.|