| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| includes | Microsoft 365 Content Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-365-content-updates.md | +## Week of February 19, 2024 +++| Published On |Topic title | Change | +|||--| +| 2/19/2024 | [What's new in Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score-whats-new?view=o365-worldwide) | modified | +| 2/20/2024 | [Use roles to define your frontline managers and workers in Shifts](/microsoft-365/frontline/shifts-frontline-manager-worker-roles?view=o365-worldwide) | added | +| 2/20/2024 | [Block Microsoft 365 user accounts with PowerShell](/microsoft-365/enterprise/block-user-accounts-with-microsoft-365-powershell?view=o365-worldwide) | modified | +| 2/20/2024 | [Delete Microsoft 365 user accounts with PowerShell](/microsoft-365/enterprise/delete-and-restore-user-accounts-with-microsoft-365-powershell?view=o365-worldwide) | modified | +| 2/20/2024 | [Manage Microsoft 365 groups](/microsoft-365/enterprise/manage-microsoft-365-groups?view=o365-worldwide) | modified | +| 2/20/2024 | [Manage security groups with PowerShell](/microsoft-365/enterprise/manage-security-groups-with-microsoft-365-powershell?view=o365-worldwide) | modified | +| 2/20/2024 | Manage schedule owners for shift management | removed | +| 2/20/2024 | [Microsoft Teams Virtual Appointments Call Quality Dashboard](/microsoft-365/frontline/virtual-appointments-call-quality?view=o365-worldwide) | modified | +| 2/20/2024 | [Set up multitenant management in Microsoft Defender XDR](/microsoft-365/security/defender/mto-requirements?view=o365-worldwide) | modified | +| 2/20/2024 | [Automated investigation and response in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/air-about?view=o365-worldwide) | modified | +| 2/20/2024 | [Use Azure Privileged Identity Management (PIM) in Microsoft Defender for Office 365 to limit admin access to cyber security tools.](/microsoft-365/security/office-365-security/pim-in-mdo-configure?view=o365-worldwide) | modified | +| 2/21/2024 | [Manage add-ins in the admin center](/microsoft-365/admin/manage/manage-addins-in-the-admin-center?view=o365-worldwide) | modified | +| 2/21/2024 | [Deploy and manage Office Add-ins](/microsoft-365/admin/manage/office-addins?view=o365-worldwide) | modified | +| 2/21/2024 | [Visit the Action center to see remediation actions](/microsoft-365/security/defender-endpoint/auto-investigation-action-center?view=o365-worldwide) | modified | +| 2/21/2024 | [View the details and results of an automated investigation](/microsoft-365/security/defender-endpoint/autoir-investigation-results?view=o365-worldwide) | modified | +| 2/21/2024 | [Use basic permissions to access the portal](/microsoft-365/security/defender-endpoint/basic-permissions?view=o365-worldwide) | modified | +| 2/21/2024 | [Cloud protection and sample submission at Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission?view=o365-worldwide) | modified | +| 2/21/2024 | [Device health Sensor health & OS report](/microsoft-365/security/defender-endpoint/device-health-sensor-health-os?view=o365-worldwide) | modified | +| 2/21/2024 | [Download the Microsoft Defender for Endpoint client analyzer](/microsoft-365/security/defender-endpoint/download-client-analyzer?view=o365-worldwide) | modified | +| 2/21/2024 | [EDR detection test for verifying device's onboarding and reporting service](/microsoft-365/security/defender-endpoint/edr-detection?view=o365-worldwide) | modified | +| 2/21/2024 | [Turn on cloud protection in Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 2/21/2024 | [Enable and update Microsoft Defender Antivirus on Windows Server](/microsoft-365/security/defender-endpoint/enable-update-mdav-to-latest-ws?view=o365-worldwide) | modified | +| 2/21/2024 | [Evaluate controlled folder access](/microsoft-365/security/defender-endpoint/evaluate-controlled-folder-access?view=o365-worldwide) | modified | +| 2/21/2024 | [See how Exploit protection works in a demo](/microsoft-365/security/defender-endpoint/evaluate-exploit-protection?view=o365-worldwide) | modified | +| 2/21/2024 | [Evaluate Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/evaluate-mde?view=o365-worldwide) | modified | +| 2/21/2024 | [Evaluate network protection](/microsoft-365/security/defender-endpoint/evaluate-network-protection?view=o365-worldwide) | modified | +| 2/21/2024 | [Review events and errors using Event Viewer](/microsoft-365/security/defender-endpoint/event-error-codes?view=o365-worldwide) | modified | +| 2/21/2024 | [Apply mitigations to help prevent attacks through vulnerabilities](/microsoft-365/security/defender-endpoint/exploit-protection?view=o365-worldwide) | modified | +| 2/21/2024 | [Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-support-ebpf?view=o365-worldwide) | modified | +| 2/21/2024 | [Diagnosing performance issues with SharePoint](/microsoft-365/enterprise/diagnosing-performance-issues-with-sharepoint-online?view=o365-worldwide) | modified | +| 2/21/2024 | [Microsoft 365 network connectivity test tool](/microsoft-365/enterprise/office-365-network-mac-perf-onboarding-tool?view=o365-worldwide) | modified | +| 2/21/2024 | [Frequently asked questions (FAQs) about tamper protection](/microsoft-365/security/defender-endpoint/faqs-on-tamper-protection?view=o365-worldwide) | modified | +| 2/21/2024 | [Fix unhealthy sensors in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/fix-unhealthy-sensors?view=o365-worldwide) | modified | +| 2/21/2024 | [Become a Microsoft Defender for Endpoint partner](/microsoft-365/security/defender-endpoint/get-started-partner-integration?view=o365-worldwide) | modified | +| 2/21/2024 | [Microsoft Defender for Endpoint for US Government customers](/microsoft-365/security/defender-endpoint/gov?view=o365-worldwide) | modified | +| 2/21/2024 | [Grant access to managed security service provider (MSSP)](/microsoft-365/security/defender-endpoint/grant-mssp-access?view=o365-worldwide) | modified | +| 2/21/2024 | [Investigate agent health issues](/microsoft-365/security/defender-endpoint/health-status?view=o365-worldwide) | modified | +| 2/21/2024 | [Host firewall reporting in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/host-firewall-reporting?view=o365-worldwide) | modified | +| 2/21/2024 | [Create indicators based on certificates](/microsoft-365/security/defender-endpoint/indicator-certificates?view=o365-worldwide) | modified | +| 2/21/2024 | [Create indicators for files](/microsoft-365/security/defender-endpoint/indicator-file?view=o365-worldwide) | modified | +| 2/21/2024 | [Manage indicators](/microsoft-365/security/defender-endpoint/indicator-manage?view=o365-worldwide) | modified | +| 2/21/2024 | [Use Microsoft Defender for Endpoint sensitivity labels to protect your data and prioritize security incident response](/microsoft-365/security/defender-endpoint/information-protection-investigation?view=o365-worldwide) | modified | +| 2/21/2024 | [Investigate Microsoft Defender for Endpoint alerts](/microsoft-365/security/defender-endpoint/investigate-alerts?view=o365-worldwide) | modified | +| 2/21/2024 | [Investigate connection events that occur behind forward proxies](/microsoft-365/security/defender-endpoint/investigate-behind-proxy?view=o365-worldwide) | modified | +| 2/21/2024 | [Investigate an IP address associated with an alert](/microsoft-365/security/defender-endpoint/investigate-ip?view=o365-worldwide) | modified | +| 2/21/2024 | [Investigate devices in the Defender for Endpoint Devices list](/microsoft-365/security/defender-endpoint/investigate-machines?view=o365-worldwide) | modified | +| 2/21/2024 | [Investigate a user account in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/investigate-user?view=o365-worldwide) | modified | +| 2/21/2024 | [Configure Microsoft Defender for Endpoint on iOS features](/microsoft-365/security/defender-endpoint/ios-configure-features?view=o365-worldwide) | modified | +| 2/21/2024 | [Deploy Microsoft Defender for Endpoint on iOS with Mobile Application Management](/microsoft-365/security/defender-endpoint/ios-install-unmanaged?view=o365-worldwide) | modified | +| 2/21/2024 | [Deploy Microsoft Defender for Endpoint on iOS with Microsoft Intune](/microsoft-365/security/defender-endpoint/ios-install?view=o365-worldwide) | modified | +| 2/21/2024 | [Privacy information - Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-privacy?view=o365-worldwide) | modified | +| 2/21/2024 | [Troubleshoot issues and find answers on FAQs related to Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-troubleshoot?view=o365-worldwide) | modified | +| 2/21/2024 | [What's new in Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-whatsnew?view=o365-worldwide) | modified | +| 2/21/2024 | [How to Deploy Defender for Endpoint on Linux with Chef](/microsoft-365/security/defender-endpoint/linux-deploy-defender-for-endpoint-with-chef?view=o365-worldwide) | modified | +| 2/21/2024 | [Configure and validate exclusions for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-exclusions?view=o365-worldwide) | modified | +| 2/21/2024 | [Deploy Microsoft Defender for Endpoint on Linux with Ansible](/microsoft-365/security/defender-endpoint/linux-install-with-ansible?view=o365-worldwide) | modified | +| 2/21/2024 | [Deploy Microsoft Defender for Endpoint on Linux with Puppet](/microsoft-365/security/defender-endpoint/linux-install-with-puppet?view=o365-worldwide) | modified | +| 2/21/2024 | [Deploy Microsoft Defender for Endpoint on Linux with SaltStack](/microsoft-365/security/defender-endpoint/linux-install-with-saltack?view=o365-worldwide) | modified | +| 2/21/2024 | [Privacy for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-privacy?view=o365-worldwide) | modified | +| 2/21/2024 | [Detect and block potentially unwanted applications with Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-pua?view=o365-worldwide) | modified | +| 2/21/2024 | [How to schedule scans with Microsoft Defender for Endpoint (Linux)](/microsoft-365/security/defender-endpoint/linux-schedule-scan-mde?view=o365-worldwide) | modified | +| 2/21/2024 | [Microsoft Defender for Endpoint on Linux static proxy discovery](/microsoft-365/security/defender-endpoint/linux-static-proxy-configuration?view=o365-worldwide) | modified | +| 2/21/2024 | [Troubleshoot cloud connectivity issues for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-support-connectivity?view=o365-worldwide) | modified | +| 2/21/2024 | [Troubleshoot missing events or alerts issues for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-support-events?view=o365-worldwide) | modified | +| 2/21/2024 | [Troubleshoot installation issues for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-support-install?view=o365-worldwide) | modified | +| 2/21/2024 | [Troubleshoot performance issues for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-support-perf?view=o365-worldwide) | modified | +| 2/21/2024 | [Troubleshoot issues for Microsoft Defender for Endpoint on Linux RHEL6](/microsoft-365/security/defender-endpoint/linux-support-rhel?view=o365-worldwide) | modified | +| 2/21/2024 | [What's new in Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-whatsnew?view=o365-worldwide) | modified | +| 2/21/2024 | [Live response library methods and properties](/microsoft-365/security/defender-endpoint/live-response-library-methods?view=o365-worldwide) | modified | +| 2/21/2024 | [macOS Device control policies frequently asked questions (FAQ)](/microsoft-365/security/defender-endpoint/mac-device-control-faq?view=o365-worldwide) | modified | +| 2/21/2024 | [Deploy and manage Device Control using Intune](/microsoft-365/security/defender-endpoint/mac-device-control-intune?view=o365-worldwide) | modified | +| 2/21/2024 | [Deploy and manage device control using JAMF](/microsoft-365/security/defender-endpoint/mac-device-control-jamf?view=o365-worldwide) | modified | +| 2/21/2024 | [Deploy and manage device control manually](/microsoft-365/security/defender-endpoint/mac-device-control-manual?view=o365-worldwide) | modified | +| 2/21/2024 | [Device control for macOS](/microsoft-365/security/defender-endpoint/mac-device-control-overview?view=o365-worldwide) | modified | +| 2/21/2024 | [Sign in to Jamf Pro](/microsoft-365/security/defender-endpoint/mac-install-jamfpro-login?view=o365-worldwide) | modified | +| 2/21/2024 | [Deploying Microsoft Defender for Endpoint on macOS with Jamf Pro](/microsoft-365/security/defender-endpoint/mac-install-with-jamf?view=o365-worldwide) | modified | +| 2/21/2024 | [Deployment with a different Mobile Device Management (MDM) system for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-install-with-other-mdm?view=o365-worldwide) | modified | +| 2/21/2024 | [Set up device groups in Jamf Pro](/microsoft-365/security/defender-endpoint/mac-jamfpro-device-groups?view=o365-worldwide) | modified | +| 2/21/2024 | [Enroll Microsoft Defender for Endpoint on macOS devices into Jamf Pro](/microsoft-365/security/defender-endpoint/mac-jamfpro-enroll-devices?view=o365-worldwide) | modified | +| 2/21/2024 | [Set up the Microsoft Defender for Endpoint on macOS policies in Jamf Pro](/microsoft-365/security/defender-endpoint/mac-jamfpro-policies?view=o365-worldwide) | modified | +| 2/21/2024 | [Privacy for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-privacy?view=o365-worldwide) | modified | +| 2/21/2024 | [Detect and block potentially unwanted applications with Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-pua?view=o365-worldwide) | modified | +| 2/21/2024 | [How to schedule scans with Microsoft Defender for Endpoint on macOS](/microsoft-365/security/defender-endpoint/mac-schedule-scan?view=o365-worldwide) | modified | +| 2/21/2024 | [Troubleshoot installation issues for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-support-install?view=o365-worldwide) | modified | +| 2/21/2024 | [Troubleshoot license issues for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-support-license?view=o365-worldwide) | modified | +| 2/21/2024 | [Troubleshoot performance issues for Microsoft Defender for Endpoint on macOS](/microsoft-365/security/defender-endpoint/mac-support-perf?view=o365-worldwide) | modified | +| 2/21/2024 | [Troubleshoot system extension issues for Microsoft Defender for Endpoint on macOS](/microsoft-365/security/defender-endpoint/mac-support-sys-ext?view=o365-worldwide) | modified | +| 2/21/2024 | [New configuration profiles for macOS Big Sur and newer versions of macOS](/microsoft-365/security/defender-endpoint/mac-sysext-policies?view=o365-worldwide) | modified | +| 2/21/2024 | [Troubleshooting mode in Microsoft Defender for Endpoint on macOS](/microsoft-365/security/defender-endpoint/mac-troubleshoot-mode?view=o365-worldwide) | modified | +| 2/21/2024 | [Deploy updates for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-updates?view=o365-worldwide) | modified | +| 2/21/2024 | [Device inventory](/microsoft-365/security/defender-endpoint/machines-view-overview?view=o365-worldwide) | modified | +| 2/21/2024 | [Manage Microsoft Defender for Endpoint alerts](/microsoft-365/security/defender-endpoint/manage-alerts?view=o365-worldwide) | modified | +| 2/21/2024 | [Manage automation folder exclusions](/microsoft-365/security/defender-endpoint/manage-automation-folder-exclusions?view=o365-worldwide) | modified | +| 2/21/2024 | [Apply Microsoft Defender Antivirus updates after certain events](/microsoft-365/security/defender-endpoint/manage-event-based-updates-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 2/21/2024 | [Manage the gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/manage-gradual-rollout?view=o365-worldwide) | modified | +| 2/21/2024 | [Manage Microsoft Defender for Endpoint incidents](/microsoft-365/security/defender-endpoint/manage-incidents?view=o365-worldwide) | modified | +| 2/21/2024 | Manage Microsoft Defender for Endpoint using Configuration Manager | removed | +| 2/21/2024 | Manage Microsoft Defender for Endpoint using Group Policy Objects | removed | +| 2/21/2024 | Manage Microsoft Defender for Endpoint using Intune | removed | +| 2/21/2024 | Manage Microsoft Defender for Endpoint using PowerShell, WMI, and MPCmdRun.exe | removed | +| 2/21/2024 | Manage Microsoft Defender for Endpoint after initial setup or migration | removed | +| 2/21/2024 | [Apply Microsoft Defender Antivirus protection updates to out of date endpoints](/microsoft-365/security/defender-endpoint/manage-outdated-endpoints-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 2/21/2024 | [Deployment guidance for Microsoft Defender for Endpoint on Linux for SAP](/microsoft-365/security/defender-endpoint/mde-linux-deployment-on-sap?view=o365-worldwide) | modified | +| 2/21/2024 | [Manage contracts using a Microsoft 365 solution](/microsoft-365/syntex/solution-manage-contracts-in-microsoft-365) | modified | +| 2/22/2024 | [Set up multifactor authentication for users](/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide) | modified | +| 2/22/2024 | [Understand your invoice for your Microsoft MCA billing account](/microsoft-365/commerce/billing-and-payments/understand-your-invoice?view=o365-worldwide) | modified | +| 2/22/2024 | [Buy or remove licenses for a Microsoft business subscription](/microsoft-365/commerce/licenses/buy-licenses?view=o365-worldwide) | modified | +| 2/22/2024 | [Manage self-service purchases and trials (for admins)](/microsoft-365/commerce/subscriptions/manage-self-service-purchases-admins?view=o365-worldwide) | modified | +| 2/22/2024 | [Manage system extensions using JamF](/microsoft-365/security/defender-endpoint/manage-sys-extensions-using-jamf?view=o365-worldwide) | modified | +| 2/22/2024 | [Get started with your Microsoft Defender for Endpoint deployment](/microsoft-365/security/defender-endpoint/mde-planning-guide?view=o365-worldwide) | modified | +| 2/22/2024 | [Microsoft Defender for Endpoint plug-in for Windows Subsystem for Linux (WSL)](/microsoft-365/security/defender-endpoint/mde-plugin-wsl?view=o365-worldwide) | modified | +| 2/22/2024 | [Configure Microsoft Defender for Cloud Apps integration](/microsoft-365/security/defender-endpoint/microsoft-cloud-app-security-config?view=o365-worldwide) | modified | +| 2/22/2024 | [Microsoft Defender for Cloud Apps integration overview](/microsoft-365/security/defender-endpoint/microsoft-cloud-app-security-integration?view=o365-worldwide) | modified | +| 2/22/2024 | [Pilot ring deployment using Group Policy and Windows Server Update Services](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-pilot-ring-deployment-group-policy-wsus?view=o365-worldwide) | modified | +| 2/22/2024 | [Production ring deployment using Group Policy and Windows Server Update Services](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-production-ring-deployment-group-policy-wsus?view=o365-worldwide) | modified | +| 2/22/2024 | [Production ring deployment using Group Policy and Microsoft Update (MU)](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-ring-deployment-group-policy-microsoft-update?view=o365-worldwide) | modified | +| 2/22/2024 | [Production ring deployment using Group Policy and network share](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-ring-deployment-group-policy-network-share?view=o365-worldwide) | modified | +| 2/22/2024 | [Appendices for ring deployment using Group Policy and Windows Server Update Services (WSUS)](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-ring-deployment-group-policy-wsus-appendices?view=o365-worldwide) | modified | +| 2/22/2024 | [Ring deployment using Intune and Microsoft Update (MU)](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-ring-deployment-intune-microsoft-update?view=o365-worldwide) | modified | +| 2/22/2024 | [Ring deployment using System Center Configuration Manager and Windows Server Update Services](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-ring-deployment-sscm-wsus?view=o365-worldwide) | modified | +| 2/22/2024 | [Microsoft Defender Antivirus ring deployment guide overview](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-ring-deployment?view=o365-worldwide) | modified | +| 2/22/2024 | [Microsoft Defender for Endpoint on Android](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-android?view=o365-worldwide) | modified | +| 2/22/2024 | [Schedule antivirus scans using Windows Management Instrumentation](/microsoft-365/security/defender-endpoint/schedule-antivirus-scans-wmi?view=o365-worldwide) | modified | +| 2/22/2024 | [Changes coming to Topics](/microsoft-365/topics/changes-coming-to-topics?view=o365-worldwide) | added | +| 2/22/2024 | [Frequently asked questions about changes coming to Topics](/microsoft-365/topics/topics-changes-faq?view=o365-worldwide) | added | +| 2/22/2024 | [How to schedule an antivirus scan using Anacron in Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/schedule-antivirus-scan-in-mde?view=o365-worldwide) | modified | +| 2/22/2024 | [Schedule antivirus scans using Group Policy](/microsoft-365/security/defender-endpoint/schedule-antivirus-scans-group-policy?view=o365-worldwide) | modified | +| 2/22/2024 | [Schedule antivirus scans using PowerShell](/microsoft-365/security/defender-endpoint/schedule-antivirus-scans-powershell?view=o365-worldwide) | modified | +| 2/22/2024 | [Server migration scenarios for the new version of Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/server-migration?view=o365-worldwide) | modified | +| 2/22/2024 | [Supported Microsoft Defender for Endpoint capabilities by platform](/microsoft-365/security/defender-endpoint/supported-capabilities-by-platform?view=o365-worldwide) | modified | +| 2/22/2024 | [Migrate to Microsoft Defender for Endpoint from non-Microsoft endpoint protection](/microsoft-365/security/defender-endpoint/switch-to-mde-overview?view=o365-worldwide) | modified | +| 2/22/2024 | [Technological partners of Microsoft Defender XDR](/microsoft-365/security/defender-endpoint/technological-partners?view=o365-worldwide) | modified | +| 2/22/2024 | [Understand threat intelligence concepts in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/threat-indicator-concepts?view=o365-worldwide) | modified | +| 2/22/2024 | [Integrate Microsoft Defender for Endpoint with other Microsoft solutions](/microsoft-365/security/defender-endpoint/threat-protection-integration?view=o365-worldwide) | modified | +| 2/22/2024 | [Data privacy and compliance in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-data-privacy-and-compliance?view=o365-worldwide) | added | +| 2/22/2024 | [Assign roles to Microsoft 365 user accounts with PowerShell](/microsoft-365/enterprise/assign-roles-to-user-accounts-with-microsoft-365-powershell?view=o365-worldwide) | modified | +| 2/22/2024 | [Get scan history by session](/microsoft-365/security/defender-endpoint/api/get-scan-history-by-session?view=o365-worldwide) | modified | +| 2/22/2024 | [Add, update, or delete a scan definition](/microsoft-365/security/defender-endpoint/api/add-a-new-scan-definition?view=o365-worldwide) | modified | +| 2/22/2024 | [Add or remove a tag for a machine](/microsoft-365/security/defender-endpoint/api/add-or-remove-machine-tags?view=o365-worldwide) | modified | +| 2/22/2024 | [Add or remove a tag for multiple machines](/microsoft-365/security/defender-endpoint/api/add-or-remove-multiple-machine-tags?view=o365-worldwide) | modified | +| 2/22/2024 | [Get alerts API](/microsoft-365/security/defender-endpoint/api/alerts?view=o365-worldwide) | modified | +| 2/22/2024 | [API Explorer in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/api/api-explorer?view=o365-worldwide) | modified | +| 2/22/2024 | [Hello World for Microsoft Defender for Endpoint API](/microsoft-365/security/defender-endpoint/api/api-hello-world?view=o365-worldwide) | modified | +| 2/22/2024 | [Microsoft Defender for Endpoint APIs connection to Power BI](/microsoft-365/security/defender-endpoint/api/api-power-bi?view=o365-worldwide) | modified | +| 2/22/2024 | [Microsoft Defender for Endpoint API release notes](/microsoft-365/security/defender-endpoint/api/api-release-notes?view=o365-worldwide) | modified | +| 2/22/2024 | [Access the Microsoft Defender for Endpoint APIs](/microsoft-365/security/defender-endpoint/api/apis-intro?view=o365-worldwide) | modified | +| 2/22/2024 | [Batch Delete Indicators API](/microsoft-365/security/defender-endpoint/api/batch-delete-ti-indicators?view=o365-worldwide) | modified | +| 2/22/2024 | [Batch Update alert entities API](/microsoft-365/security/defender-endpoint/api/batch-update-alerts?view=o365-worldwide) | modified | +| 2/22/2024 | [Cancel machine action API](/microsoft-365/security/defender-endpoint/api/cancel-machine-action?view=o365-worldwide) | modified | +| 2/22/2024 | [Collect investigation package API](/microsoft-365/security/defender-endpoint/api/collect-investigation-package?view=o365-worldwide) | modified | +| 2/22/2024 | [Common Microsoft Defender for Endpoint API errors](/microsoft-365/security/defender-endpoint/api/common-errors?view=o365-worldwide) | modified | +| 2/22/2024 | [Create alert from event API](/microsoft-365/security/defender-endpoint/api/create-alert-by-reference?view=o365-worldwide) | modified | +| 2/22/2024 | [Delete a file from the live response library](/microsoft-365/security/defender-endpoint/api/delete-library?view=o365-worldwide) | modified | +| 2/22/2024 | [Delete Indicator API.](/microsoft-365/security/defender-endpoint/api/delete-ti-indicator-by-id?view=o365-worldwide) | modified | +| 2/22/2024 | [Get alert information by ID API](/microsoft-365/security/defender-endpoint/api/get-alert-info-by-id?view=o365-worldwide) | modified | +| 2/22/2024 | [Get alert related domains information](/microsoft-365/security/defender-endpoint/api/get-alert-related-domain-info?view=o365-worldwide) | modified | +| 2/22/2024 | [Get alert related files information](/microsoft-365/security/defender-endpoint/api/get-alert-related-files-info?view=o365-worldwide) | modified | +| 2/22/2024 | [Get alert-related IPs' information](/microsoft-365/security/defender-endpoint/api/get-alert-related-ip-info?view=o365-worldwide) | modified | +| 2/22/2024 | [Get alert related machine information](/microsoft-365/security/defender-endpoint/api/get-alert-related-machine-info?view=o365-worldwide) | modified | +| 2/22/2024 | [Get alert related user information](/microsoft-365/security/defender-endpoint/api/get-alert-related-user-info?view=o365-worldwide) | modified | +| 2/22/2024 | [List alerts API](/microsoft-365/security/defender-endpoint/api/get-alerts?view=o365-worldwide) | modified | +| 2/22/2024 | [List all recommendations](/microsoft-365/security/defender-endpoint/api/get-all-recommendations?view=o365-worldwide) | modified | +| 2/22/2024 | [Get all vulnerabilities by machine and software](/microsoft-365/security/defender-endpoint/api/get-all-vulnerabilities-by-machines?view=o365-worldwide) | modified | +| 2/22/2024 | [Get all vulnerabilities](/microsoft-365/security/defender-endpoint/api/get-all-vulnerabilities?view=o365-worldwide) | modified | +| 2/22/2024 | [Export assessment methods and properties per device](/microsoft-365/security/defender-endpoint/api/get-assessment-methods-properties?view=o365-worldwide) | modified | +| 2/22/2024 | [Export secure configuration assessment per device](/microsoft-365/security/defender-endpoint/api/get-assessment-secure-config?view=o365-worldwide) | modified | +| 2/22/2024 | [Export software inventory assessment per device](/microsoft-365/security/defender-endpoint/api/get-assessment-software-inventory?view=o365-worldwide) | modified | +| 2/22/2024 | [Export software vulnerabilities assessment per device](/microsoft-365/security/defender-endpoint/api/get-assessment-software-vulnerabilities?view=o365-worldwide) | modified | +| 2/22/2024 | [Authenticated scan methods and properties](/microsoft-365/security/defender-endpoint/api/get-authenticated-scan-properties?view=o365-worldwide) | modified | +| 2/22/2024 | [Get the device secure score](/microsoft-365/security/defender-endpoint/api/get-device-secure-score?view=o365-worldwide) | modified | +| 2/22/2024 | [Get discovered vulnerabilities](/microsoft-365/security/defender-endpoint/api/get-discovered-vulnerabilities?view=o365-worldwide) | modified | +| 2/22/2024 | [Get domain-related alerts API](/microsoft-365/security/defender-endpoint/api/get-domain-related-alerts?view=o365-worldwide) | modified | +| 2/22/2024 | [Get domain-related machines API](/microsoft-365/security/defender-endpoint/api/get-domain-related-machines?view=o365-worldwide) | modified | +| 2/22/2024 | [Get domain statistics API](/microsoft-365/security/defender-endpoint/api/get-domain-statistics?view=o365-worldwide) | modified | +| 2/22/2024 | [Get exposure score](/microsoft-365/security/defender-endpoint/api/get-exposure-score?view=o365-worldwide) | modified | +| 2/22/2024 | [Get file information API](/microsoft-365/security/defender-endpoint/api/get-file-information?view=o365-worldwide) | modified | +| 2/22/2024 | [Get file-related alerts API](/microsoft-365/security/defender-endpoint/api/get-file-related-alerts?view=o365-worldwide) | modified | +| 2/22/2024 | [Get file-related machines API](/microsoft-365/security/defender-endpoint/api/get-file-related-machines?view=o365-worldwide) | modified | +| 2/22/2024 | [Get file statistics API](/microsoft-365/security/defender-endpoint/api/get-file-statistics?view=o365-worldwide) | modified | +| 2/22/2024 | [Get installed software](/microsoft-365/security/defender-endpoint/api/get-installed-software?view=o365-worldwide) | modified | +| 2/22/2024 | [List Investigations API](/microsoft-365/security/defender-endpoint/api/get-investigation-collection?view=o365-worldwide) | modified | +| 2/22/2024 | [Get Investigation object API](/microsoft-365/security/defender-endpoint/api/get-investigation-object?view=o365-worldwide) | modified | +| 2/22/2024 | [Get IP related alerts API](/microsoft-365/security/defender-endpoint/api/get-ip-related-alerts?view=o365-worldwide) | modified | +| 2/22/2024 | [Get IP statistics API](/microsoft-365/security/defender-endpoint/api/get-ip-statistics?view=o365-worldwide) | modified | +| 2/22/2024 | [Get live response results](/microsoft-365/security/defender-endpoint/api/get-live-response-result?view=o365-worldwide) | modified | +| 2/22/2024 | [Get machine by ID API](/microsoft-365/security/defender-endpoint/api/get-machine-by-id?view=o365-worldwide) | modified | +| 2/22/2024 | [List exposure score by device group](/microsoft-365/security/defender-endpoint/api/get-machine-group-exposure-score?view=o365-worldwide) | modified | +| 2/22/2024 | [Get machine logon users API](/microsoft-365/security/defender-endpoint/api/get-machine-log-on-users?view=o365-worldwide) | modified | +| 2/22/2024 | [Get machine related alerts API](/microsoft-365/security/defender-endpoint/api/get-machine-related-alerts?view=o365-worldwide) | modified | +| 2/22/2024 | [Get MachineAction object API](/microsoft-365/security/defender-endpoint/api/get-machineaction-object?view=o365-worldwide) | modified | +| 2/22/2024 | [List machineActions API](/microsoft-365/security/defender-endpoint/api/get-machineactions-collection?view=o365-worldwide) | modified | +| 2/22/2024 | [List devices by software](/microsoft-365/security/defender-endpoint/api/get-machines-by-software?view=o365-worldwide) | modified | +| 2/22/2024 | [List devices by vulnerability](/microsoft-365/security/defender-endpoint/api/get-machines-by-vulnerability?view=o365-worldwide) | modified | +| 2/22/2024 | [Get missing KBs by device ID](/microsoft-365/security/defender-endpoint/api/get-missing-kbs-machine?view=o365-worldwide) | modified | +| 2/22/2024 | [Get missing KBs by software ID](/microsoft-365/security/defender-endpoint/api/get-missing-kbs-software?view=o365-worldwide) | modified | +| 2/22/2024 | [Get package SAS URI API](/microsoft-365/security/defender-endpoint/api/get-package-sas-uri?view=o365-worldwide) | modified | +| 2/22/2024 | [Get recommendation by Id](/microsoft-365/security/defender-endpoint/api/get-recommendation-by-id?view=o365-worldwide) | modified | +| 2/22/2024 | [List devices by recommendation](/microsoft-365/security/defender-endpoint/api/get-recommendation-machines?view=o365-worldwide) | modified | +| 2/22/2024 | [List vulnerabilities by recommendation](/microsoft-365/security/defender-endpoint/api/get-recommendation-vulnerabilities?view=o365-worldwide) | modified | +| 2/22/2024 | [List all remediation activities](/microsoft-365/security/defender-endpoint/api/get-remediation-all-activities?view=o365-worldwide) | modified | +| 2/22/2024 | [List exposed devices of one remediation activity](/microsoft-365/security/defender-endpoint/api/get-remediation-exposed-devices-activities?view=o365-worldwide) | modified | +| 2/22/2024 | [Remediation activity methods and properties](/microsoft-365/security/defender-endpoint/api/get-remediation-methods-properties?view=o365-worldwide) | modified | +| 2/22/2024 | [Get one remediation activity by ID](/microsoft-365/security/defender-endpoint/api/get-remediation-one-activity?view=o365-worldwide) | modified | +| 2/22/2024 | [Get security recommendations](/microsoft-365/security/defender-endpoint/api/get-security-recommendations?view=o365-worldwide) | modified | +| 2/22/2024 | [Get software by ID](/microsoft-365/security/defender-endpoint/api/get-software-by-id?view=o365-worldwide) | modified | +| 2/22/2024 | [List software version distribution](/microsoft-365/security/defender-endpoint/api/get-software-ver-distribution?view=o365-worldwide) | modified | +| 2/22/2024 | [List software](/microsoft-365/security/defender-endpoint/api/get-software?view=o365-worldwide) | modified | +| 2/22/2024 | [List Indicators API](/microsoft-365/security/defender-endpoint/api/get-ti-indicators-collection?view=o365-worldwide) | modified | +| 2/22/2024 | [Get user-related alerts API](/microsoft-365/security/defender-endpoint/api/get-user-related-alerts?view=o365-worldwide) | modified | +| 2/22/2024 | [Get user-related machines API](/microsoft-365/security/defender-endpoint/api/get-user-related-machines?view=o365-worldwide) | modified | +| 2/22/2024 | [List vulnerabilities by software](/microsoft-365/security/defender-endpoint/api/get-vuln-by-software?view=o365-worldwide) | modified | +| 2/22/2024 | [Get vulnerability by ID](/microsoft-365/security/defender-endpoint/api/get-vulnerability-by-id?view=o365-worldwide) | modified | +| 2/22/2024 | [Import Indicators API](/microsoft-365/security/defender-endpoint/api/import-ti-indicators?view=o365-worldwide) | modified | +| 2/22/2024 | [Start Investigation API](/microsoft-365/security/defender-endpoint/api/initiate-autoir-investigation?view=o365-worldwide) | modified | +| 2/22/2024 | [Stream Microsoft Defender for Endpoint event](/microsoft-365/security/defender-endpoint/api/raw-data-export?view=o365-worldwide) | modified | +| 2/22/2024 | [Recommendation methods and properties](/microsoft-365/security/defender-endpoint/api/recommendation?view=o365-worldwide) | modified | +| 2/22/2024 | [Restrict app execution API](/microsoft-365/security/defender-endpoint/api/restrict-code-execution?view=o365-worldwide) | modified | +| 2/22/2024 | [Advanced Hunting API](/microsoft-365/security/defender-endpoint/api/run-advanced-query-api?view=o365-worldwide) | modified | +| 2/22/2024 | [Advanced Hunting with PowerShell API Basics](/microsoft-365/security/defender-endpoint/api/run-advanced-query-sample-powershell?view=o365-worldwide) | modified | +| 2/22/2024 | [Advanced Hunting with Python API Guide](/microsoft-365/security/defender-endpoint/api/run-advanced-query-sample-python?view=o365-worldwide) | modified | +| 2/22/2024 | [Run antivirus scan API](/microsoft-365/security/defender-endpoint/api/run-av-scan?view=o365-worldwide) | modified | +| 2/22/2024 | [Set device value API](/microsoft-365/security/defender-endpoint/api/set-device-value?view=o365-worldwide) | modified | +| 2/22/2024 | [Software methods and properties](/microsoft-365/security/defender-endpoint/api/software?view=o365-worldwide) | modified | +| 2/22/2024 | [Stop and quarantine file API](/microsoft-365/security/defender-endpoint/api/stop-and-quarantine-file?view=o365-worldwide) | modified | +| 2/22/2024 | [Indicator resource type](/microsoft-365/security/defender-endpoint/api/ti-indicator?view=o365-worldwide) | modified | +| 2/22/2024 | [Release device from isolation API](/microsoft-365/security/defender-endpoint/api/unisolate-machine?view=o365-worldwide) | modified | +| 2/22/2024 | [Remove app restriction API](/microsoft-365/security/defender-endpoint/api/unrestrict-code-execution?view=o365-worldwide) | modified | +| 2/22/2024 | [Update alert entity API](/microsoft-365/security/defender-endpoint/api/update-alert?view=o365-worldwide) | modified | +| 2/22/2024 | [Update machine entity API](/microsoft-365/security/defender-endpoint/api/update-machine-method?view=o365-worldwide) | modified | +| 2/22/2024 | [Upload files to the live response library](/microsoft-365/security/defender-endpoint/api/upload-library?view=o365-worldwide) | modified | +| 2/22/2024 | [User resource type](/microsoft-365/security/defender-endpoint/api/user?view=o365-worldwide) | modified | +| 2/22/2024 | [Vulnerability methods and properties](/microsoft-365/security/defender-endpoint/api/vulnerability?view=o365-worldwide) | modified | +| 2/22/2024 | [Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-ios?view=o365-worldwide) | modified | +| 2/22/2024 | [Microsoft Defender Offline scan in Windows](/microsoft-365/security/defender-endpoint/microsoft-defender-offline?view=o365-worldwide) | modified | +| 2/22/2024 | [Migrating from non-Microsoft HIPS to attack surface reduction rules](/microsoft-365/security/defender-endpoint/migrating-asr-rules?view=o365-worldwide) | modified | +| 2/22/2024 | [Migrating servers from Microsoft Defender for Endpoint to Microsoft Defender for Cloud](/microsoft-365/security/defender-endpoint/migrating-mde-server-to-cloud?view=o365-worldwide) | modified | +| 2/22/2024 | [Resources for Microsoft Defender for Endpoint for mobile devices](/microsoft-365/security/defender-endpoint/mobile-resources-defender-endpoint?view=o365-worldwide) | modified | +| 2/22/2024 | [Monthly security summary reporting in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/monthly-security-summary-report?view=o365-worldwide) | modified | +| 2/22/2024 | [Managed security service provider (MSSP) partnership opportunities](/microsoft-365/security/defender-endpoint/mssp-support?view=o365-worldwide) | modified | +| 2/22/2024 | [Use network protection to help prevent Linux connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection-linux?view=o365-worldwide) | modified | +| 2/22/2024 | [Use network protection to help prevent macOS connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection-macos?view=o365-worldwide) | modified | +| 2/22/2024 | [Microsoft Defender for Endpoint on other platforms](/microsoft-365/security/defender-endpoint/non-windows?view=o365-worldwide) | modified | +| 2/22/2024 | [Better together - Microsoft Defender Antivirus and Office 365 (including OneDrive) - better protection from ransomware and cyberthreats](/microsoft-365/security/defender-endpoint/office-365-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 2/22/2024 | [Onboarding using Microsoft Intune](/microsoft-365/security/defender-endpoint/onboarding-endpoint-manager?view=o365-worldwide) | modified | +| 2/22/2024 | [Create an onboarding or offboarding notification rule](/microsoft-365/security/defender-endpoint/onboarding-notification?view=o365-worldwide) | modified | +| 2/22/2024 | [Troubleshoot sensor health using Microsoft Defender for Endpoint Client Analyzer](/microsoft-365/security/defender-endpoint/overview-client-analyzer?view=o365-worldwide) | modified | +| 2/22/2024 | [Partner applications in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/partner-applications?view=o365-worldwide) | modified | +| 2/22/2024 | [Microsoft Defender for Endpoint partner opportunities and scenarios](/microsoft-365/security/defender-endpoint/partner-integration?view=o365-worldwide) | modified | +| 2/22/2024 | [Hide the Microsoft Defender Antivirus interface](/microsoft-365/security/defender-endpoint/prevent-end-user-interaction-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 2/22/2024 | [Turn on the preview experience in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/preview-settings?view=o365-worldwide) | modified | +| 2/22/2024 | [Microsoft Defender for Endpoint preview features](/microsoft-365/security/defender-endpoint/preview?view=o365-worldwide) | modified | +| 2/22/2024 | [Professional services supported by Microsoft Defender XDR](/microsoft-365/security/defender-endpoint/professional-services?view=o365-worldwide) | modified | +| 2/22/2024 | [Use role-based access control to grant fine-grained access to Microsoft Defender portal](/microsoft-365/security/defender-endpoint/rbac?view=o365-worldwide) | modified | +| 2/22/2024 | [Review detected threats using the Microsoft Defender for Endpoint Antivirus and Intune integration](/microsoft-365/security/defender-endpoint/review-detected-threats?view=o365-worldwide) | modified | +| 2/22/2024 | [Run a detection test on a device recently onboarded to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/run-detection-test?view=o365-worldwide) | modified | +| 2/22/2024 | [Use Microsoft Defender for Endpoint APIs](/microsoft-365/security/defender-endpoint/api/exposed-apis-create-app-nativeapp?view=o365-worldwide) | modified | +| 2/22/2024 | [Partner access through Microsoft Defender for Endpoint APIs](/microsoft-365/security/defender-endpoint/api/exposed-apis-create-app-partners?view=o365-worldwide) | modified | +| 2/22/2024 | [Create an app to access Microsoft Defender for Endpoint without a user](/microsoft-365/security/defender-endpoint/api/exposed-apis-create-app-webapp?view=o365-worldwide) | modified | +| 2/22/2024 | [Advanced Hunting with PowerShell API Guide](/microsoft-365/security/defender-endpoint/api/exposed-apis-full-sample-powershell?view=o365-worldwide) | modified | +| 2/22/2024 | [Supported Microsoft Defender for Endpoint APIs](/microsoft-365/security/defender-endpoint/api/exposed-apis-list?view=o365-worldwide) | modified | +| 2/22/2024 | [OData queries with Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/api/exposed-apis-odata-samples?view=o365-worldwide) | modified | +| 2/22/2024 | [Fetch alerts from MSSP customer tenant](/microsoft-365/security/defender-endpoint/api/fetch-alerts-mssp?view=o365-worldwide) | modified | +| 2/22/2024 | [File resource type](/microsoft-365/security/defender-endpoint/api/files?view=o365-worldwide) | modified | +| 2/22/2024 | [Find device information by internal IP API](/microsoft-365/security/defender-endpoint/api/find-machine-info-by-ip?view=o365-worldwide) | modified | +| 2/22/2024 | [Find devices by internal IP API](/microsoft-365/security/defender-endpoint/api/find-machines-by-ip?view=o365-worldwide) | modified | +| 2/22/2024 | [Find devices by tag API](/microsoft-365/security/defender-endpoint/api/find-machines-by-tag?view=o365-worldwide) | modified | +| 2/22/2024 | [Investigation resource type](/microsoft-365/security/defender-endpoint/api/investigation?view=o365-worldwide) | modified | +| 2/22/2024 | [Isolate machine API](/microsoft-365/security/defender-endpoint/api/isolate-machine?view=o365-worldwide) | modified | +| 2/22/2024 | [List library files](/microsoft-365/security/defender-endpoint/api/list-library-files?view=o365-worldwide) | modified | +| 2/22/2024 | [List software by recommendation](/microsoft-365/security/defender-endpoint/api/list-recommendation-software?view=o365-worldwide) | modified | +| 2/22/2024 | [Machine resource type](/microsoft-365/security/defender-endpoint/api/machine?view=o365-worldwide) | modified | +| 2/22/2024 | [machineAction resource type](/microsoft-365/security/defender-endpoint/api/machineaction?view=o365-worldwide) | modified | +| 2/22/2024 | [Overview of management and APIs](/microsoft-365/security/defender-endpoint/api/management-apis?view=o365-worldwide) | modified | +| 2/22/2024 | [Submit or Update Indicator API](/microsoft-365/security/defender-endpoint/api/post-ti-indicator?view=o365-worldwide) | modified | +| 2/22/2024 | [Stream Microsoft Defender for Endpoint events to your Storage account](/microsoft-365/security/defender-endpoint/api/raw-data-export-storage?view=o365-worldwide) | modified | +| 2/23/2024 | [Upgrade or change to a different Microsoft 365 for business plan](/microsoft-365/commerce/subscriptions/upgrade-to-different-plan?view=o365-worldwide) | modified | +| 2/23/2024 | [Deploy and manage device control in Microsoft Defender for Endpoint with Microsoft Intune](/microsoft-365/security/defender-endpoint/device-control-deploy-manage-intune?view=o365-worldwide) | modified | +| 2/23/2024 | [Use a promo code to reduce price of a new Microsoft 365 for business subscription](/microsoft-365/commerce/use-a-promo-code?view=o365-worldwide) | modified | +| 2/23/2024 | [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](/microsoft-365/security/office-365-security/advanced-delivery-policy-configure?view=o365-worldwide) | modified | ++ ## Week of February 12, 2024 | 1/26/2024 | [Onboard trusted vendors to collaborate in Microsoft 365](/microsoft-365/solutions/trusted-vendor-onboarding?view=o365-worldwide) | modified | | 1/26/2024 | [Microsoft Defender portal](/microsoft-365/security/defender/microsoft-365-defender-portal?view=o365-worldwide) | modified | | 1/26/2024 | [How Microsoft identifies malware and potentially unwanted applications](/microsoft-365/security/intelligence/criteria?view=o365-worldwide) | modified |---## Week of January 15, 2024 ---| Published On |Topic title | Change | -|||--| -| 1/15/2024 | [Automatic user notifications for user reported phishing results in AIR](/microsoft-365/security/office-365-security/air-user-automatic-feedback-response?view=o365-worldwide) | added | -| 1/15/2024 | [User reported settings](/microsoft-365/security/office-365-security/submissions-user-reported-messages-custom-mailbox?view=o365-worldwide) | modified | -| 1/15/2024 | [FAQs related to Microsoft Defender Experts for XDR managed response](/microsoft-365/security/defender/faq-managed-response?view=o365-worldwide) | modified | -| 1/16/2024 | [Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-support-ebpf?view=o365-worldwide) | modified | -| 1/16/2024 | [Microsoft Defender Antivirus in Windows](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows?view=o365-worldwide) | modified | -| 1/16/2024 | [DeviceEvents table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-deviceevents-table?view=o365-worldwide) | modified | -| 1/16/2024 | [DeviceInfo table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-deviceinfo-table?view=o365-worldwide) | modified | -| 1/16/2024 | [DeviceLogonEvents table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-devicelogonevents-table?view=o365-worldwide) | modified | -| 1/16/2024 | [DeviceNetworkEvents table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-devicenetworkevents-table?view=o365-worldwide) | modified | -| 1/16/2024 | [DeviceNetworkInfo table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-devicenetworkinfo-table?view=o365-worldwide) | modified | -| 1/16/2024 | [DeviceProcessEvents table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-deviceprocessevents-table?view=o365-worldwide) | modified | -| 1/16/2024 | [DeviceTvmSoftwareInventory table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-devicetvmsoftwareinventory-table?view=o365-worldwide) | modified | -| 1/16/2024 | [DeviceTvmSoftwareVulnerabilities table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-devicetvmsoftwarevulnerabilities-table?view=o365-worldwide) | modified | -| 1/16/2024 | [DeviceTvmSoftwareVulnerabilitiesKB table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table?view=o365-worldwide) | modified | -| 1/16/2024 | [IdentityDirectoryEvents table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-identitydirectoryevents-table?view=o365-worldwide) | modified | -| 1/16/2024 | [IdentityLogonEvents table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-identitylogonevents-table?view=o365-worldwide) | modified | -| 1/16/2024 | [IdentityQueryEvents table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-identityqueryevents-table?view=o365-worldwide) | modified | -| 1/16/2024 | [What's new in Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score-whats-new?view=o365-worldwide) | modified | -| 1/16/2024 | [How Microsoft names threat actors](/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide) | modified | -| 1/16/2024 | [Microsoft 365 admin center Microsoft 365 Copilot usage](/microsoft-365/admin/activity-reports/microsoft-365-copilot-usage?view=o365-worldwide) | modified | -| 1/16/2024 | [Product keys FAQ](/microsoft-365/commerce/licenses/product-keys-faq?view=o365-worldwide) | modified | -| 1/16/2024 | [Microsoft Defender for Endpoint attack surface reduction rules demonstrations](/microsoft-365/security/defender-endpoint/defender-endpoint-demonstration-attack-surface-reduction-rules?view=o365-worldwide) | modified | -| 1/16/2024 | [Microsoft Defender for Endpoint Exploit protection (EP) demonstrations](/microsoft-365/security/defender-endpoint/defender-endpoint-demonstration-exploit-protection?view=o365-worldwide) | modified | -| 1/16/2024 | [Microsoft Defender for Endpoint Potentially unwanted applications (PUA) demonstration](/microsoft-365/security/defender-endpoint/defender-endpoint-demonstration-potentially-unwanted-applications?view=o365-worldwide) | modified | -| 1/16/2024 | [EDR detection test for verifying device's onboarding and reporting service](/microsoft-365/security/defender-endpoint/edr-detection?view=o365-worldwide) | modified | -| 1/16/2024 | [AV detection test for verifying device's onboarding and reporting services](/microsoft-365/security/defender-endpoint/validate-antimalware?view=o365-worldwide) | modified | -| 1/16/2024 | [Microsoft Defender XDR Unified role-based access control (RBAC)](/microsoft-365/security/defender/manage-rbac?view=o365-worldwide) | modified | -| 1/16/2024 | [Threat Explorer and Real-time detections basics in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/real-time-detections?view=o365-worldwide) | modified | -| 1/16/2024 | [Remediate malicious email that was delivered in Office 365](/microsoft-365/security/office-365-security/remediate-malicious-email-delivered-office-365?view=o365-worldwide) | modified | -| 1/16/2024 | [Topic center overview in Topics](/microsoft-365/topics/topic-center-overview?view=o365-worldwide) | modified | -| 1/16/2024 | [Topic ContributorsΓÇöShare knowledge and expertise in Topics](/microsoft-365/topics/topic-experiences-topic-contributors?view=o365-worldwide) | modified | -| 1/17/2024 | [Deployment guidance for Microsoft Defender for Endpoint on Linux for SAP](/microsoft-365/security/defender-endpoint/mde-linux-deployment-on-sap?view=o365-worldwide) | added | -| 1/17/2024 | [Requirements for Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-requirements?view=o365-worldwide) | modified | -| 1/17/2024 | [Sign up for Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-sign-up?view=o365-worldwide) | modified | -| 1/17/2024 | [User reported settings](/microsoft-365/security/office-365-security/submissions-user-reported-messages-custom-mailbox?view=o365-worldwide) | modified | -| 1/17/2024 | [Manage Lighthouse RBAC permissions in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-manage-lighthouse-rbac-permissions?view=o365-worldwide) | added | -| 1/17/2024 | [Microsoft 365 admin center mailbox usage reports](/microsoft-365/admin/activity-reports/mailbox-usage?view=o365-worldwide) | modified | -| 1/17/2024 | [AI assistance category in Adoption Score](/microsoft-365/admin/adoption/ai-assistance?view=o365-worldwide) | modified | -| 1/17/2024 | [IT Admins - Overview of external collaboration options in Microsoft 365](/microsoft-365/enterprise/external-guest-access?view=o365-worldwide) | modified | -| 1/17/2024 | [Frontline team collaboration](/microsoft-365/frontline/flw-team-collaboration?view=o365-worldwide) | modified | -| 1/17/2024 | [Use a Teams status message to assign a delegate](/microsoft-365/frontline/hc-delegates?view=o365-worldwide) | modified | -| 1/17/2024 | [Messaging policy settings for healthcare organizations using Microsoft Teams](/microsoft-365/frontline/messaging-policies-hc?view=o365-worldwide) | modified | -| 1/17/2024 | [Simplify business processes for frontline teams](/microsoft-365/frontline/simplify-business-processes?view=o365-worldwide) | modified | -| 1/17/2024 | [Overview of permissions in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-overview-of-permissions?view=o365-worldwide) | modified | -| 1/17/2024 | [Microsoft Defender for Endpoint SmartScreen app reputation demonstration](/microsoft-365/security/defender-endpoint/defender-endpoint-demonstration-app-reputation?view=o365-worldwide) | modified | -| 1/17/2024 | [Configure spam filter policies](/microsoft-365/security/office-365-security/anti-spam-policies-configure?view=o365-worldwide) | modified | -| 1/17/2024 | [Anti-spam protection FAQ](/microsoft-365/security/office-365-security/anti-spam-protection-faq?view=o365-worldwide) | modified | -| 1/17/2024 | [Usage card in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/mdo-usage-card-about?view=o365-worldwide) | modified | -| 1/17/2024 | [View email security reports](/microsoft-365/security/office-365-security/reports-email-security?view=o365-worldwide) | modified | -| 1/17/2024 | [Steps to set up a weekly digest email of message center changes for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/stay-informed-with-message-center?view=o365-worldwide) | modified | -| 1/17/2024 | [Understanding overrides within the email entity page in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/understand-overrides-in-email-entity?view=o365-worldwide) | modified | -| 1/17/2024 | [Views in Threat Explorer and real-time detections](/microsoft-365/security/office-365-security/threat-explorer-views?view=o365-worldwide) | modified | -| 1/17/2024 | [Try and evaluate Defender for Office 365](/microsoft-365/security/office-365-security/try-microsoft-defender-for-office-365?view=o365-worldwide) | modified | -| 1/18/2024 | [Create a baseline in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-create-a-baseline?view=o365-worldwide) | modified | -| 1/18/2024 | [Manage multifactor authentication in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-manage-mfa?view=o365-worldwide) | modified | -| 1/18/2024 | [Manage your tenant list in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-manage-tenant-list?view=o365-worldwide) | modified | -| 1/18/2024 | [Mitigate threats in Microsoft 365 Lighthouse with Microsoft Defender Antivirus](/microsoft-365/lighthouse/m365-lighthouse-mitigate-threats?view=o365-worldwide) | modified | -| 1/18/2024 | [Microsoft Defender for Endpoint attack surface reduction rules demonstrations](/microsoft-365/security/defender-endpoint/defender-endpoint-demonstration-attack-surface-reduction-rules?view=o365-worldwide) | modified | -| 1/18/2024 | [Microsoft Defender for Endpoint Network protection demonstrations](/microsoft-365/security/defender-endpoint/defender-endpoint-demonstration-network-protection?view=o365-worldwide) | modified | -| 1/18/2024 | [Onboard Windows devices in Azure Virtual Desktop](/microsoft-365/security/defender-endpoint/onboard-windows-multi-session-device?view=o365-worldwide) | modified | -| 1/18/2024 | [Get started with Microsoft Defender Experts for XDR](/microsoft-365/security/defender/get-started-xdr?view=o365-worldwide) | modified | -| 1/18/2024 | [How to use the Microsoft Defender Experts for XDR service](/microsoft-365/security/defender/start-using-mdex-xdr?view=o365-worldwide) | modified | -| 1/18/2024 | [Manage Microsoft 365 Archive (Preview)](/microsoft-365/syntex/archive/archive-manage) | modified | -| 1/18/2024 | Enter your Microsoft Open product key | removed | -| 1/18/2024 | Help your frontline workers track time and attendance | removed | -| 1/18/2024 | [Overview of Loop workspaces storage and permissions](/microsoft-365/loop/loop-workspaces-storage-permission?view=o365-worldwide) | modified | -| 1/19/2024 | [Get started with Microsoft Defender Experts for XDR](/microsoft-365/security/defender/get-started-xdr?view=o365-worldwide) | modified | -| 1/19/2024 | [Create indicators](/microsoft-365/security/defender-endpoint/manage-indicators?view=o365-worldwide) | modified | -| 1/19/2024 | [Overview of document translation in Microsoft Syntex](/microsoft-365/syntex/translation-overview) | added | -| 1/19/2024 | [Set up and manage document translation in Microsoft Syntex](/microsoft-365/syntex/translation-setup) | added | -| 1/19/2024 | [Translate a document in Microsoft Syntex](/microsoft-365/syntex/translation) | added | -| 1/19/2024 | [Microsoft 365 Business Premium resources # < 60 chars](/microsoft-365/business-premium/index?view=o365-worldwide) | modified | -| 1/19/2024 | [Sign in and set up Microsoft 365 Business Premium](/microsoft-365/business-premium/m365-business-premium-setup?view=o365-worldwide) | modified | -| 1/19/2024 | [Sign in and set up Microsoft 365 for Campaigns](/microsoft-365/business-premium/m365-campaigns-setup?view=o365-worldwide) | modified | -| 1/19/2024 | [Protect yourself against phishing and other attacks](/microsoft-365/business-premium/m365bp-avoid-phishing-and-attacks?view=o365-worldwide) | modified | -| 1/19/2024 | [Working with device groups in Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-device-groups-mdb?view=o365-worldwide) | modified | -| 1/19/2024 | [Admin roles for Intune in the Microsoft 365 admin center](/microsoft-365/business-premium/m365bp-intune-admin-roles-in-the-mac?view=o365-worldwide) | modified | -| 1/19/2024 | [Secure managed and unmanaged devices](/microsoft-365/business-premium/m365bp-managed-unmanaged-devices?view=o365-worldwide) | modified | -| 1/19/2024 | [Monitor and maintain Microsoft 365 Business Premium and Defender for Business](/microsoft-365/business-premium/m365bp-mdb-maintain-environment?view=o365-worldwide) | modified | -| 1/19/2024 | [What's new in Microsoft 365 Business Premium and Microsoft Defender for Business](/microsoft-365/business-premium/m365bp-mdb-whats-new?view=o365-worldwide) | modified | -| 1/19/2024 | [Onboard your organization's devices to Microsoft Defender for Business](/microsoft-365/business-premium/m365bp-onboard-devices-mdb?view=o365-worldwide) | modified | -| 1/19/2024 | [Microsoft 365 Business Premium overview](/microsoft-365/business-premium/m365bp-overview?view=o365-worldwide) | modified | -| 1/19/2024 | [Protect against malware and other threats with Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-protect-against-malware-cyberthreats?view=o365-worldwide) | modified | -| 1/19/2024 | [Review remediation actions in Microsoft Defender XDR](/microsoft-365/business-premium/m365bp-review-remediation-actions-devices?view=o365-worldwide) | modified | -| 1/19/2024 | [Threats detected by Microsoft Defender Antivirus](/microsoft-365/business-premium/m365bp-threats-detected-defender-av?view=o365-worldwide) | modified | -| 1/19/2024 | [Upgrade Windows devices to Windows 10 or 11 Pro](/microsoft-365/business-premium/m365bp-upgrade-windows-pro?view=o365-worldwide) | modified | -| 1/19/2024 | [Send encrypted email with Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-use-labels-encryption?view=o365-worldwide) | modified | -| 1/19/2024 | [Install Microsoft 365 Apps on your devices with Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-users-install-m365-apps?view=o365-worldwide) | modified | -| 1/19/2024 | [Protect unmanaged devices with Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-users-protect-unmanaged-devices?view=o365-worldwide) | modified | -| 1/19/2024 | [View or edit device protection policies](/microsoft-365/business-premium/m365bp-view-edit-create-mdb-policies?view=o365-worldwide) | modified | -| 1/19/2024 | [Microsoft 365 Business Premium frequently asked questions](/microsoft-365/business-premium/microsoft-365-business-faqs?view=o365-worldwide) | modified | -| 1/19/2024 | [Microsoft 365 for business security best practices](/microsoft-365/business-premium/secure-your-business-data?view=o365-worldwide) | modified | -| 1/19/2024 | [Microsoft Defender for Endpoint documentation # < 60 chars](/microsoft-365/security/defender-endpoint/index?view=o365-worldwide) | modified | -| 1/19/2024 | [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide) | modified | -| 1/19/2024 | [Configure general Defender for Endpoint settings](/microsoft-365/security/defender-endpoint/preferences-setup?view=o365-worldwide) | modified | -| 1/19/2024 | [Overview of Microsoft Syntex](/microsoft-365/syntex/syntex-overview) | modified | |
| security | Microsoft Xdr Auditing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-xdr-auditing.md | + + Title: Search the audit log for events in Microsoft Defender XDR +description: Learn about the Microsoft Defender XDR activities that are logged in the Microsoft 365 audit log. ++++ms.localizationpriority: medium ++audience: ITPro ++- m365-security +- tier3 + Last updated : 2/21/2024+search.appverid: met150 +++# Search the audit log for events in Microsoft Defender XDR +++**Applies to:** ++- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) +- [Microsoft Defender XDR](https://go.microsoft.com/fwlink/?linkid=2118804) ++The audit log can help you investigate specific activities across Microsoft 365 services. In the Microsoft Defender XDR portal, Microsoft Defender XDR and Microsoft Defender for Endpoint activities are audited. Some of the activities audited are: ++- Changes to data retention settings +- Changes to advanced features +- Creation of indicators of compromise +- Isolation of devices +- Add\edit\deletion of security roles +- Create\edit custom detection rules +- Assign user to an incidents ++For a complete list of Microsoft Defender XDR activities that are audited, see [Microsoft Defender XDR activities](#microsoft-defender-xdr-activities) and [Microsoft Defender for Endpoint activities](#microsoft-defender-for-endpoint-activities). ++## Requirements ++To access the audit log, you need to have the **View-Only Audit Logs** or **Audit Logs** role in Exchange Online. By default, those roles are assigned to the Compliance Management and Organization Management role groups. ++>[!Note] +> Global administrators in Office 365 and Microsoft 365 are automatically added as members of the Organization Management role group in Exchange Online. ++## Turn on auditing in Microsoft Defender XDR ++Microsoft Defender XDR uses the [Microsoft Purview auditing solution](/purview/audit-solutions-overview), before you can look at the audit data in the Microsoft Defender XDR portal: ++- You should confirm that auditing is turned on in the Microsoft Purview compliance portal. For more information, see [Turn auditing on or off](/purview/audit-log-enable-disable). ++- Follow the steps below to enable the unified audit log in the Microsoft Defender XDR portal: + 1. Log in to [Microsoft Defender XDR](https://security.microsoft.com/homepage) using an account with the Security administrator or Global administrator role assigned. + 2. In the navigation pane, select **Settings** \> **Endpoints** \> **Advanced features**. + 3. Scroll own to **Unified audit log** and toggle the setting to **On**. ++ :::image type="content" source="../../media/defender/unified-audit-log.png" alt-text="Screenshot of the unified audit log toggle in Microsoft Defender XDR advanced settings" lightbox="../../media/defender/unified-audit-log.png"::: + 4. Select **Save preferences**. ++## Using the audit search in Microsoft Defender XDR ++1. To retrieve audit logs for Microsoft Defender XDR activities, navigate to the [Microsoft Defender XDR Audit page](https://security.microsoft.com/auditlogsearch) or go to the [Purview compliance portal](https://compliance.microsoft.com) and select **Audit**. ++ :::image type="content" source="../../media/defender/unified-audit-log-xdr.png" alt-text="Screenshot of the unified audit log page in Microsoft Defender XDR " lightbox="../../media/defender/unified-audit-log-xdr.png"::: ++2. On the **New Search** page, filter the activities, dates, and users you want to audit. +3. Select **Search** ++ :::image type="content" source="../../media/defender/unified-audit-search.png" alt-text="Screenshot of the unified audit log search options in Microsoft Defender XDR " lightbox="../../media/defender/unified-audit-search.png"::: ++4. Export your results to Excel for further analysis. ++For step-by-step instructions, see [Search the audit log in the compliance portal](/purview/audit-new-search). ++Audit log record retention is based on Microsoft Purview retention policies. For more information, see [Manage audit log retention policies](/purview/audit-log-retention-policies). ++## Microsoft Defender XDR activities ++For a list of all events that are logged for user and admin activities in Microsoft Defender XDR in the Microsoft 365 audit log, see: ++- [Custom detection activities in Microsoft Defender XDR in the audit log](/purview/audit-log-activities#microsoft-defender-xdr-custom-detection-activities) +- [Incident activities in Microsoft Defender XDR in the audit log](/purview/audit-log-activities#microsoft-defender-xdr-custom-detection-activities) +- [Suppression rule activities in Microsoft Defender XDR in the audit log](/purview/audit-log-activities#microsoft-defender-xdr-suppression-rule-activities) ++## Microsoft Defender for Endpoint activities ++For a list of all events that are logged for user and admin activities in Microsoft Defender for Endpoint in the Microsoft 365 audit log, see: ++- [General settings activities in Defender for Endpoint in the audit log](/purview/audit-log-activities#microsoft-defender-for-endpoint-general-settings-activities) +- [Indicator settings activities in Defender for Endpoint in the audit log](/purview/audit-log-activities#microsoft-defender-for-endpoint-indicator-settings-activities) +- [Response action activities in Defender for Endpoint in the audit log](/purview/audit-log-activities#microsoft-defender-for-endpoint-reponse-actions-activities) +- [Roles settings activities in Defender for Endpoint in the audit log](/purview/audit-log-activities#microsoft-defender-for-endpoint-roles-settings-activities) ++## Using a PowerShell script ++You can use the following PowerShell code snippet to query the Office 365 Management API to retrieve information about Microsoft Defender XDR events: ++```PowerShell +$cred = Get-Credential +$s = New-PSSession -ConfigurationName microsoft.exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection +Import-PSSession $s +Search-UnifiedAuditLog -StartDate 2023/03/12 -EndDate 2023/03/20 -RecordType <ID> +``` ++>[!Note] +> See the API column in Audit activities included for the record type values. ++## Additional resources ++- [Search the audit log in the compliance center](/purview/audit-new-search) +- [Use a PowerShell script to search the audit log](/purview/audit-log-search-script) +- [Detailed properties in the audit log](/purview/audit-log-detailed-properties) +- [Export, configure, and view audit log records](/purview/audit-log-export-records) +- [Office 365 Management Activity API reference](/office/office-365-management-api/office-365-management-activity-api-reference) |