| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Increase Threat Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/security-and-compliance/increase-threat-protection.md | Before you begin, note your current Microsoft Secure Score. The goal isn't to ac For more information, see [Microsoft Secure Score](../../security/defender/microsoft-secure-score.md). -For additional details about securing data and managed devices in Microsoft 365 Business Premium, see [How to secure your business data with Microsoft 365 for business](../../business-premium/secure-your-business-data.md). +For additional details about securing data and managed devices in Microsoft 365 Business Premium, see [How to secure your business data with Microsoft 365 for business](/microsoft-365/business-premium/secure-your-business-data). ## Top tasks to make sure your subscription is secure For additional details about securing data and managed devices in Microsoft 365 ## Related content -- [How to secure your business data with Microsoft 365 for business](../../business-premium/secure-your-business-data.md) +[How to secure your business data with Microsoft 365 for business](/microsoft-365/business-premium/secure-your-business-data) |
| business-premium | Secure Your Business Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/secure-your-business-data.md | Microsoft 365 for business plans include Microsoft Exchange, Microsoft Teams, Sh - [Microsoft 365 Business PremiumΓÇöcybersecurity for small business](/microsoft-365/business-premium/) - [Compare security features in Microsoft 365 plans for small and medium-sized businesses](../security/defender-business/compare-mdb-m365-plans.md) (for more details about Defender for Business and Microsoft 365 Business Premium) - [Compare Microsoft endpoint security plans](../security/defender-endpoint/defender-endpoint-plan-1-2.md) (for securing and managing devices)- |
| compliance | Apply Sensitivity Label Automatically | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/apply-sensitivity-label-automatically.md | Although auto-labeling is one of the most efficient ways to classify, label, and - With Microsoft Syntex, you can [apply a sensitivity label to a document understanding model](/microsoft-365/contentunderstanding/apply-a-sensitivity-label-to-a-model), so that identified documents in a SharePoint document library are automatically labeled. +- For Outlook messages, you can [apply a sensitivity label based on attachments that are labeled](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments). + - When you use the [Azure Information Protection unified labeling client](/azure/information-protection/rms-client/aip-clientv2): - For files in on-premises data stores, such as network shares and SharePoint Server libraries: Use the [scanner](deploy-scanner.md) to discover sensitive information in these files and label them appropriately. If you're planning to migrate or upload these files to SharePoint in Microsoft 365, use the scanner to label the files before you move them to the cloud. |
| compliance | Dlp Create Deploy Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-create-deploy-policy.md | Endpoint Endpoint + Teams --> +### Scenario 2 Show policy tip as oversharing popup (preview) ++> [!IMPORTANT] +> This is a hypothetical scenario with hypothetical values. It's only for illustrative purposes. You should substitute your own sensitive information types, sensitivity labels, distribution groups and users. ++#### Scenario 2 pre-requisites and assumptions ++This scenario uses the *Highly confidential* sensitivity label, so it requires that you have created and published sensitivity labels. To learn more, see: ++- [Learn about sensitivity labels](sensitivity-labels.md) +- [Get started with sensitivity labels](get-started-with-sensitivity-labels.md) +- [Create and configure sensitivity labels and their policies](create-sensitivity-labels.md) ++This procedure uses a hypothetical company domain at Contoso.com. ++#### Scenario 2 policy intent and mapping ++*We need to block emails to all recipients that have the ΓÇÿhighly confidentialΓÇÖ sensitivity label applied except if the recipient domain is contoso.com. We want to notify the user on send with a popup dialogue and no one can be allowed to override the block.* +++|Statement|Configuration question answered and configuration mapping| +||| +|"We need to block emails to all recipients..."|- **Where to monitor**: Exchange </br>- **Administrative scope**: Full directory </br>- **Action**: Restrict access or encrypt the content in Microsoft 365 locations > Block users from receiving email or accessing shared SharePoint, OneDrive, and Teams files > Block everyone | +|"...that have the 'highly confidential' sensitivity label applied..."| - **What to monitor**: use the Custom template </br> - **Conditions for a match**: edit it to add the *highly confidential* sensitivity label| +|"...except if..."| **Condition group configuration** - Create a nested boolean NOT condition group joined to the first conditions using a boolean AND| +|"...the recipient domain is contoso.com."| **Condition for match**: Recipient domain is| +|"...Notify..."|**User notifications**: enabled| +|"...the user on send with a popup dialogue..."| **Policy tips**: selected </br> - **Show policy tip as a dialog for the end user before send**: selected| +|"...and no one can be allowed to override the block...| **Allow overrides from M365 Services**: not selected| +++#### Steps to create policy for scenario 2 ++> [!IMPORTANT] +> For the purposes of this policy creation procedure, you'll accept the default include/exclude values and leave the policy turned off. You'll be changing these when you deploy the policy. ++1. Sign in to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft Purview compliance portal</a>. ++1. In the Microsoft Purview compliance portal \> left navigation \> **Solutions** \> **Data loss prevention** \> **Policies** \> **+ Create policy**. ++1. Select **Custom** from the **Categories** list. + +1. Select **Custom** from the **Templates** list. + +1. Give the policy a name. ++> [!IMPORTANT] +> Policies cannot be renamed. ++5. Fill in a description. You can use the policy intent statement here. ++1. Select **Next**. ++1. Select **Full directory** under **Admin units**. ++1. Set the **Exchange email** location status to **On**. Set all the other location status to **Off**. ++1. Select **Next**. ++1. Accept the default values for **Include** = **All** and **Exclude** = **None**. + +1. The **Create or customize advanced DLP rules** option should already be selected. + +1. Select **Next**. + +1. Select **Create rule**. Name the rule and provide a description. ++1. Select **Add condition** > **Content contains** > **Add** > **Sensitivity labels** > **Highly confidential**. Choose **Add**. + +1. Select **Add group** > **AND** > **NOT** > **Add condition**. ++1. Select **Recipient domain is** > **contoso.com**. Choose **Add**. + +1. Select **Add and action** > **Restrict access or encrypt the content in Microsoft 365 locations** > **Restrict access or encrypt the content in Microsoft 365 locations** > **Block users from receiving email or accessing shared SharePoint, OneDrive, and Teams file.** > **Block everyone**. + +1. Set **User notifications** to **On**. + +1. Select **Policy tips** > **Show the policy tip as a dialog for the end user before send**. + +1. Make sure that **Allow override from M365 services** *isn't* selected. + +1. Choose **Save**. + +1. Choose **Next** > **Keep it off** > **Next** > **Submit**. ++ ## Deployment A successful policy deployment isn't just about getting the policy into your environment to enforce controls on user actions. A haphazard, rushed deployment can negatively impact business process and annoy your users. Those consequences will slow acceptance of DLP technology in your organization and the safer behaviors it promotes. Ultimately making your sensitive items less safe in the long run. |
| compliance | Dlp Policy Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-policy-reference.md | f1.keywords: CSH Previously updated : 02/27/2023 Last updated : 03/06/2023 audience: Admin If you're new to Microsoft Purview DLP, here's a list of the core articles you'l 1. [Set goals and strategy](dlp-overview-plan-for-dlp.md#set-goals-and-strategy) 1. [Data Loss Prevention policy reference](dlp-policy-reference.md#data-loss-prevention-policy-reference) - this article that you're reading now introduces all the components of a DLP policy and how each one influences the behavior of a policy 1. [Design a DLP policy](dlp-policy-design.md) - this article walks you through creating a policy intent statement and mapping it to a specific policy configuration. -1. [Create and Deploy data loss prevention policies](dlp-create-deploy-policy.md) - This article presents some common policy intent scenarios that you'll map to configuration options, then it walks you through configuring those options. +1. [Create and Deploy data loss prevention policies](dlp-create-deploy-policy.md) - This article presents some common policy intent scenarios that you'll map to configuration options. It also walks you through configuring those options. ++Also, you need to be aware of the following constraints of the platform: ++- Maximum number of MIP + MIG policies in a tenant: 10,000 +- Maximum size of a DLP policy (100 KB) +- Maximum number of DLP rules: + - In a policy: Limited by the size of the policy + - In a tenant: 600 +- Maximum size of an individual DLP rule: 80 KB +- GIR evidence limit: 100, with each SIT evidence, in proportion of occurrence +- Text extraction limit: 1 MB +- Regex size limit for all matches predicted: 20 KB +- Policy name length limit: 64 characters +- Policy rule length limit: 64 characters +- Comment length limit: 1024 characters +- Description length limit: 1024 characters ## Policy templates DLP policies are scoped at two different levels. The first level lets an unrestr in your organization (depending on the locations that are selected) or to subgroups of your organization called [Administrative Unit restricted policies (preview)](#administrative-unit-restricted-policies-preview). -At this level an administrative unit restricted admin will only be able to pick from the administrative units that they're assigned to. +At this level, an administrative unit restricted admin will only be able to pick from the administrative units that they're assigned to. The second level of DLP policy scoping is by the [locations](#locations) that DLP supports. At this level, both unrestricted and administrative unit restricted administrators will see only the users, distribution groups, groups, and accounts that were included in the first level of policy scoping and are available in for that location. All the other rules are evaluated but their actions aren't enforced. Audit logs ### Conditions -Conditions are where you define what you want the rule to look for and context in which those items are being used. They tell the rule — when you find an item that looks like *this* and is being used like *that* — it's a match and the rest of the actions in the policy should be taken on it. You can use conditions to assign different actions to different risk levels. For example, sensitive content shared internally might be lower risk and require fewer actions than sensitive content shared with people outside the organization. +Conditions are where you define what you want the rule to look for and context in which those items are being used. They tell the ruleΓÇöwhen you find an item that looks like *this* and is being used like *thatΓÇöit's a match and the rest of the actions in the policy should be taken on it. You can use conditions to assign different actions to different risk levels. For example, sensitive content shared internally might be lower risk and require fewer actions than sensitive content shared with people outside the organization. > [!NOTE] > Users who have non-guest accounts in a host organization's Active Directory or Azure Active Directory tenant are considered as people inside the organization. The available context options change depending on which location you choose. If - Sender AD Attribute contains words or phrases - Sender AD Attribute matches patterns - Sender is a member of-- Any email attachment's content could not be scanned+- Any email attachment's content couldn't be scanned - Any email attachment's content didn't complete scanning - Attachment is password protected - File extension is The available context options change depending on which location you choose. If - Content contains - Document or attachment is password protected (.pdf, Office files, .zip, and Symantec PGP encrypted files are fully supported). This predicate detects only open protected files.-- Content is not labeled (.pdf and Office files are fully supported). This predicate detects content that doesn't have a sensitivity label applied. To help ensure only supported file types are detected, you should use this condition with the **File extension is** or **File type is** conditions.-- (preview) The user accessed a sensitive website from Edge. See, [Scenario 6 Monitor or restrict user activities on sensitive service domains (preview)](endpoint-dlp-using.md#scenario-6-monitor-or-restrict-user-activities-on-sensitive-service-domains) for more information.+- Content isn't labeled (.pdf and Office files are fully supported). This predicate detects content that doesn't have a sensitivity label applied. To help ensure only supported file types are detected, you should use this condition with the **File extension is** or **File type is** conditions. +- (preview) The user accessed a sensitive website from Microsoft Edge. See, [Scenario 6 Monitor or restrict user activities on sensitive service domains (preview)](endpoint-dlp-using.md#scenario-6-monitor-or-restrict-user-activities-on-sensitive-service-domains) for more information. - File extension is - File type is - See, [Endpoint activities you can monitor and take action on](endpoint-dlp-learn-about.md#endpoint-activities-you-can-monitor-and-take-action-on) The first group contains the SITs that identify an individual and the second gro Conditions can be grouped and joined by boolean operators (AND, OR, NOT) so that you defining a rule by stating what should be included and then define exclusions in a different group joined to the first by a NOT. To learn more about how Purview DLP implements booleans and nested groups see, [Complex rule design](dlp-policy-design.md#complex-rule-design). +#### DLP Platform Limitations for Conditions ++|Predicate | Workload | Limit | Cost of Evaluation | +|-|-|--|--| +|Content Contains | EXO/SPO/ODB | 125 SITs per rule | High | +|Content is shared from Microsoft 365 | EXO/SPO/ODB | - | High | +|Sender IP address is | EXO | Individual range length <= 128; Count <= 600 |Low| +|Has sender overridden the policy tip |EXO | - | Low | +|Sender is | EXO | Individual email length <= 256; Count <= 600| Medium | +|Sender is a member of | EXO | Count <= 600 | High | +|Sender domain is | EXO | Domain name length <= 67; Count <= 600 |Low | +|Sender address contains words | EXO |Individual word length <= 128; Count <= 600 | Low | +|Sender address matches patterns | EXO |Regex length <= 128 char; Count <= 600 | Low | +|Sender AD attribute contains words | EXO | Individual word length <= 128; Count <= 600 | Medium | +|Sender AD attribute matches patterns | EXO | Regex length <= 128 char; Count <= 600 | Medium | +|Content of email attachment(s) can't be scanned|EXO| [Supported file types](/exchange/security-and-compliance/mail-flow-rules/inspect-message-attachments#supported-file-types-for-mail-flow-rule-content-inspection) | Low | +|Incomplete scan of email attachment content | EXO | Size > 1 MB | Low | +|Attachment is password-protected | EXO | File types: Office files, ZIP, and 7z |Low| +|Attachment's file extension is |EXO/SPO/ODB | Count <= 50 | High| +|Recipient is a member of |EXO | Count <= 600 | High | +|Recipient domain is | EXO| Domain name length <= 67; Count <= 5000 | Low | +|Recipient is | EXO | Individual email length <= 256; Count <= 600 |Low | +|Recipient address contains words | EXO | Individual word length <= 128; Count <= 600 | Low | +|Recipient address matches patterns | EXO | Count <= 300 | Low| +|Document name contains words or phrases | EXO | Individual word length <= 128; Count <=600 |Low| +|Document Name matches patterns| EXO | Regex length <= 128 char; Count <= 300 |Low| +|Document property is | EXO/SPO/ODB | - | Low | +|Document size equals or is greater than | EXO | - | Low| +|Subject contains words or phrases | EXO | Individual word length <= 128; Count <= 600| Low| +|Header contains words or phrases | EXO | Individual word length <= 128; Count <= 600 |Low| +|Subject or body contains words or phrases |EXO| Individual word length <= 128; Count <= 600 |Low| +|Content character set contains words |EXO | Count <= 600 |Low| +|Header matches patterns |EXO | Regex length <= 128 char; Count <= 300 | Low| +|Subject matches patterns|EXO | Regex length <= 128 char; Count <= 300 | Low| +|Subject or body matches patterns |EXO |Regex length <= 128 char; Count <= 300 | Low| +|Message type is | EXO| - | Low| +|Message size over | EXO | - | Low| +|With importance | EXO | - | Low| +|Sender AD attribute contains words |EXO| Each attribute key value pair: has Regex length <= 128 char; Count <= 600 | Medium | +|Sender AD attribute matches patterns |EXO | Each attribute key value pair: has Regex length <= 128 char; Count <= 300 | Medium| +|Document contains words | EXO | Individual word length <= 128; Count <= 600 | Medium| +|Document matches patterns| EXO| Regex length <= 128 char; Count <= 300 | Medium| ++ <!--### Exceptions > [!IMPORTANT] Whether an action takes effect or not depends on how you configure the mode of t <!-- This section needs to explain that the actions available depend on the locations selected AND that the observed behavior of a policy is produced through an interaction of the configured actions AND the configured status (off, test, apply) of a policy. It will detail the purpose of each of the available actions and the location/desired outcome interaction and provide examples eg. how to use the Restrict Third Party apps in the context of a policy that is applied to endpoints so that users can't use a upload content to a third party site or the interaction of on-premises scanner with restrict access or remove on-premises files. Also what happens when I select multiple locations? provide abundant examples for most common scenarios--> +#### DLP Platform Limitations for Actions ++|Action Name | Workload | Limits | +|||| +|Restrict access or encrypt content in Microsoft 365| EXO/SPO/ODB | | +|Set headers | EXO | | +|Remove header | EXO | | +|Redirect the message to specific users | EXO| Total of 100 across all DLP rules. Cannot be DL/SG| +|Forward the message for approval to sender's manager | EXO | Manager should be defined in AD| +|Forward the message for approval to specific approvers |EXO | Groups aren't supported| +|Add recipient to the **To** box | EXO | Recipient count <= 10; Cannot be DL/SG| +|Add recipient to the **Cc** box | EXO | Recipient count <= 10; Cannot be DL/SG| +|Add recipient to the **Bcc** box | EXO | Recipient count <= 10; Cannot be DL/SG| +|Add the sender's manager as recipient | EXO | Manager attribute should be defined in AD| +|Apply HTML disclaimer| EXO| | +|Prepend subject| EXO| | +|Apply OME| EXO | | +|Remove OME | EXO | | + ### User notifications and policy tips <!--This section introduces the business need for user notifications, what they are, their benefit, how to use them, how to customize them, and links out to for where they are used/expected behavior--> <!--You can use notifications and overrides to educate your users about DLP policies and help them remain compliant without blocking their work. For example, if a user tries to share a document containing sensitive information, a DLP policy can both send them an email notification and show them a policy tip in the context of the document library that allows them to override the policy if they have a business justification.--> -When a user attempts an action on a sensitive item in a context that meets the conditions of a rule, you can let them know about it through user notification emails and in context policy tip popups. These notifications are useful because they increase awareness and help educate people about your organization's DLP policies. +When a user attempts an action on a sensitive item in a context that meets the conditions of a rule, you can let them know about it through user notification emails and in- context policy tip popups. These notifications are useful because they increase awareness and help educate people about your organization's DLP policies. For example, content like an Excel workbook on a OneDrive for Business site that contains personally identifiable information (PII) and is shared with a guest. You can customize the title and body of text with using these parameters. The bo Using this customized text -*%%AppliedActions%% File name %%FileName%% via %%ProcessName%% is not allowed by your organization. Select 'Allow' if you want to bypass the policy %%PolicyName%%* +*%%AppliedActions%% File name %%FileName%% via %%ProcessName%% isn't allowed by your organization. Select 'Allow' if you want to bypass the policy %%PolicyName%%* produces this text in the customized notification: -*pasting from the clipboard File Name: Contoso doc 1 via WINWORD.EXE is not allowed by your organization. Click 'Allow' button if you want to bypass the policy Contoso highly confidential* +*pasting from the clipboard File Name: Contoso doc 1 via WINWORD.EXE isn't allowed by your organization. Select the 'Allow' button if you want to bypass the policy Contoso highly confidential* > [!NOTE] > User notifications and policy tips are not available for the On-premises location |
| compliance | Information Barriers Multi Segment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/information-barriers-multi-segment.md | ms.localizationpriority: medium f1.keywords: - NOCSH Previously updated : 03/07/2023 Last updated : 03/09/2023 # Use multi-segment support in information barriers If the value of the `InformationBarrierMode` property is *Legacy*, enabling mult ## Enable multiple segment support for users -To enable multi-segment support for organizations in *SingleSegment* mode, run the following cmdlet. +To enable multiple segment support for organizations in *SingleSegment* mode, you must not have any IB segments or policies currently defined for your organization. Run the following cmdlet to enable multiple segment support in your organization: ```powershell Set-PolicyConfig -InformationBarrierMode 'MultiSegment' |
| compliance | Insider Risk Management Cases | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-cases.md | The **Case overview** tab also includes an **Alerts** section that includes the ### Alerts -The **Alerts** tab summarizes the current alerts included in the case. New alerts may be added to an existing case and they'll be added to the **Alert** queue as they're assigned. The following alert attributes are listed the queue: +The **Alerts** tab summarizes the current alerts included in the case. New alerts may be added to an existing case and they'll be added to the **Alert** queue as they're assigned. The following alert attributes are listed in the queue: - Status - Severity For more information about the Activity explorer, see the [Insider risk manageme ## Forensic evidence -The **Forensic evidence ** tab allows risk investigators to review visual captures associated with risk activities included in cases. For example, as part of the case management actions, investigators may need to help clarify the context of the user activity under review. Viewing the actual clips of the activity can help the investigator determine if the user activity is potentially risky and may lead to a security incident. +The **Forensic evidence** tab allows risk investigators to review visual captures associated with risk activities included in cases. For example, as part of the case management actions, investigators may need to help clarify the context of the user activity under review. Viewing the actual clips of the activity can help the investigator determine if the user activity is potentially risky and may lead to a security incident. For more information about forensic evidence, see the [Learn about insider risk management forensic evidence](/microsoft-365/compliance/insider-risk-management-forensic-evidence) article. |
| compliance | Insider Risk Management Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-configure.md | Recommended actions can help your organization quickly get with insider risk man The following recommendations are available to help you get started with or maximize your insider risk management configuration: - **Turn on auditing**: When turned on, user and admin activity in your organization is recorded to the Microsoft 365 audit log. Insider risk policies and analytics scans use this log to detect risk activities.-- **Get permissions to user risk management**: The level of access you have to insider risk management features depends on which role group you were assigned. To access and configure recommended actions, users must be assigned to the *Insider Risk Management* or *Insider Risk Management Admins* role groups.+- **Get permissions to use insider risk management**: The level of access you have to insider risk management features depends on which role group you were assigned. To access and configure recommended actions, users must be assigned to the *Insider Risk Management* or *Insider Risk Management Admins* role groups. - **Choose policy indicators**: Indicators are essentially the risk management activities you want to detect and investigate. You can choose indicators to track activity across several Microsoft 365 locations and services. - **Scan for potential insider risks**: Run an analytics scan to discover potential insider risks occurring in your org. After evaluating results, review recommended policies to set up. - **Assign permissions to others**: If there are additional team members who will be responsible for managing insider risk features, you'll need to assign them to the appropriate role groups. |
| compliance | Insider Risk Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management.md | f1.keywords: Previously updated : 02/08/2023 Last updated : 03/09/2023 audience: itpro - highpri In more serious situations, you may need to share the insider risk management ca - **eDiscovery (Premium)**: Escalating a case for investigation allows you to transfer data and management of the case to Microsoft Purview eDiscovery (Premium). eDiscovery (Premium) provides an end-to-end workflow to preserve, collect, review, analyze, and export content that's responsive to your organization's internal and external investigations. It allows legal teams to manage the entire legal hold notification workflow. To learn more about eDiscovery (Premium) cases, see [Overview of Microsoft Purview eDiscovery (Premium)](ediscovery-overview.md). - **Office 365 Management APIs integration (preview)**: Insider risk management supports exporting alert information to security information and event management (SIEM) services via the Office 365 Management APIs. Having access to alert information in the platform the best fits your organization's risk processes gives you more flexibility in how to act on risk activities. To learn more about exporting alert information with Office 365 Management APIs, see [Export alerts](insider-risk-management-settings.md#export-alerts). -> [!NOTE] -> Thank you for your feedback and support during the preview of the ServiceNow connector. We've decided to end the preview of ServiceNow connector and discontinue support in insider risk management on November 30, 2020. We are actively evaluating alternative methods to provide customers with ServiceNow integration in insider risk management. - ## Scenarios Insider risk management can help you detect, investigate, and take action to mitigate internal risks in your organization in several common scenarios: |
| compliance | Sensitivity Labels Aip | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-aip.md | f1.keywords: Previously updated : 03/06/2023 Last updated : 03/13/2023 audience: Admin However, you might find you don't need to use PowerShell to configure the suppor The following configurations from the AIP add-in that aren't yet supported by built-in labeling include: - [Label inheritance from email attachments](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#for-email-messages-with-attachments-apply-a-label-that-matches-the-highest-classification-of-those-attachments)+ - This option is currently rolling out in preview. For more information, see [Configure label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments) - [Oversharing popup messages for Outlook](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#implement-pop-up-messages-in-outlook-that-warn-justify-or-block-emails-being-sent) - The equivalent of this configuration is now rolling out in preview. For more information, see the [migration playbook to configure oversharing popups](https://microsoft.github.io/ComplianceCxE/playbooks/AIP2MIP/Features/Collaboration/OversharingPopups/) |
| compliance | Sensitivity Labels Meetings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-meetings.md | description: "Configure sensitivity labels to protect calendar items, and Teams >*[Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance).* > [!NOTE]-> For this scenario, Outlook calendar events remain in preview for Windows, and rolling out in general availability for macOS. +> For this scenario, Outlook calendar events are still rolling out in general availability for Windows and macOS. > > You won't be able to configure all the options referenced on this page if a [Teams Premium license](/MicrosoftTeams/enhanced-teams-experience) isn't found for your tenant. For those settings, you'll see an information bar in the Microsoft Purview compliance portal that your organization doesn't have this license. Meeting settings that you can apply with a sensitivity label - Encryption for meeting video and audio - Automatically record - Video watermark for screen sharing and camera streams-- Prevent or allow chat+- Prevent copy of meeting chat - Prevent or allow copying chat contents to the clipboard Users can apply sensitivity labels to meeting invites when they use Outlook or Teams: Example showing a Teams meeting invite that has the label **Highly confidential* To apply a sensitivity label to meeting invites and appointments using Outlook, users must use Outlook on the web from a desktop computer, or use built-in labeling from Microsoft 365 Apps for enterprise: -- **Outlook for Windows**: Rolling out to Current Channel (Preview)+- **Outlook for Windows**: Rolling out to Current Channel, version 2302+ - **Outlook for Mac**: Rolling out to version 16.70+ The AIP add-in for Outlook doesn't support applying labels to meeting invites. To apply a sensitivity label to meeting invites using Teams, enforce meeting opt - Encryption for meeting video and audio - Automatically record - Video watermark for screen sharing and camera streams- - Prevent or allow chat + - Prevent copy of meeting chat - The following meeting options won't take effect for a Meet Now meeting: - Who can record - Encryption for meeting video and audio - Automatically record - Video watermark for screen sharing and camera streams- - Prevent or allow chat + - Prevent copy of meeting chat - Sensitivity labels can't be applied to live events and webinars. |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | f1.keywords: Previously updated : 03/07/2023 Last updated : 03/13/2023 audience: Admin Be aware that this configuration affects both client apps and services, manual l - If the scope doesn't include email, you won't be able to select the encryption options of **Do Not Forward** or **Encrypt-Only**. - If the scope doesn't include files, you won't be able to select the encryption option **In Word, PowerPoint, and Excel, prompt users to specify permissions**. +- [Label inheritance from email attachments](#configure-label-inheritance-from-email-attachments): + - For this configuration, the label must be scoped to both files and emails. + In addition, if a label has been previously applied but then removed from one of the scopes, users will no longer see that label applied for the scope in the apps that support this feature. Because of the impact of scoping labels to just files or emails, some existing labeling configurations will prevent you from removing the scope options for **Files** and **Emails**: Set-Label -Identity "8faca7b8-8d20-48a3-8ea2-0f96310a848e" -AdvancedSettings @{S For more help in specifying PowerShell advanced settings, see [PowerShell tips for specifying the advanced settings](create-sensitivity-labels.md#powershell-tips-for-specifying-the-advanced-settings). +## Configure label inheritance from email attachments ++> [!NOTE] +> This capability is currently rolling out in preview for built-in labeling, and in various stages of release across the platforms. Identify the minimum versions of Outlook that support this feature by using the [capabilities table for Outlook](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-outlook), and the row **Label inheritance from email attachments**. ++Turn on email inheritance for when users attach labeled documents to an email message that isn't manually labeled. With this configuration, a sensitivity label is dynamically selected for the email message, based on the sensitivity labels that are applied to the attachments and published to the user. The [highest priority label](sensitivity-labels.md#label-priority-order-matters) is dynamically selected when it's supported by Outlook. ++Whether this label inheritance will override an existing label on the email message: ++- When an email message has been manually labeled, that label won't be replaced by label inheritance from email attachments. ++- Label inheritance from email attachments will replace a lower priority sensitivity label that is automatically applied or applied as a default label, but won't override a higher priority label. ++You configure this setting in the sensitivity label policy, on the **Default settings for emails** page. For the section **Inherit label from attachments**, select the checkbox **Email inherits highest priority label from attachments**. The attachment must be a physical file, and can't be a link to a file (for example, a link to a file on Microsoft SharePoint or OneDrive). ++When you select this checkbox, you can then further select the following option: **Recommend users apply the attachments label instead of automatically applying it.** Without this selection, the label is automatically applied but users can still remove the label or select a different label before sending the email. ++> [!NOTE] +> If you've configured the PowerShell advanced setting **AttachmentAction** for the Azure Information Protection (AIP) unified labeling client to be Automatic or Recommended, these options are automatically reflected in the compliance portal. However, the **AttachmentActionTip** advanced setting for a customized recommendation message doesn't have a corresponding entry in the compliance portal and isn't supported by built-in labeling. ++By default, if the automatically selected label applies encryption, the same encryption is applied to the email. For example, if the highest priority label applies encryption with Full Control to the Marketing group, the email will be protected with Full Control to the Marketing group. If the highest priority label applies the encryption option of Do Not Forward, the email message is also labeled and encrypted with Do Not Forward. ++However, take into consideration the outcome when an email client doesn't support a specific protection action that's been applied to an attachment: ++- For built-in labeling: + + - **Double Key Encryption**: If the highest priority label applies Double Key Encryption, no label or encryption is selected for the email message in Outlook for Windows. ++ - **Custom permissions for Word, PowerPoint, and Excel**: If the highest priority label applies just user-defined permissions for Word, PowerPoint, and Excel (the option **Let users assign permissions when they apply the label** and **In Word, PowerPoint, and Excel, prompt users to specify permissions**), no label or protection is selected for the email message because Outlook doesn't support this label configuration. ++- For the Azure Information Protection (AIP) unified labeling client: + + - **S/MIME**: If the highest priority label applies S/MIME signing and encryption, and the label is also configured for encryption from the Azure Rights Management service, that label is applied to the email message with the same S/MIME signing and encryption but also the label's configured encryption settings for the Azure Rights Management service. + + - **Double Key Encryption**: If the highest priority label applies the encryption setting for Double Key Encryption, no label or encryption is selected for the email message if the label is configured for **Let users assign permissions when they apply the label**. The label and protection is applied if the label is configured for **Assign permissions now**. ++ - **Custom permissions for Word, PowerPoint, and Excel**: If the highest priority label applies just user-defined permissions for Word, PowerPoint, and Excel (the option **Let users assign permissions when they apply the label** and **In Word, PowerPoint, and Excel, prompt users to specify permissions**), no label or protection is selected for the email message because Outlook doesn't support this label configuration. ++ - **Encrypt-Only**: If the highest priority label applies the encryption setting for Encrypt-Only, no label or protection is selected for the email message because the AIP unified labeling client doesn't support this setting. + ## PDF support For built-in labeling, use the tables in [Minimum versions for sensitivity labels in Office apps](sensitivity-labels-versions.md). The Azure Information Protection unified labeling client doesn't support PDF in Office apps. You can also create custom reports with your choice of security information and - [Automatically apply or recommend sensitivity labels to your files and emails in Office](https://support.office.com/article/automatically-apply-or-recommend-sensitivity-labels-to-your-files-and-emails-in-office-622e0d9c-f38c-470a-bcdb-9e90b24d71a1) - [Known issues with automatically applying or recommending sensitivity labels](https://support.office.com/article/known-issues-with-automatically-applying-or-recommending-sensitivity-labels-451698ae-311b-4d28-83aa-a839a66f6efc) -- [Create protected PDFs from Office files](https://support.microsoft.com/topic/aba7e367-e482-49e7-b746-a385e48d01e4)+- [Create protected PDFs from Office files](https://support.microsoft.com/topic/aba7e367-e482) |
| compliance | Sensitivity Labels Teams Groups Sites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-teams-groups-sites.md | If these containers have Azure AD classification values applied to them, the con ## Additional resources -See the webinar recording and answered questions for [Using Sensitivity labels with Microsoft Teams, O365 Groups and SharePoint Online sites](https://techcommunity.microsoft.com/t5/security-privacy-and-compliance/using-sensitivity-labels-with-microsoft-teams-o365-groups-and/ba-p/1221885#M1380). --This webinar was recorded when the feature was still in preview, so you might notice some discrepancies in the UI. However, the information for this feature is still accurate, with any new capabilities documented on this page. - For more information about managing Teams connected sites and channel sites, see [Manage Teams connected sites and channel sites](/SharePoint/teams-connected-sites). |
| compliance | Sensitivity Labels Versions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-versions.md | The numbers listed are the minimum Office application versions required for each > [!NOTE] > For Windows and the Semi-Annual Enterprise Channel, the minimum supported version numbers might not yet be released. [Learn more](/officeupdates/update-history-microsoft365-apps-by-date#supported-versions)- + |Capability |Windows |Mac |iOS |Android |Web | |--|-:|-|-|--|-| |[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)| Preview: [Current Channel (Preview)](https://office.com/insider) | Not relevant | Not relevant | Not relevant| Not relevant | The numbers listed are the minimum Office application versions required for each |[Let users assign permissions: <br /> - Prompt users for custom permissions (users and groups)](encryption-sensitivity-labels.md#let-users-assign-permissions) |Current Channel: 2004+ <br /><br> Monthly Enterprise Channel: 2004+ <br /><br> Semi-Annual Enterprise Channel: 2008+ | 16.35+ | Under review | Under review | Under review | |[Let users assign permissions: <br /> - Prompt users for custom permissions (users, groups, and organizations)](encryption-sensitivity-labels.md#support-for-organization-wide-custom-permissions) |Rolling out: 2212+ | Under review | Under review | Under review | Under review | |[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Excludes encryption details | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ | 2.46+ | 16.0.13628+ | Yes |-|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Includes encryption details | Preview: [Beta Channel](https://office.com/insider)| Preview: [Beta Channel](https://office.com/insider) | Preview: [Beta Channel](https://insider.office.com/join/ios) |Preview: [Beta Channel](https://insider.office.com/join/android) | Under review | +|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Includes encryption details | Current Channel: 2301+ | 16.70+ | 2.70+ | 16.0.16130+ | Under review | |[Require users to apply a label to their email and documents](sensitivity-labels-office-apps.md#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.45+ | 2.47+ | 16.0.13628+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Apply a sensitivity label to files automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Apply a sensitivity label to files automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | Under review | The numbers listed are the minimum Office application versions required for each |--|-:|-||-|-| |[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)| Preview: [Current Channel (Preview)](https://office.com/insider) | Not relevant | Not relevant | Not relevant| Not relevant | |Manually apply, change, or remove label <br /> - [Files and emails](https://support.microsoft.com/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes |-|Manually apply, change, or remove label <br /> - [Calendar items](sensitivity-labels-meetings.md)| Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Rolling out: 16.70+ <sup>\*</sup> | Under review | Under review | Yes | +|Manually apply, change, or remove label <br /> - [Calendar items](sensitivity-labels-meetings.md)| Current Channel: Rolling out to 2302+ | Rolling out: 16.70+ <sup>\*</sup> | Under review | Under review | Yes | |[Multi-language support](create-sensitivity-labels.md#additional-label-settings-with-security--compliance-powershell)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | |[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | |[Require a justification to change a label](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | The numbers listed are the minimum Office application versions required for each |[Let users assign permissions: <br /> - Encrypt-Only](encryption-sensitivity-labels.md#let-users-assign-permissions) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.48+ <sup>\*</sup> | 4.2112.0+ | 4.2112.0+ | Yes | |[Require users to apply a label to their email and documents](sensitivity-labels-office-apps.md#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes | |[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Excludes encryption details | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.51+ <sup>\*</sup> | 4.2126+ | 4.2126+ | Yes |-|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Includes encryption details | Preview: [Beta Channel](https://office.com/insider)| Preview: [Beta Channel](https://office.com/insider) | Preview: [Beta Channel](https://insider.office.com/join/ios) |Preview: [Beta Channel](https://insider.office.com/join/android) | Under review | +|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Includes encryption details | Current Channel: 2301+ | 16.70+ <sup>\*</sup> | 4.2309+| 4.2309+ | Under review | |[Apply a sensitivity label to emails automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ <sup>\*</sup> | Under review | Under review | Yes | |[Apply a sensitivity label to emails automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | Yes | |[Different settings for default label and mandatory labeling](sensitivity-labels-office-apps.md#outlook-specific-options-for-default-label-and-mandatory-labeling) | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes | |[PDF support](sensitivity-labels-office-apps.md#pdf-support) | Current Channel: 2205+ <br /><br> Monthly Enterprise Channel: 2205+ <br /><br> Semi-Annual Enterprise Channel: Under review| Under review | Under review | Under review | Under review | |[Apply S/MIME protection](sensitivity-labels-office-apps.md#configure-a-label-to-apply-smime-protection-in-outlook) | Current Channel: 2211+ <br /><br> Monthly Enterprise Channel: 2211+ <br /><br> Semi-Annual Enterprise Channel: 2302+ | 16.61+ <sup>\*</sup> | 4.2226+ | 4.2203+ | Under review |-|[Sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) and [display label color](sensitivity-labels-office-apps.md#label-colors) | Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review | Under review | +|[Sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) | Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review | Under review | +|[Display label color](sensitivity-labels-office-apps.md#label-colors) | Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Preview: [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review | |[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)| Current Channel: Rolling out to 2302+ | Under review | Under review | Under review | Under review | |[Scope labels to files or emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails) | Current Channel: 2301+ | Rolling out: 16.70+ <sup>\*</sup> | Rolling out 4.2309+| Rolling out 4.2309+ | Yes |+|[Preventing oversharing as DLP policy tip](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup-preview)| Preview: Rolling out to [Beta Channel](https://office.com/insider) | Under review | Under review | Under review | Under review | +|[Label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments) | Preview: Rolling out to [Beta Channel](https://office.com/insider) | Under review | Under review | Under review | Yes | **Footnotes:** |
| compliance | Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels.md | f1.keywords: Previously updated : 03/06/2023 Last updated : 03/13/2023 audience: Admin When you create a sensitivity label, you're asked to configure the label's scope This scope configuration lets you have sensitivity labels that are just for items such as documents and emails, and can't be selected for containers. Similarly, sensitivity labels that are just for containers and can't be selected for documents and emails. You can also select the scope for schematized data assets for Microsoft Purview Data Map: The **Items** scope can further be refined to [files and emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails), and to [meetings](sensitivity-labels-meetings.md) that includes calendar events, Teams meetings options, and Team chat. For example, use this refinement when you want a sensitivity label to be available for emails only. You can apply just one sensitivity label to an item such as a document, email, o The ordering of sublabels is used with [automatic labeling](apply-sensitivity-label-automatically.md), though. When you configure auto-labeling policies, multiple matches can result for more than one label. Then, the last sensitive label is selected, and then if applicable, the last sublabel. When you configure sublabels themselves (rather than auto-labeling policies) for automatic or recommended labeling, the behavior is a little different when sublabels share the same parent label. For example, a sublabel configured for automatic labeling is preferred over a sublabel configured for recommended labeling. For more information, see [How multiple conditions are evaluated when they apply to more than one label](apply-sensitivity-label-automatically.md#how-multiple-conditions-are-evaluated-when-they-apply-to-more-than-one-label). +The ordering of sublabels is also used with [label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments). +  ### Sublabels (grouping labels) |
| compliance | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md | f1.keywords: Previously updated : 03/06/2023 Last updated : 03/13/2023 audience: Admin Whether it be adding new solutions to the [Microsoft Purview compliance portal]( ### Sensitivity labels -- **General availability (GA)**: Outlook for Mac is now rolling out in general availability for [protected meetings](sensitivity-labels-meetings.md).+- **General availability (GA)**: Both Outlook for Windows and Outlook for Mac are rolling out in general availability for [protected meetings](sensitivity-labels-meetings.md). - **General availability (GA)**: Now rolling out in general availability for built-in labeling for Windows, support for a [default sublabel for a parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label) as a parity feature for the AIP add-in. - **General availability (GA)**: For labeling built into Windows, macOS, iOS, and Android, auditing actions for sensitivity labels include encryption details such as a change in the encryption status and settings, and the Rights Management owner. - **In preview**: The ability to [scope labels to files and emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails), so that for example, a sensitivity label is visible to users in Outlook but not in Word, Excel, or PowerPoint. This configuration can be used as a parity feature for the AIP add-in, which could be disabled per app.-- **In preview**: Prevent [oversharing of labeled emails as a DLP policy tip](dlp-create-deploy-policy.md). This DLP policy configuration is an equivalent for the AIP add-in with PowerShell advanced settings that implement pop-up messages in Outlook that warn, justify, or block emails being sent.+- **In preview**: Prevent [oversharing of labeled emails as a DLP policy tip](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup-preview). This DLP policy configuration is an equivalent for the AIP add-in with PowerShell advanced settings that implement pop-up messages in Outlook that warn, justify, or block emails being sent. +- **In preview**: As a parity feature for the AIP add-in, built-in labeling for Windows supports [label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments). - **Removal of restrictions for prevent copying chat for protected meetings**: The label setting that [prevents copying chat to the clipboard](sensitivity-labels-meetings.md#prevent-copying-chat-to-the-clipboard-label-setting) now supports users outside your organization and also users who join a chat but weren't invited to the meeting. ## February 2023 Whether it be adding new solutions to the [Microsoft Purview compliance portal]( - Updates for [creating a subject rights request](/privacy/priva/subject-rights-requests-create): - During the [custom setup process](/privacy/priva/subject-rights-requests-create#custom-setup-guided-process-to-choose-all-settings), it's now optional to enter the data subject's name. A new flyout pane lets you add more identifiers. - When refining your search, a new [Conditions](/privacy/priva/subject-rights-requests-create#conditions) flyout pane appears during search refinement lets users set multiple search conditions at once.-- Update to clarify that a subject rights request will automatically pause at the [data estimate stage](/privacy/priva/subject-rights-requests-data-retrieval) if over 10K items or 100 GB of data are likekly to be retrieved.+- Update to clarify that a subject rights request will automatically pause at the [data estimate stage](/privacy/priva/subject-rights-requests-data-retrieval) if over 10K items or 100 GB of data are likely to be retrieved. - Updates for [reviewing data and collaborating on subject rights requests](/privacy/priva/subject-rights-requests-data-review): - There are new filtering options when reviewing data, including keywords supporting multiple words and wildcard. - The "Plain text" view in the content review area now highlights all the data subject identifiers provided. Whether it be adding new solutions to the [Microsoft Purview compliance portal]( - For records management items undergoing disposition review, when you select that item in the Disposition area of the compliance portal, a new Progress column displays the item's status. That status can be "Approved for deletion, 'Awaiting deletion from SharePoint/OneDrive' or 'Awaiting deletion from Exchange', or "Permanently Deleted". When an item is approved for permanent deletion as part of the disposition review process, that deletion can take up to 15 days to complete and this new column helps you to track its progress. - The configuration to [enable a mailbox for archiving](enable-archive-mailboxes.md) is moving to the new Exchange admin center (EAC) and instructions have been updated accordingly. - Currently, trainable classifiers for auto-apply retention labels aren't supported with adaptive scopes. As a workaround, use static scopes for this configuration combination.-- Instructions to [Customize an archive and deletion policy for mailboxes](set-up-an-archive-and-deletion-policy-for-mailboxes.md) are updated to include only retention tags that that have an outcome that can't be achieved with Microsoft 365 retention.+- Instructions to [Customize an archive and deletion policy for mailboxes](set-up-an-archive-and-deletion-policy-for-mailboxes.md) are updated to include only retention tags that have an outcome that can't be achieved with Microsoft 365 retention. ### Data loss prevention |
| enterprise | Multi Geo Capabilities In Exchange Online | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/multi-geo-capabilities-in-exchange-online.md | Exchange Online synchronizes the **PreferredDataLocation** property from Azure A - Public folders are supported in multi-geo organizations. However, the public folders must remain in the central geo location. You can't move public folders to satellite geo locations. -- In a multi-geo environment, cross-geo mailbox auditing is not supported. For example, if a user is assigned permissions to access a shared mailbox in a different geo location, mailbox actions performed by that user are not logged in the mailbox audit log of the shared mailbox. Exchange admin audit events are also only available for the default location. For more information, see [Manage mailbox auditing](../compliance/enable-mailbox-auditing.md).+- In a multi-geo environment, cross-geo mailbox auditing is not supported. For example, if a user is assigned permissions to access a shared mailbox in a different geo location, mailbox actions performed by that user are not logged in the mailbox audit log of the shared mailbox. Exchange admin audit events are available for all locations via [Microsoft Purview](/microsoft-365/compliance/audit-solutions-overview) and the [Search-UnifiedAuditLog](/powershell/module/exchange/search-unifiedauditlog) cmdlet. For more information, see [Manage mailbox auditing](../compliance/enable-mailbox-auditing.md). |
| enterprise | Multi Geo Capabilities In Teams In Microsoft 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/multi-geo-capabilities-in-teams-in-microsoft-365.md | Teams uses the Preferred Data Location (PDL) for users and groups to determine w > [!NOTE] > Multi-Geo capabilities in Teams rolled out in July 2021. Your chat and channel messages will be automatically migrated to the correct geo location over the next few quarters. Any new PDL changes will be processed after the tenant has completed the initial sync, and new PDL changes beyond that will be queued and processed in the order they are received.+> +> Enable port 8653 to allow execution of this command. ## User chat |
| enterprise | Multi Tenant People Search | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/multi-tenant-people-search.md | f1.keywords: description: Learn about People Search in multi-tenant Microsoft 365 organizations. -# Microsoft 365 Multi-Tenant Organization People Search (private preview) +# Microsoft 365 Multi-Tenant Organization People Search (public preview) The Multi-Tenant Organization (MTO) People Search is a collaboration feature that enables search and discovery of people across multiple tenants. A tenant admin can enable cross-tenant synchronization that will allow users to be synced to another tenant and be discoverable in its global address list. Once enabled, users will be able to search and discover synced user profiles from the other tenant and view their corresponding people cards. >[!NOTE]->This Private Preview program is designed to offer select customers the opportunity to try out the multi-tenant people search feature. You can then validate the scenario and provide feedback to the product development team. The purpose of this article is to: +>This Public Preview program is designed to give customers the opportunity to try out the multi-tenant people search feature. You can then validate the scenario and provide feedback to the product development team. The purpose of this article is to: > >- Give an overview of the feature >- Define use cases that we currently support as part of the preview The Multi-Tenant Organization (MTO) People Search is a collaboration feature tha  -> _Fig 1: Azure AD sync illustration_ +> _Fig 1: Azure AD cross tenant synchronization illustration ## Example scenario Megan's user account has been synced from the _Fabrikam_ tenant to the target te > _Fig 2: User can view a limited people card_ -### In-tenant view of people card -The people card shows all the user's attributes including the profile picture when viewing a user's people card within the same tenant. +## Known limitations - +- The Microsoft Teams audio and video call buttons will direct the call to the MeganΓÇÖs Contoso tenant Teams instance and not the Teams instance target tenant (Fabrikam). +- The current experience provides limited information on the people card (basic contact information, job title and office location). +- There is no external tag to differentiate synced users and internal users. For example, if there was a megan@fabrikam and megan@Contoso there's no (External) tag to show that megan@fabrikam is a different user. -> _Fig 3: User can view extended people card within the same tenant_ +## External Member Limitations -## Known limitations +- External member isn't supported in Teams Connect shared channels. +- Converting an external guest into an external member or converting an external member into an external guest isn't currently supported by Teams. For more information, see Guest access in Microsoft Teams. +- External member isn't supported in Power BI. For more information, see Distribute Power BI content to external guest users using Azure Active Directory B2B. -- The Microsoft Teams audio and video call buttons will direct the call to the user's home tenant Teams instance (Fabrikam) and not the Teams instance target tenant (Contoso).-- The current experience provides limited information on the people card (basic contact information, job title and office location). ## Prerequisites To test the MTO People Search feature, it is assumed that you already have the following settings: - Two Azure AD/Microsoft 365 tenants-- Both tenants have the **Azure AD Cross-tenant Synchronization** feature enabled (currently in private preview - make sure you sign up for both preview features)-- Provisioned users from home to target tenants.+- Both tenants have the **Azure AD Cross-tenant Synchronization** feature enabled +- Provisioned users from home to target tenants ## Use Cases Multi-tenant organization people search is supported across a range of scenarios - Nestor can hover and/or click on Megan's profile picture/initials to view Megan's limited people card. - Nestor can share and collaborate on Office documents with Megan. -3. **Microsoft Teams (Web, desktop and mobile app)** -- - Nestor (<nestor@contoso.com>) searches for "Megan" on the Teams people picker and can view Megan's limited people card. - - Nestor searches for "Megan" on the Teams power bar and can view Megan's limited people card Team membership. --4. **Bing for Business** +3. **Bing for Business** - Nestor (<nestor@contoso.com>) searches for "Megan" on the search bar and can view Megan's limited people card (<megan@fabrikam.com>). Multi-tenant organization people search is supported across a range of scenarios - _Cross-Tenant synchronization_ is a feature that enables multi-tenant organizations to grant users access to applications in other tenants within the organization. It achieves this by synchronizing internal member users from a home tenant into a resource tenant as external B2B users. -## Contact us +## Provide feedback +Use this [form][https://aka.ms/MTOpeoplesearchpreviewfeedback] to provide feedback to the MTO people search team. https://aka.ms/MTOpeoplesearchpreviewfeedback ++## Frequently asked questions +If you have questions regarding cross tenant synchronization, see [Cross Tenants Synchronization FAQs] [/azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-overview#frequently-asked-questions] ++1. What are the license requirements for MTO people search? ++A: Cross-tenant Synchronization is a pre-requisite to Multi-tenant people search feature. The licensing requirements for cross tenant synchronization can be found here. [License requirements] [/azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-overview#license-requirements] ++2. What is the sync schedule? ++A: The cross-tenant sync interval is currently fixed to start at 40-minute intervals. Sync duration varies based on the number of in-scope users. The initial sync cycle is likely to take significantly longer than the following incremental sync cycles. ++3. How long does it take to discover a synced user in M365 people search experiences? ++A: The synced users will be available in the global address list right away. However, it make take up to a day for the user to be discoverable in people search experiences in M365 applications. ++4. What attributes are synchronized from the home to the resource tenant? ++A: Cross-tenant synchronization will sync commonly used attributes on the user object in Azure AD, including (but not limited to) displayName, userPrincipalName, and directory extension attributes. +- What attributes can't be synchronized? ++Attributes including (but not limited to) managers, photos, custom security attributes, and user attributes outside of the directory can't be synchronized by cross-tenant synchronization. +All synced attributes will be displayed on the people card if available. [For more information on attribute syncing] /azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-overview#attributes] -You can contact the Cross Tenant People Search team via email at [MTOPeopleSearchPreview@service.microsoft.com](mailto:MTOPeopleSearchPreview@service.microsoft.com). +7. Is there a limit to how many tenants we can apply this to? +A: No +8. Is there a limit on the number of user objects that can be synced? +A: No. However, it is important to note that if there are more users to be synced in a single job, it will take longer to complete. [How long will it take to provision users] [/azure/active-directory/app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user#how-long-will-it-take-to-provision-users] +9. Can I sync users as guests rather than members? +A: Yes. However, to enable M365 MTO people search and future MTO scenarios, we require you to sync users as members. Guests are intended for cross-company scenarios, whereas members are intended for tenants within the same company. |
| enterprise | O365 Data Locations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/o365-data-locations.md | description: "Determine where your Microsoft 365 customer data is stored worldwi See the following links to understand workload data location. -- Exchange Online (EXO) [Exchange Online Data Location](m365-dr-workload-exo.md#how-can-i-determine-customer-data-location)+- Exchange Online [Data Residency for Exchange Online](/microsoft-365/enterprise/m365-dr-workload-exo) - SharePoint Online (ODSP) and OneDrive for Business [Data Location](m365-dr-workload-spo.md#how-can-i-determine-customer-data-location) - Microsoft Teams [Data Location](m365-dr-workload-teams.md#how-can-i-determine-customer-data-location) - Microsoft Defender for Office (MDO P1) [Data Location](m365-dr-workload-mdo-p1.md#how-can-i-determine-customer-data-location) |
| frontline | Shifts Connector Prerequisites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/includes/shifts-connector-prerequisites.md | Previously updated : 03/31/2022 Last updated : 03/9/2023 audience: admin Before you get started, make sure you have the following prerequisites: - proxyHeader: X-MS-AuthToken - At least one team is set up in Teams.-- You added a Microsoft 365 system account as a team owner to all teams you want to map.</br> [Create this account in Microsoft 365](/microsoft-365/admin/add-users/add-users) and assign it a Microsoft 365 license. Then, add the account as a team owner to all teams that you want to map. The Shifts connector uses this account when syncing Shifts changes from Blue Yonder WFM. Therefore, we recommend that you create an account specifically for this purpose and not use your personal user account.+- You added a Microsoft 365 system account as a team owner to all teams you want to map.</br> [Create this account in Microsoft 365](/microsoft-365/admin/add-users/add-users) and assign it a Microsoft 365 license. Then, add the account as a team owner to all teams that you want to map. The Shifts connector uses this account when syncing Shifts changes from Blue Yonder WFM. Therefore, we recommend that you create an account specifically for this purpose and not use your personal user account. |
| includes | Advanced Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/advanced-management.md | + **Some features in this article require [Microsoft Syntex - SharePoint Advanced Management](/sharepoint/advanced-management)** + |
| includes | Microsoft 365 Content Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-365-content-updates.md | +## Week of March 06, 2023 +++| Published On |Topic title | Change | +|||--| +| 3/7/2023 | [Automatically apply a retention label to Microsoft 365 items](/microsoft-365/compliance/apply-retention-labels-automatically?view=o365-worldwide) | modified | +| 3/7/2023 | [Automatically apply a sensitivity label in Microsoft 365](/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) | modified | +| 3/7/2023 | [Publish and apply retention labels](/microsoft-365/compliance/create-apply-retention-labels?view=o365-worldwide) | modified | +| 3/7/2023 | [Apply encryption using sensitivity labels](/microsoft-365/compliance/encryption-sensitivity-labels?view=o365-worldwide) | modified | +| 3/7/2023 | [Use sensitivity labels to protect calendar items, Teams meetings, and chat](/microsoft-365/compliance/sensitivity-labels-meetings?view=o365-worldwide) | modified | +| 3/7/2023 | [Manage sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide) | modified | +| 3/7/2023 | [Learn about sensitivity labels](/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) | modified | +| 3/7/2023 | [Incident response with Microsoft 365 Defender](/microsoft-365/security/defender/incidents-overview?view=o365-worldwide) | modified | +| 3/7/2023 | [Investigate incidents in Microsoft 365 Defender](/microsoft-365/security/defender/investigate-incidents?view=o365-worldwide) | modified | +| 3/6/2023 | [Set up Microsoft Syntex](/microsoft-365/syntex/set-up-microsoft-syntex) | added | +| 3/6/2023 | [Pay-as-you-go services and pricing for Microsoft Syntex](/microsoft-365/syntex/syntex-pay-as-you-go-services) | added | +| 3/6/2023 | [Compare Microsoft Defender Vulnerability Management plans and capabilities](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-capabilities?view=o365-worldwide) | modified | +| 3/6/2023 | [Quarantine policies](/microsoft-365/security/office-365-security/quarantine-policies?view=o365-worldwide) | modified | +| 3/6/2023 | [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-worldwide) | modified | +| 3/6/2023 | [Set up Microsoft Syntex per-user licensing](/microsoft-365/syntex/set-up-content-understanding) | modified | +| 3/6/2023 | [Configure Microsoft Syntex for pay-as-you-go billing in Azure](/microsoft-365/syntex/syntex-azure-billing) | modified | +| 3/6/2023 | [Licensing for Microsoft Syntex](/microsoft-365/syntex/syntex-licensing) | modified | +| 3/7/2023 | [Manage tamper protection for your organization using Microsoft Intune](/microsoft-365/security/defender-endpoint/manage-tamper-protection-intune?view=o365-worldwide) | renamed | +| 3/7/2023 | [Microsoft Syntex video library](/microsoft-365/syntex/video-library) | added | +| 3/7/2023 | [Microsoft 365 admin center help # < 60 chars](/microsoft-365/admin/index?view=o365-worldwide) | modified | +| 3/7/2023 | Upgrade distribution lists to Microsoft 365 Groups in Exchange Online | removed | +| 3/7/2023 | [Get started with the Microsoft Purview Chrome Extension](/microsoft-365/compliance/dlp-chrome-get-started?view=o365-worldwide) | modified | +| 3/7/2023 | [Cross-Tenant Identity Mapping (preview)](/microsoft-365/enterprise/cross-tenant-identity-mapping?view=o365-worldwide) | modified | +| 3/7/2023 | [Windows and Office 365 deployment lab kit](/microsoft-365/enterprise/modern-desktop-deployment-and-management-lab?view=o365-worldwide) | modified | +| 3/7/2023 | [Configure Microsoft Defender for Endpoint on Android features](/microsoft-365/security/defender-endpoint/android-configure?view=o365-worldwide) | modified | +| 3/7/2023 | [What's new in Microsoft Defender for Endpoint on Android](/microsoft-365/security/defender-endpoint/android-whatsnew?view=o365-worldwide) | modified | +| 3/7/2023 | [Migrating servers from Microsoft Monitoring Agent to the unified solution](/microsoft-365/security/defender-endpoint/application-deployment-via-mecm?view=o365-worldwide) | modified | +| 3/7/2023 | [Test attack surface reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-test?view=o365-worldwide) | modified | +| 3/7/2023 | [Use attack surface reduction rules to prevent malware infection](/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-worldwide) | modified | +| 3/7/2023 | [Batch Update alert entities API](/microsoft-365/security/defender-endpoint/batch-update-alerts?view=o365-worldwide) | modified | +| 3/7/2023 | [Advanced deployment guidance for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/comprehensive-guidance-on-linux-deployment?view=o365-worldwide) | modified | +| 3/7/2023 | [Delete a file from the live response library](/microsoft-365/security/defender-endpoint/delete-library?view=o365-worldwide) | modified | +| 3/7/2023 | [Device health Microsoft Defender Antivirus health report](/microsoft-365/security/defender-endpoint/device-health-microsoft-defender-antivirus-health?view=o365-worldwide) | modified | +| 3/7/2023 | [Microsoft Defender for Endpoint evaluation lab](/microsoft-365/security/defender-endpoint/evaluation-lab?view=o365-worldwide) | modified | +| 3/7/2023 | [Frequently asked questions on tamper protection](/microsoft-365/security/defender-endpoint/faqs-tamper-protection?view=o365-worldwide) | modified | +| 3/7/2023 | [List devices by software](/microsoft-365/security/defender-endpoint/get-machines-by-software?view=o365-worldwide) | modified | +| 3/7/2023 | [Manage tamper protection using tenant attach with Configuration Manager, version 2006](/microsoft-365/security/defender-endpoint/manage-tamper-protection-configuration-manager?view=o365-worldwide) | modified | +| 3/7/2023 | [Manage tamper protection on an individual device](/microsoft-365/security/defender-endpoint/manage-tamper-protection-individual-device?view=o365-worldwide) | modified | +| 3/7/2023 | [Manage tamper protection for your organization using Microsoft 365 Defender](/microsoft-365/security/defender-endpoint/manage-tamper-protection-microsoft-365-defender?view=o365-worldwide) | modified | +| 3/7/2023 | [Protect security settings with tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide) | modified | +| 3/7/2023 | [How to subscribe to Microsoft Defender Experts for Hunting](/microsoft-365/security/defender/onboarding-defender-experts-for-hunting?view=o365-worldwide) | modified | +| 3/8/2023 | [Configure a default sensitivity label for a SharePoint document library](/microsoft-365/compliance/sensitivity-labels-sharepoint-default-label?view=o365-worldwide) | modified | +| 3/9/2023 | [Investigate devices in the Defender for Endpoint Devices list](/microsoft-365/security/defender-endpoint/investigate-machines?view=o365-worldwide) | modified | +| 3/9/2023 | [Deploy Microsoft Defender for Endpoint on Linux manually](/microsoft-365/security/defender-endpoint/linux-install-manually?view=o365-worldwide) | modified | +| 3/9/2023 | [Troubleshoot performance issues for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-support-perf?view=o365-worldwide) | modified | +| 3/9/2023 | [What's new in Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-whatsnew?view=o365-worldwide) | modified | +| 3/9/2023 | [Intune-based deployment for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-install-with-intune?view=o365-worldwide) | modified | +| 3/9/2023 | [Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-ios?view=o365-worldwide) | modified | +| 3/9/2023 | [Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-linux?view=o365-worldwide) | modified | +| 3/9/2023 | [Onboard previous versions of Windows on Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboard-downlevel?view=o365-worldwide) | modified | +| 3/9/2023 | [Take response actions on a device in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/respond-machine-alerts?view=o365-worldwide) | modified | +| 3/9/2023 | [Run the client analyzer on macOS or Linux](/microsoft-365/security/defender-endpoint/run-analyzer-macos-linux?view=o365-worldwide) | modified | +| 3/9/2023 | [Server migration scenarios for the new version of Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/server-migration?view=o365-worldwide) | modified | +| 3/9/2023 | [Supported Microsoft Defender for Endpoint capabilities by platform](/microsoft-365/security/defender-endpoint/supported-capabilities-by-platform?view=o365-worldwide) | modified | +| 3/9/2023 | [Troubleshoot onboarding issues related to Security Management for Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/troubleshoot-security-config-mgt?view=o365-worldwide) | modified | +| 3/9/2023 | [Upload files to the live response library](/microsoft-365/security/defender-endpoint/upload-library?view=o365-worldwide) | modified | +| 3/9/2023 | [Microsoft Defender for Identity sensor health and settings in Microsoft 365 Defender](/microsoft-365/security/defender-identity/sensor-health?view=o365-worldwide) | modified | +| 3/9/2023 | [Block vulnerable applications](/microsoft-365/security/defender-vulnerability-management/tvm-block-vuln-apps?view=o365-worldwide) | modified | +| 3/9/2023 | [Browser extensions assessment](/microsoft-365/security/defender-vulnerability-management/tvm-browser-extensions?view=o365-worldwide) | modified | +| 3/9/2023 | [Get relevant info about an entity with go hunt](/microsoft-365/security/defender/advanced-hunting-go-hunt?view=o365-worldwide) | modified | +| 3/9/2023 | [Use the advanced hunting query resource report](/microsoft-365/security/defender/advanced-hunting-limits?view=o365-worldwide) | modified | +| 3/9/2023 | [Choose between guided and advanced modes for hunting in Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-modes?view=o365-worldwide) | modified | +| 3/9/2023 | [Create and manage custom detection rules in Microsoft 365 Defender](/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide) | modified | +| 3/9/2023 | [Get started using Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-get-started?view=o365-worldwide) | modified | +| 3/9/2023 | [Manage data for Microsoft Whiteboard](/microsoft-365/whiteboard/manage-data-organizations?view=o365-worldwide) | modified | +| 3/8/2023 | [Overview of content processing in Microsoft Syntex](/microsoft-365/syntex/content-processing-overview) | added | +| 3/8/2023 | [Automatically retain or delete content by using retention policies](/microsoft-365/compliance/create-retention-policies?view=o365-worldwide) | modified | +| 3/8/2023 | [Identify the available PowerShell cmdlets for retention](/microsoft-365/compliance/retention-cmdlets?view=o365-worldwide) | modified | +| 3/8/2023 | [Configure Microsoft 365 retention settings to automatically retain or delete content](/microsoft-365/compliance/retention-settings?view=o365-worldwide) | modified | +| 3/8/2023 | [Learn about retention policies & labels to retain or delete](/microsoft-365/compliance/retention?view=o365-worldwide) | modified | +| 3/8/2023 | [Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](/microsoft-365/security/defender-endpoint/android-intune?view=o365-worldwide) | modified | +| 3/8/2023 | [Integration with Microsoft Defender for Cloud](/microsoft-365/security/defender-endpoint/azure-server-integration?view=o365-worldwide) | modified | +| 3/8/2023 | [Configure Microsoft Defender Antivirus on a remote desktop or virtual desktop infrastructure environment](/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 3/8/2023 | [Web content filtering](/microsoft-365/security/defender-endpoint/web-content-filtering?view=o365-worldwide) | modified | +| 3/8/2023 | [Work with query results in guided mode for hunting in Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-query-builder-results?view=o365-worldwide) | modified | +| 3/8/2023 | [Hunt for threats across devices, emails, apps, and identities with advanced hunting](/microsoft-365/security/defender/advanced-hunting-query-emails-devices?view=o365-worldwide) | modified | +| 3/8/2023 | [Learn the advanced hunting query language in Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-query-language?view=o365-worldwide) | modified | +| 3/8/2023 | [Use shared queries in Microsoft 365 Defender advanced hunting](/microsoft-365/security/defender/advanced-hunting-shared-queries?view=o365-worldwide) | modified | +| 3/8/2023 | [Take action on advanced hunting query results in Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-take-action?view=o365-worldwide) | modified | +| 3/8/2023 | [Alert grading playbooks](/microsoft-365/security/defender/alert-grading-playbooks?view=o365-worldwide) | modified | +| 3/8/2023 | [Automatic attack disruption in Microsoft 365 Defender](/microsoft-365/security/defender/automatic-attack-disruption?view=o365-worldwide) | modified | +| 3/8/2023 | [Configure automatic attack disruption capabilities in Microsoft 365 Defender](/microsoft-365/security/defender/configure-attack-disruption?view=o365-worldwide) | modified | +| 3/8/2023 | [Integrate your SIEM tools with Microsoft 365 Defender](/microsoft-365/security/defender/configure-siem-defender?view=o365-worldwide) | modified | +| 3/8/2023 | [Create custom roles with Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/create-custom-rbac-roles?view=o365-worldwide) | modified | +| 3/8/2023 | [Create and manage custom detection rules in Microsoft 365 Defender](/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide) | modified | +| 3/8/2023 | [Edit or delete roles Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/edit-delete-rbac-roles?view=o365-worldwide) | modified | +| 3/8/2023 | [Step 4. Evaluate Microsoft Defender for Endpoint overview, including reviewing the architecture](/microsoft-365/security/defender/eval-defender-endpoint-overview?view=o365-worldwide) | modified | +| 3/8/2023 | [Review architecture requirements and the technical framework for Microsoft Defender for Identity](/microsoft-365/security/defender/eval-defender-identity-architecture?view=o365-worldwide) | modified | +| 3/8/2023 | [Enable the evaluation environment for Microsoft Defender for Identity](/microsoft-365/security/defender/eval-defender-identity-enable-eval?view=o365-worldwide) | modified | +| 3/8/2023 | [Run an attack simulation in a Microsoft 365 Defender pilot environment](/microsoft-365/security/defender/eval-defender-investigate-respond-simulate-attack?view=o365-worldwide) | modified | +| 3/8/2023 | [Review architecture requirements and the structure for Microsoft Defender for Cloud Apps](/microsoft-365/security/defender/eval-defender-mcas-architecture?view=o365-worldwide) | modified | +| 3/8/2023 | [Step 5. Evaluate Microsoft Defender for Cloud Apps overview](/microsoft-365/security/defender/eval-defender-mcas-overview?view=o365-worldwide) | modified | +| 3/8/2023 | [Microsoft 365 Defender portal](/microsoft-365/security/defender/microsoft-365-defender-portal?view=o365-worldwide) | modified | +| 3/8/2023 | [Redirecting accounts from Microsoft Defender for Endpoint to Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-mde-redirection?view=o365-worldwide) | modified | +| 3/8/2023 | [Redirecting accounts from Microsoft Defender for Identity to Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-mdi-redirection?view=o365-worldwide) | modified | +| 3/8/2023 | [Assess your security posture through Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score-improvement-actions?view=o365-worldwide) | modified | +| 3/8/2023 | [Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score?view=o365-worldwide) | modified | +| 3/8/2023 | [How to subscribe to Microsoft Defender Experts for Hunting](/microsoft-365/security/defender/onboarding-defender-experts-for-hunting?view=o365-worldwide) | modified | +| 3/8/2023 | [Detecting human-operated ransomware attacks with Microsoft 365 Defender](/microsoft-365/security/defender/playbook-detecting-ransomware-m365-defender?view=o365-worldwide) | modified | +| 3/8/2023 | [Set up your Microsoft 365 Defender trial lab or pilot environment](/microsoft-365/security/defender/setup-m365deval?view=o365-worldwide) | modified | +| 3/8/2023 | [Remove yourself from the blocked senders list and address 5.7.511 Access denied errors](/microsoft-365/security/office-365-security/use-the-delist-portal-to-remove-yourself-from-the-office-365-blocked-senders-lis?view=o365-worldwide) | modified | +| 3/8/2023 | [Create a rule to move or copy a file from one document library to another in Microsoft Syntex](/microsoft-365/syntex/content-processing-create-rules) | modified | +| 3/8/2023 | [Manage data for Microsoft Whiteboard](/microsoft-365/whiteboard/manage-data-organizations?view=o365-worldwide) | modified | +| 3/8/2023 | Configure a team with security isolation by using a unique sensitivity label | removed | +| 3/10/2023 | [Create and deploy a data loss prevention policy](/microsoft-365/compliance/dlp-create-deploy-policy?view=o365-worldwide) | modified | +| 3/10/2023 | [Data Loss Prevention policy reference](/microsoft-365/compliance/dlp-policy-reference?view=o365-worldwide) | modified | +| 3/10/2023 | [DeviceInfo table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-deviceinfo-table?view=o365-worldwide) | modified | +| 3/10/2023 | [Microsoft Defender for Office 365 data retention](/microsoft-365/security/office-365-security/mdo-data-retention?view=o365-worldwide) | modified | +| 3/10/2023 | [Configure teams with protection for highly sensitive data](/microsoft-365/solutions/configure-teams-highly-sensitive-protection?view=o365-worldwide) | modified | +| 3/10/2023 | [Configure teams with protection for sensitive data](/microsoft-365/solutions/configure-teams-sensitive-protection?view=o365-worldwide) | modified | +| 3/10/2023 | [Configure Teams with three tiers of file sharing security](/microsoft-365/solutions/configure-teams-three-tiers-protection?view=o365-worldwide) | modified | +| 3/10/2023 | [Microsoft 365 productivity illustrations](/microsoft-365/solutions/productivity-illustrations?view=o365-worldwide) | modified | +| 3/9/2023 | [Frequently asked questions on tamper protection](/microsoft-365/security/defender-endpoint/faqs-tamper-protection?view=o365-worldwide) | modified | +| 3/9/2023 | [Manage tamper protection using tenant attach with Configuration Manager, version 2006](/microsoft-365/security/defender-endpoint/manage-tamper-protection-configuration-manager?view=o365-worldwide) | modified | +| 3/9/2023 | [Manage tamper protection on an individual device](/microsoft-365/security/defender-endpoint/manage-tamper-protection-individual-device?view=o365-worldwide) | modified | +| 3/9/2023 | [Manage tamper protection for your organization using Microsoft Intune](/microsoft-365/security/defender-endpoint/manage-tamper-protection-intune?view=o365-worldwide) | modified | +| 3/9/2023 | [Manage tamper protection for your organization using Microsoft 365 Defender](/microsoft-365/security/defender-endpoint/manage-tamper-protection-microsoft-365-defender?view=o365-worldwide) | modified | +| 3/9/2023 | [Protect security settings with tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide) | modified | +| 3/10/2023 | [How to secure your business data with Microsoft 365 for business](/microsoft-365/business-premium/secure-your-business-data?view=o365-worldwide) | added | +| 3/10/2023 | [Configure a team with security isolation by using a unique sensitivity label](/microsoft-365/solutions/secure-teams-security-isolation?view=o365-worldwide) | added | +| 3/10/2023 | [Increase threat protection for Microsoft 365 for business](/microsoft-365/admin/security-and-compliance/increase-threat-protection?view=o365-worldwide) | modified | +| 3/10/2023 | Metrics and activity tracking in Microsoft Bookings | removed | +| 3/10/2023 | [Keyword queries and search conditions for eDiscovery](/microsoft-365/compliance/ediscovery-keyword-queries-and-search-conditions?view=o365-worldwide) | modified | +| 3/10/2023 | [Integrate your SIEM tools with Microsoft 365 Defender](/microsoft-365/security/defender/configure-siem-defender?view=o365-worldwide) | modified | +| 3/10/2023 | [Create custom roles with Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/create-custom-rbac-roles?view=o365-worldwide) | modified | +| 3/10/2023 | [Create and manage custom detection rules in Microsoft 365 Defender](/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide) | modified | +| 3/10/2023 | [Edit or delete roles Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/edit-delete-rbac-roles?view=o365-worldwide) | modified | +| 3/10/2023 | [Step 4. Evaluate Microsoft Defender for Endpoint overview, including reviewing the architecture](/microsoft-365/security/defender/eval-defender-endpoint-overview?view=o365-worldwide) | modified | +| 3/10/2023 | [Review architecture requirements and the technical framework for Microsoft Defender for Identity](/microsoft-365/security/defender/eval-defender-identity-architecture?view=o365-worldwide) | modified | +| 3/10/2023 | [Enable the evaluation environment for Microsoft Defender for Identity](/microsoft-365/security/defender/eval-defender-identity-enable-eval?view=o365-worldwide) | modified | +| 3/10/2023 | [Run an attack simulation in a Microsoft 365 Defender pilot environment](/microsoft-365/security/defender/eval-defender-investigate-respond-simulate-attack?view=o365-worldwide) | modified | +| 3/10/2023 | [Review architecture requirements and the structure for Microsoft Defender for Cloud Apps](/microsoft-365/security/defender/eval-defender-mcas-architecture?view=o365-worldwide) | modified | +| 3/10/2023 | [Step 5. Evaluate Microsoft Defender for Cloud Apps overview](/microsoft-365/security/defender/eval-defender-mcas-overview?view=o365-worldwide) | modified | +| 3/10/2023 | [Microsoft 365 Defender portal](/microsoft-365/security/defender/microsoft-365-defender-portal?view=o365-worldwide) | modified | +| 3/10/2023 | [Redirecting accounts from Microsoft Defender for Endpoint to Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-mde-redirection?view=o365-worldwide) | modified | +| 3/10/2023 | [Redirecting accounts from Microsoft Defender for Identity to Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-mdi-redirection?view=o365-worldwide) | modified | +| 3/10/2023 | [Assess your security posture through Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score-improvement-actions?view=o365-worldwide) | modified | +| 3/10/2023 | [Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score?view=o365-worldwide) | modified | +| 3/10/2023 | [How to subscribe to Microsoft Defender Experts for Hunting](/microsoft-365/security/defender/onboarding-defender-experts-for-hunting?view=o365-worldwide) | modified | +| 3/10/2023 | [Detecting human-operated ransomware attacks with Microsoft 365 Defender](/microsoft-365/security/defender/playbook-detecting-ransomware-m365-defender?view=o365-worldwide) | modified | +| 3/10/2023 | [Set up your Microsoft 365 Defender trial lab or pilot environment](/microsoft-365/security/defender/setup-m365deval?view=o365-worldwide) | modified | +| 3/10/2023 | [Remove yourself from the blocked senders list and address 5.7.511 Access denied errors](/microsoft-365/security/office-365-security/use-the-delist-portal-to-remove-yourself-from-the-office-365-blocked-senders-lis?view=o365-worldwide) | modified | +| 3/10/2023 | [Set up secure file and document sharing and collaboration with Teams in Microsoft 365](/microsoft-365/solutions/setup-secure-collaboration-with-teams?view=o365-worldwide) | modified | +| 3/10/2023 | [Overview of the Apps page in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-apps-page-overview?view=o365-worldwide) | added | +| 3/10/2023 | [Overview of the Device health page in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-device-health-overview?view=o365-worldwide) | added | ++ ## Week of February 27, 2023 | 2/10/2023 | [Get started with exact data match based sensitive information types](/microsoft-365/compliance/sit-get-started-exact-data-match-based-sits-overview?view=o365-worldwide) | modified | | 2/10/2023 | [Export source data for exact data match based sensitive information type](/microsoft-365/compliance/sit-get-started-exact-data-match-export-data?view=o365-worldwide) | modified | | 2/10/2023 | [Configure anti-malware policies](/microsoft-365/security/office-365-security/anti-malware-policies-configure?view=o365-worldwide) | modified |---## Week of January 30, 2023 ---| Published On |Topic title | Change | -|||--| -| 2/1/2023 | [Manage sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide) | modified | -| 1/30/2023 | [Create and deploy a data loss prevention policy](/microsoft-365/compliance/dlp-create-deploy-policy?view=o365-worldwide) | added | -| 1/30/2023 | [Learn about data loss prevention](/microsoft-365/compliance/dlp-learn-about-dlp?view=o365-worldwide) | modified | -| 1/30/2023 | [Plan for data loss prevention](/microsoft-365/compliance/dlp-overview-plan-for-dlp?view=o365-worldwide) | modified | -| 1/30/2023 | [Design a Data loss prevention policy](/microsoft-365/compliance/dlp-policy-design?view=o365-worldwide) | modified | -| 1/30/2023 | [Data Loss Prevention policy reference](/microsoft-365/compliance/dlp-policy-reference?view=o365-worldwide) | modified | -| 2/1/2023 | [Map Microsoft 365 Defender role-based access control (RBAC) permissions](/microsoft-365/security/defender/compare-rbac-roles?view=o365-worldwide) | modified | -| 1/31/2023 | [Configure endpoint DLP settings](/microsoft-365/compliance/dlp-configure-endpoint-settings?view=o365-worldwide) | modified | -| 1/31/2023 | [Canada drivers license number entity definition](/microsoft-365/compliance/sit-defn-canada-drivers-license-number?view=o365-worldwide) | modified | -| 1/31/2023 | [Use network protection to help prevent macOS connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection-macos?view=o365-worldwide) | modified | -| 1/31/2023 | Create a DLP policy from a template | removed | -| 1/31/2023 | Create, test, and tune a DLP policy | removed | -| 1/31/2023 | [Get started with Endpoint data loss prevention](/microsoft-365/compliance/endpoint-dlp-getting-started?view=o365-worldwide) | modified | -| 1/31/2023 | [Using Endpoint DLP](/microsoft-365/compliance/endpoint-dlp-using?view=o365-worldwide) | modified | -| 1/31/2023 | [Training campaigns in Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-training-campaigns?view=o365-worldwide) | added | -| 1/31/2023 | [Training modules for Training campaigns in Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-training-modules?view=o365-worldwide) | added | -| 1/31/2023 | [View and edit your security settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-configure-security-settings?view=o365-worldwide) | modified | -| 1/31/2023 | [Deploy Microsoft Defender for Endpoint on Android with Microsoft Endpoint Manager](/microsoft-365/security/defender-endpoint/android-intune?view=o365-worldwide) | modified | -| 1/31/2023 | [Microsoft Defender for Endpoint Device Control Removable Storage frequently asked questions](/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control-faq?view=o365-worldwide) | modified | -| 1/31/2023 | [Protect your organization's data with device control](/microsoft-365/security/defender-endpoint/device-control-report?view=o365-worldwide) | modified | -| 1/31/2023 | [Deploy Microsoft Defender for Endpoint on iOS with Microsoft Endpoint Manager](/microsoft-365/security/defender-endpoint/ios-install?view=o365-worldwide) | modified | -| 1/31/2023 | [Troubleshoot performance issues for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-support-perf?view=o365-worldwide) | modified | -| 1/31/2023 | [Deploy Microsoft Defender for Endpoint on macOS with Microsoft Endpoint Manager](/microsoft-365/security/defender-endpoint/mac-install-with-intune?view=o365-worldwide) | modified | -| 1/31/2023 | [Set up and configure Microsoft Defender for Endpoint Plan 1](/microsoft-365/security/defender-endpoint/mde-p1-setup-configuration?view=o365-worldwide) | modified | -| 1/31/2023 | [Onboard devices and configure Microsoft Defender for Endpoint capabilities](/microsoft-365/security/defender-endpoint/onboard-configure?view=o365-worldwide) | modified | -| 1/31/2023 | [Onboard to the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/onboarding?view=o365-worldwide) | modified | -| 1/31/2023 | [Migrate to Microsoft Defender for Endpoint - Onboard](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-3?view=o365-worldwide) | modified | -| 1/31/2023 | Troubleshoot AuditD performance issues with Microsoft Defender for Endpoint on Linux | removed | -| 2/1/2023 | [Use the Virtual Appointments app in Microsoft Teams](/microsoft-365/frontline/virtual-appointments-app?view=o365-worldwide) | added | -| 2/1/2023 | [Configure endpoint DLP settings](/microsoft-365/compliance/dlp-configure-endpoint-settings?view=o365-worldwide) | modified | -| 2/1/2023 | [Use sensitivity labels to protect calendar items, Teams meetings, and chat](/microsoft-365/compliance/sensitivity-labels-meetings?view=o365-worldwide) | modified | -| 2/1/2023 | [Launch your portal using the Portal launch scheduler](/microsoft-365/enterprise/portallaunchscheduler?view=o365-worldwide) | modified | -| 2/1/2023 | [Microsoft Teams Advanced Virtual Appointments activity report](/microsoft-365/frontline/advanced-virtual-appointments-activity-report?view=o365-worldwide) | modified | -| 2/1/2023 | Virtual Appointments with Microsoft Teams and the Bookings app | removed | -| 2/1/2023 | [Manage the join experience for Teams Virtual Appointments on browsers](/microsoft-365/frontline/browser-join?view=o365-worldwide) | modified | -| 2/1/2023 | [Microsoft 365 for retail organizations](/microsoft-365/frontline/teams-for-retail-landing-page?view=o365-worldwide) | modified | -| 2/1/2023 | [Microsoft Teams Virtual Appointments usage report](/microsoft-365/frontline/virtual-appointments-usage-report?view=o365-worldwide) | modified | -| 2/1/2023 | [Virtual Appointments with Microsoft Teams](/microsoft-365/frontline/virtual-appointments?view=o365-worldwide) | modified | -| 2/1/2023 | [Use network protection to help prevent macOS connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection-macos?view=o365-worldwide) | modified | -| 2/1/2023 | [Training campaigns in Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-training-campaigns?view=o365-worldwide) | modified | -| 2/1/2023 | [Create and manage communication compliance policies](/microsoft-365/compliance/communication-compliance-policies?view=o365-worldwide) | modified | -| 2/1/2023 | [Deploy updates for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-updates?view=o365-worldwide) | modified | -| 2/1/2023 | [Investigate users in Microsoft 365 Defender](/microsoft-365/security/defender/investigate-users?view=o365-worldwide) | modified | -| 2/1/2023 | [Application Guard for Office for admins](/microsoft-365/security/office-365-security/install-app-guard?view=o365-worldwide) | modified | -| 2/1/2023 | [Create a more secure guest sharing environment](/microsoft-365/solutions/create-secure-guest-sharing-environment?view=o365-worldwide) | modified | -| 2/1/2023 | [Get all scan agents](/microsoft-365/security/defender-endpoint/get-all-scan-agents?view=o365-worldwide) | modified | -| 2/1/2023 | [Get scan definitions](/microsoft-365/security/defender-endpoint/get-all-scan-definitions?view=o365-worldwide) | modified | -| 2/1/2023 | [Authenticated scan for Windows in Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/windows-authenticated-scan?view=o365-worldwide) | modified | -| 2/1/2023 | [Deploy and manage using group policy](/microsoft-365/security/defender-endpoint/deploy-and-manage-using-group-policy?view=o365-worldwide) | modified | -| 2/1/2023 | [Run the client analyzer on macOS or Linux](/microsoft-365/security/defender-endpoint/run-analyzer-macos-linux?view=o365-worldwide) | modified | -| 2/1/2023 | [Create and manage inactive mailboxes](/microsoft-365/compliance/create-and-manage-inactive-mailboxes?view=o365-worldwide) | modified | -| 2/1/2023 | [Use a script to create an eDiscovery holds report](/microsoft-365/compliance/ediscovery-create-a-report-on-holds-in-cases?view=o365-worldwide) | modified | -| 2/1/2023 | [Add more SharePoint storage to your subscription](/microsoft-365/commerce/add-storage-space?view=o365-worldwide) | modified | -| 2/1/2023 | [Minimum versions for sensitivity labels in Microsoft 365 Apps](/microsoft-365/compliance/sensitivity-labels-versions?view=o365-worldwide) | added | -| 2/1/2023 | [Understand the Defender Experts for Hunting report in Microsoft 365 Defender](/microsoft-365/security/defender/defender-experts-report?view=o365-worldwide) | modified | -| 2/1/2023 | [Use the eDiscovery Export Tool in Microsoft Edge](/microsoft-365/compliance/ediscovery-configure-edge-to-export-search-results?view=o365-worldwide) | modified | -| 2/1/2023 | [Deploy and manage using group policy](/microsoft-365/security/defender-endpoint/deploy-and-manage-using-group-policy?view=o365-worldwide) | added | -| 2/1/2023 | [Deploy and manage using Intune](/microsoft-365/security/defender-endpoint/deploy-and-manage-using-intune?view=o365-worldwide) | added | -| 2/1/2023 | [Printer Protection frequently asked questions](/microsoft-365/security/defender-endpoint/printer-protection-frequently-asked-questions?view=o365-worldwide) | added | -| 2/1/2023 | [Printer Protection Overview](/microsoft-365/security/defender-endpoint/printer-protection-overview?view=o365-worldwide) | added | -| 2/1/2023 | [Switch to Microsoft Defender for Endpoint - Setup](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2?view=o365-worldwide) | modified | -| 2/1/2023 | [What's new in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint?view=o365-worldwide) | modified | -| 2/1/2023 | [Bookings with me](/microsoft-365/bookings/bookings-in-outlook?view=o365-worldwide) | modified | -| 2/1/2023 | [Learn about Endpoint data loss prevention](/microsoft-365/compliance/endpoint-dlp-learn-about?view=o365-worldwide) | modified | -| 2/1/2023 | [Reduce the attack surface for Microsoft Teams](/microsoft-365/security/office-365-security/step-by-step-guides/reducing-attack-surface-in-microsoft-teams?view=o365-worldwide) | modified | -| 2/1/2023 | [What happens to my data and access when my subscription ends?](/microsoft-365/commerce/subscriptions/what-if-my-subscription-expires?view=o365-worldwide) | modified | -| 2/1/2023 | [Enable attack surface reduction rules](/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide) | modified | -| 2/1/2023 | [What's new in Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-whatsnew?view=o365-worldwide) | modified | -| 2/1/2023 | [Performance analyzer for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/tune-performance-defender-antivirus?view=o365-worldwide) | modified | -| 2/1/2023 | [What's new in Microsoft Defender for Endpoint on Windows](/microsoft-365/security/defender-endpoint/windows-whatsnew?view=o365-worldwide) | modified | -| 2/1/2023 | [Exposure score in Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/tvm-exposure-score?view=o365-worldwide) | modified | -| 2/1/2023 | [Security recommendations](/microsoft-365/security/defender-vulnerability-management/tvm-security-recommendation?view=o365-worldwide) | modified | -| 2/1/2023 | [Upgrade distribution lists to Microsoft 365 Groups in Exchange Online](/microsoft-365/admin/manage/upgrade-distribution-lists?view=o365-worldwide) | modified | -| 2/1/2023 | [Create and manage insider risk management policies](/microsoft-365/compliance/insider-risk-management-policies?view=o365-worldwide) | modified | -| 2/1/2023 | [Deploy Microsoft Defender for Endpoint on Linux manually](/microsoft-365/security/defender-endpoint/linux-install-manually?view=o365-worldwide) | modified | -| 2/1/2023 | [Canada social insurance number entity definition](/microsoft-365/compliance/sit-defn-canada-social-insurance-number?view=o365-worldwide) | modified | -| 2/1/2023 | [Attack surface reduction in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-asr?view=o365-worldwide) | added | -| 2/1/2023 | [View and edit your security settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-configure-security-settings?view=o365-worldwide) | modified | -| 2/1/2023 | [Microsoft Defender for Business troubleshooting](/microsoft-365/security/defender-business/mdb-troubleshooting?view=o365-worldwide) | modified | -| 2/1/2023 | [Microsoft Defender for Endpoint (MDE) attack surface reduction (ASR) rules deployment overview](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment?view=o365-worldwide) | modified | -| 2/1/2023 | [Frequently asked questions on tamper protection](/microsoft-365/security/defender-endpoint/faqs-tamper-protection?view=o365-worldwide) | modified | -| 2/1/2023 | [Understand next-generation protection configuration settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-next-gen-configuration-settings?view=o365-worldwide) | modified | -| 2/1/2023 | [Get scan history by definition](/microsoft-365/security/defender-endpoint/get-scan-history-by-definition?view=o365-worldwide) | modified | -| 2/1/2023 | [Get scan history by session](/microsoft-365/security/defender-endpoint/get-scan-history-by-session?view=o365-worldwide) | modified | -| 2/1/2023 | [Troubleshoot Microsoft Teams EHR connector setup and configuration](/microsoft-365/frontline/ehr-connector-troubleshoot-setup-configuration?view=o365-worldwide) | added | -| 2/1/2023 | [Migrate to Microsoft Defender for Office 365 Phase 1: Prepare](/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365-prepare?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage submissions](/microsoft-365/security/office-365-security/submissions-admin?view=o365-worldwide) | modified | -| 2/2/2023 | [Performance analyzer for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/tune-performance-defender-antivirus?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Adoption Score Organizational Messages](/microsoft-365/admin/adoption/organizational-messages?view=o365-worldwide) | modified | -| 2/2/2023 | [Message center in the Microsoft 365 admin center](/microsoft-365/admin/manage/message-center?view=o365-worldwide) | modified | -| 2/2/2023 | [Configure authentication for Microsoft 365 support integration with ServiceNow](/microsoft-365/admin/manage/servicenow-authentication?view=o365-worldwide) | modified | -| 2/2/2023 | [Test and deploy Microsoft 365 Apps by partners in the Integrated apps portal](/microsoft-365/admin/manage/test-and-deploy-microsoft-365-apps?view=o365-worldwide) | modified | -| 2/2/2023 | [What's new in the Microsoft 365 admin center?](/microsoft-365/admin/whats-new-in-preview?view=o365-worldwide) | modified | -| 2/2/2023 | [Non-Azure Microsoft volume licensing invoices](/microsoft-365/commerce/licenses/volume-licensing-invoices?view=o365-worldwide) | modified | -| 2/2/2023 | [Communication compliance](/microsoft-365/compliance/communication-compliance-solution-overview?view=o365-worldwide) | modified | -| 2/2/2023 | [Collect eDiscovery diagnostic information](/microsoft-365/compliance/ediscovery-diagnostic-info?view=o365-worldwide) | modified | -| 2/2/2023 | [Migrate the Azure Information Protection (AIP) add-in to Microsoft Purview Information Protection built-in labeling for Office apps](/microsoft-365/compliance/sensitivity-labels-aip?view=o365-worldwide) | modified | -| 2/2/2023 | [OneDrive Cross-tenant OneDrive migration Step 2](/microsoft-365/enterprise/cross-tenant-onedrive-migration-step2?view=o365-worldwide) | modified | -| 2/2/2023 | [OneDrive Cross-tenant OneDrive migration Step 6](/microsoft-365/enterprise/cross-tenant-onedrive-migration-step6?view=o365-worldwide) | modified | -| 2/2/2023 | [OneDrive Cross-Tenant User Data Migration Step 7](/microsoft-365/enterprise/cross-tenant-onedrive-migration-step7?view=o365-worldwide) | modified | -| 2/2/2023 | [Cross-tenant OneDrive migration overview](/microsoft-365/enterprise/cross-tenant-onedrive-migration?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 Multi-Tenant Organization People Search](/microsoft-365/enterprise/multi-tenant-people-search?view=o365-worldwide) | modified | -| 2/2/2023 | [Block sign-in for shared mailbox accounts in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-block-signin-shared-mailboxes?view=o365-worldwide) | modified | -| 2/2/2023 | [Overview of using Microsoft 365 Lighthouse baselines to deploy standard tenant configurations](/microsoft-365/lighthouse/m365-lighthouse-deploy-standard-tenant-configurations-overview?view=o365-worldwide) | modified | -| 2/2/2023 | [Deploy a task automatically in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-deploy-task-automatically?view=o365-worldwide) | modified | -| 2/2/2023 | [Overview of deployment tasks in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-overview-deployment-task?view=o365-worldwide) | modified | -| 2/2/2023 | [Review a deployment plan in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-review-deployment-plan?view=o365-worldwide) | modified | -| 2/2/2023 | [Understand deployment statuses in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-understand-deployment-statuses?view=o365-worldwide) | modified | -| 2/2/2023 | [View task details in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-view-task-details?view=o365-worldwide) | modified | -| 2/2/2023 | [What's new in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-whats-new?view=o365-worldwide) | modified | -| 2/2/2023 | [Details of custom permissions in Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/custom-permissions-details?view=o365-worldwide) | modified | -| 2/2/2023 | [External Domain Name System records for Office 365](/microsoft-365/enterprise/external-domain-name-system-records?view=o365-worldwide) | modified | -| 2/2/2023 | [Troubleshoot issues and find answers on FAQs related to Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-troubleshoot?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 Multi-Tenant Organization People Search](/microsoft-365/enterprise/multi-tenant-people-search?view=o365-worldwide) | added | -| 2/2/2023 | [Test attack surface reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-test?view=o365-worldwide) | modified | -| 2/2/2023 | [Attack surface reduction (ASR) rules reporting](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-report?view=o365-worldwide) | modified | -| 2/2/2023 | [Advanced deployment guidance for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/comprehensive-guidance-on-linux-deployment?view=o365-worldwide) | modified | -| 2/2/2023 | [Map Microsoft 365 Defender role-based access control (RBAC) permissions](/microsoft-365/security/defender/compare-rbac-roles?view=o365-worldwide) | modified | -| 2/2/2023 | [What is Microsoft Defender Experts for XDR offering](/microsoft-365/security/defender/dex-xdr-overview?view=o365-worldwide) | modified | -| 2/2/2023 | [Import roles to Microsoft 365 Defender RBAC](/microsoft-365/security/defender/import-rbac-roles?view=o365-worldwide) | modified | -| 2/2/2023 | [How to use the Microsoft Defender Experts for XDR preview service](/microsoft-365/security/defender/start-using-mdex-xdr?view=o365-worldwide) | modified | -| 2/2/2023 | [Bookings with me](/microsoft-365/bookings/bookings-in-outlook?view=o365-worldwide) | modified | -| 2/2/2023 | [Pay for your Microsoft business subscription with a billing profile](/microsoft-365/commerce/billing-and-payments/pay-for-subscription-billing-profile?view=o365-worldwide) | modified | -| 2/2/2023 | [Payment options for your Microsoft business subscription](/microsoft-365/commerce/billing-and-payments/pay-for-your-subscription?view=o365-worldwide) | modified | -| 2/2/2023 | [Attack surface reduction rules reference](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/defender-for-office-365?view=o365-worldwide) | modified | -| 2/2/2023 | [Security Operations Guide for Defender for Office 365](/microsoft-365/security/office-365-security/mdo-sec-ops-guide?view=o365-worldwide) | modified | -| 2/2/2023 | [Protect security settings with tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide) | modified | -| 2/2/2023 | [Set up the Microsoft Defender for Endpoint on macOS policies in Jamf Pro](/microsoft-365/security/defender-endpoint/mac-jamfpro-policies?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Adoption Score - Meetings (New)](/microsoft-365/admin/adoption/meetings-new?view=o365-worldwide) | modified | -| 2/2/2023 | [Shifts connectors](/microsoft-365/frontline/shifts-connectors?view=o365-worldwide) | modified | -| 2/2/2023 | [Virtual Appointments with Microsoft Teams](/microsoft-365/frontline/virtual-appointments?view=o365-worldwide) | modified | -| 2/2/2023 | [Turn on cloud protection in Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus?view=o365-worldwide) | modified | -| 2/2/2023 | [View email security reports](/microsoft-365/security/office-365-security/reports-email-security?view=o365-worldwide) | modified | -| 2/2/2023 | [Search the audit log in the Microsoft Purview compliance portal](/microsoft-365/compliance/audit-log-search?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Purview auditing solutions](/microsoft-365/compliance/audit-solutions-overview?view=o365-worldwide) | modified | -| 2/2/2023 | [Track your Microsoft Secure Score history and meet goals](/microsoft-365/security/defender/microsoft-secure-score-history-metrics-trends?view=o365-worldwide) | modified | -| 2/2/2023 | [Assess your security posture through Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score-improvement-actions?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Secure score data storage and privacy](/microsoft-365/security/defender/secure-score-data-storage-privacy?view=o365-worldwide) | added | -| 2/2/2023 | [Advanced deployment guidance for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/comprehensive-guidance-on-linux-deployment?view=o365-worldwide) | added | -| 2/2/2023 | [Microsoft Defender for Endpoint device timeline](/microsoft-365/security/defender-endpoint/device-timeline-event-flag?view=o365-worldwide) | modified | -| 2/2/2023 | [Export information gathering assessment](/microsoft-365/security/defender-endpoint/get-assessment-information-gathering?view=o365-worldwide) | added | -| 2/2/2023 | [Deploy Microsoft Defender for Endpoint on Linux manually](/microsoft-365/security/defender-endpoint/linux-install-manually?view=o365-worldwide) | modified | -| 2/2/2023 | [Scheduling Dynamic Recurring Meetings](/microsoft-365/scheduler/scheduler-recurring-meetings?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage devices for frontline workers](/microsoft-365/frontline/flw-devices?view=o365-worldwide) | modified | -| 2/2/2023 | [Deploy a task automatically in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-deploy-task-automatically?view=o365-worldwide) | added | -| 2/2/2023 | [Deploy a task manually in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-deploy-task-manually?view=o365-worldwide) | added | -| 2/2/2023 | [Dismiss a task in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-dismiss-task?view=o365-worldwide) | modified | -| 2/2/2023 | [Overview of deployment tasks in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-overview-deployment-task?view=o365-worldwide) | added | -| 2/2/2023 | [Review a deployment plan in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-review-deployment-plan?view=o365-worldwide) | added | -| 2/2/2023 | [Understand deployment statuses in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-understand-deployment-statuses?view=o365-worldwide) | added | -| 2/2/2023 | [View task details in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-view-task-details?view=o365-worldwide) | added | -| 2/2/2023 | [App-based deployment for Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-install?view=o365-worldwide) | modified | -| 2/2/2023 | [Trainable classifiers definitions](/microsoft-365/compliance/classifier-tc-definitions?view=o365-worldwide) | modified | -| 2/2/2023 | [Configure automated investigation and response capabilities in Microsoft 365 Defender](/microsoft-365/security/defender/m365d-configure-auto-investigation-response?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage Microsoft LMS Gateway for any LMS](/microsoft-365/lti/manage-microsoft-one-lti?view=o365-worldwide) | modified | -| 2/2/2023 | [Common Microsoft Defender for Endpoint API errors](/microsoft-365/security/defender-endpoint/common-errors?view=o365-worldwide) | modified | -| 2/2/2023 | [Quarantine policies](/microsoft-365/security/office-365-security/quarantine-policies?view=o365-worldwide) | modified | -| 2/2/2023 | [Choose your scenarios for Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-choose-scenarios?view=o365-worldwide) | modified | -| 2/2/2023 | [Corporate communications with frontline workers](/microsoft-365/frontline/flw-corp-comms?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 for retail organizations](/microsoft-365/frontline/teams-for-retail-landing-page?view=o365-worldwide) | modified | -| 2/2/2023 | [Migrate from the MDE SIEM API to the Microsoft 365 Defender alerts API](/microsoft-365/security/defender-endpoint/configure-siem?view=o365-worldwide) | modified | -| 2/2/2023 | [FAQs related to Microsoft Defender Experts for XDR preview](/microsoft-365/security/defender/frequently-asked-questions?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 Defender streaming event types supported in Event Streaming API](/microsoft-365/security/defender/supported-event-types?view=o365-worldwide) | modified | -| 2/2/2023 | [Email analysis in investigations for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/email-analysis-investigations?view=o365-worldwide) | modified | -| 2/2/2023 | [Set up Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-setup-microsoft-365?view=o365-worldwide) | modified | -| 2/2/2023 | [Build and manage assessments in Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-assessments?view=o365-worldwide) | modified | -| 2/2/2023 | [Get started with Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-setup?view=o365-worldwide) | modified | -| 2/2/2023 | [Enable co-authoring for encrypted documents](/microsoft-365/compliance/sensitivity-labels-coauthoring?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 network connectivity test tool](/microsoft-365/enterprise/office-365-network-mac-perf-onboarding-tool?view=o365-worldwide) | modified | -| 2/2/2023 | [Schedule regular quick and full scans with Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/schedule-antivirus-scans?view=o365-worldwide) | modified | -| 2/2/2023 | [OneDrive Cross-Tenant User Data Migration Step 1](/microsoft-365/enterprise/cross-tenant-onedrive-migration-step1?view=o365-worldwide) | modified | -| 2/2/2023 | [OneDrive Cross-Tenant User Data Migration Step 2](/microsoft-365/enterprise/cross-tenant-onedrive-migration-step2?view=o365-worldwide) | modified | -| 2/2/2023 | [OneDrive Cross-Tenant User Data Migration Step 3](/microsoft-365/enterprise/cross-tenant-onedrive-migration-step3?view=o365-worldwide) | modified | -| 2/2/2023 | [OneDrive Cross-Tenant User Data Migration Step 4](/microsoft-365/enterprise/cross-tenant-onedrive-migration-step4?view=o365-worldwide) | modified | -| 2/2/2023 | [OneDrive Cross-Tenant User Data Migration Step 5](/microsoft-365/enterprise/cross-tenant-onedrive-migration-step5?view=o365-worldwide) | modified | -| 2/2/2023 | [OneDrive Cross-Tenant User Data Migration Step 6](/microsoft-365/enterprise/cross-tenant-onedrive-migration-step6?view=o365-worldwide) | modified | -| 2/2/2023 | [Cross-tenant OneDrive migration](/microsoft-365/enterprise/cross-tenant-onedrive-migration?view=o365-worldwide) | modified | -| 2/2/2023 | [Configure Microsoft 365 support integration with Azure AD Auth Token](/microsoft-365/admin/manage/servicenow-aad-oauth-token-v1?view=o365-worldwide) | added | -| 2/2/2023 | [Configure support integration with ServiceNow - Basic Authentication](/microsoft-365/admin/manage/servicenow-basic-authentication-v1?view=o365-worldwide) | added | -| 2/2/2023 | [Microsoft 365 support integration with ServiceNow configuration overview](/microsoft-365/admin/manage/servicenow-overview-v1?view=o365-worldwide) | added | -| 2/2/2023 | [Testing the ServiceNow configuration](/microsoft-365/admin/manage/servicenow-testing-the-configuration-v1?view=o365-worldwide) | added | -| 2/2/2023 | [Troubleshooting Microsoft 365 support integration with ServiceNow](/microsoft-365/admin/manage/servicenow-troubleshooting-v1?view=o365-worldwide) | added | -| 2/2/2023 | [Integrate Microsoft 365 with ServiceNow Virtual Agent](/microsoft-365/admin/manage/servicenow-virtual-agent-integration-v1?view=o365-worldwide) | added | -| 2/2/2023 | [Non-Azure Microsoft volume licensing invoices](/microsoft-365/commerce/licenses/volume-licensing-invoices?view=o365-worldwide) | added | -| 2/2/2023 | [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/defender-endpoint-antivirus-exclusions?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Defender for Endpoint Device Control Removable Storage frequently asked questions](/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control-faq?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Defender for Endpoint Device Control Removable Storage Access Control, removable storage media](/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control?view=o365-worldwide) | modified | -| 2/2/2023 | [Investigate Microsoft Defender for Endpoint files](/microsoft-365/security/defender-endpoint/investigate-files?view=o365-worldwide) | modified | -| 2/2/2023 | [Get started with sensitivity labels](/microsoft-365/compliance/get-started-with-sensitivity-labels?view=o365-worldwide) | modified | -| 2/2/2023 | [Enable attack surface reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-implement?view=o365-worldwide) | modified | -| 2/2/2023 | [Investigate an IP address associated with an alert](/microsoft-365/security/defender-endpoint/investigate-ip?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 Defender portal](/microsoft-365/security/defender/microsoft-365-defender-portal?view=o365-worldwide) | modified | -| 2/2/2023 | [Decryption in Microsoft Purview eDiscovery tools](/microsoft-365/compliance/ediscovery-decryption?view=o365-worldwide) | modified | -| 2/2/2023 | [Integrate your SIEM tools with Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/configure-siem?view=o365-worldwide) | modified | -| 2/2/2023 | [What's new in Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-whatsnew?view=o365-worldwide) | modified | -| 2/2/2023 | [Investigate alerts in Microsoft 365 Defender](/microsoft-365/security/defender/investigate-alerts?view=o365-worldwide) | modified | -| 2/2/2023 | [Insider risk management settings](/microsoft-365/compliance/insider-risk-management-settings?view=o365-worldwide) | modified | -| 2/2/2023 | [Service advisories for OAB size limits in Exchange Online monitoring](/microsoft-365/enterprise/microsoft-365-oab-size-limit-service-advisory?view=o365-worldwide) | added | -| 2/2/2023 | [Review events and errors using Event Viewer](/microsoft-365/security/defender-endpoint/event-error-codes?view=o365-worldwide) | modified | -| 2/2/2023 | [How to schedule scans with Microsoft Defender for Endpoint on macOS](/microsoft-365/security/defender-endpoint/mac-schedule-scan?view=o365-worldwide) | modified | -| 2/2/2023 | [What's new in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint?view=o365-worldwide) | modified | -| 2/2/2023 | [What's new in Microsoft Defender Vulnerability Management Public Preview](/microsoft-365/security/defender-vulnerability-management/whats-new-in-microsoft-defender-vulnerability-management?view=o365-worldwide) | modified | -| 2/2/2023 | [How SMTP DNS-based Authentication of Named Entities (DANE) secures email communications](/microsoft-365/compliance/how-smtp-dane-works?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-worldwide) | modified | -| 2/2/2023 | [Configure endpoint DLP settings](/microsoft-365/compliance/dlp-configure-endpoint-settings?view=o365-worldwide) | modified | -| 2/2/2023 | [Using Endpoint DLP](/microsoft-365/compliance/endpoint-dlp-using?view=o365-worldwide) | modified | -| 2/2/2023 | [Create and manage custom detection rules in Microsoft 365 Defender](/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide) | modified | -| 11/2/2022 | [Help your clients and customers use virtual appointments](/microsoft-365/frontline/virtual-appointments-toolkit?view=o365-worldwide) | modified | -| 2/2/2023 | [Service assurance in the Microsoft Purview compliance portal](/microsoft-365/compliance/service-assurance?view=o365-worldwide) | modified | -| 2/2/2023 | [Cross-tenant mailbox migration](/microsoft-365/enterprise/cross-tenant-mailbox-migration?view=o365-worldwide) | modified | -| 2/2/2023 | [Advanced Data Residency Commitments](/microsoft-365/enterprise/m365-dr-commitments?view=o365-worldwide) | modified | -| 2/2/2023 | [Use Microsoft Teams Meetings LTI with any LTI 1.3 compliant LMS](/microsoft-365/lti/integrate-with-other-lms?view=o365-worldwide) | added | -| 2/2/2023 | [Get Microsoft Defender for Business servers](/microsoft-365/security/defender-business/get-defender-business-servers?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Defender for Business](/microsoft-365/security/defender-business/index?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Defender for Business frequently asked questions](/microsoft-365/security/defender-business/mdb-faq?view=o365-worldwide) | modified | -| 2/2/2023 | [Offboard a device from Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-offboard-devices?view=o365-worldwide) | modified | -| 2/2/2023 | [Onboard devices to Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-onboard-devices?view=o365-worldwide) | modified | -| 2/2/2023 | [Device health Microsoft Defender Antivirus health report](/microsoft-365/security/defender-endpoint/device-health-microsoft-defender-antivirus-health?view=o365-worldwide) | modified | -| 2/2/2023 | [Get started with insider risk management](/microsoft-365/compliance/insider-risk-management-configure?view=o365-worldwide) | modified | -| 2/2/2023 | [Insider risk management policies](/microsoft-365/compliance/insider-risk-management-policies?view=o365-worldwide) | modified | -| 2/2/2023 | [Learn about insider risk management](/microsoft-365/compliance/insider-risk-management?view=o365-worldwide) | modified | -| 2/2/2023 | [Windows and Office 365 deployment lab kit](/microsoft-365/enterprise/modern-desktop-deployment-and-management-lab?view=o365-worldwide) | modified | -| 2/2/2023 | [Address false positives/negatives in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/defender-endpoint-false-positives-negatives?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Defender for Cloud Apps in Microsoft 365 Defender (Preview)](/microsoft-365/security/defender/microsoft-365-security-center-defender-cloud-apps?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage Folders and Rules feature in Microsoft 365 Groups](/microsoft-365/enterprise/manage-folders-and-rules-feature?view=o365-worldwide) | added | -| 2/2/2023 | [What is Microsoft 365 Defender?](/microsoft-365/security/defender/microsoft-365-defender?view=o365-worldwide) | modified | -| 2/2/2023 | [Feature update validation](/microsoft-365/test-base/feature?view=o365-worldwide) | modified | -| 2/2/2023 | [Creating and Testing Binary Files on Test Base](/microsoft-365/test-base/testapplication?view=o365-worldwide) | modified | -| 2/2/2023 | [Test your Intune application on Test Base](/microsoft-365/test-base/testintuneapplication?view=o365-worldwide) | modified | -| 2/2/2023 | [Uploading a pre-built zip package](/microsoft-365/test-base/uploadapplication?view=o365-worldwide) | modified | -| 2/2/2023 | [Onboard Windows servers to the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/configure-server-endpoints?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 alert policies](/microsoft-365/compliance/alert-policies?view=o365-worldwide) | modified | -| 2/2/2023 | [Data Loss Prevention policy reference](/microsoft-365/compliance/dlp-policy-reference?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Defender for Endpoint APIs connection to Power BI](/microsoft-365/security/defender-endpoint/api-power-bi?view=o365-worldwide) | modified | -| 2/2/2023 | [Create indicators for IPs and URLs/domains](/microsoft-365/security/defender-endpoint/indicator-ip-domain?view=o365-worldwide) | modified | -| 2/2/2023 | [Professional services supported by Microsoft 365 Defender](/microsoft-365/security/defender-endpoint/professional-services?view=o365-worldwide) | added | -| 2/2/2023 | [Technological partners of Microsoft 365 Defender](/microsoft-365/security/defender-endpoint/technological-partners?view=o365-worldwide) | added | -| 2/2/2023 | [Learn about auto-expanding archiving](/microsoft-365/compliance/autoexpanding-archiving?view=o365-worldwide) | modified | -| 2/2/2023 | [Azure service bus shared access signature entity definition (preview)](/microsoft-365/compliance/sit-defn-azure-service-bus-shared-access-signature?view=o365-worldwide) | modified | -| 2/2/2023 | [Azure Shared Access key / Web Hook token signature entity definition (preview)](/microsoft-365/compliance/sit-defn-azure-shared-access-key-web-hook-token?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 admin center Teams app usage reports](/microsoft-365/admin/activity-reports/microsoft-teams-apps-usage?view=o365-worldwide) | added | -| 2/2/2023 | [Microsoft 365 admin center mailbox usage reports](/microsoft-365/admin/activity-reports/mailbox-usage?view=o365-worldwide) | modified | -| 2/2/2023 | [Customize what happens at the end of the retention period](/microsoft-365/compliance/retention-label-flow?view=o365-worldwide) | added | -| 2/2/2023 | [Azure Active Directory setup guides](/microsoft-365/admin/misc/azure-ad-setup-guides?view=o365-worldwide) | modified | -| 2/2/2023 | [About the Microsoft Purview Compliance Manager premium assessment trial](/microsoft-365/compliance/compliance-easy-trials-compliance-manager-assessments?view=o365-worldwide) | modified | -| 2/2/2023 | [Automatically retain or delete content by using retention policies](/microsoft-365/compliance/create-retention-policies?view=o365-worldwide) | modified | -| 2/2/2023 | [Message encryption FAQ](/microsoft-365/compliance/ome-faq?view=o365-worldwide) | modified | -| 2/2/2023 | [Onboard Windows devices to Microsoft Defender for Endpoint via Group Policy](/microsoft-365/security/defender-endpoint/configure-endpoints-gp?view=o365-worldwide) | modified | -| 2/2/2023 | [Onboard Windows devices using Configuration Manager](/microsoft-365/security/defender-endpoint/configure-endpoints-sccm?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 admin center activity reports](/microsoft-365/admin/activity-reports/activity-reports?view=o365-worldwide) | modified | -| 2/2/2023 | [Top 20 most-viewed admin help articles this month # < 60 chars](/microsoft-365/admin/top-m365-admin-articles?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 admin center help # < 60 chars](/microsoft-365/admin/index?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 Business Premium resources # < 60 chars](/microsoft-365/business/index?view=o365-worldwide) | modified | -| 2/2/2023 | [Customize an archive and deletion policy (MRM) for mailboxes](/microsoft-365/compliance/set-up-an-archive-and-deletion-policy-for-mailboxes?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 for frontline workers # < 60 chars](/microsoft-365/frontline/index?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 documentation # < 60 chars](/microsoft-365/index?view=o365-worldwide) | modified | -| 2/2/2023 | [Investigate domains and URLs associated with a Microsoft Defender for Endpoint alert](/microsoft-365/security/defender-endpoint/investigate-domain?view=o365-worldwide) | modified | -| 2/2/2023 | [What's new in Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-whatsnew?view=o365-worldwide) | modified | -| 2/2/2023 | [Cross-Tenant Identity Mapping (preview)](/microsoft-365/enterprise/cross-tenant-identity-mapping?view=o365-worldwide) | added | -| 2/2/2023 | [Deploy Teams at scale for frontline workers](/microsoft-365/frontline/deploy-teams-at-scale?view=o365-worldwide) | modified | -| 2/2/2023 | [Onboard Microsoft Defender for IoT with Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/enable-microsoft-defender-for-iot-integration?view=o365-worldwide) | modified | -| 2/2/2023 | [Use network protection to help prevent connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection?view=o365-worldwide) | modified | -| 2/2/2023 | [Web protection](/microsoft-365/security/defender-endpoint/web-protection-overview?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage clients for Microsoft Whiteboard in GCC environments](/microsoft-365/whiteboard/manage-clients-gcc?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage data for Microsoft Whiteboard in GCC environments](/microsoft-365/whiteboard/manage-data-gcc?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage sharing for Microsoft Whiteboard in GCC environments](/microsoft-365/whiteboard/manage-sharing-gcc?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage access to Microsoft Whiteboard for GCC environments](/microsoft-365/whiteboard/manage-whiteboard-access-gcc?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Adoption Score](/microsoft-365/admin/adoption/adoption-score?view=o365-worldwide) | renamed | -| 2/2/2023 | [Microsoft Adoption Score - Microsoft 365 apps health](/microsoft-365/admin/adoption/apps-health?view=o365-worldwide) | renamed | -| 2/2/2023 | [Microsoft Adoption Score - Communication](/microsoft-365/admin/adoption/communication?view=o365-worldwide) | renamed | -| 2/2/2023 | [Microsoft Adoption Score - Content collaboration](/microsoft-365/admin/adoption/content-collaboration?view=o365-worldwide) | renamed | -| 2/2/2023 | [Microsoft Adoption Score - Meetings](/microsoft-365/admin/adoption/meetings?view=o365-worldwide) | renamed | -| 2/2/2023 | [Microsoft Adoption Score - Mobility](/microsoft-365/admin/adoption/mobility?view=o365-worldwide) | renamed | -| 2/2/2023 | [Microsoft Adoption Score - Privacy](/microsoft-365/admin/adoption/privacy?view=o365-worldwide) | renamed | -| 2/2/2023 | [Microsoft Adoption Score - Teamwork](/microsoft-365/admin/adoption/teamwork?view=o365-worldwide) | renamed | -| 2/2/2023 | [Troubleshoot issues on Microsoft Defender for Endpoint on Android](/microsoft-365/security/defender-endpoint/android-support-signin?view=o365-worldwide) | modified | -| 2/2/2023 | [What's new in Microsoft Defender for Endpoint on Android](/microsoft-365/security/defender-endpoint/android-whatsnew?view=o365-worldwide) | modified | -| 2/2/2023 | About the Microsoft Defender Vulnerability Management public preview trial | removed | -| 2/2/2023 | [Top 10 ways to secure your business data - Best practices for small and medium-sized businesses](/microsoft-365/admin/security-and-compliance/secure-your-business-data?view=o365-worldwide) | modified | -| 2/2/2023 | [Onboard and offboard macOS devices into Microsoft Purview solutions using Microsoft Intune](/microsoft-365/compliance/device-onboarding-offboarding-macos-intune?view=o365-worldwide) | modified | -| 2/2/2023 | [Integrate Microsoft Teams classes and meetings with Moodle](/microsoft-365/lti/teams-classes-meetings-with-moodle?view=o365-worldwide) | modified | -| 2/2/2023 | [Choose between guided and advanced modes for hunting in Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-modes?view=o365-worldwide) | added | -| 2/2/2023 | [Overview - Advanced hunting](/microsoft-365/security/defender/advanced-hunting-overview?view=o365-worldwide) | modified | -| 2/2/2023 | [Supported data types and filters in guided mode for hunting in Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-query-builder-details?view=o365-worldwide) | added | -| 2/2/2023 | [Work with query results in guided mode for hunting in Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-query-builder-results?view=o365-worldwide) | added | -| 2/2/2023 | [Build queries using guided mode in Microsoft 365 Defender advanced hunting](/microsoft-365/security/defender/advanced-hunting-query-builder?view=o365-worldwide) | added | -| 2/2/2023 | [Move users to a different subscription](/microsoft-365/commerce/subscriptions/move-users-different-subscription?view=o365-worldwide) | modified | -| 2/2/2023 | [EU debit card number entity definition](/microsoft-365/compliance/sit-defn-eu-debit-card-number?view=o365-worldwide) | modified | -| 2/2/2023 | [International banking account number (IBAN) entity definition](/microsoft-365/compliance/sit-defn-international-banking-account-number?view=o365-worldwide) | modified | -| 2/2/2023 | [Integrate Microsoft Teams meetings with Schoology LMS](/microsoft-365/lti/teams-classes-and-meetings-with-schoology?view=o365-worldwide) | added | -| 2/2/2023 | [Export assessment methods and properties per device](/microsoft-365/security/defender-endpoint/get-assessment-methods-properties?view=o365-worldwide) | modified | -| 2/2/2023 | [Learn how to mitigate the Log4Shell vulnerability in Microsoft Defender for Endpoint - Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/tvm-manage-log4shell-guidance?view=o365-worldwide) | modified | -| 2/2/2023 | [Configure your Event Hubs](/microsoft-365/security/defender/configure-event-hub?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 Group mailbox size management](/microsoft-365/admin/create-groups/group-mailbox-size-management?view=o365-worldwide) | added | -| 2/2/2023 | [Migrating servers from Microsoft Defender for Endpoint to Microsoft Defender for Cloud](/microsoft-365/security/defender-endpoint/migrating-mde-server-to-cloud?view=o365-worldwide) | modified | -| 2/2/2023 | [Guest users in the Microsoft 365 admin center](/microsoft-365/admin/add-users/about-guest-users?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage guest access in Microsoft 365 groups](/microsoft-365/admin/create-groups/manage-guest-access-in-groups?view=o365-worldwide) | modified | -| 2/2/2023 | [Use Microsoft Teams meetings with Blackboard Learn](/microsoft-365/lti/teams-meetings-with-blackboard-learn?view=o365-worldwide) | added | -| 2/2/2023 | [Manage data for Microsoft Whiteboard](/microsoft-365/whiteboard/manage-data-organizations?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage sharing for Microsoft Whiteboard in GCC High environments](/microsoft-365/whiteboard/manage-sharing-gcc-high?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage sharing for Microsoft Whiteboard](/microsoft-365/whiteboard/manage-sharing-organizations?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft 365 Business Premium overview](/microsoft-365/business-premium/index?view=o365-worldwide) | modified | -| 2/2/2023 | [Glossary of security terms for Microsoft 365 security capabilities](/microsoft-365/business-premium/m365bp-glossary?view=o365-worldwide) | modified | -| 2/2/2023 | [Use AllowSelfServicePurchase for the MSCommerce PowerShell module](/microsoft-365/commerce/subscriptions/allowselfservicepurchase-powershell?view=o365-worldwide) | modified | -| 2/2/2023 | [Configure and manage Microsoft Threat Experts capabilities](/microsoft-365/security/defender-endpoint/configure-microsoft-threat-experts?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Defender for Endpoint Device Control Device Installation](/microsoft-365/security/defender-endpoint/mde-device-control-device-installation?view=o365-worldwide) | modified | -| 2/2/2023 | [Review audit logs in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-review-audit-logs?view=o365-worldwide) | modified | -| 2/2/2023 | [What's new in Microsoft Defender Vulnerability Management Public Preview](/microsoft-365/security/defender-vulnerability-management/whats-new-in-microsoft-defender-vulnerability-management?view=o365-worldwide) | added | -| 2/2/2023 | [Upload Application Binaries](/microsoft-365/test-base/binaries?view=o365-worldwide) | modified | -| 2/2/2023 | [Functional testing on Test Base](/microsoft-365/test-base/functional?view=o365-worldwide) | modified | -| 2/2/2023 | [Memory regression analysis](/microsoft-365/test-base/memory?view=o365-worldwide) | modified | -| 2/2/2023 | [Run your test on-demand](/microsoft-365/test-base/ondemandrun?view=o365-worldwide) | added | -| 2/2/2023 | [Test Base SDK for Python](/microsoft-365/test-base/pythonsdkoverview?view=o365-worldwide) | modified | -| 2/2/2023 | [Set your test tasks](/microsoft-365/test-base/testtask?view=o365-worldwide) | modified | -| 2/2/2023 | [Preset security policies](/microsoft-365/security/office-365-security/preset-security-policies?view=o365-worldwide) | modified | -| 2/2/2023 | [Use Power Automate connectors to build Bookings workflows](/microsoft-365/bookings/power-automate-integration?view=o365-worldwide) | added | -| 2/2/2023 | [Learn about archive mailboxes for Microsoft Purview](/microsoft-365/compliance/archive-mailboxes?view=o365-worldwide) | modified | -| 2/2/2023 | [Share DLP alerts](/microsoft-365/compliance/dlp-share-alerts?view=o365-worldwide) | added | -| 2/2/2023 | [Enable auto-expanding archiving](/microsoft-365/compliance/enable-autoexpanding-archiving?view=o365-worldwide) | modified | -| 2/2/2023 | [Azure AD configuration for content encrypted by Microsoft Purview Information Protection](/microsoft-365/compliance/encryption-azure-ad-configuration?view=o365-worldwide) | added | -| 2/2/2023 | [Create exact data match sensitive information type workflow classic experience](/microsoft-365/compliance/sit-create-edm-sit-classic-ux-workflow?view=o365-worldwide) | added | -| 2/2/2023 | [Create EDM SIT sample file for the new experience](/microsoft-365/compliance/sit-create-edm-sit-unified-ux-sample-file?view=o365-worldwide) | added | -| 2/2/2023 | [Create EDM SIT using the new experience](/microsoft-365/compliance/sit-create-edm-sit-unified-ux-schema-rule-package?view=o365-worldwide) | added | -| 2/2/2023 | [Create exact data match sensitive information type workflow new experience](/microsoft-365/compliance/sit-create-edm-sit-unified-ux-workflow?view=o365-worldwide) | added | -| 2/2/2023 | [Get started with exact data match based sensitive information types](/microsoft-365/compliance/sit-get-started-exact-data-match-based-sits-overview?view=o365-worldwide) | modified | -| 2/2/2023 | [Create the schema for exact data match based sensitive information types](/microsoft-365/compliance/sit-get-started-exact-data-match-create-schema?view=o365-worldwide) | modified | -| 2/2/2023 | [Export source data for exact data match based sensitive information type](/microsoft-365/compliance/sit-get-started-exact-data-match-export-data?view=o365-worldwide) | modified | -| 2/2/2023 | [Hash and upload the sensitive information source table for exact data match sensitive information types](/microsoft-365/compliance/sit-get-started-exact-data-match-hash-upload?view=o365-worldwide) | modified | -| 2/2/2023 | [Learn about exact data match based sensitive information types](/microsoft-365/compliance/sit-learn-about-exact-data-match-based-sits?view=o365-worldwide) | modified | -| 2/2/2023 | [Suspicious password-spray-related IP address activity alert](/microsoft-365/security/defender/alert-grading-password-spray?view=o365-worldwide) | added | -| 2/2/2023 | [View and edit your security settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-configure-security-settings?view=o365-worldwide) | modified | -| 2/2/2023 | [Get help and support for Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-get-help?view=o365-worldwide) | modified | -| 2/2/2023 | [Visit the Microsoft 365 Defender portal](/microsoft-365/security/defender-business/mdb-get-started?view=o365-worldwide) | modified | -| 2/2/2023 | [Understand next-generation protection configuration settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-next-gen-configuration-settings?view=o365-worldwide) | modified | -| 2/2/2023 | [Use setup wizard in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-use-wizard?view=o365-worldwide) | modified | -| 2/2/2023 | [Set preferences for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-preferences?view=o365-worldwide) | modified | -| 2/2/2023 | [Introduction to Microsoft Whiteboard](/microsoft-365/whiteboard/index?view=o365-worldwide) | modified | -| 2/2/2023 | [Detect and Remediate Illicit Consent Grants](/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants?view=o365-worldwide) | modified | -| 2/2/2023 | [Set up and configure the Moodle LMS plugins](/microsoft-365/lti/moodle-plugin-configuration?view=o365-worldwide) | modified | -| 2/2/2023 | [Set up and configure the Moodle LMS plugins for Open LMS](/microsoft-365/lti/open-lms-plugin-configuration?view=o365-worldwide) | modified | -| 2/2/2023 | [Top 10 ways to secure your data - Best practices for small and medium-sized businesses](/microsoft-365/admin/security-and-compliance/secure-your-business-data?view=o365-worldwide) | modified | -| 2/2/2023 | [Migrating servers from Microsoft Monitoring Agent to the unified solution](/microsoft-365/security/defender-endpoint/application-deployment-via-mecm?view=o365-worldwide) | modified | -| 2/2/2023 | [Onboard devices and configure Microsoft Defender for Endpoint capabilities](/microsoft-365/security/defender-endpoint/onboard-configure?view=o365-worldwide) | modified | -| 2/2/2023 | [Supported Microsoft Defender for Endpoint capabilities by platform](/microsoft-365/security/defender-endpoint/supported-capabilities-by-platform?view=o365-worldwide) | added | -| 2/2/2023 | [Configure Microsoft Defender for Endpoint on iOS features](/microsoft-365/security/defender-endpoint/ios-configure-features?view=o365-worldwide) | modified | -| 2/2/2023 | [What's new in Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-whatsnew?view=o365-worldwide) | modified | -| 2/2/2023 | [Microsoft Defender Offline in Windows](/microsoft-365/security/defender-endpoint/microsoft-defender-offline?view=o365-worldwide) | modified | -| 2/2/2023 | [Go to the Action center to view and approve your automated investigation and remediation tasks](/microsoft-365/security/defender/m365d-action-center?view=o365-worldwide) | modified | -| 2/2/2023 | [Automated investigation and response in Microsoft 365 Defender](/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) | modified | -| 2/2/2023 | [Apply encryption using sensitivity labels](/microsoft-365/compliance/encryption-sensitivity-labels?view=o365-worldwide) | modified | -| 2/2/2023 | [Onboard devices without Internet access to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboard-offline-machines?view=o365-worldwide) | modified | -| 2/2/2023 | [Configure Microsoft 365 user account properties with PowerShell](/microsoft-365/enterprise/configure-user-account-properties-with-microsoft-365-powershell?view=o365-worldwide) | modified | -| 2/2/2023 | [Configure and validate exclusions based on extension, name, or location](/microsoft-365/security/defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus?view=o365-worldwide) | modified | -| 2/2/2023 | [Data Residency for Other Microsoft 365 Services](/microsoft-365/enterprise/m365-dr-workload-other?view=o365-worldwide) | modified | -| 2/2/2023 | [Manage Office Scripts settings](/microsoft-365/admin/manage/manage-office-scripts-settings?view=o365-worldwide) | modified | -| 2/2/2023 | [Create and publish sensitivity labels](/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) | modified | -| 2/2/2023 | [Delete items in the Recoverable Items folder of cloud-based mailboxes on hold - Admin Help](/microsoft-365/compliance/delete-items-in-the-recoverable-items-folder-of-mailboxes-on-hold?view=o365-worldwide) | modified | -| 2/2/2023 | [Sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide) | modified | -| 2/2/2023 | [Overview of sensitivity labels](/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) | modified | -| 2/2/2023 | [Enable sensitivity labels for Office files in SharePoint and OneDrive](/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files?view=o365-worldwide) | modified | -| 2/2/2023 | [Test and deploy Microsoft 365 Apps](/microsoft-365/admin/manage/test-and-deploy-microsoft-365-apps?view=o365-worldwide) | modified | -| 2/2/2023 | [Data loss prevention and Microsoft Teams](/microsoft-365/compliance/dlp-microsoft-teams?view=o365-worldwide) | modified | -| 2/2/2023 | [Alert policies in the security and compliance centers](/microsoft-365/compliance/alert-policies?view=o365-worldwide) | modified | -| 2/3/2023 | [Microsoft Teams Virtual Appointments Call Quality Dashboard](/microsoft-365/frontline/virtual-appointments-call-quality?view=o365-worldwide) | added | -| 2/3/2023 | [Configure alert notifications in Microsoft 365 Defender](/microsoft-365/security/defender/configure-email-notifications?view=o365-worldwide) | renamed | -| 2/3/2023 | [Microsoft Teams Virtual Appointments usage report](/microsoft-365/frontline/virtual-appointments-usage-report?view=o365-worldwide) | modified | -| 2/3/2023 | [Microsoft 365 Lighthouse frequently asked questions (FAQs)](/microsoft-365/lighthouse/m365-lighthouse-faq?view=o365-worldwide) | modified | -| 2/3/2023 | [Advanced deployment guides for Microsoft 365 and Office 365 services](/microsoft-365/enterprise/setup-guides-for-microsoft-365?view=o365-worldwide) | modified | -| 2/3/2023 | Data Loss Prevention Reference | removed | -| 2/3/2023 | [Data loss prevention and Microsoft Teams](/microsoft-365/compliance/dlp-microsoft-teams?view=o365-worldwide) | modified | -| 2/3/2023 | [Get started with the Microsoft Service Trust Portal](/microsoft-365/compliance/get-started-with-service-trust-portal?view=o365-worldwide) | modified | -| 2/3/2023 | [Set up the Microsoft Defender for Endpoint on macOS policies in Jamf Pro](/microsoft-365/security/defender-endpoint/mac-jamfpro-policies?view=o365-worldwide) | modified | |
| lighthouse | M365 Lighthouse Apps Page Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-apps-page-overview.md | + + Title: "Overview of the Apps page in Microsoft 365 Lighthouse" +f1.keywords: NOCSH ++++ Last updated : 03/10/2023+audience: Admin +++ms.localizationpriority: medium ++- Tier1 +- scotvorg +- M365-subscription-management +- Adm_O365 ++- AdminSurgePortfolib +- M365-Lighthouse +search.appverid: MET150 +description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn how to view application performance insights." +++# Overview of the Apps page in Microsoft 365 Lighthouse ++Microsoft 365 Lighthouse brings the features of Microsoft Endpoint Analytics for applications into a simplified management view. The Apps page provides insight into potential issues for desktop applications on managed devices. You can quickly identify the top applications impacting end-user productivity along with app failure metrics for these applications. ++The data only reflects fully managed Windows devices. Data on Bring Your Own Devices is not supported. ++## Requirements ++Devices must be enrolled in Microsoft Intune. For more information on enrollment, see [What is Endpoint analytics?](/mem/analytics/overview) Once a device is enrolled, the Apps page will automatically populate with data. It may take up to 48 hours to see updates. ++> [!NOTE] +> If data doesnΓÇÖt show up for a specific application, verify that the policy is enabled. From the tenantΓÇÖs deployment plan, under **Set up device enrollment**, verify that **Device health monitoring policy** is compliant. If not compliant, deploy the policy. +++## App performance tab ++The Apps performance tab provides application insight from the past 14 days. For each application, Lighthouse provides the following information, ++- **Name**: The app identifier in the file manifest provided by your client devices. The app name is typically in executable (or .exe) format. ++- **Publisher**: The publisher of the executable reported in the file manifest. ++- **Total** **Active devices (14 days)**: The total number of enrolled devices that have launched this app at least once in the past 14 days. ++- **Total crashes (14 days):** The total number of application crash events reported across all enrolled devices over the past 14 days. ++- **Total app hangs:** The total number of application hangs reported across all enrolled devices over the past 14 days. ++Select an application from the list for more detailed application information, including which devices are having issues. A shortcut is provided to view the device in Microsoft Endpoint Manager, where you can see more insights and recommendations. ++The App performance tab also includes the following options: ++- **Export**: Select to export app performance data to an Excel comma-separated values (.csv) file. ++- **Search**: Enter keywords to quickly locate a specific name or publisher in the list. ++++## Related content +[What is Endpoint analytics?](/mem/analytics/overview) (article)\ +[Application reliability in endpoint analytics](/mem/analytics/app-reliability) (article) |
| lighthouse | M365 Lighthouse Device Health Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-device-health-overview.md | + + Title: "Overview of the Device health page in Microsoft 365 Lighthouse" +f1.keywords: NOCSH ++++ Last updated : 03/10/2023+audience: Admin +++ms.localizationpriority: medium ++- Tier1 +- scotvorg +- M365-subscription-management +- Adm_O365 ++- AdminSurgePortfolib +- M365-Lighthouse +search.appverid: MET150 +description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn how to view device health insights." +++# Overview of the Device health page in Microsoft 365 Lighthouse ++Microsoft 365 Lighthouse brings the features of Microsoft Endpoint Analytics for devices into a simplified multi-tenant management view. Performance issues and other problems can go undetected by a tenant for an extended period, impacting end-user experience and increasing support costs. The Device health page brings these problems to the surface faster and across multiple tenants to save time and end-user pain by allowing you to gain insights and remedy problems. ++The Device health page provides a subset of device analytics offered through Endpoint Analytics, specifically device performance and startup processes. Example data includes device health status, total restarts, total blue screens, top processes, and hardware specifications. The data only reflects fully managed Windows devices. Data on Bring Your Own Devices is not supported. ++## Requirements ++Devices must be enrolled in Microsoft Intune. For more information on enrollment, see [What is Endpoint analytics?](/mem/analytics/overview) Once a device is enrolled, the Device health page will automatically populate with data. It may take up to 48 hours to see updates. +++> [!NOTE] +> If data doesnΓÇÖt show up for a specific tenant, verify that the policy is enabled. From the tenantΓÇÖs deployment plan, under **Set up device enrollment**, verify that **Device health monitoring policy** is compliant. If not compliant, deploy the policy. ++## Overview tab ++The Overview tab provides a multi-tenant view of device health, including the total number of restarts and blue screens. Select a tenant from the list to see device-specific details. ++The Overview tab also includes the following options: ++- **Tenant filter:** Filter by tenant or tag. ++- **Date filter:** Filter by date range. ++- **Export**: Select to export device data to an Excel comma-separated values (.csv) file. +++## Devices tab ++The Device tab provides device health insights for all managed Windows devices, including, ++- Health status (Needs attention, Meeting goals, Insufficient data) ++- Start up performance score ΓÇô To learn more, see [Scores, baselines, and insights in Endpoint Analytics](/mem/analytics/scores). ++- Total restarts ++- Total blue screens ++- Startup processes ++- Hardware model, manufacturer, OS version, and disk type ++Select a device from the list for more detailed device information, including a comprehensive list of startup processes on that device. A shortcut is provided to view the device in Microsoft Endpoint Manager, where you can see more insights and recommendations. ++The Devices tab also includes the following options: ++- **Tenant filter:** Filter by tenant or tag. ++- **Date filter:** Filter by date range. ++- **Export**: Select to export device data to an Excel comma-separated values (.csv) file. ++- **Search**: Enter keywords to quickly locate a specific device in the list. ++- **Choose Columns**: Select which columns to show. ++++## Related content +[What is Endpoint analytics?](/mem/analytics/overview) (article)\ +[Scores, baselines, and insights in Endpoint Analytics](/mem/analytics/scores) (article) |
| lti | Teams Classes With Blackboard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lti/teams-classes-with-blackboard.md | This process can be done either before or after you have configured the LTI appl If you choose to approve the Blackboard Learn Ultra Teams Classes Azure app before configuring the LTI integrations, you'll need to redirect to the **Microsoft Identity Platform Admin Consent Endpoint**. The URL is shown: -`https://login.microsoftonline.com/{tenant}/adminconsent?client\_id=2d94989f-457a-47c1-a637-e75acdb11568` +`https://login.microsoftonline.com/{tenant}/adminconsent?client_id=2d94989f-457a-47c1-a637-e75acdb11568` > [!NOTE] > YouΓÇÖll replace **{Tenant}** with your specific institutional Microsoft Azure tenant ID. You'll see a permissions window that explains you're giving permission to Blackb - If consent hasnΓÇÖt been approved, follow the steps described to generate the URL for consent and send it to the Microsoft 365 Global Admin for approval. 5. Once you've confirmation of approval, select **Retry** to confirm, and then select **Submit**.+ |
| security | Command Line Arguments Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/command-line-arguments-microsoft-defender-antivirus.md | In our example, the MpCmdRun utility starts a full antivirus scan on the device. |Command|Description| ||| |`-?` **or** `-h`|Displays all available options for the MpCmdRun tool|-|`-Scan [-ScanType [<value>]] [-File <path> [-DisableRemediation] [-BootSectorScan] [-CpuThrottling]] [-Timeout <days>] [-Cancel]`|Scans for malicious software. Values for **ScanType** are:<p>**0** Default, according to your configuration<p>**1** Quick scan<p>**2** Full scan<p>**3** File and directory custom scan.<p>CpuThrottling runs according to policy configurations| +|`-Scan [-ScanType [<value>]] [-File <path> [-DisableRemediation] [-BootSectorScan] [-CpuThrottling]] [-Timeout <days>] [-Cancel]`|Scans for malicious software. Values for **ScanType** are:<p>**0** Default, according to your configuration<p>**1** Quick scan<p>**2** Full scan<p>**3** File and directory custom scan.<p>CpuThrottling runs according to policy configurations.| |`-Trace [-Grouping #] [-Level #]`|Starts diagnostic tracing|-|`-GetFiles [-SupportLogLocation <path>]`|Collects support information. See '[collecting diagnostic data](collect-diagnostic-data.md)'| -|`-GetFilesDiagTrack`|Same as `-GetFiles`, but outputs to temporary DiagTrack folder| -|`-RemoveDefinitions [-All]`|Restores the installed Security intelligence to a previous backup copy or to the original default set| -|`-RemoveDefinitions [-DynamicSignatures]`|Removes only the dynamically downloaded Security intelligence| -|`-RemoveDefinitions [-Engine]`|Restores the previous installed engine| -|`-SignatureUpdate [-UNC \|-MMPC]`|Checks for new Security intelligence updates| -|`-Restore [-ListAll \|[[-Name <name>] [-All] \|[-FilePath <filePath>]] [-Path <path>]]`|Restores or lists quarantined item(s)| -|`-AddDynamicSignature [-Path]`|Loads dynamic Security intelligence| -|`-ListAllDynamicSignatures`|Lists the loaded dynamic Security intelligence| -|`-RemoveDynamicSignature [-SignatureSetID]`|Removes dynamic Security intelligence| -|`-CheckExclusion -path <path>`|Checks whether a path is excluded| +|`-CaptureNetworkTrace -Path <path>`|Captures all the network input into the Network Protection service and saves it to a file at `<path>`. <br/>Supply an empty path to stop tracing.| +|`-GetFiles [-SupportLogLocation <path>]`|Collects support information. See [collecting diagnostic data](collect-diagnostic-data.md).| +|`-GetFilesDiagTrack`|Same as `-GetFiles`, but outputs to temporary DiagTrack folder.| +|`-RemoveDefinitions [-All]`|Restores the installed security intelligence to a previous backup copy or to the original default set.| +|`-RemoveDefinitions [-DynamicSignatures]`|Removes only the dynamically downloaded security intelligence.| +|`-RemoveDefinitions [-Engine]`|Restores the previous installed engine.| +|`-SignatureUpdate [-UNC \|-MMPC]`|Checks for new security intelligence updates.| +|`-Restore [-ListAll \|[[-Name <name>] [-All] \|[-FilePath <filePath>]] [-Path <path>]]`|Restores or lists quarantined item(s).| +|`-AddDynamicSignature [-Path]`|Loads dynamic security intelligence.| +|`-ListAllDynamicSignatures`|Lists the loaded dynamic security intelligence.| +|`-RemoveDynamicSignature [-SignatureSetID]`|Removes dynamic security intelligence.| +|`-CheckExclusion -path <path>`|Checks whether a path is excluded.| |`-ValidateMapsConnection`|Verifies that your network can communicate with the Microsoft Defender Antivirus cloud service. This command will only work on Windows 10, version 1703 or higher.|+|`-ResetPlatform`| Revert platform binaries back to the previous installed version of the Defender platform.| +|`-RevertPlatform`|reset platform binaries back to `%ProgramFiles%\Windows Defender`.| ## Common errors in running commands via mpcmdrun.exe The following table lists common errors that can occur while using the MpCmdRun |Error message|Possible reason| |||-|**ValidateMapsConnection failed (800106BA)** or **0x800106BA**|The Microsoft Defender Antivirus service is disabled. Enable the service and try again. If you need help re-enabling Microsoft Defender Antivirus, see [Reinstall/enable Microsoft Defender Antivirus on your endpoints](switch-to-mde-phase-2.md#step-1-reinstallenable-microsoft-defender-antivirus-on-your-endpoints).<p> **TIP**: In Windows 10 1909 or older, and Windows Server 2019 or older, the service was formerly called *Windows Defender Antivirus*.| +|**ValidateMapsConnection failed (800106BA)** or **0x800106BA**|The Microsoft Defender Antivirus service is disabled. Enable the service and try again. If you need help re-enabling Microsoft Defender Antivirus, see [Reinstall/enable Microsoft Defender Antivirus on your endpoints](switch-to-mde-phase-2.md#step-1-reinstallenable-microsoft-defender-antivirus-on-your-endpoints).<p> Note that in Windows 10 1909 or older, and Windows Server 2019 or older, the service was formerly called *Windows Defender Antivirus*.| |**0x80070667**|You're running the `-ValidateMapsConnection` command from a computer that is Windows 10 version 1607 or older, or Windows Server 2016 or older. Run the command from a machine that is Windows 10 version 1703 or newer, or Windows Server 2019 or newer.| |**MpCmdRun is not recognized as an internal or external command, operable program, or batch file.**|The tool must be run from either `%ProgramFiles%\Windows Defender` or `C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2012.4-0` (where `2012.4-0` might differ since platform updates are monthly except for March)| |**ValidateMapsConnection failed to establish a connection to MAPS (hr=80070005 httpcode=450)**|The command was attempted using insufficient privileges. Use the command prompt (cmd.exe) as an administrator.| The following table lists common errors that can occur while using the MpCmdRun |**ValidateMapsConnection failed to establish a connection to MAPS (hr=800722F0D**|The firewall is blocking the connection or conducting SSL inspection.| |**ValidateMapsConnection failed to establish a connection to MAPS (hr=80072EE7 httpcode=451)**|The firewall is blocking the connection or conducting SSL inspection.| -> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) - ## See also - [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md) - [Configure Microsoft Defender Antivirus features](configure-microsoft-defender-antivirus-features.md) - [Configure and validate Microsoft Defender Antivirus network connections](configure-network-connections-microsoft-defender-antivirus.md) - [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md)+- [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) +- [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) +- [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) +- [Configure Defender for Endpoint on Android features](android-configure.md) +- [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) |
| security | Defender Endpoint Plan 1 2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2.md | The following table summarizes what's included in Microsoft endpoint security pl > - [Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance) > - [Microsoft 365 Education](/office365/servicedescriptions/office-365-platform-service-description/microsoft-365-education) +## Mixed-licensing scenarios ++A mixed-licensing scenario is a situation in which an organization is using a mix of subscriptions, such as Defender for Endpoint Plan 1 and Plan 2. The following table describes examples of mixed-licensing scenarios: ++| Scenario | Description | +|:|:| +| *Mixed tenant* | Use different sets of capabilities for groups of users and their devices. Examples include:<br/>- Defender for Endpoint Plan 1 and Defender for Endpoint Plan 2<br/>- Microsoft 365 E3 and Microsoft 365 E5 | +| *Mixed trial* | Try a premium level subscription for some users. Examples include: <br/>- Defender for Endpoint Plan 1 (purchased for all users), and Defender for Endpoint Plan 2 (a trial subscription has been started for some users)<br/>- Microsoft 365 E3 (purchased for all users), and Microsoft 365 E5 (a trial subscription has been started for some users) | +| *Phased upgrades* | Upgrade user licenses in phases. Examples include:<br/>- Moving groups of users from Defender for Endpoint Plan 1 to Plan 2<br/>- Moving groups of users from Microsoft 365 E3 to E5 | ++**If you have Defender for Endpoint Plan 1 and Plan 2 in your tenant, the ability to manage your subscription settings across client devices is now in preview**! This new capability enables you to: ++- Apply *either* Defender for Endpoint Plan 1 *or* Plan 2 settings to all your client devices; or +- Use mixed mode, and apply Defender for Endpoint Plan 1 settings to some client devices, and Defender for Endpoint Plan 2 to other client devices. ++You can also use a newly added license usage report to track status. ++**For more information, including how to use mixed-licensing scenarios in your tenant, see [Manage your Defender for Endpoint subscription settings across devices](defender-endpoint-subscription-settings.md)**. + ## Options for onboarding servers Defender for Endpoint Plan 1 and 2 (standalone), Defender for Business (standalone), and Microsoft 365 Business Premium don't include server licenses. To onboard servers, choose from the following options: |
| security | Defender Endpoint Subscription Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-subscription-settings.md | + + Title: Manage your Microsoft Defender for Endpoint subscription settings across client devices +description: Learn about your options for managing your Defender for Endpoint subscription settings. Choose Plan 1, Plan 2, or mixed mode. +keywords: Defender for Endpoint, choose plan 1, choose plan 2, mixed mode, device tag, endpoint protection, endpoint security, device security, cybersecurity +search.appverid: MET150 ++++audience: ITPro + Last updated : 03/06/2023+++ms.localizationpriority: medium ++f1.keywords: NOCSH ++- M365-security-compliance +- m365initiative-defender-endpoint +++# Manage Microsoft Defender for Endpoint subscription settings across client devices ++A [mixed-licensing scenario](defender-endpoint-plan-1-2.md#mixed-licensing-scenarios) is a situation in which an organization is using a mix of Defender for Endpoint Plan 1 and Plan 2 licenses. Until recently, mixed-licensing scenarios weren't supported; in cases of multiple subscriptions, the highest functional subscription would take precedence for your tenant. Now, **the ability to manage your subscription settings to accommodate mixed licensing scenarios across client devices is currently in preview**! These capabilities enable you to: ++- **Set your tenant to mixed mode and tag devices** to determine which client devices will receive features and capabilities from each plan (we call this option *mixed mode*); **OR**, +- **Use the features and capabilities from one plan across all your client devices**. ++## [**Use mixed mode**](#tab/mixed) ++## Set your tenant to mixed mode and tag devices ++> [!IMPORTANT] +> - **Mixed-mode settings apply to client endpoints only**. Tagging server devices wonΓÇÖt change their subscription state. All server devices running Windows Server or Linux should have appropriate licenses, such as [Defender for Servers](/azure/defender-for-cloud/plan-defender-for-servers-select-plan). See [Options for onboarding servers](defender-endpoint-plan-1-2.md#options-for-onboarding-servers). +> - **Make sure to follow the procedures in this article to try mixed-license scenarios in your environment**. Assigning user licenses in the Microsoft 365 admin center ([https://admin.microsoft.com](https://admin.microsoft.com)) doesn't set your tenant to mixed mode. +> - Make sure that you have opted in to receive [preview features](preview.md). +> - **You should have active trial or paid licenses for both Defender for Endpoint Plan 1 and Plan 2**. +> - To access license information, you must have one of the following roles assigned in Azure Active Directory (Azure AD): +> - Global Admin +> - Security Admin +> - License Admin + MDE Admin ++1. As an admin, go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in. ++2. Go to **Settings** > **Endpoints** > **Licenses**. Your usage report report opens and displays information about your organizationΓÇÖs Defender for Endpoint licenses. ++3. Under **Subscription state**, select **Manage subscription settings**. ++ > [!NOTE] + > If you don't see **Manage subscription settings**, at least one of the following conditions is true: + > - You have Defender for Endpoint Plan 1 or Plan 2 (but not both); or + > - Mixed-license capabilities haven't rolled out to your tenant yet. ++4. A **Subscription settings** flyout opens. Choose the option to use Defender for Endpoint Plan 1 and Plan 2. (No changes will occur until devices are tagged as per the next step.) ++5. Tag the devices that should receive either Defender for Endpoint Plan 1 or Plan 2 capabilities. You can choose to tag your devices manually or by using a dynamic rule. [Learn more about device tagging](#more-details-about-device-tagging). ++ | Method | Details | + |:|:| + | Tag devices manually | To tag devices manually, create a tag called `License MDE P1` and apply it to devices. To get help with this step, see [Create and manage device tags](machine-tags.md).<br/><br/>Note that devices that are tagged with the `License MDE P1` tag using the [registry key method](machine-tags.md#add-device-tags-by-setting-a-registry-key-value) will not receive downgraded functionality. If you want to tag devices by using the registry key method, use a dynamic rule instead of manual tagging. | + | Tag devices automatically by using a dynamic rule | *Dynamic rule functionality is new for mixed-license scenarios! It allows you to apply a dynamic and granular level of control over how you manage devices*. <br/><br/>To use a dynamic rule, you specify a set of criteria based on device name, domain, operating system platform, and/or device tags. Devices that meet the specified criteria will receive the Defender for Endpoint Plan 1 or Plan 2 capabilities according to your rule. <br/><br/>As you define your criteria, you can use the following condition operators: <br/>- `Equals` / `Not equals`<br/>- `Starts with`<br/>- `Contains` / `Does not contain` <br/><br/>For **Device name**, you can use freeform text.<br/><br/>For **Domain**, select from a list of domains.<br/><br/>For **OS platform**, select from a list of operating systems.<br/><br/>For **Tag**, use the freeform text option. Type the tag value that corresponds to the devices that should receive either Defender for Endpoint Plan 1 or Plan 2 capabilities. See the example in [More details about device tagging](#more-details-about-device-tagging). | + + Device tags are visible in the **Device inventory** view and in the [Defender for Endpoint APIs](apis-intro.md). ++ > [!NOTE] + > Dynamically added Defender for Endpoint P1 tags are not currently filterable in the Device inventory view. ++6. Save your rule and wait for up to three (3) hours for tags to be applied. Then, proceed to [Validate that a device is receiving only Defender for Endpoint Plan 1 capabilities](#validate-that-a-device-is-receiving-only-defender-for-endpoint-plan-1-capabilities). ++### More details about device tagging ++As described in [Tech Community blog: How to use tagging effectively](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/how-to-use-tagging-effectively-part-1/ba-p/1964058), device tagging provides you with granular control over devices. With device tags, you can: ++- Display certain devices to individual users in the Microsoft 365 Defender portal so that they see only the devices they're responsible for. +- Include or exclude devices from specific security policies. +- Determine which devices should receive Defender for Endpoint Plan 1 or Plan 2 capabilities. (*This capability is now in preview!*) ++For example, suppose that you want to use a tag called `VIP` for all the devices that should receive Defender for Endpoint Plan 2 capabilities. Here's what you would do: ++1. Create a device tag called `VIP`, and apply it to all the devices that should receive Defender for Endpoint Plan 2 capabilities. Use one of the following methods to create your device tag: ++ - [Add and manage device tags using the Microsoft 365 Defender portal](machine-tags.md#add-and-manage-device-tags-using-the-portal). + - [Add device tags by setting a registry key value](machine-tags.md#add-device-tags-by-setting-a-registry-key-value). + - [Add or remove machine tags by using the Defender for Endpoint API](add-or-remove-machine-tags.md). + - [Add device tags by creating a custom profile in Microsoft Intune](machine-tags.md#add-device-tags-by-creating-a-custom-profile-in-microsoft-intune). ++2. Set up a dynamic rule using the condition operator `Tag Does not contain VIP`. In this case, all devices that do not have the `VIP` tag will receive the `License MDE P1` tag and Defender for Endpoint Plan 1 capabilities. +++## [**Use one plan**](#tab/oneplan) ++## Use the features and capabilities from one plan across all your devices ++> [!IMPORTANT] +> - Make sure that you have opted in to receive [preview features](preview.md). +> - To access license information, you must have one of the following roles assigned in Azure Active Directory (Azure AD): +> - Global Admin +> - Security Admin +> - License Admin + MDE Admin ++1. As a Security Admin or Global Admin, go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in. ++2. Go to **Settings** > **Endpoints** > **Licenses**. ++3. Under **Subscription state**, select **Manage subscription settings**. ++ > [!NOTE] + > If you don't see **Manage subscription settings**, at least one of the following conditions is true: + > - You have Defender for Endpoint Plan 1 or Plan 2 (but not both); or + > - Mixed-license capabilities haven't rolled out to your tenant yet. ++4. A **Subscription settings** flyout opens. Choose one plan for all users and devices, and then select **Done**. It can take up to three hours for your changes to be applied. ++ If you chose to apply Defender for Endpoint Plan 1 to all devices, proceed to [Validate that devices are receiving only Defender for Endpoint Plan 1 capabilities](#validate-that-a-device-is-receiving-only-defender-for-endpoint-plan-1-capabilities). ++++## Validate that a device is receiving only Defender for Endpoint Plan 1 capabilities ++After you have assigned Defender for Endpoint Plan 1 capabilities to some or all devices, you can verify that an individual device is receiving those capabilities. ++1. In the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), go to **Assets** > **Devices**. ++2. Select a device that is tagged with `License MDE P1`. You should see that Defender for Endpoint Plan 1 is assigned to the device. ++> [!NOTE] +> Devices that are assigned Defender for Endpoint Plan 1 capabilities will not have vulnerabilities or security recommendations listed. ++## Review license usage ++The license usage report is estimated based on sign-in activities on the device. To reduce management overhead, there will not be a requirement for device-to-user mapping and assignment. Instead, the license report will provide a utilization estimation that is calculated based on the utilization seen across your organization. It might take up to one day for your usage report to reflect the active usage of your devices. ++> [!IMPORTANT] +> To access license information, you must have one of the following roles assigned in Azure Active Directory (Azure AD): +> - Security Admin +> - Global Admin +> - License Admin + MDE Admin ++1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in. ++2. Choose **Settings** > **Endpoints** > **Licenses**. ++3. Review your available and assigned licenses. The calculation is based on detected users who have accessed devices that are onboarded to Defender for Endpoint. ++## More resources ++- [Compare Microsoft endpoint security plans](defender-endpoint-plan-1-2.md) +- [Licensing and product terms for Microsoft 365 subscriptions](https://www.microsoft.com/licensing/terms/productoffering/Microsoft365/MCA). +- [How to contact support for Defender for Endpoint](contact-support.md). +- [Get started with Microsoft Security (trial offers)](https://www.microsoft.com/security/business/get-started/start-free-trial) +- [Microsoft Defender for Endpoint](microsoft-defender-endpoint.md) +- [Microsoft Defender for Business](../defender-business/mdb-overview.md) (endpoint protection for small and medium-sized businesses) |
| security | Live Response | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/live-response.md | Before you can initiate a session on a device, make sure you fulfill the followi You'll need to enable the live response capability in the [Advanced features settings](advanced-features.md) page. > [!NOTE]- > Only admins and users who have "Manage Portal Settings" permissions can enable live response. - > - > Automated Investigation must be enabled in the [Advanced features settings](advanced-features.md) prior to enabling live response. + > Only admins and users who have "Manage Portal Settings" permissions can enable live response. - **Enable live response for servers from the advanced settings page** (recommended). |
| security | Machineaction | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/machineaction.md | Last updated 12/18/2020 |Property|Type|Description| |||| |ID|Guid|Identity of the [Machine Action](machineaction.md) entity.|-|type|Enum|Type of the action. Possible values are: "RunAntiVirusScan", "Offboard", "Live Response", "CollectInvestigationPackage", "Isolate", "Unisolate", "StopAndQuarantineFile", "RestrictCodeExecution", and "UnrestrictCodeExecution".| +|type|Enum|Type of the action. Possible values are: "RunAntiVirusScan", "Offboard", "LiveResponse", "CollectInvestigationPackage", "Isolate", "Unisolate", "StopAndQuarantineFile", "RestrictCodeExecution", and "UnrestrictCodeExecution".| |scope|string|Scope of the action. "Full" or "Selective" for Isolation, "Quick" or "Full" for Anti-Virus scan.| |requestor|String|Identity of the person that executed the action.| |externalID|String|Id the customer can submit in the request for custom correlation.| |
| security | Manage Tamper Protection Configuration Manager | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-tamper-protection-configuration-manager.md | Title: Manage tamper protection using tenant attach with Configuration Manager, version 2006-+ description: Turn tamper protection on or off using tenant attach with Configuration Manager. keywords: malware, defender, antivirus, tamper protection, Configuration Manager |
| security | Manage Tamper Protection Individual Device | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-tamper-protection-individual-device.md | Title: Manage tamper protection on an individual device-+ description: Turn tamper protection on or off for an individual device. keywords: malware, defender, antivirus, tamper protection |
| security | Manage Tamper Protection Intune | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-tamper-protection-intune.md | Title: Manage tamper protection for your organization using Microsoft Intune-+ description: Turn tamper protection on or off for your organization in Microsoft Intune. keywords: malware, defender, antivirus, tamper protection, Microsoft Intune |
| security | Manage Updates Baselines Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus.md | ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: high Previously updated : 02/23/2023 Last updated : 03/13/2023 audience: ITPro Platform and engine updates are provided on a monthly cadence. To be fully suppo During the technical support (only) phase, commercially reasonable support incidents will be provided through Microsoft Customer Service & Support and Microsoft's managed support offerings (such as Premier Support). If a support incident requires escalation to development for further guidance, requires a non-security update, or requires a security update, customers will be asked to upgrade to the latest platform version or an intermediate update (*). + > [!NOTE] > If you are manually deploying Microsoft Defender Antivirus Platform Update, or if you are using a script or a non-Microsoft management product to deploy Microsoft Defender Antivirus Platform Update, make sure that version `4.18.2001.10` is installed from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=4.18.2001.10) before the latest version of Platform Update (N-2) is installed. -### Platform version included with Windows 10 releases +## How to roll back an update ++In the unfortunate event that you encounter issues after a platform update, you can roll back to the previous or the inbox version of the Microsoft Defender platform. +- To roll back to the previous version, run the following command:<br> +`"%programdata%\Microsoft\Windows Defender\Platofrm\<version>\MpCmdRun.exe" -RevertPlatform` +- To roll back this update to the version shipped with the Operating System ("%ProgramFiles%\Windows Defender")<br> +`"%programdata%\Microsoft\Windows Defender\Platofrm\<version>\MpCmdRun.exe" -ResetPlatform` ++## Platform version included with Windows 10 releases The below table provides the Microsoft Defender Antivirus platform and engine versions that are shipped with the latest Windows 10 releases: The below table provides the Microsoft Defender Antivirus platform and engine ve |2004 (20H1/20H2) | `4.18.1909.6` | `1.1.17000.2` | Technical upgrade support (only) | |1909 (19H2) |`4.18.1902.5` |`1.1.16700.3` | Technical upgrade support (only) | |1903 (19H1) |`4.18.1902.5` |`1.1.15600.4` | Technical upgrade support (only) |-|1809 (RS5) |`4.18.1807.1807`5 |`1.1.15000.2` | Technical upgrade support (only) | +|1809 (RS5) |`4.18.1807.5` |`1.1.15000.2` | Technical upgrade support (only) | |1803 (RS4) |`4.13.17134.1` |`1.1.14600.4` | Technical upgrade support (only) | |1709 (RS3) |`4.12.16299.15` |`1.1.14104.0` | Technical upgrade support (only) | |1703 (RS2) |`4.11.15603.2` |`1.1.13504.0` | Technical upgrade support (only) | We recommend updating your Windows 10 (Enterprise, Pro, and Home editions), Wind For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images). +### 20230308.1 ++- Defender package version: **20230308.1** +- Security intelligence version: **1.383.1321.0** +- Engine version: **1.1.20000.2** +- Platform version: **4.18.2301.6** ++#### Fixes ++- None ++#### Additional information ++- None + ### 20230215.1 - Defender package version: **20230215.1** |
| security | Microsoft Defender Antivirus On Windows Server | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-on-windows-server.md | The following table describes methods to set Microsoft Defender Antivirus to pas ||| | Set Microsoft Defender Antivirus to passive mode by using a registry key | Set the `ForceDefenderPassiveMode` registry key as follows: <br/>- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection` <br/>- Name: `ForceDefenderPassiveMode` <br/>- Type: `REG_DWORD` <br/>- Value: `1` | | Turn off the Microsoft Defender Antivirus user interface using PowerShell | Open Windows PowerShell as an administrator, and run the following PowerShell cmdlet: `Uninstall-WindowsFeature -Name Windows-Defender-GUI`-| Disable Microsoft Defender Antivirus using PowerShell | Use the following PowerShell cmdlet: `Set-MpPreference -DisableRealtimeMonitoring $true` | +| Disable Microsoft Defender Antivirus Realtime Protection using PowerShell | Use the following PowerShell cmdlet: `Set-MpPreference -DisableRealtimeMonitoring $true` | | Disable Microsoft Defender Antivirus using the Remove Roles and Features wizard | See [Install or Uninstall Roles, Role Services, or Features](/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features#remove-roles-role-services-and-features-by-using-the-remove-roles-and-features-wizard), and use the **Remove Roles and Features Wizard**. <br/><br/>When you get to the **Features** step of the wizard, clear the **Windows Defender Features** option. <br/><br/> If you clear **Windows Defender** by itself under the **Windows Defender Features** section, you'll be prompted to remove the interface option **GUI for Windows Defender**.<br/><br/>Microsoft Defender Antivirus will still run normally without the user interface, but the user interface can't be enabled if you disable the core **Windows Defender** feature. | | Uninstall Microsoft Defender Antivirus using PowerShell | Use the following PowerShell cmdlet: `Uninstall-WindowsFeature -Name Windows-Defender` | | Disable Microsoft Defender Antivirus using Group Policy | In your Local Group Policy Editor, navigate to **Administrative Template** > **Windows Component** > **Endpoint Protection** > **Disable Endpoint Protection**, and then select **Enabled** > **OK**. | |
| security | Prevent Changes To Security Settings With Tamper Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection.md | Title: Protect security settings with tamper protection-+ description: Use tamper protection to prevent malicious apps from changing important security settings. keywords: malware, defender, antivirus, tamper protection audience: ITPro -ms.reviwer: joshbregman - nextgen - admindeeplinkDEFENDER |
| security | Report Monitor Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/report-monitor-microsoft-defender-antivirus.md | Last updated 04/08/2021 Microsoft Defender Antivirus is built into Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2016. Microsoft Defender Antivirus is of your next-generation protection in Microsoft Defender for Endpoint. Next-generation protection helps protect your devices from software threats like viruses, malware, and spyware across email, apps, the cloud, and the web. -With Microsoft Defender Antivirus, you have several options for reviewing protection status and alerts. You can use Microsoft Configuration Manager to [monitor Microsoft Defender Antivirus](/configmgr/protect/deploy-use/monitor-endpoint-protection) or [create email alerts](/configmgr/protect/deploy-use/endpoint-configure-alerts). Or, you can monitor protection using [Microsoft Intune](/intune/introduction-intune). +With Microsoft Defender Antivirus, you have several options for reviewing protection status and alerts. You can use Microsoft Configuration Manager to [monitor Microsoft Defender Antivirus](/configmgr/protect/deploy-use/monitor-endpoint-protection) or [create email alerts](/configmgr/protect/deploy-use/endpoint-configure-alerts). Or, you can monitor protection using [Microsoft Intune](/intune/introduction-intune). When endpoints are onboarded to Defender for Endpoint, alerts are visible in Microsoft 365 Defender [unified alert and incident queues](/microsoft-365/security/defender/incident-queue). ++Within the Microsoft 365 Defender portal, reporting is also available for Microsoft Defender for Endpoint onboarded endpoints across platforms that include antivirus engine versions, security intelligence versions, and Microsoft Defender Antivirus platform versions via [Device Health reports](/microsoft-365/security/defender-endpoint/device-health-reports). If you have a third-party security information and event management (SIEM) server, you can also consume [Windows Defender client events](/windows/win32/events/windows-events). You can also [monitor malware events using the Malware Assessment solution in Lo For monitoring or determining status with PowerShell, WMI, or Microsoft Azure, see the [(Deployment, management, and reporting options table)](deploy-manage-report-microsoft-defender-antivirus.md#ref2). -> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) - > [!TIP] > **Performance tip** Due to a variety of factors (examples listed below) Microsoft Defender Antivirus, like other antivirus software, can cause performance issues on endpoint devices. In some cases, you might need to tune the performance of Microsoft Defender Antivirus to alleviate those performance issues. Microsoft's **Performance analyzer** is a PowerShell command-line tool that helps determine which files, file paths, processes, and file extensions might be causing performance issues; some examples are: > For monitoring or determining status with PowerShell, WMI, or Microsoft Azure, s > - top scans per file per process > > You can use the information gathered using Performance analyzer to better assess performance issues and apply remediation actions. -> See: [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md). -> +> See [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md). ++> [!NOTE] +> If you're looking for Antivirus related information for other platforms, see: +> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) +> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) +> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) +> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) +> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) +> - [Configure Defender for Endpoint on Android features](android-configure.md) +> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) ## See also |
| security | Advanced Hunting Deviceinfo Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-deviceinfo-table.md | Last updated 02/16/2021 The `DeviceInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about devices in the organization, including OS version, active users, and computer name. Use this reference to construct queries that return information from this table. +> [!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md). | Column name | Data type | Description | For information on other tables in the advanced hunting schema, [see the advance |`AdditionalFields` | `string` | Additional information about the event in JSON array format | |`DeviceCategory` | `string` | Broader classification that groups certain device types under the following categories: Endpoint, Network device, IoT, Unknown | |`DeviceType` | `string` | Type of device based on purpose and functionality, such as network device, workstation, server, mobile, gaming console, or printer |-|`DeviceSubType` | `string` | Additional modifier for certain types of devices, for example, a mobile device can be a tablet or a smartphone; only available if device discovery finds enough information about this attribute | +|`DeviceSubtype` | `string` | Additional modifier for certain types of devices, for example, a mobile device can be a tablet or a smartphone; only available if device discovery finds enough information about this attribute | |`Model` | `string` | Model name or number of the product from the vendor or manufacturer, only available if device discovery finds enough information about this attribute | |`Vendor` | `string` | Name of the product vendor or manufacturer, only available if device discovery finds enough information about this attribute | |`OSDistribution` | `string` | Distribution of the OS platform, such as Ubuntu or RedHat for Linux platforms | |`OSVersionInfo` | `string` | Additional information about the OS version, such as the popular name, code name, or version number | |`MergedDeviceIds` | `string` | Previous device IDs that have been assigned to the same device | |`MergedToDeviceId` | `string` | The most recent device ID assigned to a device |+|`SensorHealthState` | `string` | Indicates health of the deviceΓÇÖs EDR sensor, if onboarded to Microsoft Defender For Endpoint | +| `IsExcluded`| `bool` | Determines if the device is currently excluded from Microsoft Defender for Vulnerability Management experiences | +|`ExclusionReason` | `string` | Indicates the reason for device exclusion | +| `AssetValue`| `string` | Indicates the value of a device as assigned by the user | +| `ExposureLevel` | `string` | Indicates the exposure level of a device | + -The `DeviceInfo` table provides device information based on heartbeats, which are periodic reports or signals from a device. Every fifteen minutes, the device sends a partial heartbeat that contains frequently changing attributes like `LoggedOnUsers`. Once a day, a full heartbeat containing the device's attributes is sent. +The `DeviceInfo` table provides device information based on periodic reports or signals (heartbeats) from a device. Complete reports are sent every hour and every time a change happens to a previous heartbeat. You can use the following sample query to get the latest state of a device: |
| security | Advanced Hunting Devicenetworkinfo Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicenetworkinfo-table.md | Last updated 02/16/2021 The `DeviceNetworkInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from this table. +> [!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md). | Column name | Data type | Description | For information on other tables in the advanced hunting schema, [see the advance | `DefaultGateways` | `string` | Default gateway addresses in JSON array format | | `IPAddresses` | `string` | JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and IP address space, such as public, private, or link-local | | `ReportId` | `long` | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns |+| `NetworkAdapterVendor` | `string` | Name of the manufacturer or vendor of the network adapter | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) |
| security | Autoad Results | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/autoad-results.md | f1.keywords: ms.localizationpriority: medium Previously updated : 02/09/2023 Last updated : 02/22/2023 audience: ITPro |
| security | Automatic Attack Disruption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/automatic-attack-disruption.md | On the incident page: - A yellow banner at the top of the page that highlights the automatic action taken - The current asset status is shown in the incident graph if an action is done on an asset, e.g., account disabled or device contained -For more information see 'view attack disruption details and results'. +For more information, see [view attack disruption details and results](autoad-results.md). + ## Next steps |
| security | Configure Attack Disruption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/configure-attack-disruption.md | |
| security | Configure Siem Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/configure-siem-defender.md | Last updated 10/25/2021 > - [Microsoft 365 Defender Incidents](incident-queue.md) consists of collections of correlated alerts and their evidence. > - [Microsoft 365 Defender Streaming API](streaming-api.md) streams event data from Microsoft 365 Defender to event hubs or Azure storage accounts. -Microsoft 365 Defender supports security information and event management (SIEM) tools ingesting information from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for a registered AAD application representing the specific SIEM solution or connector installed in your environment. +Microsoft 365 Defender supports security information and event management (SIEM) tools ingesting information from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for a registered AAD application representing the specific SIEM solution or connector installed in your environment. For more information, see: For more information, see: - [Hello World example](api-hello-world.md) - [Get access with application context](api-create-app-web.md) -There are two primary models to ingest security information: +There are two primary models to ingest security information: -1. Ingesting Microsoft 365 Defender incidents and their contained alerts from a REST API in Azure. +1. Ingesting Microsoft 365 Defender incidents and their contained alerts from a REST API in Azure. -2. Ingesting streaming event data either through Azure Event Hubs or Azure Storage Accounts. +2. Ingesting streaming event data either through Azure Event Hubs or Azure Storage Accounts. -Microsoft 365 Defender currently supports the following SIEM solution integrations: +Microsoft 365 Defender currently supports the following SIEM solution integrations: - [Ingesting incidents from the incidents REST API](#ingesting-incidents-from-the-incidents-rest-api) - [Ingesting streaming event data via Event Hub](#ingesting-streaming-event-data-via-event-hubs) Microsoft 365 Defender currently supports the following SIEM solution integratio ## Ingesting incidents from the incidents REST API ### Incident schema+ For more information on Microsoft 365 Defender incident properties including contained alert and evidence entities metadata, see [Schema mapping](../defender/api-list-incidents.md#schema-mapping). ### Splunk Using the new, fully supported Splunk Add-on for Microsoft Security that support - Ingesting Defender for Endpoint alerts (from the Defender for Endpoint's Azure endpoint) and updating these alerts -- Support for updating Microsoft 365 Defender Incidents and/or Microsoft Defender for Endpoint Alerts and the respective dashboards has been moved to the Microsoft 365 App for Splunk. +- Support for updating Microsoft 365 Defender Incidents and/or Microsoft Defender for Endpoint Alerts and the respective dashboards has been moved to the Microsoft 365 App for Splunk. For more information on: Framework (CEF). For more information on the new ArcSight SmartConnector for Microsoft 365 Defender, see [ArcSight Product Documentation](https://community.microfocus.com/cyberres/productdocs/w/connector-documentation/39246/smartconnector-for-microsoft-365-defender). The SmartConnector replaces the previous FlexConnector for Microsoft Defender for Endpoint that has been deprecated.- + ### Elastic Elastic Security combines SIEM threat detection features with endpoint prevention and response capabilities in one solution. For more information on the event types supported by the Streaming API, see [Sup ### Splunk -Use the Splunk Add-on for Microsoft Cloud Services to ingest events from Azure Event Hubs. +Use the Splunk Add-on for Microsoft Cloud Services to ingest events from Azure Event Hubs. For more information on the Splunk Add-on for Microsoft Cloud Services, see the [Microsoft Cloud Services Add-on on Splunkbase](https://splunkbase.splunk.com/app/3110/).- ### IBM QRadar->Use the new IBM QRadar Microsoft 365 Defender Device Support Module (DSM) that calls the [Microsoft 365 Defender Streaming API](streaming-api.md) that allows ingesting streaming event data from Microsoft 365 Defender products via Event Hubs or Azure Storage Account. For more information on supported event types, see [Supported event types](supported-event-types.md). ++Use the new IBM QRadar Microsoft 365 Defender Device Support Module (DSM) that calls the [Microsoft 365 Defender Streaming API](streaming-api.md) that allows ingesting streaming event data from Microsoft 365 Defender products via Event Hubs or Azure Storage Account. For more information on supported event types, see [Supported event types](supported-event-types.md). ### Elastic |
| security | Create Custom Rbac Roles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/create-custom-rbac-roles.md | search.appverid: met150 The following steps guide you on how to create custom roles in Microsoft 365 Defender RBAC. ->[!Important] ->You must be a Global Administrator or Security Administrator in Azure Active Directory, or have all the **Authorization** permissions assigned in Microsoft 365 Defender RBAC to perform this task. For more information on permissions, see [Permission pre-requisites](../defender/manage-rbac.md#permissions-pre-requisites). +> [!IMPORTANT] +> You must be a Global Administrator or Security Administrator in Azure Active Directory, or have all the **Authorization** permissions assigned in Microsoft 365 Defender RBAC to perform this task. For more information on permissions, see [Permission pre-requisites](../defender/manage-rbac.md#permissions-pre-requisites). 1. Sign in to the [Microsoft 365 Defender portal](https://security.microsoft.com). 2. In the navigation pane, select **Permissions**. The following steps guide you on how to create custom roles in Microsoft 365 Def For more information on the RBAC custom permissions, see [About RBAC custom permissions](custom-permissions-details.md). - >[!Note] + > [!NOTE] > If all read-only or all read and manage permissions are assigned, any new permissions added to this category in the future will be automatically assigned under this role. > > If you have assigned custom permissions and new permissions are added to this category, you will need to re-assign your roles with the new permissions if needed. The following steps guide you on how to create custom roles in Microsoft 365 Def If a user selects all read-only permissions for a single data source, for example, Microsoft Defender for Endpoint, they will not be able to read alerts for Microsoft Defender for Office 365 or Microsoft Defender for Identity. - >[!Note] + > [!NOTE] > By selecting **Choose all data sources** all supported data sources within Microsoft 365 Defender RBAC and any future data sources that are added will be automatically assigned to this assignment. 11. In **Assigned users and groups** choose the Azure Active Directory security groups or individual users to assign the role to, and select **Add**. - >[!Note] + > [!NOTE] > In Microsoft 365 Defender RBAC, you can create as many assignments as needed under the same role with same permissions. For example, you can have an assignment within a role that has access to all data sources and then a separate assignment for a team that only needs access to Endpoint alerts from the Defender for Endpoint data source. This enables maintaining the minimum number of roles. 12. Select **Next** to review and finish creating the role and then select **Submit**. To access and manage roles and permissions, without being a Global Administrator 11. In **Assigned users and groups** ΓÇô choose the Azure Active Directory security groups or individual users to assign the role to, and select **Add**. 12. Select **Next** to review and finish creating the role and then select **Submit**. ->[!Note] ->For the Microsoft 365 Defender security portal to start enforcing the permissions and assignments configured in your new or imported roles, youΓÇÖll need to activate the new Microsoft 365 Defender RBAC model. For more information, see [Activate Microsoft 365 Defender RBAC](activate-defender-rbac.md). +> [!NOTE] +> For the Microsoft 365 Defender security portal to start enforcing the permissions and assignments configured in your new or imported roles, you'll need to activate the new Microsoft 365 Defender RBAC model. For more information, see [Activate Microsoft 365 Defender RBAC](activate-defender-rbac.md). ## Next steps |
| security | Custom Detection Rules | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/custom-detection-rules.md | +f1.keywords: - NOCSH ms.localizationpriority: medium audience: ITPro-+ - m365-security - m365initiative-m365-defender - tier2 Last updated 02/16/2021 [!INCLUDE [Microsoft 365 Defender rebranding](../includes/microsoft-defender.md)] - **Applies to:** - Microsoft 365 Defender Custom detection rules are rules you can design and tweak using [advanced huntin ## Required permissions for managing custom detections To manage custom detections, you need to be assigned one of these roles:+ - **Security settings (manage)**ΓÇöUsers with this [Microsoft 365 Defender permission](/microsoft-365/security/defender/manage-rbac) can manage security settings in the Microsoft 365 Defender portal. - **Security administrator**ΓÇöUsers with this [Azure Active Directory role](/azure/active-directory/roles/permissions-reference#security-administrator) can manage security settings in the Microsoft 365 Defender portal and other portals and services. - **Security operator**ΓÇöUsers with this [Azure Active Directory role](/azure/active-directory/roles/permissions-reference#security-operator) can manage alerts and have global read-only access to security-related features, including all information in the Microsoft 365 Defender portal. This role is sufficient for managing custom detections only if role-based access control (RBAC) is turned off in Microsoft Defender for Endpoint. If you have RBAC configured, you also need the **manage security settings** permission for Defender for Endpoint. -You can also manage custom detections that apply to data from specific Microsoft 365 Defender solutions if you have permissions for them. If you only have manage permissions for Microsoft 365 Defender for Office, for instance, you can create custom detections using `Email` tables but not `Identity` tables. +You can also manage custom detections that apply to data from specific Microsoft 365 Defender solutions if you have permissions for them. If you only have manage permissions for Microsoft 365 Defender for Office, for instance, you can create custom detections using `Email` tables but not `Identity` tables. To manage required permissions, a **global administrator** can: -- Assign the **security administrator** or **security operator** role in [Microsoft 365 admin center](https://admin.microsoft.com/) under **Roles** > **Security admin**.-- Check RBAC settings for Microsoft Defender for Endpoint in [Microsoft 365 Defender](https://security.microsoft.com/) under **Settings** > **Permissions** > **Roles**. Select the corresponding role to assign the **manage security settings** permission.+- Assign the **security administrator** or **security operator** role in [Microsoft 365 admin center](https://admin.microsoft.com/) under **Roles** \> **Security admin**. +- Check RBAC settings for Microsoft Defender for Endpoint in [Microsoft 365 Defender](https://security.microsoft.com/) under **Settings** \> **Permissions** > **Roles**. Select the corresponding role to assign the **manage security settings** permission. > [!NOTE] > To manage custom detections, **security operators** will need the **manage security settings** permission in Microsoft Defender for Endpoint if RBAC is turned on. ## Create a custom detection rule-### 1. Prepare the query. -In the Microsoft 365 Defender portal, go to **Advanced hunting** and select an existing query or create a new query. When using a new query, run the query to identify errors and understand possible results. +### 1. Prepare the query ->[!IMPORTANT] ->To prevent the service from returning too many alerts, each rule is limited to generating only 100 alerts whenever it runs. Before creating a rule, tweak your query to avoid alerting for normal, day-to-day activity. +In the Microsoft 365 Defender portal, go to **Advanced hunting** and select an existing query or create a new query. When using a new query, run the query to identify errors and understand possible results. +> [!IMPORTANT] +> To prevent the service from returning too many alerts, each rule is limited to generating only 100 alerts whenever it runs. Before creating a rule, tweak your query to avoid alerting for normal, day-to-day activity. #### Required columns in the query results+ To create a custom detection rule, the query must return the following columns: - `Timestamp`ΓÇöused to set the timestamp for generated alerts - `ReportId`ΓÇöenables lookups for the original records - One of the following columns that identify specific devices, users, or mailboxes:- - `DeviceId` - - `DeviceName` - - `RemoteDeviceName` - - `RecipientEmailAddress` - - `SenderFromAddress` (envelope sender or Return-Path address) - - `SenderMailFromAddress` (sender address displayed by email client) - - `RecipientObjectId` - - `AccountObjectId` - - `AccountSid` - - `AccountUpn` - - `InitiatingProcessAccountSid` - - `InitiatingProcessAccountUpn` - - `InitiatingProcessAccountObjectId` + - `DeviceId` + - `DeviceName` + - `RemoteDeviceName` + - `RecipientEmailAddress` + - `SenderFromAddress` (envelope sender or Return-Path address) + - `SenderMailFromAddress` (sender address displayed by email client) + - `RecipientObjectId` + - `AccountObjectId` + - `AccountSid` + - `AccountUpn` + - `InitiatingProcessAccountSid` + - `InitiatingProcessAccountUpn` + - `InitiatingProcessAccountObjectId` ->[!NOTE] ->Support for additional entities will be added as new tables are added to the [advanced hunting schema](advanced-hunting-schema-tables.md). +> [!NOTE] +> Support for additional entities will be added as new tables are added to the [advanced hunting schema](advanced-hunting-schema-tables.md). Simple queries, such as those that don't use the `project` or `summarize` operator to customize or aggregate results, typically return these common columns. There are various ways to ensure more complex queries return these columns. For example, if you prefer to aggregate and count by entity under a column such as `DeviceId`, you can still return `Timestamp` and `ReportId` by getting it from the most recent event involving each unique `DeviceId`. - > [!IMPORTANT] > Avoid filtering custom detections using the `Timestamp` column. The data used for custom detections is pre-filtered based on the detection frequency. - The sample query below counts the number of unique devices (`DeviceId`) with antivirus detections and uses this count to find only the devices with more than five detections. To return the latest `Timestamp` and the corresponding `ReportId`, it uses the `summarize` operator with the `arg_max` function. ```kusto DeviceEvents > [!TIP] > For better query performance, set a time filter that matches your intended run frequency for the rule. Since the least frequent run is _every 24 hours_, filtering for the past day will cover all new data. -### 2. Create new rule and provide alert details. +### 2. Create new rule and provide alert details With the query in the query editor, select **Create detection rule** and specify the following alert details: With the query in the query editor, select **Create detection rule** and specify - **Severity**ΓÇöpotential risk of the component or activity identified by the rule - **Category**ΓÇöthreat component or activity identified by the rule - **MITRE ATT&CK techniques**ΓÇöone or more attack techniques identified by the rule as documented in the [MITRE ATT&CK framework](https://attack.mitre.org/). This section is hidden for certain alert categories, including malware, ransomware, suspicious activity, and unwanted software-- **Description**ΓÇömore information about the component or activity identified by the rule +- **Description**ΓÇömore information about the component or activity identified by the rule - **Recommended actions**ΓÇöadditional actions that responders might take in response to an alert #### Rule frequency+ When you save a new rule, it runs and checks for matches from the past 30 days of data. The rule then runs again at fixed intervals, applying a lookback duration based on the frequency you choose: - **Every 24 hours**ΓÇöruns every 24 hours, checking data from the past 30 days When you save a new rule, it runs and checks for matches from the past 30 days o When you edit a rule, it will run with the applied changes in the next run time scheduled according to the frequency you set. The rule frequency is based on the event timestamp and not the ingestion time. --->[!TIP] -> Match the time filters in your query with the lookback duration. Results outside of the lookback duration are ignored. +> [!TIP] +> Match the time filters in your query with the lookback duration. Results outside of the lookback duration are ignored. Select the frequency that matches how closely you want to monitor detections. Consider your organization's capacity to respond to the alerts. ##### Tables that support Continuous (NRT) frequency -Near real-time detections are supported for the following tables: +Near real-time detections are supported for the following tables: + - `AlertEvidence`-- `DeviceEvents` -- `DeviceFileCertificateInfo` -- `DeviceFileEvents` -- `DeviceImageLoadEvents` -- `DeviceLogonEvents` -- `DeviceNetworkEvents` -- `DeviceNetworkInfo` -- `DeviceInfo` -- `DeviceProcessEvents` -- `DeviceRegistryEvents` -- `EmailAttachmentInfo` -- `EmailEvents` -- `EmailPostDeliveryEvents` -- `EmailUrlInfo` -- `UrlClickEvents` +- `DeviceEvents` +- `DeviceFileCertificateInfo` +- `DeviceFileEvents` +- `DeviceImageLoadEvents` +- `DeviceLogonEvents` +- `DeviceNetworkEvents` +- `DeviceNetworkInfo` +- `DeviceInfo` +- `DeviceProcessEvents` +- `DeviceRegistryEvents` +- `EmailAttachmentInfo` +- `EmailEvents` +- `EmailPostDeliveryEvents` +- `EmailUrlInfo` +- `UrlClickEvents` ->[!NOTE] +> [!NOTE] > Only columns that are generally available can support **Continuous (NRT)** frequency. -### 3. Choose the impacted entities. +### 3. Choose the impacted entities + Identify the columns in your query results where you expect to find the main affected or impacted entity. For example, a query might return sender (`SenderFromAddress` or `SenderMailFromAddress`) and recipient (`RecipientEmailAddress`) addresses. Identifying which of these columns represent the main impacted entity helps the service aggregate relevant alerts, correlate incidents, and target response actions. You can select only one column for each entity type (mailbox, user, or device). Columns that are not returned by your query can't be selected. -### 4. Specify actions. -Your custom detection rule can automatically take actions on devices, files, users, or emails that are returned by the query. +### 4. Specify actions +Your custom detection rule can automatically take actions on devices, files, users, or emails that are returned by the query. :::image type="content" source="../../media/ah-custom-actions.png" alt-text="Screenshot that shows actions for custom detections in the Microsoft 365 Defender portal." lightbox="../../media/ah-custom-actions.png"::: - #### Actions on devices+ These actions are applied to devices in the `DeviceId` column of the query results:+ - **Isolate device**ΓÇöuses Microsoft Defender for Endpoint to apply full network isolation, preventing the device from connecting to any application or service. [Learn more about Microsoft Defender for Endpoint machine isolation](/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#isolate-devices-from-the-network) - **Collect investigation package**ΓÇöcollects device information in a ZIP file. [Learn more about the Microsoft Defender for Endpoint investigation package](/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#collect-investigation-package-from-devices) - **Run antivirus scan**ΓÇöperforms a full Microsoft Defender Antivirus scan on the device These actions are applied to devices in the `DeviceId` column of the query resul #### Actions on files -- When selected, the **Allow/Block** action can be applied to the file. Blocking files are only allowed if you have *Remediate* permissions for files and if the query results have identified a file ID, such as a SHA1. Once a file is blocked, other instances of the same file in all devices are also blocked. You can control which device group the blocking is applied to, but not specific devices. +- When selected, the **Allow/Block** action can be applied to the file. Blocking files are only allowed if you have *Remediate* permissions for files and if the query results have identified a file ID, such as a SHA1. Once a file is blocked, other instances of the same file in all devices are also blocked. You can control which device group the blocking is applied to, but not specific devices. - When selected, the **Quarantine file** action can be applied to files in the `SHA1`, `InitiatingProcessSHA1`, `SHA256`, or `InitiatingProcessSHA256` column of the query results. This action deletes the file from its current location and places a copy in quarantine. -- #### Actions on users -- When selected, the **Mark user as compromised** action is taken on users in the `AccountObjectId`, `InitiatingProcessAccountObjectId`, or `RecipientObjectId` column of the query results. This action sets the users risk level to "high" in Azure Active Directory, triggering corresponding [identity protection policies](/azure/active-directory/identity-protection/overview-identity-protection). +- When selected, the **Mark user as compromised** action is taken on users in the `AccountObjectId`, `InitiatingProcessAccountObjectId`, or `RecipientObjectId` column of the query results. This action sets the users risk level to "high" in Azure Active Directory, triggering corresponding [identity protection policies](/azure/active-directory/identity-protection/overview-identity-protection). - Select **Disable user** to temporarily prevent a user from logging in.-- Select **Force password reset** to prompt the user to change their password on the next sign in session. +- Select **Force password reset** to prompt the user to change their password on the next sign in session. -Both the Disable user and Force password reset options require the user SID, which are in the columns `AccountSid`, `InitiatingProcessAccountSid`, `RequestAccountSid`, and `OnPremSid`. +Both the Disable user and Force password reset options require the user SID, which are in the columns `AccountSid`, `InitiatingProcessAccountSid`, `RequestAccountSid`, and `OnPremSid`. For more details on user actions, read [Remediation actions in Microsoft Defender for Identity](/defender-for-identity/remediation-actions). #### Actions on emails-- If the custom detection yields email messages, you can select **Move to mailbox folder** to move the email to a selected folder (any of **Junk**, **Inbox**, or **Deleted items** folders). ++- If the custom detection yields email messages, you can select **Move to mailbox folder** to move the email to a selected folder (any of **Junk**, **Inbox**, or **Deleted items** folders). - Alternatively, you can select **Delete email** and then choose to either move the emails to Deleted Items (**Soft delete**) or delete the selected emails permanently (**Hard delete**). The columns `NetworkMessageId` and `RecipientEmailAddress` must be present in the query output to apply actions to email messages. +### 5. Set the rule scope -### 5. Set the rule scope. Set the scope to specify which devices are covered by the rule. The scope influences rules that check devices and doesn't affect rules that check only mailboxes and user accounts or identities. When setting the scope, you can select: When setting the scope, you can select: Only data from devices in scope will be queried. Also, actions will be taken only on those devices. -### 6. Review and turn on the rule. -After reviewing the rule, select **Create** to save it. The custom detection rule immediately runs. It runs again based on configured frequency to check for matches, generate alerts, and take response actions. -+### 6. Review and turn on the rule ->[!Important] ->Custom detections should be regularly reviewed for efficiency and effectiveness. To make sure you are creating detections that trigger true alerts, take time to review your existing custom detections by following the steps in [Manage existing custom detection rules](#manage-existing-custom-detection-rules). <br> -You maintain control over the broadness or specificity of your custom detections so any false alerts generated by custom detections might indicate a need to modify certain parameters of the rules. +After reviewing the rule, select **Create** to save it. The custom detection rule immediately runs. It runs again based on configured frequency to check for matches, generate alerts, and take response actions. +> [!IMPORTANT] +> Custom detections should be regularly reviewed for efficiency and effectiveness. To make sure you are creating detections that trigger true alerts, take time to review your existing custom detections by following the steps in [Manage existing custom detection rules](#manage-existing-custom-detection-rules). +> +> You maintain control over the broadness or specificity of your custom detections so any false alerts generated by custom detections might indicate a need to modify certain parameters of the rules. ## Manage existing custom detection rules+ You can view the list of existing custom detection rules, check their previous runs, and review the alerts they have triggered. You can also run a rule on demand and modify it. ->[!TIP] +> [!TIP] > Alerts raised by custom detections are available over alerts and incident APIs. For more information, see [Supported Microsoft 365 Defender APIs](api-supported.md). ### View existing rules To view all existing custom detection rules, navigate to **Hunting** > **Custom To view comprehensive information about a custom detection rule, go to **Hunting** > **Custom detection rules** and then select the name of rule. You can then view general information about the rule, including information, its run status, and scope. The page also provides the list of triggered alerts and actions. -*Custom detection rule details* You can also take the following actions on the rule from this page: You can also take the following actions on the rule from this page: ### View and manage triggered alerts -In the rule details screen (**Hunting** > **Custom detections** > **[Rule name]**), go to **Triggered alerts**, which lists the alerts generated by matches to the rule. Select an alert to view detailed information about it and take the following actions: +In the rule details screen (**Hunting** \> **Custom detections** \> **[Rule name]**), go to **Triggered alerts**, which lists the alerts generated by matches to the rule. Select an alert to view detailed information about it and take the following actions: - Manage the alert by setting its status and classification (true or false alert) - Link the alert to an incident - Run the query that triggered the alert on advanced hunting ### Review actions-In the rule details screen (**Hunting** > **Custom detections** > **[Rule name]**), go to **Triggered actions**, which lists the actions taken based on matches to the rule. ->[!TIP] ->To quickly view information and take action on an item in a table, use the selection column [✓] at the left of the table. +In the rule details screen (**Hunting** \> **Custom detections** \> **[Rule name]**), go to **Triggered actions**, which lists the actions taken based on matches to the rule. ->[!NOTE] ->Some columns in this article might not be available in Microsoft Defender for Endpoint. [Turn on Microsoft 365 Defender](m365d-enable.md) to hunt for threats using more data sources. You can move your advanced hunting workflows from Microsoft Defender for Endpoint to Microsoft 365 Defender by following the steps in [Migrate advanced hunting queries from Microsoft Defender for Endpoint](advanced-hunting-migrate-from-mde.md). +> [!TIP] +> To quickly view information and take action on an item in a table, use the selection column [✓] at the left of the table. ++> [!NOTE] +> Some columns in this article might not be available in Microsoft Defender for Endpoint. [Turn on Microsoft 365 Defender](m365d-enable.md) to hunt for threats using more data sources. You can move your advanced hunting workflows from Microsoft Defender for Endpoint to Microsoft 365 Defender by following the steps in [Migrate advanced hunting queries from Microsoft Defender for Endpoint](advanced-hunting-migrate-from-mde.md). ## See also+ - [Custom detections overview](custom-detections-overview.md) - [Advanced hunting overview](advanced-hunting-overview.md) - [Learn the advanced hunting query language](advanced-hunting-query-language.md) |
| security | Edit Delete Rbac Roles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/edit-delete-rbac-roles.md | In Microsoft 365 Defender role-based access control (RBAC), you can edit and del The following steps guide you on how to edit roles in Microsoft 365 Defender RBAC: ->[!Important] ->You must be a Global Administrator or Security Administrator in Azure Active Directory, or have all the **Authorization** permissions assigned in Microsoft 365 Defender RBAC to perform this task. For more information on permissions, see [Permission pre-requisites](../defender/manage-rbac.md#permissions-pre-requisites). +> [!IMPORTANT] +> You must be a Global Administrator or Security Administrator in Azure Active Directory, or have all the **Authorization** permissions assigned in Microsoft 365 Defender RBAC to perform this task. For more information on permissions, see [Permission pre-requisites](../defender/manage-rbac.md#permissions-pre-requisites). 1. Sign in to the [Microsoft 365 Defender portal](https://security.microsoft.com) as global administrator or security administrator. 2. In the navigation pane, select **Permissions**. The following steps guide you on how to edit roles in Microsoft 365 Defender RBA :::image type="content" source="../../media/defender/m365-defender-rbac-edit-roles.png" alt-text="Screenshot of the activate workloads page" lightbox="../../media/defender/m365-defender-rbac-edit-roles.png"::: -->[!Note] ->After editing an imported role, the changes made in Microsoft 365 Defender RBAC will not be reflected back in the individual product RBAC model. +> [!NOTE] +> After editing an imported role, the changes made in Microsoft 365 Defender RBAC will not be reflected back in the individual product RBAC model. ## Delete Roles To delete roles in Microsoft 365 Defender RBAC, select the role or roles you wan If the workload is active, by removing the role all assigned user permission will be deleted. ->[!Note] ->After deleting an imported role, the role won't be deleted from the individual product RBAC model. If needed, you can re-import it to the Microsoft 365 Defender RBAC list of roles. +> [!NOTE] +> After deleting an imported role, the role won't be deleted from the individual product RBAC model. If needed, you can re-import it to the Microsoft 365 Defender RBAC list of roles. ## Next steps |
| security | Eval Defender Endpoint Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-endpoint-overview.md | +f1.keywords: - NOCSH Last updated 07/09/2021 ms.localizationpriority: medium audience: ITPro-+ - m365-security - m365solution-scenario - m365solution-evalutatemtp-This article outlines the process to enable and pilot Microsoft Defender for Endpoint. Before starting this process, be sure you've reviewed the overall process for [evaluating Microsoft 365 Defender](eval-overview.md), and you've [created the Microsoft 365 Defender evaluation environment](eval-create-eval-environment.md). -<br> +This article outlines the process to enable and pilot Microsoft Defender for Endpoint. Before starting this process, be sure you've reviewed the overall process for [evaluating Microsoft 365 Defender](eval-overview.md), and you've [created the Microsoft 365 Defender evaluation environment](eval-create-eval-environment.md). Use the following steps to enable and pilot Microsoft Defender for Endpoint. :::image type="content" source="../../media/defender/m365-defender-endpoint-eval-steps.png" alt-text="The steps for adding Microsoft Defender for Endpoint to the Microsoft Defender evaluation environment" lightbox="../../media/defender/m365-defender-endpoint-eval-steps.png"::: - The following table describes the steps in the illustration. - |Step |Description -||| -| [Step 1. Review architecture requirements and key concepts](eval-defender-endpoint-architecture.md) | Understand the Defender for Endpoint architecture and the capabilities available to you. | -|[Step 2. Enable the evaluation environment](eval-defender-endpoint-enable-eval.md) | Follow the steps to set up the evaluation environment. | -|[Step 3. Set up the pilot ](eval-defender-endpoint-pilot.md) | Verify your pilot group, run simulations, and become familiar with key features and dashboards. | +|Step|Description| +||| +|[Step 1. Review architecture requirements and key concepts](eval-defender-endpoint-architecture.md)|Understand the Defender for Endpoint architecture and the capabilities available to you.| +|[Step 2. Enable the evaluation environment](eval-defender-endpoint-enable-eval.md)|Follow the steps to set up the evaluation environment.| +|[Step 3. Set up the pilot](eval-defender-endpoint-pilot.md)|Verify your pilot group, run simulations, and become familiar with key features and dashboards.| |
| security | Eval Defender Identity Architecture | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-identity-architecture.md | +f1.keywords: - NOCSH Last updated 07/09/2021 ms.localizationpriority: medium audience: ITPro-+ - m365-security - m365solution-scenario - m365solution-evalutatemtp Defender for Identity protects your on-premises Active Directory users and/or us ## Understand the architecture -The following diagram illustrates the baseline architecture for Defender for Identity. +The following diagram illustrates the baseline architecture for Defender for Identity. :::image type="content" source="../../media/defender/m365-defender-identity-architecture.png" alt-text="The identity architecture for Microsoft Defender for Identity" lightbox="../../media/defender/m365-defender-identity-architecture.png"::: In this illustration: - Sensors installed on AD domain controllers parse logs and network traffic and send them to Microsoft Defender for Identity for analysis and reporting.-- Sensors can also parse Active Directory Federation Services (AD FS) when Azure AD is configured to use federated authentication (dotted line in illustration). +- Sensors can also parse Active Directory Federation Services (AD FS) when Azure AD is configured to use federated authentication (dotted line in illustration). - Microsoft Defender for Identity shares signals to Microsoft 365 Defender for extended detection and response (XDR). Defender for Identity sensors can be directly installed on the following servers: Defender for Identity sensors can be directly installed on the following servers For a deeper look into the architecture of Defender for Identity, including integration with Defender for Cloud Apps, see [Microsoft Defender for Identity architecture](/defender-for-identity/architecture). - ## Understand key concepts The following table identified key concepts that are important to understand when evaluating, configuring, and deploying Microsoft Defender for Identity. The following table identified key concepts that are important to understand whe | Entity profiles | Entity profiles provide a comprehensive deep-dive investigation of users, computers, devices, and resources along with their access history. | [Understanding entity profiles](/defender-for-identity/entity-profiles) | | Lateral movement paths | A key component of MDI security insights is identifying lateral movement paths in which an attacker uses non-sensitive accounts to gain access to sensitive accounts or machines throughout your network. | [Microsoft Defender for Identity Lateral Movement Paths (LMPs)](/defender-for-identity/use-case-lateral-movement-path) | | Network Name Resolution | Network Name Resolution (NNR) is a component of MDI functionality which captures activities based on network traffic, Windows events, ETW, etc. and correlates this raw data to the relevant computers involved in each activity. | [What is Network Name Resolution?](/defender-for-identity/nnr-policy) |-| Reports | Defender for Identity reports allow you to schedule or immediately generate and download reports that provide system and entity status information. You can create reports about system health, security alerts, and potential lateral movement paths detected in your environment. | [Microsoft Defender for Identity Reports ](/defender-for-identity/reports) | +| Reports | Defender for Identity reports allow you to schedule or immediately generate and download reports that provide system and entity status information. You can create reports about system health, security alerts, and potential lateral movement paths detected in your environment. | [Microsoft Defender for Identity Reports](/defender-for-identity/reports) | | Role groups | Defender for Identity offers role-based groups and delegated access to safeguard data according to your organization's specific security and compliance needs which includes Administrators, Users and Viewers. | [Microsoft Defender for Identity role groups](/defender-for-identity/role-groups) | | Administrative portal | In addition to the Microsoft 365 Defender portal, the Defender for Identity portal can be used to monitor and respond to suspicious activity. | [Working with the Microsoft Defender for Identity portal](/defender-for-identity/workspace-portal) | | Microsoft Defender for Cloud Apps integration | Microsoft Defender for Cloud Apps integrates with Microsoft Defender for Identity to provide user entity behavioral analytics (UEBA) across a hybrid environment - both cloud app and on-premises | Microsoft Defender for Identity integration | The following table identified key concepts that are important to understand whe Defender for Identity requires some prerequisite work to ensure that your on-premises identity and networking components meet minimum requirements. Use this article as a checklist to ensure your environment is ready: [Microsoft Defender for Identity prerequisites](/defender-for-identity/prerequisites). - ## Next steps Step 2 of 3: [Enable the evaluation environment Defender for Identity](eval-defender-identity-enable-eval.md) Return to the overview for [Evaluate Microsoft Defender for Identity](eval-defender-identity-overview.md) -Return to the overview for [Evaluate and pilot Microsoft 365 Defender](eval-overview.md) +Return to the overview for [Evaluate and pilot Microsoft 365 Defender](eval-overview.md) |
| security | Eval Defender Identity Enable Eval | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-identity-enable-eval.md | +f1.keywords: - NOCSH Last updated 07/09/2021 ms.localizationpriority: medium audience: ITPro-+ - m365-security - m365solution-scenario - m365solution-evalutatemtp-Use the following steps to set up your Microsoft Defender for Identity environment. +Use the following steps to set up your Microsoft Defender for Identity environment. :::image type="content" source="../../media/defender/m365-defender-identity-eval-enable-steps.png" alt-text="The steps to enable Microsoft Defender for Identity in the Microsoft Defender evaluation environment" lightbox="../../media/defender/m365-defender-identity-eval-enable-steps.png"::: Use the following steps to set up your Microsoft Defender for Identity environme ## Step 1. Set up the Defender for Identity Instance -Sign in to the Defender for Identity portal to create your instance and then connect this instance to your Active Directory environment. +Sign in to the Defender for Identity portal to create your instance and then connect this instance to your Active Directory environment. -| Step | Description |More information | -|||| -|1 | Create the Defender for Identity instance | [Quickstart: Create your Microsoft Defender for Identity instance](/defender-for-identity/install-step1) | -|2 | Connect the Defender for Identity instance to your Active Directory forest | [Quickstart: Connect to your Active Directory Forest](/defender-for-identity/install-step2) | +|Step|Description|More information| +|||| +|1|Create the Defender for Identity instance|[Quickstart: Create your Microsoft Defender for Identity instance](/defender-for-identity/install-step1)| +|2|Connect the Defender for Identity instance to your Active Directory forest|[Quickstart: Connect to your Active Directory Forest](/defender-for-identity/install-step2)| ## Step 2. Install and configure the sensor Next, download, install, and configure the Defender for Identity sensor on the domain controllers and AD FS servers in your on-premises environment. -| Step | Description |More information | -|||| -|1 | Determine how many Microsoft Defender for Identity sensors you need. | [Plan capacity for Microsoft Defender for Identity](/defender-for-identity/capacity-planning) | -|2 | Download the sensor setup package | [Quickstart: Download the Microsoft Defender for Identity sensor setup package](/defender-for-identity/install-step3) | -|3 | Install the Defender for Identity sensor | [Quickstart: Install the Microsoft Defender for Identity sensor](/defender-for-identity/install-step4) | -|4 | Configure the sensor | [Configure Microsoft Defender for Identity sensor settings ](/defender-for-identity/install-step5) | +|Step|Description|More information| +|||| +|1|Determine how many Microsoft Defender for Identity sensors you need.|[Plan capacity for Microsoft Defender for Identity](/defender-for-identity/capacity-planning)| +|2|Download the sensor setup package|[Quickstart: Download the Microsoft Defender for Identity sensor setup package](/defender-for-identity/install-step3)| +|3|Install the Defender for Identity sensor|[Quickstart: Install the Microsoft Defender for Identity sensor](/defender-for-identity/install-step4)| +|4|Configure the sensor|[Configure Microsoft Defender for Identity sensor settings](/defender-for-identity/install-step5)| ## Step 3. Configure event log and proxy settings on machines with the sensor On the machines that you installed the sensor on, configure Windows event log collection and Internet proxy settings to enable and enhance detection capabilities. -| Step | Description |More information | -|||| -|1 | Configure Windows event log collection | [Configure Windows Event collection](/defender-for-identity/configure-windows-event-collection) | -|2 | Configure Internet proxy settings | [Configure endpoint proxy and Internet connectivity settings for your Microsoft Defender for Identity Sensor](/defender-for-identity/configure-proxy) | +|Step|Description|More information| +|||| +|1|Configure Windows event log collection|[Configure Windows Event collection](/defender-for-identity/configure-windows-event-collection)| +|2|Configure Internet proxy settings|[Configure endpoint proxy and Internet connectivity settings for your Microsoft Defender for Identity Sensor](/defender-for-identity/configure-proxy)| ## Step 4. Allow Defender for Identity to identify local admins on other computers -Microsoft Defender for Identity lateral movement path detection relies on queries that identify local admins on specific machines. These queries are performed with the SAM-R protocol, using the Defender for Identity Service account. +Microsoft Defender for Identity lateral movement path detection relies on queries that identify local admins on specific machines. These queries are performed with the SAM-R protocol, using the Defender for Identity Service account. To ensure Windows clients and servers allow your Defender for Identity account to perform SAM-R, a modification to Group Policy must be made to add the Defender for Identity service account in addition to the configured accounts listed in the Network access policy. Make sure to apply group policies to all computers **except domain controllers**. -For instructions on how to do this, see [Configure Microsoft Defender for Identity to make remote calls to SAM](/defender-for-identity/install-step8-samr). +For instructions on how to do this, see [Configure Microsoft Defender for Identity to make remote calls to SAM](/defender-for-identity/install-step8-samr). ## Next steps |
| security | Eval Defender Identity Pilot | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-identity-pilot.md | Use the following steps to setup and configure the pilot for Microsoft Defender The following table describes the steps in the illustration. - [Step 1: Configure benchmark recommendations for your identity environment](#step-1-configure-benchmark-recommendations-for-your-identity-environment)-- [Step 2: Try out capabilities ΓÇö Walk through tutorials for identifying and remediating different attack types ](#step-2-try-out-capabilities--walk-through-tutorials-for-identifying-and-remediating-different-attack-types)+- [Step 2: Try out capabilities ΓÇö Walk through tutorials for identifying and remediating different attack types](#step-2-try-out-capabilities--walk-through-tutorials-for-identifying-and-remediating-different-attack-types) ## Step 1. Configure benchmark recommendations for your identity environment These benchmark recommendations include [Azure security baseline for Microsoft D The Microsoft Defender for Identity documentation includes a series of tutorials that walk through the process of identifying and remediating various attack types. Try out Defender for Identity tutorials:+ - [Reconnaissance alerts](/defender-for-identity/reconnaissance-alerts) - [Compromised credential alerts](/defender-for-identity/compromised-credentials-alerts) - [Lateral movement alerts](/defender-for-identity/lateral-movement-alerts) |
| security | Eval Defender Investigate Respond Simulate Attack | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-investigate-respond-simulate-attack.md | +f1.keywords: - NOCSH Last updated 07/09/2021 ms.localizationpriority: medium audience: ITPro-+ - m365-security - m365solution-scenario - m365solution-pilotmtpproject An incident in Microsoft 365 Defender is a collection of correlated alerts and a Microsoft 365 services and apps create alerts when they detect a suspicious or malicious event or activity. Individual alerts provide valuable clues about a completed or ongoing attack. However, attacks typically employ various techniques against different types of entities, such as devices, users, and mailboxes. The result is multiple alerts for multiple entities in your tenant. ->[!Note] ->If you are brand new to security analysis and incident response, see the [Respond to your first incident walkthrough](first-incident-overview.md) to get a guided tour of a typical process of analysis, remediation, and post-incident review. -> +> [!NOTE] +> If you are brand new to security analysis and incident response, see the [Respond to your first incident walkthrough](first-incident-overview.md) to get a guided tour of a typical process of analysis, remediation, and post-incident review. ## Simulate attacks with the Microsoft 365 Defender portal The Microsoft 365 Defender portal has built-in capabilities to create simulated attacks on your pilot environment: - Attack simulation training for Microsoft 365 Defender for Office 365 at [https://security.microsoft.com/attacksimulator](https://security.microsoft.com/attacksimulator).- + In the Microsoft 365 Defender portal, select **Email & collaboration > Attack simulation training**. - Attack tutorials & simulations for Microsoft 365 Defender for Endpoint at [https://security.microsoft.com/tutorials/simulations](https://security.microsoft.com/tutorials/simulations). To view the incident: The alerts that are shown in the dashboard can be filtered based on service resources: Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, Microsoft Defender for Endpoint, Microsoft 365 Defender, and Microsoft Defender for Office 365. -3. Select **Open incident page** to get more information about the incident. +4. Select **Open incident page** to get more information about the incident. In the **Incident** page, you can see all the alerts and information related to the incident. The information includes the entities and assets that are involved in the alert, the detection source of the alerts (such as Microsoft Defender for Identity or Microsoft Defender for Endpoint), and the reason they were linked together. Reviewing the incident alert list shows the progression of the attack. From this view, you can see and investigate the individual alerts. Select the user name to open the user's profile page where further investigation #### Automated investigation and remediation > [!NOTE]->Before we walk you through this simulation, watch the following video to get familiar with what automated self-healing is, where to find it in the portal, and how it can help in your security operations: +> Before we walk you through this simulation, watch the following video to get familiar with what automated self-healing is, where to find it in the portal, and how it can help in your security operations: > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4BzwB] |
| security | Eval Defender Investigate Respond | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-investigate-respond.md | Use the following steps. The following table describes the steps in the illustration. -|Step |Description | +|Step|Description| |||-| 1. [Simulate attacks](eval-defender-investigate-respond-simulate-attack.md) | Simulate attacks on your evaluation environment and use the Microsoft 365 Defender portal to perform incident response. | -| 2. [Try incident response capabilities ](eval-defender-investigate-respond-additional.md) | Try additional incident response features and capabilities in Microsoft 365 Defender. | -||| +|1. [Simulate attacks](eval-defender-investigate-respond-simulate-attack.md)|Simulate attacks on your evaluation environment and use the Microsoft 365 Defender portal to perform incident response.| +|2. [Try incident response capabilities](eval-defender-investigate-respond-additional.md)|Try additional incident response features and capabilities in Microsoft 365 Defender.| -### Navigation you may need +## Navigation you may need [Create the Microsoft 365 Defender Evaluation Environment](eval-create-eval-environment.md) |
| security | Eval Defender Mcas Architecture | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-mcas-architecture.md | +f1.keywords: - NOCSH Last updated 07/09/2021 ms.localizationpriority: medium audience: ITPro-+ - m365-security - m365solution-scenario - m365solution-evalutatemtp-Before enabling Microsoft Defender for Cloud Apps, be sure you understand the architecture and can meet the requirements. +Before enabling Microsoft Defender for Cloud Apps, be sure you understand the architecture and can meet the requirements. ## Understand the architecture Without Defender for Cloud Apps, cloud apps that are used by your organization a :::image type="content" source="../../media/defender/m365-defender-mcas-architecture-a.png" alt-text="The architecture for Microsoft Defender for Cloud Apps" lightbox="../../media/defender/m365-defender-mcas-architecture-a.png"::: In the illustration:-- The use of cloud apps by an organization is unmonitored and unprotected. -- This use falls outside the protections achieved within a managed organization. -#### Discovering cloud apps +- The use of cloud apps by an organization is unmonitored and unprotected. +- This use falls outside the protections achieved within a managed organization. ++### Discovering cloud apps The first step to managing the use of cloud apps is to discover which cloud apps are used by your organization. This next diagram illustrates how cloud discovery works with Defender for Cloud Apps. :::image type="content" source="../../media/defender/m365-defender-mcas-architecture-b.png" alt-text="The architecture for Microsoft Defender for Cloud Apps in Cloud discovery" lightbox="../../media/defender/m365-defender-mcas-architecture-b.png"::: - In this illustration, there are two methods that can be used to monitor network traffic and discover cloud apps that are being used by your organization.-- A. Cloud App Discovery integrates with Microsoft Defender for Endpoint natively. Defender for Endpoint reports cloud apps and services being accessed from IT-managed Windows 10 and Windows 11 devices. ++- A. Cloud App Discovery integrates with Microsoft Defender for Endpoint natively. Defender for Endpoint reports cloud apps and services being accessed from IT-managed Windows 10 and Windows 11 devices. - B. For coverage on all devices connected to a network, the Defender for Cloud Apps log collector is installed on firewalls and other proxies to collect data from endpoints. This data is sent to Defender for Cloud Apps for analysis. -#### Managing cloud apps +### Managing cloud apps -After you discover cloud apps and analyze how these apps are used by your organization, you can begin managing cloud apps that you choose. +After you discover cloud apps and analyze how these apps are used by your organization, you can begin managing cloud apps that you choose. :::image type="content" source="../../media/defender/m365-defender-mcas-architecture-c.png" alt-text="The architecture for Microsoft Defender for Cloud Apps while the managing the Cloud apps" lightbox="../../media/defender/m365-defender-mcas-architecture-c.png"::: In this illustration:+ - Some apps are sanctioned for use. This sanction is a simple way of beginning to manage apps. - You can enable greater visibility and control by connecting apps with app connectors. App connectors use the APIs of app providers. +### Applying session controls to cloud apps -#### Applying session controls to cloud apps --Microsoft Defender for Cloud Apps serves as a reverse proxy, providing proxy access to sanctioned cloud apps. This provision allows Defender for Cloud Apps to apply session controls that you configure. +Microsoft Defender for Cloud Apps serves as a reverse proxy, providing proxy access to sanctioned cloud apps. This provision allows Defender for Cloud Apps to apply session controls that you configure. :::image type="content" source="../../media/defender/m365-defender-mcas-architecture-d.png" alt-text="The architecture for Microsoft Defender for Cloud Apps - Proxy access session control" lightbox="../../media/defender/m365-defender-mcas-architecture-d.png"::: In this illustration:+ - Access to sanctioned cloud apps from users and devices in your organization is routed through Defender for Cloud Apps. - This proxy access allows session controls to be applied. - Cloud apps that you have not sanctioned or explicitly unsanctioned are not affected. Session controls allow you to apply parameters to how cloud apps are used by your organization. For example, if your organization is using Salesforce, you can configure a session policy that allows only managed devices to access your organization's data at Salesforce. A simpler example could be configuring a policy to monitor traffic from unmanaged devices so you can analyze the risk of this traffic before applying stricter policies. -#### Integrating with Azure AD with Conditional Access App Control +### Integrating with Azure AD with Conditional Access App Control -You might already have SaaS apps added to your Azure AD tenant to enforce multi-factor authentication and other conditional access policies. Microsoft Defender for Cloud Apps natively integrates with Azure AD. All you have to do is configure a policy in Azure AD to use Conditional Access App Control in Defender for Cloud Apps. This routes network traffic for these managed SaaS apps through Defender for Cloud Apps as a proxy, which allows Defender for Cloud Apps to monitor this traffic and to apply session controls. +You might already have SaaS apps added to your Azure AD tenant to enforce multi-factor authentication and other conditional access policies. Microsoft Defender for Cloud Apps natively integrates with Azure AD. All you have to do is configure a policy in Azure AD to use Conditional Access App Control in Defender for Cloud Apps. This routes network traffic for these managed SaaS apps through Defender for Cloud Apps as a proxy, which allows Defender for Cloud Apps to monitor this traffic and to apply session controls. :::image type="content" source="../../media/defender/m365-defender-mcas-architecture-e.png" alt-text="The architecture for the Microsoft Defender for Cloud Apps - SaaS apps" lightbox="../../media/defender/m365-defender-mcas-architecture-e.png"::: In this illustration:+ - SaaS apps are integrated with the Azure AD tenant. This integration allows Azure AD to enforce conditional access policies, including multi-factor authentication. - A policy is added to Azure Active Directory to direct traffic for SaaS apps to Defender for Cloud Apps. The policy specifies which SaaS apps to apply this policy to. Therefore, after Azure AD enforces any conditional access policies that apply to these SaaS apps, Azure AD then directs (proxies) the session traffic through Defender for Cloud Apps.-- Defender for Cloud Apps monitors this traffic and applies any session control policies that have been configured by administrators. +- Defender for Cloud Apps monitors this traffic and applies any session control policies that have been configured by administrators. You might have discovered and sanctioned cloud apps using Defender for Cloud Apps that have not been added to Azure AD. You can take advantage of Conditional Access App Control by adding these cloud apps to your Azure AD tenant and the scope of your conditional access rules. -#### Protecting your organization from hackers +### Protecting your organization from hackers Defender for Cloud Apps provides powerful protection on its own. However, when combined with the other capabilities of Microsoft 365 Defender, Defender for Cloud Apps provides data into the shared signals which (together) helps stop attacks. -It's worth repeating this illustration from the overview to this Microsoft 365 Defender evaluation and pilot guide. +It's worth repeating this illustration from the overview to this Microsoft 365 Defender evaluation and pilot guide. :::image type="content" source="../../media/defender/m365-defender-eval-threat-chain.png" alt-text="How Microsoft 365 Defender stops a chain of threats" lightbox="../../media/defender/m365-defender-eval-threat-chain.png"::: Focusing on the right side of this illustration, Microsoft Defender for Cloud Ap The following table identified key concepts that are important to understand when evaluating, configuring, and deploying Microsoft Defender for Cloud Apps. - |Concept |Description |More information | ||||-| Defender for Cloud Apps Dashboard | Presents an overview of the most important information about your organization and gives links to deeper investigation. | [Working with the dashboard ](/cloud-app-security/daily-activities-to-protect-your-cloud-environment) | +| Defender for Cloud Apps Dashboard | Presents an overview of the most important information about your organization and gives links to deeper investigation. | [Working with the dashboard](/cloud-app-security/daily-activities-to-protect-your-cloud-environment) | | Conditional Access App Control | Reverse proxy architecture that integrates with your Identity Provider (IdP) to give Azure AD conditional access policies and selectively enforce session controls. | [Protect apps with Microsoft Defender for Cloud Apps Conditional Access App Control](/cloud-app-security/proxy-intro-aad) | | Cloud App Catalog | The Cloud App Catalog gives you a full picture against Microsoft catalog of over 16,000 cloud apps that are ranked and scored based on more than 80 risk factors. | [Working with App risk scores](/cloud-app-security/risk-score) |-| Cloud Discovery Dashboard | Cloud Discovery analyzes your traffic logs and is designed to give more insight into how cloud apps are being used in your organization as well as give alerts and risk levels. | [Working with discovered apps ](/cloud-app-security/discovered-apps) | +| Cloud Discovery Dashboard | Cloud Discovery analyzes your traffic logs and is designed to give more insight into how cloud apps are being used in your organization as well as give alerts and risk levels. | [Working with discovered apps](/cloud-app-security/discovered-apps) | |Connected Apps |Defender for Cloud Apps provides end-to-end protection for connected apps using Cloud-to-Cloud integration, API connectors, and real-time access and session controls using our Conditional App Access Controls. |[Protecting connected apps](/cloud-app-security/protect-connected-apps) |-| | | | ## Review architecture requirements To discover cloud apps used in your environment, you can implement one or both o - Get up and running quickly with Cloud Discovery by integrating with Microsoft Defender for Endpoint. This native integration enables you to immediately start collecting data on cloud traffic across your Windows 11 and Windows 10 devices, on and off your network. - To discover all cloud apps accessed by all devices connected to your network, deploy the Defender for Cloud Apps log collector on your firewalls and other proxies. This deployment helps collect data from your endpoints and sends it to Defender for Cloud Apps for analysis. Defender for Cloud Apps natively integrates with some third-party proxies for even more capabilities. -These options are included in [Step 2. Enable the evaluation environment](eval-defender-mcas-enable-eval.md). +These options are included in [Step 2. Enable the evaluation environment](eval-defender-mcas-enable-eval.md). ### Applying Azure AD Conditional Access policies to cloud apps Conditional Access App Control (the ability to apply Conditional Access policies ## SIEM integration -You can integrate Microsoft Defender for Cloud Apps with your generic SIEM server or with Microsoft Sentinel to enable centralized monitoring of alerts and activities from connected apps. +You can integrate Microsoft Defender for Cloud Apps with your generic SIEM server or with Microsoft Sentinel to enable centralized monitoring of alerts and activities from connected apps. Additionally, Microsoft Sentinel includes a Microsoft Defender for Cloud Apps connector to provide deeper integration with Microsoft Sentinel. This arrangement enables you to not only gain visibility into your cloud apps but to also get sophisticated analytics to identify and combat cyberthreats and to control how your data travels. |
| security | Eval Defender Mcas Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-mcas-overview.md | +f1.keywords: - NOCSH Last updated 07/09/2021 ms.localizationpriority: medium audience: ITPro-+ - m365-security - m365solution-scenario- - m365solution-evalutatemtp + - m365solution-evalutatemtp - zerotrust-solution - highpri - tier1-This article outlines the process to enable and pilot Microsoft Defender for Cloud Apps alongside Microsoft 365 Defender. Before starting this process, be sure you've reviewed the overall process for [evaluating Microsoft 365 Defender](eval-overview.md) and you have [created the Microsoft 365 Defender evaluation environment](eval-create-eval-environment.md). -<br> +This article outlines the process to enable and pilot Microsoft Defender for Cloud Apps alongside Microsoft 365 Defender. Before starting this process, be sure you've reviewed the overall process for [evaluating Microsoft 365 Defender](eval-overview.md) and you have [created the Microsoft 365 Defender evaluation environment](eval-create-eval-environment.md). Use the following steps to enable and pilot Microsoft Defender for Cloud Apps. Use the following steps to enable and pilot Microsoft Defender for Cloud Apps. ||| |[Review architecture requirements and key concepts](eval-defender-mcas-architecture.md) | Understand the Defender for Cloud Apps architecture and how it integrates with Microsoft 365 Defender, Microsoft Defender for Endpoint, and Azure Active Directory. | |[Enable the evaluation environment](eval-defender-mcas-enable-eval.md) | Connect to the portal, configure integration with Defender for Identity and/or your organization's network devices, and begin to view and manage cloud apps. |-|[Set up the pilot ](eval-defender-mcas-pilot.md) | Scope your deployment to certain user groups, configure Conditional Access App Control, and try out tutorials for protecting your environment. | +|[Set up the pilot](eval-defender-mcas-pilot.md) | Scope your deployment to certain user groups, configure Conditional Access App Control, and try out tutorials for protecting your environment. | |
| security | Import Rbac Roles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/import-rbac-roles.md | Title: Import roles to Microsoft 365 Defender RBAC + Title: Import roles to Microsoft 365 Defender RBAC description: Create custom Microsoft 365 Defender Security portal role-based access control (RBAC) ms.mktglfcycl: deploy Importing roles will migrate and maintain the roles with full parity in relation The following steps guide you on how to import roles into Microsoft 365 Defender RBAC: > [!IMPORTANT]->You must be a Global Administrator or Security Administrator in Azure Active Directory, or have all the **Authorization** permissions assigned in Microsoft 365 Defender RBAC to perform this task. For more information on permissions, see [Permission pre-requisites](../defender/manage-rbac.md#permissions-pre-requisites). +> You must be a Global Administrator or Security Administrator in Azure Active Directory, or have all the **Authorization** permissions assigned in Microsoft 365 Defender RBAC to perform this task. For more information on permissions, see [Permission pre-requisites](../defender/manage-rbac.md#permissions-pre-requisites). 1. Sign in to the [Microsoft 365 Defender portal](https://security.microsoft.com). 2. In the navigation pane, select **Permissions**. |
| security | Integrate Microsoft 365 Defender Secops | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/integrate-microsoft-365-defender-secops.md | If you are not already familiar with Microsoft 365 Defender, see these articles: If your organization has already implemented some aspects of Microsoft 365 Defender, these articles can either affirm or help improve your existing architecture and processes. ->[!Note] ->As a Microsoft partner, Protiviti contributed to and provided material feedback to this article. -> +> [!NOTE] +> As a Microsoft partner, Protiviti contributed to and provided material feedback to this article. ## Target audience |
| security | Investigate Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/investigate-users.md | Defender for Identity pulls tags out of Active Directory to give you a single in For more information, see [Defender for Identity entity tags in Microsoft 365 Defender](/defender-for-identity/entity-tags). ->[!NOTE] +> [!NOTE] > The organization tree section and the account tags are available when a Microsoft Defender for Identity license is available. ## Alerts You can see all active alerts involving the user from the last 180 days in this - Groups - this section includes all observed on-premises groups for the identity, as reported by Defender for Identity. - Lateral movement paths - this section includes all profiled lateral movement paths from the on-premises environment detected by Defender for Identity. ->[!NOTE] +> [!NOTE] > Groups and lateral movement paths are available when a Microsoft Defender for Identity license is available. Selecting the **Lateral movements** tab lets you view a fully dynamic and clickable map where you can see the lateral movement paths to and from a user. An attacker can use the path information to infiltrate your network. |
| security | M365d Enable Faq | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-enable-faq.md | To optimize your Microsoft 365 Defender experiences, we recommend deploying *all Microsoft 365 Defender automatically selects an optimal location for the data center where consolidated data is processed and stored. If you have Microsoft Defender for Endpoint, it selects the same location used by Defender for Endpoint. ->[!NOTE] ->Microsoft Defender for Endpoint automatically provisions in European Union (EU) data centers when turned on through Microsoft Defender for Cloud. Microsoft 365 Defender will automatically provision in the same EU data center for customers who have provisioned Microsoft Defender for Endpoint in this manner. +> [!NOTE] +> Microsoft Defender for Endpoint automatically provisions in European Union (EU) data centers when turned on through Microsoft Defender for Cloud. Microsoft 365 Defender will automatically provision in the same EU data center for customers who have provisioned Microsoft Defender for Endpoint in this manner. The data center location is shown before and after the service is provisioned in the settings page for Microsoft 365 Defender (**Settings > Microsoft 365 Defender**). If you prefer to use another data center location, select **Need help?** in the Microsoft 365 Defender portal to contact Microsoft support. By default, Microsoft 365 Defender displays time information in the UTC time zon Microsoft regularly provides information through the various channels, including: - Blogposts in the [Microsoft 365 security & compliance tech community](https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/bg-p/MicrosoftThreatProtectionBlog)-- Go to [Defender monthly news](https://aka.ms/defendernews) +- Go to [Defender monthly news](https://aka.ms/defendernews) - The [message center](../../admin/manage/message-center.md) in Microsoft 365 admin center |
| security | Microsoft 365 Defender Portal | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-defender-portal.md | audience: ITPro - m365-security - tier1-+ - admindeeplinkDEFENDER - intro-overview The [Microsoft 365 Defender portal](https://sip.security.microsoft.com/homepage) - **[Microsoft Defender for Identity](/defender-for-identity/what-is)** is a cloud-based security solution that leverages your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization. - **[Microsoft Defender for Cloud Apps](/cloud-app-security/)** is a comprehensive cross-SaaS and PaaS solution bringing deep visibility, strong data controls, and enhanced threat protection to your cloud apps. -Watch this short video to learn about the Microsoft 365 Defender portal. +Watch this short video to learn about the Microsoft 365 Defender portal. > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWBKau] ## What to expect The Microsoft 365 Defender portal helps security teams investigate and respond t - Trials - Partner catalog -Microsoft 365 Defender emphasizes *unity, clarity, and common goals*. +Microsoft 365 Defender emphasizes *unity, clarity, and common goals*. > [!NOTE] > The Microsoft 365 Defender portal is accessible without any need for customers to take migration steps or purchase a new license. For example, this new portal is accessible to administrators with an E3 subscription, just as it is to those with Microsoft Defender for Office 365 Plan 1 and Plan 2; however, Exchange Online Protection, or Defender for Office 365 Plan 1 customers see only the security features their subscription license supports. The goal of the portal is to centralize security. You can add and remove different cards depending on your needs. ### Search across entities (Preview) ->[!IMPORTANT] +> [!IMPORTANT] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. The search bar is located at the top of the page. As you type, suggestions are provided so that it's easier to find entities. The enhanced search results page centralizes the results from all entities. -You can search across the following entities in Defender for Endpoint and Defender for Identity: +You can search across the following entities in Defender for Endpoint and Defender for Identity: -- **Devices** - supported for both Defender for Endpoint and Defender for Identity. Supports use of search operators. -- **Users** - supported for Defender for Endpoint, Defender for Identity, and Defender for Cloud Apps. +- **Devices** - supported for both Defender for Endpoint and Defender for Identity. Supports use of search operators. +- **Users** - supported for Defender for Endpoint, Defender for Identity, and Defender for Cloud Apps. - **Files, IPs, and URLs** - same capabilities as in Defender for Endpoint. - >[!NOTE] - >IP and URL searches are exact match and don't appear in the search results page ΓÇô they lead directly to the entity page. + > [!NOTE] + > IP and URL searches are exact match and don't appear in the search results page ΓÇô they lead directly to the entity page. -- **MDVM** - same capabilities as in Defender for Endpoint (vulnerabilities, software, and recommendations). +- **MDVM** - same capabilities as in Defender for Endpoint (vulnerabilities, software, and recommendations). ## Threat analytics Threat analytics is the Microsoft 365 Defender threat intelligence solution from ## Partner catalog Microsoft 365 Defender supports two types of partners:-- Third-party integrations to help secure users with effective threat protection, detection, investigation, and response in various security fields of endpoints, vulnerability management, email, identities, and cloud apps.-- Professional services where organizations can enhance the detection, investigation, and threat intelligence capabilities of the platform. +- Third-party integrations to help secure users with effective threat protection, detection, investigation, and response in various security fields of endpoints, vulnerability management, email, identities, and cloud apps. +- Professional services where organizations can enhance the detection, investigation, and threat intelligence capabilities of the platform. ## Send us your feedback With this learning path from Microsoft Learn, you can understand Microsoft 365 D > [!div class="nextstepaction"] > [Start >](/training/paths/defender-detect-respond/) - ## See also - [What's new in Microsoft 365 Defender](whats-new.md) |
| security | Microsoft 365 Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-defender.md | Microsoft 365 Defender services protect: - **Identities with Defender for Identity and Azure Active Directory (Azure AD) Identity Protection** - Microsoft Defender for Identity is a cloud-based security solution that leverages your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization. Azure AD Identity Protection uses the learnings Microsoft has acquired from their position in organizations with Azure AD, the consumer space with Microsoft Accounts, and in gaming with Xbox to protect your users. - **Applications with Microsoft Defender for Cloud Apps** - Microsoft Defender for Cloud Apps is a comprehensive cross-SaaS solution bringing deep visibility, strong data controls, and enhanced threat protection to your cloud apps. ->[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4Bzww] +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4Bzww] Microsoft 365 Defender's unique cross-product layer augments the individual service components to: |
| security | Microsoft 365 Security Center Mde | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-center-mde.md | This table is a quick reference of the changes between the Microsoft Defender Se | Area | Description of change | |||-|Search | The search bar is located at the top of the page. Suggestions are provided as you type. You can search across the following entities in Defender for Endpoint and Defender for Identity: <br><br> - **Devices** - supported for both Defender for Endpoint and Defender for Identity. You can even use search operators, for example, you can use "contains" to search for part of a host name. <br><br> - **Users** - supported for both Defender for Endpoint and Defender for Identity. <br><br> - **Files, IPs, and URLs** - same capabilities as in Defender for Endpoint. <br> NOTE: *IP and URL searches are exact match and don't appear in the search results page ΓÇô they lead directly to the entity page. <br><br> - **MDVM** - same capabilities as in Defender for Endpoint (vulnerabilities, software, and recommendations). <br><br> The enhanced search results page centralizes the results from all entities. | +|Search | The search bar is located at the top of the page. Suggestions are provided as you type. You can search across the following entities in Defender for Endpoint and Defender for Identity: <br><br> - **Devices** - supported for both Defender for Endpoint and Defender for Identity. You can even use search operators, for example, you can use "contains" to search for part of a host name. <br><br> - **Users** - supported for both Defender for Endpoint and Defender for Identity. <br><br> - **Files, IPs, and URLs** - same capabilities as in Defender for Endpoint. <br> NOTE: *IP and URL searches are exact match and don't appear in the search results page ΓÇô they lead directly to the entity page. <br><br> - **MDVM** - same capabilities as in Defender for Endpoint (vulnerabilities, software, and recommendations). <br><br> The enhanced search results page centralizes the results from all entities. | |[Dashboard](/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard) | This is your security operations dashboard. See an overview of how many active alerts were triggered, which devices are at risk, which users are at risk, and severity level for alerts, devices, and users. You can also see if any devices have sensor issues, your overall service health, and how any unresolved alerts were detected. | |Device inventory | No changes. | |[Vulnerability management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) | Name was shortened to fit in the navigation pane. It's the same as the Microsoft Defender Vulnerability Management section, with all the pages underneath. | |
| security | Microsoft 365 Security Mde Redirection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-mde-redirection.md | +f1.keywords: - NOCSH ms.localizationpriority: medium audience: ITPro-+ - m365-security - tier2 Once automatic redirection is enabled, accounts accessing the former Microsoft D Learn more about what's changed: [Microsoft Defender for Endpoint in Microsoft 365 Defender](microsoft-365-security-center-mde.md). -This includes redirection for direct access to the former portal via browser, including links pointing towards the former securitycenter.windows.com portal - such as links in email notifications, and links returned by SIEM API calls. +This includes redirection for direct access to the former portal via browser, including links pointing towards the former securitycenter.windows.com portal - such as links in email notifications, and links returned by SIEM API calls. External links from email notifications or SIEM APIs currently contain links to both portals. Once redirection is enabled, both links will point to Microsoft 365 Defender until the old link is eventually removed. We encourage you to adopt the new link pointing to Microsoft 365 Defender. Refer to the table below for more on links and routing. ## When does this take effect? -Once enabled, this update might take effect almost immediately for some accounts. But the redirection might take longer to propagate to every account in your organization. Accounts in active sessions while this setting is applied will not be ejected from their session and will only be routed to Microsoft 365 Defender after ending their current session and signing back in again. +Once enabled, this update might take effect almost immediately for some accounts. But the redirection might take longer to propagate to every account in your organization. Accounts in active sessions while this setting is applied will not be ejected from their session and will only be routed to Microsoft 365 Defender after ending their current session and signing back in again. ### Set up portal redirection To start routing accounts to Microsoft 365 Defender: 2. Sign in to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender</a>. -3. Navigate to **Settings** > **Endpoints** > **General** > **Portal redirection** or [click here](https://security.microsoft.com/preferences2/portal_redirection). +3. Navigate to **Settings** \> **Endpoints** \> **General** \> **Portal redirection** or [click here](https://security.microsoft.com/preferences2/portal_redirection). 4. Toggle the Automatic redirection setting to **On**. 5. Click **Enable** to apply automatic redirection to Microsoft 365 Defender. ->[!IMPORTANT] ->Enabling this setting will not terminate active user sessions. Accounts who are in an active session while this setting is applied will only be directed to Microsoft 365 Defender after ending their current session and signing in again. +> [!IMPORTANT] +> Enabling this setting will not terminate active user sessions. Accounts who are in an active session while this setting is applied will only be directed to Microsoft 365 Defender after ending their current session and signing in again. ->[!NOTE] ->You must be a global administrator or have security administrator permissions in Azure Active Directory to enable or disable this setting. +> [!NOTE] +> You must be a global administrator or have security administrator permissions in Azure Active Directory to enable or disable this setting. ## Can I go back to using the former portal? To revert to the former Microsoft Defender for Endpoint portal: 1. Sign in to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender</a> as a global administrator or using and account with security administrator permissions in Azure Active directory. -2. Navigate to **Settings** > **Endpoints** > **General** > **Portal redirection** or [open the page here](https://security.microsoft.com/preferences2/portal_redirection). +2. Navigate to **Settings** \> **Endpoints** \> **General** \> **Portal redirection** or [open the page here](https://security.microsoft.com/preferences2/portal_redirection). 3. Toggle the Automatic redirection setting to **Off**. 4. Click **Disable** & share feedback when prompted. -This setting can be enabled again at any time. +This setting can be enabled again at any time. -Once disabled, accounts will no longer be routed to security.microsoft.com, and you will once again have access to the former portal - securitycenter.windows.com or securitycenter.microsoft.com. +Once disabled, accounts will no longer be routed to security.microsoft.com, and you will once again have access to the former portal - securitycenter.windows.com or securitycenter.microsoft.com. ## Related information+ - [Microsoft 365 Defender overview](microsoft-365-defender.md) - [Microsoft Defender for Endpoint in Microsoft 365 Defender](microsoft-365-security-center-mde.md)-- [Microsoft delivers unified SIEM and XDR to modernize security operations](https://www.microsoft.com/security/blog/?p=91813) -- [XDR versus SIEM infographic](https://afrait.com/blog/xdr-versus-siem/) -- [`The New Defender`](https://afrait.com/blog/the-new-defender/) -- [About Microsoft 365 Defender](https://www.microsoft.com/microsoft-365/security/microsoft-365-defender) +- [Microsoft delivers unified SIEM and XDR to modernize security operations](https://www.microsoft.com/security/blog/?p=91813) +- [XDR versus SIEM infographic](https://afrait.com/blog/xdr-versus-siem/) +- [`The New Defender`](https://afrait.com/blog/the-new-defender/) +- [About Microsoft 365 Defender](https://www.microsoft.com/microsoft-365/security/microsoft-365-defender) - [Microsoft security portals and admin centers](portals.md) |
| security | Microsoft 365 Security Mdi Redirection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-mdi-redirection.md | +f1.keywords: - NOCSH ms.localizationpriority: medium audience: ITPro-+ - m365-security - tier2 Starting January 31, 2023, the portal redirection setting will be automatically ## When does this take effect? -Once enabled, this update might take effect almost immediately for some accounts. But the redirection might take longer to propagate to every account in your organization. Accounts in active sessions while this setting is applied won't be ejected from their session and will only be routed to Microsoft 365 Defender after ending their current session and signing back in again. +Once enabled, this update might take effect almost immediately for some accounts. But the redirection might take longer to propagate to every account in your organization. Accounts in active sessions while this setting is applied won't be ejected from their session and will only be routed to Microsoft 365 Defender after ending their current session and signing back in again. ### Set up portal redirection To start routing accounts to Microsoft 365 Defender: 1. Toggle the Automatic redirection setting to **On**. ->[!IMPORTANT] ->Enabling this setting will not terminate active user sessions. Accounts who are in an active session while this setting is applied will only be directed to Microsoft 365 Defender after ending their current session and signing in again. +> [!IMPORTANT] +> Enabling this setting will not terminate active user sessions. Accounts who are in an active session while this setting is applied will only be directed to Microsoft 365 Defender after ending their current session and signing in again. ->[!NOTE] ->You must be a global administrator or have security administrator permissions in Azure Active Directory to enable or disable this setting. +> [!NOTE] +> You must be a global administrator or have security administrator permissions in Azure Active Directory to enable or disable this setting. ## Can I go back to using the former portal? To revert to the former Microsoft Defender for Identity portal: 1. Sign in to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender</a> as a global administrator or using and account with security administrator permissions in Azure Active directory. -2. Navigate to **Settings** > **Identities** > **General** > **Portal redirection** or [open the page here](https://security.microsoft.com/preferences2/portal_redirection). +2. Navigate to **Settings** > **Identities** > **General** > **Portal redirection** or [open the page here](https://security.microsoft.com/preferences2/portal_redirection). 3. Toggle the Automatic redirection setting to **Off**. |
| security | Microsoft Secure Score Improvement Actions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-secure-score-improvement-actions.md | +search.appverid: - MOE150 - MET150-+ - seo-marvel-apr2020 - seo-marvel-jun2020 Last updated 02/16/2021 This view is what it will look like if you've included all possible score views: The **recommended actions** tab lists the security recommendations that address possible attack surfaces. It also includes their status (to address, planned, risk accepted, resolved through third party, resolved through alternate mitigation, and completed). You can search, filter, and group all the recommended actions. -Once you have completed an action it can take between 24-48 hours for the changes to be reflected in your secure score. +Once you have completed an action it can take between 24-48 hours for the changes to be reflected in your secure score. ### Ranking Ranking is based on the number of points left to achieve, implementation difficu ### View recommended action details -When you select a specific recommended action, a full page flyout appears. +When you select a specific recommended action, a full page flyout appears. :::image type="content" source="../../media/secure-score/secure-score-improvement-action-details.png" alt-text="Screenshot that shows the flyout of a recommended action in the Microsoft 365 Defender portal." lightbox="../../media/secure-score/secure-score-improvement-action-details.png"::: Choose any statuses and record notes specific to the recommended action. You won't be able to choose a status for Secure Score recommended actions in the "Device" category, instead, you'll be directed to the associated [Microsoft Defender Vulnerability Management security recommendation](/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation) to take action. ->[!NOTE] ->If you choose to create a 'Global exception' in the Defender Vulnerability management security recommendation, the status in the Microsoft Secure Score recommended action will be updated with the exception justification. Updates may take up to 2 hours. +> [!NOTE] +> If you choose to create a 'Global exception' in the Defender Vulnerability management security recommendation, the status in the Microsoft Secure Score recommended action will be updated with the exception justification. Updates may take up to 2 hours. >->If you choose to create an 'Exception per device group' in the Defender Vulnerability manage security recommendation, Secure Score will not be updated and the recommended action will remain as 'To address'. +> If you choose to create an 'Exception per device group' in the Defender Vulnerability manage security recommendation, Secure Score will not be updated and the recommended action will remain as 'To address'. #### Completed recommended actions The section called **At a glance** will tell you the category, attacks it can pr The **Implementation** section shows any prerequisites, step-by-step next steps to complete the recommended action, the current implementation status of the recommended action, and any learn more links. -Prerequisites include any licenses that are needed or actions to be completed before the recommended action is addressed. Make sure you have enough seats in your license to complete the recommended action and that those licenses are applied to the necessary users. +Prerequisites include any licenses that are needed or actions to be completed before the recommended action is addressed. Make sure you have enough seats in your license to complete the recommended action and that those licenses are applied to the necessary users. ## We want to hear from you |
| security | Microsoft Secure Score | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-secure-score.md | +search.appverid: - MOE150 - MET150-+ - seo-marvel-apr2020 - seo-marvel-jun2020 Last updated 02/16/2021 Microsoft Secure Score is a measurement of an organization's security posture, w Following the Secure Score recommendations can protect your organization from threats. From a centralized dashboard in the Microsoft 365 Defender portal, organizations can monitor and work on the security of their Microsoft 365 identities, apps, and devices. -Secure Score helps organizations: +Secure Score helps organizations: -* Report on the current state of the organization's security posture. -* Improve their security posture by providing discoverability, visibility, guidance, and control. -* Compare with benchmarks and establish key performance indicators (KPIs). +- Report on the current state of the organization's security posture. +- Improve their security posture by providing discoverability, visibility, guidance, and control. +- Compare with benchmarks and establish key performance indicators (KPIs). Watch this video for a quick overview of Secure score. > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWUPrP] Organizations gain access to robust visualizations of metrics and trends, integr :::image type="content" source="../../media/secure-score/secure-score-home-page.png" alt-text="The Microsoft Secure Score homepage in the Microsoft 365 Defender portal" lightbox="../../media/secure-score/secure-score-home-page.png"::: ->[!Note] -> Currently, the Azure Active Directory related Microsoft Secure Score recommendations are not available for customer tenants registered in the following Azure Active Directory regions: +> [!NOTE] +> Currently, the Azure Active Directory related Microsoft Secure Score recommendations are not available for customer tenants registered in the following Azure Active Directory regions: Japan, Australia, New Zealand, Fiji, Canada, United Kingdom, South Korea, France, United Arab Emirates, South America, Switzerland, Lichtenstein, Norway, Germany, Brazil, Sweden and Qatar. ## How it works If you have a license for one of the supported Microsoft products, then you'll s Your score is updated in real time to reflect the information presented in the visualizations and recommended action pages. Secure Score also syncs daily to receive system data about your achieved points for each action. ->[!Note] +> [!NOTE] > For Microsoft Teams related recommendations, the recommendation state will get updated when changes occur in the configuration state. In addition, the recommendation state is refreshed once a month. - ### Key scenarios - [Check your current score](microsoft-secure-score-improvement-actions.md#check-your-current-score) If you turn on security defaults, you'll be awarded full points for the followin - Require MFA for administrative roles (10 points) - Enable policy to block legacy authentication (7 points) ->[!IMPORTANT] ->Security defaults include security features that provide similar security to the "sign-in risk policy" and "user risk policy" recommended actions. Instead of setting up these policies on top of the security defaults, we recommend updating their statuses to "Resolved through alternative mitigation." +> [!IMPORTANT] +> Security defaults include security features that provide similar security to the "sign-in risk policy" and "user risk policy" recommended actions. Instead of setting up these policies on top of the security defaults, we recommend updating their statuses to "Resolved through alternative mitigation." ## Required permissions To have permission to access Microsoft Secure Score, you must be assigned one of With read and write access, you can make changes and directly interact with Secure Score. You can also assign read-only access to other users. -* Global administrator -* Security administrator -* Exchange administrator -* SharePoint administrator +- Global administrator +- Security administrator +- Exchange administrator +- SharePoint administrator ### Read-only roles With read-only access, you aren't able to edit status or notes for a recommended action, edit score zones, or edit custom comparisons. -* Helpdesk administrator -* User administrator -* Service support administrator -* Security reader -* Security operator -* Global reader +- Helpdesk administrator +- User administrator +- Service support administrator +- Security reader +- Security operator +- Global reader ## Risk awareness |
| security | Onboarding Defender Experts For Hunting | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/onboarding-defender-experts-for-hunting.md | - - tier1 + - tier1 search.appverid: met150 Last updated 07/26/2022 Last updated 07/26/2022 ## Onboarding -If you're new to Microsoft 365 Defender and Defender Experts for Hunting: +If you're new to Microsoft 365 Defender and Defender Experts for Hunting: 1. Upon getting your welcome email, select **Log into Microsoft 365 Defender**. 2. Sign in if you already have a Microsoft account. If none, create one.-3. The Microsoft 365 Defender quick tour will get you familiar with the security suite, where the capabilities are and how important they are. Select **Take a quick tour**. +3. The Microsoft 365 Defender quick tour will get you familiar with the security suite, where the capabilities are and how important they are. Select **Take a quick tour**. 4. Read the short descriptions about what the Microsoft Defender Experts service is and the capabilities it provides. Select **Next**. You'll see the welcome page:  If you're new to Microsoft 365 Defender and Defender Experts for Hunting: ## Receive Defender Experts Notifications The Defender Experts Notifications service includes:+ - Threat monitoring and analysis, reducing dwell time and the risk to your business-- Hunter-trained artificial intelligence to discover and target both known attacks and emerging threats -- Identification of the most pertinent risks, helping SOCs maximize their effectiveness -- Help in scoping compromises and as much context as can be quickly delivered to enable a swift SOC response +- Hunter-trained artificial intelligence to discover and target both known attacks and emerging threats +- Identification of the most pertinent risks, helping SOCs maximize their effectiveness +- Help in scoping compromises and as much context as can be quickly delivered to enable a swift SOC response Refer to the following screenshot to see a sample Defender Experts Notification: You can filter your incidents and alerts if you want to only see the Defender Ex ### Set up Defender Experts email notifications -You can set up Microsoft 365 Defender to notify you or your staff with an email about new incidents or updates to existing incidents, including those observed by Microsoft Defender Experts. [Learn more about getting incident notifications by email](/microsoft-365/security/defender/incidents-overview#get-incident-notifications-by-email) +You can set up Microsoft 365 Defender to notify you or your staff with an email about new incidents or updates to existing incidents, including those observed by Microsoft Defender Experts. [Learn more about getting incident notifications by email](/microsoft-365/security/defender/incidents-overview#get-incident-notifications-by-email) 1. In the Microsoft 365 Defender navigation pane, select **Settings** > **Microsoft 365 Defender** > **Email notifications** > **Incidents**. 2. Update your existing email notification rules or create a new one. [Learn more about creating a rule for email notifications](/microsoft-365/security/defender/incidents-overview#create-a-rule-for-email-notifications) You can set up Microsoft 365 Defender to notify you or your staff with an email > [!NOTE] > Experts on Demand is included in your Defender Experts for Hunting subscription with [monthly allocations](/microsoft-365/security/defender/before-you-begin-defender-experts#eligibility-and-licensing). However, it's not a security incident response service. It's intended to provide a better understanding of complex threats affecting your organization. Engage with your own security incident response team to address urgent security incident response issues. If you don't have your own security incident response team and would like Microsoft's help, create a support request in the [Premier Services Hub](/services-hub/). -Select **Ask Defender Experts** directly inside the Microsoft 365 security portal to get swift and accurate responses to all your threat hunting questions. Experts can provide insight to better understand the complex threats your organization may face. Experts on Demand can help to: +Select **Ask Defender Experts** directly inside the Microsoft 365 security portal to get swift and accurate responses to all your threat hunting questions. Experts can provide insight to better understand the complex threats your organization may face. Experts on Demand can help to: - Gather additional information on alerts and incidents, including root causes and scope - Gain clarity into suspicious devices, alerts, or incidents and take next steps if faced with an advanced attacker |
| security | Playbook Detecting Ransomware M365 Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/playbook-detecting-ransomware-m365-defender.md | f1.keywords: NOCSH Ransomware is a type of extortion attack that destroys or encrypts files and folders, preventing access to critical data or disrupting critical business systems. There are two types of ransomware: -* Commodity ransomware is malware that spreads with phishing or between devices and encrypts files before demanding a ransom. -* Human-operated ransomware is a planned and coordinated attack by active cybercriminals who employ multiple attack methods. In many cases, known techniques and tools are used to infiltrate your organization, find the assets or systems worth extorting, and then demand a ransom. Upon compromising a network, the attacker carries out reconnaissance of assets and systems which can be encrypted or extorted. The attackers then encrypt or exfiltrate data before demanding a ransom. +- Commodity ransomware is malware that spreads with phishing or between devices and encrypts files before demanding a ransom. +- Human-operated ransomware is a planned and coordinated attack by active cybercriminals who employ multiple attack methods. In many cases, known techniques and tools are used to infiltrate your organization, find the assets or systems worth extorting, and then demand a ransom. Upon compromising a network, the attacker carries out reconnaissance of assets and systems which can be encrypted or extorted. The attackers then encrypt or exfiltrate data before demanding a ransom. This article describes proactive detection of new or ongoing human-operated ransomware attacks with the Microsoft 365 Defender portal, an extended detection and response (XDR) solution for the following security -* Microsoft Defender for Endpoint -* Microsoft Defender for Office 365 -* Microsoft Defender for Identity -* Microsoft Defender for Cloud Apps (including the app governance add-on) -* Microsoft Azure AD Identity Protection -* Microsoft Defender for IoT -* Microsoft 365 Business Premium -* Microsoft Defender for Business +- Microsoft Defender for Endpoint +- Microsoft Defender for Office 365 +- Microsoft Defender for Identity +- Microsoft Defender for Cloud Apps (including the app governance add-on) +- Microsoft Azure AD Identity Protection +- Microsoft Defender for IoT +- Microsoft 365 Business Premium +- Microsoft Defender for Business For information about preventing ransomware attacks, see [Rapidly protect against ransomware and extortion](/security/compass/protect-against-ransomware-phase3). Because human-operated ransomware is typically performed by active attackers who If pre-ransom activities are detected quickly, the likelihood of a severe attack decreases. The pre-ransom stage typically includes the following techniques: initial access, reconnaissance, credential theft, lateral movement, and persistence. These techniques can initially seem unrelated and often fly under the radar. If these techniques lead to the ransom stage, it's often too late. Microsoft 365 Defender can help identify those small and seemingly unrelated incidents as possibly part of a larger ransomware campaign. -* When detected during the pre-ransom stage, smaller-scale mitigations such as isolating infected devices or user accounts can be used to disrupt and remediate the attack. -* If detection comes at a later stage, such as when the malware used to encrypt files is being deployed, more aggressive remediation steps that can cause downtime might need to be used to disrupt and remediate the attack. +- When detected during the pre-ransom stage, smaller-scale mitigations such as isolating infected devices or user accounts can be used to disrupt and remediate the attack. +- If detection comes at a later stage, such as when the malware used to encrypt files is being deployed, more aggressive remediation steps that can cause downtime might need to be used to disrupt and remediate the attack. Business operation disruptions are likely when responding to a ransomware attack. The end stage of a ransomware attack is often a choice between downtime caused by attackers with major risks, or a controlled downtime to ensure network safety and give you time to fully investigate. We never recommend paying a ransom. Paying cybercriminals to get a ransomware decryption key provides no guarantee that your encrypted data will be restored. See, [Ransomware response - Microsoft Security Blog](https://www.microsoft.com/security/blog/2019/12/16/ransomware-response-to-pay-or-not-to-pay/). In many cases, human-operated ransomware attackers use well-known and field-test To see examples of how ransomware attacks get started with common malware, see these resources: -* [Human-operated ransomware attacks: A preventable disaster](https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/) -* [Ransomware threat analytics reports in the Microsoft 365 Defender portal](https://sip.security.microsoft.com/threatanalytics3?page_size=30&filters=tags%3DRansomware&ordering=-lastUpdatedOn&fields=displayName,alertsCount,impactedEntities,exposureLevel,MisconfiguredDevices,VulnerableDevices,reportType,createdOn,lastUpdatedOn,tags,flag) +- [Human-operated ransomware attacks: A preventable disaster](https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/) +- [Ransomware threat analytics reports in the Microsoft 365 Defender portal](https://sip.security.microsoft.com/threatanalytics3?page_size=30&filters=tags%3DRansomware&ordering=-lastUpdatedOn&fields=displayName,alertsCount,impactedEntities,exposureLevel,MisconfiguredDevices,VulnerableDevices,reportType,createdOn,lastUpdatedOn,tags,flag) Being familiar with pre-ransom malware, payloads, and activities helps your analysts know what to look for to prevent the later stages of an attack. Here are some typical techniques and tools used by ransomware attackers for the Initial access: -* RDP brute force -* Vulnerable internet-facing system -* Weak application settings -* Phishing email +- RDP brute force +- Vulnerable internet-facing system +- Weak application settings +- Phishing email Credential theft: -* Mimikatz -* LSA secrets -* Credential vault -* Credentials in plaintext -* Abuse of service accounts +- Mimikatz +- LSA secrets +- Credential vault +- Credentials in plaintext +- Abuse of service accounts Lateral movement: -* Cobalt Strike -* WMI -* Abuse of management tools -* PsExec +- Cobalt Strike +- WMI +- Abuse of management tools +- PsExec Persistence: -* New accounts -* GPO changes -* Shadow IT tools -* Schedule tasks -* Service registration +- New accounts +- GPO changes +- Shadow IT tools +- Schedule tasks +- Service registration Defense evasion: -* Disabling security features -* Clearing log files -* Deleting attack artifact files -* Resetting timestamps on altered files +- Disabling security features +- Clearing log files +- Deleting attack artifact files +- Resetting timestamps on altered files Exfiltration: -* Exfiltration of sensitive data +- Exfiltration of sensitive data Impact (financial leverage):-* Encryption of data in place and in backups -* Deletion of data in place and backups, which might be combined with a preceding exfiltration -* Threat of public leakage of exfiltrated, sensitive data +- Encryption of data in place and in backups +- Deletion of data in place and backups, which might be combined with a preceding exfiltration +- Threat of public leakage of exfiltrated, sensitive data ### What to look for The challenge for security analysts is recognizing when an alert is part of a larger attack chain with the goal of extorting your sensitive data or crucial systems. For example, a detected phishing attack might be: -* A one-off attack to surveil the email messages of someone in the finance department of an organization. -* The pre-ransom part of an attack chain to use compromised user account credentials to discover the resources available to the user account and to compromise other user accounts with higher levels of privilege and access. +- A one-off attack to surveil the email messages of someone in the finance department of an organization. +- The pre-ransom part of an attack chain to use compromised user account credentials to discover the resources available to the user account and to compromise other user accounts with higher levels of privilege and access. This section provides common attack phases and methods and the signal sources that feed into the central Microsoft 365 Defender portal, which creates alerts and incidents composed of multiple related alerts for security analysis. In some cases, there are alternate security portals to view the attack data. This section provides common attack phases and methods and the signal sources th Attacker is attempting to compromise a user account, device, or app. -Attack method |Signal source |Alternate security portals -|:|:|: -RDP brute force|Defender for Endpoint|Defender for Cloud Apps -Vulnerable internet-facing system|Windows security features, Microsoft Defender for Servers| -Weak application settings |Defender for Cloud Apps, Defender for Cloud Apps with the app governance add-on|Defender for Cloud Apps | -Malicious app activity |Defender for Cloud Apps, Defender for Cloud Apps with the app governance add-on|Defender for Cloud Apps | -Phishing email |Defender for Office 365 -Password spray against Azure AD accounts |Azure AD Identity Protection via Defender for Cloud Apps |Defender for Cloud Apps -Password spray against on-premises accounts |Microsoft Defender for Identity -Device compromise |Defender for Endpoint -Credential theft |Microsoft Defender for Identity -Escalation of privilege |Microsoft Defender for Identity +|Attack method|Signal source|Alternate security portals| +|||| +|RDP brute force|Defender for Endpoint|Defender for Cloud Apps| +|Vulnerable internet-facing system|Windows security features, Microsoft Defender for Servers| +|Weak application settings|Defender for Cloud Apps, Defender for Cloud Apps with the app governance add-on|Defender for Cloud Apps| +|Malicious app activity|Defender for Cloud Apps, Defender for Cloud Apps with the app governance add-on|Defender for Cloud Apps| +|Phishing email|Defender for Office 365| +|Password spray against Azure AD accounts|Azure AD Identity Protection via Defender for Cloud Apps|Defender for Cloud Apps| +|Password spray against on-premises accounts|Microsoft Defender for Identity| +|Device compromise|Defender for Endpoint| +|Credential theft|Microsoft Defender for Identity| +|Escalation of privilege|Microsoft Defender for Identity| #### Recent spike in otherwise typical behavior Attacker is attempting to probe for additional entities to compromise. -Spike category |Signal source |Alternate security portals -|: |: |: -Sign-ins: Numerous failed attempts, attempts to logon to multiple devices in a short period, multiple first-time logons, etc. |Azure AD Identity Protection via Defender for Cloud Apps, Microsoft Defender for Identity |Defender for Cloud Apps -Recently active user account, group, machine account, app |Azure AD Identity Protection via Defender for Cloud Apps (Azure AD), Defender for Identity (Active Directory Domain Services [AD DS]) |Defender for Cloud Apps -Recent app activity such as data access |Apps with Defender for Cloud Apps with the app governance add-on |Defender for Cloud Apps +|Spike category|Signal source|Alternate security portals| +|||| +|Sign-ins: Numerous failed attempts, attempts to logon to multiple devices in a short period, multiple first-time logons, etc.|Azure AD Identity Protection via Defender for Cloud Apps, Microsoft Defender for Identity|Defender for Cloud Apps| +|Recently active user account, group, machine account, app|Azure AD Identity Protection via Defender for Cloud Apps (Azure AD), Defender for Identity (Active Directory Domain Services [AD DS])|Defender for Cloud Apps| +|Recent app activity such as data access|Apps with Defender for Cloud Apps with the app governance add-on|Defender for Cloud Apps| #### New activity Attacker is creating new entities to further their reach, install malware agents, or evade detection. -Activity |Signal source |Alternate security portal -|: |: |: -New apps that are installed |Defender for Cloud Apps with the app governance add-on |Defender for Cloud Apps -New user accounts |Azure Identity Protection |Defender for Cloud Apps -Role changes |Azure Identity Protection |Defender for Cloud Apps +|Activity|Signal source|Alternate security portal| +|||| +|New apps that are installed|Defender for Cloud Apps with the app governance add-on|Defender for Cloud Apps| +|New user accounts|Azure Identity Protection|Defender for Cloud Apps| +|Role changes|Azure Identity Protection|Defender for Cloud Apps| #### Suspicious behavior Attacker is downloading sensitive information, encrypting files, or otherwise collecting or damaging organization assets. -Behavior |Signal source -|: |: -Malware spread to multiple devices |Defender for Endpoint -Resource scanning |Defender for Endpoint, Defender for Identity -Changes in mailbox forwarding rules |Defender for Office 365 -Data exfiltration and encryption |Defender for Office 365 +|Behavior|Signal source| +||| +|Malware spread to multiple devices|Defender for Endpoint| +|Resource scanning|Defender for Endpoint, Defender for Identity| +|Changes in mailbox forwarding rules|Defender for Office 365| +|Data exfiltration and encryption|Defender for Office 365| -**Monitor for Adversary Disabling Security** ΓÇô as this is often part of human-operated ransomware (HumOR) attack chain +-*Monitor for Adversary Disabling Security** ΓÇô as this is often part of human-operated ransomware (HumOR) attack chain -* **Event Logs Clearing** ΓÇô especially the Security Event log and PowerShell Operational logs -* **Disabling of security tools/controls** (associated with some groups) +- **Event Logs Clearing** ΓÇô especially the Security Event log and PowerShell Operational logs +- **Disabling of security tools/controls** (associated with some groups) ## Detect ransomware attacks with the Microsoft 365 Defender portal The Microsoft 365 Defender portal provides a centralized view for information on detections, impacted assets, automated actions taken, and related evidence a combination of: -* An incident queue, which groups related alerts for an attack to provide the full attack scope, impacted assets, and automated remediation actions. -* An alerts queue, which lists all of the alerts being tracked by Microsoft 365 Defender. +- An incident queue, which groups related alerts for an attack to provide the full attack scope, impacted assets, and automated remediation actions. +- An alerts queue, which lists all of the alerts being tracked by Microsoft 365 Defender. ### Incident and alert sources Microsoft 365 Defender portal centralizes signals from: -* Microsoft Defender for Endpoint -* Microsoft Defender for Office 365 -* Microsoft Defender for Identity -* Microsoft Defender for Cloud Apps (including the app governance add-on) -* Microsoft Azure AD Identity Protection -* Microsoft Defender for IoT +- Microsoft Defender for Endpoint +- Microsoft Defender for Office 365 +- Microsoft Defender for Identity +- Microsoft Defender for Cloud Apps (including the app governance add-on) +- Microsoft Azure AD Identity Protection +- Microsoft Defender for IoT This table lists some typical attacks and their corresponding signal source for Microsoft 365 Defender. -Attacks and incidents |Signal source -|: |: -Cloud identity: Password spray, numerous failed attempts, attempts to log on to multiple devices in a short period, multiple first-time logons, recently active user accounts |Azure AD Identity Protection -On-premises identity (AD DS) compromise |Defender for Identity -Phishing |Defender for Office 365 -Malicious apps |Defender for Cloud Apps or Defender for Cloud Apps with app governance add-on -Endpoint (device) compromise |Defender for Endpoint -IoT-capable device compromise |Defender for IoT +|Attacks and incidents|Signal source| +||| +|Cloud identity: Password spray, numerous failed attempts, attempts to log on to multiple devices in a short period, multiple first-time logons, recently active user accounts|Azure AD Identity Protection| +|On-premises identity (AD DS) compromise|Defender for Identity| +|Phishing|Defender for Office 365| +|Malicious apps|Defender for Cloud Apps or Defender for Cloud Apps with app governance add-on| +|Endpoint (device) compromise|Defender for Endpoint| +|IoT-capable device compromise|Defender for IoT| ### Filtering ransomware-identified incidents You can easily filter the incidents queue for incidents that have been categoriz Each filter setting for the incidents queue creates a URL that you can save and access later as a link. These URLs can be bookmarked or otherwise saved and used when needed at a single click. For example, you can create bookmarks for: -* Incidents containing the "ransomware" category. Here is the corresponding [link](https://security.microsoft.com/incidents?filters=AlertStatus%3DNew%257CInProgress,category%3Dransomware&page_size=30&fields=expand,name,tags,severity,investigationStates,category,impactedEntities,alertCount,serviceSource,detectionSource,firstEventTime,lastEventTime,sensitivity,status,incidentAssignment,classification,determination,rbacGroup). -* Incidents with a specified **Actor** name known to be performing ransomware attacks. -* Incidents with a specified **Associated threat** name known to be used in ransomware attacks. -* Incidents containing a custom tag that your SecOps team uses for incidents that are known to be part of a larger, coordinated ransomware attack. +- Incidents containing the "ransomware" category. Here is the corresponding [link](https://security.microsoft.com/incidents?filters=AlertStatus%3DNew%257CInProgress,category%3Dransomware&page_size=30&fields=expand,name,tags,severity,investigationStates,category,impactedEntities,alertCount,serviceSource,detectionSource,firstEventTime,lastEventTime,sensitivity,status,incidentAssignment,classification,determination,rbacGroup). +- Incidents with a specified **Actor** name known to be performing ransomware attacks. +- Incidents with a specified **Associated threat** name known to be used in ransomware attacks. +- Incidents containing a custom tag that your SecOps team uses for incidents that are known to be part of a larger, coordinated ransomware attack. ### Filtering ransomware-identified threat analytics reports From the **Detection details** section of many threat analytics reports, you can ### Microsoft 365 Defender APIs -You can also use the Microsoft 365 Defender APIs to query the Microsoft 365 Defender incidents and alerts data in your tenant. A custom app can filter the data, filter it based on custom settings, and then provide a filtered list of links to alerts and incidents that you can easily select to go right to that alert or incident. See [List incidents API in Microsoft 365 Defender | Microsoft Docs](/api-list-incidents.md). You can also integrate your SIEM with Microsoft Defender, see [Integrate your SIEM tools with Microsoft 365 Defender](/configure-siem-defender.md). +You can also use the Microsoft 365 Defender APIs to query the Microsoft 365 Defender incidents and alerts data in your tenant. A custom app can filter the data, filter it based on custom settings, and then provide a filtered list of links to alerts and incidents that you can easily select to go right to that alert or incident. See [List incidents API in Microsoft 365 Defender| Microsoft Docs](/api-list-incidents.md). You can also integrate your SIEM with Microsoft Defender, see [Integrate your SIEM tools with Microsoft 365 Defender](/configure-siem-defender.md). ### Microsoft 365 Defender Sentinel Integration Microsoft Sentinel's Microsoft 365 Defender incident integration allows you to s For proactive scanning of ransomware activities, you should assemble a catalog of advanced hunting queries for commonly used ransomware attack methods for identities, endpoints, apps, and data. Here are some key sources for ready-to-use advanced hunting queries: -* The [Hunt for ransomware](/advanced-hunting-find-ransomware.md) article -* GitHub repository for advanced hunting queries: - * [Ransomware-specific](https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/tree/master/Ransomware) queries - * [All categories](https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/tree/master/Ransomware) of queries -* Threat analytics reports - * Advanced hunting section of the [Ransomware: A pervasive and ongoing threat](https://security.microsoft.com/threatanalytics3/05658b6c-dc62-496d-ad3c-c6a795a33c27/analystreport) analyst report - * Advanced hunting section of other analyst reports +- The [Hunt for ransomware](/advanced-hunting-find-ransomware.md) article +- GitHub repository for advanced hunting queries: + - [Ransomware-specific](https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/tree/master/Ransomware) queries + - [All categories](https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/tree/master/Ransomware) of queries +- Threat analytics reports + - Advanced hunting section of the [Ransomware: A pervasive and ongoing threat](https://security.microsoft.com/threatanalytics3/05658b6c-dc62-496d-ad3c-c6a795a33c27/analystreport) analyst report + - Advanced hunting section of other analyst reports ### Automated hunting Advanced hunting queries can also be used to create custom detection rules and a To create a custom detection rule, select **Create custom detection** rule from the page of an advanced hunting query. Once created, you can specify: -* How often to run the custom detection rule -* The severity of the alert created by the rule -* The MITRE attack phase for the created alert -* Impacted entities -* Actions to take on impacted entities +- How often to run the custom detection rule +- The severity of the alert created by the rule +- The MITRE attack phase for the created alert +- Impacted entities +- Actions to take on impacted entities ## Prepare your SecOps Team for focused ransomware detection Preparing your SecOps team for proactive ransomware detection requires: -* Pre-work for your SecOps team and organization -* Security analyst training, as needed -* Ongoing operational work to incorporate the latest attacks and detection experiences of your security analysts +- Pre-work for your SecOps team and organization +- Security analyst training, as needed +- Ongoing operational work to incorporate the latest attacks and detection experiences of your security analysts ### Pre-work for your SecOps team and organization Consider these steps to get your SecOps team and organization ready for focused 4. Create the set of custom detection rules for specific advanced hunting queries that create alerts for known ransomware attack methods, including their schedule, alert naming, and automated actions. 5. Determine the set of [custom tags](/manage-incidents.md) or standards to create new one to identify incidents that are known to be part of a larger, coordinated ransomware attack 6. Determine the set of operational tasks for ransomware incident and alert management. For example:--* Processes for Tier 1 analyst scanning of incoming incidents and alerts and assignment to Tier 2 analysts for investigation. -* Manually running advanced hunting queries and their schedule (daily, weekly, monthly). -* Ongoing changes based on ransomware attack investigation and mitigation experiences. + - Processes for Tier 1 analyst scanning of incoming incidents and alerts and assignment to Tier 2 analysts for investigation. + - Manually running advanced hunting queries and their schedule (daily, weekly, monthly). + - Ongoing changes based on ransomware attack investigation and mitigation experiences. ### Security analyst training As needed, you can provide your security analysts with internal training for: -* Common ransomware attack chains (MITRE attack tactics and common threat techniques and malware) -* Incidents and alerts and how to locate and analyze them in the Microsoft 365 Defender portal using: - * Alerts and incidents already created by Microsoft 365 Defender - * Pre-scanned URL-based filters for the Microsoft 365 Defender portal - * Programmatically via the incidents API -* Advanced hunting queries to use and their manual schedule (daily, weekly, monthly) -* Custom detection rules to use and their settings -* Custom incident tags -* The latest [threat analytics reports for ransomware](https://security.microsoft.com/threatanalytics3?page_size=30&filters=tags%3DRansomware&ordering=-lastUpdatedOn&fields=displayName,alertsCount,impactedEntities,reportType,createdOn,lastUpdatedOn,tags,flag) attacks in the Microsoft 365 Defender portal +- Common ransomware attack chains (MITRE attack tactics and common threat techniques and malware) +- Incidents and alerts and how to locate and analyze them in the Microsoft 365 Defender portal using: + - Alerts and incidents already created by Microsoft 365 Defender + - Pre-scanned URL-based filters for the Microsoft 365 Defender portal + - Programmatically via the incidents API +- Advanced hunting queries to use and their manual schedule (daily, weekly, monthly) +- Custom detection rules to use and their settings +- Custom incident tags +- The latest [threat analytics reports for ransomware](https://security.microsoft.com/threatanalytics3?page_size=30&filters=tags%3DRansomware&ordering=-lastUpdatedOn&fields=displayName,alertsCount,impactedEntities,reportType,createdOn,lastUpdatedOn,tags,flag) attacks in the Microsoft 365 Defender portal ### Ongoing work based on operational learning and new threats As part of your SecOps team's ongoing tool and process best practices and security analysts' experiences, you should: -* Update your catalog of advanced hunting queries with: - * New queries based on the latest threat analytics reports in the Microsoft 365 Defender portal or the [Advanced Hunting GitHub repository](<https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/tree/master/Ransomware>). - * Changes to existing ones to optimize for threat identification or for better alert quality. -* Update custom detection rules based on new or changed advanced hunting queries. -* Update the set of operational tasks for ransomware detection. +- Update your catalog of advanced hunting queries with: + - New queries based on the latest threat analytics reports in the Microsoft 365 Defender portal or the [Advanced Hunting GitHub repository](<https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/tree/master/Ransomware>). + - Changes to existing ones to optimize for threat identification or for better alert quality. +- Update custom detection rules based on new or changed advanced hunting queries. +- Update the set of operational tasks for ransomware detection. |
| security | Prerequisites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/prerequisites.md | For more information, [view the Microsoft 365 Enterprise service plans](https:// ### Check your existing licenses Go to Microsoft 365 admin center ([admin.microsoft.com](https://admin.microsoft.com/)) to view your existing licenses. In the admin center, go to **Billing** > **Licenses**. ->[!NOTE] +> [!NOTE] > You need to be assigned either the **Billing admin** or **Global reader** [role in Azure AD](/azure/active-directory/roles/permissions-reference) to be able to see license information. If you encounter access problems, contact a global admin. ## Required permissions |
| security | Setup M365deval | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/setup-m365deval.md | -# Set up your Microsoft 365 Defender trial in a lab environment +# Set up your Microsoft 365 Defender trial in a lab environment [!INCLUDE [Microsoft 365 Defender rebranding](../includes/microsoft-defender.md)] - **Applies to:**-- Microsoft 365 Defender +- Microsoft 365 Defender -This topic guides you to set up a dedicated lab environment. For information on setting up a trial in production, see the new [Evaluate and pilot Microsoft 365 Defender](eval-overview.md) guide. +This topic guides you to set up a dedicated lab environment. For information on setting up a trial in production, see the new [Evaluate and pilot Microsoft 365 Defender](eval-overview.md) guide. ## Create an Office 365 E5 trial tenant->[!NOTE] ->If you already have an existing Office 365 or Azure Active Directory subscription, you can skip the Office 365 E5 trial tenant creation steps. ++> [!NOTE] +> If you already have an existing Office 365 or Azure Active Directory subscription, you can skip the Office 365 E5 trial tenant creation steps. 1. Go to the [Office 365 E5 product portal](https://www.microsoft.com/microsoft-365/business/office-365-enterprise-e5-business-software?activetab=pivot%3aoverviewtab) and select **Free trial**. :::image type="content" source="../../media/mtp-eval-9.png" alt-text="The Office 365 E5 free trial page" lightbox="../../media/mtp-eval-9.png":::- + 2. Complete the trial registration by entering your email address (personal or corporate). Click **Set up account**. :::image type="content" source="../../media/mtp-eval-10.png" alt-text="The Office 365 E5 trial registration setup page" lightbox="../../media/mtp-eval-10.png"::: -3. Fill in your first name, last name, business phone number, company name, company size, and country or region. +3. Fill in your first name, last name, business phone number, company name, company size, and country or region. :::image type="content" source="../../media/mtp-eval-11.png" alt-text="The Office 365 E5 trial registration setup page asking for name, phone, and company details" lightbox="../../media/mtp-eval-11.png":::- + > [!NOTE] > The country or region you set here determines the data center region your Office 365 will be hosted.- -4. Choose your verification preference: through a text message or call. Click **Send Verification Code**. ++4. Choose your verification preference: through a text message or call. Click **Send Verification Code**. :::image type="content" source="../../media/mtp-eval-12.png" alt-text="The Office 365 E5 trial registration setup page asking for verification preference" lightbox="../../media/mtp-eval-12.png"::: 5. Set the custom domain name for your tenant, then click **Next**. :::image type="content" source="../../media/mtp-eval-13.png" alt-text="The Office 365 E5 trial registration setup page where you can set up your custom domain name" lightbox="../../media/mtp-eval-13.png":::- + 6. Set up the first identity, which will be a Global Administrator for the tenant. Fill in **Name** and **Password**. Click **Sign up**. :::image type="content" source="../../media/mtp-eval-14.png" alt-text="The Office 365 E5 trial registration setup page where you can set your business identity" lightbox="../../media/mtp-eval-14.png"::: This topic guides you to set up a dedicated lab environment. For information on 8. Connect your corporate domain to the Office 365 tenant. [Optional] Choose **Connect a domain you already own** and type in your domain name. Click **Next**. :::image type="content" source="../../media/mtp-eval-16.png" alt-text="The Office 365 E5 Setup page where you should personalize your sign-in and email" lightbox="../../media/mtp-eval-16.png":::- + 9. Add a TXT or MX record to validate the domain ownership. Once you've added the TXT or MX record to your domain, select **Verify**. :::image type="content" source="../../media/mtp-eval-17.png" alt-text="The Office 365 E5 setup page where you should add a TXT of MX record to verify your domain" lightbox="../../media/mtp-eval-17.png":::- + 10. [Optional] Create more user accounts for your tenant. You can skip this step by clicking **Next**. :::image type="content" source="../../media/mtp-eval-18.png" alt-text="The Office 365 E5 setup page where you can add more users" lightbox="../../media/mtp-eval-18.png":::- -11. [Optional] Download Office apps. Click **Next** to skip this step. ++11. [Optional] Download Office apps. Click **Next** to skip this step. :::image type="content" source="../../media/mtp-eval-19.png" alt-text="The Office 365 E5 page where you can install your Office apps" lightbox="../../media/mtp-eval-19.png"::: 12. [Optional] Migrate email messages. Again, you can skip this step. :::image type="content" source="../../media/mtp-eval-20.png" alt-text="The Office 365 E5 where you can set whether to migrate email messages or not" lightbox="../../media/mtp-eval-20.png":::- -13. Choose online services. Select **Exchange** and click **Next**. ++13. Choose online services. Select **Exchange** and click **Next**. :::image type="content" source="../../media/mtp-eval-21.png" alt-text="The Office 365 E5 where you can choose your online services" lightbox="../../media/mtp-eval-21.png"::: 14. Add MX, CNAME, and TXT records to your domain. When completed, select **Verify**. :::image type="content" source="../../media/mtp-eval-22.png" alt-text="The Office 365 E5 here you can add your DNS records" lightbox="../../media/mtp-eval-22.png":::- + 15. Congratulations, you have completed the provisioning of your Office 365 tenant. :::image type="content" source="../../media/mtp-eval-23.png" alt-text="The Office 365 E5 setup completion confirmation page" lightbox="../../media/mtp-eval-23.png":::- ## Enable Microsoft 365 trial subscription ->[!NOTE] ->Signing up for a trial gives you 25 user licenses to use for a month. See [Try or buy a Microsoft 365 subscription](../../commerce/try-or-buy-microsoft-365.md) for details. +> [!NOTE] +> Signing up for a trial gives you 25 user licenses to use for a month. See [Try or buy a Microsoft 365 subscription](../../commerce/try-or-buy-microsoft-365.md) for details. 1. From [Microsoft 365 Admin Center](https://admin.microsoft.com/), click **Billing** and then navigate to **Purchase services**. -2. Select **Microsoft 365 E5** and click **Start free trial**. +2. Select **Microsoft 365 E5** and click **Start free trial**. :::image type="content" source="../../media/mtp-eval-24.png" alt-text="The Microsoft 365 E5 Start free trial page" lightbox="../../media/mtp-eval-24.png"::: 3. Choose your verification preference: through a text message or call. Once you have decided, enter the phone number, select **Text me** or **Call me** depending on your selection. :::image type="content" source="../../media/mtp-eval-25.png" alt-text="The Microsoft 365 E5 Start free trial page asking for contact details to send code to prove you are not a robot" lightbox="../../media/mtp-eval-25.png":::- + 4. Enter the verification code and click **Start your free trial**. :::image type="content" source="../../media/mtp-eval-26.png" alt-text="The Microsoft 365 E5 Start free trial page where you can fill out verification code the system sent to prove you are not a robot" lightbox="../../media/mtp-eval-26.png"::: This topic guides you to set up a dedicated lab environment. For information on 5. Click **Try now** to confirm your Microsoft 365 E5 trial. :::image type="content" source="../../media/mtp-eval-27.png" alt-text="The Microsoft 365 E5 Start free trial page where you should clock the Try now button to start" lightbox="../../media/mtp-eval-27.png":::- + 6. Go to the **Microsoft 365 Admin Center** > **Users** > **Active users**. Select your user account, select **Manage product licenses**, then swap the license from Office 365 E5 to **Microsoft 365 E5**. Click **Save**. :::image type="content" source="../../media/mtp-eval-28.png" alt-text="The Microsoft 365 Admin Center page where you can select the Microsoft 365 E5 license" lightbox="../../media/mtp-eval-28.png":::- + 7. Select the global administrator account again then click **Manage username**. :::image type="content" source="../../media/mtp-eval-29.png" alt-text="The Microsoft 365 Admin Center page where you can select Account and Manage username" lightbox="../../media/mtp-eval-29.png"::: This topic guides you to set up a dedicated lab environment. For information on :::image type="content" source="../../media/mtp-eval-30.png" alt-text="The Microsoft 365 Admin Center page where you can change your domain preference" lightbox="../../media/mtp-eval-30.png"::: ## Next step+ |[Phase 3: Configure & Onboard](config-m365d-eval.md) | Configure each Microsoft 365 Defender pillar for your Microsoft 365 Defender trial lab or pilot environment and onboard your endpoints. |:-|:--| |
| security | Threat Analytics Analyst Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/threat-analytics-analyst-reports.md | The analyst report also provides the detections from Microsoft Defender Antiviru These detections are available on devices with [Microsoft Defender Antivirus](/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) turned on. When these detections occur on devices that have been onboarded to Microsoft Defender for Endpoint, they also trigger alerts that light up the charts in the report. ->[!NOTE] ->The analyst report also lists **generic detections** that can identify a wide-range of threats, in addition to components or behaviors specific to the tracked threat. These generic detections don't reflect in the charts. +> [!NOTE] +> The analyst report also lists **generic detections** that can identify a wide-range of threats, in addition to components or behaviors specific to the tracked threat. These generic detections don't reflect in the charts. ### Endpoint detection and response (EDR) alerts While detections allow you to identify and stop the tracked threat automatically Advanced hunting queries in the analyst reports have been vetted by Microsoft analysts and are ready for you to run in the [advanced hunting query editor](https://security.microsoft.com/advanced-hunting). You can also use the queries to create [custom detection rules](custom-detection-rules.md) that trigger alerts for future matches. ->[!NOTE] +> [!NOTE] > Threat analytics is also available in [Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/threat-analytics). However, it does not have the data integration between Microsoft Defender for Office and Microsoft Defender for Endpoint. ## Related topics |
| security | Threat Analytics | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/threat-analytics.md | Threat analytics is our in-product threat intelligence solution from expert Micr Watch this short video to learn more about how threat analytics can help you track the latest threats and stop them. ->[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWwJfU] +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWwJfU] You can access threat analytics either from the upper left-hand side of Microsoft 365 security portal's navigation bar, or from a dedicated dashboard card that shows the top threats to your org, both in terms of impact, and in terms of exposure. |
| security | Tickets | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/tickets.md | Last updated 02/16/2021 [!INCLUDE [Microsoft 365 Defender rebranding](../includes/microsoft-defender.md)] ->[!CAUTION] ->**The preview period for the ServiceNow connector has ended**<br> ->This capability is no longer available. Thank you for your feedback and continued support while we determine next steps. +> [!CAUTION] +> **The preview period for the ServiceNow connector has ended** +> +> This capability is no longer available. Thank you for your feedback and continued support while we determine next steps. ServiceNow is a popular cloud computing platform that helps companies manage digital workflows for enterprise operations. Their Now platform has IT workflows, employee workflows, and customer workflows. |
| security | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/whats-new.md | For more information on what's new with other Microsoft Defender security produc You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter). ## March 2023--+- (Preview) Complete device reports for the [`DeviceInfo` table](advanced-hunting-deviceinfo-table.md) in advanced hunting are now sent *every hour* (instead of the previous daily cadence). In addition, complete device reports are also sent whenever there is a change to any previous report. New columns were also added to the `DeviceInfo` table, along with several improvements to existing data in `DeviceInfo` and [DeviceNetworkInfo](advanced-hunting-devicenetworkinfo-table.md) tables. - (Preview) Near real-time custom detection is now available for public preview in advanced hunting custom detections. There is a new [Continuous (NRT)](custom-detection-rules.md) frequency, which checks data from events as they are collected and processed in near real-time. ## February 2023 |
| security | Criteria | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/intelligence/criteria.md | You can assist Microsoft by [submitting unknown or suspicious software for analy The next sections provide an overview of the classifications we use for applications and the types of behaviors that lead to that classification. ->[!NOTE] +> [!NOTE] > New forms of malware and potentially unwanted applications are being developed and distributed rapidly. The following list may not be comprehensive, and Microsoft reserves the right to adjust, expand, and update these without prior notice or announcement. ## Unknown ΓÇô Unrecognized software |
| security | Microsoft 365 Zero Trust | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/microsoft-365-zero-trust.md | Use this article together with this poster. | Item | Description | |:--|:--|-|[</li></ul> +|[</li></ul> ## Zero Trust security architecture In this illustration: - Threat protection capabilities are built on top of this foundation to provide real-time monitoring and remediation of security threats. - Information protection and governance provide sophisticated controls targeted at specific types of data to protect your most valuable information and to help you comply with compliance standards, including protecting personal information. - This article assumes you have already configured cloud identity. If you need guidance for this objective, see [**Deploy your identity infrastructure for Microsoft 365**](/microsoft-365/enterprise/deploy-identity-solution-overview). ## Step 1. Configure Zero Trust identity and device access protection ΓÇö starting-point policies |
| security | Anti Phishing Policies About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-policies-about.md | description: Admins can learn about the anti-phishing policies that are availabl search.appverid: met150 Previously updated : 3/2/2023 Last updated : 3/13/2023 # Anti-phishing policies in Microsoft 365 User impersonation protection prevents specific internal or external email addre You can use protected users to add internal and external sender email addresses to protect from impersonation. This list of **senders** that are protected from user impersonation is different from the list of **recipients** that the policy applies to (all recipients for the default policy; specific recipients as configured in the **Users, groups, and domains** setting in the [Common policy settings](#common-policy-settings) section). > [!NOTE]+> You can specify a maximum of 350 users for user impersonation protection in each anti-phishing policy. >-> - In each anti-phishing policy, you can specify a maximum of 350 protected users (sender email addresses). You can't specify the same protected user in multiple policies. So, regardless of how many policies apply to a recipient, the maximum number of protected users (sender email addresses) for each individual recipient is 350. For more information about policy priority and how policy processing stops after the first policy is applied, see [Order and precedence of email protection](how-policies-and-protections-are-combined.md). -> - User impersonation protection does not work if the sender and recipient have previously communicated via email. If the sender and recipient have never communicated via email, the message can be identified as an impersonation attempt. +> User impersonation protection does not work if the sender and recipient have previously communicated via email. If the sender and recipient have never communicated via email, the message can be identified as an impersonation attempt. +> +> You might get the error "The email address already exists" if you try to add a user to user impersonation protection when that email address is already specified for user impersonation protection in another anti-phishing policy. This error occurs only in the Defender portal. You won't get the error if you use the corresponding _TargetedUsersToProtect_ parameter in the **New-AntiPhishPolicy** or **Set-AntiPhishPolicy** cmdlets in Exchange Online PowerShell. By default, no sender email addresses are configured for impersonation protection, either in the default policy or in custom policies. For detected user impersonation attempts, the following actions are available: Domain impersonation protection prevents specific domains **in the sender's email address** from being impersonated. For example, all domains that you own ([accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains)) or specific custom domains (domains you own or partner domains). **Sender domains** that are protected from impersonation is different from the list of **recipients** that the policy applies to (all recipients for the default policy; specific recipients as configured in the **Users, groups, and domains** setting in the [Common policy settings](#common-policy-settings) section). > [!NOTE]-> You can specify a maximum of 50 custom domains in each anti-phishing policy. +> You can specify a maximum of 50 custom domains for domain impersonation protection in each anti-phishing policy. Messages from **senders** in the specified domains are subject to impersonation protection checks. The message is checked for impersonation **if** the message is sent to a **recipient** that the policy applies to (all recipients for the default policy; **Users, groups, and domains** recipients in custom policies). If impersonation is detected in the domain of the sender's email address, the action for domain impersonation is applied to the message. For detected domain impersonation attempts, the following actions are available: - **Don't apply any action**: This is the default value. - **Redirect message to other email addresses**: Sends the message to the specified recipients instead of the intended recipients. - **Move messages to the recipients' Junk Email folders**: The message is delivered to the mailbox and moved to the Junk Email folder. For more information, see [Configure junk email settings on Exchange Online mailboxes in Microsoft 365](configure-junk-email-settings-on-exo-mailboxes.md).- + - **Quarantine the message**: Sends the message to quarantine instead of the intended recipients. For information about quarantine, see the following articles: - [Quarantine in Microsoft 365](quarantine-email-messages.md) - [Manage quarantined messages and files as an admin in Microsoft 365](manage-quarantined-messages-and-files.md) For impersonation attempts detected by mailbox intelligence, the following actio - **Quarantine the message**: If you select this action, you can also select the quarantine policy that applies to messages that are quarantined by mailbox intelligence protection. Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. For more information, see [Quarantine policies](quarantine-policies.md). - **Deliver the message and add other addresses to the Bcc line** - **Delete the message before it's delivered**- + #### Impersonation safety tips Impersonation safety tips appear to users when messages are identified as impersonation attempts. The following safety tips are available: Impersonation safety tips appear to users when messages are identified as impers Trusted senders and domain are exceptions to the impersonation protection settings. Messages from the specified senders and sender domains are never classified as impersonation-based attacks by the policy. In other words, the action for protected senders, protected domains, or mailbox intelligence protection aren't applied to these trusted senders or sender domains. The maximum limit for these lists is 1024 entries. > [!NOTE]+> Trusted domain entries don't include subdomains of the specified domain. You need to add an entry for each subdomain. >-> - Trusted domain entries don't include subdomains of the specified domain. You need to add an entry for each subdomain. +> If Microsoft 365 system messages from the following senders are identified as impersonation attempts, you can add the senders to the trusted senders list: >-> - If Microsoft 365 system messages from the following senders are identified as impersonation attempts, you can add the senders to the trusted senders list: -> - `noreply@email.teams.microsoft.com` -> - `noreply@emeaemail.teams.microsoft.com` -> - `no-reply@sharepointonline.com` +> - `noreply@email.teams.microsoft.com` +> - `noreply@emeaemail.teams.microsoft.com` +> - `no-reply@sharepointonline.com` ### Advanced phishing thresholds in anti-phishing policies in Microsoft Defender for Office 365 |
| security | Anti Phishing Policies Mdo Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure.md | description: Admins can learn how to create, modify, and delete the advanced ant search.appverid: met150 Previously updated : 11/30/2022 Last updated : 3/13/2023 # Configure anti-phishing policies in Microsoft Defender for Office 365 Creating a custom anti-phishing policy in the Microsoft 365 Defender portal crea - **Impersonation**: These settings are a condition for the policy that identifies specific senders to look for (individually or by domain) in the From address of inbound messages. For more information, see [Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365). - > [!NOTE] - > In each anti-phishing policy, you can specify a maximum of 350 protected users (sender email addresses). You can't specify the same protected user in multiple policies. - - **Enable users to protect**: The default value is off (not selected). To turn it on, select the check box, and then click the **Manage (nn) sender(s)** link that appears. In the **Manage senders for impersonation protection** flyout that appears, do the following steps: Creating a custom anti-phishing policy in the Microsoft 365 Defender portal crea When you're finished, click **Add** + > [!NOTE] + > You can specify a maximum of 350 users for user impersonation protection in each anti-phishing policy. + > + > User impersonation protection does not work if the sender and recipient have previously communicated via email. If the sender and recipient have never communicated via email, the message can be identified as an impersonation attempt. + > + > You might get the error "The email address already exists" if you try to add a user to user impersonation protection when that email address is already specified for user impersonation protection in another anti-phishing policy. This error occurs only in the Defender portal. You won't get the error if you use the corresponding _TargetedUsersToProtect_ parameter in the **New-AntiPhishPolicy** or **Set-AntiPhishPolicy** cmdlets in Exchange Online PowerShell. + Back on the **Manage senders for impersonation** flyout, you can remove entries by selecting one or more entries from the list. You can search for entries using the  **Search** box. After you select at least one entry, the  **Remove selected users** icon appears, which you can use to remove the selected entries. Creating a custom anti-phishing policy in the Microsoft 365 Defender portal crea When you're finished, click **Add domains** > [!NOTE]- > You can specify a maximum of 50 custom domains in each anti-phishing policy. + > You can specify a maximum of 50 custom domains for domain impersonation protection in each anti-phishing policy. Back on the **Manage custom domains for impersonation** flyout, you can remove entries by selecting one or more entries from the list. You can search for entries using the  **Search** box. Creating a custom anti-phishing policy in the Microsoft 365 Defender portal crea When you're finished, click **Add**. > [!NOTE]+ > Trusted domain entries don't include subdomains of the specified domain. You need to add an entry for each subdomain. >- > - If Microsoft 365 system messages from the following senders are identified as impersonation attempts, you can add the senders to the trusted senders list: - > - `noreply@email.teams.microsoft.com` - > - `noreply@emeaemail.teams.microsoft.com` - > - `no-reply@sharepointonline.com` + > If Microsoft 365 system messages from the following senders are identified as impersonation attempts, you can add the senders to the trusted senders list: >- > - Trusted domain entries don't include subdomains of the specified domain. You need to add an entry for each subdomain. + > - `noreply@email.teams.microsoft.com` + > - `noreply@emeaemail.teams.microsoft.com` + > - `no-reply@sharepointonline.com` Back on the **Manage custom domains for impersonation** flyout, you can remove entries from the **Sender** and **Domain** tabs by selecting one or more entries from the list. You can search for entries using the  **Search** box. |
| security | Attack Simulation Training Simulations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-simulations.md | On the **Target users** page, select who will receive the simulation. Configure - **Include only specific users and groups**: Choose one of the following options: -  **Add users**: In the **Add users** flyout that appears, you can find users and groups based on the following criteria: - > [!NOTE] - > You can't use dynamic distribution groups to target users. + > [!NOTE] + > You can't use dynamic distribution groups to target users. - **Search for users or groups**: In box, you can type part of the **Name** or **Email address** of the user or group and then press Enter. You can select some or all of the results. When you're finished, click **Add x users**. |
| security | Defender For Office 365 Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/defender-for-office-365-whats-new.md | For more information on what's new with other Microsoft Defender security produc - Items in the Office 365 Security & Compliance Center that aren't related to security aren't redirected to Microsoft 365 Defender. For compliance solutions redirection to Microsoft 365 Compliance Center, see Message Center post 244886. - This is a continuation of [Microsoft 365 Defender delivers unified XDR experience to GCC, GCC High and DoD customers - Microsoft Tech Community](https://techcommunity.microsoft.com/t5/public-sector-blog/microsoft-365-defender-delivers-unified-xdr-experience-to-gcc/ba-p/3263702), announced in March 2022. - This change enables users to view and manage additional Microsoft 365 Defender security solutions in one portal.-- This change impacts all customers who use the Office 365 Security & Compliance Center (protection.office.com), including Microsoft Defender for Office (Plan 1 or Plan 2), Microsoft 365 E3 / E5, Office 365 E3/ E5, and Exchange Online Protection. For the full list, see [Security & Compliance Center - Service Descriptions | Microsoft Docs](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance)+- This change impacts all customers who use the Office 365 Security & Compliance Center (protection.office.com), including Microsoft Defender for Office (Plan 1 or Plan 2), Microsoft 365 E3 / E5, Office 365 E3/ E5, and Exchange Online Protection. For the full list, see [Microsoft 365 guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance) - This change impacts all users who log in to the Office 365 Security and Compliance portal (protection.office.com), including security teams and end-users who access the Email Quarantine experience, at the **Microsoft Defender Portal** > **Review** > **Quarantine**. - Redirection is enabled by default and impacts all users of the Tenant. - Global Administrators and Security Administrators can turn on or off redirection in the Microsoft 365 Defender portal by navigating to **Settings** > **Email & collaboration** > **Portal redirection** and switch the redirection toggle. |
| security | Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/defender-for-office-365.md | Last updated 01/31/2023 # Microsoft Defender for Office 365 > [!IMPORTANT]->If your browser is being blocked by Safe Links and Safe Attachment pages, see [Advanced Outlook.com security for Microsoft 365 subscribers](https://support.microsoft.com/office/advanced-outlook-com-security-for-microsoft-365-subscribers-882d2243-eab9-4545-a58a-b36fee4a46e2?storagetype=live). +> If your browser is being blocked by Safe Links and Safe Attachment pages, see [Advanced Outlook.com security for Microsoft 365 subscribers](https://support.microsoft.com/office/advanced-outlook-com-security-for-microsoft-365-subscribers-882d2243-eab9-4545-a58a-b36fee4a46e2?storagetype=live). [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] |
| security | Email Analysis Investigations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-analysis-investigations.md | Here are additional enhancements to email analysis in investigations. During the email clustering analysis, all clustering queries will ignore security mailboxes set up as Security Operations mailboxes in the Advanced Delivery policy. Similarly, the email clustering queries will ignore phish simulation (education) messages that are configured in the Advanced Delivery policy. Neither the SecOps nor the PhishEdu exclusion values are shown in the query to keep the clustering attributes simple and easy to read. This exclusion ensures that threat intelligence and operational mailboxes (SecOps mailboxes) and the phish simulations (PhishEdu) are ignored during threat analysis and do not get removed during any remediation. ->[!Note] ->When opening an email cluster to view it in Explorer from the email cluster details, the PhishEdu and SecOps mailbox filters will be applied in Explorer but will not be shown. If you change the Explorer filters, dates, or refresh the query within the page ΓÇô then the PhishEdu/SecOps filter exclusions will get removed and emails that match these will be shown once again. If you refresh the Explorer page using the browser refresh function, the original query filters will get re-loaded, including the PhishEdu/SecOps filters ΓÇô but removing any subsequent changes you had made. -> +> [!NOTE] +> When opening an email cluster to view it in Explorer from the email cluster details, the PhishEdu and SecOps mailbox filters will be applied in Explorer but will not be shown. If you change the Explorer filters, dates, or refresh the query within the page ΓÇô then the PhishEdu/SecOps filter exclusions will get removed and emails that match these will be shown once again. If you refresh the Explorer page using the browser refresh function, the original query filters will get re-loaded, including the PhishEdu/SecOps filters ΓÇô but removing any subsequent changes you had made. ## AIR updates pending email action status |
| security | Email Authentication Dkim Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-authentication-dkim-configure.md | DKIM lets you add a digital signature to outbound email messages in the message In basic, a private key encrypts the header in a domain's outgoing email. The public key is published in the domain's DNS records, and receiving servers can use that key to decode the signature. DKIM verification helps the receiving servers confirm the mail is really coming from your domain and not someone *spoofing* your domain. > [!TIP]->You can choose to do nothing about DKIM for your custom domain too. If you don't set up DKIM for your custom domain, Microsoft 365 creates a private and public key pair, enables DKIM signing, and then configures the Microsoft 365 default policy for your custom domain. +> You can choose to do nothing about DKIM for your custom domain too. If you don't set up DKIM for your custom domain, Microsoft 365 creates a private and public key pair, enables DKIM signing, and then configures the Microsoft 365 default policy for your custom domain. Microsoft-365's built-in DKIM configuration is sufficient coverage for most customers. However, you should manually configure DKIM for your custom domain in the following circumstances: |
| security | Identity Access Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/identity-access-policies.md | Conditional Access policies may be assigned to users, groups, and administrator Here's an example of group assignment and exclusions for requiring MFA after your users have completed [user registration](#user-registration). -|| Azure AD Conditional Access policy | Include | Exclude | -| | | | | -| **Starting point**| Require multifactor authentication for medium or high sign-in risk | *All users* | - Emergency access accounts <br> - Conditional Access exclusion group | -| **Enterprise**| Require multifactor authentication for low, medium, or high sign-in risk | *Executive staff group* | - Emergency access accounts <br> - Conditional Access exclusion group | -| **Specialized security**| Require multifactor authentication always | *Top Secret Project Buckeye group* | - Emergency access accounts <br> - Conditional Access exclusion group | +| |Azure AD Conditional Access policy|Include|Exclude| +||||| +|**Starting point**|Require multifactor authentication for medium or high sign-in risk|*All users*|<ul><li>Emergency access accounts</li><li>Conditional Access exclusion group</li></ul>| +|**Enterprise**|Require multifactor authentication for low, medium, or high sign-in risk|*Executive staff group*|<ul><li>Emergency access accounts</li><li>Conditional Access exclusion group</li></ul>| +|**Specialized security**|Require multifactor authentication always|*Top Secret Project Buckeye group*|<ul><li>Emergency access accounts</li><li>Conditional Access exclusion group</li></ul>| Be careful when applying higher levels of protection to groups and users. **The goal of security isn't to add unnecessary friction** to the user experience. For example, members of the *Top Secret Project Buckeye group* will be required to use MFA every time they sign in, even if they aren't working on the specialized security content for their project. Excessive security friction can lead to fatigue. We recommend implementing the [starting point policies](#starting-point) in the ### Starting point -| Policy | More information | Licensing | +|Policy|More information|Licensing| ||||-| [Require MFA when sign-in risk is *medium* or *high*](#require-mfa-based-on-sign-in-risk) | Use risk data from Azure AD Identity Protection to require MFA only when risk is detected | Microsoft 365 E5 or Microsoft 365 E3 with the E5 Security add-on | -| [Block clients that don't support modern authentication](#block-clients-that-dont-support-multifactor-authentication) | Clients that don't use modern authentication can bypass Conditional Access policies, so it's important to block them. | Microsoft 365 E3 or E5 | -| [High risk users must change password](#high-risk-users-must-change-password) | Forces users to change their password when signing in if high-risk activity is detected for their account. | Microsoft 365 E5 or Microsoft 365 E3 with the E5 Security add-on | -| [Apply application protection policies for data protection](#app-protection-policies) | One Intune app protection policy per platform (Windows, iOS/iPadOS, Android). | Microsoft 365 E3 or E5 | -| [Require approved apps and app protection policies](#require-approved-apps-and-app-protection-policies) | Enforces mobile app protection policies for phones and tablets using iOS, iPadOS, or Android. | Microsoft 365 E3 or E5 | +|[Require MFA when sign-in risk is *medium* or *high*](#require-mfa-based-on-sign-in-risk)|Use risk data from Azure AD Identity Protection to require MFA only when risk is detected|Microsoft 365 E5 or Microsoft 365 E3 with the E5 Security add-on| +|[Block clients that don't support modern authentication](#block-clients-that-dont-support-multifactor-authentication)|Clients that don't use modern authentication can bypass Conditional Access policies, so it's important to block them.|Microsoft 365 E3 or E5| +|[High risk users must change password](#high-risk-users-must-change-password)|Forces users to change their password when signing in if high-risk activity is detected for their account.|Microsoft 365 E5 or Microsoft 365 E3 with the E5 Security add-on| +|[Apply application protection policies for data protection](#app-protection-policies)|One Intune app protection policy per platform (Windows, iOS/iPadOS, Android).|Microsoft 365 E3 or E5| +|[Require approved apps and app protection policies](#require-approved-apps-and-app-protection-policies)|Enforces mobile app protection policies for phones and tablets using iOS, iPadOS, or Android.|Microsoft 365 E3 or E5| ### Enterprise -| Policy | More information | Licensing | +|Policy|More information|Licensing| ||||-| [Require MFA when sign-in risk is *low*, *medium*, or *high*](#require-mfa-based-on-sign-in-risk) | Use risk data from Azure AD Identity Protection to require MFA only when risk is detected | Microsoft 365 E5 or Microsoft 365 E3 with the E5 Security add-on | -| [Define device compliance policies](#device-compliance-policies) | Set minimum configuration requirements. One policy for each platform. | Microsoft 365 E3 or E5 | -| [Require compliant PCs and mobile devices](#require-compliant-pcs-and-mobile-devices) | Enforces the configuration requirements for devices accessing your organization | Microsoft 365 E3 or E5 | +|[Require MFA when sign-in risk is *low*, *medium*, or *high*](#require-mfa-based-on-sign-in-risk)|Use risk data from Azure AD Identity Protection to require MFA only when risk is detected|Microsoft 365 E5 or Microsoft 365 E3 with the E5 Security add-on| +|[Define device compliance policies](#device-compliance-policies)|Set minimum configuration requirements. One policy for each platform.|Microsoft 365 E3 or E5| +|[Require compliant PCs and mobile devices](#require-compliant-pcs-and-mobile-devices)|Enforces the configuration requirements for devices accessing your organization|Microsoft 365 E3 or E5| ### Specialized security -| Policy | More information | Licensing | +|Policy|More information|Licensing| ||||-| [*Always* require MFA](#always-require-mfa) | Users must perform MFA anytime they sign in to your organizations services | Microsoft 365 E3 or E5 | +|[*Always* require MFA](#always-require-mfa)|Users must perform MFA anytime they sign in to your organizations services|Microsoft 365 E3 or E5| ## App protection policies The following settings are configured in **Step 2: Compliance settings**, of the For **Device health > Windows Health Attestation Service evaluation rules**, see this table. -| Property | Value | +|Property|Value| |||-| Require BitLocker | Require | -| Require Secure Boot to be enabled on the device | Require | -| Require code integrity | Require | +|Require BitLocker|Require| +|Require Secure Boot to be enabled on the device|Require| +|Require code integrity|Require| For **Device properties**, specify appropriate values for operating system versions based on your IT and security policies. For **Configuration Manager Compliance**, if you are in a co-managed environment For **System security**, see this table. -| Property | Value | +|Property|Value| |||-| Require a password to unlock mobile devices | Require | -| Simple passwords | Block | -| Password type | Device default | -| Minimum password length | 6 | -| Maximum minutes of inactivity before password is required | 15 minutes | -| Password expiration (days) | 41 | -| Number of previous passwords to prevent reuse | 5 | -| Require password when device returns from idle state (Mobile and Holographic) | Require | -| Require encryption of data storage on device | Require | -| Firewall | Require | -| Antivirus | Require | -| Antispyware | Require | -| Microsoft Defender Antimalware | Require | -| Microsoft Defender Antimalware minimum version | Microsoft recommends versions no more than five behind from the most recent version. | -| Microsoft Defender Antimalware signature up to date | Require | -| Real-time protection | Require | +|Require a password to unlock mobile devices|Require| +|Simple passwords|Block| +|Password type|Device default| +|Minimum password length|6| +|Maximum minutes of inactivity before password is required|15 minutes| +|Password expiration (days)|41| +|Number of previous passwords to prevent reuse|5| +|Require password when device returns from idle state (Mobile and Holographic)|Require| +|Require encryption of data storage on device|Require| +|Firewall|Require| +|Antivirus|Require| +|Antispyware|Require| +|Microsoft Defender Antimalware|Require| +|Microsoft Defender Antimalware minimum version|Microsoft recommends versions no more than five behind from the most recent version.| +|Microsoft Defender Antimalware signature up to date|Require| +|Real-time protection|Require| For **Microsoft Defender for Endpoint** -| Property | Value | +|Property|Value| |||-| [Require the device to be at or under the machine-risk score](/mem/intune/protect/advanced-threat-protection-configure#create-and-assign-compliance-policy-to-set-device-risk-level) | Medium | +|[Require the device to be at or under the machine-risk score](/mem/intune/protect/advanced-threat-protection-configure#create-and-assign-compliance-policy-to-set-device-risk-level)|Medium| ## Conditional Access policies Follow the guidance in the article [Common Conditional Access policy: Sign-in ri When configuring your policy, use the following risk levels. -| Level of protection | Risk level values needed | Action | +|Level of protection|Risk level values needed|Action| ||||-| Starting point | High, medium | Check both. | -| Enterprise | High, medium, low | Check all three. | +|Starting point|High, medium|Check both.| +|Enterprise|High, medium, low|Check all three.| ### Block clients that don't support multifactor authentication |
| security | Identity Access Prerequisites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/identity-access-prerequisites.md | Title: Prerequisite work for implementing identity and device access policies - Microsoft 365 for enterprise | Microsoft Docs + Title: Prerequisite work for implementing Zero Trust identity and device access policies description: This article describes the prerequisites you need to meet to use Zero Trust identity and device access policies and configurations. |
| security | Mdo Data Retention | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-data-retention.md | f1.keywords: Previously updated : 1/31/2023 Last updated : 3/9/2023 audience: ITPro -description: Microsoft Defender for Office 365 data retention informationThreat Explorer/ Real-Time detections +description: Admins can learn how long Defender for Office 365 features retain data. search.appverid: met150 search.appverid: met150 By default, data across different features is retained for a maximum of 30 days. However, for some of the features, you can specify the retention period based on policy. See the following table for the different retention periods for each feature. > [!NOTE]-> Microsoft Defender for Office 365 comes in two different Plan types. You can tell if you have **Plan 1** if you have 'Real-time Detections', and **Plan 2**, if you have Threat Explorer. The Plan you have influences the tools you will see, so be certain that you're aware of your Plan as you learn. +> Microsoft Defender for Office 365 comes in two different subscriptions: **Plan 1** and **Plan 2**. If you have **Threat Explorer** at <https://security.microsoft.com/threatexplorer>, you have Plan 2. Otherwise, you have **Real-time Detections** at <https://security.microsoft.com/realtimereports> as part of **Plan 1**. +> +> Your Defender for Office 365 subscription affects the tools that are available to you, so make sure you know which subscription you have as you learn. ## Defender for Office 365 Plan 1 |Feature|Retention period| |||-|Alert metadata details (Microsoft Defender for Office alerts) | 90 days | -|Entity metadata details (Emails) | 30 days | -|Activity alert details (audit logs) | 7 days | -|Email entity page | 30 days | -|Quarantine | 30 days (configurable up to 30 days maximum) | -|Reports | 90 days (for all aggregated data) <br>30 days (for all detailed information except below) <br> 10 days (for Threat protection status report detail and spoof mail report details) <br> 7 days (for URL protection report details) <br> -|Submissions | 30 days | -|Threat Explorer/ Real-Time detections | 30 days | +|Alert metadata details (Microsoft Defender for Office alerts)|90 days.| +|Entity metadata details (Email)|30 days.| +|Activity alert details (audit logs)|7 days.| +|Email entity page|30 days.| +|Quarantine|30 days (configurable; 30 days is the maximum).| +|Reports|90 days for aggregated data. <br/><br/> 30 days for detailed information.| +|Submissions|30 days.| +|Real-Time detections|30 days.| ## Defender for Office 365 Plan 2 Defender for Office 365 Plan 1 capabilities, plus: |Feature|Retention period| |||-|Action Center | 180 days, 30 days (Office Action center) | -|Advanced Hunting | 30 days | -|AIR (Automated Investigation and Response) | 60 days (for investigations meta data)<br> 30 days (for email meta data) | -|Attack Simulation Data | 18 months | -|Campaigns | 30 days | -|Incidents | 30 days| -|Remediation | 30 days | -|Threat Analytics | 30 days | -|Threat Trackers | 30 days | +|Action Center|180 days. <br/><br/> Office Action Center 30 days.| +|Advanced Hunting|30 days.| +|AIR (Automated investigation and response)|60 days for investigations metadata. <br/><br/> 30 days for email metadata.| +|Attack simulation training data|18 months.| +|Campaigns|30 days.| +|Incidents|30 days.| +|Remediation|30 days| +|Threat Analytics|30 days.| +|Threat Explorer|30 days.| +|Threat Trackers|30 days.| |
| security | Preset Security Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/preset-security-policies.md | You might want to apply the **Standard** or **Strict** preset security policies > [!NOTE] > All recipients automatically receive impersonation protection from [mailbox intelligence](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365) in preset security policies.+ > + > You can specify a maximum of 350 users for user impersonation protection in the Standard or Strict preset security policy. + > + > User impersonation protection does not work if the sender and recipient have previously communicated via email. If the sender and recipient have never communicated via email, the message can be identified as an impersonation attempt. Each entry consists of a display name and an email address. Enter each value in the boxes and then click **Add**. Repeat this step as many times as necessary. - You can specify a maximum of 350 users, and you can't specify the same user in the user impersonation protection settings in multiple policies. - To remove an existing entry from the list, click . When you're finished, click **Next**. You might want to apply the **Standard** or **Strict** preset security policies > [!NOTE] > All domains that you own ([accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains)) automatically receive domain impersonation protection in preset security policies.+ > + > You can specify a maximum of 50 custom domains for domain impersonation protection in the Standard or Strict preset security policy. All senders in the specified domains are protected by domain impersonation protection. You might want to apply the **Standard** or **Strict** preset security policies To remove an existing entry from the list, select the entry, and then click . - The maximum number of domains that you can specify for domain impersonation protection in all anti-phishing policies is 50. - When you're finished, click **Next**. 8. On the **Add trusted email addresses and domains to not flag as impersonation** page, enter the sender email addresses and domains that you want excluded from impersonation protection. Messages from these senders will never be flagged as an impersonation attack, but the senders are still subject to scanning by other filters in EOP and Defender for Office 365. + > [!NOTE] + > Trusted domain entries don't include subdomains of the specified domain. You need to add an entry for each subdomain. + Enter the email address or domain in the box, and then click **Add**. Repeat this step as many times as necessary. To remove an existing entry from the list, select the entry, and then click . |
| security | Quarantine Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-policies.md | In _supported_ protection features that quarantine email messages, you can assig | User impersonation (_TargetedUserProtectionAction_)|Yes (_TargetedUserQuarantineTag_)| | Domain impersonation (_TargetedDomainProtectionAction_)|Yes (_TargetedDomainQuarantineTag_)| | Mailbox intelligence impersonation (_MailboxIntelligenceProtectionAction_)|Yes (_MailboxIntelligenceQuarantineTag_)|-|**[Anti-malware policies](anti-malware-policies-configure.md)**|Yes ( _QuarantineTag_)| +|**[Anti-malware policies](anti-malware-policies-configure.md)**|Yes (_QuarantineTag_)| |**[Safe Attachments protection](safe-attachments-about.md)**|| | Email messages with attachments that are quarantined as malware by Safe Attachments policies (_Enable_ and _Action_)|Yes (_QuarantineTag_)| | Files that are quarantined as malware by [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](safe-attachments-for-spo-odfb-teams-about.md)|No| |
| security | Recover From Ransomware | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/recover-from-ransomware.md | Microsoft Azure: Microsoft Defender for Cloud Apps: -- [Create anomaly detection policies in Defender for Cloud Apps](/cloud-app-security/anomaly-detection-policy)+- [Create anomaly detection policies in Defender for Cloud Apps](/cloud-app-security/anomaly-detection-policy) Microsoft Security team blog posts: |
| security | Reports Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/reports-defender-for-office-365.md | To view the report, open the [Microsoft 365 Defender portal](https://security.mi The available views on the **URL protection** report page are described in the following sections. -> [!NOTE] -> This is a *protection trend report*, meaning data represents trends in a larger dataset. As a result, the data in the charts is not available in real time here, but the data in the details table is, so you may see a slight discrepancy between the two. The charts are refreshed once every four hours and contain data for the last 90 days. For detailed real-time information, see [View phishing URL and click verdict data](threat-explorer-about.md#view-phishing-url-and-click-verdict-data). - ### View data by URL click protection action :::image type="content" source="../../media/url-threat-protection-report-url-click-protection-action-view.png" alt-text="The view namely URL click protection action in the URL protection report" lightbox="../../media/url-threat-protection-report-url-click-protection-action-view.png"::: If you click **Filters**, you can modify the report and the details table by sel When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. -The details table below the chart provides the following near-real-time view of all clicks that happened within the organization for the last 7 days: +The details table below the chart provides the following near-real-time view of all clicks that happened within the organization for the last 30 days: - **Click time** - **User** |
| security | Siem Integration With Office 365 Ti | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/siem-integration-with-office-365-ti.md | The SIEM server or other similar system polls the **audit.general** workload to The following table summarizes the values of **AuditLogRecordType** that are relevant for Microsoft Defender for Office 365 events:<br/><br/> -| Value | Member name | Description | +|Value|Member name|Description| ||||-| 28| ThreatIntelligence | Phishing and malware events from Exchange Online Protection and Microsoft Defender for Office 365. | -| 41| ThreatIntelligenceUrl | Safe Links time-of-block and block override events from Microsoft Defender for Office 365. | -| 47| ThreatIntelligenceAtpContent | Phishing and malware events for files in SharePoint Online, OneDrive for Business, and Microsoft Teams, from Microsoft Defender for Office 365. | -| 64| AirInvestigation | Automated investigation and response events, such as investigation details and relevant artifacts, from Microsoft Defender for Office 365 Plan 2. | +|28|ThreatIntelligence|Phishing and malware events from Exchange Online Protection and Microsoft Defender for Office 365.| +|41|ThreatIntelligenceUrl|Safe Links time-of-block and block override events from Microsoft Defender for Office 365.| +|47|ThreatIntelligenceAtpContent|Phishing and malware events for files in SharePoint Online, OneDrive for Business, and Microsoft Teams, from Microsoft Defender for Office 365.| +|64|AirInvestigation|Automated investigation and response events, such as investigation details and relevant artifacts, from Microsoft Defender for Office 365 Plan 2.| > [!IMPORTANT] > You must have either the global administrator or Security Administrator role assigned in the Microsoft 365 Defender portal to set up SIEM integration with Microsoft Defender for Office 365. For more information, see [Permissions in the Microsoft 365 Defender portal](mdo-portal-permissions.md). |
| security | Use The Delist Portal To Remove Yourself From The Office 365 Blocked Senders Lis | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/use-the-delist-portal-to-remove-yourself-from-the-office-365-blocked-senders-lis.md | where _IP address_ is the IP address of the computer on which the mail server r ## Verify senders before removing them from the blocked senders list There are good reasons for senders to wind up on the blocked senders list, but mistakes can happen. Take a look at this video for a balanced explanation of blocked senders and delisting.-<p> > [!VIDEO https://www.microsoft.com/videoplayer/embed/RWMhvD] There are good reasons for senders to wind up on the blocked senders list, but m See [Create safe sender lists in EOP](create-safe-sender-lists-in-office-365.md) and [Outbound spam protection in EOP](outbound-spam-protection-about.md) to prevent an IP from being blocked. ### How to fix error code 5.7.511- + When there's a problem delivering an email message that you sent, Microsoft 365 or Office 365 sends an email notification to let you know. The email notification is known a delivery status notification or DSN. The most common type of DSN is a non-delivery report (also known as an NDR or bounce message) that tells you that a message wasn't delivered. In certain situations, Microsoft must conduct additional investigations against traffic from your IP address. If you receive and NDR with code 5.7.511, you **will not** be able to use the delist portal.- -> 550 5.7.511 Access denied, banned sender[xxx.xxx.xxx.xxx]. To request removal from this list, forward this message to delist@microsoft.com. For more information, go to https://go.microsoft.com/fwlink/?LinkId=526653. - -In the email to request removal from this list, provide the full NDR code and IP address. Microsoft will contact you within 48 hours with the next steps. ++> 550 5.7.511 Access denied, banned sender[xxx.xxx.xxx.xxx]. To request removal from this list, forward this message to delist@microsoft.com. For more information, go to https://go.microsoft.com/fwlink/?LinkId=526653. ++In the email to request removal from this list, provide the full NDR code and IP address. Microsoft will contact you within 48 hours with the next steps. ## More information |
| security | Security Posture Solution Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/security-posture-solution-overview.md | -As an organizationΓÇÖs security posture is constantly changing alongside the cybersecurity landscape, making security posture improvements should be a continuous process. This article provides an overview of how you can strengthen your organization's security posture using capabilities available in Microsoft 365 Defender and other Microsoft security products, such as Microsoft Defender for Endpoint and Microsoft Defender Vulnerability Management. +As an organization's security posture is constantly changing alongside the cybersecurity landscape, making security posture improvements should be a continuous process. This article provides an overview of how you can strengthen your organization's security posture using capabilities available in Microsoft 365 Defender and other Microsoft security products, such as Microsoft Defender for Endpoint and Microsoft Defender Vulnerability Management. It will help you better understand your overall security posture and provide a framework to help you continually assess, improve, and maintain a security posture to fit your organization's security needs. |
| solutions | Configure Teams Highly Sensitive Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/configure-teams-highly-sensitive-protection.md | f1.keywords: NOCSH Previously updated : 05/01/2020 Last updated : 03/09/2023 audience: ITPro +ms.localizationpriority: normal search.appverid: - MET150 - highpri+- Tier1 - Ent_O365 - Strat_O365_Enterprise - m365solution-3tiersprotection description: "Learn how to deploy teams with protection for highly sensitive dat # Configure teams with protection for highly sensitive data + In this article, we look at setting up a team for a highly sensitive level of protection. Be sure you've completed the steps in [Deploy teams with baseline protection](configure-teams-baseline-protection.md) before following the steps in this article. For this tier of protection, we create a sensitivity label that can be used across your organization for highly sensitive teams and files. Only members of your organization and guests that you have specified will be able to decrypt files that use this label. If you need to further isolate permissions so that only members of a specific team can decrypt files, see [Deploy a team with security isolation](secure-teams-security-isolation.md). The highly sensitive tier offers the following additional protections over the baseline tier: -- A sensitivity label for the team that allows you to turn guest sharing on or off and blocks access to SharePoint content for unmanaged devices. This label can also be used to classify and encrypt files.-- A more restrictive default sharing link type+- A sensitivity label for the team that allows you to turn guest sharing on or off and enforces a conditional access for access to the SharePoint site. The label is also used as a default label for files. - Only team owners can create private channels.-- Access requests for the associated SharePoint site are turned off.+- Site access is restricted to team members. ## Video demonstration For details about sharing with guests securely, see the following resources: - [Limit accidental exposure to files when sharing with people outside your organization](./share-limit-accidental-exposure.md) - [Create a secure guest sharing environment](./create-secure-guest-sharing-environment.md) -To allow or block guest sharing, we use a combination of a sensitivity label for the team and site-level sharing controls for the associated SharePoint site, both discussed later. +To allow or block guest sharing, we'll use controls available in sensitivity labels. +++## Authentication context ++We'll use an [Azure Active Directory authentication context](/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps#configure-authentication-contexts) to enforce more stringent access conditions when users access SharePoint sites. ++First, add an authentication context in Azure Active Directory. ++To add an authentication context +1. In [Azure Active Directory Conditional Access](https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/ConditionalAccessBlade), under **Manage**, click **Authentication context**. ++2. Click **New authentication context**. ++3. Type a name and description and select the **Publish to apps** check box. ++  ++4. Click **Save**. ++Next, create a conditional access policy that applies to that authentication context and that requires guests to agree to a terms of use as a condition of access. ++To create a conditional access policy +1. In [Azure Active Directory Conditional Access](https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/ConditionalAccessBlade), click **New policy**. ++1. Type a name for the policy. ++1. On the **Users and groups** tab, choose the **Select users and groups** option, and then select the **Guest or external users** check box. ++1. Choose **B2B collaboration guest users** from the dropdown. ++1. On the **Cloud apps or actions** tab, under **Select what this policy applies to**, choose **Authentication context**, and select the check box for the authentication context that you created. ++  ++1. On the **Grant** tab, select **Require multifactor authentication**, and then click **Select**. ++1. Choose if you want to enable the policy, and then click **Create**. ++We'll point to the authentication context in the sensitivity label. ## Sensitivity labels -For the highly sensitive level of protection, we'll be using a sensitivity label to classify the team. This label can also be used to classify and encrypt individual files in this or other teams or in other file locations such as SharePoint or OneDrive. +For the highly sensitive level of protection, we'll be using a sensitivity label to classify the team. We'll also use this label to classify and encrypt individual files in the team. (It can also be used on files in other file locations such as SharePoint or OneDrive.) -As a first step, you must enable sensitivity labels for Teams. See [Use sensitivity labels to protect content in Microsoft Teams, Office 365 Groups, and SharePoint sites](../compliance/sensitivity-labels-teams-groups-sites.md) for details. +As a first step, you must enable sensitivity labels for Teams. See [Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 Groups, and SharePoint sites](../compliance/sensitivity-labels-teams-groups-sites.md) for details. If you already have sensitivity labels deployed in your organization, consider how this label fits with your overall label strategy. You can change the name or settings if needed to meet the needs of your organization. Once you have enabled sensitivity labels for Teams, the next step is to create t To create a sensitivity label 1. Open the [Microsoft Purview compliance portal](https://compliance.microsoft.com).-2. Under **Solutions**, click **Information protection**. -3. Click **Create a label**. -4. Give the label a name. We suggest **Highly sensitive**, but you can choose a different name if that one is already in use. -5. Add a display name and description, and then click **Next**. -6. On the **Define the scope for this label page**, select **Files & emails** and **Groups & sites** and click **Next**. -7. On the **Choose protection settings for files and emails** page, select **Encrypt files and emails**, and then click **Next**. -8. On the **Encryption** page, choose **Configure encryption settings**. -9. Under **Assign permissions to specific users and groups**, click **Assign permissions**. -10. Click **Add all users and groups in your organization**. -11. If there are guests who should have permissions to decrypt files, click **Add users or groups** and add them. -12. Click **Save**, and then click **Next**. -13. On the *Auto-labeling for files and emails** page, click **Next**. -14. On the **Define protection settings for groups and sites** page, select **Privacy and external user access settings** and **Device access and external sharing settings** and click **Next**. -15. On the **Define privacy and external user access settings** page, under **Privacy**, select the **Private** option. -16. If you want to allow guest access, under **External user access**, select **Let Microsoft 365 Group owners add people outside your organization to the group as guests**. -17. Click **Next**. -18. On the **Define external sharing and device access settings** page, select **Control external sharing from labeled SharePoint sites**. -19. Under **Content can be shared with**, choose **New and existing guests** if you're allowing guest access or **Only people in your organization** if not. -20. Under **Access from unmanaged devices**, choose **Block access**. (If you're allowing guests and they don't have managed devices, you may want to choose **Allow limited, web-only access**.) -21. Click **Next**. -22. On the **Auto-labeling for database columns** page, click **Next**. -23. Click **Create label**, and then click **Done**. +1. Under **Solutions**, click **Information protection**. +1. On the **Labels** tab, click **Create a label**. +1. Give the label a name. We suggest **Highly sensitive**, but you can choose a different name if that one is already in use. +1. Add a display name and description, and then click **Next**. +1. On the **Define the scope for this label page**, select **Files & emails** and **Groups & sites** and clear **Include meetings**. +1. Click **Next**. +1. On the **Choose protection settings for files and emails** page, select **Apply or remove encryption**, and then click **Next**. +1. On the **Encryption** page, choose **Configure encryption settings**. +1. Under **Assign permissions to specific users and groups**, click **Assign permissions**. +1. Click **Add all users and groups in your organization**. +1. If there are guests who should have permissions to decrypt files, click **Add users or groups** and add them. +1. Click **Save**, and then click **Next**. +1. On the **Auto-labeling for files and emails** page, click **Next**. +1. On the **Define protection settings for groups and sites** page, select **Privacy and external user access settings** and **External sharing and Conditional Access settings** and click **Next**. +1. On the **Define privacy and external user access settings** page, under **Privacy**, select the **Private** option. +1. If you want to allow guest access, under **External user access**, select **Let Microsoft 365 Group owners add people outside your organization to the group as guests**. +1. Click **Next**. +1. On the **Define external sharing and device access settings** page, select **Control external sharing from labeled SharePoint sites**. +1. Under **Content can be shared with**, choose **New and existing guests** if you're allowing guest access or **Only people in your organization** if not. +1. Select **Use Azure AD Conditional Access to protect labeled SharePoint sites**. +1. Select the **Choose an existing authentication context** option, and then select the authentication context that you created from the dropdown list. +1. Click **Next**. +1. On the **Auto-labeling for database columns** page, click **Next**. +1. Click **Create label**, and then click **Done**. Once you've created the label, you need to publish it to the users who will use it. For sensitive protection, we'll make the label available to all users. You publish the label in the Microsoft Purview compliance portal, on the **Label policies** tab of the **Information protection** page. If you have an existing policy that applies to all users, add this label to that policy. If you need to create a new policy, see [Publish sensitivity labels by creating a label policy](../compliance/create-sensitivity-labels.md#publish-sensitivity-labels-by-creating-a-label-policy). You can also use [teams policies](/MicrosoftTeams/teams-policies) to control who ## SharePoint settings Each time you create a new team with the highly sensitive label, there are two steps to do in SharePoint:+- Restrict access to the site to members of the team only +- Choose a default sensitivity label for the document library connected to the team. ++### Restrict site access to team members ++Each time you create a new team with the highly sensitive label, you need to turn on restricted site access on the associated SharePoint site. This prevents people from outside the team from accessing the site or its content. (This requires a Microsoft Syntex - SharePoint Advanced Management license.) ++[SharePoint PowerShell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) is required to configure restricted site access. ++If you haven't used restricted site access before, you need to turn it on for your organization. To do this, run the following command: ++```Powershell +Set-SPOTenant -EnableRestrictedAccessControl $true +``` ++> [!NOTE] +> If you have Microsoft 365 Multi-Geo, you must run this command for each geo-location you want to use restricted access control. ++Wait for approximately one hour before turning on restricted access control for the site. ++To restrict site access for the site connected to your team, run the following command: ++```Powershell +Set-SPOSite -Identity <siteurl> -RestrictedAccessControl $true +``` ++### Choose a default sensitivity label for files -- Update the guest sharing settings for the site in the SharePoint admin center to update the default sharing link to *People with existing access*.-- Update the site sharing settings in the site itself to prevent members from sharing files, folders, or the site, and turn off access requests.+We'll use the sensitivity label that we created as the default sensitivity label for the site document library that is connected to Teams. This will automatically apply the highly sensitive label to any new label-compatible files that are uploaded to the library, encrypting them. (This requires a Microsoft Syntex - SharePoint Advanced Management license.) -### Site default sharing link settings +To set a default sensitivity label for a document library -To update the site default sharing link type +1. In Teams, navigate to the **General** channel of the team you want to update. -1. Open the SharePoint admin center, and under **Sites**, select <a href="https://go.microsoft.com/fwlink/?linkid=2185220" target="_blank">**Active sites**</a>. -1. Select the site that is associated with team. -1. On the **Policies** tab, under **External sharing**, select **Edit**. -1. Under Default sharing link type, clear the **Same as organization-level setting** check box, and select **People with existing access**. -1. Select **Save**. +1. In the tool bar for the team, click **Files**. -Note that if you add private or shared channels to the team, each creates a new SharePoint site with the default sharing settings. You can update them in the SharePoint admin center by selecting the sites associated with the team. +1. Click **Open in SharePoint**. -### Site sharing settings +1. In the SharePoint site, open **Settings** and then choose **Library settings**. -To help ensure that the SharePoint site does not get shared with people who are not members of the team, we limit such sharing to owners. We also limit sharing of files and folders to team owners. This helps ensure that owners are aware whenever a file is shared with someone outside the team. +1. From the **Library settings** flyout pane, select **Default sensitivity labels**, and then select the highly sensitive label from the drop-down box. -To configure owners-only site sharing -1. In Teams, navigate to the **General** tab of the team you want to update. -2. In the tool bar for the team, click **Files**. -3. Click the ellipsis, and then click **Open in SharePoint**. -4. In the tool bar of the underlying SharePoint site, click the settings icon, and then click **Site permissions**. -5. In the **Site permissions** pane, under **Site sharing**, click **Change how members can share**. -6. Under **Sharing permissions**, choose **Only site owners can share files, folders, and the site**. -7. Set **Allow access requests** to **Off**, and then click **Save**. +For more details about how default library labels work, see [Configure a default sensitivity label for a SharePoint document library](/microsoft-365/compliance/sensitivity-labels-sharepoint-default-label). ## See Also |
| solutions | Configure Teams Sensitive Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/configure-teams-sensitive-protection.md | f1.keywords: NOCSH Previously updated : 05/01/2020 Last updated : 03/09/2023 audience: ITPro +ms.localizationpriority: normal search.appverid: - MET150 - highpri+- Tier1 - Ent_O365 - Strat_O365_Enterprise - m365solution-3tiersprotection description: "Learn how to deploy teams with protection for sensitive data." # Configure teams with protection for sensitive data + In this article, we look at setting up a team for a sensitive level of protection. Be sure you've completed the steps in [Deploy teams with baseline protection](configure-teams-baseline-protection.md) before following the steps in this article. The sensitive tier offers the following additional protections over the baseline tier: -- A sensitivity label for the team that allows you to turn guest sharing on or off and limits access to SharePoint content to web-only for unmanaged devices. This label can also be used to classify files.+- A sensitivity label for the team that allows you to turn guest sharing on or off and limits access to SharePoint content to web-only for unmanaged devices. This label is also used as the default label for files. - A more restrictive default sharing link type - Only team owners can create private channels. To allow or block guest sharing, we use a combination of a sensitivity label for ## Sensitivity labels -For the sensitive level of protection, we'll be using a sensitivity label to classify the team. This label can also be used to classify individual files in this or other teams, or in other file locations such as SharePoint or OneDrive. +For the sensitive level of protection, we'll be using a sensitivity label to classify the team. We'll also use this label to classify individual files in the team. (It can also be used on files in other file locations such as SharePoint or OneDrive.) -As a first step, you must enable sensitivity labels for Teams. See [Use sensitivity labels to protect content in Microsoft Teams, Office 365 Groups, and SharePoint sites](../compliance/sensitivity-labels-teams-groups-sites.md) for details. +As a first step, you must enable sensitivity labels for Teams. See [Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 Groups, and SharePoint sites](../compliance/sensitivity-labels-teams-groups-sites.md) for details. If you already have sensitivity labels deployed in your organization, consider how this label fits with your overall label strategy. You can change the name or settings if needed to meet the needs of your organization. Once you have enabled sensitivity labels for Teams, the next step is to create t To create a sensitivity label 1. Open the [Microsoft Purview compliance portal](https://compliance.microsoft.com).-2. Under **Solutions**, click **Information protection**. -3. Click **Create a label**. -4. Give the label a name. We suggest **Sensitive**, but you can choose a different name if that one is already in use. -5. Add a display name and description, and then click **Next**. -6. On the **Define the scope for this label page**, select **Files & emails** and **Groups & sites** and click **Next**. -7. On the **Choose protection settings for files and emails** page, click **Next**. -8. On the *Auto-labeling for files and emails** page, click **Next**. -9. On the **Define protection settings for groups and sites** page, select **Privacy and external user access settings** and **Device access and external sharing settings** and click **Next**. -10. On the **Define privacy and external user access settings** page, under **Privacy**, select the **Private** option. -11. If you want to allow guest access, under **External user access**, select **Let Microsoft 365 Group owners add people outside your organization to the group as guests**. -12. Click **Next**. -13. On the **Define external sharing and device access settings** page, select **Control external sharing from labeled SharePoint sites**. -14. Under **Content can be shared with**, choose **New and existing guests** if you're allowing guest access or **Only people in your organization** if not. -15. Under **Access from unmanaged devices**, choose **Allow limited, web-only access**. -16. Click **Next**. -17. On the **Auto-labeling for database columns** page, click **Next**. -18. Click **Create label**, and then click **Done**. +1. Under **Solutions**, click **Information protection**. +1. Click **Create a label**. +1. Give the label a name. We suggest **Sensitive**, but you can choose a different name if that one is already in use. +1. Add a display name and description, and then click **Next**. +1. On the **Define the scope for this label page**, select **Files & emails** and **Groups & sites** and clear **Include meetings**. +1. Click **Next**. +1. On the **Choose protection settings for files and emails** page, click **Next**. +1. On the **Auto-labeling for files and emails** page, click **Next**. +1. On the **Define protection settings for groups and sites** page, select **Privacy and external user access settings** and **External sharing and Conditional Access settings** and click **Next**. +1. On the **Define privacy and external user access settings** page, under **Privacy**, select the **Private** option. +1. If you want to allow guest access, under **External user access**, select **Let Microsoft 365 Group owners add people outside your organization to the group as guests**. +1. Click **Next**. +1. On the **Define external sharing and device access settings** page, select **Control external sharing from labeled SharePoint sites**. +1. Under **Content can be shared with**, choose **New and existing guests** if you're allowing guest access or **Only people in your organization** if not. +1. Select **Use Azure AD Conditional Access to protect labeled SharePoint sites**. +1. Choose the **Determine whether users can access SharePoint sites from unmanaged devices** option, and then choose **Allow limited, web-only access**. +1. Click **Next**. +1. On the **Auto-labeling for database columns** page, click **Next**. +1. Click **Create label**, and then click **Done**. Once you've created the label, you need to publish it to the users who will use it. For sensitive protection, we'll make the label available to all users. You publish the label in the Microsoft Purview compliance portal, on the **Label policies** tab of the **Information protection** page. If you have an existing policy that applies to all users, add this label to that policy. If you need to create a new policy, see [Publish sensitivity labels by creating a label policy](../compliance/create-sensitivity-labels.md#publish-sensitivity-labels-by-creating-a-label-policy). You can also use [teams policies](/MicrosoftTeams/teams-policies) to control who ## SharePoint settings -Each time you create a new team with the sensitive label, there are two steps to do in SharePoint: +Each time you create a new team with the sensitive label, there are three steps to do in SharePoint: - Update the guest sharing settings for the site in the SharePoint admin center to update the default sharing link to *Specific people*. - Update the site sharing settings in the site itself to prevent members from sharing the site.+- Choose a default sensitivity label for the document library connected to the team. ### Site default sharing link settings To configure owners-only site sharing 5. In the **Site permissions** pane, under **Site sharing**, click **Change how members can share**. 6. Under **Sharing permissions**, choose **Site owners and members, and people with Edit permissions can share files and folders, but only site owners can share the site**, and then click **Save**. +### Choose a default sensitivity label for files ++We'll use the sensitivity label that we created as the default sensitivity label for the site document library that is connected to Teams. This will automatically apply the highly sensitive label to any new label-compatible files that are uploaded to the library. (This requires a Microsoft Syntex - SharePoint Advanced Management license.) ++To set a default sensitivity label for a document library ++1. In Teams, navigate to the **General** channel of the team you want to update. ++1. In the tool bar for the team, click **Files**. ++1. Click **Open in SharePoint**. ++1. In the SharePoint site, open **Settings** and then choose **Library settings**. ++1. From the **Library settings** flyout pane, select **Default sensitivity labels**, and then select the highly sensitive label from the drop-down box. ++For more details about how default library labels work, see [Configure a default sensitivity label for a SharePoint document library](/microsoft-365/compliance/sensitivity-labels-sharepoint-default-label). ## Related topics |
| solutions | Configure Teams Three Tiers Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/configure-teams-three-tiers-protection.md | f1.keywords: NOCSH Previously updated : 05/01/2020 Last updated : 03/09/2023 audience: ITPro +ms.localizationpriority: normal search.appverid: - MET150 - highpri+- Tier1 - Ent_O365 - Strat_O365_Enterprise - M365-security-compliance-The articles in this series provide recommendations for configuring teams in Microsoft Teams and their associated SharePoint sites for file protection that balances security with ease of collaboration. ++The articles in this series provide recommendations for configuring teams in Microsoft Teams, and their associated SharePoint sites, for file protection that balances security with ease of collaboration. This article defines four different configurations, starting with a public team with the most open sharing policies. Each additional configuration represents a meaningful step up in protection, while the ability to access and collaborate on files stored within teams is reduced to the relevant set of team members. The configurations in this article align with Microsoft's recommendations for th - Baseline protection -- sensitive protection+- Sensitive protection - Highly sensitive protection For more information about these tiers and capabilities recommended for each tier, see [Microsoft cloud for enterprise architects illustrations](./cloud-architecture-models.md) +For information about creating a Teams meeting environment that meets your compliance requirements, see [Configure Teams meetings with three tiers of protection](/MicrosoftTeams/configure-meetings-three-tiers-protection). + ## Three tiers at a glance The following table summarizes the configurations for each tier. Use these configurations as starting point recommendations and adjust the configurations to meet the needs of your organization. You may not need every tier. The following table summarizes the configurations for each tier. Use these confi |Private or public team|Public|Private|Private|Private| |Who has access?|Everybody in the organization, including B2B users.|Only members of the team. Others can request access to the associated site.|Only members of the team.|Only members of the team.| |Private channels|Owners and members can create private channels|Owners and members can create private channels|Only owners can create private channels|Only owners can create private channels|-|Shared channels|Owners and members can create shared channels|Owners and members can create shared channels|Only owners can create shared channels|Only owners can create shared channels| |Site-level guest access|**New and existing guests** (default).|**New and existing guests** (default).|**New and existing guests** or **Only people in your organization** depending on team needs.|**New and existing guests** or **Only people in your organization** depending on team needs.|-|Site sharing settings|**Site owners and members, and people with Edit permissions can share files and folders, but only site owners can share the site**.|**Site owners and members, and people with Edit permissions can share files and folders, but only site owners can share the site**.|**Site owners and members, and people with Edit permissions can share files and folders, but only site owners can share the site**.|**Only site owners can share files, folders, and the site**.<br>Access requests **Off**.| -|Site-level unmanaged device access|**Full access from desktop apps, mobile apps, and the web** (default).|**Full access from desktop apps, mobile apps, and the web** (default).|**Allow limited, web-only access**.|**Block access**.| +|Site-level conditional access|**Full access from desktop apps, mobile apps, and the web** (default).|**Full access from desktop apps, mobile apps, and the web** (default).|**Allow limited, web-only access**.|Custom conditional access policy| |Default sharing link type|**Only people in your organization**|**Only people in your organization**|**Specific people**|**People with existing access**|-|Sensitivity labels|None|None|Sensitivity label used to classify the team and control guest sharing and unmanaged device access.|Sensitivity label used to classify the team and control guest sharing and unmanaged device access. Label can also be used on files to encrypt files.| +|Sensitivity labels|None|None|Sensitivity label used to classify the team and control guest sharing and unmanaged device access.|Sensitivity label used to classify the team, control guest sharing, and specify a conditional access policy. Default file label is used on files to encrypt them.| +|Site sharing settings|**Site owners and members, and people with Edit permissions can share files and folders, but only site owners can share the site**.|**Site owners and members, and people with Edit permissions can share files and folders, but only site owners can share the site**.|**Site owners and members, and people with Edit permissions can share files and folders, but only site owners can share the site**.|N/A (Controlled by site-level restricted access control.)| +|Site-level restricted access control|None|None|None|Team members only| A variation of the Highly sensitive option, [Teams with security isolation](secure-teams-security-isolation.md) uses a unique sensitivity label for one team, which provides additional security. You can use this label to encrypt files, and only members of that team will be able to read them. Teams for sensitive and highly sensitive protection are private teams in which s ## Sensitivity labels -The sensitive and highly sensitive tiers use sensitivity labels to help secure the team and its files. To implement these tiers, you must enable [sensitivity labels to protect content in Microsoft Teams, Office 365 Groups, and SharePoint sites](../compliance/sensitivity-labels-teams-groups-sites.md). +The sensitive and highly sensitive tiers use sensitivity labels to help secure the team and its files. To implement these tiers, you must enable [sensitivity labels to protect content in Microsoft Teams, Microsoft 365 Groups, and SharePoint sites](../compliance/sensitivity-labels-teams-groups-sites.md). -While the baseline tier does not require sensitivity labels, consider creating a "general" label and then requiring that all teams be labeled. This will help ensure that users make a conscious choice about sensitivity when they create a team. If you plan to deploy the sensitive or highly sensitive tiers, we do recommend creating a "general" label that you can use for baseline teams and for files that are not sensitive. +While the baseline tier does not require sensitivity labels, consider creating a "general" label and then requiring that all teams be labeled. This will help ensure that users make a conscious choice about sensitivity when they create a team. If you plan to deploy the sensitive or highly sensitive tiers, we do recommend creating a "general" label that you can use for baseline teams and for files that are not sensitive. For the highly sensitive tier, we'll also specify a default sensitivity label for document libraries so that Office files and other compatible files will have that label automatically applied when they're uploaded. If you're new to using sensitivity labels, we recommend reading [Get started with sensitivity labels](../compliance/get-started-with-sensitivity-labels.md) to get started. By default, team owners and members can share the site itself with people outsid While teams do not have a read-only permission option, the SharePoint site does. If you have stakeholders of partner groups who need to be able to view team files but not edit them, consider adding them directly to the SharePoint site with Read permissions. +For the highly sensitive tier, we'll restrict access to the site to members of the team only. This restriction will also prevent sharing files with people outside the team. + ## Sharing files and folders -By default, both owners and members of the team can share files and folders with people outside the team. This may include people outside your organization, if you have allowed guest sharing. In all three tiers, we update the default sharing link type to help avoid accidental oversharing. In the highly sensitive tier, we restrict such sharing to team owners only. +By default, both owners and members of the team can share files and folders with people outside the team. This may include people outside your organization, if you have allowed guest sharing. In all three tiers, we update the default sharing link type to help avoid accidental oversharing. In the highly sensitive tier, we restrict such sharing to team owners only. As noted above, in the highly sensitive tier, file access is limited to team members only. ## Sharing with people outside your organization If you plan to use guest sharing, we recommend configuring [SharePoint and OneDr Teams guest sharing is on by default, but you can turn it off if needed in the sensitive and highly sensitive tiers by using a sensitivity label. Shared channels are on by default, but require setting up cross-organizational relationships for each organization you want to collaborate with. See [Collaborate with external participants in a channel](collaborate-teams-direct-connect.md) for details. -In the highly sensitive tier, we configure the sensitivity label to encrypt files to which it is applied. If you need guests to have access to these files, you must give them permissions when you create the label. External participants in shared channels can't be given permissions to sensitivity labels and can't access content encrypted by a sensitivity label. +In the highly sensitive tier, we configure the default library sensitivity label to encrypt files to which it is applied. If you need guests to have access to these files, you must give them permissions when you create the label. External participants in shared channels can't be given permissions to sensitivity labels and can't access content encrypted by a sensitivity label. We highly recommend that you leave guest sharing on for the baseline tier and for the sensitive or highly sensitive tiers if you need to collaborate with people outside your organization. The guest sharing features in Microsoft 365 provide a much more secure and governable sharing experience than sending files as attachments in email messages. It also reduces the risk of shadow IT where users use ungoverned consumer products to share with legitimate external collaborators. -If you regularly collaborate with other organizations that use Azure AD, shared channels may be a good option. Shared channels appear seamlessly in the other organization's Teams client and allow external participants to use their regular user account for their organization rather than having to login in separately using a guest account. +If you regularly collaborate with other organizations that use Azure AD, shared channels may be a good option. Shared channels appear seamlessly in the other organization's Teams client and allow external participants to use their regular user account for their organization rather than having to log in separately using a guest account. See the following references to create a secure and productive guest sharing environment for your organization: See the following references to create a secure and productive guest sharing env - [Limit accidental exposure to files when sharing with people outside your organization](share-limit-accidental-exposure.md) - [Create a secure guest sharing environment](create-secure-guest-sharing-environment.md) -## Access from unmanaged devices +## Conditional access policies ++Azure AD conditional access offers many options for determining how people access Microsoft 365, including limitations based on location, risk, device compliance, and other factors. We recommend you read [What is Conditional Access?](/azure/active-directory/conditional-access/overview) and consider which additional policies might be appropriate for your organization. ++For the sensitive and highly sensitive tiers, we use sensitivity labels to restrict access to SharePoint content. + -For the sensitive and highly sensitive tiers, we restrict access to SharePoint content with sensitivity labels. Azure AD conditional access offers many options for determining how people access Microsoft 365, including limitations based on location, risk, device compliance, and other factors. We recommend you read [What is Conditional Access?](/azure/active-directory/conditional-access/overview) and consider which additional policies might be appropriate for your organization. +For the sensitive tier, we'll restrict access to web-only for unmanaged devices. (Note that guests often don't have devices that are managed by your organization. If you allow guests in any of the tiers, consider what kinds of devices they'll be using to access teams and sites and set your unmanaged device policies accordingly.) -Note that guests often don't have devices that are managed by your organization. If you allow guests in any of the tiers, consider what kinds of devices they'll be using to access teams and sites and set your unmanaged device policies accordingly. +For the highly sensitive tier, we'll use [Azure Active Directory authentication context](/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps#configure-authentication-contexts) with the sensitivity label to trigger a custom conditional access policy when people access the SharePoint site associate with the team. -### Control device access across Microsoft 365 +### Conditional access across Teams-related services -The unmanaged devices setting in sensitivity labels only affect SharePoint access. If you want to expand control of unmanaged devices beyond SharePoint, you can [Create an Azure Active Directory conditional access policy for all apps and services in your organization](/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) instead. To configure this policy specifically for [Microsoft 365 services](/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps#office-365), select the **Office 365** cloud app under **Cloud apps or actions**. +The conditional access settings in sensitivity labels only affect SharePoint access. If you want to expand conditional access beyond SharePoint, you can [Create an Azure Active Directory conditional access policy for all apps and services in your organization](/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) instead. To configure this policy specifically for [Microsoft 365 services](/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps#office-365), select the **Office 365** cloud app under **Cloud apps or actions**. - + Using a policy that affects all Microsoft 365 services can lead to better security and a better experience for your users. For example, when you block access to unmanaged devices in SharePoint only, users can access the chat in a team with an unmanaged device, but will lose access when they try to access the **Files** tab. Using the Office 365 cloud app helps avoid issues with [service dependencies](/azure/active-directory/conditional-access/service-dependencies). Using a policy that affects all Microsoft 365 services can lead to better securi Start by [configuring the baseline level of protection](configure-teams-baseline-protection.md). If needed you can add [sensitive protection](configure-teams-sensitive-protection.md) and [highly sensitive protection](configure-teams-highly-sensitive-protection.md) on top of the baseline. -## See also +## Related topics [Security and compliance in Microsoft Teams](/microsoftteams/security-compliance-overview) |
| solutions | Productivity Illustrations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/productivity-illustrations.md | Depending on your environment, some tools are better suited for certain architec | Item | Description | |:--|:--|-|[ <br>Updated September 2021| The architectural material helps you plan your deployment for the following architectures: <ul><li> Cloud-native </li><li> Co-management </li><li> On-premise</li><li>Evaluation and local onboarding</li> | +|[ <br>Updated September 2021| The architectural material helps you plan your deployment for the following architectures: <ul><li> Cloud-native </li><li> Co-management </li><li> On-premises</li><li>Evaluation and local onboarding</li> | <!-- <a name="BKMK_O365IDP"></a> Updated June 2021 For more information, see the article for this poster: [Set up your infrastructure for hybrid work with Microsoft 365](empower-people-to-work-remotely.md). -## Microsoft Teams with security isolation --With Microsoft 365, you can configure a private team in Microsoft Teams and use SharePoint site security settings and a unique sensitivity label to encrypt files so that only team members can decrypt them. --[](../downloads/team-security-isolation-poster.pdf) <br/> -[PDF](https://github.com/MicrosoftDocs/microsoft-365-docs/raw/public/microsoft-365/downloads/team-security-isolation-poster.pdf) | [PowerPoint](https://download.microsoft.com/download/8/0/5/8057fc16-c044-40b6-a652-7ed555ba2895/team-security-isolation-poster.pptx) <br> -Updated August 2020 --For more information, see the article for this poster: [Configure a team with security isolation](secure-teams-security-isolation.md). -- ## See Also [Architectural models for SharePoint, Exchange, Skype for Business, and Lync](../enterprise/architectural-models-for-sharepoint-exchange-skype-for-business-and-lync.md) |
| solutions | Secure Teams Security Isolation | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/secure-teams-security-isolation.md | - Title: "Configure a team with security isolation by using a unique sensitivity label"--- Previously updated : 05/01/2020----- highpri-- M365-subscription-management-- Strat_O365_Enterprise-- m365solution-3tiersprotection-- m365solution-securecollab--- Ent_Solutions-- admindeeplinkCOMPLIANCE-- admindeeplinkSPO -recommendations: false -description: "Learn how to create a team with a unique sensitivity label for security." ---# Configure a team with security isolation by using a unique sensitivity label --This article provides you with recommendations and steps to configure a private team in Microsoft Teams and use a unique sensitivity label to encrypt files so that only team members can decrypt them. --Beyond the private access, this article describes how to configure the associated SharePoint site, which you can access from the **Files** section of a team channel, for the additional security needed to store highly regulated data. --The elements of configuration for a team with security isolation are: --- A private team-- Additional security on the associated SharePoint site for the team that:- - Prevents members of the site from sharing the site with others. - - Prevents non-members of the site from requesting access to the site. -- A sensitivity label specifically for this team that:- - Prevents access to SharePoint content from unmanaged devices - - Allows or denies guest access to the team, depending on your requirements - - Encrypts documents to which the label is applied --> [!IMPORTANT] -> Be sure you have enabled [sensitivity labels to protect content in Microsoft Teams, Office 365 groups, and SharePoint sites](../compliance/sensitivity-labels-teams-groups-sites.md) before you proceed with the steps in this article. --Watch this video for an overview of the deployment process. -<br> -<br> -> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4mGHf] --<a name="poster"></a> -For a 1-page summary of this scenario, see the [Microsoft Teams with security isolation poster](../downloads/team-security-isolation-poster.pdf). --[](../downloads/team-security-isolation-poster.pdf) --You can also download this poster in [PDF](https://github.com/MicrosoftDocs/microsoft-365-docs/raw/public/microsoft-365/downloads/team-security-isolation-poster.pdf) or [PowerPoint](https://download.microsoft.com/download/8/0/5/8057fc16-c044-40b6-a652-7ed555ba2895/team-security-isolation-poster.pptx) formats and print it on letter, legal, or tabloid (11 x 17) size paper. --Try this configuration in your own test lab environment with [these instructions](team-security-isolation-dev-test.md). --See how the Contoso Corporation used an isolated team for a top-secret project in [this case study](contoso-team-for-top-secret-project.md). --## Initial protections --To help protect access to the team and its underlying SharePoint site, review the following best practices: -- [Identity and device access policies](../security/office-365-security/identity-access-policies.md)-- [SharePoint Online access policies](../security/office-365-security/sharepoint-file-access-policies.md)-- [Deploy teams with baseline protection](configure-teams-baseline-protection.md)--## Guest sharing --Depending on the nature of your business, you may or may not want to enable guest sharing for this team. If you do plan to collaborate with people outside your organization in the team, enable guest sharing. --For details about sharing with guests securely, see the following resources: --- [Limit accidental exposure to files when sharing with people outside your organization](./share-limit-accidental-exposure.md)-- [Create a secure guest sharing environment](./create-secure-guest-sharing-environment.md)--To allow or block guest sharing, we use a combination of a sensitivity label for the team and site-level sharing controls for the associated SharePoint site, both discussed later. --## Create a private team --Since we are creating a sensitivity label specifically for this team, the next step is to create the team. If you have an existing team, you can use that. --To create a team for sensitive information -1. In Teams, click **Teams** on the left side of the app, then click **Join or create a team** at the bottom of the teams list. -2. Click **Create team** (first card, top left corner). -3. Choose **Build a team from scratch**. -4. In the **Sensitivity** list, keep the default. -5. Under **Privacy**, click **Private**. -6. Type a name for the team that is related to your sensitive project. For example, **Project Saturn**. -7. Click **Create**. -8. Add users to the team, and then click **Close**. --## Private channel settings --We recommend restricting creating private channels to team owners. --To restrict private channel creation -1. In the team, click **More options**, and then click **Manage team**. -2. On the **Settings** tab, expand **Member permissions**. -3. Clear the **Allow members to create private channels** check box. --You can also use [teams policies](/MicrosoftTeams/teams-policies) to control who can create private channels. --## Create a sensitivity label --To configure a team for security isolation, we'll be using a sensitivity label created specifically for this team. This label is used at the team level to control guest sharing and to block access from unmanaged devices. It can also be used to classify and encrypt individual files in the team so that only team owners and members can open them. --If you have an internal partner or stakeholder group who should be able to view encrypted documents but not edit them, you can add them to the label with view-only permissions. You can then add these people to the team's SharePoint site with Reader permissions, and they will have read-only access to the site where the documents are kept, but not the team itself. --To create a sensitivity label --1. Open the Microsoft Purview compliance portal, and under **Solutions**, select <a href="https://go.microsoft.com/fwlink/p/?linkid=2174015" target="_blank">**Information protection**</a>. -1. Click **Create a label**. -1. Give the label a name. We suggest naming it after the team that you'll be using it with. -1. Add a display name and description, and then click **Next**. -1. On the **Define the scope for this label page**, select **Files & emails** and **Groups & sites** and click **Next**. -1. On the **Choose protection settings for files and emails** page, select **Encrypt files and emails**, and then click **Next**. -1. On the **Encryption** page, choose **Configure encryption settings**. -1. Click **Add users or groups**, select the team that you created, and then click **Add** -1. Click **Choose permissions**. -1. Choose **Co-Author** from the dropdown list, and then click **Save**. -1. If you want to include users or groups with read-only access to files with the label: - 1. Click **Assign permissions**. - 1. Click **Add users or groups**, select the users or groups that you want to add, and then click **Add**. - 1. Click **Choose permissions**. - 1. Choose **Viewer** from the dropdown list, and then click **Save**. -13. Click **Save**, and then click **Next**. -14. On the *Auto-labeling for files and emails** page, click **Next**. -15. On the **Define protection settings for groups and sites** page, select **Privacy and external user access settings** and **Device access and external sharing settings** and click **Next**. -16. On the **Define privacy and external user access settings** page, under **Privacy**, select the **Private** option. -17. If you want to allow guest access, under **External user access**, select **Let Microsoft 365 Group owners add people outside your organization to the group as guests**. -18. Click **Next**. -19. On the **Define external sharing and device access settings** page, select **Control external sharing from labeled SharePoint sites**. -20. Under **Content can be shared with**, choose **New and existing guests** if you're allowing guest access or **Only people in your organization** if not. -21. Under **Access from unmanaged devices**, choose **Block access**. -22. Click **Next**. -23. On the **Auto-labeling for database columns** page, click **Next**. -24. Click **Create label**, and then click **Done**. --Once you've created the label, you need to publish it to the users who will use it. In this case, we'll make the label available only to people in the team. --To publish a sensitivity label: --1. In the Microsoft Purview compliance portal, on the <a href="https://go.microsoft.com/fwlink/p/?linkid=2174015" target="_blank">**Information protection** page</a>, choose the **Label policies** tab. -2. Click **Publish labels**. -3. On the **Choose sensitivity labels to publish** page, click **Choose sensitivity labels to publish**. -4. Select the label that you created, and then click **Add**. -5. Click **Next**. -6. On the Publish to users and groups page, click **Choose users and groups**. -7. Click **Add**, and then select the team that you created. -8. Click **Add**, and then click **Done**. -9. Click **Next**. -10. On the Policy settings page, select the **Users must provide justification to remove a label or lower classification label** check box, and then click **Next**. -11. Type a name for the policy, and then click **Next**. -12. Click **Submit** and then click **Done**. --## Apply the label to the team --Once the label has been published, you must apply it to the team in order for the guest sharing and managed devices settings to take effect. This is done in the SharePoint admin center. Note, it may take some time for the label to become available after it's been published. --To apply the sensitivity label --1. Open the SharePoint admin center, and under **Sites**, select <a href="https://go.microsoft.com/fwlink/?linkid=2185220" target="_blank">**Active sites**</a>. -1. Select the site that is associated with team. -1. On the **Policies** tab, under **Sensitivity**, select **Edit**. -1. Select the label that you created, and then select **Save**. --## SharePoint settings --There are three steps to do in SharePoint: --- Update the guest sharing settings for the site in the SharePoint admin center to match what you chose when you created the label, and update the default sharing link to *People with existing access*.-- Update the site sharing settings in the site itself to prevent members from sharing files, folders, or the site, and turn off access requests.-- If you added people or groups to the label with Viewer permissions, you can add them to the SharePoint site with Read permissions.--### SharePoint guest settings --The guest sharing setting that you chose when you created the label (which only affects team membership) should match the guest sharing settings for the associated SharePoint site as follows: --|Label setting|SharePoint site setting| -|:|:-| -|**Let Office 365 group owners add people outside the organization to the group** selected|**New and existing guests** (default for new teams)| -|**Let Office 365 group owners add people outside the organization to the group** not selected|**Only people in your organization**| --We'll also update the default sharing link type to reduce the risk of accidentally sharing files and folders to a wider audience than intended. --To update site settings --1. Open the SharePoint admin center, and under **Sites**, select <a href="https://go.microsoft.com/fwlink/?linkid=2185220" target="_blank">**Active sites**</a> -1. Select the site that is associated with team. -1. On the **Policies** tab, under **External sharing**, select **Edit**. -1. If you allowed guest sharing when you created the sensitive label, ensure that **New and existing guests** is selected. If you didn't allow sharing when you created the label, choose **Only people in your organization**. -1. Under Default sharing link type, clear the **Same as organization-level setting** check box, and select **People with existing access**. -1. Select **Save**. --#### Private channels --If you add private channels to the team, each private channel creates a new SharePoint site with the default sharing settings. These sites are not visible in the SharePoint admin center, so you must use the [Set-SPOSite](/powershell/module/sharepoint-online/set-sposite) PowerShell cmdlet with the following parameters to update the guest sharing settings: --- `-SharingCapability Disabled` to turn off guest sharing (it's on by default)-- `-DefaultSharingLinkType Internal` to change the default sharing link to *Specific people*--If you don't plan to use private channels with your team, consider turning off the ability for team members to create them under **Member permissions** in [team settings](https://support.microsoft.com/office/ce053b04-1b8e-4796-baa8-90dc427b3acc). --### Site sharing settings --To help ensure that the SharePoint site does not get shared with people who are not members of the team, we limit such sharing to owners. We also limit sharing of files and folders to team owners. This helps ensure that owners are aware whenever a file is shared with someone outside the team. --To configure owners-only site sharing -1. In Teams, navigate to the **General** tab of the team you want to update. -2. In the tool bar for the team, click **Files**. -3. Click the ellipsis, and then click **Open in SharePoint**. -4. In the tool bar of the underlying SharePoint site, click the settings icon, and then click **Site permissions**. -5. In the Site permissions pane, under **Sharing Settings**, click **Change sharing settings**. -6. Under **Sharing permissions**, choose **Only site owners can share files, folders, and the site**, and then click **Save**. --### Custom site permissions --If you added people with Viewer permissions to the sensitivity label, you can add them to the SharePoint site with Read access so they have easy access to the files. --To add users to the site -1. In the site, click the settings icon, and then click **Site permissions**. -2. Click **Invite people**, and then click **Share site only**. -3. Type the names of the users and groups that you want to invite. -4. For each person or group that you add, change their permissions from **Edit** to **Read**. -5. Choose if you want to send them an email with a link to the site. -6. Click **Add**. --## Additional protections --Microsoft 365 offers additional methods for securing your content. Consider if the following options would help improve security for your organization. --- Have your guests agree to a [terms of use](/azure/active-directory/conditional-access/terms-of-use).-- Configure a [session timeout policy](/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime) for guests.-- Create [sensitive information types](../compliance/sensitive-information-type-learn-about.md) and use [data loss protection](../compliance/dlp-learn-about-dlp.md) to set policies around accessing sensitive information.-- Use [Azure Active Directory access](/azure/active-directory/governance/access-reviews-overview) reviews to periodically review team access and membership.--## Drive user adoption for team members --With the team in place, it's time to drive the adoption of this team and its additional security to team members. --### Train your users --Members of the team can access the team and all of its resources, including chats, meetings, and other apps. When working with files from the **Files** section of a channel, members of the team should assign the sensitivity label to the files they create. --When the label gets applied to the file, it is encrypted. Members of the team can open it and collaborate in real time. If the file leaves the site and gets forwarded to a malicious user, they will have to supply credentials of a user account that is member of the team to open the file and view its contents. --Train your team members: --- On the importance of using the new team for chats, meetings, files, and the other resources of the SharePoint site and the consequences of a highly regulated data leak, such as legal ramifications, regulatory fines, ransomware, or loss of competitive advantage.-- How to access the team.-- How to create new files on the site and upload new files stored locally.-- How to label files with the correct sensitivity label for the team.-- How the label protects files even when they are leaked off the site.--This training should include hands-on exercises so that your team members can experience these capabilities and their results. --### Conduct periodic reviews of usage and address team member feedback --In the weeks after training: --- Quickly address team member feedback and fine tune policies and configurations.-- Analyze usage for the team and compare it with usage expectations.-- Verify that highly regulated files have been properly labeled with the sensitivity label. (You can see which files have a label assigned by viewing a folder in SharePoint and adding the **Sensitivity** column through the **Show/hide columns** option of **Add column**.--Retrain your users as needed. --## See also --[Azure AD Privileged Identity Management](/azure/active-directory/privileged-identity-management/pim-configure) |
| syntex | Content Processing Create Rules | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/content-processing-create-rules.md | To move or copy a file from one document library to another, follow these steps.  -2. On the **Manage rules** page, you can see the rules that have been applied. You can turn on or off a rule or [create a new rule](#move-or-copy-a-file) to automate actions on a specific document library. +2. On the **Manage rules** page, you can see the rules that have been applied. You can turn on or off a rule or [create a new rule](#create-a-rule-to-move-or-copy-a-file-from-one-document-library-to-another-in-microsoft-syntex) to automate actions on a specific document library.  In the document library, in the upper-right corner of the page, select the detai > [!NOTE] > Currently, the activity feed shows only move activity. Copy activity will be available in a future release. +## See also ++[Overview of content processing](content-processing-overview.md) |
| syntex | Content Processing Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/content-processing-overview.md | For example, you can create a rule to move files tagged with a specific customer > [!NOTE] > This feature is available only for users who are licensed for Syntex.++## See also ++[Create a rule to move or copy a file from one document library to another](content-processing-create-rules.md) |