Updates from: 03/15/2023 07:19:53
Category Microsoft Docs article Related commit history on GitHub Change details
admin Create Dns Records At Godaddy https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/dns/create-dns-records-at-godaddy.md
search.appverid:
- MET150 - MOE150 ms.assetid: f40a9185-b6d5-4a80-bb31-aa3bb0cab48a
-description: "Learn to verify your domain and set up DNS records for email, Skype for Business Online, and other services at GoDaddy for Microsoft."
+description: "Learn to verify your domain and set up DNS records for email, Teams, and other services at GoDaddy for Microsoft."
# Connect your DNS records at GoDaddy to Microsoft 365 **[Check the Domains FAQ](../setup/domains-faq.yml)** if you don't find what you're looking for.
-If GoDaddy is your DNS hosting provider, follow the steps in this article to verify your domain and set up DNS records for email, Skype for Business Online, and so on.
+If GoDaddy is your DNS hosting provider, follow the steps in this article to verify your domain and set up DNS records for email, Teams, and so on.
## Before you begin
Before you use your domain with Microsoft, we have to make sure that you own it.
If you're prompted to log in, use your login credentials, select your login name in the upper right, and then select **My Products**.
-1. Under **Domains**, select the three dots next to the domain you want to verify, and then select **Manage DNS**.
+2. Under **Domains**, select **DNS** next to the domain you want to verify.
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-1.png" alt-text="Select Manage DNS from the drop-down list.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-manage-dns.png" alt-text="Select DNS.":::
-1. Under **Records**, select **ADD** (You might have to scroll down).
+3. Under **DNS Records**, select **ADD** on the top right corner.
- :::image type="content" source="../../media/dns/56527673-ffb3b300-651b-11e9-91c2-83dc9fe5ca30.png" alt-text="Select ADD.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-add.png" alt-text="Select ADD.":::
-1. Choose **TXT** from the drop-down list.
+4. Select **TXT** option from the filter box.
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-Type.png" alt-text="Select TXT from the Type drop-down list.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-add-txt-records.png" alt-text="Select TXT from the Type drop-down list.":::
-1. In the boxes for the new record, type or copy and paste the values from the table.
+5. In the boxes for the new record, type or copy and paste the values from the table.
- |Type|Host|TXT Value|TTL|
+ |Type|Name|Value|TTL|
||||| |TXT|@|MS=ms *XXXXXXXX*<br>**Note**: This is an example. Use your specific **Destination or Points to Address** value here, from the table. [How do I find this?](../get-help-with-domains/information-for-dns-records.md)|1 hour <br>|
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-TXT-values.png" alt-text="Fill in the values from the table for the TXT record.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-TXTvalue.png" alt-text="Fill in the values from the table for the TXT record.":::
-1. Select **Save**.
+6. Select **Save**.
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-TXTSave.png" alt-text="Select Save.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-TXT-save.png" alt-text="Select Save.":::
Wait a few minutes before you continue, so that the record you just created can update across the Internet.
To verify the record in Microsoft 365:
1. In the admin center, go to the **Settings** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834818" target="_blank">**Domains**</a>.
-1. On the Domains page, select the domain that you're verifying, and select **Start setup**.
+2. On the Domains page, select the domain that you're verifying, and select **Start setup**.
:::image type="content" source="../../media/dns-IONOS/IONOS-DomainConnects-2.png" alt-text="Select Start setup.":::
-1. Select **Continue**.
+3. Select **Continue**.
-1. On the **Verify domain** page, select **Verify**.
+4. On the **Verify domain** page, select **Verify**.
> [!NOTE] > Typically it takes about 15 minutes for DNS changes to take effect. However, it can occasionally take longer for a change you've made to update across the Internet's DNS system. If you're having trouble with mail flow or other issues after adding DNS records, see [Troubleshoot issues after changing your domain name or DNS records](../get-help-with-domains/find-and-fix-issues.md).
To verify the record in Microsoft 365:
If you're prompted to log in, use your login credentials, select your login name in the upper right, and then select **My Products**.
-2. Under **Domains**, select the three dots next to the domain you want to verify, and then select **Manage DNS**.
+2. Under **Domains**, select the **DNS**.
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-1.png" alt-text="Select Manage DNS from the drop-down list.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-manage-dns.png" alt-text="Select DNS.":::
3. Under **Records**, select **ADD**.
- :::image type="content" source="../../media/dns/56527673-ffb3b300-651b-11e9-91c2-83dc9fe5ca30.png" alt-text="Select ADD.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-add.png" alt-text="Select ADD.":::
-4. Choose **MX** from the drop-down list.
-
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-Type.png" alt-text="Select MX from the Type drop-down list.":::
+4. Choose **MX** option from the filter box.
5. In the boxes for the new record, type or copy and paste the values from the following table. (Choose the **Type** and **TTL** values from the drop-down list.)
- |Type|Host|Points to|Priority|TTL|
+ |Type|Name|Priority|Value|TTL|
||||||
- |MX|@| *\<domain-key\>*.mail.protection.outlook.com <br/> **Note:** Get your *\<domain-key\>* from your Microsoft account. [How do I find this?](../get-help-with-domains/information-for-dns-records.md)|10 <br/> For more information about priority, see [What is MX priority?](../setup/domains-faq.yml)|1 hour|
+ |MX|@| 10 <br/> For more information about priority, see [What is MX priority?](../setup/domains-faq.yml)|*\<domain-key\>*.mail.protection.outlook.com <br/> **Note:** Get your *\<domain-key\>* from your Microsoft account. [How do I find this?](../get-help-with-domains/information-for-dns-records.md)|1 hour|
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-Type.png" alt-text="Fill in the values from the table for the MX record.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-MXvalues.png" alt-text="Fill in the values from the table for the MX record.":::
6. Select **Save**.
To verify the record in Microsoft 365:
If you're prompted to log in, use your login credentials, select your login name in the upper right, and then select **My Products**.
-2. Under **Domains**, select the three dots next to the domain you want to verify, and then select **Manage DNS**.
+2. Under **Domains**, select the three dots next to the domain you want to verify, and then select **DNS**.
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-1.png" alt-text="Select Manage DNS from the drop-down list.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-manage-dns.png" alt-text="Select DNS.":::
3. Under **Records**, select **ADD**.
- :::image type="content" source="../../media/dns/56527673-ffb3b300-651b-11e9-91c2-83dc9fe5ca30.png" alt-text="Select ADD.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-add.png" alt-text="Select ADD.":::
4. Choose **CNAME** from the drop-down list.
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-Type.png" alt-text="Select CNAME from the Type drop-down list.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-CNAME-type.png" alt-text="Select CNAME from the Type drop-down list.":::
+ 5. Create the CNAME record.
To verify the record in Microsoft 365:
(Choose the **TTL** value from the drop-down list.)
- |Type|Host|Points to|TTL|
+ |Type|Name|Value|TTL|
||||| |CNAME|autodiscover|autodiscover.outlook.com|1 hour|
To verify the record in Microsoft 365:
If you're prompted to log in, use your login credentials, select your login name in the upper right, and then select **My Products**.
-2. Under **Domains**, select the three dots next to the domain you want to verify, and then select **Manage DNS**.
+2. Under **Domains**, select the three dots next to the domain you want to verify, and then select **DNS**.
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-1.png" alt-text="Select Manage DNS from the drop-down list.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-manage-dns.png" alt-text="Select DNS from the drop-down list.":::
3. Under **Records**, select **ADD**.
- :::image type="content" source="../../media/dns/56527673-ffb3b300-651b-11e9-91c2-83dc9fe5ca30.png" alt-text="Select ADD.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-add.png" alt-text="Select ADD.":::
4. Choose **TXT** from the drop-down list.
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-Type.png" alt-text="Select TXT from the Type drop-down list.":::
+ :::image type="content" source="../../media\dns-godaddy\godaddy-domains-TXT-save.png" alt-text="Select TXT from the Type drop-down list.":::
5. In the boxes for the new record, type or copy and paste the following values. (Choose the **TTL** value from the drop-down lists.)
- |Type|Host|TXT Value|TTL|
+ |Type|Name|Value|TTL|
|||||
- |TXT|@|v=spf1 include:spf.protection.outlook.com -all <br/> **Note:** We recommend copying and pasting this entry, so that all of the spacing stays correct.|1 hour|
+ |TXT|@|v=spf1 include:secureserver.net -all <br/> **Note:** We recommend copying and pasting this entry, so that all of the spacing stays correct.|1 hour|
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-TXT-values.png" alt-text="Fill in the values from the table for the TXT record.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-add-TXTvalue-spf.png" alt-text="Fill in the values from the table for the TXT record.":::
6. Select **Save**. ## Advanced option: Skype for Business
-Only select this option if your organization uses Skype for Business for online communication services like chat, conference calls, and video calls, in addition to Microsoft Teams. Skype needs 4 records: 2 SRV records for user-to-user communication, and 2 CNAME records to sign-in and connect users to the service.
+Only select this option if your organization uses Microsoft Teams. Teams needs 4 records: 2 SRV records for user-to-user communication, and 2 CNAME records to sign-in and connect users to the service.
### Add the two required SRV records
Only select this option if your organization uses Skype for Business for online
If you're prompted to log in, use your login credentials, select your login name in the upper right, and then select **My Products**.
-1. Under **Domains**, select the three dots next to the domain you want to verify, and then select **Manage DNS**.
+2. Under **Domains**, select the three dots next to the domain you want to verify, and then select **DNS**.
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-1.png" alt-text="Select Manage DNS from the drop-down list.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-manage-dns.png" alt-text="Select DNS from the drop-down list.":::
-1. Under **Records**, select **ADD**.
+3. Under **Records**, select **ADD**.
- :::image type="content" source="../../media/dns/56527673-ffb3b300-651b-11e9-91c2-83dc9fe5ca30.png" alt-text="Select ADD.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-add.png" alt-text="Select ADD.":::
-1. Choose **SRV** from the drop-down list.
+4. Choose **SRV** from the drop-down list.
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-Type.png" alt-text="Select SRV from the Type drop-down list.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-SRV.png" alt-text="Select SRV from the Type drop-down list.":::
-1. Create the first SRV record.
+5. Create the first SRV record.
In the boxes for the new record, type or copy and paste the values from the first row of the following table. (Choose the **Type** and **TTL** values from the drop-down lists.)
- |Type|Service|Protocol|Name|Target|Priority|Weight|Port|TTL|
+ |Type|Service|Protocol|Name|Value|Priority|Weight|Port|TTL|
|||||||||| |SRV|_sip|_tls|@|sipdir.online.lync.com|100| 1|443|1 Hour| |SRV|_sipfederationtls|_tcp|@| sipfed.online.lync.com| 100|1|5061|1 Hour|
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-SRV-values.png" alt-text="Fill in the values from the table for the SRV record.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-SRV-records.png" alt-text="Fill in the values from the table for the SRV record.":::
-1. Select **Save**.
+6. Select **Save**.
-1. Add the other SRV record by choosing the values from the second row of the table.
+7. Add the other SRV record by choosing the values from the second row of the table.
> [!NOTE] > Typically it takes about 15 minutes for DNS changes to take effect. However, it can occasionally take longer for a change you've made to update across the Internet's DNS system. If you're having trouble with mail flow or other issues after adding DNS records, see [Troubleshoot issues after changing your domain name or DNS records](../get-help-with-domains/find-and-fix-issues.md).
Only select this option if your organization uses Skype for Business for online
If you're prompted to log in, use your login credentials, select your login name in the upper right, and then select **My Products**.
-1. Under **Domains**, select the three dots next to the domain you want to verify, and then select **Manage DNS**.
+2. Under **Domains**, select the three dots next to the domain you want to verify, and then select **Manage DNS**.
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-1.png" alt-text="Select Manage DNS from the drop-down list.":::
+3. Under **Records**, select **ADD**.
-1. Under **Records**, select **ADD**.
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-add.png" alt-text="Select ADD.":::
- :::image type="content" source="../../media/dns/56527673-ffb3b300-651b-11e9-91c2-83dc9fe5ca30.png" alt-text="Select ADD.":::
+4. Choose **CNAME** from the drop-down list.
-1. Choose **CNAME** from the drop-down list.
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-CNAME-type.png" alt-text="Select CNAME from the Type drop-down list.":::
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-Type.png" alt-text="Select CNAME from the Type drop-down list.":::
+5. In the empty boxes for the new records, type or copy and paste the values from the first row in the following table.
-1. In the empty boxes for the new records, type or copy and paste the values from the first row in the following table.
-
- |Type|Host|Points to|TTL|
+ |Type|Name|Value|TTL|
||||| |CNAME|sip|sipdir.online.lync.com. <br/> **This value MUST end with a period (.)**|1 Hour| |CNAME|lyncdiscover|webdir.online.lync.com. <br/> **This value MUST end with a period (.)**|1 Hour|
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-CNAME-values.png" alt-text="Fill in the values from the table for the CNAME record.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-CNAME-records.png" alt-text="Fill in the values from the table for the CNAME record.":::
1. Select **Save**.
This service helps you secure and remotely manage mobile devices that connect to
If you're prompted to log in, use your login credentials, select your login name in the upper right, and then select **My Products**.
-1. Under **Domains**, select the three dots next to the domain you want to verify, and then select **Manage DNS**.
+2. Under **Domains**, select the three dots next to the domain you want to verify, and then select **DNS**.
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-1.png" alt-text="Select Manage DNS from the drop-down list.":::
+ :::image type="content" source="../../media\dns-godaddy\godaddy-manage-dns.png" alt-text="Select DNS from the drop-down list.":::
-1. Under **Records**, select **ADD**.
+3. Under **Records**, select **ADD**.
- :::image type="content" source="../../media/dns/56527673-ffb3b300-651b-11e9-91c2-83dc9fe5ca30.png" alt-text="Select ADD.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-add.png" alt-text="Select ADD.":::
-1. Choose **CNAME** from the drop-down list.
+4. Choose **CNAME** from the drop-down list.
- :::image type="content" source="../../media/dns-godaddy/godaddy-domains-Type.png" alt-text="Select CNAME from the Type drop-down list.":::
+ :::image type="content" source="../../media/dns-godaddy/godaddy-domains-CNAME-type.png" alt-text="Select CNAME from the Type drop-down list.":::
1. In the empty boxes for the new records, type or copy and paste the values from the first row in the following table.
- |Type|Host|Points to|TTL|
+ |Type|Name|Value|TTL|
||||| |CNAME|enterpriseregistration|enterpriseregistration.windows.net. <br/> **This value MUST end with a period (.)**|1 Hour| |CNAME|enterpriseenrollment|enterpriseenrollment-s.manage.microsoft.com. <br/> **This value MUST end with a period (.)**|1 Hour|
compliance Import Hr Data https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/import-hr-data.md
f1.keywords:
Previously updated : 01/01/2023 Last updated : 03/13/2023 audience: Admin
Setting up a connector for HR data that insider risk management policies can use
- This connector is available in GCC environments in the Microsoft 365 US Government cloud. Third-party applications and services might involve storing, transmitting, and processing your organization's customer data on third-party systems that are outside of the Microsoft 365 infrastructure and therefore aren't covered by the Microsoft Purview and data protection commitments. Microsoft makes no representation that use of this product to connect to third-party applications implies that those third-party applications are FEDRAMP compliant. For step-by-step instructions for setting up an HR connector in a GCC environment, see [Set up a connector to import HR data in US Government](import-hr-data-US-government.md).
+- Add the *webhook.ingestion.office.com* domain to your firewall allowlist for your organization.
+ ## Step 1: Prepare a CSV file with your HR data The first step is to create a CSV file that contains the HR data that the connector will import to Microsoft 365. This data will be used by the insider risk solution to generate potential risk indicators. Data for the following HR scenarios can be imported to Microsoft 365:
You can also select **Edit** to change the Azure App ID or the column header nam
## Step 4: Run the sample script to upload your HR data
+> [!IMPORTANT]
+> You must add the *webhook.ingestion.office.com* domain to your firewall allowlist for your organization. If this domain is blocked, the script won't run.
+ The last step in setting up an HR connector is to run a sample script that will upload the HR data in the CSV file (that you created in Step 1) to the Microsoft cloud. Specifically, the script uploads the data to the HR connector. After you run the script, the HR connector that you created in Step 3 imports the HR data to your Microsoft 365 organization where it can be accessed by other compliance tools, such as the Insider risk management solution. After you run the script, consider scheduling a task to run it automatically on a daily basis so the most current employee termination data is uploaded to the Microsoft cloud. See [Schedule the script to run automatically](#optional-step-6-schedule-the-script-to-run-automatically). 1. Go to window that you left open from the previous step to access the GitHub site with the sample script. Alternatively, open the bookmarked site or use the URL that you copied. You can also access the script [here](https://github.com/microsoft/m365-compliance-connector-sample-scripts/blob/main/sample_script.ps1).
compliance Insider Risk Management Configure https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-configure.md
For step-by-step instructions to turn on auditing, see [Turn audit log search on
## Step 3 (optional): Enable and view insider risk analytics insights
-Insider risk management analytics enables you to conduct an evaluation of potential insider risks in your organization without configuring any insider risk policies. This evaluation can help your organization identify potential areas of higher user risk and help determine the type and scope of insider risk management policies you may consider configuring. This evaluation may also help you determine needs for additional licensing or future optimization of existing policies. Analytics scan results may take up to 48 hours before insights are available as reports for review. To learn more about analytics insights, see [Insider risk management settings: Analytics](insider-risk-management-settings.md#analytics) and check out the [Insider Risk Management Analytics video](https://www.youtube.com/watch?v=5c0P5MCXNXk) to help understand how analytics can help accelerate the identification of potential insider risks and help you to quickly take action.
-
+Insider tisk management analytics enables you to conduct an evaluation of potential insider risks in your organization without configuring any insider risk policies. This evaluation can help your organization identify potential areas of higher user risk and help determine the type and scope of insider risk management policies you may consider configuring. This evaluation may also help you determine needs for additional licensing or future optimization of existing policies. Analytics scan results may take up to 48 hours before insights are available as reports for review. To learn more about analytics insights, see [Insider risk management settings: Analytics](insider-risk-management-settings.md#analytics) and check out the [Insider Risk Management Analytics video](https://www.youtube.com/watch?v=5c0P5MCXNXk) to help understand how analytics can help accelerate the identification of potential insider risks and help you to quickly take action.
To enable insider risk analytics, you must be a member of the *Insider Risk Management*, *Insider Risk Management Admins*, or Microsoft 365 *Global admin* role group. Complete the following steps to enable insider risk analytics:
Before configuring a policy, define the following insider risk settings:
- [Site exclusions](insider-risk-management-settings.md#site-exclusions) - [Keyword exclusion](insider-risk-management-settings.md#keyword-exclusion)
- > [!NOTE]
- > As you make intelligent detections adjustments for domains, sensitive info types, trainable classifiers, file types, and SharePoint sites, to help you understand the effect of those changes for your policies, Microsoft Purview Insider Risk Management calculates the number of users and the number of activities affected. It takes 24 hours for the changes to appear.
-
6. On the **Export alerts** page, enable export of insider risk alert information using the Office 365 Management APIs if needed. 7. On the **Priority user groups** page, create a priority user group and add users if not created in **Step 3**. 8. On the **Power Automate flows** page, configure a flow from insider risk flow templates or create a new flow. See the [Getting started with insider risk management settings](insider-risk-management-settings.md#power-automate-flows-preview) article for step-by-step guidance.
compliance Insider Risk Management Settings https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-settings.md
f1.keywords:
Previously updated : 02/21/2023 Last updated : 03/13/2023 audience: itpro - highpri
Another option for policy thresholds is to assign the policy triggering event to
Policy timeframes allow you to define past and future review periods that are triggered after policy matches based on events and activities for the insider risk management policy templates. Depending on the policy template you choose, the following policy timeframes are available: - **Activation window**: Available for all policy templates, the *Activation window* is the defined number of days that the window activates **after** a triggering event. The window activates for 1 to 30 days after a triggering event occurs for any user assigned to the policy. For example, you've configured an insider risk management policy and set the *Activation window* to 30 days. Several months have passed since you configured the policy, and a triggering event occurs for one of the users included in the policy. The triggering event activates the *Activation window* and the policy is active for that user for 30 days after the triggering event occurred.-- **Past activity detection**: Available for all policy templates, the *Past activity detection* is the defined number of days that the window activates **before** a triggering event. The window activates for 0 to 90 days before a triggering event occurs for any user assigned to the policy. For example, you've configured an insider risk management policy and set the *Past activity detection* to 90 days. Several months have passed since you configured the policy, and a triggering event occurs for one of the users included in the policy. The triggering event activates the *Past activity detection* and the policy gathers historic activities for that user for 90 days prior to the triggering event.
+- **Past activity detection**: Available for all policy templates, the *Past activity detection* is the defined number of days that the window activates **before** a triggering event. For activities in the audit log, the window activates for 0 to 90 days before a triggering event occurs for any user assigned to the policy. For example, you've configured an insider risk management policy and set the *Past activity detection* to 90 days. Several months have passed since you configured the policy, and a triggering event occurs for one of the users included in the policy. The triggering event activates the *Past activity detection* and the policy gathers historic activities for that user for 90 days prior to the triggering event.
+
+ > [!NOTE]
+ > For email activities, the past activity detection period is 10 days.
![Insider risk management timeframe settings.](../media/insider-risk-settings-timeframes.png)
compliance Microsoft 365 Compliance Center Permissions https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/microsoft-365-compliance-center-permissions.md
f1.keywords:
Previously updated : 01/01/2023 Last updated : 03/14/2023 audience: ITPro
The roles that appear in the **Azure AD** > **Roles** section of the compliance
## Administrative units (preview)
+> [!IMPORTANT]
+> Administrative units are supported only in Microsoft 365 commercial cloud organizations for public preview.
+ Administrative units let you subdivide your organization into smaller units, and then assign specific administrators that can manage only the members of those units. They also allow you to assign administrative units to members of role groups in Microsoft Purview solutions, so that these administrators can manage only the members (and associated features) of those assigned administrative units. For example, you could use administrative units to delegate permissions to administrators for each geographic region in a large multi-national organization or for grouping administrator access by department within your organization. You can create region or department-specific policies or view user activity as a result of those policies and administrative unit assignment. You can also use administrative units as an initial scope for a policy, where the selection of users eligible for the policy depends on membership in administrative units.
For these solutions, the following features also support administrative units:
- Alerts: [DLP](/microsoft-365/compliance/dlp-alerts-dashboard-get-started) alerts are visible only from users in assigned administrative units - [Activity explorer](data-classification-activity-explorer.md): Activity events are visible only from users in assigned administrative units
+Administrative units are also supported for some built-in role groups. You can add users and groups to administrative units for the following built-in role groups:
+
+- Compliance Administrator
+- Compliance Data Administrators
+- Global Reader
+- Information Protection
+- Information Protection Admins
+- Information Protection Analyst
+- Information Protection Investigators
+- Information Protection Readers
+- Organization Management
+- Security Administrator
+- Security Operator
+- Security Reader
+ When you assign role groups, you can select individual members or groups, and then the **Assign admin units** option to select administrative units that have been defined in Azure Active Directory: ![Assign admin units option when you edit role groups.](../media/assign-admin-units.png)
+> [!IMPORTANT]
+> **Assign admin units** is always available when you've created custom role groups. You can assign administrative units for any custom role group.
+ These administrators, referred to as restricted administrators, can now select one or more of their assigned administrative units to automatically define the initial scope of policies that they create or edit. Only if administrators don't have administrative units assigned (unrestricted administrators), will they be able to assign policies to the entire directory without selecting individual administrative units. > [!IMPORTANT]
Complete the following steps to configure and use administrative units with Micr
1. [Create administrative units](/azure/active-directory/roles/admin-units-manage#create-an-administrative-unit) to restrict the scope of role permissions in Azure Active Directory (Azure AD). 2. [Add users and distribution groups](/azure/active-directory/roles/admin-units-members-add) to administrative units.+
+ >[!IMPORTANT]
+ >Members of [Dynamic Distribution Groups](/azure/active-directory/roles/administrative-units#groups) don't automatically become members of an administrative unit.
+ 3. If creating a geographic region or department-based administrative units, configure administrative units with [dynamic membership rules](/azure/active-directory/roles/admin-units-members-dynamic). >[!NOTE]
Complete the following steps to add users or groups to a Microsoft Purview role
6. Select **Select**. 7. If the selected users or groups need organization-wide access as part of this role group assignment, go to Step 10. 8. If the selected users or groups need to be assigned to administrative units, select the users or groups and select **Assign admin units**.+
+ > [!IMPORTANT]
+ > Administrative units are supported only in Microsoft 365 commercial cloud organizations for public preview.
+ 9. On the **Assign admin units (preview)** pane, select the checkbox for all the administrative units you want to assign to the users or groups. Select **Select**. 10. Select **Next** and **Save** to add the users or groups to the role group. Select **Done** to complete the steps.
Complete the following steps to create a custom Microsoft Purview role group:
10. Select **Next** to continue. 11. If the selected users or groups need organization-wide access as part of this role group assignment, go to Step 14. 12. If the selected users or groups need to be assigned to administrative units, select the users or groups and select **Assign admin units**.+
+ > [!IMPORTANT]
+ > Administrative units are supported only in Microsoft 365 commercial cloud organizations for public preview.
+ 13. On the **Assign admin units (preview)** pane, select the checkbox for all the administrative units you want to assign to the users or groups. Select **Select**. 14. Select **Next**. 15. On the **Review the role group and finish** page, review the details for the custom role group. If you need to edit the information, select **Edit** in the appropriate section. When all the settings are correct, select **Create** to create the custom role group or select **Cancel** to discard the changes and not create the custom role group.
compliance Purview Adaptive Scopes https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/purview-adaptive-scopes.md
description: Learn about Microsoft Purview adaptive scopes for policies.
# Adaptive scopes
-When you create a communications compliance policy or a policy for retention, you can create or add an adaptive scope for your policy. A single policy can have one or many adaptive scopes.
+When you create a [communication compliance policy](/microsoft-365/compliance/communication-compliance-policies) or a policy for retention, you can create or add an adaptive scope for your policy. A single policy can have one or many adaptive scopes.
- An adaptive scope uses a query that you specify, so you can define the membership of users or groups included in that query. These dynamic queries run daily against the attributes or properties that you specify for the selected scope. You can use one or more adaptive scopes with a single policy. - For example, you can assign different policy settings to users according to their department by using existing Azure AD attributes without the administrative overhead of creating and maintaining groups for this purpose.
When you choose to use adaptive scopes, you're prompted to select what type of a
> [!NOTE]
-> For communications compliance policies, SharePoint sites and OneDrive accounts are not suported. Also, excluded users and Microsoft 365 groups are supported.
+> For communication compliance policies, SharePoint sites and OneDrive accounts are not supported. Excluded users and Microsoft 365 groups are supported.
The property names for sites are based on SharePoint site managed properties. For information about the custom attributes, see [Using Custom SharePoint Site Properties to Apply Microsoft 365 Retention with Adaptive Policy Scopes](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/using-custom-sharepoint-site-properties-to-apply-microsoft-365/ba-p/3133970).
compliance Sensitivity Labels Aip https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-aip.md
f1.keywords:
Previously updated : 03/13/2023 Last updated : 03/14/2023 audience: Admin
description: For Office 365 apps, understand the migration of the Azure Informat
>*[Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance).*
-When you use [sensitivity labels](sensitivity-labels.md) in Microsoft 365 Apps on Windows computers, we recommend you use you labeling that's built into Office apps, even if you have the [Azure Information Protection (AIP) unified labeling client](/azure/information-protection/rms-client/aip-clientv2) installed. Moving forward, the AIP add-in will be disabled by default in the latest versions of Office apps.
+When you use [sensitivity labels](sensitivity-labels.md) in Microsoft 365 Apps on Windows computers, we recommend you use you labeling that's built into Office apps, even if you have the [Azure Information Protection (AIP) unified labeling client](/azure/information-protection/rms-client/aip-clientv2) installed. The AIP add-in is now disabled by default in the latest versions of Office apps.
To prepare for this change, use this article to understand the benefits of using built-in labeling, which main features have parity, and how to control the migration from the AIP add-in to the newer labeling experience.
Built-in labeling forms the cornerstone of a [Microsoft Purview Information Prot
Because built-in labels don't use an Office add-in, they benefit from more stability and better performance. They also support the latest Microsoft Purview features, such as advanced classifiers.
-Up until recently, built-in labeling was turned off by default in Office for Windows apps when the AIP client was installed. This default will no longer be the case for newer versions of Office. You can control the default behavior by using the instructions in the following section, [How to disable the AIP add-in to use built-in labeling for Office apps](#how-to-disable-the-aip-add-in-to-use-built-in-labeling-for-office-apps). For example, disable the add-in for initial testing on a couple of computers, and then move onto a pilot for a few users. When you're ready, migrate all users to the newer labeling experience.
+Up until recently, built-in labeling was turned off by default in Office for Windows apps when the AIP client was installed. This default is no longer the case for newer versions of Office. You can control the default behavior by using the instructions in the following section, [How to disable the AIP add-in to use built-in labeling for Office apps](#how-to-disable-the-aip-add-in-to-use-built-in-labeling-for-office-apps). For example, disable the add-in for initial testing on a couple of computers, and then move onto a pilot for a few users. When you're ready, migrate all users to the newer labeling experience.
When you keep the AIP client installed but disabled in Office apps, the other capabilities of the AIP client remain supported:
Some features are only supported by built-in labeling for Office apps, and won't
- Access to intelligent classification services that include [trainable classifiers](classifier-learn-about.md), [exact data match (EDM)](sit-learn-about-exact-data-match-based-sits.md), and [named entities](named-entities-learn.md) - Detection of sensitive information as users enter the text - In Word, users can review and remove the identified sensitive content-- [Sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) that is integrated into existing user workflows
+- [Sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) that's integrated into existing user workflows
- [PDF support](sensitivity-labels-office-apps.md#pdf-support)-- [Protect meeting invites, with their attachments and responses](sensitivity-labels-meetings.md) (in preview)
+- [Protect meeting invites, with their attachments and responses](sensitivity-labels-meetings.md)
- For labels that let users assign permissions, different permissions (Read or Change) can be granted to users or groups - Encrypt-Only for emails - Support for account switching
To keep informed when new labeling capabilities become available for built-in la
## How to disable the AIP add-in to use built-in labeling for Office apps
-For the latest Office apps, the AIP add-in is disabled by default, so there's nothing for you to configure:
--- Currently in preview: [Current Channel (Preview)](https://office.com/insider)-- **Current Channel** and **Monthly Enterprise Channel**: Not before version 2302+ (not yet released) -- **Semi-Annual Channel**: Not before version 2302+ (not yet released)-
-If you have a version that disabled the AIP add-in by default, and you need to use the AIP add-in rather than built-in labeling, you must [configure a new setting to override the default](#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in).
+Starting with **version 2302** for all Office deployment channels, the AIP add-in is disabled by default. For these versions, there's nothing for you to configure for users to benefit from built-in labels. If you need to use the AIP add-in rather than built-in labeling, you must [configure a new setting to override the default](#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in).
> [!IMPORTANT]
-> If youΓÇÖve previously used the AIP add-in as the default labeling client in Office apps and use Office versions identified in this section, the AIP add-in could be automatically disabled and replaced by built-in labeling.
+> If youΓÇÖve previously used the AIP add-in as the default labeling client in Office apps and use Office versions 2302 or later, by default, the AIP add-in is automatically disabled and replaced by built-in labeling.
To disable the AIP add-in for older versions, see the next section.
Remember, when the AIP add-in is disabled, you can still use the AIP client to e
### How to configure older versions of Office to disable the AIP add-in
-For Office apps older than the versions listed in the previous section, to prevent the AIP add-in from loading in Office apps, use the Group Policy setting **List of managed add-ins** as documented in [No Add-ins loaded due to group policy settings for Office 2013 and Office 2016 programs](https://support.microsoft.com/help/2733070/no-add-ins-loaded-due-to-group-policy-settings-for-office-2013-and-off).
+For Office apps older than version 2302, to prevent the AIP add-in from loading in Office apps, use the Group Policy setting **List of managed add-ins** as documented in [No Add-ins loaded due to group policy settings for Office 2013 and Office 2016 programs](https://support.microsoft.com/help/2733070/no-add-ins-loaded-due-to-group-policy-settings-for-office-2013-and-off).
For your Windows Office apps that support built-in labeling, use the configuration for Microsoft Word 2016, Excel 2016, PowerPoint 2016, and Outlook 2016, specify the following programmatic identifiers (ProgID) for the AIP client, and set the option to **0: The add-in is always disabled (blocked)**
If after making these changes the **Sensitivity** button doesn't display on the
> [!CAUTION] > If you've previously set the value of **Use the Sensitivity feature in Office to apply and view sensitivity labels** to **0** (or used the equivalent registry key of **UseOfficeForLabelling**) to disable built-in labeling because you wanted to use the AIP add-in: Going forward, if you don't configure the new setting that's described in this section, you won't be able to use sensitivity labeling with either the AIP add-in or built-in labeling.
-In the [newer versions of Office](#how-to-disable-the-aip-add-in-to-use-built-in-labeling-for-office-apps), the AIP add-in is disabled by default. To enable it, you must configure a new Office setting under **User Configuration/Administrative Templates/Microsoft Office 2016/Security Settings**:
+Starting with version 2302 of the Office apps, the AIP add-in is disabled by default. To enable it, you must configure a new Office setting under **User Configuration/Administrative Templates/Microsoft Office 2016/Security Settings**:
- **Use the Azure Information Protection add-in for sensitivity labeling**. Set the value to **1**.
Additional Office settings you might need to configure:
## Feature parity for built-in labeling and the AIP add-in for Office apps
-Many of the labeling features supported by the AIP add-in are now supported by built-in labeling. For a more detailed list of available capabilities, minimum versions that might be needed, and configuration information, see [Manage sensitivity labels in Office apps](sensitivity-labels-office-apps.md). To support a specific feature, you might need to change your [Office update channel](/deployoffice/overview-update-channels).
+Many of the labeling features supported by the AIP add-in are now supported by built-in labeling. For a detailed list of available capabilities and configuration information, see [Manage sensitivity labels in Office apps](sensitivity-labels-office-apps.md). To support a specific feature, you might need to change your [Office update channel](/deployoffice/overview-update-channels).
More features are planned and in development. If there's a specific feature that you're interested in, check the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap?filters=Microsoft%20Information%20Protection&searchterms=label) and consider joining the [Microsoft Information Protection in Office Private Preview](https://aka.ms/MIP/PreviewRing).
-Use the following information to help you identify if the features you use with the AIP add-in is currently available with built-in labeling. Features that aren't yet available but in planning or deployment might delay your final migration for users, but you can begin testing the other features now to expedite a later migration.
+Use the following information to help you identify if the features you use with the AIP add-in is available with built-in labeling. Additional features that aren't yet available but in planning or deployment might delay your final migration for users, but you can begin testing the other features now to expedite a later migration.
|AIP add-in feature or capability|Built-in labeling| ||::|
Use the following information to help you identify if the features you use with
|Central reporting and auditing|![Supported.](../medi#auditing-labeling-activities)| |Government Cloud|![Supported.](../media/yes-icon.png)| |Admin can disable labeling for all apps| ![Supported.](../medi#if-you-need-to-turn-off-built-in-labeling-in-office-apps-on-windows)|
-|Admin can display labels for just files or just emails| [Rolling out](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails)|
+|Admin can display labels for just files or just emails| ![Supported.](../medi#scope-labels-to-just-files-or-emails)|
|**Category: User Experience**|| |Labeling button on the ribbon|![Supported.](../media/yes-icon.png)| |Multilanguage support for label names and tooltips|![Supported.](../medi#example-configuration-to-configure-a-sensitivity-label-for-different-languages)|
-|Visibility of labels on a toolbar|[In preview](sensitivity-labels-office-apps.md#sensitivity-bar)|
-|Label colors|[In preview](sensitivity-labels-office-apps.md#label-colors)|
+|Visibility of labels on a toolbar|![Supported.](../medi#sensitivity-bar)|
+|Label colors|![Supported.](../medi#label-colors)|
|**Category: Labeling actions**|| |Manual labeling|![Supported.](../media/yes-icon.png) <br>[Learn more](https://support.microsoft.com/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)| |Mandatory labeling|![Supported.](../medi#what-label-policies-can-do)|
However, you might find you don't need to use PowerShell to configure the suppor
The following configurations from the AIP add-in that aren't yet supported by built-in labeling include: - [Label inheritance from email attachments](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#for-email-messages-with-attachments-apply-a-label-that-matches-the-highest-classification-of-those-attachments)
- - This option is currently rolling out in preview. For more information, see [Configure label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments)
+ - This option is currently rolling out in preview. For more information, see [Configure label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments).
- [Oversharing popup messages for Outlook](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#implement-pop-up-messages-in-outlook-that-warn-justify-or-block-emails-being-sent)
- - The equivalent of this configuration is now rolling out in preview. For more information, see the [migration playbook to configure oversharing popups](https://microsoft.github.io/ComplianceCxE/playbooks/AIP2MIP/Features/Collaboration/OversharingPopups/)
--- [Default sublabel for a parent label](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#specify-a-default-sublabel-for-a-parent-label)
- - This option is currently rolling out in general availability. For more information, see [Specify a default sublabel for a parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)
+ - The equivalent of this configuration is now rolling out in preview. For more information, see the [migration playbook to configure oversharing popups](https://microsoft.github.io/ComplianceCxE/playbooks/AIP2MIP/Features/Collaboration/OversharingPopups/).
- [Remove external content markings](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#remove-headers-and-footers-from-other-labeling-solution)
compliance Sensitivity Labels Office Apps https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md
When the Outlook app supports turning off mandatory labeling:
When the Outlook app doesn't support turning off mandatory labeling: If you select **Require users to apply a label to their email or documents** as a policy setting, Outlook will always prompt users to select a label for unlabeled emails.
-> [!NOTE]
-> If you have configured the PowerShell advanced settings **OutlookDefaultLabel** and **DisableMandatoryInOutlook** by using the [Set-LabelPolicy](/powershell/module/exchange/set-labelpolicy) or [New-LabelPolicy](/powershell/module/exchange/new-labelpolicy) cmdlets:
->
-> Your chosen values for these PowerShell settings are reflected in the label policy configuration in the Microsoft Purview compliance portal, and they automatically work for Outlook apps that support these settings. The other PowerShell advanced settings remain supported for the Azure Information Protection unified labeling client only.
- ## Scope labels to just files or emails > [!NOTE]
When the Outlook app doesn't support turning off mandatory labeling: If you sele
> > Until this capability is supported on all the platforms used by your users, they will have an inconsistent labeling experience. For example, Word on one platform doesn't display a label that they see on a different platform.
-This configuration is an extension to the **Items** scope, when you [create or edit a sensitivity label](create-sensitivity-labels.md#create-and-configure-sensitivity-labels) in the Microsoft Purview compliance center. When you define the scope for the label for items, you can further refine the scope to just files or emails, and to [meetings](sensitivity-labels-meetings.md):
+This configuration is an extension to the **Items** scope, when you [create or edit a sensitivity label](create-sensitivity-labels.md#create-and-configure-sensitivity-labels) in the Microsoft Purview compliance portal. When you define the scope for the label for items, you can further refine the scope to just files or emails, and to [meetings](sensitivity-labels-meetings.md):
- To scope labels to just Word, Excel, and PowerPoint: Make sure the option for **Files** is selected, and not the option for **Emails**. - To scope labels to just Outlook, make sure the option for **Emails** is selected, and not the option for **Files**.
-Make sure both options are selected if you don't want to scope the labels to just Word, Excel, and PowerPoint, or to just Outlook.
+> [!WARNING]
+> Although you can edit an existing label and remove the **Files** scope, we don't recommend you do this because existing configurations might no longer work as expected. For example, a SharePoint site admin wouldn't understand why a sensitivity label that they selected as a default label for a document library no longer applies the label.
+>
+> If you want a sensitivity label just for emails, create a new label with just the **Emails** scope rather than edit an existing label.
+
+Make sure both options are selected if you don't need to scope the labels to just Word, Excel, and PowerPoint, or to just Outlook.
> [!NOTE] > The **Files** option can include other items that support this scoping option, such as Power BI files. Check the application's documentation to verify, and remember to test all labeling apps and services used by your organization.
Deploy this setting by using Group Policy, or by using the [Cloud Policy service
## Sensitivity bar
-Supported in preview for built-in labeling, use the tables in [Minimum versions for sensitivity labels in Office apps](sensitivity-labels-versions.md) to identify which Office versions support this feature.
+Use the tables in [Minimum versions for sensitivity labels in Office apps](sensitivity-labels-versions.md) to identify which Office versions support the sensitivity bar.
When Word, Excel, and PowerPoint support this feature, sensitivity labels are displayed in a sensitivity bar next to the file name on the top window bar. For example:
compliance Sensitivity Labels Versions https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-versions.md
Previously updated : 03/13/2023 Last updated : 03/14/2023 audience: Admin
The numbers listed are the minimum Office application versions required for each
|Capability |Windows |Mac |iOS |Android |Web | |--|-:|-|-|--|-|
-|[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)| Preview: [Current Channel (Preview)](https://office.com/insider) | Not relevant | Not relevant | Not relevant| Not relevant |
-|[Manually apply, change, or remove label](https://support.microsoft.com/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
-|[Multi-language support](create-sensitivity-labels.md#additional-label-settings-with-security--compliance-powershell)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | Under review |
-|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) to new documents | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
-|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) to existing documents | Current Channel: 2208+ <br /><br> Monthly Enterprise Channel: 2207+ <br /><br> Semi-Annual Enterprise Channel: Under review | 16.63+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
-|[Require a justification to change a label](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
-|[Provide help link to a custom help page](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
-|[Mark the content](sensitivity-labels.md#what-sensitivity-labels-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
-|[Dynamic markings with variables](sensitivity-labels-office-apps.md#dynamic-markings-with-variables) | Current Channel: 2010+ <br /><br> Monthly Enterprise Channel: 2010+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.42+ | 2.42+ | 16.0.13328+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
-|[Assign permissions now](encryption-sensitivity-labels.md#assign-permissions-now) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
-|[Let users assign permissions: <br /> - Prompt users for custom permissions (users and groups)](encryption-sensitivity-labels.md#let-users-assign-permissions) |Current Channel: 2004+ <br /><br> Monthly Enterprise Channel: 2004+ <br /><br> Semi-Annual Enterprise Channel: 2008+ | 16.35+ | Under review | Under review | Under review |
-|[Let users assign permissions: <br /> - Prompt users for custom permissions (users, groups, and organizations)](encryption-sensitivity-labels.md#support-for-organization-wide-custom-permissions) |Rolling out: 2212+ | Under review | Under review | Under review | Under review |
-|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Excludes encryption details | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ | 2.46+ | 16.0.13628+ | Yes |
-|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Includes encryption details | Current Channel: 2301+ | 16.70+ | 2.70+ | 16.0.16130+ | Under review |
-|[Require users to apply a label to their email and documents](sensitivity-labels-office-apps.md#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.45+ | 2.47+ | 16.0.13628+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
-|[Apply a sensitivity label to files automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
-|[Apply a sensitivity label to files automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | Under review |
-|[Support co-authoring and AutoSave](sensitivity-labels-coauthoring.md) for labeled and encrypted documents | Current Channel: 2107+ <br /><br> Monthly Enterprise Channel: 2107+ <br /><br> Semi-Annual Enterprise Channel: 2202+ | 16.51+ | 2.58+ | 16.0.14931+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
-|[PDF support](sensitivity-labels-office-apps.md#pdf-support)| Current Channel: 2208+ <br /><br> Monthly Enterprise Channel: 2209+ <br /><br> Semi-Annual Enterprise Channel: 2302+ | Under review | Under review | Under review | Under review |
-|[Sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) and [display label color](sensitivity-labels-office-apps.md#label-colors) | Preview: [Current Channel (Preview)](https://office.com/insider) | Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review |
-|[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)| Current Channel: Rolling out to 2302+ | Under review | Under review | Under review | Under review |
-|[Scope labels to files or emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails) | Current Channel: 2301+ | 16.69+ | Preview: Rolling out to [Beta Channel](https://insider.office.com/join/ios) | Preview: Rolling out to [Beta Channel](https://insider.office.com/join/android)| [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
+|[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)|Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Not relevant |Not relevant |Not relevant|Not relevant |
+|[Manually apply, change, or remove label](https://support.microsoft.com/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)|Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ | 2.21+ | 16.0.11231+ |[Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
+|[Multi-language support](create-sensitivity-labels.md#additional-label-settings-with-security--compliance-powershell)|Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+|2.21+ |16.0.11231+ |Under review |
+|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) to new documents |Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |2.21+ |16.0.11231+ |[Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md)|
+|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) to existing documents |Current Channel: 2208+ <br /><br> Monthly Enterprise Channel: 2207+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |16.63+ |Under review |Under review |[Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
+|[Require a justification to change a label](sensitivity-labels.md#what-label-policies-can-do) |Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |2.21+ |16.0.11231+ |[Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
+|[Provide help link to a custom help page](sensitivity-labels.md#what-label-policies-can-do) |Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |2.21+ | 16.0.11231+ |[Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
+|[Mark the content](sensitivity-labels.md#what-sensitivity-labels-can-do) |Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |2.21+ |16.0.11231+ |[Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
+|[Dynamic markings with variables](sensitivity-labels-office-apps.md#dynamic-markings-with-variables) |Current Channel: 2010+ <br /><br> Monthly Enterprise Channel: 2010+ <br /><br> Semi-Annual Enterprise Channel: 2102+ |16.42+ |2.42+ |16.0.13328+ |[Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
+|[Assign permissions now](encryption-sensitivity-labels.md#assign-permissions-now) |Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |2.21+ |16.0.11231+ |[Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
+|[Let users assign permissions: <br /> - Prompt users for custom permissions (users and groups)](encryption-sensitivity-labels.md#let-users-assign-permissions) |Current Channel: 2004+ <br /><br> Monthly Enterprise Channel: 2004+ <br /><br> Semi-Annual Enterprise Channel: 2008+ |16.35+ |Under review | Under review | Under review |
+|[Let users assign permissions: <br /> - Prompt users for custom permissions (users, groups, and organizations)](encryption-sensitivity-labels.md#support-for-organization-wide-custom-permissions)|Current Channel: 2212+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+|Under review|Under review|Under review| Under review|
+|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Excludes encryption details |Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ |16.43+ |2.46+ |16.0.13628+ |Yes |
+|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Includes encryption details |Current Channel: 2301+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |16.70+ |2.70+ |16.0.16130+ |Under review |
+|[Require users to apply a label to their email and documents](sensitivity-labels-office-apps.md#require-users-to-apply-a-label-to-their-email-and-documents) |Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ |16.45+ |2.47+ |16.0.13628+ |[Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
+|[Apply a sensitivity label to files automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types |Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ |16.44+ |Under review | Under review |[Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
+|[Apply a sensitivity label to files automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers |Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ |16.49+ |Under review |Under review |Under review |
+|[Support co-authoring and AutoSave](sensitivity-labels-coauthoring.md) for labeled and encrypted documents |Current Channel: 2107+ <br /><br> Monthly Enterprise Channel: 2107+ <br /><br> Semi-Annual Enterprise Channel: 2202+ |16.51+ |2.58+ |16.0.14931+ |[Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
+|[PDF support](sensitivity-labels-office-apps.md#pdf-support)|Current Channel: 2208+ <br /><br> Monthly Enterprise Channel: 2209+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Under review |Under review |Under review |Under review |
+|[Sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) and [display label color](sensitivity-labels-office-apps.md#label-colors) |Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Under review |Under review |Under review |Under review |
+|[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)|Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Under review |Under review |Under review |Under review |
+|[Scope labels to files or emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails) |Current Channel: 2301+ <br /><br> Monthly Enterprise Channel: Under review <br /><br> Semi-Annual Enterprise Channel: Under review |16.69+ |Preview: Rolling out to [Beta Channel](https://insider.office.com/join/ios) |Preview: Rolling out to [Beta Channel](https://insider.office.com/join/android)| [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |
## Sensitivity label capabilities in Outlook
The numbers listed are the minimum Office application versions required for each
|Capability |Outlook for Windows |Outlook for Mac |Outlook on iOS |Outlook on Android |Outlook on the web | |--|-:|-||-|-|
-|[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)| Preview: [Current Channel (Preview)](https://office.com/insider) | Not relevant | Not relevant | Not relevant| Not relevant |
-|Manually apply, change, or remove label <br /> - [Files and emails](https://support.microsoft.com/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes |
-|Manually apply, change, or remove label <br /> - [Calendar items](sensitivity-labels-meetings.md)| Current Channel: Rolling out to 2302+ | Rolling out: 16.70+ <sup>\*</sup> | Under review | Under review | Yes |
-|[Multi-language support](create-sensitivity-labels.md#additional-label-settings-with-security--compliance-powershell)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes |
-|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes |
-|[Require a justification to change a label](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes |
-|[Provide help link to a custom help page](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes |
-|[Mark the content](sensitivity-labels.md#what-sensitivity-labels-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes |
-|[Dynamic markings with variables](sensitivity-labels-office-apps.md#dynamic-markings-with-variables) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes |
-|[Assign permissions now](encryption-sensitivity-labels.md#assign-permissions-now) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes |
-|[Let users assign permissions: <br /> - Do Not Forward](encryption-sensitivity-labels.md#let-users-assign-permissions) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes |
-|[Let users assign permissions: <br /> - Encrypt-Only](encryption-sensitivity-labels.md#let-users-assign-permissions) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.48+ <sup>\*</sup> | 4.2112.0+ | 4.2112.0+ | Yes |
-|[Require users to apply a label to their email and documents](sensitivity-labels-office-apps.md#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes |
-|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Excludes encryption details | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.51+ <sup>\*</sup> | 4.2126+ | 4.2126+ | Yes |
-|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Includes encryption details | Current Channel: 2301+ | 16.70+ <sup>\*</sup> | 4.2309+| 4.2309+ | Under review |
-|[Apply a sensitivity label to emails automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ <sup>\*</sup> | Under review | Under review | Yes |
-|[Apply a sensitivity label to emails automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | Yes |
-|[Different settings for default label and mandatory labeling](sensitivity-labels-office-apps.md#outlook-specific-options-for-default-label-and-mandatory-labeling) | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes |
-|[PDF support](sensitivity-labels-office-apps.md#pdf-support) | Current Channel: 2205+ <br /><br> Monthly Enterprise Channel: 2205+ <br /><br> Semi-Annual Enterprise Channel: Under review| Under review | Under review | Under review | Under review |
-|[Apply S/MIME protection](sensitivity-labels-office-apps.md#configure-a-label-to-apply-smime-protection-in-outlook) | Current Channel: 2211+ <br /><br> Monthly Enterprise Channel: 2211+ <br /><br> Semi-Annual Enterprise Channel: 2302+ | 16.61+ <sup>\*</sup> | 4.2226+ | 4.2203+ | Under review |
-|[Sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) | Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review | Under review |
-|[Display label color](sensitivity-labels-office-apps.md#label-colors) | Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Preview: [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review |
-|[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)| Current Channel: Rolling out to 2302+ | Under review | Under review | Under review | Under review |
-|[Scope labels to files or emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails) | Current Channel: 2301+ | Rolling out: 16.70+ <sup>\*</sup> | Rolling out 4.2309+| Rolling out 4.2309+ | Yes |
-|[Preventing oversharing as DLP policy tip](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup-preview)| Preview: Rolling out to [Beta Channel](https://office.com/insider) | Under review | Under review | Under review | Under review |
-|[Label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments) | Preview: Rolling out to [Beta Channel](https://office.com/insider) | Under review | Under review | Under review | Yes |
+|[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)|Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Not relevant |Not relevant |Not relevant|Not relevant |
+|Manually apply, change, or remove label <br /> - [Files and emails](https://support.microsoft.com/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)|Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ | 4.7.1+ | 4.0.39+ | Yes |
+|Manually apply, change, or remove label <br /> - [Calendar items](sensitivity-labels-meetings.md)| Current Channel: Rolling out to 2302+ |Rolling out: 16.70+ <sup>\*</sup> |Under review |Under review |Yes |
+|[Multi-language support](create-sensitivity-labels.md#additional-label-settings-with-security--compliance-powershell)|Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |4.7.1+ |4.0.39+ |Yes |
+|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) |Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |4.7.1+ |4.0.39+ | Yes |
+|[Require a justification to change a label](sensitivity-labels.md#what-label-policies-can-do)|Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |4.7.1+ |4.0.39+ |Yes |
+|[Provide help link to a custom help page](sensitivity-labels.md#what-label-policies-can-do) |Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |4.7.1+ |4.0.39+ |Yes |
+|[Mark the content](sensitivity-labels.md#what-sensitivity-labels-can-do) |Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |4.7.1+ |4.0.39+ |Yes |
+|[Dynamic markings with variables](sensitivity-labels-office-apps.md#dynamic-markings-with-variables) |Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |4.7.1+ |4.0.39+ |Yes|
+|[Assign permissions now](encryption-sensitivity-labels.md#assign-permissions-now) |Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |4.7.1+ |4.0.39+ |Yes |
+|[Let users assign permissions: <br /> - Do Not Forward](encryption-sensitivity-labels.md#let-users-assign-permissions) |Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |4.7.1+ |4.0.39+ |Yes |
+|[Let users assign permissions: <br /> - Encrypt-Only](encryption-sensitivity-labels.md#let-users-assign-permissions) |Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ |16.48+ <sup>\*</sup> |4.2112.0+ |4.2112.0+ |Yes |
+|[Require users to apply a label to their email and documents](sensitivity-labels-office-apps.md#require-users-to-apply-a-label-to-their-email-and-documents) |Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ |16.43+ <sup>\*</sup> |4.2111+ |4.2111+ |Yes |
+|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Excludes encryption details | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ |16.51+ <sup>\*</sup> |4.2126+ |4.2126+ |Yes |
+|[Audit label-related user activity](sensitivity-labels-office-apps.md#auditing-labeling-activities): <br /> - Includes encryption details | Current Channel: 2301+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |16.70+ <sup>\*</sup> |4.2309+|4.2309+ |Under review |
+|[Apply a sensitivity label to emails automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types |Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ |16.44+ <sup>\*</sup> |Under review |Under review |Yes |
+|[Apply a sensitivity label to emails automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers |Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ |16.49+ |Under review |Under review |Yes |
+|[Different settings for default label and mandatory labeling](sensitivity-labels-office-apps.md#outlook-specific-options-for-default-label-and-mandatory-labeling) |Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ |16.43+ <sup>\*</sup> |4.2111+ |4.2111+ |Yes |
+|[PDF support](sensitivity-labels-office-apps.md#pdf-support) |Current Channel: 2205+ <br /><br> Monthly Enterprise Channel: 2205+ <br /><br> Semi-Annual Enterprise Channel: Under review| Under review |Under review |Under review |Under review |
+|[Apply S/MIME protection](sensitivity-labels-office-apps.md#configure-a-label-to-apply-smime-protection-in-outlook) |Current Channel: 2211+ <br /><br> Monthly Enterprise Channel: 2211+ <br /><br> Semi-Annual Enterprise Channel: 2302+ | 16.61+ <sup>\*</sup> |4.2226+ |4.2203+ |Under review |
+|[Sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) | Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Under review |Under review |Under review |Under review |
+|[Display label color](sensitivity-labels-office-apps.md#label-colors) |Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Preview: [Current Channel (Preview)](https://office.com/insider) <sup>\*</sup> |Under review |Under review |Under review |
+|[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)|Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Under review |Under review |Under review |Under review |
+|[Scope labels to files or emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails) |Current Channel: 2301+ <br /><br> Monthly Enterprise Channel: Under review <br /><br> Semi-Annual Enterprise Channel: Under review |Rolling out: 16.70+ <sup>\*</sup> | Rolling out 4.2309+ |Rolling out 4.2309+ |Yes |
+|[Preventing oversharing as DLP policy tip](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup-preview)|Preview: Rolling out to [Beta Channel](https://office.com/insider) |Under review |Under review |Under review |Under review |
+|[Label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments) |Preview: Rolling out to [Beta Channel](https://office.com/insider) |Under review |Under review |Under review |Under review |
**Footnotes:**
compliance Sensitivity Labels https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels.md
f1.keywords:
Previously updated : 03/13/2023 Last updated : 03/14/2023 audience: Admin
To get their work done, people in your organization collaborate with others both
Sensitivity labels from Microsoft Purview Information Protection let you classify and protect your organization's data, while making sure that user productivity and their ability to collaborate isn't hindered.
-The following example from Excel shows some sensitivity labels that have been made available to users. In this case, the **Highly Confidential** label has been applied to the spreadsheet, but users can change the label by using the **Sensitivity** button from the **Home** tab on the Ribbon.
+The following example from Excel shows how users might see an applied sensitivity label from the window bar, and how they can easily change the label by using the [sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) that's available with the latest versions of Office. The labels are also available from the **Sensitivity** button on the **Home** tab from the ribbon.
![Sensitivity label on the Excel ribbon and status bar.](../media/Sensitivity-label-in-Excel.png)
When you configure a label policy, you can:
Consider using this option to help increase your labeling coverage. However, without user training, these settings can result in inaccurate labeling. In addition, unless you also set a corresponding default label, mandatory labeling can frustrate your users with the frequent prompts. -- **Provide help link to a custom help page.** If your users aren't sure what your sensitivity labels mean or how they should be used, you can provide a Learn More URL that appears at the bottom of the **Sensitivity label** menu in the Office apps:
+- **Provide help link to a custom help page.** If your users aren't sure what your sensitivity labels mean or how they should be used, you can provide a Learn More URL that appears after the list of available sensitivity labels in the Office apps. For example:
![Learn more link on Sensitivity button on Ribbon.](../media/Sensitivity-label-learn-more.png)
compliance Whats New https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md
f1.keywords:
Previously updated : 03/13/2023 Last updated : 03/14/2023 audience: Admin
Whether it be adding new solutions to the [Microsoft Purview compliance portal](
### Sensitivity labels
+- **AIP add-in disabled by default**: The AIP add-in for Office apps is now disabled by default beginning with version 2302. Starting with this version, you must [configure an Office setting](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in) if you need to continue to use the Azure Information Protection (AIP) add-in rather than the labels that are built into Office apps.
+- **General availability (GA)**: For Windows, the [sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) and [label colors](sensitivity-labels-office-apps.md#label-colors) are now generally available for Word, Excel, PowerPoint, and Outlook.
- **General availability (GA)**: Both Outlook for Windows and Outlook for Mac are rolling out in general availability for [protected meetings](sensitivity-labels-meetings.md).-- **General availability (GA)**: Now rolling out in general availability for built-in labeling for Windows, support for a [default sublabel for a parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label) as a parity feature for the AIP add-in.
+- **General availability (GA)**: Now in general availability for built-in labeling for Windows, support for a [default sublabel for a parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label) as a parity feature for the AIP add-in.
- **General availability (GA)**: For labeling built into Windows, macOS, iOS, and Android, auditing actions for sensitivity labels include encryption details such as a change in the encryption status and settings, and the Rights Management owner. - **In preview**: The ability to [scope labels to files and emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails), so that for example, a sensitivity label is visible to users in Outlook but not in Word, Excel, or PowerPoint. This configuration can be used as a parity feature for the AIP add-in, which could be disabled per app. - **In preview**: Prevent [oversharing of labeled emails as a DLP policy tip](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup-preview). This DLP policy configuration is an equivalent for the AIP add-in with PowerShell advanced settings that implement pop-up messages in Outlook that warn, justify, or block emails being sent. - **In preview**: As a parity feature for the AIP add-in, built-in labeling for Windows supports [label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments).
+- **In preview**: Preview versions of Outlook for Mac now support [label colors](sensitivity-labels-office-apps.md#label-colors) but don't yet support the sensitivity bar.
- **Removal of restrictions for prevent copying chat for protected meetings**: The label setting that [prevents copying chat to the clipboard](sensitivity-labels-meetings.md#prevent-copying-chat-to-the-clipboard-label-setting) now supports users outside your organization and also users who join a chat but weren't invited to the meeting. ## February 2023
enterprise Multi Tenant People Search https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/multi-tenant-people-search.md
Title: "Microsoft 365 Multi-Tenant Organization People Search"
Previously updated : 07/26/2022 Last updated : 03/13/2023 audience: ITPro
Megan's user account has been synced from the _Fabrikam_ tenant to the target te
## Known limitations -- The Microsoft Teams audio and video call buttons will direct the call to the MeganΓÇÖs Contoso tenant Teams instance and not the Teams instance target tenant (Fabrikam).
+- The Microsoft Teams audio and video call buttons will direct the call to the Megan's Contoso tenant Teams instance and not the Teams instance target tenant (Fabrikam).
- The current experience provides limited information on the people card (basic contact information, job title and office location). - There is no external tag to differentiate synced users and internal users. For example, if there was a megan@fabrikam and megan@Contoso there's no (External) tag to show that megan@fabrikam is a different user.
Multi-tenant organization people search is supported across a range of scenarios
- _Cross-Tenant synchronization_ is a feature that enables multi-tenant organizations to grant users access to applications in other tenants within the organization. It achieves this by synchronizing internal member users from a home tenant into a resource tenant as external B2B users. ## Provide feedback
-Use this [form][https://aka.ms/MTOpeoplesearchpreviewfeedback] to provide feedback to the MTO people search team. https://aka.ms/MTOpeoplesearchpreviewfeedback
+Use this [form](https://aka.ms/MTOpeoplesearchpreviewfeedback) to provide feedback to the MTO people search team.
## Frequently asked questions
-If you have questions regarding cross tenant synchronization, see [Cross Tenants Synchronization FAQs] [/azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-overview#frequently-asked-questions]
+If you have questions regarding cross tenant synchronization, see [Cross Tenants Synchronization FAQs](/azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-overview#frequently-asked-questions)
1. What are the license requirements for MTO people search?
-A: Cross-tenant Synchronization is a pre-requisite to Multi-tenant people search feature. The licensing requirements for cross tenant synchronization can be found here. [License requirements] [/azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-overview#license-requirements]
+A: Cross-tenant Synchronization is a pre-requisite to Multi-tenant people search feature. The licensing requirements for cross tenant synchronization can be found here. [License requirements](/azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-overview#license-requirements)
-2. What is the sync schedule?
+2. What is the sync schedule?
A: The cross-tenant sync interval is currently fixed to start at 40-minute intervals. Sync duration varies based on the number of in-scope users. The initial sync cycle is likely to take significantly longer than the following incremental sync cycles.
-3. How long does it take to discover a synced user in M365 people search experiences?
+3. How long does it take to discover a synced user in M365 people search experiences?
A: The synced users will be available in the global address list right away. However, it make take up to a day for the user to be discoverable in people search experiences in M365 applications.
-4. What attributes are synchronized from the home to the resource tenant?
+4. What attributes are synchronized from the home to the resource tenant?
A: Cross-tenant synchronization will sync commonly used attributes on the user object in Azure AD, including (but not limited to) displayName, userPrincipalName, and directory extension attributes.+ - What attributes can't be synchronized? Attributes including (but not limited to) managers, photos, custom security attributes, and user attributes outside of the directory can't be synchronized by cross-tenant synchronization.
-All synced attributes will be displayed on the people card if available. [For more information on attribute syncing] /azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-overview#attributes]
+All synced attributes will be displayed on the people card if available. For more information on attribute syncing, see [this page.](/azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-overview#attributes)
-7. Is there a limit to how many tenants we can apply this to?
+7. Is there a limit to how many tenants we can apply this to?
A: No 8. Is there a limit on the number of user objects that can be synced?
-A: No. However, it is important to note that if there are more users to be synced in a single job, it will take longer to complete. [How long will it take to provision users] [/azure/active-directory/app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user#how-long-will-it-take-to-provision-users]
+A: No. However, it is important to note that if there are more users to be synced in a single job, it will take longer to complete. [How long will it take to provision users](/azure/active-directory/app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user#how-long-will-it-take-to-provision-users)
9. Can I sync users as guests rather than members? A: Yes. However, to enable M365 MTO people search and future MTO scenarios, we require you to sync users as members. Guests are intended for cross-company scenarios, whereas members are intended for tenants within the same company.
security Customize Controlled Folders https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/customize-controlled-folders.md
Title: Customize controlled folder access
description: Add other folders that should be protected by controlled folder access, or allow apps that are incorrectly blocking changes to important files. keywords: Controlled folder access, windows 10, windows 11, windows defender, ransomware, protect, files, folders, customize, add folder, add app, allow, add executable
-ms.sitesec: library
ms.localizationpriority: medium audience: ITPro
- m365-security - tier2 search.appverid: met150 Previously updated : 12/18/2020 Last updated : 03/14/2023 # Customize controlled folder access
An allowed application or service only has write access to a controlled folder a
3. Expand the tree to **Windows components** \> **Microsoft Defender Antivirus** \> **Windows Defender Exploit Guard** \> **Controlled folder access**.
-4. Double-click the **Configure allowed applications** setting and set the option to **Enabled**. Select **Show** and enter each app.
+4. Double-click the **Configure allowed applications** setting and then set the option to **Enabled**. Select **Show**.
+
+5. Add the full path to the executable in **Value name**. Set **Value** to `0`. For example, to allow the Command Prompt set **Value name** as `C:\Windows\System32\cmd.exe`. **Value** should be set to `0`.
### Use PowerShell to allow specific apps
-1. Type **PowerShell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator**
+1. Type **PowerShell** in the Start menu, right-click **Windows PowerShell** and then select **Run as administrator**
2. Enter the following cmdlet: ```PowerShell
security Linux Whatsnew https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-whatsnew.md
This article is updated frequently to let you know what's new in the latest rele
- [What's new in Defender for Endpoint on macOS](mac-whatsnew.md) - [What's new in Defender for Endpoint on iOS](ios-whatsnew.md)
-<details>
- <summary>March-2023 (Build: 101.98.05 | Release version: 30.123012.19805.0)</summary>
+#### March-2023 (Build: 101.98.05 | Release version: 30.123012.19805.0)
&ensp;Released: **March , 08,2023**<br/> &ensp;Published: **March 08, 2023**<br/>
sudo mdatp config real-time-protection --value=disabled
sudo systemctl disable mdatp ```
-</details>
+ <details> <summary>Jan-2023 (Build: 101.94.13 | Release version: 30.122112.19413.0)</summary>
security Manage Updates Baselines Microsoft Defender Antivirus https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus.md
During the technical support (only) phase, commercially reasonable support incid
In the unfortunate event that you encounter issues after a platform update, you can roll back to the previous or the inbox version of the Microsoft Defender platform. - To roll back to the previous version, run the following command:<br>
-`"%programdata%\Microsoft\Windows Defender\Platofrm\<version>\MpCmdRun.exe" -RevertPlatform`
+`"%programdata%\Microsoft\Windows Defender\Platform\<version>\MpCmdRun.exe" -RevertPlatform`
- To roll back this update to the version shipped with the Operating System ("%ProgramFiles%\Windows Defender")<br>
-`"%programdata%\Microsoft\Windows Defender\Platofrm\<version>\MpCmdRun.exe" -ResetPlatform`
+`"%programdata%\Microsoft\Windows Defender\Platform\<version>\MpCmdRun.exe" -ResetPlatform`
## Platform version included with Windows 10 releases
syntex Content Assembly Map Fields https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/content-assembly-map-fields.md
+
+ Title: Map fields of a modern template to library columns in Microsoft Syntex
+++
+audience: admin
+ Last updated : 03/14/2023++
+search.appverid:
+
+ - enabler-strategic
+ - m365initiative-syntex
+ms.localizationpriority: medium
+description: Learn how to map fields of a modern template to library columns in Microsoft Syntex.
++
+# Map fields of a modern template to library columns in Microsoft Syntex
+
+You can map fields in a modern template to document library columns, and then add the fields to a custom view of the library. Once configured, every time a document is created from this template, the field values will get automatically extracted and filled in against the library columns and be part of the document metadata.
+
+You no longer have to train and build AI models to extract the information already configured as fields while creating modern templates. All the relevant metadata for your generated documents will be available as columns in your document library.
+
+## Map fields to a custom view of your library
+
+1. When you select **Publish** to publish a modern template after creating the necessary fields, you can choose to add some or all of the created fields into a custom view of the library.
+
+ ![Screenshot of the Publish template panel and template document.](../media/content-understanding/content-assembly-map-fields-1.png)
+
+2. You can choose fields that you want to map in the custom view that will get created for your modern template. You can also rename the template by entering value in the **Template name** text box.
+
+ Once done, select **Publish** to publish the modern template. If you've selected the **Set the default view of the library** option (selected by default), the library default view will be set to the template name view.
+
+ ![Screenshot of the document library showing the template as the default view.](../media/content-understanding/content-assembly-map-fields-2.png)
+
+ If **Set the default view of the library** isn't selected, the library view will be created but won't be set as default. You can switch to the view from the **Views** menu in the library.
+
+ ![Screenshot of document library Views menu with the template selected as the default view.](../media/content-understanding/content-assembly-map-fields-3.png)
+
+ ## Generate documents from your template
+
+After choosing the specific fields to be translated as library columns when you've published the template, you can now choose to generate documents from the template.
+
+After you generate the document, the values against the mapped fields will automatically start showing up in the library view.
+
+ ![Screenshot of document library showing the mapped fields in the library view.](../media/content-understanding/content-assembly-map-fields-4.png)
+
+ > [!NOTE]
+ > - You can only choose to map fields when you publish a new template or republish an existing template.<br>
+ > - You can unselect or reselect fields to be mapped as library columns every time you republish a modern template.<br>
+ > - If you change the name of a mapped field and republish the template with the new settings, the new name changes are reflected in the corresponding library column.<br>
+ > - If you change the data type of a mapped field and republish the template with the new settings, the new changes are reflected in the corresponding library column. If you choose to proceed with [incompatible data type change such as **Single line of text** to **Number**, or **Number** to **Date and time**](https://support.microsoft.com/office/0d8ddb7b-7dc7-414d-a283-ee9dca891df7), the mapped field will be deslected by default to prevent potential loss of data from the column. If you still choose to reselect the field to be mapped to column, you might lose data from the column values of previously created documents. The content of the documents that are already been generated won't be affected.<br>
+ > - Mapping image and table fields to library columns is not supported.
+
syntex Content Assembly Modern Template https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/content-assembly-modern-template.md
When you have completed adding all relevant fields to the template and you want
## See also
+[Map fields of a modern template to library columns](content-assembly-map-fields.md)
+ [Edit a modern template](content-assembly-edit-template.md) [Create a document from a modern template](content-assembly-create-document.md)
syntex Syntex Azure Billing https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-azure-billing.md
If you have not previously configured Microsoft Syntex, read [Set up Microsoft S
## Monitor your Microsoft Syntex pay-as-you-go usage
-You can monitor your Microsoft Syntex pay-as-you-go usage in Azure Cost Management. You must have at least *read* access to the resource group that you specified for Microsoft Syntex.
+You can monitor your Microsoft Syntex pay-as-you-go usage in Azure Cost Management. You must have at least *read* access to the resource group that you specified for Microsoft Syntex. Note that usage information may take up to 24 hours to appear in Cost Management.
To see the charges applied to the Syntex meters 1. Sign in to [Azure Cost Management](https://portal.azure.com/#view/Microsoft_Azure_CostManagement/Menu/~/overview).