| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Compare Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/compare-groups.md | Last updated 02/18/2020 f1.keywords: CSH -+ audience: Admin |
| admin | Create Dns Records At Godaddy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/dns/create-dns-records-at-godaddy.md | search.appverid: - MET150 - MOE150 ms.assetid: f40a9185-b6d5-4a80-bb31-aa3bb0cab48a-description: "Learn to verify your domain and set up DNS records for email, Teams, and other services at GoDaddy for Microsoft." +description: "Learn to verify your domain and set up DNS records for email, Microsoft Teams, and other services at GoDaddy for Microsoft." # Connect your DNS records at GoDaddy to Microsoft 365 To verify the record in Microsoft 365: 4. Choose **MX** option from the filter box. + :::image type="content" source="../../media/dns-godaddy/godaddy-domains-add-MX-records.png" alt-text="Drop down menu showing MX record selected."::: + 5. In the boxes for the new record, type or copy and paste the values from the following table. (Choose the **Type** and **TTL** values from the drop-down list.) To verify the record in Microsoft 365: 6. Select **Save**. -## Advanced option: Skype for Business +## Advanced option: Microsoft Teams Only select this option if your organization uses Microsoft Teams. Teams needs 4 records: 2 SRV records for user-to-user communication, and 2 CNAME records to sign-in and connect users to the service. Only select this option if your organization uses Microsoft Teams. Teams needs 4 > [!NOTE] > Typically it takes about 15 minutes for DNS changes to take effect. However, it can occasionally take longer for a change you've made to update across the Internet's DNS system. If you're having trouble with mail flow or other issues after adding DNS records, see [Troubleshoot issues after changing your domain name or DNS records](../get-help-with-domains/find-and-fix-issues.md). -### Add the two required CNAME records for Skype for Business +### Add the two required CNAME records for Microsoft Teams 1. To get started, go to your domains page at GoDaddy by using [this link](https://account.godaddy.com/products/?go_redirect=disabled). Only select this option if your organization uses Microsoft Teams. Teams needs 4 2. Under **Domains**, select the three dots next to the domain you want to verify, and then select **Manage DNS**. + :::image type="content" source="../../media/dns-godaddy/godaddy-manage-dns.png" alt-text="Select Manage DNS from the drop-down list."::: + 3. Under **Records**, select **ADD**. :::image type="content" source="../../media/dns-godaddy/godaddy-domains-add.png" alt-text="Select ADD."::: |
| admin | Create Dns Records At Namecheap | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/dns/create-dns-records-at-namecheap.md | description: "Learn to verify your domain and set up DNS records for email, Skyp **[Check the Domains FAQ](../setup/domains-faq.yml)** if you don't find what you're looking for. -If Namecheap is your DNS hosting provider, follow the steps in this article to verify your domain and set up DNS records for email, Skype for Business Online, and so on. +If Namecheap is your DNS hosting provider, follow the steps in this article to verify your domain and set up DNS records for email, Microsoft Teams, and so on. After you add these records at Namecheap, your domain will be set up to work with Microsoft services. To verify the record in Microsoft 365: :::image type="content" source="../../media/f2846c36-ace3-43d8-be5d-a65e2c267619.png" alt-text="Select the Save Changes control."::: -## Advanced option: Skype for Business +## Advanced option: Microsoft Teams -Only select this option if your organization uses Skype for Business for online communication services like chat, conference calls, and video calls, in addition to Microsoft Teams. Skype needs 4 records: 2 SRV records for user-to-user communication, and 2 CNAME records to sign-in and connect users to the service. +Only select this option if your organization uses Microsoft Teams. Teams needs 4 records: 2 SRV records for user-to-user communication, and 2 CNAME records to sign-in and connect users to the service. ### Add the two required SRV records |
| compliance | Alert Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/alert-policies.md | The tables also indicate the Office 365 Enterprise and Office 365 US Government |||::|::|| |**A potentially malicious URL click was detected**|Generates an alert when a user protected by [Safe Links](/microsoft-365/security/office-365-security/safe-links-about) in your organization clicks a malicious link. This alert is generated when a user clicks on a link and this event triggers a URL verdict change identification by Microsoft Defender for Office 365. It also checks for any clicks in the past 48 hours from the time the malicious URL verdict is identified, and generates alerts for the clicks that happened in the 48-hour timeframe for that malicious link. This alert automatically triggers [automated investigation and response in Office 365](/microsoft-365/security/office-365-security/air-about). For more information on events that trigger this alert, see [Set up Safe Links policies](/microsoft-365/security/office-365-security/safe-links-policies-configure).|High|Yes|E5/G5 or Defender for Office 365 P2 add-on subscription| |**A user clicked through to a potentially malicious URL**|Generates an alert when a user protected by [Safe Links](/microsoft-365/security/office-365-security/safe-links-about) in your organization clicks a malicious link. This event is triggered when user clicks on a URL (which is identified as malicious or pending validation) and overrides the Safe Links warning page (based on your organization's Microsoft 365 for business Safe Links policy) to continue to the URL hosted page / content. For Defender for Office 365 P2, E5, G5 customers, this alert automatically triggers [automated investigation and response in Office 365](/microsoft-365/security/office-365-security/air-about). For more information on events that trigger this alert, see [Set up Safe Links policies](/microsoft-365/security/office-365-security/safe-links-policies-configure).|High|Yes|E5/G5 or Defender for Office 365 P2 add-on subscription|-|**Admin submission result completed**|Generates an alert when an [Admin Submission](../security/office-365-security/submissions-admin.md) completes the rescan of the submitted entity. An alert will be triggered every time a rescan result is rendered from an Admin Submission. These alerts are meant to remind you to [review the results of previous submissions](https://compliance.microsoft.com/reportsubmission), submit user reported messages to get the latest policy check and rescan verdicts, and help you determine if the filtering policies in your organization are having the intended impact.|Informational|No|E1/F1, E3/F3, or E5| -|**Admin triggered manual investigation of email**|Generates an alert when an admin triggers the manual investigation of an email from Threat Explorer. For more information, see [Example: A security administrator triggers an investigation from Threat Explorer](../security/office-365-security/air-about-office.md#example-a-security-administrator-triggers-an-investigation-from-threat-explorer). This alert notifies your organization that the investigation was started. The alert provides information about who triggered it and includes a link to the investigation.|Informational|Yes|E5/G5 or Microsoft Defender for Office 365 P2 add-on subscription| -|**Admin triggered user compromise investigation**|Generates an alert when an admin triggers the manual user compromise investigation of either an email sender or recipient from Threat Explorer. For more information, see [Example: A security administrator triggers an investigation from Threat Explorer](../security/office-365-security/air-about-office.md#example-a-security-administrator-triggers-an-investigation-from-threat-explorer), which shows the related manual triggering of an investigation on an email. This alert notifies your organization that the user compromise investigation was started. The alert provides information about who triggered it and includes a link to the investigation.|Medium|Yes|E5/G5 or Microsoft Defender for Office 365 P2 add-on subscription| +|**Admin submission result completed**|Generates an alert when an [Admin Submission](../security/office-365-security/submissions-admin.md) completes the rescan of the submitted entity. An alert will be triggered every time a rescan result is rendered from an Admin Submission. <br/><br/> These alerts are meant to remind you to [review the results of previous submissions](https://compliance.microsoft.com/reportsubmission), submit user reported messages to get the latest policy check and rescan verdicts, and help you determine if the filtering policies in your organization are having the intended impact.|Informational|No|E1/F1, E3/F3, or E5| +|**Admin triggered manual investigation of email**|Generates an alert when an admin triggers the manual investigation of an email from Threat Explorer. For more information, see [Example: A security administrator triggers an investigation from Threat Explorer](../security/office-365-security/air-about-office.md#example-a-security-administrator-triggers-an-investigation-from-threat-explorer). <br/><br/> This alert notifies your organization that the investigation was started. The alert provides information about who triggered it and includes a link to the investigation.|Informational|Yes|E5/G5 or Microsoft Defender for Office 365 P2 add-on subscription| +|**Admin triggered user compromise investigation**|Generates an alert when an admin triggers the manual user compromise investigation of either an email sender or recipient from Threat Explorer. For more information, see [Example: A security administrator triggers an investigation from Threat Explorer](../security/office-365-security/air-about-office.md#example-a-security-administrator-triggers-an-investigation-from-threat-explorer), which shows the related manual triggering of an investigation on an email. <br/><br/> This alert notifies your organization that the user compromise investigation was started. The alert provides information about who triggered it and includes a link to the investigation.|Medium|Yes|E5/G5 or Microsoft Defender for Office 365 P2 add-on subscription| |**Administrative action submitted by an Administrator**|Admins can take manual email actions on email entities using various surfaces. For example, Threat Explorer, advanced hunting or through custom detection. When the remediation starts, it generates an alert. This alert shows up in the alerts queue with the name **Administrative action submitted by an Administrator** to indicate that an admin took the action of remediating an entity. The alert contains details like the action type, supporting investigation link, time, etc. It's helpful to know whenever a sensitive action like remediation is performed on entities.|Informational|Yes|E5/G5 or Defender for Office 365 P2 add-on subscription| |**Creation of forwarding/redirect rule**|Generates an alert when someone in your organization creates an inbox rule for their mailbox that forwards or redirects messages to another email account. This policy only tracks inbox rules that are created using Outlook on the web (formerly known as Outlook Web App) or Exchange Online PowerShell. For more information about using inbox rules to forward and redirect email in Outlook on the web, see [Use rules in Outlook on the web to automatically forward messages to another account](https://support.office.com/article/1433e3a0-7fb0-4999-b536-50e05cb67fed).|Informational|No|E1/F1/G1, E3/F3/G3, or E5/G5|-|**eDiscovery search started or exported**|Generates an alert when someone uses the Content search tool in the Microsoft Purview portal. An alert is triggered when the following content search activities are performed: A content search is started, the results of a content search are exported, a content search report is exported. Alerts are also triggered when the previous content search activities are performed in association with an eDiscovery case. For more information about content search activities, see [Search for eDiscovery activities in the audit log](ediscovery-search-for-activities-in-the-audit-log.md#ediscovery-activities).|Informational|No|E1/F1/G1, E3/F3/G3, or E5/G5| +|**eDiscovery search started or exported**|Generates an alert when someone uses the Content search tool in the Microsoft Purview portal. An alert is triggered when the following content search activities are performed: <ul><li>A content search is started.</li><li>The results of a content search are exported.</li><li>A content search report is exported.</li></ul> <br/> Alerts are also triggered when the previous content search activities are performed in association with an eDiscovery case. For more information about content search activities, see [Search for eDiscovery activities in the audit log](ediscovery-search-for-activities-in-the-audit-log.md#ediscovery-activities).|Informational|No|E1/F1/G1, E3/F3/G3, or E5/G5| |**Email messages containing malicious file removed after delivery**|Generates an alert when any messages containing a malicious file are delivered to mailboxes in your organization. If this event occurs, Microsoft removes the infected messages from Exchange Online mailboxes using [Zero-hour auto purge](../security/office-365-security/zero-hour-auto-purge.md). This policy automatically triggers [automated investigation and response in Office 365](../security/office-365-security/air-about.md). For more information on this new policy, see [New alert policies in Microsoft Defender for Office 365](new-defender-alert-policies.md).|Informational|Yes|E5/G5 or Microsoft Defender for Office 365 P2 add-on subscription| |**Email messages containing malicious URL removed after delivery**|Generates an alert when any messages containing a malicious URL are delivered to mailboxes in your organization. If this event occurs, Microsoft removes the infected messages from Exchange Online mailboxes using [Zero-hour auto purge](../security/office-365-security/zero-hour-auto-purge.md). This policy automatically triggers [automated investigation and response in Office 365](../security/office-365-security/air-about.md). For more information on this new policy, see [New alert policies in Microsoft Defender for Office 365](new-defender-alert-policies.md).|Informational|Yes|E5/G5 or Defender for Office 365 P2 add-on subscription| |**Email messages containing malware removed after delivery**|**Note**: This alert policy has been replaced by **Email messages containing malicious file removed after delivery**. This alert policy will eventually go away, so we recommend disabling this alert policy and using **Email messages containing malicious file removed after delivery** instead. For more information, see [New alert policies in Microsoft Defender for Office 365](new-defender-alert-policies.md).|Informational|Yes|E5/G5 or Microsoft Defender for Office 365 P2 add-on subscription| The tables also indicate the Office 365 Enterprise and Office 365 US Government |**Email sending limit exceeded**|Generates an alert when someone in your organization has sent more mail than is allowed by the outbound spam policy. This is usually an indication the user is sending too much email or that the account may be compromised. If you get an alert generated by this alert policy, it's a good idea to [check whether the user account is compromised](../security/office-365-security/responding-to-a-compromised-email-account.md).|Medium|No|E1/F1/G1, E3/F3/G3, or E5/G5| |**Form blocked due to potential phishing attempt**|Generates an alert when someone in your organization has been restricted from sharing forms and collecting responses using Microsoft Forms due to detected repeated phishing attempt behavior.|High|No|E1, E3/F3, or E5| |**Form flagged and confirmed as phishing**|Generates an alert when a form created in Microsoft Forms from within your organization has been identified as potential phishing through Report Abuse and confirmed as phishing by Microsoft.|High|No|E1, E3/F3, or E5|-|**Graders disagreement with Tenant Allow/Block List entry**|Generates an alert when Microsoft determines that the admin submission corresponding to an allow entry in the Tenant Allow/Block List is found to be malicious. This event is triggered as soon as the submission has been analyzed by Microsoft. The allow entry will continue to exist for its stipulated duration. For more information on events that trigger this alert, see [Manage the Tenant Allow/Block list](../security/office-365-security/tenant-allow-block-list-about.md).|Informational|No|E1/F1/G1, E3/F3/G3, or E5/G5| +|**Graders disagreement with Tenant Allow/Block List entry**|Generates an alert when Microsoft determines that the admin submission corresponding to an allow entry in the Tenant Allow/Block List is found to be malicious. This event is triggered as soon as the submission has been analyzed by Microsoft. <br/><br/> The allow entry will continue to exist for its stipulated duration. For more information on events that trigger this alert, see [Manage the Tenant Allow/Block list](../security/office-365-security/tenant-allow-block-list-about.md).|Informational|No|E1/F1/G1, E3/F3/G3, or E5/G5| |**Malware campaign detected after delivery**┬╣|Generates an alert when an unusually large number of messages containing malware are delivered to mailboxes in your organization. If this event occurs, Microsoft removes the infected messages from Exchange Online mailboxes.|High|No|E5/G5 or Microsoft Defender for Office 365 P2 add-on subscription| |**Malware campaign detected and blocked**┬╣|Generates an alert when someone has attempted to send an unusually large number of email messages containing a certain type of malware to users in your organization. If this event occurs, the infected messages are blocked by Microsoft and not delivered to mailboxes.|Low|No|E5/G5 or Defender for Office 365 P2 add-on subscription| |**Malware campaign detected in SharePoint and OneDrive**┬╣|Generates an alert when an unusually high volume of malware or viruses is detected in files located in SharePoint sites or OneDrive accounts in your organization.|High|No|E5/G5 or Defender for Office 365 P2 add-on subscription| The tables also indicate the Office 365 Enterprise and Office 365 US Government |**Phish delivered due to an IP allow policy**┬▓|Generates an alert when Microsoft detects an IP allow policy that allowed delivery of a high confidence phishing message to a mailbox. For more information about the IP allow policy (connection filtering), see [Configure the default connection filter policy - Office 365](../security/office-365-security/connection-filter-policies-configure.md).|Informational|No|E1/F1/G1, E3/F3/G3, or E5/G5| |**Phish not zapped because ZAP is disabled**┬▓|Generates an alert when Microsoft detects delivery of a high confidence phishing message to a mailbox because Zero-Hour Auto Purge for Phish messages is disabled.|Informational|No|E5/G5 or Defender for Office 365 P2 add-on subscription| |**Potential nation-state activity**|Microsoft Threat Intelligence Center detected an attempt to compromise accounts from your tenant.|High|No|E5/G5 or Defender for Office 365 P2 add-on subscription|-|**Remediation action taken by admin on emails or URL or sender**|**Note**: This alert policy has been replaced by the **Administrative action submitted by an Administrator** alert policy. This alert policy will eventually go away, so we recommend disabling this alert policy and using **Administrative action submitted by an Administrator** instead. This alert is triggered when an admin takes remediation action on the selected entity|Informational|Yes|E5/G5 or Defender for Office 365 P2 add-on subscription| -|**Removed an entry in Tenant Allow/Block List**|Generates an alert when an allow entry in the Tenant Allow/Block List is learned from by filtering system and removed. This event is triggered when the allow entry for the affected domain or email address, file, or URL (_entity_) is removed. You no longer need the affected allow entry. Email messages that contain the affected entities will be delivered to the Inbox if nothing else in the message is determined to be bad. URLs and files will be allowed at time of click. For more information on events that trigger this alert, see [Manage the Tenant Allow/Block list](../security/office-365-security/tenant-allow-block-list-about.md).|Informational|No|E1/F1/G1, E3/F3/G3, or E5/G5| +|**Remediation action taken by admin on emails or URL or sender**|**Note**: This alert policy has been replaced by the **Administrative action submitted by an Administrator** alert policy. This alert policy will eventually go away, so we recommend disabling this alert policy and using **Administrative action submitted by an Administrator** instead. <br/><br/> This alert is triggered when an admin takes remediation action on the selected entity|Informational|Yes|E5/G5 or Defender for Office 365 P2 add-on subscription| +|**Removed an entry in Tenant Allow/Block List**|Generates an alert when an allow entry in the Tenant Allow/Block List is learned from by filtering system and removed. This event is triggered when the allow entry for the affected domain or email address, file, or URL (_entity_) is removed. <br/><br/> You no longer need the affected allow entry. Email messages that contain the affected entities will be delivered to the Inbox if nothing else in the message is determined to be bad. URLs and files will be allowed at time of click. <br/><br/> For more information on events that trigger this alert, see [Manage the Tenant Allow/Block list](../security/office-365-security/tenant-allow-block-list-about.md).|Informational|No|E1/F1/G1, E3/F3/G3, or E5/G5| |**Suspicious connector activity**|Generates an alert when a suspicious activity is detected on an inbound connector in your organization. Mail is blocked from using the inbound connector. The admin will receive an email notification and an alert. This alert provides guidance on how to investigate, revert changes, and unblock a restricted connector. To learn how to respond to this alert, see [Respond to a compromised connector](/microsoft-365/security/office-365-security/connectors-detect-respond-to-compromise).|High|No|E1/F1/G1, E3/F3/G3, or E5/G5| |**Suspicious email forwarding activity**|Generates an alert when someone in your organization has autoforwarded email to a suspicious external account. This is an early warning for behavior that may indicate the account is compromised, but not severe enough to restrict the user. Although it's rare, an alert generated by this policy may be an anomaly. It's a good idea to [check whether the user account is compromised](../security/office-365-security/responding-to-a-compromised-email-account.md).|High|No|E1/F1/G1, E3/F3/G3, or E5/G5| |**Suspicious email sending patterns detected**|Generates an alert when someone in your organization has sent suspicious email and is at risk of being restricted from sending email. This is an early warning for behavior that may indicate that the account is compromised, but not severe enough to restrict the user. Although it's rare, an alert generated by this policy may be an anomaly. However, it's a good idea to [check whether the user account is compromised](../security/office-365-security/responding-to-a-compromised-email-account.md).|Medium|Yes|E1/F1/G1, E3/F3/G3, or E5/G5| The tables also indicate the Office 365 Enterprise and Office 365 US Government |**Suspicious email transport rule detected**|A suspicious mail flow rule (transport rule) was created to forward any email in the organization to an attacker-owned mailbox.|Medium|No|E5/G5 or Microsoft Defender for Office 365 P2 add-on subscription| |**Suspicious pattern of inbound connector creation**|A suspicious pattern of inbound connector creation was detected. This behavior might suggest that an attacker set malicious inbound connectors to allow anonymous relay through the organization's Exchange server.|Medium|No|E5/G5 or Microsoft Defender for Office 365 P2 add-on subscription| |**Suspicious email-sending pattern from new Exchange inbound connector**.|A suspicious email-sending pattern from a new Exchange inbound connector was detected. This behavior might suggest that an attacker set a malicious inbound connector to allow anonymous relay through the organization's Exchange server.|Medium|No|E5/G5 or Microsoft Defender for Office 365 P2 add-on subscription|-|**Tenant Allow/Block List entry is about to expire**|Generates an alert when an allow entry or block entry in the Tenant Allow/Block List entry is about to be removed. This event is triggered 7 days before the expiration date, which is based on when the entry was created or last updated. For both allow entries and block entries, you can extend the expiration date. For more information on events that trigger this alert, see [Manage the Tenant Allow/Block list](../security/office-365-security/tenant-allow-block-list-about.md).|Informational|No|E1/F1/G1, E3/F3/G3, or E5/G5| +|**Tenant Allow/Block List entry is about to expire**|Generates an alert when an allow entry or block entry in the Tenant Allow/Block List entry is about to be removed. This event is triggered 7 days before the expiration date, which is based on when the entry was created or last updated. <br/><br/> For both allow entries and block entries, you can extend the expiration date. For more information on events that trigger this alert, see [Manage the Tenant Allow/Block list](../security/office-365-security/tenant-allow-block-list-about.md).|Informational|No|E1/F1/G1, E3/F3/G3, or E5/G5| |**Tenant restricted from sending email**|Generates an alert when most of the email traffic from your organization has been detected as suspicious and Microsoft has restricted your organization from sending email. Investigate any potentially compromised user and admin accounts, new connectors, or open relays, and then contact Microsoft Support to unblock your organization. For more information about why organizations are blocked, see [Fix email delivery issues for error code 5.7.7xx in Exchange Online](/Exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/fix-error-code-5-7-700-through-5-7-750).|High|No|E1/F1/G1, E3/F3/G3, or E5/G5| |**Tenant restricted from sending unprovisioned email**|Generates an alert when too much email is being sent from unregistered domains (also known as _unprovisioned_ domains). Office 365 allows a reasonable amount of email from unregistered domains, but you should configure every domain that you use to send email as an accepted domain. This alert indicates that all users in the organization can no longer send email. For more information about why organizations are blocked, see [Fix email delivery issues for error code 5.7.7xx in Exchange Online](/Exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/fix-error-code-5-7-700-through-5-7-750).|High|No|E1/F1/G1, E3/F3/G3, or E5/G5| |**Unusual increase in email reported as phish**┬╣|Generates an alert when there's a significant increase in the number of people in your organization using the Report Message add-in in Outlook to report messages as phishing mail. For more information about this add-in, see [Use the Report Message add-in](https://support.office.com/article/b5caa9f1-cdf3-4443-af8c-ff724ea719d2).|Medium|No|E5/G5 or Defender for Office 365 P2 add-on subscription| |
| compliance | Audit Log Detailed Properties | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/audit-log-detailed-properties.md | The following table describes the properties that are included (depending on the | ProtectionEventType | Enumerates how the protection was changed by the operation being audited. The following values and meanings apply: <br/><br/> **0** - Indicates unchanged. <br/> **1** - Indicates added. <br/> **2** - Indicates changed. <br/> **3** - Indicates removed. | All | |RecordType|The type of operation indicated by the record. This property indicates the service or feature that the operation was triggered in. For a list of record types and their corresponding ENUM value (which is the value displayed in the **RecordType** property in an audit record), see [Audit log record type](/office/office-365-management-api/office-365-management-activity-api-schema#auditlogrecordtype).| |ResultStatus|Indicates whether the action (specified in the **Operation** property) was successful or not. <br/> For Exchange admin activity, the value is either **True** (successful) or **False** (failed).|All <br/>|-|SecurityComplianceCenterEventType|Indicates that the activity was a compliance portal event. All compliance portal activities will have a value of **0** for this property.|Security & Compliance Center| +|SecurityComplianceCenterEventType|Indicates that the activity was a compliance portal event. All compliance portal activities will have a value of **0** for this property.|Microsoft Purview compliance portal| |SharingType|The type of sharing permissions that was assigned to the user that the resource was shared with. This user is identified in the **UserSharedWith** property.|SharePoint| |Site|The GUID of the site where the file or folder accessed by the user is located.|SharePoint| |SiteUrl|The URL of the site where the file or folder accessed by the user is located.|SharePoint| The following table describes the properties that are included (depending on the |UserAgent|Information about the user's browser. This information is provided by the browser.|SharePoint| |UserDomain|Identity information about the tenant organization of the user (actor) who performed the action.|Azure Active Directory| |UserId|The user who performed the action (specified in the **Operation** property) that resulted in the record being logged. Audit records for activity performed by system accounts (such as SHAREPOINT\system or NT AUTHORITY\SYSTEM) are also included in the audit log. Another common value for the UserId property is app@sharepoint. This indicates that the "user" who performed the activity was an application that has the necessary permissions in SharePoint to perform organization-wide actions (such as search a SharePoint site or OneDrive account) on behalf of a user, admin, or service. <br/><br/>For more information, see:<br/> [The app\@sharepoint user in audit records](audit-log-activities.md#the-appsharepoint-user-in-audit-records)<br/> or <br/>[System accounts in Exchange mailbox audit records](audit-log-activities.md#system-accounts-in-exchange-mailbox-audit-records). |All|-|UserKey|An alternative ID for the user identified in the **UserID** property. For example, this property is populated with the passport unique ID (PUID) for events performed by users in SharePoint. This property also might specify the same value as the **UserID** property for events occurring in other services and events performed by system accounts.|All| -|UserType|The type of user that performed the operation. The following values indicate the user type. <br/> <br/> **0** - A regular user. <br/>**2** - An administrator in your Microsoft 365 organization.<sup>1</sup> <br/>**3** - A Microsoft datacenter administrator or datacenter system account. <br/>**4** - A system account. <br/>**5** - An application. <br/>**6** - A service principal.<br/>**7** - A custom policy.<br/>**8** - A system policy.|All| +|UserKey| Contains a valid Azure Active Directory Object ID in GUID format or hex format. For scenarios where the primary actor isn't a user, the *UserKey* is an empty string. See [UserType and UserKey scenarios](#usertype-and-userkey-scenarios) for details on various *UserKey* scenarios.|All| +|UserType|The type of user that performed the operation. See the [UserType and UserKey scenarios](#usertype-and-userkey-scenarios) for details on various *UserType* scenarios. |All| |Version|Indicates the version number of the activity (identified by the **Operation** property) that's logged.|All| |Workload|The Microsoft 365 service where the activity occurred.|All| |||| +## UserType and UserKey scenarios ++The following table provides details for *UserType* and *UserKey* scenarios: ++|**Value**|**UserType member name**|**Description**|**UserKey**| +|:--|:--|:--|:-| +| 0 | Regular | A regular user without admin permissions. | AAD Object ID in GUID format | +| 2 | ADmin | An administrator in your Microsoft 365 organization.<sup>1</sup> | AAD Object ID in GUID format | +| 3 | DCAdmin | A Microsoft datacenter administrator or datacenter system account. | AAD Object ID in GUID format | +| 4 | System | An audit event triggered by server-side logic. For example, Windows services or background processes. | Empty string | +| 5 | Application | An audit event triggered by an AAD application. | AAD Application Name or Application ID (when available). Otherwise, an empty string. | +| 6 | ServicePrincipal | A service principal. | Empty string | +| 7 | CustomPolicy | A customer created or managed policy. | Empty string | +| 8 | SystemPolicy | A Microsoft-managed or system policy. | Empty string | +| 9 | PartnerTechnician | A partner tenant's user working on behalf of the customer tenant (in [GDAP](/partner-center/gdap-introduction) scenarios). | Empty string | +| 10 | Guest | A guest or anonymous user. | Empty string | + > [!NOTE]-><sup>1</sup> For Azure Active Directory-related events, the value for an administrator isn't used in an audit record. Audit records for activities performed by administrators will indicate that a regular user (for example, **UserType: 0**) performed the activity. The **UserID** property will identify the person (regular user or administrator) who performed the activity. +><sup>1</sup> For Azure Active Directory-related events, the value for an administrator isn't used in an audit record. Audit records for activities performed by administrators will indicate that a regular user (for example, **UserType: 0**) performed the activity. The **UserID** property will identify the person (regular user or administrator) who performed the activity. |
| compliance | Auto Apply Retention Labels Scenario | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/auto-apply-retention-labels-scenario.md | +- tier2 - SPO_Content - admindeeplinkCOMPLIANCE |
| compliance | Communication Compliance Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-configure.md | f1.keywords: Previously updated : 02/24/2023 Last updated : 03/20/2023 audience: Admin f1_keywords: For more information about configuring Yammer in Native Mode, see: - Enable [optical character recognition (OCR)](/microsoft-365/compliance/communication-compliance-policies#optical-character-recognition-ocr) to identify embedded or attached images in messages for printed or handwritten text that match policy conditions. For custom policies, one or more conditional settings associated with text, keywords, classifiers, or sensitive info types must be configured in the policy to enable the selection of optical character recognition (OCR) documents. - Choose the **Filter email blasts** check box to exclude messages sent from email blast services. Messages that match specific conditions selected here won't generate alerts. This includes bulk email, such as newsletters, as well as spam, phishing, and malware. When this option is selected, you can view a [report](communication-compliance-reports-audits.md#detailed-reports) containing the bulk email senders that are filtered out.+ + > [!NOTE] + > The list of senders is filtered before the content is analyzed so there might be senders that don't match the content conditions. In other words, there might be extra senders in the report. - Define the percentage of communications to review. |
| compliance | Ediscovery Cjk Support | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery-cjk-support.md | It depends on your search scenario. For review set queries, you don't need to specify a document language. eDiscovery (Premium) automatically detects document languages when you add content to a review set. This helps you optimize your query results in a review set. -**Can I see detected languages in [file metadata](ediscovery-view-documents-in-review-set.md#file-metadata)?** +**Can I see detected languages in [file metadata](ediscovery-view-documents-in-review-set.md#metadata-view)?** No, you can't see detected languages in file metadata. |
| compliance | Ediscovery Identify A Hold On An Exchange Online Mailbox | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery-identify-a-hold-on-an-exchange-online-mailbox.md | Use the following table to help you understand each of the previous values liste |:- |:-- | | **ed** | Indicates the End date, which is the date the retention policy was disabled. MinValue means the policy is still assigned to the mailbox. | | **hid** | Indicates the GUID for the retention policy. This value will correlate to the GUIDs that you collected for the explicit or organization-wide retention policies assigned to the mailbox.|+| **ht** | Indicates the hold type. Values are *0* for LitigationHold, *1* for InPlaceHold, *2* for ComplianceTagHold, *3* for DelayReleaseHold, *4* for OrganizationRetention, *5* for CompliancePolicy, *6* for SubstrateAppPolicy, and *7* for SharepointPolicy. | | **lsd** | Indicates the Last start date, which is the date the retention policy was assigned to the mailbox.| | **osd** | Indicates the Original start date, which is the date that Exchange first recorded information about the retention policy. | |
| compliance | Ediscovery View Documents In Review Set | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery-view-documents-in-review-set.md | Title: View documents in a review set in eDiscovery (Premium) -description: "Choose how you view content in eDiscovery (Premium), such as text, annotate, converted, or native view." +description: "Choose how you view content in eDiscovery (Premium) review sets, such as source, plain text, annotate, and metadata." f1.keywords: - NOCSH Previously updated : 01/01/2023 Last updated : 03/17/2023 audience: Admin -eDiscovery (Premium) displays content via several viewers each with different purposes. The various viewers can be used by selecting on any document within a review set. The viewers currently provided are: +eDiscovery (Premium) review sets display content using several viewers each with different purposes. These viewers are used by selecting the viewer on any document within a review set. The available document viewers are: -- File metadata-- Native view-- Text view-- Annotate view+- Source +- Plain text +- Annotate +- Metadata [!INCLUDE [purview-preview](../includes/purview-preview.md)] -## File metadata +## Source view -This panel can be toggled on/off to display various metadata associated with the document. Although the search results grid can be customized to display specific metadata, there are instances where scrolling horizontally can be difficult while reviewing data. The File metadata panel allows a user to toggle on a view within the viewer. -- --## Native view +The source viewer displays the richest view of a document. It supports hundreds of file types and is meant to display the truest to native experience possible. For Microsoft Office files, the viewer uses the web version of Office apps to display content such as document comments, Microsoft Teams chats, Excel formulas, hidden rows/columns, and PowerPoint notes. -The Native viewer displays the richest view of a document. It supports hundreds of file types and is meant to display the truest to native experience possible. For Microsoft Office files, the viewer uses the web version of Office apps to display content such as document comments, Excel formulas, hidden rows/columns, and PowerPoint notes. -- + ## Text view -The Text viewer provides a view of the extracted text of a file. It ignores any embedded images and formatting but is very effective if you are trying to understand the content quickly. Text view also includes these features: +The Text viewer provides a view of the extracted text of a file. It ignores any embedded images and formatting but is useful if you're trying to understand the content quickly. Text view also includes these features: - Line counter makes it easier to reference specific portions of a document-- Search hit highlighting that will highlight terms within the document as well as the scrollbar-- Diff view provides a comparison view that highlights textual differences when viewing Near Duplicate documents-- +- Search hit highlighting that highlights terms within the document and in the scrollbar - + ## Annotate view The Annotate view provides features that allow users to apply markup on a document including: -- **Area redactions**: users can draw a box on the document in order to hide sensitive content-- **Pencil**: users can free-hand draw on a document in order to bring attention to certain portions of a document-- **Select annotations**: users can select annotations on a document in order to delete-- **Toggle annotation transparency**: makes annotations semi-transparent in order to view the content behind the annotation-- **Previous page**: navigates to previous page-- **Next page**: navigates to the next page-- **Go to page**: user can enter a specific page number to navigate to-- **Zoom**: set zoom level for annotate view-- **Rotate**: user can rotate document clockwise-- **Search**: user can search within a document and navigate to the various hits within the document+- **Select annotations**: Select annotations on a document to delete +- **Select text**: Select text on the document to delete +- **Area redactions**: Draw a box on the document to hide sensitive content +- **Pencil**: Free-hand draw in selectable colors on a document in order to bring attention to certain portions of a document +- **Toggle annotation transparency**: Make annotations semi-transparent in order to view the content behind the annotation +- **Previous page**: Navigates to previous page +- **Next page**: Navigates to the next page +- **Go to page**: Enter a specific page number to navigate to +- **Zoom**: Set the zoom level for annotate view +- **Rotate**: Rotate the document clockwise ++ ++## Metadata view ++This panel can be toggled on/off to display various metadata associated with the document. Although the search results grid can be customized to display specific metadata, there are instances where scrolling horizontally can be difficult while reviewing data. The File metadata panel allows a user to toggle on a view within the viewer. ++ ++## Viewer and management tools ++For selected content, there are additional view and management tools to help you work with documents. -  + -## Dashboard View +You can select the following actions for selected content: -The dashboard view allows you to visualize and summarize the data in your search results grid. In this view, you can create custom widgets to make analyzing and reporting on your review set intuitive and easy. Once you have created your widgets, you can interact with them to get item counts or to create a search. +- **View or update notes**: Opens the **Notes** pane where you can view or add notes to the selected document. You can display the notes for the document in a column in the dashboard list by customizing your displayed columns. +- **Show in a new window**: Displays the selected document in a new browser window/tab. +- **Download PDF**: Downloads the selected document as a .pdf file. +- **Move up**: Selects the previous review set item and displays the item in the viewer. +- **Move down**: Selects the next review set item and displays the item in the viewer. +- **Maximize/Minimize**: Maximizes the viewer pane to full screen and minimizes the viewer pane. +- **Close**: Closes the selected item from the viewers |
| compliance | Retention Policies Sharepoint | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention-policies-sharepoint.md | f1.keywords: Previously updated : 03/18/2020 Last updated : 03/18/2023 audience: Admin For retention policies and auto-apply label policies: SharePoint sites must be i ## How retention works for SharePoint and OneDrive -To store content that needs to be retained, SharePoint and OneDrive create a Preservation Hold library if one doesn't exist for the site. The Preservation Hold library isn't designed to be used interactively but instead, automatically stores files when this is needed for compliance reasons. It works in the following way: +To store content that needs to be retained, SharePoint and OneDrive create a Preservation Hold library if one doesn't exist for the site. The Preservation Hold library isn't designed to be used interactively but instead, automatically stores files when this is needed for compliance reasons. It's not supported to edit, delete, or move these automatically retained files yourself. Instead, use compliance tools, such as those supported by [eDiscovery](ediscovery.md) to access these files. ++The Preservation Hold library works in the following way: When a user changes an item that's subject to retention from a retention policy or a retention label that marks items as a record, or deletes any item subject to retention, the original content is copied to the Preservation Hold library. This behavior lets the user to change or delete the content in their app, while keeping a copy of the original for compliance reasons. |
| enterprise | Multi Geo Capabilities In Onedrive And Sharepoint Online In Microsoft 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/multi-geo-capabilities-in-onedrive-and-sharepoint-online-in-microsoft-365.md | Users get a seamless experience when using Microsoft 365 services, including Off ## OneDrive -Each user's OneDrive can be provisioned in or [moved by an administrator](move-onedrive-between-geo-locations.md) to a satellite location in accordance with the user's PDL. Personal files are then kept in that geo location, though they can be shared with users in other geo locations. +Each user's OneDrive can be provisioned in or [moved by an administrator](move-onedrive-between-geo-locations.md) to a satellite location in accordance with the user's PDL. Personal files are then kept in that geo location, though they can be shared with users in other geo locations. Note that administrative options found under the OneDrive tab of an active user within the Microsoft 365 admin center are currently not supported for multi-geo tenants. ## SharePoint Sites and Groups |
| includes | Microsoft 365 Content Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-365-content-updates.md | +## Week of March 13, 2023 +++| Published On |Topic title | Change | +|||--| +| 3/13/2023 | [Manage your Microsoft Defender for Endpoint subscription settings across client devices](/microsoft-365/security/defender-endpoint/defender-endpoint-subscription-settings?view=o365-worldwide) | added | +| 3/13/2023 | [Create and deploy a data loss prevention policy](/microsoft-365/compliance/dlp-create-deploy-policy?view=o365-worldwide) | modified | +| 3/13/2023 | [Data Loss Prevention policy reference](/microsoft-365/compliance/dlp-policy-reference?view=o365-worldwide) | modified | +| 3/13/2023 | [Use sensitivity labels to protect calendar items, Teams meetings, and chat](/microsoft-365/compliance/sensitivity-labels-meetings?view=o365-worldwide) | modified | +| 3/13/2023 | [Minimum versions for sensitivity labels in Microsoft 365 Apps](/microsoft-365/compliance/sensitivity-labels-versions?view=o365-worldwide) | modified | +| 3/13/2023 | [Microsoft 365 Multi-Tenant Organization People Search](/microsoft-365/enterprise/multi-tenant-people-search?view=o365-worldwide) | modified | +| 3/13/2023 | [Compare Microsoft endpoint security plans](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2?view=o365-worldwide) | modified | +| 3/13/2023 | [Microsoft Defender Antivirus security intelligence and product updates](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 3/13/2023 | [DeviceInfo table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-deviceinfo-table?view=o365-worldwide) | modified | +| 3/13/2023 | [Integrate your SIEM tools with Microsoft 365 Defender](/microsoft-365/security/defender/configure-siem-defender?view=o365-worldwide) | modified | +| 3/13/2023 | [Create custom roles with Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/create-custom-rbac-roles?view=o365-worldwide) | modified | +| 3/13/2023 | [Create and manage custom detection rules in Microsoft 365 Defender](/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide) | modified | +| 3/13/2023 | [Edit or delete roles Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/edit-delete-rbac-roles?view=o365-worldwide) | modified | +| 3/13/2023 | [Step 4. Evaluate Microsoft Defender for Endpoint overview, including reviewing the architecture](/microsoft-365/security/defender/eval-defender-endpoint-overview?view=o365-worldwide) | modified | +| 3/13/2023 | [Review architecture requirements and the technical framework for Microsoft Defender for Identity](/microsoft-365/security/defender/eval-defender-identity-architecture?view=o365-worldwide) | modified | +| 3/13/2023 | [Enable the evaluation environment for Microsoft Defender for Identity](/microsoft-365/security/defender/eval-defender-identity-enable-eval?view=o365-worldwide) | modified | +| 3/13/2023 | [Run an attack simulation in a Microsoft 365 Defender pilot environment](/microsoft-365/security/defender/eval-defender-investigate-respond-simulate-attack?view=o365-worldwide) | modified | +| 3/13/2023 | [Review architecture requirements and the structure for Microsoft Defender for Cloud Apps](/microsoft-365/security/defender/eval-defender-mcas-architecture?view=o365-worldwide) | modified | +| 3/13/2023 | [Step 5. Evaluate Microsoft Defender for Cloud Apps overview](/microsoft-365/security/defender/eval-defender-mcas-overview?view=o365-worldwide) | modified | +| 3/13/2023 | [Microsoft 365 Defender portal](/microsoft-365/security/defender/microsoft-365-defender-portal?view=o365-worldwide) | modified | +| 3/13/2023 | [Redirecting accounts from Microsoft Defender for Endpoint to Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-mde-redirection?view=o365-worldwide) | modified | +| 3/13/2023 | [Redirecting accounts from Microsoft Defender for Identity to Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-mdi-redirection?view=o365-worldwide) | modified | +| 3/13/2023 | [Assess your security posture through Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score-improvement-actions?view=o365-worldwide) | modified | +| 3/13/2023 | [Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score?view=o365-worldwide) | modified | +| 3/13/2023 | [How to subscribe to Microsoft Defender Experts for Hunting](/microsoft-365/security/defender/onboarding-defender-experts-for-hunting?view=o365-worldwide) | modified | +| 3/13/2023 | [Detecting human-operated ransomware attacks with Microsoft 365 Defender](/microsoft-365/security/defender/playbook-detecting-ransomware-m365-defender?view=o365-worldwide) | modified | +| 3/13/2023 | [Set up your Microsoft 365 Defender trial lab or pilot environment](/microsoft-365/security/defender/setup-m365deval?view=o365-worldwide) | modified | +| 3/13/2023 | [Anti-phishing policies](/microsoft-365/security/office-365-security/anti-phishing-policies-about?view=o365-worldwide) | modified | +| 3/13/2023 | [Configure anti-phishing policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure?view=o365-worldwide) | modified | +| 3/13/2023 | [Common Zero Trust identity and device access policies - Microsoft 365 for enterprise](/microsoft-365/security/office-365-security/identity-access-policies?view=o365-worldwide) | modified | +| 3/13/2023 | [Microsoft Defender for Office 365 data retention](/microsoft-365/security/office-365-security/mdo-data-retention?view=o365-worldwide) | modified | +| 3/13/2023 | [Preset security policies](/microsoft-365/security/office-365-security/preset-security-policies?view=o365-worldwide) | modified | +| 3/13/2023 | [SIEM integration with Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/siem-integration-with-office-365-ti?view=o365-worldwide) | modified | +| 3/13/2023 | [Remove yourself from the blocked senders list and address 5.7.511 Access denied errors](/microsoft-365/security/office-365-security/use-the-delist-portal-to-remove-yourself-from-the-office-365-blocked-senders-lis?view=o365-worldwide) | modified | +| 3/13/2023 | [Configure teams with protection for highly sensitive data](/microsoft-365/solutions/configure-teams-highly-sensitive-protection?view=o365-worldwide) | modified | +| 3/13/2023 | [Configure teams with protection for sensitive data](/microsoft-365/solutions/configure-teams-sensitive-protection?view=o365-worldwide) | modified | +| 3/13/2023 | [Configure Teams with three tiers of file sharing security](/microsoft-365/solutions/configure-teams-three-tiers-protection?view=o365-worldwide) | modified | +| 3/13/2023 | [Microsoft 365 productivity illustrations](/microsoft-365/solutions/productivity-illustrations?view=o365-worldwide) | modified | +| 3/13/2023 | Configure a team with security isolation by using a unique sensitivity label | removed | +| 3/13/2023 | [Manage sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide) | modified | +| 3/14/2023 | [Increase threat protection for Microsoft 365 for business](/microsoft-365/admin/security-and-compliance/increase-threat-protection?view=o365-worldwide) | modified | +| 3/14/2023 | [How to secure your business data with Microsoft 365 for business](/microsoft-365/business-premium/secure-your-business-data?view=o365-worldwide) | added | +| 3/14/2023 | [Create and deploy a data loss prevention policy](/microsoft-365/compliance/dlp-create-deploy-policy?view=o365-worldwide) | modified | +| 3/14/2023 | [Data Loss Prevention policy reference](/microsoft-365/compliance/dlp-policy-reference?view=o365-worldwide) | modified | +| 3/14/2023 | [Keyword queries and search conditions for eDiscovery](/microsoft-365/compliance/ediscovery-keyword-queries-and-search-conditions?view=o365-worldwide) | modified | +| 3/14/2023 | [DeviceInfo table in the advanced hunting schema](/microsoft-365/security/defender/advanced-hunting-deviceinfo-table?view=o365-worldwide) | modified | +| 3/14/2023 | [Integrate your SIEM tools with Microsoft 365 Defender](/microsoft-365/security/defender/configure-siem-defender?view=o365-worldwide) | modified | +| 3/14/2023 | [Create custom roles with Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/create-custom-rbac-roles?view=o365-worldwide) | modified | +| 3/14/2023 | [Create and manage custom detection rules in Microsoft 365 Defender](/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide) | modified | +| 3/14/2023 | [Edit or delete roles Microsoft 365 Defender role-based access control (RBAC)](/microsoft-365/security/defender/edit-delete-rbac-roles?view=o365-worldwide) | modified | +| 3/14/2023 | [Step 4. Evaluate Microsoft Defender for Endpoint overview, including reviewing the architecture](/microsoft-365/security/defender/eval-defender-endpoint-overview?view=o365-worldwide) | modified | +| 3/14/2023 | [Review architecture requirements and the technical framework for Microsoft Defender for Identity](/microsoft-365/security/defender/eval-defender-identity-architecture?view=o365-worldwide) | modified | +| 3/14/2023 | [Enable the evaluation environment for Microsoft Defender for Identity](/microsoft-365/security/defender/eval-defender-identity-enable-eval?view=o365-worldwide) | modified | +| 3/14/2023 | [Run an attack simulation in a Microsoft 365 Defender pilot environment](/microsoft-365/security/defender/eval-defender-investigate-respond-simulate-attack?view=o365-worldwide) | modified | +| 3/14/2023 | [Review architecture requirements and the structure for Microsoft Defender for Cloud Apps](/microsoft-365/security/defender/eval-defender-mcas-architecture?view=o365-worldwide) | modified | +| 3/14/2023 | [Step 5. Evaluate Microsoft Defender for Cloud Apps overview](/microsoft-365/security/defender/eval-defender-mcas-overview?view=o365-worldwide) | modified | +| 3/14/2023 | [Microsoft 365 Defender portal](/microsoft-365/security/defender/microsoft-365-defender-portal?view=o365-worldwide) | modified | +| 3/14/2023 | [Redirecting accounts from Microsoft Defender for Endpoint to Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-mde-redirection?view=o365-worldwide) | modified | +| 3/14/2023 | [Redirecting accounts from Microsoft Defender for Identity to Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-mdi-redirection?view=o365-worldwide) | modified | +| 3/14/2023 | [Assess your security posture through Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score-improvement-actions?view=o365-worldwide) | modified | +| 3/14/2023 | [Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score?view=o365-worldwide) | modified | +| 3/14/2023 | [How to subscribe to Microsoft Defender Experts for Hunting](/microsoft-365/security/defender/onboarding-defender-experts-for-hunting?view=o365-worldwide) | modified | +| 3/14/2023 | [Detecting human-operated ransomware attacks with Microsoft 365 Defender](/microsoft-365/security/defender/playbook-detecting-ransomware-m365-defender?view=o365-worldwide) | modified | +| 3/14/2023 | [Set up your Microsoft 365 Defender trial lab or pilot environment](/microsoft-365/security/defender/setup-m365deval?view=o365-worldwide) | modified | +| 3/14/2023 | [Microsoft Defender for Office 365 data retention](/microsoft-365/security/office-365-security/mdo-data-retention?view=o365-worldwide) | modified | +| 3/14/2023 | [Remove yourself from the blocked senders list and address 5.7.511 Access denied errors](/microsoft-365/security/office-365-security/use-the-delist-portal-to-remove-yourself-from-the-office-365-blocked-senders-lis?view=o365-worldwide) | modified | +| 3/14/2023 | [Configure teams with protection for highly sensitive data](/microsoft-365/solutions/configure-teams-highly-sensitive-protection?view=o365-worldwide) | modified | +| 3/14/2023 | [Configure teams with protection for sensitive data](/microsoft-365/solutions/configure-teams-sensitive-protection?view=o365-worldwide) | modified | +| 3/14/2023 | [Configure Teams with three tiers of file sharing security](/microsoft-365/solutions/configure-teams-three-tiers-protection?view=o365-worldwide) | modified | +| 3/14/2023 | [Microsoft 365 productivity illustrations](/microsoft-365/solutions/productivity-illustrations?view=o365-worldwide) | modified | +| 3/14/2023 | [Set up secure file and document sharing and collaboration with Teams in Microsoft 365](/microsoft-365/solutions/setup-secure-collaboration-with-teams?view=o365-worldwide) | modified | +| 3/14/2023 | [Map fields of a modern template to library columns in Microsoft Syntex](/microsoft-365/syntex/content-assembly-map-fields) | added | +| 3/14/2023 | [Connect your DNS records at GoDaddy to Microsoft 365](/microsoft-365/admin/dns/create-dns-records-at-godaddy?view=o365-worldwide) | modified | +| 3/14/2023 | [Manage sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide) | modified | +| 3/14/2023 | [Microsoft 365 Multi-Tenant Organization People Search](/microsoft-365/enterprise/multi-tenant-people-search?view=o365-worldwide) | modified | +| 3/14/2023 | [Use Office 365 Content Delivery Network (CDN) with SharePoint Online](/microsoft-365/enterprise/use-microsoft-365-cdn-with-spo?view=o365-worldwide) | modified | +| 3/14/2023 | [Use the command line to manage Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/command-line-arguments-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 3/14/2023 | [What's new in Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-whatsnew?view=o365-worldwide) | modified | +| 3/14/2023 | [Monitor and report on Microsoft Defender Antivirus protection](/microsoft-365/security/defender-endpoint/report-monitor-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 3/14/2023 | [Permissions in the Microsoft Purview compliance portal](/microsoft-365/compliance/microsoft-365-compliance-center-permissions?view=o365-worldwide) | modified | +| 3/14/2023 | [Customize controlled folder access](/microsoft-365/security/defender-endpoint/customize-controlled-folders?view=o365-worldwide) | modified | +| 3/14/2023 | [Migrate the Azure Information Protection (AIP) add-in to Microsoft Purview Information Protection built-in labeling for Office apps](/microsoft-365/compliance/sensitivity-labels-aip?view=o365-worldwide) | modified | +| 3/14/2023 | [Minimum versions for sensitivity labels in Microsoft 365 Apps](/microsoft-365/compliance/sensitivity-labels-versions?view=o365-worldwide) | modified | +| 3/15/2023 | [Microsoft Purview Insider Risk Management and Communication Compliance privacy guide](/microsoft-365/compliance/insider-risk-solution-privacy?view=o365-worldwide) | added | +| 3/15/2023 | [Microsoft Defender Antivirus security intelligence and product updates](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates?view=o365-worldwide) | renamed | +| 3/15/2023 | [Redirecting accounts from Microsoft Defender for Cloud Apps to Microsoft 365 Defender (Preview)](/microsoft-365/security/defender/microsoft-365-security-mda-redirection?view=o365-worldwide) | added | +| 3/15/2023 | How to secure your business data with Microsoft 365 for business | removed | +| 3/15/2023 | [What's new in the Microsoft 365 admin center?](/microsoft-365/admin/whats-new-in-preview?view=o365-worldwide) | modified | +| 3/15/2023 | [Set up GDAP for your customers](/microsoft-365/lighthouse/m365-lighthouse-setup-gdap?view=o365-worldwide) | modified | +| 3/15/2023 | [Microsoft Defender for Business frequently asked questions](/microsoft-365/security/defender-business/mdb-faq?view=o365-worldwide) | modified | +| 3/15/2023 | [Device health Microsoft Defender Antivirus health report](/microsoft-365/security/defender-endpoint/device-health-microsoft-defender-antivirus-health?view=o365-worldwide) | modified | +| 3/15/2023 | [Microsoft Defender Antivirus updates - Previous versions for technical upgrade support](/microsoft-365/security/defender-endpoint/msda-updates-previous-versions-technical-upgrade-support?view=o365-worldwide) | modified | +| 3/15/2023 | [Compare Microsoft Defender Vulnerability Management plans and capabilities](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-capabilities?view=o365-worldwide) | modified | +| 3/15/2023 | [Enable the Report Message or the Report Phishing add-ins](/microsoft-365/security/office-365-security/submissions-users-report-message-add-in-configure?view=o365-worldwide) | modified | +| 3/15/2023 | [Top 12 tasks for security teams to support working from home](/microsoft-365/security/top-security-tasks-for-remote-work?view=o365-worldwide) | modified | +| 3/16/2023 | [Manage sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide) | modified | +| 3/15/2023 | [Select the domain to use for email from Microsoft 365 products](/microsoft-365/admin/email/select-domain-to-use-for-email-from-microsoft-365-products?view=o365-worldwide) | added | +| 3/15/2023 | [Permissions in the Microsoft Purview compliance portal](/microsoft-365/compliance/microsoft-365-compliance-center-permissions?view=o365-worldwide) | modified | +| 3/15/2023 | [Frequently asked questions on tamper protection](/microsoft-365/security/defender-endpoint/faqs-tamper-protection?view=o365-worldwide) | modified | +| 3/15/2023 | [Protect security settings with tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide) | modified | +| 3/15/2023 | [Train your custom model in Microsoft Syntex](/microsoft-365/syntex/train-model) | modified | +| 3/17/2023 | [Train an unstructured document processing model in Microsoft Syntex](/microsoft-365/syntex/create-a-classifier) | modified | +| 3/16/2023 | [Microsoft 365 alert policies](/microsoft-365/compliance/alert-policies?view=o365-worldwide) | modified | +| 3/16/2023 | [Detailed properties in the audit log](/microsoft-365/compliance/audit-log-detailed-properties?view=o365-worldwide) | modified | +| 3/16/2023 | [Search the audit log to troubleshoot common scenarios](/microsoft-365/compliance/audit-troubleshooting-scenarios?view=o365-worldwide) | modified | +| 3/16/2023 | [Free trial of Microsoft Purview compliance solutions](/microsoft-365/compliance/compliance-easy-trials?view=o365-worldwide) | modified | +| 3/17/2023 | [Get started with insider risk management settings](/microsoft-365/compliance/insider-risk-management-settings?view=o365-worldwide) | modified | +| 3/17/2023 | [Microsoft 365 alert policies](/microsoft-365/compliance/alert-policies?view=o365-worldwide) | modified | +| 3/17/2023 | [Manage quarantined messages and files as an admin](/microsoft-365/security/office-365-security/quarantine-admin-manage-messages-files?view=o365-worldwide) | modified | ++ ## Week of March 06, 2023 | 2/17/2023 | [Learn about data loss prevention](/microsoft-365/compliance/dlp-learn-about-dlp?view=o365-worldwide) | modified | | 2/17/2023 | [Configure the delivery of third-party phishing simulations to users and unfiltered messages to SecOps mailboxes](/microsoft-365/security/office-365-security/skip-filtering-phishing-simulations-sec-ops-mailboxes?view=o365-worldwide) | modified | | 2/17/2023 | [Use network protection to help prevent Linux connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection-linux?view=o365-worldwide) | modified |---## Week of February 06, 2023 ---| Published On |Topic title | Change | -|||--| -| 2/6/2023 | [Help dynamically mitigate risks with Adaptive Protection (preview)](/microsoft-365/compliance/insider-risk-management-adaptive-protection?view=o365-worldwide) | added | -| 2/6/2023 | [Automatically apply a sensitivity label in Microsoft 365](/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) | modified | -| 2/6/2023 | [Create and publish sensitivity labels](/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) | modified | -| 2/6/2023 | [Create and deploy a data loss prevention policy](/microsoft-365/compliance/dlp-create-deploy-policy?view=o365-worldwide) | modified | -| 2/6/2023 | [Learn about data loss prevention](/microsoft-365/compliance/dlp-learn-about-dlp?view=o365-worldwide) | modified | -| 2/6/2023 | [Data Loss Prevention policy reference](/microsoft-365/compliance/dlp-policy-reference?view=o365-worldwide) | modified | -| 2/6/2023 | [Using Endpoint DLP](/microsoft-365/compliance/endpoint-dlp-using?view=o365-worldwide) | modified | -| 2/6/2023 | [Get started with sensitivity labels](/microsoft-365/compliance/get-started-with-sensitivity-labels?view=o365-worldwide) | modified | -| 2/6/2023 | [Get started with insider risk management](/microsoft-365/compliance/insider-risk-management-configure?view=o365-worldwide) | modified | -| 2/6/2023 | [Permissions in the Microsoft Purview compliance portal](/microsoft-365/compliance/microsoft-365-compliance-center-permissions?view=o365-worldwide) | modified | -| 2/6/2023 | [Learn about Adaptive Protection in data loss prevention](/microsoft-365/compliance/dlp-adaptive-protection-learn?view=o365-worldwide) | added | -| 2/6/2023 | [Limit guest sharing to specific organizations](/microsoft-365/solutions/limit-guest-sharing-to-specific-organization?view=o365-worldwide) | modified | -| 2/6/2023 | [Limit sharing in Microsoft 365](/microsoft-365/solutions/microsoft-365-limit-sharing?view=o365-worldwide) | modified | -| 2/6/2023 | [Automatically apply a retention label to Microsoft 365 items](/microsoft-365/compliance/apply-retention-labels-automatically?view=o365-worldwide) | modified | -| 2/6/2023 | [What's new in Microsoft Purview risk and compliance solutions](/microsoft-365/compliance/whats-new?view=o365-worldwide) | modified | -| 2/7/2023 | [Automatic ServiceNow Incident Creation](/microsoft-365/admin/manage/servicenow-incidents?view=o365-worldwide) | added | -| 2/7/2023 | [Email authentication in Microsoft 365](/microsoft-365/security/office-365-security/email-authentication-about?view=o365-worldwide) | modified | -| 2/7/2023 | [Use a prebuilt model to extract information from invoices in Microsoft Syntex](/microsoft-365/syntex/prebuilt-model-invoice?view=o365-worldwide) | modified | -| 2/7/2023 | [Get started with communication compliance](/microsoft-365/compliance/communication-compliance-configure?view=o365-worldwide) | modified | -| 2/7/2023 | [Plan for communication compliance](/microsoft-365/compliance/communication-compliance-plan?view=o365-worldwide) | modified | -| 2/7/2023 | [Create and manage communication compliance policies](/microsoft-365/compliance/communication-compliance-policies?view=o365-worldwide) | modified | -| 2/7/2023 | [Learn about communication compliance](/microsoft-365/compliance/communication-compliance?view=o365-worldwide) | modified | -| 2/7/2023 | [Review data with the insider risk management content explorer](/microsoft-365/compliance/insider-risk-management-content-explorer?view=o365-worldwide) | modified | -| 2/7/2023 | [Attack surface reduction in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-asr?view=o365-worldwide) | modified | -| 2/7/2023 | [View and edit your security settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-configure-security-settings?view=o365-worldwide) | modified | -| 2/7/2023 | [Configure authentication for Microsoft 365 support integration with ServiceNow](/microsoft-365/admin/manage/servicenow-authentication?view=o365-worldwide) | modified | -| 2/7/2023 | [Azure Active Directory setup guides](/microsoft-365/admin/misc/azure-ad-setup-guides?view=o365-worldwide) | modified | -| 2/7/2023 | [Compare Microsoft endpoint security plans](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2?view=o365-worldwide) | modified | -| 2/8/2023 | [Audit log activities](/microsoft-365/compliance/audit-log-activities?view=o365-worldwide) | modified | -| 2/8/2023 | [Introduction to information management policies](/microsoft-365/compliance/intro-to-info-mgmt-policies?view=o365-worldwide) | modified | -| 2/8/2023 | [Microsoft Teams Virtual Appointments Call Quality Dashboard](/microsoft-365/frontline/virtual-appointments-call-quality?view=o365-worldwide) | modified | -| 2/8/2023 | [Run the client analyzer on macOS or Linux](/microsoft-365/security/defender-endpoint/run-analyzer-macos-linux?view=o365-worldwide) | modified | -| 2/8/2023 | [Report spam, non-spam, phishing, suspicious emails and files to Microsoft](/microsoft-365/security/office-365-security/submissions-report-messages-files-to-microsoft?view=o365-worldwide) | modified | -| 2/8/2023 | [User reported message settings](/microsoft-365/security/office-365-security/submissions-user-reported-messages-files-custom-mailbox?view=o365-worldwide) | modified | -| 2/8/2023 | [Deploy a task automatically in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-deploy-task-automatically?view=o365-worldwide) | modified | -| 2/8/2023 | [Set up GDAP for your customers](/microsoft-365/lighthouse/m365-lighthouse-setup-gdap?view=o365-worldwide) | modified | -| 2/8/2023 | [Turn on cloud protection in Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus?view=o365-worldwide) | modified | -| 2/9/2023 | [Learn about sensitivity labels](/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) | modified | -| 2/9/2023 | [Limit guest sharing to specific organizations](/microsoft-365/solutions/limit-guest-sharing-to-specific-organization?view=o365-worldwide) | modified | -| 2/10/2023 | [Set preferences for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-preferences?view=o365-worldwide) | modified | -| 2/10/2023 | [Anti-spam protection](/microsoft-365/security/office-365-security/anti-spam-protection-about?view=o365-worldwide) | modified | -| 2/9/2023 | [Turn pronouns on or off for your organization in the Microsoft 365 admin center](/microsoft-365/admin/add-users/turn-pronouns-on-or-off?view=o365-worldwide) | added | -| 2/9/2023 | [Search for and delete chat messages in Teams](/microsoft-365/compliance/ediscovery-search-and-delete-teams-chat-messages?view=o365-worldwide) | modified | -| 2/10/2023 | [Configure Microsoft Defender for Endpoint on Android risk signals using App Protection Policies (MAM)](/microsoft-365/security/defender-endpoint/android-configure-mam?view=o365-worldwide) | modified | -| 2/10/2023 | [Network device discovery and vulnerability management](/microsoft-365/security/defender-endpoint/network-devices?view=o365-worldwide) | modified | -| 2/10/2023 | [How to schedule an antivirus scan using Anacron in Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/schedule-antivirus-scan-in-mde?view=o365-worldwide) | modified | -| 2/10/2023 | [Performance analyzer for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/tune-performance-defender-antivirus?view=o365-worldwide) | modified | -| 2/10/2023 | [Authenticated scan for Windows in Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/windows-authenticated-scan?view=o365-worldwide) | modified | -| 2/10/2023 | [Application Guard for Office for admins](/microsoft-365/security/office-365-security/install-app-guard?view=o365-worldwide) | modified | -| 2/10/2023 | [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-worldwide) | modified | -| 2/10/2023 | [Set up Safe Links policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/safe-links-policies-configure?view=o365-worldwide) | modified | -| 2/10/2023 | [Test and deploy Microsoft 365 Apps by partners in the Integrated apps portal](/microsoft-365/admin/manage/test-and-deploy-microsoft-365-apps?view=o365-worldwide) | modified | -| 2/10/2023 | [Create EDM SIT sample file for the new experience](/microsoft-365/compliance/sit-create-edm-sit-unified-ux-sample-file?view=o365-worldwide) | modified | -| 2/10/2023 | [Get started with exact data match based sensitive information types](/microsoft-365/compliance/sit-get-started-exact-data-match-based-sits-overview?view=o365-worldwide) | modified | -| 2/10/2023 | [Export source data for exact data match based sensitive information type](/microsoft-365/compliance/sit-get-started-exact-data-match-export-data?view=o365-worldwide) | modified | -| 2/10/2023 | [Configure anti-malware policies](/microsoft-365/security/office-365-security/anti-malware-policies-configure?view=o365-worldwide) | modified | |
| lighthouse | M365 Lighthouse Deploy Task Automatically | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-deploy-task-automatically.md | Additionally, each partner tenant user must meet the following requirements: 5. In the task details pane, select **Deploy**. -6. In the **Review and edit deployment configuration** page, edit the default configuration as needed. +6. On the **Review deployment task** page, edit the default configuration as needed. - 1. Select whether to deploy the applicable configuration as **Enable** or **Report Only** mode if applicable. + 1. If applicable, select whether to deploy the configuration as **Enable** or **Report Only** mode. 2. If applicable, edit the assignment of the task to: Additionally, each partner tenant user must meet the following requirements: 7. Select **Next**. -8. In the **Review detected configurations** page, review detected configurations. +8. On the **Review tenant configuration** page, review intersecting configurations. Intersecting configurations are common properties with settings that are also included in the deployment task. - The **Review detected configurations** page is provided for eligible tasks and lists any existing configurations detected within the tenant. From this page, you may either edit the existing configurations or deploy a new configuration through Lighthouse to fulfill the task's requirements. + The **Review tenant configurations** page is provided for eligible tasks and lists any intersecting configurations detected within the tenant. From this page, you may edit the existing configurations or deploy a new configuration through Lighthouse to fulfill the task's requirements. - If existing configurations are detected, they'll be displayed in the detected configuration in the deployment plan comparison table. For each detected configuration, Lighthouse will determine whether the setting is **Compliant**, **Not compliant**, **Missing**, or **Extra**. + If existing configurations are detected, they'll be displayed with a link to the applicable configuration in the **Detected configuration in the deployment plan** comparison table. - The detected configurations table at the bottom of the page allows you to compare the detected configurations from the tenant to your deployment plan, inclusive of any selections made on the **Review and edit deployment configuration** page. This table can be filtered by configuration or setting status and searched by user. + The detected configurations table at the bottom of the page allows you to compare the detected configurations from the tenant to your deployment plan, inclusive of any selections made on the **Review deployment task** page. This table can be filtered by configuration or setting status and searched by user. - If there are no detected configurations, you'll be directed to the confirm and deploy page. + If there are no detected configurations, you'll be directed to the **Confirm configuration** page. 9. If applicable, edit existing configurations as needed. Additionally, each partner tenant user must meet the following requirements: 4. Save the updated configuration in the applicable management portal - 5. In Lighthouse, select **Refresh detected configurations** to refresh the results of the detected configuration. + 5. In Lighthouse, select **Refresh** to refresh the results of the detected configuration. - When editing existing configurations, the presence of **Extra** settings has no impact on the deployment status of the task. You may retain, edit, or discard, **Extra** settings at your discretion. + When editing existing configurations, **Extra** settings have no impact on the deployment status of the task. You may retain, edit, or discard **Extra** settings at your discretion. - Once Lighthouse sees no settings from the task that are missing for or not compliant for any of the users to whom the task is targeted, Lighthouse will update the task status to **Compliant**, and you'll be prompted to exit the wizard. + Once Lighthouse determines there are no settings that are **Not compliant** or **Missing** from all existing configurations, Lighthouse will update the task status to **Compliant**. You will be prompted to exit the wizard. 10. Select **Next**. -11. From the **Confirm and deploy** page, confirm the configuration and select **Confirm**. +11. On the **Confirm configuration** page, confirm the configuration and select **Confirm**. -12. From the **Complete** confirmation page, select **Close**. +12. On the **Complete** confirmation page, select **Close**. -Choosing to deploy a new configuration through Lighthouse will ensure that the security configuration is enforced but doesn't modify any of the existing configurations. This may result in settings with duplicate or conflicting values for users, which may prevent the status of the task from being updated to compliant. To make the task compliant, you'll need to edit or delete the settings that aren't compliant with the existing configuration. +Deploying a new configuration through Lighthouse will ensure that the security configuration is enforced but doesn't modify any existing configurations. This may result in settings with duplicate or conflicting values for users, which may prevent the status of the task from being updated to **Compliant**. To make the task compliant, you'll need to edit or delete the settings that aren't compliant with the deployment task. ## Related content |
| lighthouse | M365 Lighthouse Overview Deployment Task | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-overview-deployment-task.md | A tenant's deployment plan is complete when all tasks are compliant or explicitl |Factor|Description| |||-|Is the tenant licensed for the required services associated with the task?|<ul><li>Tasks that aren't licensed won't be eligible for deployment.</li><li>Tasks that aren't licensed may be dismissed.</li><li>Lighthouse will direct users to the Business Workshop Tool to determine licensing needs.</li><li>Once Lighthouse detects that the tenant is licensed for the required services associated with the task, the status will be updated automatically.</li></ul>| -|Is the task related to other tasks?|<ul><li>Tasks related to other tasks must be completed in sequential order.</li><li>Subsequent tasks will be eligible for deployment once the pre-requisite tasks are compliant.</li></ul>| +|Is the tenant licensed for the required services associated with the task?|<ul><li>Tasks that aren't licensed won't be eligible for deployment.</li><li>Tasks that aren't licensed may be **Dismissed**.</li><li>Once Lighthouse detects that the tenant is licensed for the required services associated with the task, the status will be updated automatically.</li></ul>| +|Is the task related to other tasks?|<ul><li>Tasks related to other tasks must be completed in sequential order.</li><li>Subsequent tasks will be eligible for deployment once the pre-requisite tasks are **Compliant**.</li></ul>| |Can the configuration associated with the task be deployed through Lighthouse?|<ul><li>Tasks that require configurations that can't be deployed through Lighthouse will require manual implementation.</li><li>Lighthouse can't deploy tasks when it can't detect any existing configuration.</li></ul>|-|Was the task dismissed?|<ul><li>Dismissed tasks aren't eligible for deployment.</li><li>Dismissed tasks can be reinstated.</li><li>Once a task is reinstated, the status will be updated automatically.</li></ul>| +|Was the task dismissed?|<ul><li>Dismissed tasks aren't eligible for deployment.</li><li>Dismissed tasks can be **Reinstated**.</li><li>Once a task is **Reinstated**, the status will be updated automatically.</li></ul>| |Is the task compliant?|<ul><li>Compliant tasks require no further action, but users may review task details and existing configurations.</li></ul>| ## Related content |
| lighthouse | M365 Lighthouse Understand Deployment Statuses | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-understand-deployment-statuses.md | Tasks can have the following statuses: |Task Status|Description| |||-|Compliant|<ul><li>All settings included in the subtask are Compliant.</li><li>There are no settings that are Missing or Not compliant.</li><li>There may be Extra settings detected within existing configurations.</li></ul>| -|Not Compliant|<ul><li>One or more settings included in the subtask are either Missing or Not compliant.</li><li>There may be Extra settings detected within existing configurations.</li><p>**Note:** Doesn't apply to subtasks that aren't licensed. </p></ul>| +|Compliant|<ul><li>All settings included in the subtask are **Compliant**.</li><li>There are no settings that are **Not compliant**.</li><li>There are no settings that are **Missing** from all existing configurations. A task can be **Compliant** if a setting is **Compliant** in one or more existing configurations without being **Not compliant** in another.</li><li>There may be **Extra** settings detected within existing configurations.</li></ul>| +|Not compliant|<ul><li>One or more settings included in the subtask are **Not compliant**.</li><li>One or more settings are **Missing** from all existing configurations.</li><li>There may be **Extra** settings detected within existing configurations.</li><p>**NOTE:** Doesn't apply to subtasks that are **Not licensed**. </p></ul>| |Not licensed|The tenant isn't licensed for the services required to deploy the configuration associated with the subtask.| |Dismissed|The subtask has been Dismissed by a Lighthouse user.<p>**NOTE:** Not licensed subtasks may be dismissed by a Lighthouse user.</p>| Settings can be assigned the following statuses: |Setting Status|Description| |||-|Compliant|The value detected in the tenant is equivalent to the value in the deployment plan for all targeted users.| -|Not compliant|The value detected in the tenant isn't equivalent to the value in the deployment plan for one or more targeted users.| +|Compliant|The value detected in the existing configuration deployed to the customer tenant is equivalent to the value in the deployment plan for all targeted users.| +|Not compliant|The value detected in the existing configuration deployed to the customer tenant isn't equivalent to the value in the deployment plan for one or more targeted users.| |Missing|There's no value detected in the tenant for a setting that is included in the deployment plan.| |Extra|There's a value detected in the tenant for a setting that isn't included in the deployment plan.| Users can be assigned the following statuses: |User Status|Description| |||-|Compliant|<ul><li>The user is targeted for the subtask.</li><li>The user has been assigned licenses for all services required by the subtask.</li><li>All settings included in the subtask are Compliant.</li><li>There are no settings that are Missing or Not compliant.</li><li>There may be Extra settings detected within existing configurations.</li></ul>| -|Not compliant|<ul><li>The user is targeted for the subtask.</li><li>The user has been assigned licenses for all services required by the subtask.</li><li>One or more settings included in the subtask are either Missing or Not compliant.</li><li>There may be Extra settings detected within existing configurations.</li><p>**NOTE:** Doesn't apply to subtasks that are Not licensed.</p></ul>| -|Excluded|The user has been excluded from the subtask.<p>**NOTE**: When a user is excluded from a subtask, status detection and reporting will be updated accordingly, but existing configurations won't be affected.</p>| -|Not licensed|The user isn't licensed for the services required to deploy the prescribed configuration.<p>**NOTE:** Doesn't apply to users with Not targeted status.</p>| -|Not targeted|The user isn't targeted for the subtask. For example, a user that isn't an admin is reported as Not targeted for a subtask that is assigned only to admins.| +|Compliant|<ul><li>The user is targeted for the subtask.</li><li>The user has been assigned licenses for all services required by the subtask.</li><li>All settings included in the subtask are **Compliant**.</li><li>There are no settings that are **Not compliant**.</li><li>There are no settings that are **Missing** from all existing configurations. A user can be **Compliant** if a setting is **Compliant** in one or more existing configurations without being **Not compliant** in another.</li><li>There may be **Extra** settings detected within existing configurations.</li></ul>| +|Not compliant|<ul><li>The user is targeted for the subtask.</li><li>The user has been assigned licenses for all services required by the subtask.</li><li>One or more settings included in the subtask are **Not compliant**.</li><li>One or more settings are **Missing** from all existing configurations.</li><li>There may be **Extra** settings detected within existing configurations.</li><p>**NOTE:** Doesn't apply to subtasks that are **Not licensed**.</p></ul>| +|Excluded|The user has been excluded from the subtask.<p>**NOTE**: When a user is **Excluded** from a subtask, status detection and reporting will be updated accordingly, but existing configurations won't be affected.</p>| +|Not licensed|The user isn't licensed for the services required to deploy the prescribed configuration.<p>**NOTE:** Doesn't apply to users with **Not targeted** status.</p>| +|Not targeted|The user isn't the intended target for the subtask. For example, a user that isn't an admin is reported as **Not targeted** for a subtask that is assigned only to admins.| ## Related content |
| security | Defender Endpoint Subscription Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-subscription-settings.md | Title: Manage your Microsoft Defender for Endpoint subscription settings across client devices + Title: Manage your Microsoft Defender for Endpoint subscription settings across client devices (preview!) description: Learn about your options for managing your Defender for Endpoint subscription settings. Choose Plan 1, Plan 2, or mixed mode. keywords: Defender for Endpoint, choose plan 1, choose plan 2, mixed mode, device tag, endpoint protection, endpoint security, device security, cybersecurity search.appverid: MET150 -# Manage Microsoft Defender for Endpoint subscription settings across client devices +# Manage Microsoft Defender for Endpoint subscription settings across client devices (preview!) A [mixed-licensing scenario](defender-endpoint-plan-1-2.md#mixed-licensing-scenarios) is a situation in which an organization is using a mix of Defender for Endpoint Plan 1 and Plan 2 licenses. Until recently, mixed-licensing scenarios weren't supported; in cases of multiple subscriptions, the highest functional subscription would take precedence for your tenant. Now, **the ability to manage your subscription settings to accommodate mixed licensing scenarios across client devices is currently in preview**! These capabilities enable you to: |
| security | Microsoft Defender Antivirus Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates.md | description: Manage how Microsoft Defender Antivirus receives protection and pro keywords: updates, security baselines, protection, schedule updates, force updates, mobile updates, wsus ms.localizationpriority: high Previously updated : 03/15/2023 Last updated : 03/20/2023 audience: ITPro For Windows 10 release information, see the [Windows lifecycle fact sheet](https ## Updates for Deployment Image Servicing and Management (DISM) -We recommend updating your Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, Windows Server 2022, and Windows Server 2016 OS installation images with the latest antivirus and antimalware updates. Keeping your OS installation images up to date helps avoid a gap in protection. +We recommend updating your Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, Windows Server 2022, Windows Server 2016, and Windows Server 2012 R2 OS installation images with the latest antivirus and antimalware updates. Keeping your OS installation images up to date helps avoid a gap in protection. For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images). For more information, see [Microsoft Defender update for Windows operating syste | Article | Description | |:|:|-|[Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images) | Review antimalware update packages for your OS installation images (WIM and VHD files). Get Microsoft Defender Antivirus updates for Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, Windows Server 2022, and Windows Server 2016 installation images. | +|[Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images) | Review antimalware update packages for your OS installation images (WIM and VHD files). Get Microsoft Defender Antivirus updates for Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, Windows Server 2022, Windows Server 2016, and Windows Server 2012 R2 installation images. | |[Manage how protection updates are downloaded and applied](manage-protection-updates-microsoft-defender-antivirus.md) | Protection updates can be delivered through many sources. | |[Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) | You can schedule when protection updates should be downloaded. | |[Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) | If an endpoint misses an update or scheduled scan, you can force an update or scan the next time a user signs in. | |
| security | Whats New In Microsoft Defender Endpoint | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint.md | ms.pagetype: security ms.localizationpriority: medium Previously updated : 02/28/2023 Last updated : 03/20/2023 audience: ITPro For more information on Microsoft Defender for Endpoint on specific operating sy - [What's new in Defender for Endpoint on iOS](ios-whatsnew.md) - [What's new in Defender for Endpoint on Linux](linux-whatsnew.md) +## March 2023 ++- Support for [Mixed-licensing scenarios](defender-endpoint-plan-1-2.md#mixed-licensing-scenarios) is now in preview! With these capabilities, you can [Manage Microsoft Defender for Endpoint subscription settings across client devices (preview!)](defender-endpoint-subscription-settings.md). + ## February 2023 -- The Microsoft Defender for Identity integration toggle is now removed from the MDE Settings > Advanced features page. Because Defender for Identity is now integrated with Microsoft 365 Defender, this toggle is no longer required. You don't need to manually configure integration between services. See [What's new - Microsoft Defender for Identity](/defender-for-identity/whats-new#defender-for-identity-release-2194).+- The Microsoft Defender for Identity integration toggle is now removed from the Microsoft Defender for Endpoint Settings > Advanced features page. Because Defender for Identity is now integrated with Microsoft 365 Defender, this toggle is no longer required. You don't need to manually configure integration between services. See [What's new - Microsoft Defender for Identity](/defender-for-identity/whats-new#defender-for-identity-release-2194). ## January 2023 |
| security | Air About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-about.md | Microsoft 365 provides many built-in alert policies that help identify Exchange |Alert|Severity|How the alert is generated| ||||-|A potentially malicious URL click was detected|**High**|This alert is generated when any of the following occurs: <ul><li>A user protected by [Safe Links](safe-links-about.md) in your organization clicks a malicious link</li><li>Verdict changes for URLs are identified by Microsoft Defender for Office 365</li><li>Users override Safe Links warning pages (based on your organization's [Safe Links policy](safe-links-policies-configure.md).</li></ul> <p> For more information on events that trigger this alert, see [Set up Safe Links policies](safe-links-policies-configure.md).| +|A potentially malicious URL click was detected|**High**|This alert is generated when any of the following occurs: <ul><li>A user protected by [Safe Links](safe-links-about.md) in your organization clicks a malicious link</li><li>Verdict changes for URLs are identified by Microsoft Defender for Office 365</li><li>Users override Safe Links warning pages (based on your organization's [Safe Links policy](safe-links-policies-configure.md).</li></ul> <br/> For more information on events that trigger this alert, see [Set up Safe Links policies](safe-links-policies-configure.md).| |An email message is reported by a user as malware or phish|**Informational**|This alert is generated when users in your organization report messages as phishing email using the [Microsoft Report Message or Report Phishing add-ins](submissions-users-report-message-add-in-configure.md).| |Email messages containing malicious file removed after delivery|**Informational**|This alert is generated when any messages containing a malicious file are delivered to mailboxes in your organization. If this event occurs, Microsoft removes the infected messages from Exchange Online mailboxes using [zero-hour auto purge (ZAP)](zero-hour-auto-purge.md).| |Email messages containing malware are removed after delivery|**Informational**|This alert is generated when any email messages containing malware are delivered to mailboxes in your organization. If this event occurs, Microsoft removes the infected messages from Exchange Online mailboxes using [zero-hour auto purge (ZAP)](zero-hour-auto-purge.md).| Permissions are granted through certain roles, such as those that are described |Task|Role(s) required| |||-|Set up AIR features|One of the following roles: <ul><li>Global Administrator</li><li>Security Administrator</li></ul> <p> These roles can be assigned in [Azure Active Directory](/azure/active-directory/roles/permissions-reference) or in the [Microsoft 365 Defender portal](mdo-portal-permissions.md).| +|Set up AIR features|One of the following roles: <ul><li>Global Administrator</li><li>Security Administrator</li></ul> <br/> These roles can be assigned in [Azure Active Directory](/azure/active-directory/roles/permissions-reference) or in the [Microsoft 365 Defender portal](mdo-portal-permissions.md).| |Start an automated investigation <p> or <p> Approve or reject recommended actions|One of the following roles, assigned in [Azure Active Directory](/azure/active-directory/roles/permissions-reference) or in the [Microsoft 365 Defender portal](mdo-portal-permissions.md): <ul><li>Global Administrator</li><li>Security Administrator</li><li>Security Operator</li><li>Security Reader <br> and </li><li>Search and Purge (this role is assigned only in the [Microsoft 365 Defender portal](mdo-portal-permissions.md). You might need to create a new **Email & collaboration** role group there and add the Search and Purge role to that new role group.</li></ul>| ## Required licenses |
| security | Air View Investigation Results | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-view-investigation-results.md | The investigation status indicates the progress of the analysis and actions. As |**Starting**|The investigation has been triggered and waiting to start running.| |**Running**|The investigation process has started and is underway. This state also occurs when [pending actions](air-review-approve-pending-completed-actions.md#approve-or-reject-pending-actions) are approved.| |**No Threats Found**|The investigation has finished and no threats (user account, email message, URL, or file) were identified. <p> **TIP**: If you suspect something was missed (such as a false negative), you can take action using [Threat Explorer](threat-explorer-about.md).|-|**Partially Investigated**|The automated investigation found issues, but there are no specific remediation actions to resolve those issues. <p> The **Partially Investigated** status can occur when some type of user activity was identified but no cleanup actions are available. Examples include any of the following user activities: <ul><li>A [data loss prevention](../../compliance/dlp-learn-about-dlp.md) event</li><li>An email sending anomaly</li><li>Sent malware</li><li>Sent phish</li></ul> <p> **Note**: This **Partially Investigated** status used to be labeled as **Threats Found**. <p> The investigation found no malicious URLs, files, or email messages to remediate, and no mailbox activity to fix, such as turning off forwarding rules or delegation. <p> **TIP**: If you suspect something was missed (such as a false negative), you can investigate and take action using [Threat Explorer](threat-explorer-about.md)| -|**Terminated By System**|The investigation stopped. An investigation can stop for several reasons: <ul><li>The investigation's pending actions expired. Pending actions time out after awaiting approval for one week</li><li>There are too many actions. For example, if there are too many users clicking on malicious URLs, it can exceed the investigation's ability to run all the analyzers, so the investigation halts</li></ul> <p> **TIP**: If an investigation halts before actions were taken, try using [Threat Explorer](threat-explorer-about.md) to find and address threats.| +|**Partially Investigated**|The automated investigation found issues, but there are no specific remediation actions to resolve those issues. <p> The **Partially Investigated** status can occur when some type of user activity was identified but no cleanup actions are available. Examples include any of the following user activities: <ul><li>A [data loss prevention](../../compliance/dlp-learn-about-dlp.md) event</li><li>An email sending anomaly</li><li>Sent malware</li><li>Sent phish</li></ul> <br/> **Note**: This **Partially Investigated** status used to be labeled as **Threats Found**. <p> The investigation found no malicious URLs, files, or email messages to remediate, and no mailbox activity to fix, such as turning off forwarding rules or delegation. <p> **TIP**: If you suspect something was missed (such as a false negative), you can investigate and take action using [Threat Explorer](threat-explorer-about.md)| +|**Terminated By System**|The investigation stopped. An investigation can stop for several reasons: <ul><li>The investigation's pending actions expired. Pending actions time out after awaiting approval for one week</li><li>There are too many actions. For example, if there are too many users clicking on malicious URLs, it can exceed the investigation's ability to run all the analyzers, so the investigation halts</li></ul> <br/> **TIP**: If an investigation halts before actions were taken, try using [Threat Explorer](threat-explorer-about.md) to find and address threats.| |**Pending Action**|The investigation has found a threat, such as a malicious email, a malicious URL, or a risky mailbox setting, and an action to remediate that threat is [awaiting approval](air-review-approve-pending-completed-actions.md). <p> The **Pending Action** state is triggered when any threat with a corresponding action is found. However, the list of pending actions can increase as an investigation runs. View investigation details to see if other items are still pending completion.| |**Remediated**|The investigation finished and all remediation actions were approved (noted as fully remediated). <p> **NOTE**: Approved remediation actions can have errors that prevent the actions from being taken. Regardless of whether remediation actions are successfully completed, the investigation status doesn't change. View investigation details.| |**Partially Remediated**|The investigation resulted in remediation actions, and some were approved and completed. Other actions are still [pending](air-review-approve-pending-completed-actions.md).| |
| security | Anti Spam Policies Asf Settings About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-policies-asf-settings-about.md | The following **Mark as spam** ASF settings set the SCL of detected messages to |Anti-spam policy setting|Description|X-header added| |||| |**Sender ID filtering hard fail** <p> *MarkAsSpamFromAddressAuthFail*|Messages that hard fail a conditional Sender ID check are marked as spam. <p> This setting combines an SPF check with a Sender ID check to help protect against message headers that contain forged senders. <p> Test mode is not available for this setting.|`X-CustomSpam: SPF From Record Fail`|-|**Backscatter** <p> *MarkAsSpamNdrBackscatter*|*Backscatter* is useless non-delivery reports (also known as NDRs or bounce messages) caused by forged senders in email messages. For more information, see [Backscatter messages and EOP](anti-spam-backscatter-about.md). <p> You don't need to configure this setting in the following environments, because legitimate NDRs are delivered, and backscatter is marked as spam: <ul><li>Microsoft 365 organizations with Exchange Online mailboxes.</li><li>On-premises email organizations where you route *outbound* email through EOP.</li></ul> <p> In standalone EOP environments that protect inbound email to on-premises mailboxes, turning this setting on or off has the following result: <ul><li> **On**: Legitimate NDRs are delivered, and backscatter is marked as spam.</li><li>**Off**: Legitimate NDRs and backscatter go through normal spam filtering. Most legitimate NDRs will be delivered to the original message sender. Some, but not all, backscatter is marked as spam. By definition, backscatter can only be delivered to the spoofed sender, not to the original sender.</li></ul> <p> Test mode is not available for this setting.|`X-CustomSpam: Backscatter NDR`| +|**Backscatter** <p> *MarkAsSpamNdrBackscatter*|*Backscatter* is useless non-delivery reports (also known as NDRs or bounce messages) caused by forged senders in email messages. For more information, see [Backscatter messages and EOP](anti-spam-backscatter-about.md). <p> You don't need to configure this setting in the following environments, because legitimate NDRs are delivered, and backscatter is marked as spam: <ul><li>Microsoft 365 organizations with Exchange Online mailboxes.</li><li>On-premises email organizations where you route *outbound* email through EOP.</li></ul> <br/> In standalone EOP environments that protect inbound email to on-premises mailboxes, turning this setting on or off has the following result: <ul><li> **On**: Legitimate NDRs are delivered, and backscatter is marked as spam.</li><li>**Off**: Legitimate NDRs and backscatter go through normal spam filtering. Most legitimate NDRs will be delivered to the original message sender. Some, but not all, backscatter is marked as spam. By definition, backscatter can only be delivered to the spoofed sender, not to the original sender.</li></ul> <br/> Test mode is not available for this setting.|`X-CustomSpam: Backscatter NDR`| |
| security | Defender For Office 365 Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/defender-for-office-365-whats-new.md | For more information on what's new with other Microsoft Defender security produc - [What's new in Microsoft Defender for Identity](/defender-for-identity/whats-new) - [What's new in Microsoft Defender for Cloud Apps](/cloud-app-security/release-notes) +## March 2023 ++- **Built-in protection: Safe Links time of click protection enabled for email**: Microsoft will now by default protect URLs in email messages at time of click as part of this update to Safe Links settings (_EnableSafeLinksForEmail_) within the Built-in protection preset security policy. To learn about the specific Safe Links protections in the Built-in protection policy, see [Safe Links policy settings](recommended-settings-for-eop-and-office365.md#safe-links-policy-settings). ++- **Quarantine notifications enabled in preset security policies**: If your organization has enabled or will enable the Standard or Strict preset security policies, the policies will be automatically updated to use the new DefaultFullAccessWithNotificationPolicy quarantine policy (noifications enabled) wherever the DefaultFullAccessPolicy (notifications disabled) was used. To learn more about quaratine notifications, see [Quarantine notifications](=(quarantine-quarantine-notifications.md). For more information about specific settings in preset security policies, see [Microsoft recommendations for EOP and Defender for Office 365 security settings](recommended-settings-for-eop-and-office365.md). + ## January 2023 - [Automatic Tenant Allow/Block List expiration management is now available in Microsoft Defender for Office 365](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447): Microsoft will now automatically remove entries from the allow list once the system has learned from it. Alternatively, Microsoft will extend the expiration time of the allows if the system has not learned yet. This will prevent your legitimate emails from going to junk or quarantine. |
| security | Mdo Sec Ops Guide | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-sec-ops-guide.md | Permissions for managing Defender for Office 365 in the Microsoft 365 Defender p The following permissions (roles and role groups) are available in Defender for Office 365 and can be used to grant access to security team members: -- **Azure AD roles**: Centralized roles that assign permissions for _all_ Microsoft 365 services, including Defender for Office 365. You can view the Azure AD roles and assigned users in the Microsoft 365 Defender portal, but you can't manage them directly there. Instead, you manage Azure AD roles and members at <https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RolesAndAdministrators>. The most frequent roles used by security teams are:- - **Security administrator** - - **Security operator** - - **Security reader** +- **Azure AD**: Centralized roles that assign permissions for _all_ Microsoft 365 services, including Defender for Office 365. You can view the Azure AD roles and assigned users in the Microsoft 365 Defender portal, but you can't manage them directly there. Instead, you manage Azure AD roles and members at <https://aad.portal.azure.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles/adminUnitObjectId//resourceScope/%2F>. The most frequent roles used by security teams are: + - **[Security Administrator](/azure/active-directory/roles/permissions-reference#security-administrator)** + - **[Security Reader](/azure/active-directory/roles/permissions-reference#security-reader)** -- **Email & collaboration roles**: Roles and role groups that grant permission specific to Microsoft Defender for Office 365. The following roles are not available in Azure AD, but can be important for security teams:+- **Exchange Online** and **Email & collaboration**: Roles and role groups that grant permission specific to Microsoft Defender for Office 365. The following roles are not available in Azure AD, but can be important for security teams: - - **Preview** role: Assign this role to team members who need to preview or download email messages as part of investigation activities. Allows users to [preview and download](investigate-malicious-email-that-was-delivered.md#preview-role-permissions) email messages in cloud mailboxes using the [email entity page](mdo-email-entity-page.md#email-preview-and-download-for-cloud-mailboxes). + - **Preview** role (Email & collaboration): Assign this role to team members who need to preview or download email messages as part of investigation activities. Allows users to [preview and download](investigate-malicious-email-that-was-delivered.md#preview-role-permissions) email messages in cloud mailboxes using the [email entity page](mdo-email-entity-page.md#email-preview-and-download-for-cloud-mailboxes). By default, this role is assigned only to the following role groups: The following permissions (roles and role groups) are available in Defender for To assign this role to a new or existing role group, see [Modify Email & collaboration role membership in the Microsoft 365 Defender portal](mdo-portal-permissions.md#modify-email--collaboration-role-membership-in-the-microsoft-365-defender-portal). - - **Search and Purge** role: Approve the deletion of malicious messages as recommended by AIR or take manual action on messages in hunting experiences like Threat Explorer. + - **Search and Purge** role (Email & collaboration): Approve the deletion of malicious messages as recommended by AIR or take manual action on messages in hunting experiences like Threat Explorer. By default, this role is assigned only to the following role groups: The following permissions (roles and role groups) are available in Defender for To assign this role to a new or existing role group, see [Modify Email & collaboration role membership in the Microsoft 365 Defender portal](mdo-portal-permissions.md#modify-email--collaboration-role-membership-in-the-microsoft-365-defender-portal). - - **Tenant AllowBlockList Manager**: Manage allow and block entries in the [Tenant Allow/Block List](tenant-allow-block-list-about.md). Blocking URLs, files (using file hash) or senders is a useful response action to take when investigating malicious email that was delivered. + - **Tenant AllowBlockList Manager** (Exchange Online): Manage allow and block entries in the [Tenant Allow/Block List](tenant-allow-block-list-about.md). Blocking URLs, files (using file hash) or senders is a useful response action to take when investigating malicious email that was delivered. - By default, this role is assigned only to the **Security Operator** role group. But, members of the **Security Administrators** and **Organization management** role groups can also manage entries in the Tenant Allow/Block List. + By default, this role is assigned only to the **Security Operator role group in Exchange Online**, not in Azure AD. Membership in the **[Security Operator role in Azure AD](/azure/active-directory/roles/permissions-reference#security-operator)** _does not_ allow you to manage entries the Tenant Allow/Block List. ++ Members of the **Security Administrator** or **Organization management** roles in Azure AD or the corresponding role groups in Exchange Online _are_ able to manage entries in the Tenant Allow/Block List. ### SIEM/SOAR integration |
| security | Message Headers Eop Mdo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/message-headers-eop-mdo.md | The individual fields and values are described in the following table. |Field|Description| ||| |`ARC`|The `ARC` protocol has the following fields: <ul><li>`AAR`: Records the content of the **Authentication-results** header from DMARC.</li><li>`AMS`: Includes cryptographic signatures of the message.</li><li>`AS`: Includes cryptographic signatures of the message headers. This field contains a tag of a chain validation called `"cv="`, which includes the outcome of the chain validation as **none**, **pass**, or **fail**.</li></ul>|-|`CAT:`|The category of protection policy, applied to the message: <ul><li>`BULK`: Bulk</li><li>`DIMP`: Domain Impersonation</li><li>`GIMP`: [Mailbox intelligence based impersonation](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)</li><li>`HPHSH` or `HPHISH`: High confidence phishing</li><li>`HSPM`: High confidence spam</li><li>`MALW`: Malware</li><li>`PHSH`: Phishing</li><li>`SPM`: Spam</li><li>`SPOOF`: Spoofing</li><li>`UIMP`: User Impersonation</li><li>`AMP`: Anti-malware</li><li>`SAP`: Safe attachments</li><li>`FTBP`: Anti-malware filetype policy</li><li>`OSPM`: Outbound spam</li></ul> <p> An inbound message may be flagged by multiple forms of protection and multiple detection scans. Policies have different priorities, and the policy with the highest priority is applied first. For more information, see [What policy applies when multiple protection methods and detection scans run on your email](how-policies-and-protections-are-combined.md).| +|`CAT:`|The category of protection policy, applied to the message: <ul><li>`BULK`: Bulk</li><li>`DIMP`: Domain Impersonation</li><li>`GIMP`: [Mailbox intelligence based impersonation](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)</li><li>`HPHSH` or `HPHISH`: High confidence phishing</li><li>`HSPM`: High confidence spam</li><li>`MALW`: Malware</li><li>`PHSH`: Phishing</li><li>`SPM`: Spam</li><li>`SPOOF`: Spoofing</li><li>`UIMP`: User Impersonation</li><li>`AMP`: Anti-malware</li><li>`SAP`: Safe attachments</li><li>`FTBP`: Anti-malware filetype policy</li><li>`OSPM`: Outbound spam</li></ul> <br/> An inbound message may be flagged by multiple forms of protection and multiple detection scans. Policies have different priorities, and the policy with the highest priority is applied first. For more information, see [What policy applies when multiple protection methods and detection scans run on your email](how-policies-and-protections-are-combined.md).| |`CIP:[IP address]`|The connecting IP address. You can use this IP address in the IP Allow List or the IP Block List. For more information, see [Configure connection filtering](connection-filter-policies-configure.md).| |`CTRY`|The source country as determined by the connecting IP address, which may not be the same as the originating sending IP address.| |`H:[helostring]`|The HELO or EHLO string of the connecting email server.| |
| security | Office 365 Ti | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/office-365-ti.md | Microsoft Defender for Office 365 uses role-based access control. Permissions ar |Activity|Roles and permissions| |||-|Use the Microsoft Defender Vulnerability Management dashboard <p> View information about recent or current threats|One of the following: <ul><li>**Global Administrator**</li><li>**Security Administrator**</li><li>**Security Reader**</li></ul> <p> These roles can be assigned in either Azure Active Directory (<https://portal.azure.com>) or the Microsoft 365 admin center (<https://admin.microsoft.com>).| -|Use [Explorer (and real-time detections)](threat-explorer-about.md) to analyze threats|One of the following: <ul><li>**Global Administrator**</li><li>**Security Administrator**</li><li>**Security Reader**</li></ul> <p> These roles can be assigned in either Azure Active Directory (<https://portal.azure.com>) or the Microsoft 365 admin center (<https://admin.microsoft.com>).| -|View Incidents (also referred to as Investigations) <p> Add email messages to an incident|One of the following: <ul><li>**Global Administrator**</li><li>**Security Administrator**</li><li>**Security Reader**</li></ul> <p> These roles can be assigned in either Azure Active Directory (<https://portal.azure.com>) or the Microsoft 365 admin center (<https://admin.microsoft.com>).| -|Trigger email actions in an incident <p> Find and delete suspicious email messages|One of the following: <ul><li>**Global Administrator**</li><li>**Security Administrator** plus the **Search and Purge** role</li></ul> <p> The **Global Administrator** and **Security Administrator** roles can be assigned in either Azure Active Directory (<https://portal.azure.com>) or the Microsoft 365 admin center (<https://admin.microsoft.com>). <p> The **Search and Purge** role must be assigned in the **Email & collaboration roles** in the Microsoft 36 Defender portal (<https://security.microsoft.com>).| +|Use the Microsoft Defender Vulnerability Management dashboard <p> View information about recent or current threats|One of the following: <ul><li>**Global Administrator**</li><li>**Security Administrator**</li><li>**Security Reader**</li></ul> <br/> These roles can be assigned in either Azure Active Directory (<https://portal.azure.com>) or the Microsoft 365 admin center (<https://admin.microsoft.com>).| +|Use [Explorer (and real-time detections)](threat-explorer-about.md) to analyze threats|One of the following: <ul><li>**Global Administrator**</li><li>**Security Administrator**</li><li>**Security Reader**</li></ul> <br/> These roles can be assigned in either Azure Active Directory (<https://portal.azure.com>) or the Microsoft 365 admin center (<https://admin.microsoft.com>).| +|View Incidents (also referred to as Investigations) <p> Add email messages to an incident|One of the following: <ul><li>**Global Administrator**</li><li>**Security Administrator**</li><li>**Security Reader**</li></ul> <br/> These roles can be assigned in either Azure Active Directory (<https://portal.azure.com>) or the Microsoft 365 admin center (<https://admin.microsoft.com>).| +|Trigger email actions in an incident <p> Find and delete suspicious email messages|One of the following: <ul><li>**Global Administrator**</li><li>**Security Administrator** plus the **Search and Purge** role</li></ul> <br/> The **Global Administrator** and **Security Administrator** roles can be assigned in either Azure Active Directory (<https://portal.azure.com>) or the Microsoft 365 admin center (<https://admin.microsoft.com>). <p> The **Search and Purge** role must be assigned in the **Email & collaboration roles** in the Microsoft 36 Defender portal (<https://security.microsoft.com>).| |Integrate Microsoft Defender for Office 365 Plan 2 with Microsoft Defender for Endpoint <p> Integrate Microsoft Defender for Office 365 Plan 2 with a SIEM server|Either the **Global Administrator** or the **Security Administrator** role assigned in either Azure Active Directory (<https://portal.azure.com>) or the Microsoft 365 admin center (<https://admin.microsoft.com>). <p> **plus** <p> An appropriate role assigned in additional applications (such as [Microsoft Defender Security Center](/windows/security/threat-protection/microsoft-defender-atp/user-roles) or your SIEM server).| ## Next steps |
| security | Quarantine About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-about.md | Both users and admins can work with quarantined messages: |Quarantine reason|Default retention period|Customizable?|Comments| |||::||- |Messages quarantined by anti-spam policies: spam, high confidence spam, phishing, high confidence phishing, or bulk.|15 days: <ul><li>In the default anti-spam policy.</li><li>In anti-spam policies that you create in PowerShell.</li></ul> <p> 30 days in anti-spam policies that you create in the Microsoft 365 Defender portal.|Yes|You can configure (lower) this value in anti-spam policies. For more information, see the **Retain spam in quarantine for this many days** (_QuarantineRetentionPeriod_) setting in [Configure anti-spam policies](anti-spam-policies-configure.md).| + |Messages quarantined by anti-spam policies: spam, high confidence spam, phishing, high confidence phishing, or bulk.|15 days: <ul><li>In the default anti-spam policy.</li><li>In anti-spam policies that you create in PowerShell.</li></ul> <br/> 30 days in anti-spam policies that you create in the Microsoft 365 Defender portal.|Yes|You can configure (lower) this value in anti-spam policies. For more information, see the **Retain spam in quarantine for this many days** (_QuarantineRetentionPeriod_) setting in [Configure anti-spam policies](anti-spam-policies-configure.md).| |Messages quarantined by anti-phishing policies: spoof intelligence in EOP; user impersonation, domain impersonation, or mailbox intelligence in Defender for Office 365.|30 days|Yes|This retention period is also controlled by the **Retain spam in quarantine for this many days** (_QuarantineRetentionPeriod_) setting in **anti-spam** policies. The retention period that's used is the value from the first matching **anti-spam** policy that the recipient is defined in.| |Messages quarantined by anti-malware policies (malware messages).|30 days|No|If you turn on common attachments filtering in anti-malware policies (in the default policy or in custom policies), file attachments in email messages to the affected recipients are treated as malware based solely on the file extension. A predefined list of mostly executable file types is used by default, but you can customize the list. For more information, see [Anti-malware policies](anti-malware-protection-about.md#anti-malware-policies).| |Messages quarantined by Safe Attachments policies in Defender for Office 365 (malware messages).|30 days|No|| |
| security | Quarantine Admin Manage Messages Files | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-admin-manage-messages-files.md | The following actions are available after you click  **Delete from quarantine**: The message is deleted and is not sent to the original recipients. How the message is deleted depends on your selections in the flyout that opens: - Select **Permanently delete the message from quarantine** and then click **Delete**: The message is permanently deleted and is not recoverable.- - Click **Delete** only: The message is deleted, but is recoverable within 30 days. + - Click **Delete** only: The message is deleted, but is potentially recoverable. -  **Download email**: In the flyout that appears, configure the following settings: - **Reason for downloading file**: Enter descriptive text. When you select multiple quarantined messages in the list (up to 100) by clickin -  **Delete from quarantine**: The messages are deleted and are not sent to the original recipients. How the messages are deleted depends on your selections in the flyout that opens: - Select **Permanently delete the message from quarantine** and then click **Delete**: The messages are permanently deleted and are not recoverable.- - Click **Delete** only: The messages are deleted, but they're recoverable within 30 days. + - Click **Delete** only: The messages are deleted, but they're potentially recoverable. - **... More** \>  **Submit for review**. - **... More** \>  **Download messages** |
| security | Quarantine End User | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-end-user.md | The following actions are available after you click  **Delete from quarantine**: The message is deleted and is not sent to the original recipients. How the message is deleted depends on your selections in the flyout that opens: - Select **Permanently delete the message from quarantine** and then click **Delete**: The message is permanently deleted and is not recoverable.- - Click **Delete** only: The message is deleted, but is recoverable within 30 days. + - Click **Delete** only: The message is deleted, but is potentially recoverable. -  **Download email**: In the flyout that appears, configure the following settings: - **Reason for downloading file**: Enter descriptive text. |
| security | Responding To A Compromised Email Account | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account.md | Follow the procedures in [Reset a business password for someone](../../admin/add ### Step 4 Unblock the user from sending mail -If the suspected compromised mailbox was used illicitly to send spam email, it is likely that the mailbox has been blocked from sending mail. +If the suspected compromised mailbox was used illicitly to send spam email, it's likely that the mailbox has been blocked from sending mail. To unblock a mailbox from sending mail, follow the procedures in [Removing a user from the Restricted Users portal after sending spam email](removing-user-from-restricted-users-portal-after-spam.md). ### Step 5 Optional: Block the user account from signing-in > [!IMPORTANT]-> You can block the suspected compromised account from signing-in until you believe it is safe to re-enable access. --1. In the Microsoft 365 admin center at <https://admin.microsoft.com>, go to **Users** \> **Active users**. To go directly to the **Active users** page, use <https://admin.microsoft.com/Adminportal/Home#/users>. --2. On the **Active users** page, find and select the user account, click , and then select **Edit sign-in status**. --3. On the **Block sign-in** pane that appears, select **Block this user from signing in**, and then click **Save changes**. --4. In the Exchange admin center (EAC) at <https://admin.exchange.microsoft.com>, go to **Recipients** \> **Mailboxes**. To go directly to the **Mailboxes** page, use <https://admin.exchange.microsoft.com/#/mailboxes>. --5. On the **Mailboxes** page, find and select the user. In the mailbox details flyout that opens, do the following steps: - - In the **Email apps** section, select **Manage email apps settings**. In the **Manage settings for email apps** flyout that appears, block all of the available settings by moving the toggle to the right : - - **Outlook on the web** - - **Outlook desktop (MAPI)** - - **Exchange Web Services** - - **Mobile (Exchange ActiveSync)** - - **IMAP** - - **POP3** -- When you're finished, click **Save** and then click **Close**. +> You can block the suspected compromised account from signing-in until you believe it's safe to re-enable access. ++1. Do the following steps in the Microsoft 365 admin center at <https://admin.microsoft.com>: + 1. Go to **Users** \> **Active users**. Or, to go directly to the **Active users** page, use <https://admin.microsoft.com/Adminportal/Home#/users>. + 2. On the **Active users** page, find and then select the user account by doing either of the following steps: + - Select the user from the list by clicking anywhere in the row other than the check box. In the user details flyout that opens, click  **Block sign-in** at the top of the flyout. + - Select the user from the list by clicking the check box in the row. Click  **More actions**, and then select  **Edit sign-in status**. + 3. On the **Block sign-in** flyout that opens, select **Block this user from signing in**, click **Save changes** and then click  **Close**. ++2. Do the following steps in the Exchange admin center (EAC) at <https://admin.exchange.microsoft.com>: + 1. Go to **Recipients** \> **Mailboxes**. Or, to go directly to the **Mailboxes** page, use <https://admin.exchange.microsoft.com/#/mailboxes>. + 2. On the **Mailboxes** page, find and select the user from the list by clicking anywhere in the row other than the check box. + 3. In the mailbox details flyout that opens, do the following steps: + 1. Verify the **General** tab is selected, and then click **Manage email apps settings** in the **Email apps & mobile devices** section. + 2. In the **Manage settings for email apps** flyout that opens, disable all of the available settings by changing the toggles to  **Disabled**: + - **Outlook on the web** + - **Outlook desktop (MAPI)** + - **Exchange Web Services** + - **Mobile (Exchange ActiveSync)** + - **IMAP** + - **POP3** ++ When you're finished, click **Save** and then click  **Close**. ### Step 6 Optional: Remove the suspected compromised account from all administrative role groups |
| security | Submissions Users Report Message Add In Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-users-report-message-add-in-configure.md | Admins in Microsoft 365 Government Community Cloud (GCC) or GCC High need to use > [!NOTE] > It could take up to 24 hours for the add-in to appear in your organization.+> +> In U.S. Government organizations (Microsoft 365 GCC, GCC High, and DoD), reported messages are not sent to Microsoft for analysis. They are sent only to the reporting mailbox that you identify. For more information, see [User reported settings](submissions-user-reported-messages-custom-mailbox.md). 1. In the Microsoft 365 admin center at <https://portal.office365.us/adminportal> open the Exchange admin center (EAC) by selecting **Exchange** in the **Admin centers** section. |
| security | Tenant Wide Setup For Increased Security | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-wide-setup-for-increased-security.md | Here are a couple of additional settings that are recommended. |Area|Recommendation| |||-|**Mail flow rules** (also known as transport rules)|Add a mail flow rule to help protect against ransomware by blocking executable file types and Office file types that contain macros. For more information, see [Use mail flow rules to inspect message attachments in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/inspect-message-attachments). <p> See these additional topics: <ul><li>[Protect against ransomware](../../business-premium/secure-your-business-data.md)</li><li>[Malware and Ransomware Protection in Microsoft 365](/compliance/assurance/assurance-malware-and-ransomware-protection)</li><li>[Recover from a ransomware attack in Office 365](recover-from-ransomware.md)</li></ul> <p> Create a mail flow rule to prevent auto-forwarding of email to external domains. For more information, see [Mitigating Client External Forwarding Rules with Secure Score](/archive/blogs/office365security/mitigating-client-external-forwarding-rules-with-secure-score). <p> More information: [Mail flow rules (transport rules) in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules)| -|**Modern authentication**|Modern authentication is a prerequisite for using multi-factor authentication (MFA). MFA is recommended for securing access to cloud resources, including email. <p> See these topics: <ul><li>[Enable or disable modern authentication in Exchange Online](/Exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online)</li><li>[Skype for Business Online: Enable your tenant for modern authentication](https://social.technet.microsoft.com/wiki/contents/articles/34339.skype-for-business-online-enable-your-tenant-for-modern-authentication.aspx)</li></ul> <p> Modern authentication is enabled by default for Office 2016 clients, SharePoint Online, and OneDrive for Business. <p> More information: [How modern authentication works for Office 2013 and Office 2016 client apps](../../enterprise/modern-auth-for-office-2013-and-2016.md)| +|**Mail flow rules** (also known as transport rules)|Add a mail flow rule to help protect against ransomware by blocking executable file types and Office file types that contain macros. For more information, see [Use mail flow rules to inspect message attachments in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/inspect-message-attachments). <p> See these additional topics: <ul><li>[Protect against ransomware](../../business-premium/secure-your-business-data.md)</li><li>[Malware and Ransomware Protection in Microsoft 365](/compliance/assurance/assurance-malware-and-ransomware-protection)</li><li>[Recover from a ransomware attack in Office 365](recover-from-ransomware.md)</li></ul> <br/> Create a mail flow rule to prevent auto-forwarding of email to external domains. For more information, see [Mitigating Client External Forwarding Rules with Secure Score](/archive/blogs/office365security/mitigating-client-external-forwarding-rules-with-secure-score). <p> More information: [Mail flow rules (transport rules) in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules)| +|**Modern authentication**|Modern authentication is a prerequisite for using multi-factor authentication (MFA). MFA is recommended for securing access to cloud resources, including email. <p> See these topics: <ul><li>[Enable or disable modern authentication in Exchange Online](/Exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online)</li><li>[Skype for Business Online: Enable your tenant for modern authentication](https://social.technet.microsoft.com/wiki/contents/articles/34339.skype-for-business-online-enable-your-tenant-for-modern-authentication.aspx)</li></ul> <br/> Modern authentication is enabled by default for Office 2016 clients, SharePoint Online, and OneDrive for Business. <p> More information: [How modern authentication works for Office 2013 and Office 2016 client apps](../../enterprise/modern-auth-for-office-2013-and-2016.md)| ## Configure tenant-wide sharing policies in SharePoint admin center To support the goals for baseline protection, configure tenant-wide sharing poli |Area|Includes a default policy|Recommendation| ||||-|**Sharing** (SharePoint Online and OneDrive for Business)|Yes|External sharing is enabled by default. These settings are recommended: <ul><li>Allow sharing to authenticated external users and using anonymous access links (default setting).</li><li>Anonymous access links expire in this many days. Enter a number, if desired, such as 30 days.</li><li>Default link type ΓÇö select Internal (people in the organization only). Users who wish to share using anonymous links must choose this option from the sharing menu.</li></ul> <p> More information: [External sharing overview](/sharepoint/external-sharing-overview)| +|**Sharing** (SharePoint Online and OneDrive for Business)|Yes|External sharing is enabled by default. These settings are recommended: <ul><li>Allow sharing to authenticated external users and using anonymous access links (default setting).</li><li>Anonymous access links expire in this many days. Enter a number, if desired, such as 30 days.</li><li>Default link type ΓÇö select Internal (people in the organization only). Users who wish to share using anonymous links must choose this option from the sharing menu.</li></ul> <br/> More information: [External sharing overview](/sharepoint/external-sharing-overview)| SharePoint admin center and OneDrive for Business admin center include the same settings. The settings in either admin center apply to both. |
| security | Zero Hour Auto Purge | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/zero-hour-auto-purge.md | ZAP doesn't work in standalone Exchange Online Protection (EOP) environments tha ## How ZAP works -Spam and malware signatures are updated in the service real-time on a daily basis. However, users can still receive malicious messages for a variety of reasons, including if content is weaponized after being delivered to users. ZAP addresses this issue by continually monitoring updates to the spam and malware signatures in the service. ZAP can find and remove messages that are already in a user's mailbox. +Spam and malware signatures are updated in the service real-time on a daily basis. However, users can still receive malicious messages for a variety of reasons, including if content is weaponized after being delivered to users. ZAP addresses this issue by continually monitoring updates to the spam and malware signatures in the service. ZAP can find and take automated actions on messages that are already in a user's mailbox up to 48 hours after delivery. The ZAP action is seamless for the user; they aren't notified if a message is detected and moved. |
| solutions | Allow Direct Connect With All Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/allow-direct-connect-with-all-organizations.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-securecollab |
| solutions | Allow Members To Send As Or Send On Behalf Of Group | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/allow-members-to-send-as-or-send-on-behalf-of-group.md | +- Tier1 search.appverid: - MET150 |
| solutions | B2b Extranet | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/b2b-extranet.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-3tiersprotection |
| solutions | Best Practices Anonymous Sharing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/best-practices-anonymous-sharing.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-3tiersprotection |
| solutions | Collaborate As Team | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-as-team.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-3tiersprotection |
| solutions | Collaborate In Site | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-in-site.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-3tiersprotection |
| solutions | Collaborate On Documents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-on-documents.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-3tiersprotection |
| solutions | Collaborate Teams Direct Connect | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-teams-direct-connect.md | audience: ITPro -- highpri +- highpri +- Tier1 - SPO_Content - M365-collaboration - m365solution-3tiersprotection |
| solutions | Collaborate With People Outside Your Organization | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-with-people-outside-your-organization.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-securecollab |
| solutions | Configure Teams Baseline Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/configure-teams-baseline-protection.md | search.appverid: - MET150 - highpri+- Tier1 - Ent_O365 - Strat_O365_Enterprise - m365solution-3tiersprotection |
| solutions | Create Secure Guest Sharing Environment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/create-secure-guest-sharing-environment.md | +- Tier1 - SPO_Content - M365-security-compliance - m365solution-3tiersprotection |
| solutions | Limit Guest Sharing To Specific Organization | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/limit-guest-sharing-to-specific-organization.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-securecollab |
| solutions | Limit Invitations From Specific Organization | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/limit-invitations-from-specific-organization.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-securecollab |
| solutions | Limit Organizations Where Users Have Guest Accounts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/limit-organizations-where-users-have-guest-accounts.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-securecollab |
| solutions | Limit Who Can Invite Guests | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/limit-who-can-invite-guests.md | audience: ITPro -- highpri +- highpri +- Tier1 - SPO_Content - M365-collaboration - m365solution-securecollab |
| solutions | Microsoft 365 Guest Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/microsoft-365-guest-settings.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-3tiersprotection |
| solutions | Microsoft 365 Limit Sharing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/microsoft-365-limit-sharing.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-3tiersprotection |
| solutions | Plan External Collaboration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/plan-external-collaboration.md | +- Tier1 - M365-collaboration - m365solution-securecollab - m365solution-scenario |
| solutions | Share Limit Accidental Exposure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/share-limit-accidental-exposure.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-3tiersprotection |
| solutions | Trust Conditional Access From Other Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/trust-conditional-access-from-other-organizations.md | +- Tier1 - SPO_Content - M365-collaboration - m365solution-securecollab |
| syntex | Set Up Content Understanding | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/set-up-content-understanding.md | +- Tier1 - admindeeplinkMAC search.appverid: MET150 |
| syntex | Set Up Microsoft Syntex | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/set-up-microsoft-syntex.md | +- Tier1 - admindeeplinkMAC search.appverid: MET150 |
| syntex | Syntex Azure Billing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-azure-billing.md | + - Tier1 search.appverid: MET150 ms.localizationpriority: medium description: Learn about how to set up pay-as-you-go Azure billing for Microsoft Syntex and how to monitor your usage. |
| syntex | Syntex Copilot | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-copilot.md | + + Title: Overview of Copilot in Microsoft Syntex ++++audience: admin + Last updated : 04/05/2023+++search.appverid: ++ - enabler-strategic + - m365initiative-syntex +ms.localizationpriority: medium ++description: Learn how to use Copilot to streamline processes in Microsoft Syntex. +++# Overview of Copilot in Microsoft Syntex ++This article is in development. |
| syntex | Syntex Licensing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-licensing.md | + - Tier1 search.appverid: MET150 ms.localizationpriority: medium description: Learn about licensing for Microsoft Syntex. |
| syntex | Syntex Pay As You Go Services | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-pay-as-you-go-services.md | + - Tier1 search.appverid: MET150 ms.localizationpriority: medium description: Learn about pay-as-you-go services and pricing for Microsoft Syntex. |