| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| compliance | Communication Compliance Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-policies.md | f1.keywords: Previously updated : 02/24/2023 Last updated : 03/20/2023 audience: Admin f1_keywords: The following table outlines the time to detection for supported content types: |:|:--| | Email body content | 1 hour | | Teams body content | 1 hour |-| Yammer body content | 13 hours | -| Email OCR | 13 hours | -| Teams OCR | 13 hours | -| Email attachment | 13 hours | -| Team attachment | 13 hours | -| Teams modern attachment | 13 hours | +| Yammer body content | 24 hours | +| Email OCR | 24 hours | +| Teams OCR | 24 hours | +| Email attachment | 24 hours | +| Team attachment | 24 hours | +| Teams modern attachment | 24 hours | | Teams metadata | 1 hour | | Email metadata | 1 hour |-| Teams shared channels | 13 hours | +| Teams shared channels | 24 hours | For existing policies created before July 31, 2022 it may take up to 24 hours to detect messages and review alerts that match these policies. To reduce the latency for these policies, [copy the existing policy](/microsoft-365/compliance/communication-compliance-policies#copy-a-policy) and create a new policy from the copy. If you don't need to retain any data from the older policy, it can be paused or deleted. |
| compliance | Importing Pst Files To Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/importing-pst-files-to-office-365.md | f1.keywords: Previously updated : 01/01/2023 Last updated : 03/21/2023 audience: Admin f1_keywords:+- **Network upload**: Upload the PST files over the network to a temporary Azure Storage location in the Microsoft cloud. Then you use the Microsoft 365 Import service to import the PST data to mailboxes in your organization. -- **Drive shipping**  - Copy the PST files to a BitLocker-encrypted hard drive and then physically ship the drive to Microsoft. When Microsoft receives the hard drive, data center personnel upload the data to a temporary Azure Storage location in the Microsoft cloud. Then you use the Microsoft 365 Import service to import the data to mailboxes in your organization.+- **Drive shipping**: Copy the PST files to a BitLocker-encrypted hard drive and then physically ship the drive to Microsoft. When Microsoft receives the hard drive, data center personnel upload the data to a temporary Azure Storage location in the Microsoft cloud. Then you use the Microsoft 365 Import service to import the data to mailboxes in your organization. [!INCLUDE [purview-preview](../includes/purview-preview.md)] ## Step-by-step instructions -See one of the following topics for detailed, step-by-step instructions for bulk-importing your organization's PST files to Microsoft 365. +See one of the following articles for detailed, step-by-step instructions for bulk-importing your organization's PST files to Microsoft 365. - [Use network upload to import PST files to Microsoft 365](use-network-upload-to-import-pst-files.md)- - [Use drive shipping to import PST files](use-drive-shipping-to-import-pst-files-to-office-365.md) ## How importing PST files works Here's an illustration and description of the complete PST import process. The i  -1. **Download the PST import tools and key to private Azure Storage location** - The first step is to download the tool and access key used to upload the PST files or copy them to a hard drive. You obtain these from the **Import** page in the compliance portal. The key provides you (or Microsoft data center personnel in the case of drive shipping) with the necessary permissions to upload PST files to a private and secure Azure Storage location. This access key is unique to your organization and helps prevent unauthorized access to your PST files after they're uploaded to the Microsoft cloud. Importing PST files to Microsoft 365 doesn't require your organization to have a separate Azure subscription. +1. **Download the PST import tools and key to private Azure Storage location**: The first step is to download the tool and access key used to upload the PST files or copy them to a hard drive. You obtain these from the **Import** page in the compliance portal. The key provides you (or Microsoft data center personnel in the case of drive shipping) with the necessary permissions to upload PST files to a private and secure Azure Storage location. This access key is unique to your organization and helps prevent unauthorized access to your PST files after they're uploaded to the Microsoft cloud. Importing PST files to Microsoft 365 doesn't require your organization to have a separate Azure subscription. -2. **Upload or copy the PST files** - The next step depends on whether you're using network upload or drive shipping to import PST files. In both cases, you'll use the tool and secure storage key that you obtained in the previous step. +2. **Upload or copy the PST files**: The next step depends on whether you're using network upload or drive shipping to import PST files. In both cases, you'll use the tool and secure storage key that you obtained in the previous step. - - **Network upload:** The AzCopy.exe tool (downloaded in step 1) is used to upload and store your PST files in an Azure Storage location in the Microsoft cloud. The Azure Storage location that you upload your PST files to is located in the same regional Microsoft datacenter as your organization. + - **Network upload**: The AzCopy.exe tool (downloaded in step 1) is used to upload and store your PST files in an Azure Storage location in the Microsoft cloud. The Azure Storage location that you upload your PST files to is located in the same regional Microsoft datacenter as your organization. To upload them, the PST files that you want to import have to be located in a file share or file server in your organization. - - **Drive shipping:** The WAImportExport.exe tool (downloaded in step 1) is used to copy your PST files to the hard drive. This tool encrypts the hard drive with BitLocker and then copies the PSTs to the hard drive. Like network upload, the PST files that you want to copy to the hard drive have to be located in a file share or file server in your organization. + - **Drive shipping**: The WAImportExport.exe tool (downloaded in step 1) is used to copy your PST files to the hard drive. This tool encrypts the hard drive with BitLocker and then copies the PSTs to the hard drive. Like network upload, the PST files that you want to copy to the hard drive have to be located in a file share or file server in your organization. -3. **Create a PST import mapping file** - After the PST files have been uploaded to the Azure Storage location or copied to a hard drive, the next step is to create a comma-separated value (CSV) file that specifies which user mailboxes the PST files will be imported to (and a PST file can be imported to a user's primary mailbox or their archive mailbox). [Download a copy of the PST Import mapping file](https://go.microsoft.com/fwlink/p/?LinkId=544717). The Microsoft 365 Import service will use the information to import the PST files. +3. **Create a PST import mapping file**: After the PST files have been uploaded to the Azure Storage location or copied to a hard drive, the next step is to create a comma-separated value (CSV) file that specifies which user mailboxes the PST files will be imported to (and a PST file can be imported to a user's primary mailbox or their archive mailbox). [Download a copy of the PST Import mapping file](https://go.microsoft.com/fwlink/p/?LinkId=544717). The Microsoft 365 Import service will use the information to import the PST files. -4. **Create a PST import job** - The next step is to create a PST import job on the **Import PST files** page in the compliance portal and submit the PST import mapping file created in the previous step. For network upload (because the PST files have been uploaded to Azure) Microsoft 365 analyzes the data in the PST files and then gives you an opportunity to set filters that control what data actually gets imported to the mailboxes specified in the PST import mapping file. +4. **Create a PST import job**: The next step is to create a PST import job on the **Import PST files** page in the compliance portal and submit the PST import mapping file created in the previous step. For network upload (because the PST files have been uploaded to Azure) Microsoft 365 analyzes the data in the PST files and then gives you an opportunity to set filters that control what data actually gets imported to the mailboxes specified in the PST import mapping file. For drive shipping, a few other things happen at this point in the process. Here's an illustration and description of the complete PST import process. The i - Microsoft ships the hard drive back to you. -5. **Filter the PST data that will be imported to mailboxes** - After the import job is created (and after the PST files from a drive shipping job are uploaded to the Azure Storage location) Microsoft 365 analyzes the data in the PST files (safely and securely) by identifying the age of the items and the different message types included in the PST files. When the analysis is completed and the data is ready to import, you have the option to import all the data contained in the PST files or you can trim the data that's imported by setting filters that control what data gets imported. +5. **Filter the PST data that will be imported to mailboxes**: After the import job is created (and after the PST files from a drive shipping job are uploaded to the Azure Storage location) Microsoft 365 analyzes the data in the PST files (safely and securely) by identifying the age of the items and the different message types included in the PST files. When the analysis is completed and the data is ready to import, you have the option to import all the data contained in the PST files or you can trim the data that's imported by setting filters that control what data gets imported. -6. **Start the PST import job** - After the import job is started, Microsoft 365 uses the information in the PST import mapping file to import the PST files from the Azure Storage location to user mailboxes. Status information about the import job (including information about each PST file being imported) is displayed on the **Import PST files** page in the compliance portal. When the import job is finished, the status for the job is set to **Complete**. +6. **Start the PST import job**: After the import job is started, Microsoft 365 uses the information in the PST import mapping file to import the PST files from the Azure Storage location to user mailboxes. Status information about the import job (including information about each PST file being imported) is displayed on the **Import PST files** page in the compliance portal. When the import job is finished, the status for the job is set to **Complete**. ## Why import email data to Microsoft 365? - It's a good way to import your organization's archival messaging data to Microsoft 365.- - You can use the [Intelligent Import](filter-data-when-importing-pst-files.md) feature to filter the items in PST files that actually get imported to the target mailboxes. This lets you trim the data that's imported by setting filters that control what data gets imported. - Importing email data to Microsoft 365 helps address compliance needs of your organization by letting you:- - Enable [archive mailboxes](enable-archive-mailboxes.md) and [auto-expanding archiving](autoexpanding-archiving.md) to give users additional mailbox storage space.- - Place mailboxes on [Litigation Hold](./ediscovery-create-a-litigation-hold.md) to retain content.- - Use the [Content Search tool](ediscovery-content-search.md) to search for mailbox content.- - Use [eDiscovery cases](./ediscovery-standard-get-started.md) to manage your organization's legal investigations- - Use [retention policies](retention.md) in the compliance portal to control how long mailbox content is retained, and then delete content after the retention period expires.- - Use [Communication compliance policies](communication-compliance.md) to examine messages to make sure they are compliant with message standards and add a classification type. - Importing data to Microsoft 365 helps protect against data loss. Email data that's imported to Microsoft 365 inherits the high availability features of Exchange Online.- - Email data is available to users from all devices because it's stored in the cloud. ## Importing SharePoint data to Microsoft 365 Here's an illustration and description of the complete PST import process. The i You can also import files and documents to SharePoint sites and OneDrive accounts in your organization. For more information, see the following articles: - [Migrate to SharePoint Online](/sharepointmigration/migrate-to-sharepoint-online)- - [Introducing the SharePoint Migration Tool](/sharepointmigration/introducing-the-sharepoint-migration-tool)- - [Migrate to SharePoint Online using PowerShell](/sharepointmigration/overview-spmt-ps-cmdlets)- - [Migrate your file share content to SharePoint Online using the Azure Data Box](/sharepointmigration/how-to-migrate-file-share-content-to-spo-using-azuredatabox) ## Frequently asked questions about importing PST files You can also import files and documents to SharePoint sites and OneDrive account Here are some frequently asked questions about using the Microsoft 365 Import service to bulk-import PST files to Microsoft 365 mailboxes. - [Using network upload to import PST files](#using-network-upload-to-import-pst-files)- - [Using drive shipping to import PST files](#using-drive-shipping-to-import-pst-files) ### Using network upload to import PST files Here are some frequently asked questions about using the Microsoft 365 Import se You have to be assigned the Mailbox Import Export role in Exchange Online to import PST files to Microsoft 365 mailboxes. By default, this role isn't assigned to any role group in Exchange Online. You can add the Mailbox Import Export role to the Organization Management role group. Or you can create a new role group, assign the Mailbox Import Export role, and then add yourself or other users as a member. For more information, see the "Add a role to a role group" or the "Create a role group" sections in [Manage role groups in Exchange Online](/Exchange/permissions-exo/role-groups). -Additionally, to create import jobs in the compliance portal, one of the following must be true: +Additionally, to create import jobs in the compliance portal, one of the following permission assignments must be true: - You have to be assigned the Mail Recipients role in Exchange Online. By default, this role is assigned to the Organization Management and Recipient Management roles groups. Additionally, to create import jobs in the compliance portal, one of the followi #### Where is network upload available? -Network upload is currently available in these regions: United States, Canada, Brazil, the United Kingdom, France, Germany, Switzerland, Norway, Europe, India, East Asia, Southeast Asia, Japan, Republic of Korea, Australia, and United Arab Emirates (UAE). Network upload will be available in more regions in the future. +Network upload is currently available in these regions: United States, Canada, Brazil, the United Kingdom, France, Germany, Switzerland, Norway, Europe (excluding Sweden), India, East Asia, Southeast Asia, Japan, Republic of Korea, Australia, and United Arab Emirates (UAE). Network upload will be available in more regions in the future. #### What is the pricing for importing PST files by using network upload? This also means that after PST files are deleted from the Azure Storage area, th It depends on the capacity of your network, but it typically takes several hours for each terabyte (TB) of data to be uploaded to the Azure Storage area for your organization. After the PST files are copied to the Azure Storage area, a PST file is imported to a Microsoft 365 mailbox at a rate of approximately 24 GB per day<sup>\*</sup>. If this rate doesn't meet your needs, you might consider other methods to get email data into Microsoft 365. For more information, see [Ways to migrate multiple email accounts to Microsoft 365](/Exchange/mailbox-migration/mailbox-migration). -If different PST files are imported to different target mailboxes, the import process occurs in parallel; in other words, each PST/mailbox pair is imported simultaneously. If multiple PST files are imported to the same mailbox, they will be imported sequentially (one at a time), not simultaneously. +If different PST files are imported to different target mailboxes, the import process occurs in parallel; in other words, each PST/mailbox pair is imported simultaneously. If multiple PST files are imported to the same mailbox, they'll be imported sequentially (one at a time), not simultaneously. > [!NOTE] > <sup>\*</sup> This rate is not guaranteed. Server workload and transient performance issues might decrease this rate. After your hard drive is received at the Microsoft data center, it will take bet After the PST files are uploaded to the Azure Storage area, Microsoft 365 analyzes the data in the PST files (in a safe and secure manner) to identify the age of the items and the different message types included in the PST files. When this analysis is complete, you'll have the option to import all the data in the PST files or set filters to that control what data gets imported. After you start the import job, a PST file is imported to a Microsoft 365 mailbox at a rate of approximately 24 GB per day.<sup>\*</sup> If this rate doesn't meet your needs, you might consider other methods to get email data into Microsoft 365. For more information, see [Ways to migrate multiple email accounts to Microsoft 365](/Exchange/mailbox-migration/mailbox-migration). -If different PST files are imported to different target mailboxes, the import process occurs in parallel; in other words, each PST/mailbox pair is imported simultaneously. If multiple PST files are imported to the same mailbox, they will be imported sequentially (one at a time), not simultaneously. +If different PST files are imported to different target mailboxes, the import process occurs in parallel; in other words, each PST/mailbox pair is imported simultaneously. If multiple PST files are imported to the same mailbox, they'll be imported sequentially (one at a time), not simultaneously. > [!NOTE] > <sup>\*</sup> This rate is not guaranteed. Server workload and transient performance issues might decrease this rate. This also means that after PST files are deleted from the Azure Storage area, th #### What version of the PST file format is supported for importing to Microsoft 365? -There are two versions of the PST file format: ANSI and Unicode. We recommend importing files that use the Unicode PST file format. However, files that use the ANSI PST file format, such as those for languages that use a double-byte character set (DBCS), can also be imported to Microsoft 365. For more information about importing ANSI PST files, see Step 3 in [Use drive shipping to import your organization PST files to Microsoft 365](use-drive-shipping-to-import-pst-files-to-office-365.md#step-3-create-the-pst-import-mapping-file). +There are two versions of the PST file format: ANSI and Unicode. We recommend importing files that use the Unicode PST file format. However, files that use the ANSI PST file format, such as those formats for languages that use a double-byte character set (DBCS), can also be imported to Microsoft 365. For more information about importing ANSI PST files, see Step 3 in [Use drive shipping to import your organization PST files to Microsoft 365](use-drive-shipping-to-import-pst-files-to-office-365.md#step-3-create-the-pst-import-mapping-file). Additionally, PST files from Outlook 2007 and later versions can be imported to Microsoft 365. No, you can't import PST files to public folders. #### Can Microsoft wipe my hard drive before they ship it back to me? -No, Microsoft can't wipe hard drives before shipping them back to customers. Hard drives are returned to you in the same state they were in when they were received by Microsoft. +No, Microsoft can't wipe hard drives before shipping them back to customers. Hard drives are returned to you in the same state they were in when received by Microsoft. #### Can Microsoft shred my hard drive instead of shipping it back to me? -No, Microsoft can't destroy your hard drive. Hard drives are returned to you in the same state they were in when they were received by Microsoft. +No, Microsoft can't destroy your hard drive. Hard drives are returned to you in the same state they were in when received by Microsoft. #### What courier services are supported for return shipping? Yes. #### If I have to ship my hard drive to another country, is there anything I need to do? -The hard drive that you ship to Microsoft might have to cross international borders. If so, you're responsible for ensuring that the hard drive and the data it contains are imported and/or exported in accordance with the applicable laws. Before shipping a hard drive, check with your advisors to verify that your drive and data can legally be shipped to the specified Microsoft data center. This will help to ensure that it reaches Microsoft in a timely manner. +The hard drive that you ship to Microsoft might have to cross international borders. If so, you're responsible for ensuring that the hard drive and the data it contains are imported and/or exported in accordance with the applicable laws. Before shipping a hard drive, check with your advisors to verify that your drive and data can legally be shipped to the specified Microsoft data center. This verification will help to ensure that it reaches Microsoft in a timely manner. |
| compliance | Insider Risk Management Plan | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-plan.md | Different geographic and organizational areas may have compliance and privacy re If you have requirements for specific stakeholders to be involved in case investigations that involve users in certain regions, roles, or divisions, you may want to implement separate (even if identical) [insider risk management policies](insider-risk-management-policies.md) targeting the different regions and populations. This configuration makes it easier for the right stakeholders to triage and manage cases that are relevant to their roles and regions. You may want to consider creating processes and policies for regions where investigators and reviewers speak the same language as the users, which can help streamline the escalation process for insider risk management alerts and cases. -## Plan for the review and investigation workflow --Depending on how you want to manage insider risk management policies and alerts, you'll need to assign users to specific role groups to manage different sets of insider risk management features. You have the option to assign users with different compliance responsibilities to specific role groups to manage different areas of insider risk management features. Or you may decide to assign all user accounts for designated administrators, analysts, investigators, and viewers to the *Insider Risk Management* role group. Use a single role group or multiple role groups to best fit your compliance management requirements. --Choose from the following role group options and solution actions when working with insider risk management: --|**Actions**|**Insider Risk Management**|**Insider Risk Management Admins**|**Insider Risk Management Analysts**|**Insider Risk Management Investigators**|**Insider Risk Management Auditors**|**Insider Risk Management Approvers**| -|||||||| -|Configure policies and settings|Yes|Yes|No|No|No|No| -|Access analytics insights|Yes|Yes|Yes|No|No|No| -|Access and investigate alerts|Yes|No|Yes|Yes|No|No| -|Access and investigate cases|Yes|No|Yes|Yes|No|No| -|Access and view the Content Explorer|Yes|No|No|Yes|No|No| -|Configure notice templates|Yes|No|Yes|Yes|No|No| -|View and export audit logs|Yes|No|No|No|Yes|No| -|Access and view forensic evidence captures|Yes|No|No|Yes|No|No| -|Create forensic evidence capturing request|Yes|Yes|No|No|No|No| -|Approve forensic evidence capturing requests|Yes|No|No|No|No|Yes| -|View device health report|Yes|Yes|No|No|No|No| -|Configure Adaptive Protection|Yes|Yes|No|No|No|No| -|View Adaptive Protection users tab|Yes|No|Yes|Yes|No|No| +## Plan for permissions to support the review and investigation workflow -> [!IMPORTANT] -> Make sure you always have at least one user in the *Insider Risk Management* or *Insider Risk Management Admins* role groups (depending on the option you choose) so that your insider risk management configuration doesn't get in to a 'zero administrator' scenario if specific users leave your organization. --Members of the following roles can assign users to insider risk management role groups and have the same solution permissions included with the *Insider Risk Management Admins* role group: --- Azure Active Directory *Global Administrator*-- Azure Active Directory *Compliance Administrator*-- Microsoft Purview compliance portal *Organization Management*-- Microsoft Purview compliance portal *Compliance Administrator*+Depending on how you want to manage insider risk management policies and alerts, you'll need to assign users to specific role groups to manage different sets of insider risk management features. You have the option to assign users with different compliance responsibilities to specific role groups to manage different areas of insider risk management features. Or you may decide to assign all user accounts for designated administrators, analysts, investigators, and viewers to the *Insider Risk Management* role group. For more information, see [Get started with insider risk management](insider-risk-management-configure.md#step-1-required-enable-permissions-for-insider-risk-management). ## Understand requirements and dependencies |
| compliance | Sensitivity Labels Versions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-versions.md | Title: "Minimum versions for sensitivity labels in Microsoft 365 Apps" f1.keywords: - NOCSH---+++ Last updated 03/14/2023 audience: Admin The numbers listed are the minimum Office application versions required for each |Capability |Windows |Mac |iOS |Android |Web | |--|-:|-|-|--|-|-|[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)|Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Not relevant |Not relevant |Not relevant|Not relevant | +|[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)|Current Channel: Rolling Out to 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Not relevant |Not relevant |Not relevant|Not relevant | |[Manually apply, change, or remove label](https://support.microsoft.com/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)|Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ | 2.21+ | 16.0.11231+ |[Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Multi-language support](create-sensitivity-labels.md#additional-label-settings-with-security--compliance-powershell)|Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+|2.21+ |16.0.11231+ |Under review | |[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) to new documents |Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |2.21+ |16.0.11231+ |[Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md)| The numbers listed are the minimum Office application versions required for each |Capability |Outlook for Windows |Outlook for Mac |Outlook on iOS |Outlook on Android |Outlook on the web | |--|-:|-||-|-|-|[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)|Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Not relevant |Not relevant |Not relevant|Not relevant | +|[AIP add-in disabled by default](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in)|Current Channel: Rolling Out to 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Not relevant |Not relevant |Not relevant|Not relevant | |Manually apply, change, or remove label <br /> - [Files and emails](https://support.microsoft.com/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)|Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ | 4.7.1+ | 4.0.39+ | Yes | |Manually apply, change, or remove label <br /> - [Calendar items](sensitivity-labels-meetings.md)| Current Channel: Rolling out to 2302+ |Rolling out: 16.70+ <sup>\*</sup> |Under review |Under review |Yes | |[Multi-language support](create-sensitivity-labels.md#additional-label-settings-with-security--compliance-powershell)|Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ |16.21+ |4.7.1+ |4.0.39+ |Yes | |
| compliance | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md | f1.keywords: Previously updated : 03/15/2023 Last updated : 03/21/2023 audience: Admin Whether it be adding new solutions to the [Microsoft Purview compliance portal]( ## March 2023 +### Communication compliance ++- **New topic**: Added topic that includes a list of [best practices to help reduce alert "noise"](communication-compliance-alerts-best-practices.md). +- **New topic**: Added topic that summarizes the [privacy principles for communication compliance](insider-risk-solution-privacy.md). +- Clarification on the [Filter email blasts feature and why the report might include unexpected senders](communication-compliance-configure.md#step-5-required-create-a-communication-compliance-policy). +- Clarification that [Translation view includes associated conversation view messages](communication-compliance-investigate-remediate.md#step-2-examine-the-message-details). + ### Insider risk management - **Forensic Evidence GA**: With the GA release of Forensic Evidence, you can now:- - [Specify websites or desktop apps to include or exclude when you create a policy](insider-risk-management-forensic-evidence-configure.md#step-4-create-a-policy) - - [View and explore a list of captured clips and filter the list to find just the information you need](insider-risk-management-forensic-evidence-manage.md#viewing-captured-clips) - - [Purchase/analyze capacity for captured clips and/or sign up for 20 GB of trial capacity](insider-risk-management-forensic-evidence-manage.md#capacity-and-billing) + - [Specify websites or desktop apps to include or exclude when you create a policy](insider-risk-management-forensic-evidence-configure.md#step-4-create-a-policy). + - [View and explore a list of captured clips and filter the list to find just the information you need](insider-risk-management-forensic-evidence-manage.md#viewing-captured-clips). + - [Purchase/analyze capacity for captured clips and/or sign up for 20 GB of trial capacity](insider-risk-management-forensic-evidence-manage.md#capacity-and-billing). +- **New topic**: Added topic that [summarizes the privacy principles for insider risk management](insider-risk-solution-privacy.md). +- Clarification about [adding "webhook.ingestion.office.com" to the allowlist when setting up a connector to import HR data](import-hr-data.md#before-you-begin). +- Clarification about the [past activity detection period for email activities (contrasted to audit activities)](insider-risk-management-settings.md#policy-timeframes). +- Clarification on the [retention time for user activities reports](insider-risk-management-activities.md#retention-and-item-limits). ### Sensitivity labels -- **AIP add-in disabled by default**: The AIP add-in for Office apps is now disabled by default beginning with version 2302. Starting with this version, you must [configure an Office setting](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in) if you need to continue to use the Azure Information Protection (AIP) add-in rather than the labels that are built into Office apps.+- **AIP add-in disabled by default**: Now rolling out, the AIP add-in for Office apps is disabled by default with version 2302. Starting with this version, you must [configure an Office setting](sensitivity-labels-aip.md#how-to-configure-newer-versions-of-office-to-enable-the-aip-add-in) if you need to continue to use the Azure Information Protection (AIP) add-in rather than the labels that are built into Office apps. - **General availability (GA)**: For Windows, the [sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) and [label colors](sensitivity-labels-office-apps.md#label-colors) are now generally available for Word, Excel, PowerPoint, and Outlook. - **General availability (GA)**: Both Outlook for Windows and Outlook for Mac are rolling out in general availability for [protected meetings](sensitivity-labels-meetings.md). - **General availability (GA)**: Now in general availability for built-in labeling for Windows, support for a [default sublabel for a parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label) as a parity feature for the AIP add-in. |
| enterprise | Office 365 Cdn Quickstart | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/office-365-cdn-quickstart.md | You can use the built-in **Office 365 Content Delivery Network (CDN)** to host s For more detailed information guidance see [Use the Office 365 Content Delivery Network (CDN) with SharePoint Online](use-microsoft-365-cdn-with-spo.md). > [!CAUTION]-> Private CDN configuration is in the process of deprecation. You are no longer required to configure a private CDN. Image file types are served through a private CDN out of the box. However, if a private CDN is in use for other file types, like JS or CSS, we recommend using a public CDN for better performance. Going forward, non-image file types will not be supported through private CDNs. +> As images are now automatically managed in a SharePoint Online service-managed Private CDN, the manually configured Private CDN is in the process of being deprecated. This means that customers no longer need to configure private CDN. The recommended practice remains unchanged as images will be hosted via the service-managed Private CDN automatically and Public CDN will continue to be available for all other file types, like CSS and JS. Any customers using Private CDN for file types other than images, will need to move those files into Public CDN. Public CDN is recommended for these file types, to enhance performance. >[!NOTE] >The Office 365 CDN is only available to tenants in the production (worldwide) cloud. Tenants in the US Government, China and Germany clouds do not currently support the Office 365 CDN. |
| enterprise | Use Microsoft 365 Cdn With Spo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/use-microsoft-365-cdn-with-spo.md | description: Learn how to use the Office 365 Content Delivery Network (CDN) to s You can use the built-in Office 365 Content Delivery Network (CDN) to host static assets to provide better performance for your SharePoint Online pages. The Office 365 CDN improves performance by caching static assets closer to the browsers requesting them, which helps to speed up downloads and reduce latency. Also, the Office 365 CDN uses the [HTTP/2 protocol](https://en.wikipedia.org/wiki/HTTP/2) for improved compression and HTTP pipelining. The Office 365 CDN service is included as part of your SharePoint Online subscription. > [!CAUTION]-> Private CDN configuration is in the process of deprecation. You are no longer required to configure a private CDN. Image file types are served through a private CDN out of the box. However, if a private CDN is in use for other file types, like JS or CSS, we recommend using a public CDN for better performance. Going forward, non-image file types will not be supported through private CDNs. +> As images are now automatically managed in a SharePoint Online service-managed Private CDN, the manually configured Private CDN is in the process of being deprecated. This means that customers no longer need to configure private CDN. The recommended practice remains unchanged as images will be hosted via the service-managed Private CDN automatically and Public CDN will continue to be available for all other file types, like CSS and JS. Any customers using Private CDN for file types other than images, will need to move those files into Public CDN. Public CDN is recommended for these file types, to enhance performance. > [!NOTE] > The Office 365 CDN is only available to tenants in the **Production** (worldwide) cloud. Tenants in the US Government and China clouds do not currently support the Office 365 CDN. |
| lighthouse | M365 Lighthouse Understand Deployment Statuses | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-understand-deployment-statuses.md | Tasks can have the following statuses: |Compliant|<ul><li>All settings included in the subtask are **Compliant**.</li><li>There are no settings that are **Not compliant**.</li><li>There are no settings that are **Missing** from all existing configurations. A task can be **Compliant** if a setting is **Compliant** in one or more existing configurations without being **Not compliant** in another.</li><li>There may be **Extra** settings detected within existing configurations.</li></ul>| |Not compliant|<ul><li>One or more settings included in the subtask are **Not compliant**.</li><li>One or more settings are **Missing** from all existing configurations.</li><li>There may be **Extra** settings detected within existing configurations.</li><p>**NOTE:** Doesn't apply to subtasks that are **Not licensed**. </p></ul>| |Not licensed|The tenant isn't licensed for the services required to deploy the configuration associated with the subtask.|-|Dismissed|The subtask has been Dismissed by a Lighthouse user.<p>**NOTE:** Not licensed subtasks may be dismissed by a Lighthouse user.</p>| +|Dismissed|The subtask was dismissed by a Lighthouse user.<p>**NOTE:** A Lighthouse user can dismiss **Not Licensed** subtasks.</p>| Lighthouse will stop detecting or reporting deployment status for subtasks that have been dismissed. |
| security | Device Control Removable Storage Access Control Faq | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control-faq.md | DeviceFileEvents Another way is to deploy an Audit policy to the organization, and see the events in advanced hunting or the device control report. -## How do I find Sid or ComputerSid for Azure AD group? +## How do I find Sid for Azure AD group? -Different from AD group, the Sid or ComputerSid is using Object Id for Azure AD group. You can find the Object Id from Azure portal. +Different from AD group, the Sid is using Object Id for Azure AD group. You can find the Object Id from Azure portal.  ## Why is my printer blocked in my organization? -The **Default Enforcement** setting is for all device control components, which means if you set it to `Deny`, it will block all printers as well. You can either create custom policy to explictly allow printers or you can replace the Default Enforcement policy with a custom policy. +The **Default Enforcement** setting is for all device control components, which means if you set it to `Deny`, it will block all printers as well. You can either create custom policy to explicitly allow printers or you can replace the Default Enforcement policy with a custom policy. +++## Why creating a folder is not blocked by File system level access +Creating an empty folder will not be blocked even if **File system level access** Write access Deny is configured. Any non-empty file will be blocked. ++## Why my USB is still blocked with allow-ready policy? +Some specific USB devices require more than Read access, the following list shows some examples: +1. To Read access some Kingston encrypted USBs requires Execute access for its CDROM. +2. To Read access some WD My Passport USBs requires Disk level Write access. For this case, if you want to deny Write access, you should use the **File system level access** ++The best way to understand this is to check the event on the Advanced hunting which will clearly show what accessMask is required. ## Can I use both Group Policy and Intune deploy policies? |
| security | Linux Whatsnew | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-whatsnew.md | This article is updated frequently to let you know what's new in the latest rele - [What's new in Defender for Endpoint on macOS](mac-whatsnew.md) - [What's new in Defender for Endpoint on iOS](ios-whatsnew.md) -#### March-2023 (Build: 101.98.05 | Release version: 30.123012.19805.0) +<details> + <summary> March-2023 (Build: 101.98.30 | Release version: 30.123012.19830.0)</summary> ++ Released: **March , 20,2023**<br/> + Published: **March 20, 2023**<br/> + Build: **101.98.30**<br/> + Release version: **30.123012.19830.0**<br/> + Engine version: **1.1.19900.2**<br/> + Signature version: **1.379.1299.0**<br/> +**What's new** +- This new release is build over March 2023 release (101.98.05) with fix for Live response commands failing for one of our customers. There is no change for other customers and upgrade is optional. +</details> + +<details> + <summary> March-2023 (Build: 101.98.05 | Release version: 30.123012.19805.0)</summary>  Released: **March , 08,2023**<br/>  Published: **March 08, 2023**<br/> This article is updated frequently to let you know what's new in the latest rele **Known issues** -- While upgrading mdatp to version 101.94.13, you may notice that health is false, with health_issues as "no active supplementary event provider". This may happen due to misconfigured/conflicting auditd rules on existing machines. To mitigate the issue, the auditd rules on the existing machines needs to be fixed. The following steps can help you to identify such auditd rules (these commands need to be run as super user). Please take backup of following file: /etc/audit/rules.d/audit.rules as these steps are only to identify failures.+- While upgrading mdatp to version 101.94.13, you may notice that health is false, with health_issues as "no active supplementary event provider". This may happen due to misconfigured/conflicting auditd rules on existing machines. To mitigate the issue, the auditd rules on the existing machines need to be fixed. The following steps can help you to identify such auditd rules (these commands need to be run as super user). Please take backup of following file: /etc/audit/rules.d/audit.rules as these steps are only to identify failures. ```bash Caution: Some customers(<1%) are experiencing issues with this method. sudo mdatp config real-time-protection --value=disabled sudo systemctl disable mdatp ```-+</details> <details> sudo systemctl disable mdatp **Known issues** -- While upgrading mdatp to version 101.94.13, you may notice that health is false, with health_issues as "no active supplementary event provider". This may happen due to misconfigured/conflicting auditd rules on existing machines. To mitigate the issue, the auditd rules on the existing machines needs to be fixed. The following steps can help you to identify such auditd rules (these commands need to be run as super user). Please take backup of following file: /etc/audit/rules.d/audit.rules as these steps are only to identify failures.+- While upgrading mdatp to version 101.94.13, you may notice that health is false, with health_issues as "no active supplementary event provider". This may happen due to misconfigured/conflicting auditd rules on existing machines. To mitigate the issue, the auditd rules on the existing machines need to be fixed. The following steps can help you to identify such auditd rules (these commands need to be run as super user). Please take backup of following file: /etc/audit/rules.d/audit.rules as these steps are only to identify failures. ```bash echo -c >> /etc/audit/rules.d/audit.rules |
| security | Supported Capabilities By Platform | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/supported-capabilities-by-platform.md | The following table gives information about the supported Microsoft Defender for |Endpoint & network device discovery||||| |[Vulnerability management](../defender-vulnerability-management/defender-vulnerability-management.md)||||| ||||||-|**Response**||||| -|[Automated Investigation & Response (AIR)](automated-investigations.md)||||| -|[Device response capabilities: collect investigation package, run AV scan](respond-machine-alerts.md)||| <sup>[[3](#fn3)]</sup>| <sup>[[3](#fn3)]</sup>| -|[Device isolation](respond-machine-alerts.md)||| <sup>[[3](#fn3)]</sup>|| -|File response capabilities: collect file, deep analysis, block file, stop, and quarantine processes||| <sup>[[4](#fn4)]</sup>| <sup>[[4](#fn4)]</sup>| -|[Live Response](live-response.md)||||| +|**Response** | | | || +|[Automated Investigation & Response (AIR)](automated-investigations.md) |  |  |  |  | +|[Device response capabilities: collect investigation package, run AV scan](respond-machine-alerts.md) |  |  |  <sup>[[2](#fn2)][[3](#fn3)]</sup> |  <sup>[[2](#fn2)][[3](#fn3)]</sup> | +|[Device isolation](respond-machine-alerts.md) |  |  | ! |  <sup>[[2](#fn2)][[3](#fn3)]</sup> | +|File response capabilities: collect file, deep analysis, block file, stop, and quarantine processes |  |  |  <sup>[[4](#fn4)]</sup> |  <sup>[[4](#fn4)]</sup> | +|[Live Response](live-response.md) |  |  |  <sup>[[2](#fn2)]</sup> |  <sup>[[2](#fn2)]</sup> | (<a id="fn1">1</a>) Refers to the modern, unified solution for Windows Server 2012 R2 and 2016. For more information, see [Onboard Windows Servers to the Defender for Endpoint service](configure-server-endpoints.md). |
| security | Advanced Hunting Cloudappevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-cloudappevents-table.md | Last updated 02/16/2021 The `CloudAppEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about activities in various cloud apps and services covered by Microsoft Defender for Cloud Apps. For a complete list, jump to [Apps and services covered](#apps-and-services-covered). Use this reference to construct queries that return information from this table. -> [!IMPORTANT] -> This table includes information that used to be available in the `AppFileEvents` table. Starting March 7, 2021, users hunting through file-related activities in cloud services on and beyond this date should use the `CloudAppEvents` table instead. <br><br>Make sure to search for queries and custom detection rules that still use the `AppFileEvents` table and edit them to use the `CloudAppEvents` table. More guidance about converting affected queries can be found in [Hunt across cloud app activities with Microsoft 365 Defender advanced hunting](https://techcommunity.microsoft.com/t5/microsoft-365-defender/hunt-across-cloud-app-activities-with-microsoft-365-defender/ba-p/1893857). + For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md). |
| security | Attack Simulation Training Faq | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-faq.md | It's possible that the number of users who actually receive the simulation email - Guest users. - Users that are no longer active in Azure Active Directory (Azure AD). -Only valid, non-guest users with a valid mailbox will be included in simulations. If you use distribution groups or mail-enabled security groups to target users, you can use the [Get-DistributionGroupMember](/powershell/module/exchange/get-distributiongroupmember) cmdlet in [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) to view and validate distribution group members. +Only valid, non-guest users with valid Exchange Online mailboxes will be included in simulations. If you use distribution groups or mail-enabled security groups to target users, you can use the [Get-DistributionGroupMember](/powershell/module/exchange/get-distributiongroupmember) cmdlet in [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) to view and validate distribution group members. ## Issues with Attack simulation training reporting |
| security | Attack Simulation Training Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-get-started.md | Watch this short video to learn more about Attack simulation training. ## What do you need to know before you begin? -- Attack simulation training requres a Microsoft 365 E5 or [Microsoft Defender for Office 365 Plan 2](defender-for-office-365.md) license.+- Attack simulation training requires a Microsoft 365 E5 or [Microsoft Defender for Office 365 Plan 2](defender-for-office-365.md) license. - To open the Microsoft 365 Defender portal, go to <https://security.microsoft.com>. Attack simulation training is available at **Email and collaboration** \> **Attack simulation training**. To go directly to Attack simulation training, use <https://security.microsoft.com/attacksimulator>. For step by step instructions on how to gain insights with reporting, see [Gain One of the most crucial elements in a phishing simulation is the payload selection. If you're tracking only click-through as a quality metric, there's an incentive to decrease the click rate by selecting easier-to-spot phishing payloads. Eventually, it's less likely that the user will change their behavior when a real phishing messages comes along. -To combat the tendency to use low click rate payloads and to maximize educational returns, we've created a new piece of metadata for every global payload called the predicted compromise rate (PCR). +To combat the tendency to use low click rate payloads and to maximize educational returns, we've created a new piece of metadata for every global payload called the predicted compromise rate (PCR). PCR uses historical data across Microsoft 365 that predicts the percentage of people who will be compromised by the payload. The formula is: users compromised / total number of users who receive the simulation. PCR is an intelligent mechanism that's built on information like payload content, compromise rates (aggregated and anonymized), and payload metadata. PCR predicts a more accurate potential compromise rate when the payload is used within a simulation. The benefit of PCR comes from predicting actual vs. predicted click through for a given simulation and payload. |
| security | Configure Junk Email Settings On Exo Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-junk-email-settings-on-exo-mailboxes.md | In Microsoft 365 organizations with mailboxes in Exchange Online, organizational But, there are also specific anti-spam settings that admins can configure on individual mailboxes in Exchange Online: -> [!NOTE] -> EOP now uses its own mail flow delivery agent to route messages to the Junk Email folder instead of using the junk email rule. The _Enabled_ parameter on the **Set-MailboxJunkEmailConfiguration** cmdlet no longer has any effect on mail flow. EOP routes messages based on the actions set in anti-spam policies. The user's Safe Sender list and Blocked Senders list will continue to work as usual. - - **Move messages to the Junk Email folder based on anti-spam policies**: When an anti-spam policy is configured with the action **Move message to Junk Email folder** for a spam filtering verdict, the message is moved to the Junk Email folder after the message is delivered to the mailbox. For more information about spam filtering verdicts in anti-spam policies, see [Configure anti-spam policies in EOP](anti-spam-policies-configure.md). Similarly, if zero-hour auto purge (ZAP) determines a delivered message is spam or phish, the message is moved to the Junk Email folder for **Move message to Junk Email folder** spam filtering verdict actions. For more information about ZAP, see [Zero-hour auto purge (ZAP) in Exchange Online](zero-hour-auto-purge.md). - **Junk email settings that users configure for themselves in Outlook or Outlook on the web**: The _safelist collection_ is the Safe Senders list, the Safe Recipients list, and the Blocked Senders list on each mailbox. The entries in these lists determine whether the message is moved to the Inbox or the Junk Email folder. Users can configure the safelist collection for their own mailbox in Outlook or Outlook on the web (formerly known as Outlook Web App). Admins can configure the safelist collection on any user's mailbox. Admins can use Exchange Online PowerShell to configure entries in the safelist c > [!NOTE] > Messages from senders that users have added to their own Safe Senders lists will skip content filtering as part of EOP (the SCL is -1). To prevent users from adding entries to their Safe Senders list in Outlook, use Group Policy as mentioned in the [About junk email settings in Outlook](#about-junk-email-settings-in-outlook) section later in this article. Policy filtering, Content filtering and Defender for Office 365 checks will still be applied to the messages.+> +> EOP uses its own mail flow delivery agent to route messages to the Junk Email folder instead of using the junk email rule in the mailbox. The _Enabled_ parameter on the **Set-MailboxJunkEmailConfiguration** cmdlet has any effect on mail flow for Exchange Online mailboxes. EOP routes messages based on the actions set in anti-spam policies. The user's Safe Sender list and Blocked Senders continue to work as usual. ## What do you need to know before you begin? |
| security | Defender For Office 365 Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/defender-for-office-365-whats-new.md | For more information on what's new with other Microsoft Defender security produc ## March 2023 - **Built-in protection: Safe Links time of click protection enabled for email**: Microsoft will now by default protect URLs in email messages at time of click as part of this update to Safe Links settings (_EnableSafeLinksForEmail_) within the Built-in protection preset security policy. To learn about the specific Safe Links protections in the Built-in protection policy, see [Safe Links policy settings](recommended-settings-for-eop-and-office365.md#safe-links-policy-settings).--- **Quarantine notifications enabled in preset security policies**: If your organization has enabled or will enable the Standard or Strict preset security policies, the policies will be automatically updated to use the new DefaultFullAccessWithNotificationPolicy quarantine policy (noifications enabled) wherever the DefaultFullAccessPolicy (notifications disabled) was used. To learn more about quaratine notifications, see [Quarantine notifications](=(quarantine-quarantine-notifications.md). For more information about specific settings in preset security policies, see [Microsoft recommendations for EOP and Defender for Office 365 security settings](recommended-settings-for-eop-and-office365.md).+- **Quarantine notifications enabled in preset security policies**: If your organization has enabled or will enable the Standard or Strict preset security policies, the policies will be automatically updated to use the new DefaultFullAccessWithNotificationPolicy quarantine policy (notifications enabled) wherever the DefaultFullAccessPolicy (notifications disabled) was used. To learn more about quarantine notifications, see [Quarantine notifications](quarantine-quarantine-notifications.md). For more information about specific settings in preset security policies, see [Microsoft recommendations for EOP and Defender for Office 365 security settings](recommended-settings-for-eop-and-office365.md). ## January 2023 For more information on what's new with other Microsoft Defender security produc - This is a continuation of [Microsoft 365 Defender delivers unified XDR experience to GCC, GCC High and DoD customers - Microsoft Tech Community](https://techcommunity.microsoft.com/t5/public-sector-blog/microsoft-365-defender-delivers-unified-xdr-experience-to-gcc/ba-p/3263702), announced in March 2022. - This change enables users to view and manage additional Microsoft 365 Defender security solutions in one portal. - This change impacts all customers who use the Office 365 Security & Compliance Center (protection.office.com), including Microsoft Defender for Office (Plan 1 or Plan 2), Microsoft 365 E3 / E5, Office 365 E3/ E5, and Exchange Online Protection. For the full list, see [Microsoft 365 guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance)-- This change impacts all users who log in to the Office 365 Security and Compliance portal (protection.office.com), including security teams and end-users who access the Email Quarantine experience, at the **Microsoft Defender Portal** > **Review** > **Quarantine**.+- This change impacts all users who log in to the Office 365 Security and Compliance portal (protection.office.com), including security teams and end-users who access the Email Quarantine experience, at the **Microsoft Defender Portal** \> **Review** \> **Quarantine**. - Redirection is enabled by default and impacts all users of the Tenant.-- Global Administrators and Security Administrators can turn on or off redirection in the Microsoft 365 Defender portal by navigating to **Settings** > **Email & collaboration** > **Portal redirection** and switch the redirection toggle.+- Global Administrators and Security Administrators can turn on or off redirection in the Microsoft 365 Defender portal by navigating to **Settings** \> **Email & collaboration** > **Portal redirection** and switch the redirection toggle. - **Built-in protection**: A profile that enables a base level of Safe Links and Safe Attachments protection that's on by default for all Defender for Office 365 customers. To learn more about this new policy and order of precedence, see [Preset security policies](preset-security-policies.md) and to learn about the specific Safe Links and Safe Attachment controls set, see [Safe Attachments settings](recommended-settings-for-eop-and-office365.md#safe-attachments-settings) and [Safe Links settings](recommended-settings-for-eop-and-office365.md#safe-links-settings). - **Bulk Complaint Level** is now available in the EmailEvents table in Advanced Hunting with numeric BCL values from 0 to 9. A higher BCL score indicates that bulk message is more likely to generate complaints and is more likely to be spam. For more information on what's new with other Microsoft Defender security produc ## April 2022 - [Introducing the URLClickEvents table in Microsoft 365 Defender Advanced Hunting](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/introducing-the-urlclickevents-table-in-advanced-hunting-with/ba-p/3295096): Introducing the UrlClickEvents table in advanced hunting with Microsoft Defender for Office 365.-- [Manual email remediation enhancements](/microsoft-365/security/office-365-security/remediate-malicious-email-delivered-office-365): Bringing manual email purge actions taken in Microsoft Defender for Office 365 to the Microsoft 365 Defender (M365D) unified Action Center using a new action-focused investigation.+- [Manual email remediation enhancements](remediate-malicious-email-delivered-office-365.md): Bringing manual email purge actions taken in Microsoft Defender for Office 365 to the Microsoft 365 Defender (M365D) unified Action Center using a new action-focused investigation. - [Introducing differentiated protection for priority accounts in Microsoft Defender for Office 365](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/introducing-differentiated-protection-for-priority-accounts-in/ba-p/3283838): Introducing the general availability of differentiated protection for priority accounts. ## March 2022 |