| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Remove Former Employee Step 5 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/remove-former-employee-step-5.md | To preserve a former user's OneDrive files, first give yourself access to their > [!NOTE] > You can move or copy up to 500 MB of files and folders at a time.<br/> > When you move or copy documents that have version history, only the latest version is moved. +> Administrative options for an active user under the OneDrive tab in the Microsoft 365 admin center are currently not supported for multi-geo tenants. You can also grant access to another user to access a former employee's OneDrive. |
| admin | Admin Controls Profile Videos | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/admin-controls-profile-videos.md | Title: "Turn the profile video feature on or off for all users in your Microsoft 365 organization"-- NOCSH In the request body, populate the value for **isEnabledInOrganization** to eithe * **Where are profile videos stored?** - Profile videos are stored in a userΓÇÖs OneDrive for Business, in the **Apps\Microsoft People Cards Service\Live Persona Card** folder. + Profile videos are stored in a userΓÇÖs OneDrive for Business, in the **Apps\Microsoft People Cards Service\Live Persona Card** folder. * **Can users control who can see their profile video?** In the request body, populate the value for **isEnabledInOrganization** to eithe * **Can deleted profile videos be recovered?** - No, if a user deletes their profile video it can't be recovered. + No, if a user deletes their profile video it can't be recovered. |
| admin | Compare Ways To Block Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/compare-ways-to-block-access.md | When an employee leaves your organization, on good terms or bad, you need to blo |Block sign-in <br/> |One way to block a user from accessing Microsoft 365 is to change their sign-in status to **Sign-in blocked**. This prevents them from signing into Microsoft 365 from their computers and mobile devices though they can still view previously downloaded or synced email and documents. If you're using Blackberry Enterprise Service, you can disable their access there as well. <br/> |Use when an employee plans to leave the organization or they plan to take a long-term leave of absence. <br/> | |Reset user password <br/> |Another way to prevent a user from accessing Microsoft 365 is to reset their password. This prevents them from using their account though they can still view previously downloaded or synced email and documents. You can then sign in as them and change the password to one of your choosing. <br/> |Use when an employee leaves suddenly and permanently and you feel there's concern for business data. <br/> | |Remove all assigned licenses <br/> |Another option is to remove any Microsoft 365 licenses assigned to the user. This prevents them from using applications and services like the Office suite, Office apps for the web, Yammer, and SharePoint Online. They can still sign in but canΓÇÖt use these services. <br/> |Use when you feel this user no longer needs access to specific features in Microsoft 365. <br/> <br> **Important:** When you remove a license, the user's mailbox will be deleted in 30 days.- + ## Related articles [Offboard a user from Microsoft 365](../add-users/remove-former-employee.md) When an employee leaves your organization, on good terms or bad, you need to blo [Assign licenses to users in Microsoft 365 for business](../manage/assign-licenses-to-users.md) [Remove licenses from users in Microsoft 365 for business](../manage/remove-licenses-from-users.md)- |
| business-premium | M365bp Mdb Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-mdb-whats-new.md | f1.keywords: NOCSH This article lists new features in the latest release of [Microsoft 365 Business Premium](index.md) and [Microsoft Defender for Business](../security/defender-business/mdb-overview.md). Features that are currently in preview are denoted with **(preview)**. +## March 2023 ++- **Mobile threat defense (preview) is added to Defender for Business**. The ability to [onboard iOS and Android devices](../security/defender-business/mdb-onboard-devices.md) to the standalone version of Defender for Business is now in preview! These capabilities provide OS-level threat and vulnerability management, web protection, and app security to help you and employees stay more secure on the go. See [Mobile threat defense capabilities in Microsoft Defender for Business](../security/defender-business/mdb-mtd.md). ++- **Monthly security summary report (preview) is added to Defender for Business** (preview). The new monthly security summary report shows how secure your organization is across identity, devices, information, and apps. You can view threats detected (and blocked) by Defender for Business together with your current status from Microsoft Secure Score. Recommendations to improve your security are also provided. See [Reports in Microsoft Defender for Business](../security/defender-business/mdb-reports.md). ++- **Device exposure score is now visible in Microsoft 365 Lighthouse** (preview). Microsoft Cloud Solution Providers (CSPs) who are using [Microsoft 365 Lighthouse](../lighthouse/m365-lighthouse-overview.md) can now view and manage device exposure scores across customer tenants. These capabilities enable partners to discover which customers' devices are at risk because of vulnerabilities. See [Microsoft 365 Lighthouse and Microsoft Defender for Business](../security/defender-business/mdb-lighthouse-integration.md). + ## January 2023 -- **Attack surface reduction capabilities are rolling out**. [Attack surface reduction capabilities in Defender for Business](../security/defender-business/mdb-asr.md) include attack surface reduction rules and a new attack surface reduction rules report. Attack surface reduction rules target certain behaviors that are considered risky because they are commonly abused by attackers through malware. In the Microsoft 365 Defender portal ([https://security.microsoft.com/](https://security.microsoft.com/)), you can now view a report showing detections and configuration information for attack surface reduction rules. In the navigation pane, choose **Reports**, and under **Endpoints**, choose **Attack surface reduction rules**. +- **Attack surface reduction capabilities are rolling out**. [Attack surface reduction capabilities in Defender for Business](../security/defender-business/mdb-asr.md) include attack surface reduction rules and a new attack surface reduction rules report. Attack surface reduction rules target certain behaviors that are considered risky because they're commonly abused by attackers through malware. In the Microsoft 365 Defender portal ([https://security.microsoft.com/](https://security.microsoft.com/)), you can now view a report showing detections and configuration information for attack surface reduction rules. In the navigation pane, choose **Reports**, and under **Endpoints**, choose **Attack surface reduction rules**. - **Default experience for Defender for Business when an enterprise plan is added**. Defender for Business now retains its default experience ([simplified configuration and setup](../security/defender-business/mdb-simplified-configuration.md)) even if an enterprise plan, such as [Defender for Endpoint Plan 2](../security/defender-endpoint/microsoft-defender-endpoint.md) or [Microsoft Defender for Servers Plan 1 or 2](/azure/defender-for-cloud/plan-defender-for-servers) is added. To learn more, see [What happens if I have a mix of Microsoft endpoint security subscriptions](/microsoft-365/security/defender-business/mdb-faq?#what-happens-if-i-have-a-mix-of-microsoft-endpoint-security-subscriptions)? |
| business-premium | M365bp Onboard Devices Mdb | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-onboard-devices-mdb.md | audience: Admin Previously updated : 01/18/2023 Last updated : 03/23/2023 ms.localizationpriority: high f1.keywords: NOCSH To onboard devices to Defender for Business, you can choose from several options - [Automatic onboarding for Windows devices that are already enrolled in Microsoft Intune](#use-automatic-onboarding-for-windows-devices-that-are-already-enrolled-in-intune) - [A local script to onboard Windows and Mac devices to Defender for Business](#use-a-local-script-to-onboard-windows-and-mac-devices-to-defender-for-business) (for devices that are not already enrolled in Intune)+- [Onboard mobile devices using the Microsoft Defender app](#onboard-mobile-devices-using-the-microsoft-defender-app) (Mobile threat defense capabilities are currently in preview!) - [Intune for enrolling new devices, including mobile devices](#use-intune-to-enroll-devices) (Windows, Mac, iOS, and Android) and then apply Defender for Business policies to those devices This article also includes: -- [What about servers?](#what-about-servers) (NEW!)+- [What about servers?](#what-about-servers) - [How to run a detection test on a Windows device](#run-a-detection-test-on-a-windows-device) - [How to onboard devices gradually](#onboard-devices-gradually) - [How to offboard a device](#offboard-a-device) if a device is replaced or someone leaves the organization You can use a local script to onboard Windows and Mac devices. When you run the See [Onboard devices to Microsoft Defender for Business](../security/defender-business/mdb-onboard-devices.md) for detailed instructions. +## Onboard mobile devices using the Microsoft Defender app ++If you have opted in to receive preview features, you can now onboard Android and iOS devices using the Microsoft Defender app. With [mobile threat defense capabilities in Defender for Business](../security/defender-business/mdb-mtd.md), users download the Microsoft Defender app from Google Play or the Apple App Store, sign in, and complete onboarding steps. ++For detailed instructions, see the **Mobile devices** tab in [Onboard devices to Microsoft Defender for Business](../security/defender-business/mdb-onboard-devices.md). ++To learn more about mobile threat defense, see [Mobile threat defense capabilities in Microsoft Defender for Business](../security/defender-business/mdb-mtd.md). + ## Use Intune to enroll devices To enroll a device, you can enroll it yourself, or have users sign in to the company portal app, enroll their devices, and then install any apps that are needed. After you've onboarded Windows devices to Defender for Business, you can run a d powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference = 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\test-MDATP-test\\invoice.exe');Start-Process 'C:\\test-MDATP-test\\invoice.exe' ``` -After the command has run, the Command Prompt window closes automatically. If successful, the detection test is marked as completed, and a new alert appears in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) for the newly-onboarded device in about ten minutes. +After the command has run, the Command Prompt window closes automatically. If successful, the detection test is marked as completed, and a new alert appears in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) for the newly onboarded device in about ten minutes. ## Onboard devices gradually |
| compliance | Auto Apply Retention Labels Scenario | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/auto-apply-retention-labels-scenario.md | The manufacturing company's compliance and data governance policies dictate how | Product agreements | 10 years after production stops | Review | | User manuals | 5 years after production stops | Delete | | All other types of documents | Don't actively retain | Delete when document is older than 3 years <br /><br /> A document is considered older than 3 years if it hasn't been modified within the last 3 years. |-||| We use the Microsoft Purview compliance portal to create the following [retention labels](retention.md#retention-labels): Here's the [file plan](file-plan-manager.md) for the Product Specification reten - **File plan descriptors:** For simplifying the scenario, no optional file descriptors are provided. -The following screenshot shows the settings when you create the Product Specification retention label in the Microsoft Purview compliance portal. You can create the *Product Cessation* event type when you create the retention label. See the procedure in the following section. +The following screenshot shows a summary of the label settings when you create the Product Specification retention label in the Microsoft Purview compliance portal. You can create the *Product Cessation* event type before you create the retention label, or during. See the procedure in the following section. - + > [!NOTE] > To avoid a 5-year wait for document deletion, set the retention duration to ***1 day*** if you're recreating this scenario in a test environment. ### Create an event type when you create a retention label -1. On the **Define retention settings** page of the Create retention label wizard, after **Start the retention period based on**, select **Create new event type**: +1. On the **Define the retention period** page of the Create retention label configuration, after **Start the retention period based on**, select **Create new event type**: -  +  3. On the **Name your event type** page, enter **Product Cessation** and an optional description. Then select **Next**, **Submit**, and **Done**. -4. Back on the **Define retention settings** page, for **Start the retention period based on**, use the dropdown box to select the **Product Cessation** event type that you created. +4. Back on the **Define the retention period** page, for **Start the retention period based on**, use the dropdown box to select the **Product Cessation** event type that you created. - Here's what the settings look like for the Product Specification retention label: +5. On the **Choose what happens during the retention period** page, select **Mark items as a record**. -  +6. On the **Choose what happens after the retention period** page, keep the default of **Delete items automatically**. -6. Select **Create label**, and on the next page when you see the options to publish the label, auto-apply the label, or just save the label: Select **Just save the label for now**, and then select **Done**. +6. On the **Review and finish** page, select **Create label**. On the next page when you see the options to publish the label, auto-apply the label, or just save the label: Select **Do Nothing**, and then select **Done**. > [!TIP] > For more detailed steps, see [Create a label whose retention period is based on an event](event-driven-retention.md#step-1-create-a-label-whose-retention-period-is-based-on-an-event). Now that we've verified that the KQL query is working, let's create an auto-appl 1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft Purview compliance portal</a>, go to **Records management** > **Label policies** > **Auto-apply a label**. - [  ](../media/SPRetention16.png#lightbox) --2. In the Create auto-labeling policy wizard, on the **Name your auto-labeling policy** page, enter a name such as **Auto-apply Product Specification label**, and an optional description. Then select **Next**. +2. In the Create auto-labeling policy configuration, on the **Name your auto-labeling policy** page, enter a name such as **Auto-apply Product Specification label**, and an optional description. Then select **Next**. 3. On the **Choose the type of content you want to apply this label to** page, select **Apply label to content that contains specific words or phrases, or properties**, and then select **Next**. - [  ](../media/SPRetention17.png#lightbox) + [  ](../media/spo-scenario-policy-conditions.png#lightbox) This option lets us provide the same KQL search query that we tested in the previous section. The query returns all Product Specification documents that have a status of *Final*. When we use this same query in the auto-apply label policy, the Product Specification retention label will be automatically applied to all documents that match it. Now that we've verified that the KQL query is working, let's create an auto-appl  -5. On the **Choose locations to apply the policy** page, you select the content locations that you want to apply the policy to. For this scenario, we apply the policy only to SharePoint locations, because all the production documents are stored in SharePoint document libraries. Toggle the status for **Exchange mailboxes**, **OneDrive accounts**, and **Microsoft 365 Group mailboxes & sites** to **Off**. Make sure that the status for SharePoint sites is set to **On** before you select **Next**: +5. On the **Choose the type of retention policy to create** page, select **Static**. ++6. On the **Choose where to automatically apply the label** page, you select the content locations that you want to apply the policy to. For this scenario, we apply the policy only to **SharePoint classic and communication sites**. Toggle the status for **Exchange mailboxes**, **OneDrive accounts**, and **Microsoft 365 Group mailboxes & sites** to **Off**: -  +  > [!TIP]- > Instead of applying the policy to all SharePoint sites, you can select **Choose site** and add the URLs for specific SharePoint sites. + > Instead of applying the policy to all SharePoint sites, you can select **Edit** for the **Included** column, and add the URLs for specific SharePoint sites. 6. On the **Choose a label to auto-apply** page, select **Add label**. 7. From the list of retention labels, select **Product Specification**. Then select **Add** and **Next**. -8. Review your settings: +8. On the **Decide whether to test or run your policy** page, keep the default of **Turn on policy**. -  +9. Review your settings: ++  9. Select **Submit** to create the auto-apply label policy. Also look at the properties of the documents in the Document Library. In the inf [  ](../media/SPRetention21.png#lightbox) -Because the retention labels were auto-applied to documents, those documents are protected from deletion because the retention label was configured to declare the documents as *records*. As an example of this protection, we get the following error message when we try to delete one of these documents: +Because the retention labels were auto-applied to documents, those documents are protected from deletion because the retention label was configured to mark items as records. As an example of this protection, we get the following error message when we try to delete one of these documents: [  ](../media/SPRetention22.png#lightbox) This list describes the parameters in the **Body** property of the action that m Now the retention label is created and auto-applied, and the flow is configured and created. When the value in the **In Production** column for the Spinning Widget product in the Products list is changed from ***Yes*** to ***No***, the flow is triggered to create the event. To see this event in the Microsoft Purview compliance portal, go to **Records management** > **Events**. -[  ](../media/SPRetention28.png#lightbox) --Select the event to view the details on the flyout page. Notice that even though the event is created, the event status shows that no SharePoint sites or documents have been processed. +Select the event to view the details on the flyout pane. Notice that even though the event is created, the event status shows that no SharePoint sites or documents have been processed.  |
| compliance | Device Onboarding Macos Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/device-onboarding-macos-overview.md | Your macOS devices must already be managed through Intune or JAMF Pro. - To onboard into Intune, see [Deployment guide: Manage macOS devices in Microsoft Intune](/mem/intune/fundamentals/deployment-guide-platform-macos) and [Enroll your Mac with Intune Company Portal](/mem/intune/user-help/enroll-your-device-in-intune-macos-cp). - To onboard into JAMF Pro see, [JAMF Pro administrators guide](https://www.jamf.com/resources/product-documentation/jamf-pro-administrators-guide/) and [JAMF Pro Installation and Configuration Guide for Mac](https://www.jamf.com/resources/product-documentation/jamf-pro-installation-guide-for-mac/) +### Supported processors ++macOS devices with x64 and M1 (ARM64) processors are supported. ### Supported browsers |
| compliance | Information Barriers Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/information-barriers-policies.md | keywords: Microsoft 365, Microsoft Purview, compliance, information barriers Previously updated : 01/01/2023 Last updated : 03/21/2023 audience: ITPro To learn more about roles and permissions, see [Roles and role groups in the Mic When you configure IB, you'll work with several objects and concepts. - **User account attributes** are defined in Azure Active Directory (or Exchange Online). These attributes can include department, job title, location, team name, and other job profile details. You'll assign users or groups to segments with these attributes.-- **Segments** are sets of groups or users that are defined in the compliance portal or by using PowerShell that use selected group or user account attributes. +- **Segments** are sets of groups or users that are defined in the compliance portal or by using PowerShell that uses selected group or user account attributes. Your organization can have up to 5,000 segments and users can be assigned to a maximum of 10 segments. See the list of [IB supported attributes](information-barriers-attributes.md) for details. When you configure IB, you'll work with several objects and concepts. - **For organizations in *Legacy* mode**: For users defined in *allow* policies, non-IB groups and users won't be visible to users included in IB segments and policies. For users defined in *block* policies, non-IB groups and users will be visible to users included in IB segments and policies. - **For organizations in *SingleSegment* or *MultiSegment* mode**: For users defined in *allow* and *block* policies, non-IB groups and users will be visible to users included in IB segments and policies. - **Group support**. Only Modern Groups are currently supported in IB and Distribution Lists/Security Groups are treated as non-IB groups.-- **Hidden/disabled user accounts**. For hidden/disabled accounts in your organization, the *HiddenFromAddressListEnabled* parameter is automatically set to *True* when the users accounts are hidden or disabled. In IB-enabled organizations, these accounts are prevented from communicating with all other user accounts.+- **Hidden/disabled user and guest accounts**. For hidden/disabled user and guest accounts in your organization, the *HiddenFromAddressListEnabled* parameter is automatically set to *True* when user accounts are hidden or disabled, or when a guest is created. When the organization mode is *Legacy* for IB-enabled organizations, these accounts are prevented from communicating with all other user accounts. Administrators can disable this default behavior by manually setting the *HiddenFromAddressListEnabled* parameter to *False*. ## Configuration overview In addition to the required subscriptions and permissions, make sure that the fo - **Remove existing Exchange Online address book policies (optional)**: - **For organizations in *Legacy* mode**: Before you define and apply IB policies, you must remove all existing Exchange Online address book policies in your organization. IB policies are based on address book policies and existing ABPs policies aren't compatible with the ABPs created by IB. To remove your existing address book policies, see [Remove an address book policy in Exchange Online](/exchange/address-books/address-book-policies/remove-an-address-book-policy). For more information about IB policies and Exchange Online, see [Information barriers and Exchange Online](information-barriers.md#information-barriers-and-exchange-online).- - **For organizations in *SingleSegment* or *MultiSegment* mode**: Information barriers is no longer based on Exchange Online Address Book Policies (ABPs). Organizations using ABPs will not have any impact to the existing ABPs when enabling information barriers. + - **For organizations in *SingleSegment* or *MultiSegment* mode**: Information barriers is no longer based on Exchange Online Address Book Policies (ABPs). Organizations using ABPs won't have any impact to the existing ABPs when enabling information barriers. - **Manage using PowerShell (optional)**: IB segments and policies can be defined and managed in the compliance portal, but you can also use the Office 365 Security & Compliance PowerShell if preferred or needed. Although several examples are provided in this article, you'll need to be familiar with PowerShell cmdlets and parameters if you choose to use PowerShell to configure and manage IB segments and policies. You'll also need the Azure Active Directory PowerShell module if you choose this configuration option. - [Connect to Security & Compliance PowerShell](/powershell/exchange/connect-to-scc-powershell) |
| enterprise | Microsoft 365 Multi Geo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/microsoft-365-multi-geo.md | description: In this article, learn how to expand your Microsoft 365 presence to # Microsoft 365 Multi-Geo -The Microsoft 365 Multi-Geo Capabilities add-on provides customers with the ability to expand their Microsoft 365 presence to multiple geographic regions or counties within a single existing Microsoft 365 _Tenant_. Multi-Geo enables customers to manage data-at-rest locations at a granular level for their users, SharePoint sites, Microsoft 365 Groups, and Microsoft Teams teams level. Multi-Geo is targeted to customers who have a need to store customer data in multiple geographies at the same time to satisfy their data residency requirements and whose needs may change over time. +The Microsoft 365 Multi-Geo Capabilities add-on provides customers with the ability to expand their Microsoft 365 presence to multiple geographic regions or countries within a single existing Microsoft 365 _Tenant_. Multi-Geo enables customers to manage data-at-rest locations at a granular level for their users, SharePoint sites, Microsoft 365 Groups, and Microsoft Teams teams level. Multi-Geo is targeted to customers who have a need to store customer data in multiple geographies at the same time to satisfy their data residency requirements and whose needs may change over time. Microsoft 365 Multi-Geo is designed to meet customers' data residency requirements and allow for collaboration between and amongst the customers satellite location and preferred data locations. If customer requires performance optimization functionalities for Microsoft 365, see <a href="https://support.office.com/article/e5f1228c-da3c-4654-bf16-d163daee8848" target="_blank">Network planning and performance tuning for Microsoft 365</a> or contact your support group. |
| frontline | Sms Notifications Usage Report | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/sms-notifications-usage-report.md | + + Title: Microsoft Teams SMS notifications usage report ++++audience: Admin ++++f1.keywords: +- NOCSH +ms.localizationpriority: high +search.appverid: MET150 ++ - M365-collaboration + - m365-frontline + - m365initiative-meetings +description: Learn how to use the SMS notifications usage report in the Microsoft Teams admin center to get an overview of SMS notifications usage in your organization. +appliesto: + - Microsoft Teams + - Microsoft 365 for frontline workers + Last updated : 3/23/2023++# Microsoft Teams SMS notifications usage report ++ **This feature requires [Teams Premium](/microsoftteams/teams-add-on-licensing/licensing-enhance-teams).** ++The SMS notifications usage report in the Microsoft Teams admin center gives you an overview of SMS notifications usage in your organization. ++You can track key data for confirmation and reminder text messages sent to external attendees in virtual appointments scheduled by your staff. The report provides information such as date and time sent, notification type, delivery status, and distribution details. ++To access the report, you must be a Global admin, Teams admin, Global reader, or Report reader. ++## View the report ++1. In the left navigation of the Teams admin center, choose **Analytics & reports** > **Usage reports**. On the **View reports** tab, under **Report**, select **SMS notifications usage**. +2. Under **Date range**, select a date range of 7 days, 30 days, or 90 days. Then, choose **Run report**. ++ The report contains the following information: + + |Tab |Description | + ||| + |**[Distribution](#distribution)** |Shows a breakdown of the number of SMS notifications sent in Bookings appointments and in Teams Electronic Health Record (EHR)-integrated appointments.| ++## Interpret the report ++Here's what you'll see on each tab of the report. ++### Distribution ++|Callout |Description | +|--|-| +|**1** |Each report has a date for when the report was generated. The reports usually reflect a 24 to 48-hour latency from time of activity. | +|**2** |The X axis is the selected date range for the report, by month. The Y axis is the number of SMS notifications.<br>Hover over the dot on a given date to see the number of SMS notifications sent on that date.| +|**3** |You can filter what you see on the chart by selecting an item. For example, select **SMS sent in EHR** or **SMS sent in Bookings** to see only the info related to each one. Changing this selection doesnΓÇÖt change the information in the table.| +|**4** |The table gives you detailed information about each SMS notification that was sent during the selected date range. <ul><li>**Sent time (UTC)** is the date and time when the notification was sent.</li> <li>**Sent from** indicates the source of the notification.</li> <li>**SMS notification type** shows whether the notification is an appointment reminder or confirmation.</li> <li>**Product type** indicates whether the virtual appointment was scheduled through Bookings or the Teams EHR connector.</li> <li>**Status** shows the delivery status.</li></ul> | ++## Related articles ++- [Virtual Appointments usage report](virtual-appointments-usage-report.md) +- [Advanced Virtual Appointments activity report](advanced-virtual-appointments-activity-report.md) +- [Teams Premium licensing](/microsoftteams/teams-add-on-licensing/licensing-enhance-teams) |
| frontline | Virtual Appointments App | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/virtual-appointments-app.md | To send SMS notifications to attendees by default, turn on **Send them text mess Keep in mind that schedulers can later choose to turn off the setting on an as-needed basis when they use the appointment type to schedule an appointment. +You can use the [SMS notifications usage report](sms-notifications-usage-report.md) to gain insight into how your workforce is using SMS notifications with virtual appointments. + To learn more, see [Use text messages to remind customers of their appointment](https://support.microsoft.com/topic/adda1e2a-03b8-4db2-864d-0a5a3f3a874a). ##### Link forms |
| lighthouse | M365 Lighthouse Vulnerability Management Page Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-vulnerability-management-page-overview.md | + + Title: "Overview of the Vulnerability management page in Microsoft 365 Lighthouse" +f1.keywords: NOCSH ++++ Last updated : 03/23/2023+audience: Admin +++ms.localizationpriority: medium ++- Tier1 +- scotvorg +- M365-subscription-management +- Adm_O365 ++- AdminSurgePortfolio +- M365-Lighthouse +search.appverid: MET150 +description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn about the Vulnerability management page." +++# Overview of the Vulnerability management page in Microsoft 365 Lighthouse ++Microsoft 365 Lighthouse provides a multi-tenant view of exposure score and recommendations from Microsoft Defender Vulnerability Management in Microsoft Defender for Business and Microsoft Defender for Endpoint. The exposure score from Microsoft Defender Vulnerability Management reflects how vulnerable tenants are to cybersecurity threats. Microsoft Defender Vulnerability Management helps proactively identify and build a secure foundation for devices through the remediation of software vulnerabilities and misconfigurations in customer environments. ++To learn more about vulnerability management, see [What is Microsoft Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management). ++You can access the Vulnerability management page in Lighthouse from the **Microsoft Defender for Business exposure score** card on the **Home** page or from the left navigation pane by selecting **Devices** > **Vulnerability management**. You'll see a multi-tenant view of the exposure and vulnerabilities detected for all tenants that have devices onboarded to Microsoft Defender for Business or Microsoft Defender for Endpoint. ++## Overview tab ++The overview tab provides multi-tenant insights into the exposure score, the number of exposed devices, vulnerabilities, and recommendations for tenants to lower their exposure. You can filter the list by exposure score, tenant name, or tenant tag. Select a tenant from the list to be taken to the Vulnerability Management dashboard page for that tenant in the Microsoft 365 Defender portal. To export exposure score data to an Excel comma-separated values (.csv) file, select **Export**. +++## Related content ++[What is Microsoft Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management) (article)\ +[Exposure score in Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/tvm-exposure-score) (article)\ +[Overview of the Device security page in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-device-security-overview) (article) |
| security | Compare Mdb M365 Plans | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/compare-mdb-m365-plans.md | The following table provides more information about what's included in each plan | Plan | Description | |:|:|-| **[Defender for Business](mdb-overview.md)** (standalone) | **Antivirus, antimalware, and ransomware protection for devices**<br/>- [Next-generation protection](../defender-endpoint/microsoft-defender-antivirus-in-windows-10.md) (antivirus/antimalware protection on devices together with cloud protection)<br/>- [Attack surface reduction](../defender-endpoint/overview-attack-surface-reduction.md) (network protection, firewall, and attack surface reduction rules) <sup>[[a](#fna)]</sup><br/>- [Endpoint detection and response](../defender-endpoint/overview-endpoint-detection-response.md) (behavior-based detection and manual response actions)<br/>- [Automated investigation and response](../defender/m365d-autoir.md) (with self-healing for detected threats)<br/>- [Microsoft Defender Vulnerability Management](mdb-view-tvm-dashboard.md) (view exposed devices and recommendations)<br/>- [Cross-platform support for devices](mdb-onboard-devices.md) (Windows, Mac, iOS, and Android) <sup>[[b](#fnb)]</sup><br/>- [Centralized management and reporting](mdb-get-started.md) (Microsoft 365 Defender portal)<br/>- [APIs for integration](../defender-endpoint/management-apis.md) (for Microsoft partners or your custom tools and apps) | -| **[Microsoft 365 Business Premium](../../business-premium/index.md)** | **Defender for Business plus productivity and additional security capabilities**<br/>- [Microsoft 365 Business Standard](../../admin/admin-overview/what-is-microsoft-365-for-business.md) (Office apps and services, and Microsoft Teams)<br/>- [Microsoft Intune](/mem/intune/fundamentals/what-is-intune) (device onboarding and management)<br/>- [Shared computer activation](/deployoffice/overview-shared-computer-activation) (for deploying Microsoft 365 Apps)<br/>- [Windows 10/11 Business](../../business-premium/m365bp-upgrade-windows-10-pro.md) (upgrade from previous versions of Windows Pro)<br/>- [Windows Autopilot](/mem/autopilot/windows-autopilot) (for setting up and configuring Windows devices)<br/>- [Exchange Online Protection](../office-365-security/eop-about.md) (antiphishing, antispam, antimalware, and spoof intelligence for email)<br/>- [Microsoft Defender for Office 365 Plan 1](/microsoft-365/security/office-365-security/defender-for-office-365) (advanced antiphishing, real-time detections, Safe Attachments, Safe Links)<br/>- [Auto-expanding archiving](../../compliance/autoexpanding-archiving.md) (for email)<br/>- [Azure Active Directory Premium Plan 1](/azure/active-directory/fundamentals/active-directory-whatis) (identity management)<br/>- [Azure Information Protection Premium Plan 1](/azure/information-protection/what-is-information-protection) (protection for sensitive information)<br/>- [Azure Virtual Desktop](/azure/virtual-desktop/overview) (centrally managed, secure virtual machines in the cloud) | +| **[Defender for Business](mdb-overview.md)** (standalone) | **Antivirus, antimalware, and ransomware protection for devices**<br/>- [Next-generation protection](../defender-endpoint/microsoft-defender-antivirus-in-windows-10.md) (antivirus/antimalware protection on devices together with cloud protection)<br/>- [Attack surface reduction](../defender-endpoint/overview-attack-surface-reduction.md) (network protection, firewall, and attack surface reduction rules) (see note 1 below)<br/>- [Endpoint detection and response](../defender-endpoint/overview-endpoint-detection-response.md) (behavior-based detection and manual response actions)<br/>- [Automated investigation and response](../defender/m365d-autoir.md) (with self-healing for detected threats)<br/>- [Microsoft Defender Vulnerability Management](mdb-view-tvm-dashboard.md) (view exposed devices and recommendations)<br/>- [Cross-platform support for devices](mdb-onboard-devices.md) (Windows, Mac, iOS, and Android) (see note 2 below)<br/>- [Centralized management and reporting](mdb-get-started.md) (Microsoft 365 Defender portal)<br/>- [APIs for integration](../defender-endpoint/management-apis.md) (for Microsoft partners or your custom tools and apps) | +| **[Microsoft 365 Business Premium](../../business-premium/index.md)** | **Defender for Business plus productivity and additional security capabilities**<br/>- [Microsoft 365 Business Standard](../../admin/admin-overview/what-is-microsoft-365-for-business.md) (Office apps and services, and Microsoft Teams)<br/>- [Microsoft Intune](/mem/intune/fundamentals/what-is-intune) (device onboarding and management)<br/>- [Shared computer activation](/deployoffice/overview-shared-computer-activation) (for deploying Microsoft 365 Apps)<br/>- [Windows 10/11 Business](../../business-premium/m365bp-upgrade-windows-10-pro.md) (upgrade from previous versions of Windows Pro)<br/>- [Windows Autopilot](/mem/autopilot/windows-autopilot) (for setting up and configuring Windows devices)<br/>- [Exchange Online Protection](../office-365-security/eop-about.md) (antiphishing, antispam, antimalware, and spoof intelligence for email)<br/>- [Microsoft Defender for Office 365 Plan 1](/microsoft-365/security/office-365-security/defender-for-office-365) (advanced antiphishing, real-time detections, Safe Attachments, and Safe Links)<br/>- [Auto-expanding archiving](../../compliance/autoexpanding-archiving.md) (for email)<br/>- [Azure Active Directory Premium Plan 1](/azure/active-directory/fundamentals/active-directory-whatis) (identity management)<br/>- [Azure Information Protection Premium Plan 1](/azure/information-protection/what-is-information-protection) (protection for sensitive information)<br/>- [Azure Virtual Desktop](/azure/virtual-desktop/overview) (centrally managed, secure virtual machines in the cloud) | -(<a id="fna">a</a>) Microsoft Intune is required to modify or customize attack surface reduction rules. Intune can be added on to the standalone version of Defender for Business. Intune is included in Microsoft 365 Business Premium. --(<a id="fnb">b</a>) Microsoft Intune is required to onboard iOS and Android devices. See [Onboard devices to Microsoft Defender for Business](mdb-onboard-devices.md). +> [!NOTE] +> 1. Microsoft Intune is required to modify or customize attack surface reduction rules. Intune can be added on to the standalone version of Defender for Business. Intune is included in Microsoft 365 Business Premium. +> +> 2. You can use *either* mobile threat defense (preview) *or* Microsoft Intune to onboard iOS and Android devices. See [Onboard devices to Microsoft Defender for Business](mdb-onboard-devices.md). ## Compare Defender for Business to Defender for Endpoint Plan 1 and Plan 2 Defender for Business brings the enterprise-grade capabilities of Defender for E |Feature/capability|[Defender for Business](mdb-overview.md)<br/>(standalone)|[Defender for Endpoint Plan 1](../defender-endpoint/defender-endpoint-plan-1.md)<br/>(for enterprise customers) |[Defender for Endpoint Plan 2](../defender-endpoint/microsoft-defender-endpoint.md)<br/>(for enterprise customers) | |||||-|[Centralized management](../defender-endpoint/manage-atp-post-migration.md) <sup>[[1](#fn1)]</sup> | :::image type="icon" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| +|[Centralized management](../defender-endpoint/manage-atp-post-migration.md)<br/>(see note 1 below) | :::image type="icon" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| |[Simplified client configuration](mdb-simplified-configuration.md)|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| | | |[Microsoft Defender Vulnerability Management](../defender-endpoint/next-gen-threat-and-vuln-mgt.md)|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|-|[Attack surface reduction capabilities](../defender-endpoint/overview-attack-surface-reduction.md) <sup>[[2](#fn2)]</sup>|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| +|[Attack surface reduction capabilities](../defender-endpoint/overview-attack-surface-reduction.md) <br/>(see note 2 below)|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| |[Next-generation protection](../defender-endpoint/next-generation-protection.md)|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|-|[Endpoint detection and response](../defender-endpoint/overview-endpoint-detection-response.md) <sup>[[3](#fn3)]</sup>|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| -|[Automated investigation and response](../defender-endpoint/automated-investigations.md) <sup>[[4](#fn4)]</sup>|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: ||:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| -|[Threat hunting](../defender-endpoint/advanced-hunting-overview.md) and six months of data retention <sup>[[5](#fn5)]</sup> | | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| -|[Threat analytics](../defender-endpoint/threat-analytics.md) <sup>[[6](#fn6)]</sup>|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| -|[Cross-platform support](../defender-endpoint/minimum-requirements.md) <br/>(Windows, Mac, iOS, and Android OS) <sup>[[7](#fn7)]</sup>|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| +|[Endpoint detection and response](../defender-endpoint/overview-endpoint-detection-response.md) <br/>(see note 3 below) |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| +|[Automated investigation and response](../defender-endpoint/automated-investigations.md) <br/>(see note 4 below) |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: ||:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| +|[Threat hunting](../defender-endpoint/advanced-hunting-overview.md) and six months of data retention | | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| +|[Threat analytics](../defender-endpoint/threat-analytics.md) <br/>(see note 5 below) |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| +|[Cross-platform support](../defender-endpoint/minimum-requirements.md) <br/>Windows, Mac, iOS, and Android OS<br/>(For Windows Server and Linux, see note 6 below) |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| |[Microsoft Threat Experts](../defender-endpoint/microsoft-threat-experts.md)| | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| |Partner APIs|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| |[Microsoft 365 Lighthouse integration](../../lighthouse/m365-lighthouse-overview.md) <br/>(For viewing security incidents across customer tenants) |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: | -(<a id="fn1">1</a>) Onboard and manage devices in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) or by using Microsoft Intune ([https://intune.microsoft.com](https://intune.microsoft.com)). --(<a id="fn2">2</a>) Intune is required to configure and manage [ASR rules](../defender-endpoint/attack-surface-reduction.md). --(<a id="fn3">3</a>) Endpoint detection and response (EDR) capabilities in Defender for Business include behavior-based detection and the following manual response actions: -- Run antivirus scan-- Isolate device-- Add an indicator to block or allow a file--(<a id="fn4">4</a>) In Defender for Business, automated investigation and response is turned on by default, tenant wide. Turning off automated investigation and response affects real-time protection. See [Review settings for advanced features](mdb-configure-security-settings.md#review-settings-for-advanced-features). +> [!NOTE] +> 1. Onboard and manage devices in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) or by using Microsoft Intune ([https://intune.microsoft.com](https://intune.microsoft.com)). +> +> 2. Intune is required to configure and manage [ASR rules](../defender-endpoint/attack-surface-reduction.md). +> +> 3. Endpoint detection and response (EDR) capabilities in Defender for Business include behavior-based detection and the following manual response actions: +> +> - Run antivirus scan +> - Isolate device +> - Add an indicator to block or allow a file +> +> 4. In Defender for Business, automated investigation and response is turned on by default, tenant wide. Turning off automated investigation and response affects real-time protection. See [Review settings for advanced features](mdb-configure-security-settings.md#review-settings-for-advanced-features). +> +> 5. In Defender for Business, threat analytics are optimized for small and medium-sized businesses. +> +> 6. To onboard servers, another license is required. See the following articles: +> +> - [Onboard devices to Defender for Business](mdb-onboard-devices.md) +> - [Onboard devices and configure Microsoft Defender for Endpoint capabilities](../defender-endpoint/onboard-configure.md) -(<a id="fn5">5</a>) There's no timeline view in Defender for Business. --(<a id="fn6">6</a>) In Defender for Business, threat analytics are optimized for small and medium-sized businesses. --(<a id="fn7">7</a>) To onboard servers, another license is required. See the following articles: -- [Onboard devices to Defender for Business](mdb-onboard-devices.md)-- [Onboard devices and configure Microsoft Defender for Endpoint capabilities](../defender-endpoint/onboard-configure.md)--> [!TIP] -> Also see [Compare Microsoft endpoint security plans](../defender-endpoint/defender-endpoint-plan-1-2.md) and [Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance). ## Next steps |
| security | Get Defender Business Servers | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/get-defender-business-servers.md | |
| security | Mdb Create Edit Device Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-create-edit-device-groups.md | |
| security | Mdb Custom Rules Firewall | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-custom-rules-firewall.md | |
| security | Mdb Email Notifications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-email-notifications.md | |
| security | Mdb Firewall | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-firewall.md | |
| security | Mdb Get Help | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-get-help.md | |
| security | Mdb Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-get-started.md | |
| security | Mdb Lighthouse Integration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-lighthouse-integration.md | |
| security | Mdb Manage Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-manage-devices.md | In Defender for Business, you can manage devices as follows: ## View the list of onboarded devices 1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in. |
| security | Mdb Mtd | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-mtd.md | + + Title: Mobile threat defense capabilities in Microsoft Defender for Business +description: Get an overview of mobile threat defense in Defender for Business. Learn about what's included and how to onboard devices. +++ Last updated : 03/23/2023++++ms.localizationpriority: medium ++- SMB +- m365-security +- m365-initiative-defender-business +- tier1 ++search.appverid: MET150 +f1.keywords: NOCSH +audience: Admin +++# Mobile threat defense capabilities in Microsoft Defender for Business ++Microsoft Defender for Business provides advanced threat protection capabilities for devices, such as Windows and Mac clients. **Defender for Business capabilities now include mobile threat defense (preview)**! Mobile threat defense capabilities help protect Android and iOS devices, without requiring you to use Microsoft Intune to onboard mobile devices. ++In addition, mobile threat defense capabilities integrate with [Microsoft 365 Lighthouse](../../lighthouse/m365-lighthouse-overview.md), where Cloud Solution Providers (CSPs) can view information about vulnerable devices and help mitigate detected threats. ++## What's included in mobile threat defense? ++The following table summarizes the capabilities that are included in mobile threat defense (preview) in Defender for Business: ++| Capability | Android | iOS | +|:|:|:| +| **Web Protection** <br/>Anti-phishing, blocking unsafe network connections, and support for custom indicators. <br/>Web protection is turned on by default with [web content filtering](mdb-configure-security-settings.md#set-up-web-content-filtering). | :::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included checkmark."::: | :::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included checkmark."::: | +| **Malware protection** (Android-only) <br/>Scanning for malicious apps. | :::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included checkmark."::: | No | +| **Jailbreak detection** (iOS-only) <br/>Detection of jailbroken devices. | No | :::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included checkmark."::: | +| **Microsoft Defender Vulnerability Management**<br/>Vulnerability assessment of onboarded mobile devices. Includes vulnerability assessments for operating systems and apps for Android and iOS. <br/>See [Use your vulnerability management dashboard in Microsoft Defender for Business](mdb-view-tvm-dashboard.md). | :::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included checkmark."::: | See note 1 (below) | +| **Network Protection** <br/>Protection against rogue Wi-Fi related threats and rogue certificates. <br/>Network protection is turned on by default with [next-generation protection](mdb-configure-security-settings.md#view-or-edit-your-next-generation-protection-policies). <br/>As part of mobile threat defense, network protection also includes the ability to allow root certification authority and private root certification authority certificates in Intune. It also establishes trust with endpoints. | See note 2 (below) | See note 2 (below) | +| **Unified alerting** <br/>Alerts from all platforms are listed in the unified Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). In the navigation pane, choose **Incidents**). <br/>See [View and manage incidents in Microsoft Defender for Business](mdb-view-manage-incidents.md) | :::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included checkmark."::: | :::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included checkmark."::: | +| **Conditional Access** and **conditional launch** <br/>[Conditional Access](/mem/intune/protect/conditional-access) and [conditional launch](/mem/intune/apps/app-protection-policies-access-actions) block risky devices from accessing corporate resources.<br/>- Conditional Access policies require certain criteria to be met before a user can access company data on their mobile device. <br/>- Conditional launch policies enable your security team to block access or wipe devices that don't meet certain criteria.<br/>Defender for Business risk signals can also be added to app protection policies. | Requires Intune <br/>(see note 3 below) | Requires Intune <br/>(see note 3 below) | +| **Privacy controls** <br/>Configure privacy in threat reports by controlling the data sent by Defender for Business. Privacy controls are available for admin and end users, and for both enrolled and unenrolled devices. | Requires Intune (see note 3 below) | Requires Intune (see note 3 below) | +| **Integration with Microsoft Tunnel** <br/>Integration with [Microsoft Tunnel](/mem/intune/protect/microsoft-tunnel-overview), a VPN gateway solution for Intune. | Requires Intune VPN Tunnel <br/>(see note 4 below) | Requires Intune VPN Tunnel <br/>(see note 4 below) | ++> [!NOTE] +> 1. Intune is required for software/app vulnerabilities to be reported. Operating system vulnerabilities are included by default. +> +> 2. Intune is required to configure or manage an allow list of root certification authority and private root certification authority certificates. +> +> 3. Intune is included in [Microsoft 365 Business Premium](../../business-premium/index.md). Intune can be added on to Defender for Business. +> +> 4. See [Prerequisites for the Microsoft Tunnel in Intune](/mem/intune/protect/microsoft-tunnel-prerequisites). +> ++## How to get mobile threat defense capabilities ++Mobile threat defense capabilities are currently in preview for [Defender for Business](get-defender-business.md) customers. Here's how to get these capabilities for your organization: ++1. Make sure your organization has signed up to receive preview features for your tenant. See [Microsoft Defender for Business preview features](mdb-preview.md). ++2. Make sure that Defender for Business has finished provisioning. In the [Microsoft 365 Defender portal](https://security.microsoft.com), go to **Assets** > **Devices**. ++ - If you see a message that says, "Hang on! We're preparing new spaces for your data and connecting them," it means that Defender for Business hasn't finished provisioning. This process is happening now, and can take up to 24 hours to complete. + - If you see a list of devices, or you're prompted to onboard devices, it means Defender for Business provisioning has completed. ++3. Review, and if necessary, edit your [next-generation protection policies](mdb-configure-security-settings.md#view-or-edit-your-next-generation-protection-policies). ++4. Review, and if necessary, edit your [firewall policies and custom rules](mdb-configure-security-settings.md#view-or-edit-your-firewall-policies-and-custom-rules). ++5. Review, and if necessary, edit your [web content filtering](mdb-configure-security-settings.md#set-up-web-content-filtering) policy. ++6. To onboard mobile devices, see the "Use the Microsoft Defender app" procedures in [Onboard devices to Microsoft Defender for Business](mdb-onboard-devices.md). ++## See also ++- [Set up and configure Microsoft Defender for Business](mdb-setup-configuration.md) +- [View and edit security policies and settings in Microsoft Defender for Business](mdb-configure-security-settings.md) +- [What's new in Microsoft 365 Business Premium and Microsoft Defender for Business](../../business-premium/m365bp-mdb-whats-new.md) |
| security | Mdb Next Gen Configuration Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-next-gen-configuration-settings.md | |
| security | Mdb Offboard Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-offboard-devices.md | |
| security | Mdb Onboard Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-onboard-devices.md | Onboard your business devices to protect them right away. You can choose from se 1. Select a tab: - **Windows 10 and 11** - **Mac**- - **Servers** (NEW! Windows Server or Linux Server) - - **Mobile** (for iOS/iPadOS or Android devices) + - **Mobile** (new capabilities are in preview for iOS and Android devices!) + - **Servers** (Windows Server or Linux Server) 2. View your onboarding options, and follow the guidance on the selected tab.-3. Proceed to your next steps. +3. [View a list of onboarded devices](#view-a-list-of-onboarded-devices). +4. [Run a phishing test on a device](#run-a-phishing-test-on-a-device). +5. Proceed to your [next steps](#next-steps). ## [**Windows 10 and 11**](#tab/Windows10and11) Onboard your business devices to protect them right away. You can choose from se > - Windows 10 or 11 Professional > - Windows 10 or 11 Enterprise > -> For more details, see [Microsoft Defender for Business requirements](mdb-requirements.md). +> For more information, see [Microsoft Defender for Business requirements](mdb-requirements.md). > Choose one of the following options to onboard Windows client devices to Defender for Business: After you've onboarded Windows devices to Defender for Business, you can run a d powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference = 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\test-MDATP-test\\invoice.exe');Start-Process 'C:\\test-MDATP-test\\invoice.exe' ``` -After the command runs, the Command Prompt window will close automatically. If successful, the detection test will be marked as completed, and a new alert will appear in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) for the newly onboarded device in about 10 minutes. +After the command runs, the Command Prompt window closes automatically. If successful, the detection test is marked as completed, and a new alert appears in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) for the newly onboarded device within about 10 minutes. ## [**Mac**](#tab/mac) Choose one of the following options to onboard Mac: ### Local script for Mac -When you run the local script on Mac: --- It creates a trust with Azure Active Directory if that trust doesn't already exist.-- It enrolls the Mac in Microsoft Intune if it isn't already enrolled, and then onboards the Mac to Defender for Business. -- We recommend that you onboard up to 10 devices at a time using this method.+When you run the local script on Mac, it creates a trust with Azure Active Directory if that trust doesn't already exist. It enrolls the Mac in Microsoft Intune if it isn't already enrolled, and then onboards the Mac to Defender for Business. We recommend that you onboard up to 10 devices at a time using this method. 1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), and sign in. When you run the local script on Mac: 8. Select **Continue**, agree with the license terms, and then enter your password when prompted. -9. You'll be prompted to allow installation of a driver from Microsoft (either "System Extension Blocked" or "Installation is on hold", or both). You must allow the driver installation: Select **Open Security Preferences** or **Open System Preferences** > **Security & Privacy**, and then select **Allow**. +9. You're prompted to allow installation of a driver from Microsoft (either "System Extension Blocked" or "Installation is on hold", or both). You must allow the driver installation: Select **Open Security Preferences** or **Open System Preferences** > **Security & Privacy**, and then select **Allow**. 10. Use the following Bash command to run the onboarding package: If your business prefers to have people enroll their own devices in Intune, dire After a device is enrolled in Intune, you can add it to a device group. [Learn more about device groups in Defender for Business](mdb-create-edit-device-groups.md). +## [**Mobile devices**](#tab/mobiles) ++## Mobile devices ++You can use the following methods to onboard mobile devices, such as Android and iOS devices: ++- [Use the Microsoft Defender app (preview)](#use-the-microsoft-defender-app-preview) +- [Use Microsoft Intune](#use-microsoft-intune) ++### Use the Microsoft Defender app (preview) ++[Mobile threat defense capabilities](mdb-mtd.md) are now available to Defender for Business customers who have opted in to receive [preview](mdb-preview.md) features. With these capabilities, you can now onboard mobile devices (such as Android and iOS) by using the Microsoft Defender app. With this method, users download the app from Google Play or the Apple App Store, sign in, and complete onboarding steps. ++> [!IMPORTANT] +> Make sure that all of the following requirements are met before onboarding mobile devices: +> 1. Your organization has signed up to receive preview features for your tenant. See [Microsoft Defender for Business preview features](mdb-preview.md). +> 2. Defender for Business has finished provisioning. In the [Microsoft 365 Defender portal](https://security.microsoft.com), go to **Assets** > **Devices**.<br/>- If you see a message that says, "Hang on! We're preparing new spaces for your data and connecting them," it means that Defender for Business hasn't finished provisioning. This process is happening now, and can take up to 24 hours to complete. <br/>- If you see a list of devices, or you're prompted to onboard devices, it means Defender for Business provisioning has completed. +> 3. Users have downloaded the Microsoft Authenticator app on their device, and have registered their device using their work or school account for Microsoft 365. ++| Device | Procedure | +|:|:| +| Android | 1. On the device, go to the Google Play store.<br/><br/>2. If you haven't already done so, download and install the Microsoft Authenticator app. Sign in, and register your device in the Microsoft Authenticator app. <br/><br/>3. In the Google Play store, search for the Microsoft Defender app. <br/><br/>4. On the app page, scroll down and select **Join the beta** > **Join**.<br/><br/>5. Wait for the process to complete. It might take a few hours for the process of joining the beta program to complete. You'll see text that says, “Joining the beta…”<br/><br/>6. After you've enrolled into the beta, verify that the beta version of the app looks like `1.0.xxxx.0201`, and then install the app.<br/><br/>7. Open the app, sign in, and complete the onboarding process. | +| iOS | 1. On the device, go to the Apple App Store. <br/><br/>2. If you haven't already done so, download and install the Microsoft Authenticator app. Sign in, and register your device in the Microsoft Authenticator app.<br/><br/>3. In the Apple App Store, search for the Microsoft Defender app.<br/><br/>4. Sign in and install the app. <br/><br/>5. Agree to the terms of use to continue. <br/><br/>6. Allow the Microsoft Defender app to set up a VPN connection and add VPN configurations. <br/><br/>7. Choose whether to allow notifications (such as alerts). | ++> [!TIP] +> After you have onboarded mobile devices using the Microsoft Defender app, proceed to [run a phishing test on a device](#run-a-phishing-test-on-a-device). ++### Use Microsoft Intune ++If your subscription includes Microsoft Intune, you can use it to onboard mobile devices, such as Android and iOS/iPadOS devices. See the following resources to get help enrolling these devices into Intune: ++- [Enroll Android devices](/mem/intune/enrollment/android-enroll) +- [Enroll iOS or iPadOS devices](/mem/intune/enrollment/ios-enroll) ++After a device is enrolled in Intune, you can add it to a device group. [Learn more about device groups in Defender for Business](mdb-create-edit-device-groups.md). ++> [!NOTE] +> The standalone version of Defender for Business does not include the Intune license that is required to onboard iOS and Android devices in the Intune admin center. However, if your tenant is receiving [preview features](mdb-preview.md), you can now use the [Microsoft Defender app method](#use-the-microsoft-defender-app-preview). Or, you can add Intune to your Defender for Business subscription. Intune is included in Microsoft 365 Business Premium. + ## [**Servers**](#tab/Servers) ## Servers You can onboard an instance of Windows Server to Defender for Business by using 3. Select an operating system, such as **Windows Server 1803, 2019, and 2022**, and then in the **Deployment method** section, choose **Local script**. - If you select **Windows Server 2012 R2 and 2016**, you'll have two packages to download and run: an installation package and an onboarding package. The installation package contains an MSI file that installs the Defender for Business agent. The onboarding package contains the script to onboard your Windows Server endpoint to Defender for Business. + If you select **Windows Server 2012 R2 and 2016**, you have two packages to download and run: an installation package and an onboarding package. The installation package contains an MSI file that installs the Defender for Business agent. The onboarding package contains the script to onboard your Windows Server endpoint to Defender for Business. 4. Select **Download onboarding package**. We recommend that you save the onboarding package to a removable drive. After you onboard your Windows Server endpoint to Defender for Business, you can powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference = 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\test-MDATP-test\\invoice.exe');Start-Process 'C:\\test-MDATP-test\\invoice.exe' ``` -After the command runs, the Command Prompt window will close automatically. If successful, the detection test will be marked as completed, and a new alert will appear in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) for the newly onboarded device in about 10 minutes. +After the command runs, the Command Prompt window will close automatically. If successful, the detection test is marked as completed, and a new alert appears in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) for the newly onboarded device within about 10 minutes. ## Linux Server You can use the following methods to onboard an instance of Linux Server to Defe > [!NOTE] > Onboarding an instance of Linux Server to Defender for Business is the same as onboarding to [Microsoft Defender for Endpoint on Linux](../defender-endpoint/microsoft-defender-endpoint-linux.md). -## [**Mobile devices**](#tab/mobiles) --## Mobile devices + -Use Microsoft Intune to onboard mobile devices, such as Android and iOS/iPadOS devices. See the following resources to get help enrolling these devices into Intune: +## View a list of onboarded devices -- [Enroll Android devices](/mem/intune/enrollment/android-enroll)-- [Enroll iOS or iPadOS devices](/mem/intune/enrollment/ios-enroll)+To view the list of devices that are onboarded to Defender for Business, go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). In the navigation pane, go to **Assets** > **Devices**. -After a device is enrolled in Intune, you can add it to a device group. [Learn more about device groups in Defender for Business](mdb-create-edit-device-groups.md). +## Run a phishing test on a device -> [!NOTE] -> The standalone version of Defender for Business does not include the Intune license that is required to onboard iOS and Android devices. You can add Intune to your Defender for Business subscription to onboard mobile devices. Intune is included in Microsoft 365 Business Premium. +After you've onboarded a device, you can run a quick phishing test to make sure the device is connected and that alerts are generated as expected. -+1. On a device, go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net). Defender for Business should block that URL on the user's device. -## View a list of onboarded devices +2. As a member of your organization's security team, go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in. -To view the list of devices that are onboarded to Defender for Business, go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). In the navigation pane, go to **Assets** > **Devices**. +3. In the navigation pane, go to **Incidents**. You should see an informational alert that indicates a device tried to access a phishing site. ## Next steps |
| security | Mdb Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-overview.md | Watch the following video to learn more about Defender for Business: <br/><br/> > [!VIDEO https://www.youtube.com/embed/umhUNzMqZto] -## What's included with Defender for Business +## What's included with Defender for Business? ++Defender for Business includes a full range of device protection capabilities, as shown in the following diagram: :::image type="content" source="media/mdb-offering-overview.png" alt-text="Defender for Business features and capabilities."::: With Defender for Business, you can help protect the devices and data your busin - [Try scenarios, tutorials, and simulations](mdb-tutorials.md). - **Provide guidance on managing devices and security policies**.+ - [Learn about new mobile threat defense capabilities (preview)](mdb-mtd.md). - [Monitor or manage devices](mdb-manage-devices.md). - [View or edit security policies](mdb-view-edit-policies.md). |
| security | Mdb Partners | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-partners.md | |
| security | Mdb Policy Order | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-policy-order.md | |
| security | Mdb Preview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-preview.md | |
| security | Mdb Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-reports.md | -Several reports are available in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). This article describes these reports, how you can use them, and how to find them. --## Reports in Defender for Business --|Report |Description | -||| -| **License report**<br/>(*NEW!*) | The license report provides information about licenses your organization has purchased and is using. To access this report, in the navigation pane, choose **Settings** > **Endpoints** > **Licenses**. | -| **Security report** | The security report provides information about your company's identities, devices, and apps. To access this report, in the navigation pane, choose **Reports** > **General** > **Security report**. <br/><br/>You can view similar information on the home page of your Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). | -| **Threat protection** | The threat protection report provides information about alerts and alert trends. Use the **Alert trends** column to view information about alerts that were triggered over the last 30 days. Use the **Alert status** column to view current snapshot information about alerts, such as categories of unresolved alerts and their classification. To access this report, in the navigation pane, choose **Reports** > **Endpoints** > **Threat protection**. <br/><br/>You can also use the **Incidents** list to view information about alerts. In the navigation pane, choose **Incidents** to view and manage current incidents. To learn more, see [View and manage incidents in Defender for Business](mdb-view-manage-incidents.md). | -| **Device health** | The device health report provides information about device health and trends. You can use this report to determine whether Defender for Business sensors are working correctly on devices and the current status of Microsoft Defender Antivirus. To access this report, in the navigation pane, choose **Reports** > **Endpoints** > **Device health**. <br/><br/>You can use the **Devices** list to view information about your company's devices. In the navigation pane, go to **Assets** > **Devices**. To learn more, see [Manage devices in Defender for Business](mdb-manage-devices.md). | -| **Vulnerable devices** | The vulnerable devices report provides information about devices and trends. Use the **Trends** column to view information about devices that had alerts over the last 30 days. Use the **Status** column to view current snapshot information about devices that have alerts. To access this report, in the navigation pane, choose **Reports** > **Endpoints** > **Vulnerable devices**.<br/><br/>You can use the **Devices** list to view information about your company's devices. In the navigation pane, go to **Assets** > **Devices**. To learn more, see [Manage devices in Defender for Business](mdb-manage-devices.md). | -| **Web protection** | The web protection report shows attempts to access phishing sites, malware vectors, exploit sites, untrusted or low-reputation sites, and sites that are explicitly blocked. Categories of blocked sites include adult content, leisure sites, legal liability sites, and more. To access this report, in the navigation pane, choose **Reports** > **Endpoints** > **Web protection**.<br/><br/>If you haven't yet configured web protection for your company, choose the **Settings** button in a report view. Then, under **Rules**, choose **Web content filtering**. To learn more about web content filtering, see [Web content filtering](../defender-endpoint/web-content-filtering.md). | -| **Firewall** | The firewall report shows blocked inbound, outbound, and app connections. This report also shows remote IPs connected by multiple devices, and remote IPs with the most connection attempts. <br/><br/>If you haven't yet configured your firewall protection, in the navigation pane, choose **Endpoints** > **Configuration management** > **Device configuration**. To learn more, see [Firewall in Defender for Business](mdb-firewall.md). | -| **Device control** | The device control report shows information about media usage, such as the use of removable storage devices in your organization. | -| **Attack surface reduction rules** <br/>*(NEW!)* | The attack surface reduction rules report has three tabs: **Detections** (to show blocked or audited detections); **Configuration** (enabling you to filter on standard protection rules or additional ASR rules); and **Add exclusions** (enabling you to define exclusions, if needed). To access this report, in the navigation pane, choose **Reports** > **Endpoints** > Attack surface reduction rules**. <br/><br/>To learn more, see [Attack surface reduction capabilities in Microsoft Defender for Business](mdb-asr.md). | +Several reports are available in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). These reports enable your security team to view information about detected threats, device status, and more. ++This article describes these reports, how you can use them, and how to find them. ++## Monthly security summary (preview) +++The monthly security summary report (currently in preview) shows: ++- Threats that were detected and prevented by Defender for Business, so you can see how the service is working for you. +- Your current status from [Microsoft Secure Score](../defender/microsoft-secure-score.md), which gives you an indication of your organization's security posture. +- Recommended actions you can take to improve your score and your security posture. ++To access this report, in the navigation pane, choose **Reports** > **Endpoints** > **Monthly Security Summary**. ++## License report +++The license report provides information about licenses your organization has purchased and is using. ++To access this report, in the navigation pane, choose **Settings** > **Endpoints** > **Licenses**. ++## Security report +++The security report provides information about your company's identities, devices, and apps. ++To access this report, in the navigation pane, choose **Reports** > **General** > **Security report**. ++> [!TIP] +> You can view similar information on the home page of your Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). ++## Threat protection report +++The threat protection report provides information about alerts and alert trends. ++- Use the **Alert trends** column to view information about alerts that were triggered over the last 30 days. +- Use the **Alert status** column to view current snapshot information about alerts, such as categories of unresolved alerts and their classification. ++To access this report, in the navigation pane, choose **Reports** > **Endpoints** > **Threat protection**. ++## Incidents view +++You can use the **Incidents** list to view information about alerts. To learn more, see [View and manage incidents in Defender for Business](mdb-view-manage-incidents.md). ++To access this report, in the navigation pane, choose **Incidents** to view and manage current incidents. ++## Device health report +++The device health report provides information about device health and trends. You can use this report to determine whether Defender for Business sensors are working correctly on devices and the current status of Microsoft Defender Antivirus. ++To access this report, in the navigation pane, choose **Reports** > **Endpoints** > **Device health**. ++## Device inventory list +++You can use the **Devices** list to view information about your company's devices. To learn more, see [Manage devices in Defender for Business](mdb-manage-devices.md). ++To access this report, in the navigation pane, go to **Assets** > **Devices**. ++## Vulnerable devices report +++The vulnerable devices report provides information about devices and trends. ++- Use the **Trends** column to view information about devices that had alerts over the last 30 days. +- Use the **Status** column to view current snapshot information about devices that have alerts. ++To access this report, in the navigation pane, choose **Reports** > **Endpoints** > **Vulnerable devices**. ++## Web protection report +++The web protection report shows attempts to access phishing sites, malware vectors, exploit sites, untrusted or low-reputation sites, and sites that are explicitly blocked. Categories of blocked sites include adult content, leisure sites, legal liability sites, and more. ++To access this report, in the navigation pane, choose **Reports** > **Endpoints** > **Web protection**. ++> [!NOTE] +> If you haven't yet configured web protection for your company, choose the **Settings** button in a report view. Then, under **Rules**, choose **Web content filtering**. To learn more about web content filtering, see [Web content filtering](../defender-endpoint/web-content-filtering.md). ++## Firewall report +++When firewall protection is configured, the firewall report shows blocked inbound, outbound, and app connections. This report also shows remote IPs connected by multiple devices, and remote IPs with the most connection attempts. ++To access this report, in the navigation pane, choose **Reports** > **Endpoints** > **Firewall**. ++> [!NOTE] +> If your firewall report has no data, it might be because you haven't configured your firewall protection yet. In the navigation pane, choose **Endpoints** > **Configuration management** > **Device configuration**. To learn more, see [Firewall in Defender for Business](mdb-firewall.md). ++## Device control report +++The device control report shows information about media usage, such as the use of removable storage devices in your organization. ++To access this report, in the navigation pane, choose **Reports** > **Endpoints** > **Device control**. ++## Attack surface reduction rules report +++The attack surface reduction rules report has three tabs: ++- **Detections** to show blocked or audited detections; +- **Configuration** enabling you to filter on standard protection rules or additional attack surface reduction rules; and +- **Add exclusions** enabling you to define exclusions, if needed. ++To learn more, see [Attack surface reduction capabilities in Microsoft Defender for Business](mdb-asr.md). ++To access this report, in the navigation pane, choose **Reports** > **Endpoints** > **Attack surface reduction rules**. ## See also |
| security | Mdb Requirements | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-requirements.md | The following table lists the basic requirements you need to configure and use D | Requirement | Description | |:|:|-| Subscription | Microsoft 365 Business Premium or Defender for Business (standalone). See [How to get Defender for Business](get-defender-business.md). | +| Subscription | Microsoft 365 Business Premium or Defender for Business (standalone). <br/>See [How to get Defender for Business](get-defender-business.md). | | Datacenter | One of the following datacenter locations: <br/>- European Union <br/>- United Kingdom <br/>- United States | | User accounts | - User accounts are created in the Microsoft 365 admin center ([https://admin.microsoft.com](https://admin.microsoft.com)). <br/>- Licenses for Defender for Business (or Microsoft 365 Business Premium) are assigned in the Microsoft 365 admin center.<br/><br/>To get help with this task, see [Add users and assign licenses](mdb-add-users.md). | | Permissions | To sign up for Defender for Business, you must be a Global Admin.<br/><br/>To access the Microsoft 365 Defender portal, users must have one of the following [roles in Azure AD](mdb-roles-permissions.md) assigned: <br/>- Security Reader <br/>- Security Admin <br/>- Global AdminTo learn more, see [Roles and permissions in Defender for Business](mdb-roles-permissions.md). |-| Browser requirements | Microsoft Edge or Google Chrome | -| Client device operating system | To manage devices in the Microsoft 365 Defender portal, your devices must be running one of the following operating systems: <br/>- Windows 10 or 11 Business <br/>- Windows 10 or 11 Professional <br/>- Windows 10 or 11 Enterprise <br/>- Mac (the three most-current releases are supported) <br/><br/>Make sure that [KB5006738](https://support.microsoft.com/topic/october-26-2021-kb5006738-os-builds-19041-1320-19042-1320-and-19043-1320-preview-ccbce6bf-ae00-4e66-9789-ce8e7ea35541) is installed on the Windows devices. <br/><br/>If you're already managing devices in Microsoft Intune, you can continue to use it.<sup>[[1](#fn1)]</sup> In that case, the following other operating systems are supported: <br/>- iOS and iPadOS <br/>- Android OS | -| Server requirements | To onboard a device running Windows Server or Linux Server, you'll need an additional license, such as [Microsoft Defender for Business servers](get-defender-business-servers.md) <sup>[[2](#fn2)]</sup>.<br/><br/>Windows Server endpoints must meet the [requirements for Defender for Endpoint](/microsoft-365/security/defender-endpoint/minimum-requirements#hardware-and-software-requirements), and enforcement scope must be turned on.<br/>1. In the Microsoft 365 Defender portal, go to **Settings** > **Endpoints** > **Configuration management** > **Enforcement scope**. <br/>2. Select **Use MDE to enforce security configuration settings from MEM**, select **Windows Server**. <br/>3. Select **Save**.<br/><br/>Linux Server endpoints must meet the [prerequisites for Microsoft Defender for Endpoint on Linux](../defender-endpoint/microsoft-defender-endpoint-linux.md#prerequisites).| --(<a id="fn1">1</a>) Microsoft Intune is not included in the standalone version of Defender for Business. Intune can be added onto Defender for Business. Intune is included in Microsoft 365 Business Premium. --(<a id="fn2">2</a>) To onboard servers, we recommend using [Microsoft Defender for Business servers](get-defender-business-servers.md). Alternately, you could use [Microsoft Defender for Servers Plan 1 or Plan 2](/azure/defender-for-cloud/plan-defender-for-servers). To learn more, see [What happens if I have a mix of Microsoft endpoint security subscriptions?](mdb-faq.yml#what-happens-if-i-have-a-mix-of-microsoft-endpoint-security-subscriptions) and [Onboard devices to Microsoft Defender for Business](mdb-onboard-devices.md). +| Browser | Microsoft Edge or Google Chrome | +| Client computer operating system | To manage devices in the Microsoft 365 Defender portal, your devices must be running one of the following operating systems: <br/>- Windows 10 or 11 Business <br/>- Windows 10 or 11 Professional <br/>- Windows 10 or 11 Enterprise <br/>- Mac (the three most-current releases are supported) <br/><br/>Make sure that [KB5006738](https://support.microsoft.com/topic/october-26-2021-kb5006738-os-builds-19041-1320-19042-1320-and-19043-1320-preview-ccbce6bf-ae00-4e66-9789-ce8e7ea35541) is installed on the Windows devices. | +| Mobile devices | To onboard mobile devices, such as iOS or Android OS, you can use [Mobile threat defense capabilities (preview)](mdb-mtd.md) or Microsoft Intune (see note 1 below).<br/><br/>For more details about onboarding devices, including requirements for mobile threat defense (preview), see [Onboard devices to Microsoft Defender for Business](mdb-onboard-devices.md). | +| Server license | To onboard a device running Windows Server or Linux Server, you'll need an additional license, such as [Microsoft Defender for Business servers](get-defender-business-servers.md) (see note 2 below). | +| Additional server requirements | Windows Server endpoints must meet the [requirements for Defender for Endpoint](/microsoft-365/security/defender-endpoint/minimum-requirements#hardware-and-software-requirements), and enforcement scope must be turned on.<br/>1. In the Microsoft 365 Defender portal, go to **Settings** > **Endpoints** > **Configuration management** > **Enforcement scope**. <br/>2. Select **Use MDE to enforce security configuration settings from MEM**, select **Windows Server**. <br/>3. Select **Save**.<br/><br/>Linux Server endpoints must meet the [prerequisites for Microsoft Defender for Endpoint on Linux](../defender-endpoint/microsoft-defender-endpoint-linux.md#prerequisites). | > [!NOTE]-> [Azure Active Directory (Azure AD)](/azure/active-directory/fundamentals/active-directory-whatis) is used to manage user permissions and device groups. Azure AD is included in your Defender for Business subscription. -> - If you don't have a Microsoft 365 subscription before you start your trial, Azure AD will be provisioned for you during the activation process. -> - If you do have another Microsoft 365 subscription when you start your Defender for Business trial, you can use your existing Azure AD service. +> 1. Microsoft Intune is not included in the standalone version of Defender for Business, but Intune can be added on. Intune is included in Microsoft 365 Business Premium. +> +> 2. To onboard servers, we recommend using [Microsoft Defender for Business servers](get-defender-business-servers.md). Alternately, you could use [Microsoft Defender for Servers Plan 1 or Plan 2](/azure/defender-for-cloud/plan-defender-for-servers). To learn more, see [What happens if I have a mix of Microsoft endpoint security subscriptions?](mdb-faq.yml#what-happens-if-i-have-a-mix-of-microsoft-endpoint-security-subscriptions) and [Onboard devices to Microsoft Defender for Business](mdb-onboard-devices.md). +> +> 3. [Azure Active Directory (Azure AD)](/azure/active-directory/fundamentals/active-directory-whatis) is used to manage user permissions and device groups. Azure AD is included in your Defender for Business subscription. +> - If you don't have a Microsoft 365 subscription before you start your trial, Azure AD will be provisioned for you during the activation process. +> - If you do have another Microsoft 365 subscription when you start your Defender for Business trial, you can use your existing Azure AD service. > -> Security defaults are included in Defender for Business. If you prefer to use Conditional Access policies instead, you'll need Azure AD Premium Plan 1 (included in [Microsoft 365 Business Premium](../../business-premium/index.md)). To learn more, see [Multi-factor authentication](../../business-premium/m365bp-conditional-access.md). +> 4. Security defaults are included in Defender for Business. If you prefer to use Conditional Access policies instead, you'll need Azure AD Premium Plan 1 (included in [Microsoft 365 Business Premium](../../business-premium/index.md)). To learn more, see [Multi-factor authentication](../../business-premium/m365bp-conditional-access.md). ## Next steps |
| security | Mdb Respond Mitigate Threats | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-respond-mitigate-threats.md | The Microsoft 365 Defender portal enables your security team to respond to and m 3. Select a button or link on the card to view more information and take action. As an example, our **Devices at risk** card includes a **View details** button. Selecting that button takes us to the **Devices** list, as shown in the following image: - :::image type="content" source="../../medib-deviceinventory.png" alt-text="Screenshot of device inventory"::: + :::image type="content" source="../../medib-device-inventory.png" alt-text="Screenshot of device inventory"::: The **Devices** page lists company devices, along with their risk level and exposure level. |
| security | Mdb Roles Permissions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-roles-permissions.md | |
| security | Mdb Setup Configuration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-setup-configuration.md | |
| security | Mdb Simplified Configuration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-simplified-configuration.md | |
| security | Mdb Tutorials | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-tutorials.md | |
| security | Mdb Use Wizard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-use-wizard.md | |
| security | Mdb View Edit Create Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-view-edit-create-policies.md | |
| security | Mdb View Manage Incidents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-view-manage-incidents.md | |
| security | Mdb View Tvm Dashboard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-view-tvm-dashboard.md | |
| security | Add Or Remove Machine Tags | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/add-or-remove-machine-tags.md | Title: Add or Remove Machine Tags API + Title: Add or remove a tag for a machine description: Learn how to use the Add or Remove machine tags API to adds or remove a tag for a machine in Microsoft Defender for Endpoint. keywords: apis, graph api, supported apis, tags, machine tags search.appverid: met150 Last updated 02/24/2023 -# Add or remove machine tags API +# Add or remove a tag for a machine **Applies to:** Last updated 02/24/2023 ## API description -Adds or removes tag to a specific [Machine](machine.md). +Adds or removes a tag for a specific [Machine](machine.md). ## Limitations If successful, this method returns 200 - Ok response code and the updated Machin ## Example Request -Here is an example of a request that adds machine tag. +Here is an example of a request that adds a machine tag. ```http POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/tags |
| security | Add Or Remove Multiple Machine Tags | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/add-or-remove-multiple-machine-tags.md | + + Title: Add or remove a tag for multiple machines +description: Learn how to use the Add or Remove machine tags API to add or remove a tag for multiple devices in Microsoft Defender for Endpoint. +keywords: apis, graph api, supported apis, tags, machine tags ++ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++- m365-security +- tier3 ++++search.appverid: met150 Last updated : 02/24/2023+++# Add or remove a tag for multiple machines ++**Applies to:** ++- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) +- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) +++> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) ++++## API description ++Adds or removes a tag for the specified set of machines. ++## Limitations ++1. You can post on machines last seen according to your configured retention period. +2. Rate limitations for this API are 100 calls per minute and 1500 calls per hour. +3. We can add or remove tag a for up to 500 machines per API call. +++## Permissions ++One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Defender for Endpoint APIs](apis-intro.md). ++Permission type|Permission|Permission display name +:|:|: +Application|Machine.ReadWrite.All|'Read and write all machine information' +Delegated (work or school account)|Machine.ReadWrite|'Read and write machine information' ++> [!NOTE] +> When obtaining a token using user credentials: +> +> - The user needs to have at least the following role permission: 'Manage security setting'. For more (See [Create and manage roles](user-roles.md) for more information). +> - The user needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information). ++## HTTP request ++```http +POST https://api.securitycenter.microsoft.com/api/machines/AddOrRemoveTagForMultipleMachines +``` ++## Request headers ++Name|Type|Description +:|:|: +Authorization|String|Bearer {token}. **Required**. +Content-Type|string|application/json. **Required**. ++## Request body ++In the request body, supply a JSON object with the following parameters: ++Parameter|Type|Description +:|:|: +Value|String|The tag name. **Required**. +Action|Enum|Add or Remove. Allowed values are: 'Add' or 'Remove'. **Required**. +MachineIds|List (String)|List of machine ids to update. Required.| ++## Response ++If successful, this method returns 200 - Ok response code and the updated machines in the response body. ++## Example Request ++Here is an example of a request that adds a tag to multiple machines. ++```http +POST https://api.securitycenter.microsoft.com/api/machines/AddOrRemoveTagForMultipleMachines +``` ++```json +{ + "Value" : "Tag", + "Action": "Add", + "MachineIds": ["34e83ca3feea4dae2353006ba389262c033a025e", + "2a398439b4975924e87a65943972bc702469b329", + "a610c00c65fdf79960cc0077d9d8c569d23f09a5"] +} +``` ++To remove machine tags, set the Action to 'Remove' instead of 'Add' in the request body. |
| security | Deploy Manage Report Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deploy-manage-report-microsoft-defender-antivirus.md | Title: Deploy, manage, and report on Microsoft Defender Antivirus description: You can deploy and manage Microsoft Defender Antivirus with Intune, Microsoft Configuration Manager, Group Policy, PowerShell, or WMI keywords: deploy, manage, update, protection, Microsoft Defender Antivirus -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium Previously updated : 09/02/2022 Last updated : 03/23/2023 -+ search.appverid: met150 - Windows -You can deploy, manage, and report on Microsoft Defender Antivirus in many ways. +Microsoft Defender Antivirus is installed as a core part of Windows 10 and 11, and is included in Windows Server 2016 and later (Windows Server 2012 requires Microsoft Defender for Endpoint). You can manage and report on Microsoft Defender Antivirus using one of several tools, such as: -Because the Microsoft Defender Antivirus client is installed as a core part of Windows 10 and Windows 11, traditional deployment of a client to your endpoints doesn't apply. +- [Microsoft Intune](#microsoft-intune) +- [Configuration Manager](#configuration-manager) +- [PowerShell](#powershell) +- [Group Policy and Azure Active Directory](#powershell) +- [Windows Management Instrumentation](#windows-management-instrumentation) -However, in most cases you'll still need to enable the protection service on your endpoints with Microsoft Intune, Microsoft Configuration Manager, Microsoft Defender for Cloud, or Group Policy Objects, which is described in the following table. +This article describes these options for deployment, management, and reporting. -You'll also see other links for: +## Microsoft Intune -- Managing Microsoft Defender Antivirus protection, including managing product and protection updates-- Reporting on Microsoft Defender Antivirus protection+With Intune, you can manage device security through policies, such as a policy to configure Microsoft Defender Antivirus and other security capabilities in Defender for Endpoint. To learn more, see [Use policies to manage device security](/mem/intune/protect/endpoint-security#use-policies-to-manage-device-security). -> [!IMPORTANT] -> In most cases, Windows 10 or Windows 11 will disable Microsoft Defender Antivirus if it finds another antivirus product that is running and up-to-date. You must disable or uninstall third-party antivirus products before Microsoft Defender Antivirus will function. If you re-enable or install third-party antivirus products, then Windows 10 or Windows 11 automatically disables Microsoft Defender Antivirus. +For reporting, you can choose from several options: -| Tool|Deployment options (<a href="#fn2" id="ref2">2</a>)|Management options (network-wide configuration and policy or baseline deployment) ([3](#fn3))|Reporting options | -||| -| Microsoft Intune|[Add endpoint protection settings in Intune](/intune/endpoint-protection-configure)|[Configure device restriction settings in Intune](/intune/device-restrictions-configure)| [Use the Intune console to manage devices](/intune/device-management) -Microsoft Configuration Manager ([1](#fn1))|Use the [Endpoint Protection point site system role](/mem/configmgr/protect/deploy-use/endpoint-protection-site-role) and [enable Endpoint Protection with custom client settings](/mem/configmgr/protect/deploy-use/endpoint-protection-configure-client).|With [default and customized antimalware policies](/microsoft-365/security/office-365-security/anti-malware-policies-configure) and client management.|With the default [Configuration Manager Monitoring workspace](/mem/configmgr/apps/deploy-use/monitor-applications-from-the-console) and email alerts. | -| Group Policy and Active Directory (domain-joined)|Use a Group Policy Object to deploy configuration changes and ensure Microsoft Defender Antivirus is enabled.|Use Group Policy Objects (GPOs) to [configure update options for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/manage-protection-update-schedule-microsoft-defender-antivirus) and [configure Windows Defender features](/microsoft-365/security/defender-endpoint/configure-microsoft-defender-antivirus-features).|Endpoint reporting isn't available with Group Policy. You can generate a list of Group Policies to determine if any settings or policies aren't applied. | -| PowerShell|Deploy with Group Policy, Microsoft Configuration Manager, or manually on individual endpoints.|Use the [Set-MpPreference](/powershell/module/defender/set-mppreference) and [Update-MpSignature](/powershell/module/defender/update-mpsignature) cmdlets available in the Defender module.|Use the appropriate [Get- cmdlets available in the Defender module](/powershell/module/defender). | -| Windows Management Instrumentation|Deploy with Group Policy, Microsoft Configuration Manager, or manually on individual endpoints.|Use the [Set method of the MSFT_MpPreference class](/previous-versions/windows/desktop/defender/set-msft-mppreference) and the [Update method of the MSFT_MpSignature class](/previous-versions/windows/desktop/defender/update-msft-mpsignature).|Use the [MSFT_MpComputerStatus](/previous-versions/windows/desktop/defender/msft-mpcomputerstatus) class and the get method of associated classes in the [Windows Defender WMIv2 Provider](/windows/win32/wmisdk/wmi-providers). | -| Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by using Visual Studio virtual machine configuration, or using Azure PowerShell cmdlets](/azure/security/azure-security-antimalware#antimalware-deployment-scenarios). You can also [Install Endpoint protection in Microsoft Defender for Cloud](/azure/defender-for-cloud/endpoint-protection-recommendations-technical).|Configure [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) or [use code samples](https://gallery.technet.microsoft.com/Antimalware-For-Azure-5ce70efe).|Use [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) to enable monitoring. You can also review usage reports in Azure Active Directory to determine suspicious activity, including the Possibly infected devices report, and configure an SIEM tool to report on [event logs and error codes in Microsoft Defender Antivirus](troubleshoot-microsoft-defender-antivirus.md) and add that tool as an app in Azure AD. | +- [Use the Microsoft 365 Defender portal](../defender/microsoft-365-defender-portal.md), which includes a [device inventory list](/microsoft-365/security/defender-endpoint/machines-view-overview). To access the device inventory, in the Microsoft 365 Defender portal ([https://security.microsoft.com/](https://security.microsoft.com/)), go to **Assets** > **Devices**. The device inventory list displays onboarded devices along with their health state and risk level. -1. <span id="fn1" />The availability of some functions and features, especially related to cloud-delivered protection, differ between Microsoft Configuration Manager (Current Branch) and System Center 2012 Configuration Manager. In this library, we've focused on Windows 10, Windows 11, Windows Server 2016, and Microsoft Configuration Manager (Current Branch). See [Use Microsoft cloud-provided protection in Microsoft Defender Antivirus](cloud-protection-microsoft-defender-antivirus.md) for a table that describes the major differences. [(Return to table)](#ref2) +- [Manage devices with Intune](/mem/intune/remote-actions/device-management), which includes the ability to view detailed information about devices and take action. [Available actions](/mem/intune/remote-actions/device-management#available-device-actions) include starting an antivirus scan, restarting a device, locating a device, wiping a device, and more. -2. <span id="fn2" />In Windows 10 and Windows 11, Microsoft Defender Antivirus is a component available without installation or deployment of another client or service. It will automatically be enabled when third-party antivirus products are either uninstalled or out of date (except on Windows Server 2016). Traditional deployment, therefore, isn't required. Deployment here refers to ensuring the Microsoft Defender Antivirus component is available and enabled on endpoints or servers. [(Return to table)](#ref2) +## Configuration Manager -3. <span id="fn3" />Configuration of features and protection, including configuring product and protection updates, are further described in the [Configure Microsoft Defender Antivirus features](configure-notifications-microsoft-defender-antivirus.md) section in this library. [(Return to table)](#ref2) +With Configuration Manager, you can manage security and malware on Configuration Manager client computers. Use the [Endpoint Protection point site system role](/mem/configmgr/protect/deploy-use/endpoint-protection-site-role) and [enable Endpoint Protection with custom client settings](/mem/configmgr/protect/deploy-use/endpoint-protection-configure-client). You can use [default and customized antimalware policies](/microsoft-365/security/office-365-security/anti-malware-policies-configure). -## In this section +For reporting, you can choose from several options: -Article | Description -| -[Deploy and enable Microsoft Defender Antivirus protection](deploy-microsoft-defender-antivirus.md) | While the client is installed as a core part of Windows 10 or Windows 11, and traditional deployment doesn't apply, you'll still need to enable the client on your endpoints with Microsoft Configuration Manager, Microsoft Intune, or Group Policy Objects. -[Manage Microsoft Defender Antivirus updates and apply baselines](microsoft-defender-antivirus-updates.md) | There are two parts to updating Microsoft Defender Antivirus: updating the client on endpoints (product updates), and updating Security intelligence (protection updates). You can update Security intelligence in many ways, using Microsoft Configuration Manager, Group Policy, PowerShell, and WMI. -[Monitor and report on Microsoft Defender Antivirus protection](report-monitor-microsoft-defender-antivirus.md) | You can use Microsoft Intune, Microsoft Configuration Manager, the Update Compliance add-in for Microsoft Operations Management Suite, or a third-party SIEM product (by consuming Windows event logs) to monitor protection status and create reports about endpoint protection. +- [Use the Microsoft 365 Defender portal](../defender/microsoft-365-defender-portal.md), which includes a [device inventory list](/microsoft-365/security/defender-endpoint/machines-view-overview). To access the device inventory, in the Microsoft 365 Defender portal ([https://security.microsoft.com/](https://security.microsoft.com/)), go to **Assets** > **Devices**. The device inventory list displays onboarded devices along with their health state and risk level. ++- [Use Intune to view device details](/mem/intune/remote-actions/device-inventory). ++- Use the default [Configuration Manager Monitoring workspace](/mem/configmgr/apps/deploy-use/monitor-applications-from-the-console). ++- [Create email alerts](/configmgr/protect/deploy-use/endpoint-configure-alerts). ++- If your organization has Defender for Endpoint, you can also use the [Microsoft 365 Defender portal](../defender/microsoft-365-defender-portal.md), which includes a [device inventory list](/microsoft-365/security/defender-endpoint/machines-view-overview). To access the device inventory, in the Microsoft 365 Defender portal ([https://security.microsoft.com/](https://security.microsoft.com/)), go to **Assets** > **Devices**. The device inventory list displays onboarded devices along with their health state and risk level. ++## PowerShell ++You can use PowerShell with Group Policy or Configuration Manager to manage Microsoft Defender Antivirus on client devices. You can also use PowerShell to manage Microsoft Defender Antivirus manually on individual devices that are not managed by a security team. ++- Use the appropriate [Get- cmdlets available in the Defender module](/powershell/module/defender). ++- Use the [Set-MpPreference](/powershell/module/defender/set-mppreference) and [Update-MpSignature](/powershell/module/defender/update-mpsignature) cmdlets that are available in the Defender module. ++For reporting, you can choose from the following options: ++- [Use the Microsoft 365 Defender portal](../defender/microsoft-365-defender-portal.md), which includes a [device inventory list](/microsoft-365/security/defender-endpoint/machines-view-overview). To access the device inventory, in the Microsoft 365 Defender portal ([https://security.microsoft.com/](https://security.microsoft.com/)), go to **Assets** > **Devices**. The device inventory list displays onboarded devices along with their health state and risk level. ++- [Use Intune to view device details](/mem/intune/remote-actions/device-inventory). ++- Use the default [Configuration Manager Monitoring workspace](/mem/configmgr/apps/deploy-use/monitor-applications-from-the-console). ++## Group Policy and Azure Active Directory ++You can use a Group Policy Object to deploy configuration changes and ensure Microsoft Defender Antivirus is enabled. Use Group Policy Objects (GPOs) to [configure update options for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/manage-protection-update-schedule-microsoft-defender-antivirus) and [configure Windows Defender features](/microsoft-365/security/defender-endpoint/configure-microsoft-defender-antivirus-features). ++For reporting, keep in mind that device reporting isn't available with Group Policy. ++- You can generate a list of Group Policies to determine if any settings or policies aren't applied. ++- If your organization has Defender for Endpoint, you can also use the [Microsoft 365 Defender portal](../defender/microsoft-365-defender-portal.md), which includes a [device inventory list](/microsoft-365/security/defender-endpoint/machines-view-overview). To access the device inventory, in the Microsoft 365 Defender portal ([https://security.microsoft.com/](https://security.microsoft.com/)), go to **Assets** > **Devices**. The device inventory list displays onboarded devices along with their health state and risk level. ++## Windows Management Instrumentation ++With Windows Management Instrumentation (WMI), you can manage Microsoft Defender Antivirus with Group Policy or Configuration Manager. You can also use WMI to manage Microsoft Defender Antivirus manually on individual devices that aren't managed by a security team. ++- Use the [Set method of the MSFT_MpPreference class](/previous-versions/windows/desktop/defender/set-msft-mppreference) and the [Update method of the MSFT_MpSignature class](/previous-versions/windows/desktop/defender/update-msft-mpsignature). ++- Use the [MSFT_MpComputerStatus](/previous-versions/windows/desktop/defender/msft-mpcomputerstatus) class and the get method of associated classes in the [Windows Defender WMIv2 Provider](/windows/win32/wmisdk/wmi-providers). ++For reporting, Windows events comprise several security event sources, including Security Account Manager (SAM) events ([enhanced for Windows 10](/windows/whats-new/whats-new-windows-10-version-1507-and-1511). Also see [Security auditing](/windows/security/threat-protection/auditing/security-auditing-overview) and [Windows Defender events](troubleshoot-microsoft-defender-antivirus.md). ++## See also ++- [Microsoft Defender Antivirus compatibility with other security products](microsoft-defender-antivirus-compatibility.md) +- [Deploy and enable Microsoft Defender Antivirus protection](deploy-microsoft-defender-antivirus.md) +- [Manage Microsoft Defender Antivirus updates and apply baselines](microsoft-defender-antivirus-updates.md) +- [Monitor and report on Microsoft Defender Antivirus protection](report-monitor-microsoft-defender-antivirus.md) +- [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) +- [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) +- [Configure Defender for Endpoint on Android features](android-configure.md) +- [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) -> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) > [!TIP]-> **Performance tip** Due to a variety of factors (examples listed below) Microsoft Defender Antivirus, like other antivirus software, can cause performance issues on endpoint devices. In some cases, you might need to tune the performance of Microsoft Defender Antivirus to alleviate those performance issues. Microsoft's **Performance analyzer** is a PowerShell command-line tool that helps determine which files, file paths, processes, and file extensions might be causing performance issues; some examples are: -> -> - Top paths that impact scan time -> - Top files that impact scan time -> - Top processes that impact scan time -> - Top file extensions that impact scan time -> - Combinations ΓÇô for example: -> - top files per extension -> - top paths per extension -> - top processes per path -> - top scans per file -> - top scans per file per process -> -> You can use the information gathered using Performance analyzer to better assess performance issues and apply remediation actions. -> See: [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md). -> +> **Performance tip** Due to a variety of factors, Microsoft Defender Antivirus, like other antivirus software, can cause performance issues on endpoint devices. In some cases, you might need to tune the performance of Microsoft Defender Antivirus to alleviate those performance issues. Microsoft's **Performance analyzer** is a PowerShell command-line tool that helps determine which files, file paths, processes, and file extensions might be causing performance issues. You can use the information gathered using Performance analyzer to better assess performance issues and apply remediation actions. See [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md). |
| security | Deploy Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deploy-microsoft-defender-antivirus.md | - Title: Deploy and enable Microsoft Defender Antivirus -description: Deploy Microsoft Defender Antivirus for protection of your endpoints with Microsoft Intune, Microsoft Endpoint Configuration Manager, Group Policy, PowerShell cmdlets, or WMI. -keywords: deploy, enable, Microsoft Defender Antivirus --ms.sitesec: library -ms.pagetype: security ---------- m365-security-- tier2 Previously updated : 04/08/2021---# Deploy and enable Microsoft Defender Antivirus ----**Applies to:** --- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037)-- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)-- Microsoft Defender Antivirus--**Platforms** -- Windows--Depending on the management tool you are using, you may need to specifically enable or configure Microsoft Defender Antivirus protection. --See the table in [Deploy, manage, and report on Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md#ref2) for instructions on how to enable protection with Microsoft Intune, Microsoft Endpoint Configuration Manager, Group Policy, Active Directory, Microsoft Azure, PowerShell cmdlets, and Windows Management Instruction (WMI). --Some scenarios require more guidance on how to successfully deploy or configure Microsoft Defender Antivirus protection, such as Virtual Desktop Infrastructure (VDI) environments. --The remaining article in this section provides end-to-end advice and best practices for [setting up Microsoft Defender Antivirus on virtual machines (VMs) in a VDI or Remote Desktop Services (RDS) environment](deployment-vdi-microsoft-defender-antivirus.md). --## Related articles --- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md)-- [Deploy, manage updates, and report on Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md)-- [Deployment guide for Microsoft Defender Antivirus in a virtual desktop infrastructure (VDI) environment](deployment-vdi-microsoft-defender-antivirus.md)--> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) |
| security | Report Monitor Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/report-monitor-microsoft-defender-antivirus.md | - Title: Monitor and report on Microsoft Defender Antivirus protection -description: Use Configuration Manager or security information and event management (SIEM) tools to consume reports, and monitor Microsoft Defender Antivirus with PowerShell and WMI. -keywords: siem, monitor, report, Microsoft Defender AV, Microsoft Defender Antivirus --ms.sitesec: library -ms.pagetype: security ---------- m365-security-- tier2 Previously updated : 03/13/2023---# Report on Microsoft Defender Antivirus --**Applies to:** -- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037)-- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)-- Microsoft Defender Antivirus--**Platforms** -- Windows--Microsoft Defender Antivirus is built into Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2016. Microsoft Defender Antivirus is of your next-generation protection in Microsoft Defender for Endpoint. Next-generation protection helps protect your devices from software threats like viruses, malware, and spyware across email, apps, the cloud, and the web. --With Microsoft Defender Antivirus, you have several options for reviewing protection status and alerts. You can use Microsoft Configuration Manager to [monitor Microsoft Defender Antivirus](/configmgr/protect/deploy-use/monitor-endpoint-protection) or [create email alerts](/configmgr/protect/deploy-use/endpoint-configure-alerts). Or, you can monitor protection using [Microsoft Intune](/intune/introduction-intune). When endpoints are onboarded to Defender for Endpoint, alerts are visible in Microsoft 365 Defender [unified alert and incident queues](/microsoft-365/security/defender/incident-queue). --Within the Microsoft 365 Defender portal, reporting is also available for Microsoft Defender for Endpoint onboarded endpoints across platforms that include antivirus engine versions, security intelligence versions, and Microsoft Defender Antivirus platform versions via [Device Health reports](/microsoft-365/security/defender-endpoint/device-health-reports). --If you have a third-party security information and event management (SIEM) server, you can also consume [Windows Defender client events](/windows/win32/events/windows-events). --Windows events comprise several security event sources, including Security Account Manager (SAM) events ([enhanced for Windows 10](/windows/whats-new/whats-new-windows-10-version-1507-and-1511), also see the [Security auditing](/windows/security/threat-protection/auditing/security-auditing-overview) topic) and [Windows Defender events](troubleshoot-microsoft-defender-antivirus.md). --These events can be centrally aggregated using the [Windows event collector](/windows/win32/wec/windows-event-collector). Often, SIEM servers have connectors for Windows events, allowing you to correlate all security events in your SIEM server. --You can also [monitor malware events using the Malware Assessment solution in Log Analytics](/security/benchmark/azure/security-control-logging-monitoring). --For monitoring or determining status with PowerShell, WMI, or Microsoft Azure, see the [(Deployment, management, and reporting options table)](deploy-manage-report-microsoft-defender-antivirus.md#ref2). --> [!TIP] -> **Performance tip** Due to a variety of factors (examples listed below) Microsoft Defender Antivirus, like other antivirus software, can cause performance issues on endpoint devices. In some cases, you might need to tune the performance of Microsoft Defender Antivirus to alleviate those performance issues. Microsoft's **Performance analyzer** is a PowerShell command-line tool that helps determine which files, file paths, processes, and file extensions might be causing performance issues; some examples are: -> -> - Top paths that impact scan time -> - Top files that impact scan time -> - Top processes that impact scan time -> - Top file extensions that impact scan time -> - Combinations ΓÇô for example: -> - top files per extension -> - top paths per extension -> - top processes per path -> - top scans per file -> - top scans per file per process -> -> You can use the information gathered using Performance analyzer to better assess performance issues and apply remediation actions. -> See [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md). --> [!NOTE] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) --## See also --- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md)-- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) |
| security | Microsoft 365 Security Center Mdi | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-center-mdi.md | Title: Microsoft Defender for Identity in Microsoft 365 Defender description: Learn about changes from the Microsoft Defender for Identity to Microsoft 365 Defender -keywords: Getting started with Microsoft 365 Defender, Microsoft Defender for Identity, NDI +keywords: Getting started with Microsoft 365 Defender, Microsoft Defender for Identity, MDI ms.mktglfcycl: deploy-Microsoft Defender for Identity contributes identity focused information into the incidents and alerts that Microsoft 365 Defender presents. This information is key to providing context and correlating alerts from the other products within Microsoft 365 Defender. +Microsoft Defender for Identity contributes identity focused information into the incidents and alerts that Microsoft 365 Defender presents. This information is key to providing context and correlating alerts from the other products within Microsoft 365 Defender. ## Quick reference The table below lists the changes in navigation between Microsoft Defender for I | **Defender for** Identity | **Microsoft 365 Defender** | | -- | | | Timeline | Microsoft 365 Defender Alerts/Incidents queue |-| Reports | Will remain in the [classic Defender for Identity portal](/defender-for-identity/classic-workspace-portal). <br> Customized reports can be created in the Microsoft 365 Defender portal using [Advanced hunting](#advanced-hunting-new). | +| Reports |Lateral movement path and passwords exposed in cleartext reports are covered by the [Identity security posture assessments](/defender-for-identity/security-assessment#assessment-reports) (ISPM)<br>Health issues are available in Settings -> Identities -> Health issues<br>Summary of alerts can be found by exporting the alerts queue or using Advanced Hunting (30 days of data)<br>Modification to sensitive groups can be found by using Advanced hunting<br>Customized reports can be created in Microsoft 365 Defender portal using Advanced hunting | | User page | Microsoft 365 Defender User page | | Device page | Microsoft 365 Defender Device page | | Group page | Microsoft 365 Defender groups side pane | In addition to the **Lateral movement paths** tab on the user page, lateral move ## Related information - [Microsoft 365 Defender](microsoft-365-defender.md)+ |
| security | Microsoft Secure Score | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-secure-score.md | Organizations gain access to robust visualizations of metrics and trends, integr > [!NOTE] > Currently, the Azure Active Directory related Microsoft Secure Score recommendations are not available for customer tenants registered in the following Azure Active Directory regions:-Japan, Australia, New Zealand, Fiji, Canada, United Kingdom, South Korea, France, United Arab Emirates, South America, Switzerland, Lichtenstein, Norway, Germany, Brazil, Sweden and Qatar. +Japan, Australia, New Zealand, Fiji, Canada, United Kingdom, South Korea, France, United Arab Emirates, South America, Switzerland, Liechtenstein, Norway, Germany, Brazil, Sweden, and Qatar. ## How it works |