| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Servicenow Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/servicenow-overview.md | You can learn more about the steps by visiting the following pages: - This configuration will require an SSO tenant in order for the AAD Auth Token to work correctly. To understand each feature, see [Microsoft 365 support integration](https://store.servicenow.com/sn_appstore_store.do#!/store/application/6d05c93f1b7784507ddd4227cc4bcb9f).++> [!NOTE] +> This app is not supported in regulated or restricted environments. |
| commerce | Understand Your Invoice2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/understand-your-invoice2.md | -description: "Interpret charges, billing, and payment info on your Microsoft 365 for business bill or invoice, and how to change a purchase order number." Previously updated : 05/04/2021+description: "Learn how to interpret charges, billing, and payment info on your Microsoft 365 for business bill or invoice." Last updated : 03/04/2022 # Understand your bill or invoice for Microsoft 365 for business -> [!IMPORTANT] -> As of January 26, 2021, new bank accounts are no longer supported for customers in Belgium, France, Italy, Luxembourg, Portugal, Spain, and the United States. If youΓÇÖre an existing customer in one of those countries, you can continue paying for your subscription with an existing bank account, and you can add new subscriptions to it, but only as long as the bank account is in good standing. --Either monthly or annually (depending on the option you chose when you purchased your subscription), you'll receive an email that tells you that your new billing statement is available in the admin center. [Learn how to find and view your bill or invoice](view-your-bill-or-invoice.md). - -Your invoice contains two pages. Page 1 is the invoice summary, and contains general information about the invoice, order, amount due, how to make a payment, and how to contact support. - - - -Page 2 contains details about the billing activity for each subscription. - - - -For descriptions of the fields and terms included in your invoice, see the [Invoice Field Glossary](#invoice-field-glossary) later in this article. - -## Understand billing concepts --Before you view your invoice, it's helpful to understand a few key billing concepts. - -### Invoice balance vs. order balance -- **Invoice balance** is the amount shown on your invoice, and is only the amount due for that particular billing period. Your total **order balance** is the sum of all unpaid invoices. You can view your order balance in the **Billing** section of the admin center. - -### Billing frequency vs. invoice frequency -- **Billing frequency** means how often you are billed. Subscriptions are billed either monthly or annually, depending on what option you chose during the subscription purchase. **Invoice frequency** means how often you receive an invoice. If you chose annual billing, you'll only receive one invoice per year, unless activity for your subscription requires a charge or a credit. - -If you have more than one order, you'll receive an invoice for each order. - -## Invoice Field Glossary --The following table describes the fields you might see on your invoice. Some fields listed here might not appear in your invoice, depending on whether you pay by invoice or by credit card or bank account. - +Your bill or invoice provides a summary of charges for your subscription and includes instructions for how to make a payment. + > [!NOTE]-> Paying by bank account is not available in some countries or regions. - -|**Name**|**Description**| -|:--|:--| -|Annual Price|Subscriptions are billed monthly or annually. If you chose annual billing during the subscription purchase, the annual license price is reflected on the invoice. If you want to change the billing frequency, you'll have to cancel your subscription and repurchase it with the new billing frequency.| -|Billing Period|Billing Period is the time period since the last invoice date. Service Period is the time period during which you are charged to use the service.| -|Bill-To|This is the address of your billing department, and is usually the same as the Sold-To address. To update your billing address, see [Change your billing addresses](change-your-billing-addresses.md).| -|Charges|Page 1 of your invoice summarizes all charges for the invoice Billing Period. Page 2 shows the detailed charges for each subscription.| -|Check|If you pay by invoice and check payment is offered in your country, the bottom of page 1 includes information about where to send your payment. Please reference the invoice number on your check.| -|Credits|Page 1 of your invoice summarizes all credits for the invoice Billing Period. Page 2 shows the detailed credits for each subscription.| -|Customer PO Number|Your Purchase Order (PO) number. If you update the PO number, future invoices will include it. [Change your purchase order number](#change-your-purchase-order-number). <br/> **NOTE** You can't add a PO number to an existing invoice. | -|Days|Each billing transaction is associated with a Service Period. The Days column indicates the number of days in that service period.| -|Discounts|Page 1 of your invoice summarizes all discounts for the invoice Billing Period. Page 2 shows the detailed discounts for each subscription.| -|Due Date|The date when payment is due for the invoice. If your subscription is paid with a credit card or bank account, we will charge your credit card or banking account the day after the Invoice Date. <br/> **NOTE** Paying by bank account is not available in some countries or regions. | -|Electronic Funds Transfer|If you chose "invoice" as the subscription payment method, page 1 contains the Microsoft bank account information for electronic (wire, ACH, SEPA, etc.) payments. Usually, your bank will have a reference field you complete when you send a payment. Please reference the invoice number shown in this field.| -|Grand Total|This row includes the totals for all Charges, Discounts, Credits, SubTotal, Tax, and Total columns for all subscriptions listed on the invoice.| -|Invoice Date|The date the invoice was created. The invoice date is the day after the end of your Billing Period. For example, if your Billing Period is Jan 15 - Feb 14, your Invoice Date is Feb 15.| -|Invoice Number|The unique number assigned to your invoice. Please reference the Invoice Number with your payment.| -|Monthly Price|Subscriptions are billed monthly or annually. If you chose monthly billing during the subscription purchase, the monthly license price is reflected on the invoice. If you want to change the billing frequency, you'll have to cancel your subscription and repurchase it with the new billing frequency.| -|Order Number|Every time you buy a new subscription, an order is created. Every month, you'll receive an invoice for each order.| -|Payment Instructions|If you pay by credit card, you'll see "Do not pay - charged to credit card on file." If you pay by invoice, you'll see instructions for paying by Electronic Funds Transfer (EFT) and check (if applicable).| -|Payment Terms|The number of days from the Invoice Date when payment is due. The standard is 30 days.| -|Product|On page 1 of your invoice, "Online Services" is the generic term used to describe your subscriptions. On page 2 , you'll see the individual subscription names.| -|QTY|The number of licenses purchased during the Service Period.| -|Service Period|Service Period is the time period during which you are charged to use the service. A Billing Period is the time period since the last invoice date.| -|Service Usage Address|The address where the service is being used, usually the same as your Sold-To address. To update your Service Usage Address, see [Change your billing addresses](change-your-billing-addresses.md).| -|Sold-To|Your company name and address. To update this information, see [Change your organization's address, technical contact email, and other information](../../admin/manage/change-address-contact-and-more.md).| -|SubTotal|Each subscription listed on your invoice has a separate SubTotal row for all Charges, Discounts, Credits, SubTotal, Tax, and Total columns for that subscription.| -|Tax|Page 1 of your invoice shows the total tax. Page 2 shows the tax rate applied, and the total tax amount for each line item. If your invoice contains taxes and your company is tax exempt, please [contact support](../../admin/get-help-support.md).| -|Total|The amount due for the invoice Billing Period.| +> If you have other subscriptions instead of or in addition to Microsoft 365, see [Understand your bill or invoice](understand-your-invoice.md). ++## How often and when am I billed? ++Depending on the billing frequency you chose when you bought your subscription, you receive an invoice either monthly or annually. If you chose annual billing, you only receive one invoice a year, unless activity for your subscription adds a new charge or a credit. ++The amount of time since the last invoice date is called the *Billing Period* and is on page one of the invoice. This time represents the date range during which charges accrue for the current invoice. If you made a change to your subscription outside of this date range, like adding or removing licenses, the associated charges appear on the invoice for the next billing period. ++Starting on page two of the invoice, you see the charges grouped by their *Service Period*. The service period is the date range during which you're charged to use the service. ++At the end of each billing period, you receive an email that says your new invoice is ready to view or download in the Microsoft 365 admin center. If you have more than one order, you receive an invoice for each order. Learn how to [find and view your bill or invoice](view-your-bill-or-invoice.md). ++## Why is my total due different from last month? ++The amount billed for your subscription reflects the license price multiplied by the number of licenses purchased and any required taxes or fees. ++If the amount billed is different than expected, that can happen for few reasons: ++- You added or removed licenses from your subscription. Licenses changed mid-term are reflected on the next invoice. You might see a credit and rebill for the previous service period to account for this change. For details about what this looks like in your invoice, see [Page two](#page-two) below. +- The subscription was canceled. You receive an invoice after cancellation with any outstanding balance minus any credits. +- Your subscription renewed for a new term and the license price changed. ++## Overview of the invoice .PDF ++Your invoice is a .PDF that contains at least two pages. [Page one](#page-one) is the billing summary, and contains general information about the invoice, order, amount due, and payment instructions, if applicable. +++[Page two](#page-two) contains details about the billing activity for each subscription during the service period. +++## Header ++The header appears at the top of every invoice page, and includes the month of service, and the **Invoice Date**, which is the date Microsoft created the invoice. The invoice is created the day after the end of your billing period. For example, if your billing period is January 15ΓÇöFebruary 14, your invoice date is February 15. ++The header also includes an **Invoice Number**, the unique number assigned to your invoice. If you pay by Electronic Funds Transfer (EFT) or check, include the invoice number with your payment. ++Finally, the header includes the **Due Date** for payment of the invoice, and shows the total amount due. If you pay for your subscription with a credit card or bank account, we charge your card or account the day after the invoice date. ++## Footer ++The footer appears at the bottom of every invoice page and includes Microsoft business center address. Based on your country or region, it might include other information like the phone number to call for billing or technical support, a link to online self-help articles, and the address and tax ID for Microsoft in your country or region. ++## Page one ++Page one of your invoice contains address information for your organization, high-level details about your order, a summary of invoice totals, and instructions about how to pay your invoice. +++### Addresses ++Three addresses appear at the top of the first page. The **Sold-To** address is the name and address of the organization that bought the subscription. The **Bill-To** address is the address of your billing department. **Service Usage Address** is the address where the service is used. Usually, these addresses are the same. Depending on the size and configuration of your organization, these addresses might be different. ++To update the **Sold-To** address, see [Change your organization's address, technical contact, and more](../../admin/manage/change-address-contact-and-more.md)**. To update your Bill-To** or **Service Usage Address**, see [Change your billing addresses](change-your-billing-addresses.md). ++#### Order Details ++On page one of your invoice, the **Product** is "Online Services,ΓÇ¥ the generic term we use to describe your subscription. Page two lists the individual products in your order. ++**Customer PO Number** is the purchase order (PO) number that you specify. You can't add a PO number to an existing invoice. If you update the PO number, itΓÇÖs included in future invoices. To change the PO number, see [Change your purchase order number](#change-your-purchase-order-number). ++**Order Number** is the globally unique identifier (GUID) that identifies your order. Every time you buy a new subscription, a new order with a new order number is created. You receive an invoice for each order every billing period. ++**Billing Period** is the period since the last invoice date. ++**Payment Terms** is the number of days from the invoice date when payment is due. The standard payment term is 30 days. ++**Due Date** is the date when the invoice payment is due. If your subscription is paid with a credit card or bank account, we charge your card or account the day after the Invoice Date. ++### Billing Summary ++Page one of your invoice shows the totals of the following items for the invoice billing period. Page two contains details for each category. ++- Charges +- Discounts +- Credits +- Tax +- Total ++### Payment Instructions ++If you pay by credit card, you see "Please DO NOT PAY. You will be charged the amount due through your selected method of payment." If you pay by invoice, this section contains instructions for paying by EFT or check. ++### Electronic Fund Transfer (EFT) and check ++If you chose ΓÇ£invoiceΓÇ¥ as your subscription payment method, page one contains the **Electronic Funds Transfer** section that shows the Microsoft bank account information for electronic payments (wire, ACH, SEPA, and so on). Usually, your bank has a reference field you complete when you send a payment. Make sure you reference the invoice number in that field. ++If we accept payments by check for your country or region, you also see a **Check** section that contains the payee name and mailing address. Make sure you reference your invoice number on the check. ++### Support ++In some countries or regions, the invoice has a **Support** section that includes instructions on how to view past invoices in the Microsoft 365 admin center. It also includes a link to self-help articles, and for some countries and regions, the support phone number. ++## Page two ++The product name for your subscription is at the top of page two. Below it is the formula that explains how the charges are calculated. If you have more than one product in your order, you see a separate section for each product and the associated charges. ++### New charges +++The **New charges** section shows the service period during which charges, discounts, credits, and taxes were added. It shows the number of licenses included during the service period, the price per license, and the number of days in the service period. ++### Previous charges +++The **Previous charges** section shows a credit for charges you paid for the previous invoice. If you made a change during the previous billing period, your invoice includes the **Previous charges** section. For example, if you added or removed licenses mid-term, the **Previous charges** section shows the number of licenses for that service period, together with the monthly price per license, the number of days in the service period, the charges, and other amounts that apply. ++### Charges during this billing period +++The **Charges during this billing period** section shows changes to your subscription made during this billing period. If you made a change during the previous billing period, your invoice also includes the **Changes during this billing period** section. For example, if you added or removed licenses mid-term, the **Charges during this billing period** section lists the changes to the subscription and when they occurred. The charges or refunds owed to you because of those changes are prorated for the number of days affected during the billing period. ## Change your purchase order number If you pay by invoice, you can add or change the purchase order (PO) number for your subscription.- + > [!NOTE] > You can't add a PO number to an existing invoice. The PO number will appear on all future invoices. --1. In the admin center, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page. --+1. In the admin center, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page. +2. On the **Products** tab, select the subscription that you want to change. +3. On the subscription details page, in the **Subscription and payment settings** section, select **Edit invoice**. +4. At the bottom of the **Edit details for paying by invoice** pane, enter your PO number, and then select **Save**. -1. In the admin center, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=850626" target="_blank">Your products</a> page. +## Run the Unknown Charge Diagnostic +As a Microsoft 365 Global admin, you can use a diagnostic tool that runs within the Microsoft 365 admin center to research unexpected charges from Microsoft that appear on your bank or credit card statement. -1. On the **Products** tab, select the subscription that you want to change. +> [!NOTE] +> The Unknown Charge Diagnostic is only available for customers who bought their products and services from Microsoft.com, including Microsoft 365 Enterprise, Education, and Non-profit. -1. On the subscription details page, in the **Subscription and payment settings** section, select **Edit invoice**. +Select the **Run Tests** link below to open the diagnostic tool in the Microsoft 365 admin center. -1. At the bottom of the **Edit details for paying by voice** pane, enter your PO number, and then select **Save**. +>[!div class="nextstepaction"] +>[Run Tests: Unknown Charge](https://aka.ms/PillarUnknownCharge) ## Related content -[Learn how to find and view your bill or invoice](view-your-bill-or-invoice.md) (article)\ -[Billing information for Microsoft 365 for business in Mexico](mexico-billing-info.md) (article) \ -[Change your billing addresses](change-your-billing-addresses.md) (article)\ -[Change your organization's address, technical contact email, and other information](../../admin/manage/change-address-contact-and-more.md) (article)\ +[View your bill or invoice](view-your-bill-or-invoice.md) (article)\ [Pay for your Microsoft 365 for business subscription](pay-for-your-subscription.md) (article)\+[Manage payment methods](manage-payment-methods.md) (article)\ +[Billing information for Microsoft 365 for business in Mexico](mexico-billing-info.md) (article) \ [Minecraft: Education Edition payment options](/education/windows/school-get-minecraft) (article) |
| commerce | Manage Partners | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/manage-partners.md | You can remove admin roles from a partner at any time. Removing the admin roles 3. Select the row that contains the name of the partner. 4. On the partner page, select **Remove roles**. 5. In the **Remove roles?** dialog box, select **Yes**.++If you do not see the **Remove roles** option, contact the [Partner Center](https://partner.microsoft.com/support). |
| compliance | Autoexpanding Archiving | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/autoexpanding-archiving.md | Here are some things to consider when using Outlook or Outlook on the web to acc - You can delete items in an auto-expanded storage area. However, you can't use the Recover Deleted Items feature to recover an item after auto-expanding archiving is enabled for a mailbox. -- Search for auto-expanded archiving is available in Outlook for the web (OWA). Similar to Online Archive, you can search for items that were moved to an additional storage area. When archive is selected as the search scope in OWA, all archives (including auto-expanded archives) and their corresponding subfolders will be searched.+- Search for auto-expanded archiving is available in Outlook for the web (OWA). Similar to Online Archive, you can search for items that were moved to an additional storage area. When archive is selected as the search scope in OWA, all archives (including auto-expanded archives) and their corresponding subfolders will be searched. Note that search is not supported for the auto-expanded archive feature in a cloud-only archive situation (primary mailbox still on-premises). -- Auto-expanded archive search is available in Outlook Desktop in Current Channel (Preview). Within this preview, the Current Mailbox scope is available, thus allowing you to search the auto-expanded archive. For more information about this and other Microsoft Search support features, see [How Outlook for Windows connected to Exchange Online utilizes Microsoft Search](https://techcommunity.microsoft.com/t5/outlook-global-customer-service/how-outlook-for-windows-connected-to-exchange-online-utilizes/ba-p/1715045). +- Auto-expanded archive search is available in Outlook for Windows in Monthly Enterprise Channel. With this update the Current Mailbox scope is available, thus allowing you to search the auto-expanded archive. Note that search is not supported for the auto-expanded archive feature in a cloud-only archive situation (primary mailbox still on-premises). For more information about this and other Microsoft Search support features, see [How Outlook for Windows connected to Exchange Online utilizes Microsoft Search](https://techcommunity.microsoft.com/t5/outlook-global-customer-service/how-outlook-for-windows-connected-to-exchange-online-utilizes/ba-p/1715045). - Item counts in Outlook and Read/Unread counts (in Outlook and Outlook on the web) in an auto-expanded archive might not be accurate. This section explains the functionality between auto-expanding archiving and oth For more technical details about auto-expanding archiving, see [Microsoft 365: Auto-Expanding Archives FAQ](https://techcommunity.microsoft.com/t5/exchange-team-blog/office-365-auto-expanding-archives-faq/ba-p/607784). -If you're ready to enable auto-expanding archiving, see [Enable auto-expanding archiving](enable-autoexpanding-archiving.md). +If you're ready to enable auto-expanding archiving, see [Enable auto-expanding archiving](enable-autoexpanding-archiving.md). |
| compliance | Communication Compliance Channels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-channels.md | Modern attachment scanning is supported for the following file types: Extracted text for Modern attachments is included with the associated message on the **Pending** alerts dashboard for a policy. The extracted text for an attachment is named as the attachment file name (and format extension) and the .txt extension. For example, the extracted text for an attachment named *ContosoBusinessPlan.docx* would appear as *ContosoBusinessPlan.docx.txt* in the **Pending** alerts dashboard for a policy. -Select the extracted attachment text to view the details in the *Source*, *Plain text*, or *Annotate* views. After reviewing, you can resolve or take action on the attachment text using the command bar controls. You also have the option to download the attachment for review outside of the communication compliance review process. +Select the extracted attachment text to view the details in the *Source* and *Plain text* views. After reviewing, you can resolve or take action on the attachment text using the command bar controls. You also have the option to download the attachment for review outside of the communication compliance review process. Use the following group management configurations to supervise individual user chats and channel communications in Teams: |
| compliance | Communication Compliance Investigate Remediate | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-investigate-remediate.md | After reviewing the message basics, it's time to open a message to examine the d - **Attachments**: This option allows you to examine Modern attachments that match policy conditions. Modern attachments content is extracted as text and is viewable on the Pending alerts dashboard for a policy. For more information, see the [Communication compliance feature reference](/microsoft-365/compliance/communication-compliance-channels). - **Source**: This view is the standard message view commonly seen in most web-based messaging platforms. The header information is formatted in the normal style and the message body supports imbedded graphic files and word-wrapped text. If [optical character recognition (OCR)](communication-compliance-policies.md#optical-character-recognition-ocr) is enabled for the policy, images containing printed or handwritten text that match policy conditional are viewed as a child item for the associated message in this view. - **Plain text**: Text view displays a line-numbered text-only view of the message and includes keyword highlighting in messages and attachments for sensitive info type terms or keywords matched in the associated communication compliance policy. Keyword highlighting can help you quickly scan long messages and attachments for the area of interest. In some cases, highlighted text may be only in attachments for messages matching policy conditions. Keyword highlighting isn't supported for terms identified by built-in classifiers assigned to a policy. Embedded files aren't displayed and the line numbering this view is helpful for referencing pertinent details among multiple reviewers.-- **Annotate**: This view allows reviewers to add annotations directly on the message that are saved to the view of the message. If [OCR is enabled](communication-compliance-policies.md#optical-character-recognition-ocr) for the policy, images containing printed or handwritten text that match policy conditional are viewed as a child item for the associated message in this view and may be annotated. - **Conversation (preview)**: Available for Microsoft Teams chat messages, this view displays up to five messages before and after an alert message to help reviewers view the activity in the conversational context. This context helps reviewers to quickly evaluate messages and make more informed message resolution decisions. Real-time message additions to conversations are displayed, including all inline images, emojis, and stickers available in Teams. Image or text file attachments to messages aren't displayed. Notifications are automatically displayed for messages that have been edited or for messages that have been deleted from the conversation window. When a message is resolved, the associated conversational messages aren't retained with the resolved message. Conversation messages are available for up to 60 days after the alert message is identified. - **User history**: User history view displays all other alerts generated by any communication compliance policy for the user sending the message. - **Pattern detected notification**: Many harassing and bullying actions over time and involve reoccurring instances of the same behavior by a user. The *Pattern detected* notification is displayed in the alert details and raises attention to the alert. Detection of patterns is on a per-policy basis and evaluates behavior over the last 30 days when at least two messages are sent to the same recipient by a sender. Investigators and reviewers can use this notification to identify repeated behavior to evaluate the alert as appropriate. |
| compliance | Communication Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance.md | Built-in remediation workflows allow you to quickly identify and take action on - **Exact and near duplicate detection**: In addition to scanning for exact terms matching communication compliance policies, near duplicate detection groups textually similar terms and messages together to help speed up your review process. - **Optical character recognition (OCR) (preview)**: Scan, detect, and investigate printed and handwritten text within images embedded or attached to email or Microsoft Teams chat messages. - **New filters**: Investigate and remediate policy alerts faster with message filters for several fields, including sender, recipient, date, domains, and many more.-- **Improved message views**: Investigation and remediation actions are now quicker with new message source, text, and annotation views. Message attachments are now viewable to provide complete context when taking remediation actions.+- **Improved message views**: Investigation and remediation actions are now quicker with new message source and text views. Message attachments are now viewable to provide complete context when taking remediation actions. - **User history**: Historical view of all user message remediation activities, such as past notifications and escalations for policy matches, now provides reviewers with more context during the remediation workflow process. First-time or repeat instances of policy matches for users are now archived and easily viewable. - **Pattern detected notification**: Many harassing and bullying actions take place over time and involve reoccurring instances of the same behavior by a user. The new pattern detected notification displayed in alert details helps raise attention to these alerts and this type of behavior. - **Translation**: Quickly investigate message details in eight languages using translate support in the remediation workflow. Messages in other languages are automatically converted to the display language of the reviewer. In this step, you look deeper into the issues detected as matching your communic - **Alerts**: When a message matches a policy condition, an alert is automatically generated. For each alert, you can see the status, the severity, the time detected, and if an Advanced eDiscovery case is assigned and its status. New alerts are displayed on the communication compliance home page and the **Alerts** page and are listed in order of severity. - **Issue management**: For each alert, you can take investigative actions to help remediate the issue detected in the message.-- **Document review**: During the investigation of an issue, you can use several views of the message to help properly evaluate the detected issue. The views include a conversation summary, text-only, annotated, and detail views of the communication conversation.+- **Document review**: During the investigation of an issue, you can use several views of the message to help properly evaluate the detected issue. The views include a conversation summary, text-only, and detail views of the communication conversation. - **Reviewing user activity history**: View the history of user message activities and remediation actions, such as past notifications and escalations, for policy matches. - **Filters**: Use filters such as sender, recipient, date, and subject to quickly narrow down the message alerts that you want to review. |
| compliance | Create Apply Retention Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-apply-retention-labels.md | If you publish retention labels to Exchange, it can take up to seven days for th  -If the labels don't appear after seven days, check the **Status** of the label policy by selecting it from the **Label policies** page in the compliance center. If you see the status of **Off (Error)** and in the details for the locations see a message that it's taking longer than expected to deploy the policy or to try redeploying the policy, try running the [Set-AppRetentionCompliancePolicy](/powershell/module/exchange/set-appretentioncompliancepolicy) or [Set-RetentionCompliancePolicy](/powershell/module/exchange/set-retentioncompliancepolicy) PowerShell command to retry the policy distribution: +If the labels don't appear after seven days, check the **Status** of the label policy by selecting it from the **Label policies** page in the compliance center. If you see **(Error)** included in the status and in the details for the locations see a message that it's taking longer than expected to deploy the policy or to try redeploying the policy, try running the [Set-AppRetentionCompliancePolicy](/powershell/module/exchange/set-appretentioncompliancepolicy) or [Set-RetentionCompliancePolicy](/powershell/module/exchange/set-retentioncompliancepolicy) PowerShell command to retry the policy distribution: 1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell). |
| compliance | Create Retention Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-retention-policies.md | When you create and submit a retention policy, it can take up to seven days for  -First, the retention policy needs to be distributed to the locations that you selected, and then applied to content. You can always check the distribution status of the retention policy by selecting it from the **Retention policies** page in the compliance center. From the flyout pane, if you see the status of **Off (Error)** and in the details for the locations see a message that it's taking longer than expected to deploy the policy or to try redeploying the policy, try running the [Set-AppRetentionCompliancePolicy](/powershell/module/exchange/set-appretentioncompliancepolicy) or [Set-RetentionCompliancePolicy](/powershell/module/exchange/set-retentioncompliancepolicy) PowerShell command to retry the policy distribution: +First, the retention policy needs to be distributed to the locations that you selected, and then applied to content. You can always check the distribution status of the retention policy by selecting it from the **Retention policies** page in the compliance center. From the flyout pane, if you see **(Error)** included in the status, and in the details for the locations see a message that it's taking longer than expected to deploy the policy or to try redeploying the policy, try running the [Set-AppRetentionCompliancePolicy](/powershell/module/exchange/set-appretentioncompliancepolicy) or [Set-RetentionCompliancePolicy](/powershell/module/exchange/set-retentioncompliancepolicy) PowerShell command to retry the policy distribution: 1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell). |
| compliance | Encryption Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/encryption-sensitivity-labels.md | When you assign permissions, you can choose: - Any authenticated users. Make sure you understand the [requirements and limitations](#requirements-and-limitations-for-add-any-authenticated-users) of this setting before selecting it. - Any specific user or email-enabled security group, distribution group, or Microsoft 365 group ([formerly Office 365 group](https://techcommunity.microsoft.com/t5/microsoft-365-blog/office-365-groups-will-become-microsoft-365-groups/ba-p/1303601)) in Azure AD. The Microsoft 365 group can have static or [dynamic membership](/azure/active-directory/users-groups-roles/groups-create-rule). Note that you can't use a [dynamic distribution group from Exchange](/Exchange/recipients/dynamic-distribution-groups/dynamic-distribution-groups) because this group type isn't synchronized to Azure AD, and you can't use a security group that isn't email-enabled.+ + Within a specified group that's supported for this option, each [user will be individually authenticated](/azure/information-protection/prepare#azure-information-protection-requirements-for-user-accounts) by the Azure Information Protection service before they can open the encrypted content. - Any email address or domain. Use this option to specify all users in another organization who uses Azure AD, by entering any domain name from that organization. You can also use this option for social providers, by entering their domain name such as **gmail.com**, **hotmail.com**, or **outlook.com**. For the best collaboration experience for files that are encrypted by a sensitiv ## Next steps -Need to share your labeled and encrypted documents with people outside your organization? See [Sharing encrypted documents with external users](sensitivity-labels-office-apps.md#sharing-encrypted-documents-with-external-users). +Need to share your labeled and encrypted documents with people outside your organization? See [Sharing encrypted documents with external users](sensitivity-labels-office-apps.md#sharing-encrypted-documents-with-external-users). |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | The numbers listed are the minimum Office application versions required for each |[Dynamic markings with variables](#dynamic-markings-with-variables) | Current Channel: 2010+ <br /><br> Monthly Enterprise Channel: 2010+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.42+ | 2.42+ | 16.0.13328+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Assign permissions now](encryption-sensitivity-labels.md#assign-permissions-now) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Let users assign permissions: <br /> - Prompt users](encryption-sensitivity-labels.md#let-users-assign-permissions) |Current Channel: 2004+ <br /><br> Monthly Enterprise Channel: 2004+ <br /><br> Semi-Annual Enterprise Channel: 2008+ | 16.35+ | Under review | Under review | Under review |-|[Audit label-related user activity](#auditing-labeling-activities) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ | 2.46+ | 16.0.13628+ | Yes <sup>\*</sup> | +|[Audit label-related user activity](#auditing-labeling-activities) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ | 2.46+ | 16.0.13628+ | Yes | |[Require users to apply a label to their email and documents](#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.45+ | 2.47+ | 16.0.13628+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2018+ | 16.49+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Support co-authoring and AutoSave](sensitivity-labels-coauthoring.md) for labeled and encrypted documents | Current Channel: 2107+ <br /><br> Monthly Enterprise Channel: 2107+ <br /><br> Semi-Annual Enterprise Channel: 2202+ | 16.51+ | Preview: 2.58+ when you [opt-in](sensitivity-labels-coauthoring.md#opt-in-to-the-preview-of-co-authoring-for-ios-and-android) | Preview: 16.0.14931+ when you [opt-in](sensitivity-labels-coauthoring.md#opt-in-to-the-preview-of-co-authoring-for-ios-and-android) | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | -**Footnotes:** --<sup>\*</sup> -Currently rolling out justification text to remove a label or lower the classification level ### Sensitivity label capabilities in Outlook |
| enterprise | Managing Office 365 Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/managing-office-365-endpoints.md | See an IP associated with Office 365 that you want more information on? <a name="bkmk_cname"> </a> ### Some Office 365 URLs point to CNAME records instead of A records in the DNS. What do I have to do with the CNAME records? -Client computers need a DNS A or AAAA record t)hat includes one or more IP address(es) to connect to a cloud service. Some URLs included in Office 365 show CNAME records instead of A or AAAA records. These CNAME records are intermediary and there may be several in a chain. They will always eventually resolve to an A or AAAA record for an IP Address. For example, consider the following series of DNS records, which ultimately resolves to the IP address _IP_1_: +Client computers need a DNS A or AAAA record that includes one or more IP address(es) to connect to a cloud service. Some URLs included in Office 365 show CNAME records instead of A or AAAA records. These CNAME records are intermediary and there may be several in a chain. They will always eventually resolve to an A or AAAA record for an IP Address. For example, consider the following series of DNS records, which ultimately resolves to the IP address _IP_1_: ```console serviceA.office.com -> CNAME: serviceA.domainA.com -> CNAME: serviceA.domainB.com -> A: IP_1 |
| security | TOC | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/TOC.md | #### [Use limited periodic scanning in Microsoft Defender Antivirus](limited-periodic-scanning-microsoft-defender-antivirus.md) #### [Tune performance of Microsoft Defender Antivirus](tune-performance-defender-antivirus.md) #### [Compatibility with other security products](microsoft-defender-antivirus-compatibility.md) +#### [Find malware detection names for Microsoft Defender for Endpoint](find-defender-malware-name.md) #### [Get your antivirus and antimalware updates](manage-updates-baselines-microsoft-defender-antivirus.md) ##### [Manage the sources for Microsoft Defender Antivirus protection updates](manage-protection-updates-microsoft-defender-antivirus.md) |
| security | Find Defender Malware Name | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/find-defender-malware-name.md | + + Title: Find malware detection names for Microsoft Defender for Endpoint +description: How to find the names for the latest malware detections in Defender for Endpoint +keywords: Microsoft malware family names +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro +++MS.technology: mde +++# Find malware detection names for Microsoft Defender for Endpoint ++**Applies to:** +- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/?linkid=2154037) +- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) ++It might be confusing to understand how Defender for Endpoint detects specific malware families. This is because malware naming schemes vary depending on who is first to report it, how it's referred to in the media, and how some companies use specific naming conventions. ++Microsoft is part of the [Microsoft Virus Information Alliance (VIA)](/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md) program. This effort is a public collaboration program to help fight cybercrime. Microsoft names specific malware according to the [Computer Antivirus Research Organization (CARO)](/windows/security/threat-protection/intelligence/malware-naming.md). For example, Microsoft detects the Sunburst cyberattack as **Trojan:MSIL/Solorigate.BR!dha**. ++To understand how Microsoft Defender for Endpoint detects specific malware families, you can follow the process outlined below. ++## Find the detection name for a malware family +To find the detection name of a malware family, you'll need to search the internet for the malware name plus "hash". ++1. Get the name of the malware family +2. Search the web for *malware family* + **cyberattack + hash** to find the hash +3. Look up the hash in [Virus Total](https://www.virustotal.com/) +4. Find the Microsoft row and how we name the malware +5. Look up the malware name in the [Microsoft Defender Security Intelligence website] (https://www.microsoft.com/en-us/wdsi/threats). You should see Microsoft information and guidance specific to that malware. ++For example, search for the "Sunburst cyberattack hash". One of the websites returned in the search results should have the hash. In this example, the hash is **a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc**. Then, look up this hash in [Virus Total](https://www.virustotal.com/). ++You'll find the Microsoft row detects this malware as **Trojan:MSIL/Solorigate.BR!dha**. Searching in the Microsoft Defender Security Intelligence website, you'll find information specific to that malware, including techincal details and mitigation steps. |
| security | Admin Submission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/admin-submission.md | The reported message will be marked as a false positive or a false negative. An 4. When you're finished, click **Submit**. > [!div class="mx-imgBorder"]- >  + >  > [!NOTE] > If malware filtering has replaced the message attachments with the Malware Alert Text.txt file, you need to submit the original message from quarantine that contains the original attachments. For more information on quarantine and how to release messages with malware false positives, see [Manage quarantined messages and files as an admin](manage-quarantined-messages-and-files.md). The reported message will be marked as a false positive or a false negative. An When you're finished, click **Apply**. > [!div class="mx-imgBorder"]- >  + >  - To filter the entries, click **Filter**. The available filters are: - **Date submitted**: **Start date** and **End date**. The reported message will be marked as a false positive or a false negative. An When you're finished, click **Apply**. > [!div class="mx-imgBorder"]- >  + >  - To group the entries, click **Group** and select one of the following values from the dropdown list: - **None** If you've deployed the [Report Message add-in](enable-the-report-message-add-in. When you're finished, click **Apply**. > [!div class="mx-imgBorder"]- >  + >  - To group the entries, click **Group** and select one of the following values from the dropdown list: - **None** |
| security | Manage Tenant Allows | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/manage-tenant-allows.md | ms.prod: m365-security - [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) - [Microsoft 365 Defender](../defender/microsoft-365-defender.md) -Admins can't add allows directly to the Tenant Allow/Block List. Instead, you use the admin submission process to submit the message that were blocked so the corresponding URL, file, and/or senders will be added to the Tenant Allow/Block List. If a block of the file, URL, or sender has not happened, then the allow will not be created. In most cases where the message was determined to be a false positive that was incorrectly blocked, the allows are kept for as long as needed to give the system time to allow it naturally. +Admins can't add allows directly to the Tenant Allow/Block List. Instead, you use the admin submission process to submit the message that were blocked so the corresponding URL, file, and/or senders will be added to the Tenant Allow/Block List. If a block of the file, URL, or sender has not happened, then the allow will not be created. In most cases where the message was determined to be a false positive that was incorrectly blocked, the allows are kept for as long as needed to give the system time to allow them naturally. > [!IMPORTANT] > Since Microsoft manages the allows for you, sender, URL, or file allows that are not needed or considered to be bad will be removed. This is to protect your environment and prevent a misconfiguration of allows. In cases where you may disagree, a support cases may be needed to help determine why a message is still considered as bad. Allow senders (or domains) on the **Submissions** page in Microsoft 365 Defender 7. When you're finished, click the **Submit** button. > [!div class="mx-imgBorder"]->  +>  ## Add URL allows using the Submissions portal Allow URLs on the **Submissions** page in Microsoft 365 Defender. > [!div class="mx-imgBorder"] >  - ## Add File allows using the Submissions portal Allow Files on the **Submissions** page in Microsoft 365 Defender. |
| security | Safe Links | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/safe-links.md | Safe Links protection is available in the following locations: > [!NOTE] > Safe Links does not work on mail-enabled public folders.+ > + > Safe Links supports only HTTP(S) and FTP formats. - **Microsoft Teams**: Safe Links protection for links in Teams conversations, group chats, or from channels is also controlled by Safe Links policies. You configure the list of URLs in the global settings for Safe Links. For instru - The maximum length of an entry is 128 characters. - All of the entries can't exceed 10,000 characters. - Don't include a forward slash (`/`) at the end of the URL. For example, use `https://www.contoso.com`, not `https://www.contoso.com/`.-- A domain only-URL (for example `contoso.com` or `tailspintoys.com`) will block any URL that contains the domain.+- A domain-only-URL (for example `contoso.com` or `tailspintoys.com`) will block any URL that contains the domain. - You can block a subdomain without blocking the full domain. For example, `toys.contoso.com*` blocks any URL that contains the subdomain, but it doesn't block URLs that contain the full domain `contoso.com`. - You can include up to three wildcards (`*`) per URL entry. To add entries to the list in new or existing Safe Links policies, see [Create S **Notes**: -- The following clients don't recognize the **Do not rewrite the following URLs** lists in Safe Links policies. Users included in the polices can be blocked from accessing the URLs based on the results of Safe Links scanning in these clients:+- The following clients don't recognize the **Do not rewrite the following URLs** lists in Safe Links policies. Users included in the policies can be blocked from accessing the URLs based on the results of Safe Links scanning in these clients: - Microsoft Teams - Office web apps |
| security | View And Release Quarantined Messages From Shared Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/view-and-release-quarantined-messages-from-shared-mailboxes.md | ms.prod: m365-security # View and release quarantined messages from shared mailboxes -> [!NOTE] -> The features that are described in this article are currently in Preview, aren't available to everyone, and are subject to change. - Users can manage quarantined messages where they are one of the recipients as described in [Find and release quarantined messages as a user in EOP](find-and-release-quarantined-messages-as-a-user.md). But what about **shared mailboxes** where the user has Full Access and Send As or Send on Behalf permissions to the mailbox as described in [Shared mailboxes in Exchange Online](/exchange/collaboration-exo/shared-mailboxes)? -Previously, the ability for users to manage quarantined messages sent to a shared mailbox required admins to leave automapping enabled for the shared mailbox (it's enabled by default when an admin gives a user access to another mailbox). However, depending on the size and number of mailboxes that the user has access to, performance can suffer as Outlooks tries to open *all* mailboxes that the user has access to. For this reason, many admins choose to [remove automapping for shared mailboxes](/outlook/troubleshoot/profiles-and-accounts/remove-automapping-for-shared-mailbox). +Previously, the ability for users to manage quarantined messages sent to a shared mailbox required admins to leave automapping enabled for the shared mailbox (it's enabled by default when an admin gives a user access to another mailbox). However, depending on the size and number of mailboxes that the user has access to, performance can suffer as Outlooks tries to open _all_ mailboxes that the user has access to. For this reason, many admins choose to [remove automapping for shared mailboxes](/outlook/troubleshoot/profiles-and-accounts/remove-automapping-for-shared-mailbox). Now, automapping is no longer required for users to manage quarantined messages that were sent to shared mailboxes. It just works. There are two different methods to access quarantined messages that were sent to a shared mailbox: |
| security | View Email Security Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/view-email-security-reports.md | To view the report in the Microsoft 365 Defender portal at <https://security.mic On the **Mailflow status report** page, the **Type** tab is selected by default. The chart shows the following information for the specified date range: -- **Good mail**+- **Good mail**: Email that's determined not to be spam or are allowed by user or organizational policies. - **Total**-- **Malware**-- **Phishing email**-- **Spam**-- **Edge protection**-- **Rule messages**+- **Malware**: Email that's blocked as malware by various filters. +- **Phishing email**: Email that's blocked as phishing by various filters. +- **Spam**: Email that's blocked as spam by various filters. +- **Edge protection**: Email that's rejected at the edge/perimeter before being evaluated by EOP or Defender for Office 365. +- **Rule messages**: Email messages that were acted upon by mail flow rules (also known as transport rules). The details table below the graph shows the following information: |