+description: "Learn how to get the Microsoft 365 Copilot usage report and gain insights into the Copilot for Microsoft 365 activity in your organization."

+The Copilot for Microsoft 365 report, which is in continuous enhancement, includes a Readiness section and Usage section. In the Readiness section, you can view which users are technically eligible for Copilot, assign licenses, and monitor usage of Microsoft 365 apps that Copilot integrates best with. Within the Usage section, you can view a summary of how usersΓÇÖ adoption, retention, and engagement are with Copilot for Microsoft 365, and the activity of every Copilot user in your organization. The report becomes available within 72 hours, and once available, the usage data shown on the report can have up to a maximum of 72 hours latency.

+1. Sign in to the [Microsoft 365 admin center](https://admin.microsoft.com) and from the view menu, select the dropdown, and choose **Health**.

+ - azure-ad-ref-level-one-done

+ - must-keep

+> As of Nov. 2022, **Cross Tenant User Data Migration** is available as an add-on to the following Microsoft 365 subscription plans for Enterprise Agreement customers, and is required for cross-tenant migrations. User licenses are per migration (one-time fee) and can be assigned either on the source or target user object. This license also covers [OneDrive for Business migration](cross-tenant-onedrive-migration.md). Contact your Microsoft account team for details.

+``` code

+Error: CrossTenantMigrationWithoutLicensePermanentException: No license was found for the source recipient, '65c3c3ea-2b9a-44d0-a685-9bfe300f8c87', or the target recipient, '65c3c3ea-2b9a-44d0-a685-9bfe300f8c87'. A Cross-tenant User Data Migration license is required to move a mailbox between tenants.

+```

+ > You'll need the application ID of the mailbox migration app you just created and the password (secret) you configured in [Prepare the target (destination) tenant by creating the migration application and secret](#prepare-the-target-destination-tenant-by-creating-the-migration-application-and-secret). Depending on the Microsoft 365 cloud instance you use, your endpoint may be different. See the [Microsoft 365 endpoints](microsoft-365-endpoints.md) page; select the correct instance for your tenant; then review the Exchange Online _Optimize/Required_ address, and replace as appropriate.

+Yes. However, we only keep the store permissions as described in this article:

+Don't exceed 2,000 mailboxes per batch. We strongly recommend submitting batches two weeks prior to the cut-over date as there's no impact on the end users during synchronization. If you need guidance for mailboxes quantities over 50,000, you can reach out to the Engineering Feedback Distribution List at crosstenantmigrationpreview@service.microsoft.com.

+The mailbox is decrypted prior to moving. Ensure Customer Key is configured in the target tenant if it's still required. For more information, see [here](/purview/customer-key-overview).

+> [!NOTE]

+> The following script uses Microsoft Graph Powershell. For more information, see [Microsoft Graph PowerShell overview](/powershell/microsoftgraph/overview).

+>

+> For information about how to use different methods to authenticate ```Connect-Graph``` in an unattended script, see the article [Authentication module cmdlets in Microsoft Graph PowerShell](/powershell/microsoftgraph/authentication-commands).

+```powershell

+# Connect to Microsoft Graph

+Connect-Graph -Scopes User.ReadWrite.All, Organization.Read.All

+# Get licensing plans and include disabled plans

+$EmsSku = Get-MgSubscribedSku -All | Where SkuPartNumber -eq 'ENTERPRISEPREMIUM'

+$User = Get-MgUser -UserId LaraN@contoso.onmicrosoft.com

+$userLicense = Get-MgUserLicenseDetail -UserId $User.Id

+$userDisabledPlans = $userLicense.ServicePlans |

+ Where ProvisioningStatus -eq "Disabled" |

+ Select -ExpandProperty ServicePlanId

+$newDisabledPlans = $EmsSku.ServicePlans |

+ Where ServicePlanName -in ("LOCKBOX_ENTERPRISE","EXCHANGE_S_ENTERPRISE","INFORMATION_BARRIERS","MIP_S_CLP2","MIP_S_CLP1","MYANALYTICS_P2","EXCHANGE_ANALYTICS","EQUIVIO_ANALYTICS","THREAT_INTELLIGENCE","PAM_ENTERPRISE","PREMIUM_ENCRYPTION") |

+ Select -ExpandProperty ServicePlanId

+$disabledPlans = $userDisabledPlans + $newDisabledPlans | Select -Unique

+$addLicenses = @(

+ @{SkuId = $EmsSku.SkuId

+ DisabledPlans = $disabledPlans

+ }

+ )

+Set-MgUserLicense -UserId '38955658-c844-4f59-9430-6519430ac89b' -AddLicenses $addLicenses -RemoveLicenses @()

+Id DisplayName Mail UserPrincipalName UserType

+-- -- - -- --

+38955658-c844-4f59-9430-6519430ac89b Bianca Pisani BiancaP@contoso.onmicrosoft.com Member

+```

+ $order = @(

+ @{ Expression = 'ProvisioningStatus'; Ascending = $true }

+ )

+ Get-MgUserLicenseDetail -UserId '38955658-c844-4f59-9430-6519430ac89b' | Select-Object -ExpandProperty ServicePlans | sort ProvisioningStatus $order

+ AppliesTo ProvisioningStatus ServicePlanId ServicePlanName

+ -

+User Success 2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2 ADALLOM_S_STANDALONE

+User Success 6c6042f5-6f01-4d67-b8c1-eb99d36eed3e STREAM_O365_E5

+User Success e212cbc7-0961-4c40-9825-01117710dcb1 FORMS_PLAN_E5

+User Success 07699545-9485-468e-95b6-2fca3738be01 FLOW_O365_P3

+User Success 9c0dab89-a30c-4117-86e7-97bda240acd2 POWERAPPS_O365_P3

+User Success 871d91ec-ec1a-452b-a83f-bd76c7d770ef WINDEFATP

+User Success 21b439ba-a0ca-424f-a6cc-52f954a5b111 WIN10_PRO_ENT_SUB

+User Success 57ff2da0-773e-42df-b2af-ffb7a2317929 TEAMS1

+User Success 8c7d2df8-86f0-4902-b2ed-a0458298f3b3 Deskless

+User Success 8e0c0a52-6a6c-4d40-8370-dd62790dcd70 THREAT_INTELLIGENCE

+User Success 4a51bca5-1eff-43f5-878c-177680f191af WHITEBOARD_PLAN3

+User Success efb0351d-3b08-4503-993d-383af8de41e3 MIP_S_CLP2

+User Success 617b097b-4b93-4ede-83de-5f075bb5fb2f PREMIUM_ENCRYPTION

+User Success 8c098270-9dd4-4350-9b30-ba4703f3b36b ADALLOM_S_O365

+Company Success 94065c59-bc8e-4e8b-89e5-5138d471eaff MICROSOFT_SEARCH

+User Success 14ab5db5-e6c4-4b20-b4bc-13e36fd2227f ATA

+User Success 3fb82609-8c27-4f7b-bd51-30634711ee67 BPOS_S_TODO_3

+User Success b1188c4c-1b36-4018-b48b-ee07604f6feb PAM_ENTERPRISE

+User Success 5136a095-5cf0-4aff-bec3-e84448b38ea5 MIP_S_CLP1

+User Success 33c4f319-9bdd-48d6-9c4d-410b750a4a5a MYANALYTICS_P2

+User Success 5689bec4-755d-4753-8b61-40975025187c RMS_S_PREMIUM2

+User Success 4828c8ec-dc2e-4779-b502-87ac9ce28ab7 MCOEV

+User Success 9f431833-0334-42de-a7dc-70aa40db46db LOCKBOX_ENTERPRISE

+User Success 3e26ee1f-8a5f-4d52-aee2-b81ce45c8f40 MCOMEETADV

+User Success 43de0ff5-c92c-492b-9116-175376d08c38 OFFICESUBSCRIPTION

+User Success 0feaeb32-d00e-4d66-bd5a-43b5b83db82c MCOSTANDARD

+User Success 70d33638-9c74-4d01-bfd3-562de28bd4ba BI_AZURE_P2

+Company Success f20fedf3-f3c3-43c3-8267-2bfdd51c0939 ATP_ENTERPRISE

+User Success 4de31727-a228-4ec3-a5bf-8e45b5ca48cc EQUIVIO_ANALYTICS

+User Success efb87545-963c-4e0d-99df-69c6916d9eb0 EXCHANGE_S_ENTERPRISE

+User Success 34c0d7a0-a70f-4668-9238-47f9fc208882 EXCHANGE_ANALYTICS

+User Success 8a256a2b-b617-496d-b51b-e76466e88db0 MFA_PREMIUM

+User Success 41781fb2-bc02-4b7c-bd55-b576c07bb09d AAD_PREMIUM

+User Success bea4c11e-220a-4e6d-8eb8-8ea15d019f90 RMS_S_ENTERPRISE

+User Success eec0eb4f-6444-4f95-aba0-50c24d67f998 AAD_PREMIUM_P2

+User Success 6c57d4b6-3b23-47a5-9bc9-69f17b4947b3 RMS_S_PREMIUM

+User Success 5dbe027f-2339-4123-9542-606e4d348a72 SHAREPOINTENTERPRISE

+User Success b737dad2-2f6c-4c65-90e3-ca563267e8b9 PROJECTWORKMANAGEMENT

+User Success e95bec33-7c88-4a70-8e19-b10bd9d0c014 SHAREPOINTWAC

+User Success 7547a3fe-08ee-4ccb-b430-5077c5041653 YAMMER_ENTERPRISE

+User Success a23b959c-7ce8-4e57-9140-b90eb88a9e97 SWAY

+User Success c4801e8a-cb58-4c35-aca6-f2dcc106f287 INFORMATION_BARRIERS

+User Success b76fb638-6ba6-402a-b9f9-83d28acb3d86 VIVA_LEARNING_SEEDED

+Company Success db4d623d-b514-490b-b7ef-8885eee514de Nucleus

+Company Success 6f23d6a9-adbf-481c-8538-b4c095654487 M365_LIGHTHOUSE_CUSTOMER_PLAN1

+User Success a82fbf69-b4d7-49f4-83a6-915b2cf354f4 VIVAENGAGE_CORE

+User Success 9a6eeb79-0b4b-4bf0-9808-39d99a2cd5a3 Windows_Autopatch

+User Success cd31b152-6326-4d1b-ae1b-997b625182e6 MIP_S_Exchange

+User Success a413a9ff-720c-4822-98ef-2f37c2a21f4c MICROSOFT_COMMUNICATION_COMPLIANCE

+User Success 795f6fe0-cc4d-4773-b050-5dde4dc704c9 UNIVERSAL_PRINT_01

+Company Success 2b815d45-56e4-4e3a-b65c-66cb9175b560 ContentExplorer_Standard

+User Success 7bf960f6-2cd9-443a-8046-5dbff9558365 WINDOWSUPDATEFORBUSINESS_DEPLOYMENTSERVICE

+User Success 3ec18638-bd4c-4d3b-8905-479ed636b83e CustomerLockboxA_Enterprise

+User Success 3efbd4ed-8958-4824-8389-1321f8730af8 MESH_AVATARS_ADDITIONAL_FOR_TEAMS

+User Success 99cd49a9-0e54-4e07-aea1-d8d9f5f704f5 Defender_for_Iot_Enterprise

+User Success 0898bdbb-73b0-471a-81e5-20f1fe4dd66e KAIZALA_STANDALONE

+User Success c948ea65-2053-4a5a-8a62-9eaaaf11b522 PURVIEW_DISCOVERY

+User Success a1ace008-72f3-4ea0-8dac-33b3a23a2472 CLIPCHAMP

+User Success f6de4823-28fa-440b-b886-4783fa86ddba M365_AUDIT_PLATFORM

+User Success 0d0c0d31-fae7-41f2-b909-eaf4d7f26dba Bing_Chat_Enterprise

+User Success dcf9d2f4-772e-4434-b757-77a453cfbc02 MESH_AVATARS_FOR_TEAMS

+User Success c4b8c31a-fb44-4c65-9837-a21f55fcabda MICROSOFT_LOOP

+User Success a6520331-d7d4-4276-95f5-15c0933bc757 GRAPH_CONNECTORS_SEARCH_INDEX

+User Success e26c2fcc-ab91-4a61-b35c-03cdc8dddf66 INFO_GOVERNANCE

+User Success 46129a58-a698-46f0-aa5b-17f6586297d9 DATA_INVESTIGATIONS

+User Success 9d0c4ee5-e4a1-4625-ab39-d82b619b1a34 INSIDER_RISK_MANAGEMENT

+User Success 65cc641f-cccd-4643-97e0-a17e3045e541 RECORDS_MANAGEMENT

+User Success d2d51368-76c9-4317-ada2-a12c004c432f ML_CLASSIFICATION

+User Success bf6f5520-59e3-4f82-974b-7dbbc4fd27c7 SAFEDOCS

+User Success 2f442157-a11c-46b9-ae5b-6e39ff4e5849 M365_ADVANCED_AUDITING

+User Success 41fcdd7d-4733-4863-9cf4-c65b83ce2df4 COMMUNICATIONS_COMPLIANCE

+User Success 6db1f1db-2b46-403f-be40-e39395f08dbb CUSTOMER_KEY

+User Success 6dc145d6-95dd-4191-b9c3-185575ee6f6b COMMUNICATIONS_DLP

+User Success 199a5c09-e0ca-4e37-8f7c-b05d533e1ea2 MICROSOFTBOOKINGS

+User Success ded3d325-1bdc-453e-8432-5bac26d7a014 POWER_VIRTUAL_AGENTS_O365_P3

+Company Success d9fa6af4-e046-4c89-9226-729a0786685d Content_Explorer

+User Success afa73018-811e-46e9-988f-f75d2b1b8430 CDS_O365_P3

+User Success b21a6b06-1988-436e-a07b-51ec6d9f52ad PROJECT_O365_P3

+User Success 64bfac92-2b17-4482-b5e5-a0304429de3e MICROSOFTENDPOINTDLP

+User Success bf28f719-7844-4079-9c78-c1307898e192 MTP

+User Success 28b0fa46-c39a-4188-89e2-58e979a6b014 DYN365_CDS_O365_P3

+User Success d587c7a3-bda9-4f99-8776-9bcf59c84f75 INSIDER_RISK

+User Success 531ee2f8-b1cb-453b-9c21-d2180d014ca5 EXCEL_PREMIUM

+User PendingProvisioning f0ff6ac6-297d-49cd-be34-6dfef97f0c28 MESH_IMMERSIVE_FOR_TEAMS

+User PendingInput c1ec4a95-1f05-45b3-a911-aa3fa01094f5 INTUNE_A

+Company PendingActivation 882e1d05-acd1-4ccb-8708-6ee03664b117 INTUNE_O365

+ Remove users with the following command:

+ ```powershell

+ Get-MigrationUser -Identity LaraN@contoso.onmicrosoft.com -IncludeAssociatedUsers | Remove-MigrationUser

+ ```

+

+ Remove users with the following command:

+ ```powershell

+ Get-MigrationUser -Identity LaraN@contoso.onmicrosoft.com -IncludeAssociatedUsers | Remove-MigrationUser

+ ```

+

+ Remove the invalid proxy address using the following command:

+ ```powershell

+ Set-MailUser LaraN@contoso.onmicrosoft.com -EmailAddress @{remove="smtp:LaraN@northwindtraders.onmicrosoft.com"}

+ ```

+ Remove users with the following command:

+ ```powershell

+ Get-MigrationUser -Identity LaraN@contoso.onmicrosoft.com -IncludeAssociatedUsers | Remove-MigrationUser

+ ```

+ Remove users with the following command:

+ ```powershell

+ Get-MigrationUser -Identity LaraN@contoso.onmicrosoft.com -IncludeAssociatedUsers | Remove-MigrationUser

+ ```

+ Update the ExchangeGuid with the following command:

+ ```powershell

+ Set-MailUser LaraN@contoso.onmicrosoft.com -ExchangeGuid 4e3188c6-39f5-4387-adc7-b355b6b852c8

+ ```

+ Remove users with the following command:

+ ```powershell

+ Get-MigrationUser -Identity LaraN@contoso.onmicrosoft.com -IncludeAssociatedUsers | Remove-MigrationUser

+ ```

+ Re-enable the disabled archive mailbox with the following command:

+ ```powershell

+ Enable-Mailbox -Archive mailbox@contoso.onmicrosoft.com.

+ ```

+## See also

+- [Manage Microsoft 365 with PowerShell](manage-microsoft-365-with-microsoft-365-powershell.md)

+- [Get started with the Microsoft Graph PowerShell SDK](/powershell/microsoftgraph/get-started)

+Microsoft 365 for frontline workers can help you connect and engage your workforce, enhance workforce management, and increase operational efficiency. There are several solution areas that can help you achieve these goals.

+Think of Microsoft 365 foundational security and device management capabilities as setting a secure baseline, on which you can build scenarios that enable, empower, and transform your frontline business. You can use the capabilities included with Microsoft 365 for frontline workers, from Microsoft Teams, to SharePoint, Viva Connections, Viva Engage, and Power Platform, or add in solutions from our partners in the digital ecosystem to connect with existing systems or create custom solutions for your business.

+Use these scenario overviews to start envisioning what your organization can do with Microsoft 365 for frontline workers, and then follow the links to find out how to implement these scenarios.

+|[](https://go.microsoft.com/fwlink/?linkid=2206713) <br/> [PDF](https://go.microsoft.com/fwlink/?linkid=2206713) \| [Visio](https://go.microsoft.com/fwlink/?linkid=2206386) <br>Updated January 2024 |This poster provides an overview of the scenarios you can implement for your frontline workforce to increase communications, enhance wellbeing and engagement, train and onboard your workers, and manage your workforce and operations.|

+<!-- Watch the following video to see an example of how you can help your frontline workers connect and collaborate in retail organizations:

+> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWRJVw]-->

+| [Team communication and collaboration](flw-team-collaboration.md) | Help your frontline workforce communicate within their store, shift, or team with Microsoft Teams. Viva Connections helps you create a dashboard that puts the information they need front and center on their devices, so they can reach out whenever they need to. | Teams<br>Outlook<br>SharePoint<br>Power Platform and Power Apps | Approvals, Chat, Files, Lists, Meet, Praise, Shifts, Tasks, Walkie Talkie, Viva Connections|

+| [Corporate communications](flw-corp-comms.md) | Employee engagement is a significant contributor to workplace satisfaction, loyalty, and productivity at any organization. Learn how to keep everyone informed and engaged using SharePoint, Teams, and Viva Engage. Bring it all together with Viva Connections. | Teams<br>Outlook<br>SharePoint | Meet, Viva Engage, Viva Connections |

+| [Engage your employees and focus on employee wellbeing](flw-wellbeing-engagement.md) | Build deeper connections across your organization and create an inclusive workplace. | Teams<br>SharePoint| Viva Engage, Viva Connections, Praise |

+| [Onboard new employees](flw-onboarding-training.md) | Make new employee onboard a great experience by fostering an all-in-one hybrid work environment where new employees can find important resources, meet people in their organization, and prepare to be successful in their new role.| SharePoint| Lists, Viva Learning, Viva Connections, Viva Engage |

+| [Ongoing training](flw-onboarding-training.md#ongoing-training) | After they're onboarded, help your workforce keep their skills up to date with ongoing training in Viva Learning. | SharePoint| Viva Learning, Viva Connections, Viva Engage |

+| [Schedule your teams with Shifts](shifts-for-teams-landing-page.md) | Use Shifts and Shifts connectors to schedule your teams and connect with your workforce management tools. | Teams | Shifts |

+<!--Watch the following video to see an example of how you can simplify business processes in retail environments:

+> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWRzfc]-->

+| [Simplify business processes](simplify-business-processes.md) | Use task publishing to create standard processes across sites, lists to manage information and track ongoing processes, and streamline requests with Approvals. Automated workflows can speed up and automate actions, like collecting data or routing notifications. | Teams<br>Power Platform | Tasks, Lists, Approvals |

+Use the Virtual Appointments app and Microsoft Teams to schedule, manage, and host virtual appointments with clients and customers. You can integrate Forms with your virtual appointments to get the right information about your customers, or as part of your customer support experience to learn what your customers need.

+The scenarios described earlier in this article can be achieved with out-of-the-box capabilities from Microsoft. You can extend even further with third-party apps in [AppSource](https://appsource.microsoft.com/marketplace/apps?search=frontline&page=1) and custom apps that you or our partners build for you with Power Platform, Teams, and Viva extensibility.

+### Microsoft Copilot Studio

+With [Microsoft Copilot Studio](/microsoft-copilot-studio/fundamentals-what-is-copilot-studio), you can quickly create powerful AI-powered copilots using a guided, no-code graphical experience. Give your frontline access to the help they need. Automate frequently asked questions, common business processes, and more.

+With code from scratch or by using templated and sample code, you can build custom apps on the [Teams platform](/microsoftteams/platform/).

+- **APIs:** Use Microsoft Graph to enhance apps inside and outside of Teams.

+### Viva Connections extensibility

+Many components of the Viva Connections experience can be customized and extended. Learn more about [Viva Connections extensibility](/sharepoint/dev/spfx/viva/overview-viva-connections).

+Before you commit to a full rollout of Microsoft 365 for frontline workers across your organization, it's a good idea to try it out first with a small set of people in your organization. Starting with a pilot program first can help:

+- Ensure a successful, organization-wide rollout.

+- Whether the scenarios you identified match the business needs of your organization.

+- What elements need to be modified or further customized for your organization.

+- What training and orientation information you need to provide to users before, during, and after they start working with these new tools.

+Assemble a group of individuals from your business, IT, and frontline communities to act as the stakeholder and decision-making group for your Microsoft 365 pilot for frontline workers. Be sure to include individuals from all three communities to give yourself the best chance for success.

+Next, identify your phase 1 pilot community and make sure it includes actual frontline workers in the smallest logical grouping for your organization. For example, one restaurant, one division of a department store, one store, one clinical ward, one precinct, one plant, one distribution center, etc. The key is to optimize around the average frontline worker being part of one team only. Managers or specialists might be in more than one team.

+It's important to include all roles within that smallest logical grouping, from managers to part time or seasonal workers, to uncover valuable insights and enable modern communication scenarios.

+Here's some tips for a successful pilot.

+- Set start and end dates and define clear goals for measuring success. These goals can help you plan your rollout after the pilot is completed.

+- Create a test plan, a process for gathering feedback, and a communication plan.

+- Include the right stakeholders and participants, knowing you can add more users throughout the pilot, if necessary. For Microsoft 365 for frontline workers, make sure your stakeholders and participants include not only the business leaders and IT staff, but your frontline managers and workers, so you can:

+ - Check to make sure your implementation is having a positive effect on those challenges.

+For a successful pilot for frontline workers, simplicity is key! For most organizations, this community typically isnΓÇÖt provided any company-supported communication or collaboration technology, but are likely already using unsupported consumer tools to accomplish some basic needs.

+A recommended best practice is to begin where your users are and mimic the capabilities theyΓÇÖre using in consumer tools today. As your pilot progresses and the iteration process begins, you can grow the experience.

+- Which capabilities will you include in Phase 1 of your pilot?

+- Do your frontline workers need Shifts for schedule management?

+- Do your frontline workers need Walkie Talkie for push-to-talk (PTT) communications?

+Use a survey to take inventory of the tools, capabilities, and scenarios your users rely on today.

+Determine what devices to support. For example, you can use the Teams mobile clients on Android and iOS for on-the-go access to Teams and frontline worker apps. See [Get Teams clients](/microsoftteams/get-clients) and [Manage devices for frontline workers](flw-devices.md).

+See [Set up Microsoft 365 for frontline workers](flw-setup-microsoft-365.md) and [Teams deployment overview](/microsoftteams/deploy-overview) for guidance on how to set up Microsoft 365, Teams, and the other services you need for your pilot.

+- What chat and channel messaging features will you include in your pilot?

+- Will you create teams from scratch or from a [team template](/microsoftteams/get-started-with-teams-templates-in-the-admin-console)?

+Keep the channels simple. We recommend resisting the urge to create a channel for every possible area of conversation and instead keep things simple. ItΓÇÖs okay if channels are created over time as needed.

+After you set up your teams and channels, configure frontline apps that you want to use in the pilot, including:

+- [Walkie Talkie](/microsoftteams/manage-virtual-appointments-app?bc=/microsoft-365/frontline/breadcrumb/toc.json&toc=/microsoft-365/frontline/toc.json) for instant voice communications.

+- The [Virtual Appointments](/microsoftteams/walkie-talkie?bc=/microsoft-365/frontline/breadcrumb/toc.json&toc=/microsoft-365/frontline/toc.json) app to schedule appointments with clients or customers.

+Inform your frontline workers of their participation in the pilot, the pilot goals, and provide training, if necessary, on the basics.

+For example, this can be an instruction to go to the Google Play or Apple Store on their mobile devices, download the Teams app, and sign in with their company credentials. Share resources from [Microsoft Teams help & learning](https://support.microsoft.com/teams), as needed. We designed Teams with an easy-to-use interface that most frontline workers should find intuitive.

+DonΓÇÖt forget to train your managers on Shifts! If youΓÇÖre going to include Shifts in your pilot, consider holding a training session with your managers on how to create, manage, and publish schedules to their team.

+Measure usage and assess user feedback. Usage reports help you understand usage and activity patterns, and along with user feedback, provide valuable insight.

+See [Microsoft 365 reports in the admin center](../admin/activity-reports/activity-reports.md), [Microsoft 365 usage analytics](../admin/usage-analytics/usage-analytics.md), and [Teams analytics and reporting](/microsoftteams/teams-analytics-and-reports/teams-reporting-reference).

+Empowering your frontline workers is more about people than technology. To understand the impact of Teams, stay focused on your frontline workersΓÇÖ experience. Survey them before, during and after the pilot in order to understand their needs, pain points, and reactions. You might want to set up a Feedback channel in Teams to collect feedback about their experiences.

+If you're iterating your pilot and adding new features over time, this feedback can help guide the order, pace, or even whether additional features are needed.

+Nurture your champions and highlight your wins. Reward your frontline workers for embracing these new tools and using them in innovative ways that relate to business outcomes for your company. This helps ensure continued adoption of Teams and value to your company.

+Now that you successfully completed your first pilot with an initial group of frontline workers, itΓÇÖs time to expand! Consider one of the following expansion options:

+ - Instead of one location, can you do one region?

+- Expand features and capabilities.

+ - Was there a key feature that your frontline workers suggested that wasn't included in the initial feature set?

+We recommend working through this process as many times as needed to arrive at a solution, set of best practices, and training documentation for your frontline workers.

+## Configuration profile validation

+The configuration profile must be a valid JSON-formatted file. There are many tools that can be used to verify this. For example, if you have `python` installed on your device:

+```bash

+python -m json.tool mdatp_managed.json

+```

+If the JSON is well-formed, the above command outputs it back to the Terminal and returns an exit code of `0`. Otherwise, an error that describes the issue is displayed and the command returns an exit code of `1`.

+## Verifying that the mdatp_managed.json file is working as expected

+To verify that your /etc/opt/microsoft/mdatp/managed/mdatp_managed.json is working properly, you should see "[managed]" next to these settings:

+- cloud_enabled

+- cloud_automatic_sample_submission_consent

+- passive_mode_enabled

+- real_time_protection_enabled

+- automatic_definition_update_enabled

+>[!NOTE]

+>No restart of mdatp daemon is required for changes to _most_ configurations in mdatp_managed.json to take effect.

+ **Exception:** The following configurations require a daemon restart to take effect:

+> - cloud-diagnostic

+> - log-rotation-parameters

+## Configuration profile deployment

+Once you've built the configuration profile for your enterprise, you can deploy it through the management tool that your enterprise is using. Defender for Endpoint on Linux reads the managed configuration from the */etc/opt/microsoft/mdatp/managed/mdatp_managed.json* file.

+Modern malware requires modern solutions. In 2015, Microsoft Defender Antivirus moved away from using a static signature-based engine to a model that uses predictive technologies such as, machine learning, applied science, and artificial intelligence as this is what's necessary to keep you and your organizations safe from the complexity of todayΓÇÖs ever-evolving malware landscape.

+ Title: Important considerations related to Defender Experts for XDR

+# Important considerations for Microsoft Defender Experts for XDR

+### Note about incident response

+- [General information on Defender Experts for XDR service](frequently-asked-questions.md)

+- [How Microsoft Defender Experts for XDR permissions work](dex-xdr-permissions.md)

+[Important considerations for Microsoft Defender Experts for XDR](additional-information-xdr.md)

+- [Managed detection and response](managed-detection-and-response-xdr.md)

+- [Get real-time visibility with Defender Experts for XDR reports](reports-xdr.md)

+[Important considerations for Microsoft Defender Experts for XDR](additional-information-xdr.md)

+The following section lists down questions your SOC team might have regarding the receipt of [incident notifications](managed-detection-and-response-xdr.md#incident-updates).

+| **How do I know whether a Defender Experts analyst has sent any response actions for my SOC team?** | The Defender Experts analyst publishes the response actions they recommend your SOC team to perform on an incident in an incident's **Managed response** flyout panel in your Microsoft Defender portal.<br><br>At this time, the incident's **Assigned to** field is updated to _Customer_ and its **Status** is updated to _Awaiting Customer Action_.<br><br>Your incident contacts, which you have [designated](/microsoft-365/security/defender/get-started-xdr#tell-us-who-to-contact-for-important-matters) in **Settings** > **Defender Experts** > **Notification contacts** in your Microsoft Defender portal, also receive a corresponding email notification if there are response actions requiring your attention. |

+[Managed detection and response](managed-detection-and-response-xdr.md)

+The following section lists down questions you or your SOC team might have regarding [managed response](managed-detection-and-response-xdr.md).

+[Managed detection and response](managed-detection-and-response-xdr.md)

+ The figures are based on your Defender for Endpoint and Defender for Identity licenses; to achieve these target number of protected assets, [onboard more devices](../defender-endpoint/onboarding.md) to Defender for Endpoint or [install more Defender for Identity sensors](/defender-for-identity/install-sensor).

+Once our experts begin to perform comprehensive response work on your behalf, youΓÇÖll start receiving [notifications about incidents](managed-detection-and-response-xdr.md#incident-updates) that require remediation steps and targeted recommendations on critical incidents. You can also [chat with our experts](communicate-defender-experts-xdr.md) or your SDMs regarding important queries and regular business and security posture reviews, and [view real-time reports](reports-xdr.md) on the number of incidents weΓÇÖve investigated and resolved on your behalf.

+- [Managed detection and response](managed-detection-and-response-xdr.md)

+- [Get real-time visibility with Defender Experts for XDR reports](reports-xdr.md)

+- [Communicating with experts in the Microsoft Defender Experts for XDR service](communicate-defender-experts-xdr.md)

+ Title: Managed detection and response

+description: Defender Experts for XDR provides actionable managed response to your security operations center (SOC) teams.

+keywords: XDR, extended detection and response, managed detection and response in defender experts for XDR, experts for xdr, Microsoft Defender Experts for XDR, managed threat hunting, managed detection and response (MDR) service, Managed response in Teams

+ms.mktglfcycl: deploy

+ms.sitesec: library

+ms.pagetype: security

+ms.localizationpriority: medium

+audience: ITPro

+ - m365-security

+ - tier1

+ - essentials-manage

+search.appverid: met150

+# Managed detection and response

+**Applies to:**

+- [Microsoft Defender XDR](https://go.microsoft.com/fwlink/?linkid=2118804)

+Through a combination of automation and human expertise, Microsoft Defender Experts for XDR triages Microsoft Defender XDR incidents, prioritizes them on your behalf, filters out the noise, carries out detailed investigations, and provides actionable managed response to your security operations center (SOC) teams.

+## Incident updates

+Once our experts start investigating an incident, the incident's **Assigned to** and **Status** fields are updated to _Defender Experts_ and _In progress_, respectively.

+When our experts conclude their investigation on an incident, the incident's **Classification** field is updated to one of the following, depending on the experts' findings:

+- True Positive

+- False Positive

+- Informational, Expected Activity

+The **Determination** field corresponding to each classification is also updated to provide more insights on the findings that led our experts to determine the said classification.

+If an incident is classified as _False Positive_ or _Informational_, _Expected Activity_, then the incident's **Status** field gets updated to _Resolved_. Our experts then conclude their work on this incident and the **Assigned to** field gets updated to _Unassigned_. Our experts may share updates from their investigation and their conclusion when resolving an incident. These updates are posted in the incident's **Comments and history** flyout panel.

+> [!NOTE]

+> Incident comments are one-way posts. Defender Experts can't respond to any comments or questions you add in the **Comments and history** panel. For more information about how to correspond with our experts, see [Communicating with experts in the Microsoft Defender Experts for XDR service](communicate-defender-experts-xdr.md).

+Otherwise, if an incident is classified as _True Positive_, our experts then identify the required response actions that need to be performed. The method in which the actions are performed depends on the permissions and access levels you have given the Defender Experts for XDR service. [Learn more about granting permissions to our experts](get-started-xdr.md#grant-permissions-to-our-experts).

+- If you have granted Defender Experts for XDR the recommended Security Operator access permissions, our experts could perform the required response actions on the incident on your behalf. These actions, along with an **Investigation summary**, show up in the incident's [Managed response](#how-to-use-managed-response-in-microsoft-365-defender) flyout panel in your Microsoft Defender portal for you or your SOC team to review. All actions that are completed by Defender Experts for XDR appear under the **Completed actions** section. Any pending actions that require you or you SOC team to complete are listed under the **Pending actions** section. For more information, see the [Actions](#actions) section. Once our experts have taken all the necessary actions on the incident, its **Status** field is then updated to _Resolved_ and the **Assigned to** field is updated to _Unassigned_.

+- If you have granted Defender Experts for XDR the default Security Reader access, then the required response actions, along with an **Investigation summary**, show up in the incident's **Managed response** flyout panel under the **Pending actions** section in your Microsoft Defender portal for you or your SOC team to perform. For more information, see the [Actions](#actions) section. To identify this handover, the incident's **Status** field is updated to _Awaiting Customer Action_ and the **Assigned to** field is updated to _Customer_.

+You can check the number of incidents that require your action in the Defender Experts banner at the top of the Microsoft Defender homepage.

+To view the incidents our experts have investigated or are currently investigating, filter the incident queue in your Microsoft Defender portal using the _Defender Experts_ tag.

+<a name='how-to-use-managed-response-in-microsoft-365-defender'></a>

+## How to use managed response in Microsoft Defender XDR

+In the Microsoft Defender portal, an incident that requires your attention using managed response has the **Assigned to** field set to _Customer_ and a task card on top of the **Incidents** pane. Your designated incident contacts also receives a corresponding email notification with a link to the Defender portal to view the incident. [Learn more about notification contacts](get-started-xdr.md#tell-us-who-to-contact-for-important-matters).

+Select **View managed response** on the task card or on the top of the portal page (**Managed response** tab) to open a flyout panel where you can read our experts' investigation summary, complete pending actions identified by our experts, or engage with them through chat.

+### Investigation summary

+The **Investigation summary** section provides you with more context about the incident analyzed by our experts to provide you with visibility about its severity and potential impact if not addressed immediately. It could include the device timeline, indicators of attack, and indicators of compromise (IOCs) observed, and other details.

+### Actions

+The **Actions** tab displays task cards that contain response actions recommended by our experts.

+Defender Experts for XDR currently supports the following one-click managed response actions:

+|**Action**|**Description**|

+||--|

+|[Isolate device](/microsoft-365/security/defender-endpoint/respond-machine-alerts##isolate-devices-from-the-network)|Isolates a device, which helps prevent an attacker from controlling it and performing further activities such as data exfiltration and lateral movement. The isolated device will still be connected to Microsoft Defender for Endpoint.|

+|[Quarantine file](/microsoft-365/security/defender-endpoint/respond-file-alerts##stop-and-quarantine-files)|Stops running processes, quarantines the files, and deletes persistent data such as registry keys.|

+|[Restrict app execution](/microsoft-365/security/defender-endpoint/respond-machine-alerts##restrict-app-execution)| Restricts the execution of potentially malicious programs and locks down the device to prevent further attempts.|

+|[Release from isolation](/microsoft-365/security/defender-endpoint/respond-machine-alerts#isolate-devices-from-the-network)| Undoes isolation of a device.|

+|[Remove app restriction](/microsoft-365/security/defender-endpoint/respond-machine-alerts#restrict-app-execution)| Undoes release from isolation.|

+Apart from these one-click actions, you can also receive managed responses from our experts that you need to perform manually.

+> [!NOTE]

+> Before performing any of the recommended managed response actions, make sure that they are not already being addressed by your automated investigation and response configurations. [Learn more about automated investigation and response capabilities in Microsoft Defender XDR](m365d-autoir.md).

+**To view and perform the managed response actions:**

+1. Select the arrow buttons in an action card to expand it and read more information about the required action.

+2. For cards with one-click response actions, select the required action. The **Action status** in the card changes to **In progress**, then to **Failed** or **Completed**, depending on the action's outcome.

+> [!TIP]

+> You can also monitor the status of in-portal response actions in the [Action center](m365d-action-center.md). If a response action fails, try doing it again from the **View device details** page or [initiate a chat](communicate-defender-experts-xdr.md#in-portal-chat) with Defender Experts.

+3. For cards with required actions that you need to perform manually, select **I've completed this action** once you've performed them, then select **Yes, I've done it** in the confirmation dialog box that appears.

+4. If you don't want to complete a required action right away, select **Skip**, then select **Yes, skip this action** in the confirmation dialog box that appears.

+> [!IMPORTANT]

+>If you notice that any of the buttons on the action cards are grayed out, it could indicate that you don't have the necessary permissions to perform the action. Make sure that you're signed into the Microsoft Defender XDR portal with the appropriate permissions. Most managed response actions require that you have at least the Security Operator access. If you still encounter this issue even with the appropriate permissions, navigate to **View device details** and complete the steps from there.

+## Get visibility to Defender Experts investigations in your SIEM or ITSM application

+As Defender Experts for XDR investigate incidents and come up with remediation actions, you can have visibility to their work on incidents in your security information and event management (SIEM) and IT service management (ITSM) applications, including applications that are available out of the box.

+### Microsoft Sentinel

+You can get incident visibility in Microsoft Sentinel by turning on its out-of-the-box Microsoft Defender XDR data connector. [Learn more](/azure/sentinel/connect-microsoft-365-defender).

+Once you have turned on the connector, updates by Defender Experts to the **Status**, **Assigned to**, **Classification**, and **Determination** fields in Microsoft Defender XDR will show up in the corresponding **Status**, **Owner**, and **Reason for closing** fields in Sentinel.

+> [!NOTE]

+> The status of incidents investigated by Defender Experts in Microsoft Defender XDR typically transitions from _Active_ to _In progress_ to _Awaiting Customer Action_ to _Resolved_, while in Sentinel, it follows the _New_ to _Active_ to _Resolved_ path. The Microsoft Defender XDR Status _**Awaiting Customer Action**_ doesn't have an equivalent field in Sentinel; instead, it's displayed as a tag in an incident in Sentinel.

+The following section describes how an incident handled by our experts is updated in Sentinel as it progresses through the investigation journey:

+1. An incident being investigated by our experts has the **Status** listed as _Active_ and the **Owner** listed as _Defender Experts_.

+1. An incident that our experts have confirmed as a _True Positive_ has a managed response posted in Microsoft Defender XDR, and a **Tag** _Awaiting Customer Action_ and the **Owner** is listed as _Customer_. You need to act on the incident based on using the provided managed response.

+1. Once our experts have concluded their investigation and closed an incident as _False Positive_ or _Informational_, _Expected Activity_, the incident's **Status** is updated to _Resolved_, the **Owner** is updated to _Unassigned_, and a **Reason for closing** is provided.

+### Other applications

+You could obtain visibility into incidents in your SIEM or ITSM application by using the [Microsoft Defender XDR API](../defender/api-overview.md) or [connectors in Sentinel](/azure/sentinel/data-connectors-reference).

+After configuring a connector, the updates by Defender Experts to an incident's **Status**, **Assigned to**, **Classification**, and **Determination** fields in Microsoft Defender XDR can be synchronized with the third-party SIEM or ITSM applications, depending on how the field mapping has been implemented. To illustrate, you can take a look at the [connector available from Sentinel to ServiceNow](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Servicenow/StoreApp).

+### See also

+- [Get started with Microsoft Defender Experts for XDR](get-started-xdr.md)

+- [Get real-time visibility with Defender Experts for XDR reports](reports-xdr.md)

+- [Communicating with experts in the Microsoft Defender Experts for XDR service](communicate-defender-experts-xdr.md)

+- [downloadable Excel](https://download.microsoft.com/download/4/5/2/45208247-c1e9-432d-a9a2-1554d81074d9/microsoft-threat-actor-list.xlsx)

+ Title: Defender experts for XDR report

+description: Defender Experts for XDR includes an interactive, on-demand report that provides a clear summary of our expert analysts.

+keywords: XDR, extended detection and response, managed detection and response in defender experts for XDR, Defender xdr reports, XDR report, impacted assets, avergae time to resolve incidents, view incidents, resolved directly

+ms.mktglfcycl: deploy

+ms.sitesec: library

+ms.pagetype: security

+ms.localizationpriority: medium

+audience: ITPro

+ - m365-security

+ - tier1

+ - essentials-manage

+search.appverid: met150

+# Get real-time visibility with Defender Experts for XDR reports

+**Applies to:**

+- [Microsoft Defender XDR](https://go.microsoft.com/fwlink/?linkid=2118804)

+Defender Experts for XDR includes an interactive, on-demand report that provides a clear summary of the work our expert analysts are doing on your behalf, aggregate information about your incident landscape, and granular details about specific incidents. Your service delivery manager (SDM) also uses the report to provide you with more context regarding the service during a monthly business review.

+Each section of the report is designed to provide more insights about the incidents our experts investigated and resolved in your environment in real time. You can also select the **Date range** to get detailed information about incidents based on severity, category, and understand the time taken to investigate and resolve an incident during a specific period.

+## Understand the Defender Experts for XDR report

+The topmost section of the Defender Experts for XDR report provides the percentage of incidents we resolved in your environment, providing you with transparency in our operations. This percentage is derived from the following figures, which are also presented in the report:

+- **Investigated** ΓÇô The number of active threats and other incidents from your incident queue that we triaged, investigated, or currently investigating within our scope.

+- **Resolved** ΓÇô The total number of investigated incidents that were closed.

+- **Resolved directly** ΓÇô The number of investigated incidents that we were able to close directly on your behalf.

+- **Resolved with your help** ΓÇô The number of investigated incidents that were resolved because of your action on one or more managed response tasks.

+The **Average time to resolve incidents** section displays a bar chart of the average time, in minutes, our experts spent investigating and closing incidents in your environment and the average time you spent performing the required managed response actions.

+The **Incidents by severity**, **Incidents by category**, and **Incidents by service source** sections break down resolved incidents by severity, attack technique, and Microsoft security service source, respectively. These sections let you identify potential attack entry points and types of threats detected in your environment, assess their impact, and develop strategies to mitigate and prevent them. Select **View incidents** to get a filtered view of the incident queue based on the selections you made in each of the two sections.

+The **Most impacted assets** section shows the users and devices in your environment that were involved in the most number of incidents during your selected date range. You can see the volume of incidents each asset was involved in. Select an asset to get a filtered view of the incident queue based on the incidents that included the said asset.

+### See also

+- [Get started with Microsoft Defender Experts for XDR](get-started-xdr.md)

+- [Managed detection and response](managed-detection-and-response-xdr.md)

+- [Communicating with experts in the Microsoft Defender Experts for XDR service](communicate-defender-experts-xdr.md)

+- The **Guided response** feature in Microsoft Defender Experts for XDR has been renamed to **[Managed response](managed-detection-and-response-xdr.md)**. We have also added a [new FAQ section](faq-incident-notifications-xdr.md#understanding-and-managing-defender-experts-for-xdr-incident-updates) on incident updates.

+- A new URL and domain page is now available in Microsoft Defender XDR. The updated URL and domain page provides a single place to view all the information about a URL or a domain, including its reputation, the users who clicked it, the devices that accessed it, and emails where the URL or domain was seen. For details, see [Investigate URLs in Microsoft Defender XDR](../defender-endpoint/investigate-domain.md).

+- Microsoft is using a new weather-based naming taxonomy for threat actors. This new naming schema will provide more clarity and will be easier to reference. [Learn more about the new naming taxonomy](../intelligence/microsoft-threat-actor-naming.md).

+ Provides enhanced information for the context into an attack. You can see which other triggered alert caused the current alert and all the affected entities and activities involved in the attack, including files, users and mailboxes. See [Investigate alerts](investigate-alerts.md) for more information.

+ Determine if there are several alerts for a single incident or that your organization is under attack with several different incidents. See [Prioritize incidents](incident-queue.md) for more information.

+ - [Email & collaboration permissions in the Microsoft Defender portal](mdo-portal-permissions.md):

+ - _Take action on quarantined messages for all users_: Membership in the **Quarantine Administrator**, **Security Administrator**, or **Organization Management** role groups.

+ - _Submit messages from quarantine to Microsoft_: Membership in the **Quarantine Administrator** or **Security Administrator** role groups.

+ - _Use **Block sender** to [add senders to your own Blocked Senders list](#block-email-senders-from-quarantine)_: Membership in the **Security Reader**, **Quarantine Administrator** or **Security Administrator** role groups.

+ - _Read-only access to quarantined messages for all users_: Membership in the **Security Reader** or **Global Reader** role groups.

+ - [Microsoft Entra permissions](/entra/identity/role-based-access-control/manage-roles-portal): Membership these roles gives users the required permissions _and_ permissions for other features in Microsoft 365:

+ - _Take action on quarantined messages for all users_: Membership in the **Security Administrator or **Global Administrator** roles.

+ - _Submit messages from quarantine to Microsoft_: Membership in the **Security Administrator** role.

+ - _Use **Block sender** to [add senders to your own Blocked Senders list](#block-email-senders-from-quarantine)_: Membership in the **Security Reader** or **Security Administrator** roles.

+- **Recipient**: The recipient email address always resolves to the primary email address, even if the message was sent to a [proxy address](/exchange/recipients-in-exchange-online/manage-user-mailboxes/add-or-remove-email-addresses).

+> The **Search** box searches for quarantined items in the current view (which is limited to 100 items), not all quarantined items. To search all quarantined items, use **Filter** and the resulting **Filters** flyout.

+> :::image type="content" source="../../media/quarantine-message-main-page-mobile-actions.png" alt-text="Selecting a quarantined message and selecting More on a mobile device." lightbox="../../media/quarantine-message-main-page-mobile-actions.png":::

+ Recipient email addresses always resolve to the primary email address, even if the message was sent to a [proxy address](/exchange/recipients-in-exchange-online/manage-user-mailboxes/add-or-remove-email-addresses).

+> - Third party anti-virus solutions, security services, and [outbound connectors](/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/use-connectors-to-configure-mail-flow) can cause the following issues for messages that are released from quarantine:

+> - The message is quarantined after being released.

+> - Content is removed from the released message before it reaches the recipient's Inbox.

+> - The released message never arrives in the recipient's Inbox.

+> - Actions in [quarantine notifications](quarantine-quarantine-notifications.md) might be randomly selected.

+>

+> Verify that you aren't using third party filtering before you open a support ticket about these issues.

+>

+> - Inbox rules ([created by users in Outlook](https://support.microsoft.com/c24f5dea-9465-4df4-ad17-a50704d66c59) or by admins using the **\*-InboxRule** cmdlets in Exchange Online PowerShell) can move or delete messages from the Inbox.

+> [!TIP]

+> You can deny release for all recipients only. You can't deny release for specific recipients.

+ - **Remove entry after**: The default value is **30 days**, but you can also select **1 day**, **7 days**, or a **Specific date** that's less than 30 days.

+ - [Email & collaboration permissions in the Microsoft Defender portal](mdo-portal-permissions.md): Membership in the **Quarantine Administrator**, **Security Administrator**, or **Organization Management** role groups.

+ - [Microsoft Entra permissions](/entra/identity/role-based-access-control/manage-roles-portal): Membership in the **Global Administrator** or **Security Administrator** roles gives users the required permissions _and_ permissions for other features in Microsoft 365.

+The message body of quarantine notifications is already localized based on the language setting of the recipient's cloud-based mailbox.

+You can use the procedures in this section to customize the **Sender display name**, **Subject**, and **Disclaimer** values that are used in quarantine notifications based on the language setting of the recipient's cloud-based mailbox:

+> Quarantine notifications aren't localized for on-premises mailboxes.

+>

+> A custom quarantine notification for a specific language is shown to users only when their mailbox language matches the language in the custom quarantine notification.

+>

+> The languages **Norwegian** and **Norwegian (Nynorsk)** are available. Norwegian (Bokmål) isn't available.

+ Although this box isn't the first setting, you need to configure it first. If you enter values in the **Sender display name**, **Subject**, or **Disclaimer** boxes before you select the language, those values disappear.

+ 2. After you select the language, enter values for **Sender display name**, **Subject**, and **Disclaimer**. The values must be unique for each language. If you try to reuse a value in a different language, you'll get an error when you select **Save**.

+ 3. Select the **Add** button near the **Choose language** box.

+ After you select **Add**, the configured settings for the language appear in the **Click the language to show the previously configured settings** box. To reload the settings, click on the language name. To remove the language, select :::image type="icon" source="../../media/m365-cc-sc-remove-selection-icon.png" border="false":::.

+ 4. Repeat the previous steps to create a maximum of three customized quarantine notifications based on the recipient's language.

+For information about the **Specify sender address**

+- **Specify sender address**: Select an existing user for the sender email address of quarantine notifications. The default sender is `quarantine@messaging.microsoft.com`.

+- **Send end-user spam notification every (days)**: Select the frequency for quarantine notifications. You can select **Within 4 hours**, **Daily**, or **Weekly**.

+> [!NOTE]

+> Don't remove a quarantine policy until you verify that it isn't being used. For example, run the following command in PowerShell:

+> ```powershell

+> Write-Output -InputObject "Anti-spam policies",("-"*25);Get-HostedContentFilterPolicy | Format-List Name,*QuarantineTag; Write-Output -InputObject "Anti-phishing policies",("-"*25);Get-AntiPhishPolicy | Format-List Name,*QuarantineTag; Write-Output -InputObject "Anti-malware policies",("-"*25);Get-MalwareFilterPolicy | Format-List Name,QuarantineTag; Write-Output -InputObject "Safe Attachments policies",("-"*25);Get-SafeAttachmentPolicy | Format-List Name,QuarantineTag

+> ```

+>

+> If the quarantine policy is being used, [replace the assigned quarantine policy](#step-2-assign-a-quarantine-policy-to-supported-features) before you remove it to avoid the potential disruption in quarantine notifications.

+>

+> You can't remove the default quarantine policies named AdminOnlyAccessPolicy, DefaultFullAccessPolicy, or DefaultFullAccessWithNotificationPolicy.

+- **IP Allow**

+- **Exchange transport rule**

+- **Organization allowed domains**

+- **ZAP not enabled**

+- **User Safe Sender**

+- **User Safe Domain**

+- **Sender Domain List**

+- **Trusted Senders List (Outlook)**

+- **Trusted Recipient Address List**

+- **Trusted Recipient Domain List**

+- **Trusted Contact List - Sender in Address Book**

+- **Exclusive setting (Outlook)**

+- **Third party filter**

+- **TABL - File allowed**

+- **TABL - Both URL and file allowed**

+- **TABL Sender email address Allow**

+- **TABL - File blocked**

+- **TABL Sender email address block**

+- **TABL Spoof Block**

+- **Data Loss Prevention**

+Admins in Microsoft 365 Government Community Cloud (GCC) or GCC High need to use the steps in this section to get the Report Message or Report Phishing add-ins for their organizations. These steps apply to Outlook and Outlook on the web (formerly known as Outlook Web App or OWA) and don't apply to Outlook for iOS and Android.

+>

+> B2B Member accounts aren't supported for cross cloud guests. All cross cloud users must be of type B2B guest.

+> Microsoft 365 Backup (Preview) is now available worldwide in all commercial cloud environments. General availability is expected to be mid-2024. This preview feature is subject to change and [limitations as defined](backup-limitations.md). Before you begin, read the [Microsoft 365 Backup preview terms and conditions](backup-preview-terms.md).

+Microsoft 365 Backup is currently in preview and begins rolling out to organizations in mid-2024. You can set up billing for the product as described in [Set up Microsoft 365 Backup](backup-setup.md). Once Microsoft 365 Backup has been deployed and is available for use in your tenant, you'll see it in the Microsoft 365 admin center page under **Settings**.

+In cases of a ransomware attack that encrypts large swaths of your data, or instances of an internal accidental or malicious data deletion or overwrite event, you need to be able to get your business back to a healthy state as soon as possible. This is what the Microsoft 365 Backup product offers, both through the Microsoft 365 admin center, and via partner applications built on the Microsoft 365 Backup Storage platform.

+Creating a new protection policy initiates the process of backing up selected SharePoint sites, OneDrive accounts, and Exchange mailboxes. Once you submit a request to activate a valid protection policy, it takes on average up to 60 minutes to process and another 60 minutes to create restore points.

+The following table summarizes expected performance for a normally distributed tenant, including tenants of large size and scale. During the preview period, actual performance might deviate from these general availability targets.

+> Microsoft 365 Backup (Preview) is now available worldwide in all commercial cloud environments. General availability is expected to be mid-2024. This preview feature is subject to change and [limitations as defined](backup-limitations.md). Before you begin, read the [Microsoft 365 Backup preview terms and conditions](backup-preview-terms.md).

+# Create Package from App Gallery

+> [!IMPORTANT]

+> **Test Base for Microsoft 365 will transition to end-of-life (EOL) on May 31, 2024.** We're committed to working closely with each customer to provide support and guidance to make the transition as smooth as possible. If you have any questions, concerns, or need assistance, [submit a support request](https://aka.ms/TestBaseSupport).