| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Add Or Remove Members From Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/add-or-remove-members-from-groups.md | By default, the person who created the group is the group owner. Often a group w ## Related content -[Upgrade distribution lists to Microsoft 365 groups in Outlook](../manage/upgrade-distribution-lists.md) (article)\ -[Why you should upgrade your distribution lists to groups in Outlook](https://support.microsoft.com/office/7fb3d880-593b-4909-aafa-950dd50ce188) (article)\ [Manage guest access in Microsoft 365 groups](manage-guest-access-in-groups.md) (article)\ [Manage Microsoft 365 groups with PowerShell](../../enterprise/manage-microsoft-365-groups-with-powershell.md): this article introduces you to key cmdlets and provides examples (article)\ [Microsoft 365 groups naming policy](../../solutions/groups-naming-policy.md) (article) |
| admin | Compare Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/compare-groups.md | Microsoft 365 Groups can be added to one of the three SharePoint groups (Owners, Distribution groups are best for situations where you need to broadcast information to a set group of people, such as "People in Building A" or "Everyone at Contoso." -Distribution groups can be [upgraded to Microsoft 365 Groups](../manage/upgrade-distribution-lists.md). - Distribution groups can be added to a team in Microsoft Teams, though only the members are added and not the group itself. Microsoft 365 Groups can't be members of distribution groups. It's not possible to migrate a shared mailbox to a Microsoft 365 Group. [Learn about Microsoft 365 Groups](https://support.microsoft.com/office/b565caa1-5c40-40ef-9915-60fdb2d97fa2) -[Upgrade distribution lists to Microsoft 365 Groups in Outlook](/microsoft-365/admin/manage/upgrade-distribution-lists) --[Why you should upgrade your distribution lists to groups in Outlook](https://support.microsoft.com/office/7fb3d880-593b-4909-aafa-950dd50ce188) |
| admin | Create Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/create-groups.md | After creating a new group and adding members, you can further configure your gr [Manage guest access to Microsoft 365 groups](https://support.microsoft.com/office/bfc7a840-868f-4fd6-a390-f347bf51aff6) (article)\ [Choose the domain to use when creating Microsoft 365 groups](../../solutions/choose-domain-to-create-groups.md) (article)\-[Upgrade distribution lists to Microsoft 365 groups](../manage/upgrade-distribution-lists.md) (article) |
| admin | Group Mailbox Size Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/group-mailbox-size-management.md | -Each Microsoft 365 group comes equipped with a dedicated mailbox that stores the emails received on the group. The group mailbox is also used by applications like SharePoint Online, Yammer, Teams etc. The group mailbox is equipped with initial storage quota of 50 GB. If the group mailbox quota is reached, then emails are sent to the groups NDR. Hence, itΓÇÖs a good practice to remove the older content from group mailboxes, to ensure the group mailbox doesnΓÇÖt reach its quota. +Each Microsoft 365 group comes equipped with a dedicated mailbox that stores the emails received on the group. The group mailbox is also used by applications like SharePoint Online, Yammer, Teams etc. The group mailbox is equipped with initial storage quota of 50 GB. If the group mailbox quota is reached, people sending emails to the group receive a non-delivery report. Hence, itΓÇÖs a good practice to remove the older content from group mailboxes, to ensure the group mailbox doesnΓÇÖt reach its quota. The following ways help you understand how the quota calculation works, best practices or proactive approach taken to ensure the group mailbox doesn't reach its quota. And the course of action to be performed if the group mailbox as reached or exceeded its quota. |
| admin | Manage Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/manage-groups.md | To confirm that the group has been successfully purged, run the *Get-AzureADMSD [Allow members to send as or send on behalf of a Microsoft 365 group](../../solutions/allow-members-to-send-as-or-send-on-behalf-of-group.md) -[Upgrade distribution lists to Microsoft 365 Groups](../manage/upgrade-distribution-lists.md) - [Manage Microsoft 365 Groups with PowerShell](../../enterprise/manage-microsoft-365-groups-with-powershell.md) |
| admin | Office 365 Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/office-365-groups.md | Microsoft 365 groups work with Azure Active Directory. The groups features you g ## Related content [Learn about Microsoft 365 Groups](https://support.microsoft.com/office/b565caa1-5c40-40ef-9915-60fdb2d97fa2) (article)\-[Upgrade distribution lists to Microsoft 365 Groups](../manage/upgrade-distribution-lists.md) (article)\ [Manage Microsoft 365 Groups with PowerShell](../../enterprise/manage-microsoft-365-groups-with-powershell.md) (article)\ [SharePoint Online Limits](/office365/servicedescriptions/sharepoint-online-service-description/sharepoint-online-limits) (article)\ [Organize groups and channels in Microsoft Stream](/stream/groups-channels-organization) (article) |
| admin | Upgrade Distribution Lists | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/upgrade-distribution-lists.md | - Title: "Upgrade distribution lists to Microsoft 365 Groups in Exchange Online"-- NOCSH--- Previously updated : 02/18/2020----- Tier3-- scotvorg-- M365-subscription-management-- Adm_O365--- AdminSurgePortfolio-- AdminTemplateSet-- admindeeplinkEXCHANGE-- BCS160-- MET150-- MOE150 -description: "Learn how to upgrade one or many distribution lists to Microsoft 365 Groups in Exchange Online, and how to use PowerShell to upgrade several distribution lists simultaneously." ---# Upgrade distribution lists to Microsoft 365 Groups in Exchange Online --> [!IMPORTANT] -> This functionality will be deprecated by February 1, 2023. For more information, see [Deprecating Conversion of Distribution Lists to Microsoft 365 Groups - Microsoft Community Hub](https://techcommunity.microsoft.com/t5/exchange-team-blog/deprecating-conversion-of-distribution-lists-to-microsoft-365/ba-p/3668215). --Upgrading a distribution list to a Microsoft 365 Group is a great way to improve the features and capabilities of groups in your organization. For more information, see [Why you should upgrade your distribution lists to groups in Outlook](https://support.microsoft.com/office/7fb3d880-593b-4909-aafa-950dd50ce188) --You can upgrade distribution lists one at a time, or several at the same time. You can use the Exchange admin center (EAC) or Exchange Online PowerShell. ---## Upgrade one or many distribution list groups to Microsoft 365 Groups --You must be a global admin or Exchange admin to upgrade a distribution list. To upgrade to Microsoft 365 Groups, the distribution list must have a designated owner, and that owner must be a mailbox. --### Use the Classic EAC to upgrade one or many distribution list groups to Microsoft 365 Groups in Outlook --> [!NOTE] -> The procedures in this section are not available in the new EAC. --1. Go to the Exchange admin center > **Recipients** \> <a href="https://go.microsoft.com/fwlink/?linkid=2183233" target="_blank">**Groups**</a>. -- You'll see a notice indicating you have distribution lists (also called **distribution groups**) that are eligible to be upgraded to Microsoft 365 Groups. - -  --1. Select one or more distribution lists (also called **distribution groups**) from the **groups** page. --  --1. Select the upgrade icon. --  --1. On the information dialog, select **Yes** to confirm the upgrade. The process begins immediately. Depending on the size and number of distribution lists you're upgrading, the process can take minutes or hours. -- If the distribution list can't be upgraded, a dialog appears saying so. See [Which distribution lists cannot be upgraded?](#which-distribution-lists-cant-be-upgraded). --1. If you're upgrading multiple distribution lists, use the drop-down list to filter which distribution lists have been upgraded. If the list isn't complete, wait a while longer and then select **Refresh** to see what's been successfully upgraded. --**Notes**: --- You won't get a notification when the upgrades are complete. Instead, see what's listed under **Available for upgrade** or **Upgraded DLs**.--- If you selected a distribution list for upgrade, but it's still appeared on the page as **Available to upgrade**, then it failed to upgrade. See [What to do if the upgrade doesn't work](#what-to-do-if-the-upgrade-doesnt-work).--- The digest email of a group might offer to let you upgrade any eligible distribution lists that you're the owner of. For more information about digest email, see [Have a group conversation in Outlook](https://support.microsoft.com/office/a0482e24-a769-4e39-a5ba-a7c56e828b22).--## What to do if the upgrade doesn't work --Distribution lists that fail to upgrade remain unchanged. --If one or more **eligible** distribution lists fail to be upgraded, do the following steps: --1. Use [this script](https://aka.ms/DLToM365Group) to scan for possible issues. Fix any issues reported by the script and try upgrading the distribution list one more time. --2. If the script doesn't help, open a [Support ticket](../../business-video/get-help-support.md). The issue will need to be escalated to the Groups Engineering team. --## How to use Exchange Online PowerShell to upgrade several distribution lists at the same time --To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). --### Upgrade a single distribution list --To upgrade a single distribution list, use the following syntax: --```PowerShell -Upgrade-DistributionGroup -DLIdentities <EmailAddress> -``` --This example upgrades the distribution list marketing@contoso.com: --```PowerShell -Upgrade-DistributionGroup -DLIdentities marketing@contoso.com -``` --For detailed syntax and parameter information, see [Upgrade-DistributionGroup](/powershell/module/exchange/upgrade-distributiongroup). --> [!NOTE] -> You can also upgrade a single distribution list to a Microsoft 365 group using the [New-UnifiedGroup](/powershell/module/exchange/new-unifiedgroup) cmdlet. --### Upgrade multiple distribution lists at the same time --To upgrade multiple distribution lists at the same time, use the following syntax: --```PowerShell -Upgrade-DistributionGroup -DLIdentities <EmailAddress1>,<EmailAddress2>,... -``` --This example upgrades the specified distribution lists to Microsoft 365 Groups. --```powershell -Upgrade-DistributionGroup -DLIdentities marketing@contoso.com,finanace@contoso.com,hr@contoso.com -``` --For detailed syntax and parameter information, see [Upgrade-DistributionGroup](/powershell/module/exchange/upgrade-distributiongroup). --### Upgrade all eligible distribution lists --Use either of the following methods to upgrade all eligible distribution lists to Microsoft 365 Groups: --- Upgrade all eligible distribution lists:-- ```PowerShell - $All = Get-EligibleDistributionGroupForMigration -ResultSize unlimited - $All | Foreach-Object {Upgrade-DistributionGroup -DLIdentities $_.PrimarySMTPAddress} - ``` --- Try to upgrade all distribution lists whether they're eligible or not:-- ```PowerShell - $All Get-DistributionGroup -RecipientTypeDetails MailUniversalDistributionGroup -ResultSize unlimited - $All | Foreach-Object {Upgrade-DistributionGroup -DLIdentities $_.PrimarySMTPAddress} - ``` --## FAQ about upgrading distribution lists to Microsoft 365 Groups in Outlook --### Which distribution lists can't be upgraded? --You can only upgrade cloud-managed, simple, non-nested distribution lists. The table below lists distribution lists that **CANNOT** be upgraded. --|Property|Eligible?| -||::| -|On-premises managed distribution list.|No| -|Nested distribution lists. Distribution list either has child groups or is a member of another group.|No| -|Distribution lists where one or more members are something other than a user mailbox, shared mailbox, team mailbox, or mail user. In other words, the **RecipientTypeDetails** value of any member of the distribution list is not **UserMailbox**, **SharedMailbox**, **TeamMailbox**, or **MailUser**.|No| -|Distribution list that has more than 100 owners.|No| -|Distribution list that only has members but no owner.|No| -|Distribution list that has alias containing special characters.|No| -|The distribution list is configured to be a forwarding address for a Shared mailbox.|No| -|The distribution list is part of **Sender Restriction** in another distribution list.|No| -|Mail-enabled security groups.|No| -|Dynamic distribution groups.|No| -|Distribution lists that were converted to **RoomLists**.|No| --### Check which distribution lists are eligible for upgrade --To check whether a specific distribution list is eligible for upgrade, run the following command: --```PowerShell -Get-DistributionGroup <EmailAddress> | Get-EligibleDistributionGroupForMigration -``` --To see all distribution groups that are eligible for upgrade, run the following command: --```PowerShell -Get-EligibleDistributionGroupForMigration -``` --### Who can run the upgrade scripts? --People with global admin or Exchange admin rights. --### Why is the contact card still showing a distribution list? What should I do to prevent an upgraded distribution list from showing up in my auto suggest list? --- **Outlook**: After you upgrade a distribution list to a Microsoft 365 group, the user's local recipient cache (also known as the nick name cache) is not aware of the change. Do the steps in the following article to reset the user's local recipient cache: [Information about the Outlook AutoComplete list](/outlook/troubleshoot/contacts/information-about-the-outlook-autocomplete-list). -- If you don't update the recipient cache, any email sent to the Microsoft 365 Group will be delivered successfully, but the following issues will remain: - - - The Group recipient will resolve as the distribution list instead of the Microsoft 365 Group. - - The contact card will be the distribution list's contact instead of the Microsoft 365 Group's. --- **Outlook on the web**: Like Outlook, the distribution list will remain in the recipient cache. Follow the steps in this article to refresh the cache to see the Group's contact card: [Remove suggested name or email address from the Auto-Complete List](https://support.microsoft.com/office/9E1419D9-E88F-445B-B07F-F558B8A37C58).--### Do new group members get a welcome email in their inbox? --No. The setting to enable welcome messages is set to false by default. This setting affects both existing and new group members who may join after the migration is complete. If the group owner later allows guest users, guest users won't receive a welcome email in their Inbox. Guest members can continue working with the group. --### What if one or some of the DLs are not upgraded? --There are some cases in where eligible distribution lists can't be upgraded. For example: --- An admin has applied a **Group Email Address Policy**, and the distribution list doesn't meet the requirements of the policy.--- A distribution list has the **MemberJoinRestriction** or **MemberDepartRestriction** set to the value **Closed**.--- The creation of Microsoft 365 Group creation is limited as described in this article: [this article](/microsoft-365/solutions/manage-creation-of-groups).-- Use one of the following workarounds for this specific issue: -- - Ensure all owners of the distribution list are allowed to create Microsoft 365 Groups (i.e., the owners are member of the security group that is allowed to create Microsoft 365 Groups). -- - Temporarily replace the owner of the distribution list with a user who's allowed to create Microsoft 365 Groups. --### What happens to the DL if the upgrade from EAC fails? --The upgrade will happen only when the call is submitted to the server. If the upgrade fails, your distribution lists will remain and function as they used to. --### What happens to message approval (moderation) settings on distribution groups after upgrading? --The message approval (moderation) settings are preserved and continue to work fine after the distribution group is upgraded to a Microsoft 365 Group. --## Related content --[Compare groups](../create-groups/compare-groups.md) (article)\ -[Explaining Microsoft 365 Groups to your users](../create-groups/explain-groups-knowledge-worker.md) (article)\ -[Add or remove members from Microsoft 365 groups using the admin center](../create-groups/add-or-remove-members-from-groups.md) |
| admin | Customize Your Organization Theme | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/setup/customize-your-organization-theme.md | Up to five themes can be created. A default theme and four group themes. No, new group themes must be mapped to one or more Microsoft 365 groups and not security groups or distribution groups. -> [!NOTE] -> You can convert [distribution groups to Microsoft 365 groups](../manage/upgrade-distribution-lists.md) in Outlook. - ### Can I manually assign a theme independent of Microsoft 365 Groups? No, new group themes must be mapped to one or more Microsoft 365 groups. Users who are members of the Microsoft 365 group will get the theme applied to their group. You can [create and add new members to a Microsoft 365 Group](../create-groups/create-groups.md) by going to the **Settings** > **Groups** in the admin center. |
| compliance | Communication Compliance Investigate Remediate | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-investigate-remediate.md | After reviewing the message basics, now you can open a message to examine the de - **Conversation**: Available for Microsoft Teams chat messages, this view displays up to five messages before and after an alert message to help reviewers view the activity in the conversational context. This context helps reviewers to quickly evaluate messages and make more informed message resolution decisions. Real-time message additions to conversations are displayed, including all inline images, emojis, and stickers available in Teams. Image or text file attachments to messages aren't displayed. Notifications are automatically displayed for messages that have been edited or for messages that have been deleted from the conversation window. When a message is resolved, the associated conversational messages aren't retained with the resolved message. Conversation messages are available for up to 60 days after the alert message is identified. - **User history**: User history view displays all other alerts generated by any communication compliance policy for the user sending the message. - **Pattern detected notification**: Many harassing and bullying actions over time involve reoccurring instances of the same behavior by a user. The *Pattern detected* notification is displayed in the alert details and raises attention to the alert. Detection of patterns is on a per-policy basis and evaluates behavior over the last 30 days when at least two messages are sent to the same recipient by a sender. Investigators and reviewers can use this notification to identify repeated behavior to evaluate the alert as appropriate.-- **Translation**: This view automatically converts alert message text to the language configured in the *Displayed language* setting in the Microsoft 365 subscription for each reviewer. The *Translation* view helps broaden investigative support for organizations with multilingual users and eliminates the need for additional translation services outside of the communication compliance review process. Using Microsoft translation services, communication compliance automatically detects if the text is in a different language than the user's current system setting and will display alert message text accordingly. For a complete list of supported languages, see [Microsoft Translator Languages](https://www.microsoft.com/translator/business/languages/). Languages listed in the *Translator Language List* are supported in the *Translation* view.+- **Translation**: This view automatically converts alert message text to the language configured in the *Displayed language* setting in the Microsoft 365 subscription for each reviewer. This includes the text for the policy match as well as everything included in the conversation view (up to five messages before and five messages after the policy match). The *Translation* view helps broaden investigative support for organizations with multilingual users and eliminates the need for additional translation services outside of the communication compliance review process. Using Microsoft translation services, communication compliance automatically detects if the text is in a different language than the user's current system setting and will display alert message text accordingly. For a complete list of supported languages, see [Microsoft Translator Languages](https://www.microsoft.com/translator/business/languages/). Languages listed in the *Translator Language List* are supported in the *Translation* view. ### Step 3: Decide on a remediation action |
| compliance | Get Started With Data Lifecycle Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/get-started-with-data-lifecycle-management.md | f1.keywords: Previously updated : 02/27/2023 Last updated : 03/07/2023 audience: Admin For permissions to manage mailboxes for archiving, inactive mailboxes, and impor Members of your compliance team who will create and manage retention policies and retention labels need permissions to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft Purview compliance portal</a>. By default, the tenant admin (global administrator) has access to this location and can give compliance officers and other people access without giving them all the permissions of a tenant admin. To grant permissions for this limited administration, we recommend that you add users to the **Compliance Administrator** admin role group. -Alternatively to using this default role, you can create a new role group and add the **Retention Management** role to this group. For a read-only role, use **View-Only Retention Management**. To use [adaptive policy scopes](retention.md#adaptive-or-static-policy-scopes-for-retention), you'll also need the **Scope Manager** role. +Alternatively to using this default role, you can create a new role group and add the **Retention Management** role to this group. For a read-only role, use **View-Only Retention Management**. For instructions to add users to the default roles or create your own role groups, see [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md). |
| compliance | Information Barriers Multi Segment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/information-barriers-multi-segment.md | ms.localizationpriority: medium f1.keywords: - NOCSH Last updated : 03/07/2023 # Use multi-segment support in information barriers If the value of the `InformationBarrierMode` property is *Legacy*, enabling mult ## Enable multiple segment support for users -To enable multi-segment support for organizations in *SingleSegment* mode, run the following cmdlet from an [Exchange Online PowerShell session](/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps). +To enable multi-segment support for organizations in *SingleSegment* mode, run the following cmdlet. ```powershell-Enable-ExoInformationBarriersMultiSegment [-Organization] <tenantIdentity> +Set-PolicyConfig -InformationBarrierMode 'MultiSegment' ``` > [!IMPORTANT]-> If you enable multiple segments in your organization, you cannot revert to single segment support. +> If you enable multiple segments and have configured IB in your organization, you should not revert to single segment support. ## Multi-segment support for users in OneDrive |
| compliance | Sensitivity Labels Meetings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-meetings.md | Other label policy settings that are specific just to calendar items, Teams meet The label setting to prevent copying chat to the clipboard is enforced for all channel chats, even outside channel meetings. For non-channel meetings, it's enforced only for meetings. -Currently, this setting isn't supported for users outside your organization, which includes anonymous users and external users. It is supported for guest user accounts in your tenant. For meetings, it's also not supported for users who join the chat but weren't invited to the meeting. - This setting is currently unsupported for virtual desktop infrastructure (VDI). The methods supported to prevent copying chat: Select the text and then right-click \> **Copy** or Ctrl+C. Copying using developer tools or third-party apps won't be prevented. |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | Before you can scope a label to just files or emails, you must first remove it i **Limitation for this preview:** -- If the label is configured as the default label, and Outlook isn't configured with its own default label, you can't remove the scope for **Email**.+- If the label is configured as the default label in one or more label policies, and Outlook isn't configured with its own default label in the same policy, you can't remove the scope for **Email**. As a workaround, remove this label as the default label, and then you can remove the email scope. ## Configure a label to apply S/MIME protection in Outlook |
| compliance | Sensitivity Labels Versions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-versions.md | The numbers listed are the minimum Office application versions required for each |[Support co-authoring and AutoSave](sensitivity-labels-coauthoring.md) for labeled and encrypted documents | Current Channel: 2107+ <br /><br> Monthly Enterprise Channel: 2107+ <br /><br> Semi-Annual Enterprise Channel: 2202+ | 16.51+ | 2.58+ | 16.0.14931+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[PDF support](sensitivity-labels-office-apps.md#pdf-support)| Current Channel: 2208+ <br /><br> Monthly Enterprise Channel: 2209+ <br /><br> Semi-Annual Enterprise Channel: 2302+ | Under review | Under review | Under review | Under review | |[Sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) and [display label color](sensitivity-labels-office-apps.md#label-colors) | Preview: [Current Channel (Preview)](https://office.com/insider) | Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review |-|[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)| Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review | Under review | +|[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)| Current Channel: Rolling out to 2302+ | Under review | Under review | Under review | Under review | |[Scope labels to files or emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails) | Current Channel: 2301+ | 16.69+ | Preview: Rolling out to [Beta Channel](https://insider.office.com/join/ios) | Preview: Rolling out to [Beta Channel](https://insider.office.com/join/android)| [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | ## Sensitivity label capabilities in Outlook The numbers listed are the minimum Office application versions required for each |[PDF support](sensitivity-labels-office-apps.md#pdf-support) | Current Channel: 2205+ <br /><br> Monthly Enterprise Channel: 2205+ <br /><br> Semi-Annual Enterprise Channel: Under review| Under review | Under review | Under review | Under review | |[Apply S/MIME protection](sensitivity-labels-office-apps.md#configure-a-label-to-apply-smime-protection-in-outlook) | Current Channel: 2211+ <br /><br> Monthly Enterprise Channel: 2211+ <br /><br> Semi-Annual Enterprise Channel: 2302+ | 16.61+ <sup>\*</sup> | 4.2226+ | 4.2203+ | Under review | |[Sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) and [display label color](sensitivity-labels-office-apps.md#label-colors) | Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review | Under review |-|[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)| Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review | Under review | +|[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)| Current Channel: Rolling out to 2302+ | Under review | Under review | Under review | Under review | |[Scope labels to files or emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails) | Current Channel: 2301+ | Rolling out: 16.70+ <sup>\*</sup> | Rolling out 4.2309+| Rolling out 4.2309+ | Yes | **Footnotes:** |
| compliance | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md | f1.keywords: Previously updated : 03/02/2023 Last updated : 03/06/2023 audience: Admin Whether it be adding new solutions to the [Microsoft Purview compliance portal]( ### Sensitivity labels - **General availability (GA)**: Outlook for Mac is now rolling out in general availability for [protected meetings](sensitivity-labels-meetings.md).+- **General availability (GA)**: Now rolling out in general availability for built-in labeling for Windows, support for a [default sublabel for a parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label) as a parity feature for the AIP add-in. - **Rolling out**: The ability to [scope labels to files and emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails), so that for example, a sensitivity label is visible to users in Outlook but not in Word, Excel, or PowerPoint. This configuration can be used as a parity feature for the AIP add-in, which could be disabled per app.+ - **Removal of restrictions for prevent copying chat for protected meetings**: The label setting that [prevents copying chat to the clipboard](sensitivity-labels-meetings.md#prevent-copying-chat-to-the-clipboard-label-setting) now supports users outside your organization and also users who join a chat but weren't invited to the meeting. ## February 2023 Whether it be adding new solutions to the [Microsoft Purview compliance portal]( ### Data lifecycle management and records management - **Rolling out in preview**: Auto-labeling retention policies now support [simulation mode](apply-retention-labels-automatically.md#learn-about-simulation-mode), so you can test out your policy configuration and view results before deploying in production.-- The configuration and management of [adaptive policy scopes](retention.md#adaptive-or-static-policy-scopes-for-retention) is moving to a new location in the Microsoft Purview compliance portal: **Roles & Scopes** \> **Adaptive scopes**. Additionally, a new role, **Scope Manager**, is required to create and manage adaptive scopes. This new role is included in the **Records Management** role group and other built-in role groups, such as **Compliance Administrator**.+- The configuration and management of [adaptive policy scopes](retention.md#adaptive-or-static-policy-scopes-for-retention) is moving to a new location in the Microsoft Purview compliance portal: **Roles & Scopes** \> **Adaptive scopes**. - New troubleshooting resources: - [Identify errors in Microsoft 365 retention and retention label policies](/microsoft-365/troubleshoot/retention/identify-errors-in-retention-and-retention-label-policies) - [Resolve errors in Microsoft 365 retention and retention label policies](/microsoft-365/troubleshoot/retention/resolve-errors-in-retention-and-retention-label-policies) |
| enterprise | Cross Tenant Identity Mapping | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/cross-tenant-identity-mapping.md | -Cross-Tenant Identity Mapping is a feature that can be used during migrations from one Microsoft 365 organization to another (commonly referred to as a cross-tenant migration). It provides a secure method of establishing one-to-one object relationships across organization boundaries and automatically prepares the target objects for a successful migration. +Cross-Tenant Identity Mapping is a feature that can be used during Cross-Tenant User Data Migrations from one Microsoft 365 organization to another. It provides a secure method of establishing one-to-one object relationships across organization boundaries, and automatically prepares the target objects for a successful migration. >[!NOTE] >Cross-Tenant Identity Mapping is in a private preview stage of development. As an unfinished project any information or availability is subject to change at any time. Support for private-preview customers will be handled via email. Cross-Tenant Identity Mapping is covered by the **preview terms** of the [Microsoft Universal License Terms for Online Services](https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all). Cross-Tenant Identity Mapping removes the need to export large data sets from a With Cross-Tenant Identity Mapping, data remains within the Microsoft security boundary and is securely copied directly from the source organization to the target organization using specially configured **Organization Relationships** serving as a unidirectional trust. -Using Cross-Tenant Identity Mapping will reduce the potential for mistakes when configuring what could potentially be thousands of target objects for a migration by automatically configuring values such as _ExchangeGuid_, _ArchiveGuid_, and all necessary _X500 proxy addresses_. +Using Cross-Tenant Identity Mapping will reduce mistakes when configuring target objects for a migration by automatically configuring values such as _ExchangeGuid_, _ArchiveGuid_, and all necessary _X500 proxy addresses_. Some additional benefits of using Cross-Tenant Identity Mapping: Some additional benefits of using Cross-Tenant Identity Mapping: We would like to provide information commonly asked so you may evaluate if you would like to participate in the private preview. -- The feature is only intended to be used with [Cross-tenant mailbox migration (preview)](cross-tenant-mailbox-migration.md), and not with any third-party non-Microsoft migration solutions.-- Data processing (storage, compute, transfer, etc.) is currently within the United States of America, and within the Exchange Online home region of the organizations participating in the migration.+- The feature is only intended to be used with [Cross-tenant mailbox migration](cross-tenant-mailbox-migration.md), and not with any third-party non-Microsoft migration solutions. +- Data processing (storage, compute, transfer, etc.) is currently within the European Union, and within the Exchange Online home region of the organizations participating in the migration. - For Multi-Geo enabled organizations, the organization's home geo for Exchange Online will be used. - This feature can currently only be enabled in the worldwide Microsoft 365 offering. It doesn't work in GCC, GCC High, DoD, Office 365 by 21 Vianet, etc.+- Cross-Tenant Identity Mapping does **not** create the Mail Enabled User objects in the target tenant for you. These objects must still be created with a minimal attribute set. Once created, then Cross-Tenant Identity Mapping will decorate their attributes correctly for a mailbox migration to proceed. - Some familiarity with PowerShell is currently required as the feature is PowerShell-based - The feature communicates over an encrypted connection to a REST endpoint. - The feature currently requires the Global Administrator role for initial setup. This behavior may change in a future update. - Organizational Relationships are used as a dual handshake approach to ensure both organizations have authorized this transaction type to take place. - It works with cloud-only or hybrid organizations.-- Target organizations in a hybrid configuration will require an on-premises Exchange server to modify any Mail Enabled User objects synchronized from the on-premises directory. We haven't tested support for the new Exchange Management Tool feature released in Exchange Server 2019 CU12.+- Target organizations in a hybrid configuration will require Microsoft supported on-premises object management tools to modify any Mail Enabled User objects synchronized from the on-premises directory. ## What does participating in the private preview entail? We're looking for customers willing to both try Cross-Tenant Identity Mapping an ## How to participate -If you would like to participate or you have more questions, please email [CTIMPreview@service.microsoft.com](mailto:CTIMPreview@service.microsoft.com) and provide some basic information about the migration you would like to use Cross-Tenant Identity Mapping with. +The Cross-Tenant User Content Migration feature and licenses are currently only available to Enterprise Agreement customers. If you are an Enterprise Agreement customer who will be purchasing Cross-Tenant User Content Migration licenses, and you would like to evaluate Cross-Tenant Identity Mapping to improve your migration experience, then please email [CTIMPreview@service.microsoft.com](mailto:CTIMPreview@service.microsoft.com) and provide some basic information about the migration you are performing. The team will respond to you within a couple business days with some additional questions. For more information on licensing, please see [Cross-Tenant User Content Migration Licensing](cross-tenant-mailbox-migration.md?#licensing) and contact your Microsoft account team. ## Next steps We recommend reviewing the current Cross-Tenant Mailbox Migration steps related to preparing target user objects for migration as this preparation is what Cross-Tenant Identity Mapping will automate. -- [Review Cross-Tenant Mailbox Migration (preview)](cross-tenant-mailbox-migration.md#prepare-target-user-objects-for-migration)+- [Review Cross-Tenant Mailbox Migration](cross-tenant-mailbox-migration.md#prepare-target-user-objects-for-migration) |
| enterprise | Modern Desktop Deployment And Management Lab | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/modern-desktop-deployment-and-management-lab.md | The Windows and Office 365 deployment lab kits are designed to help you plan, te |Windows 10 Lab|Windows 11 Lab| |||-|[Windows 10 lab environment](https://download.microsoft.com/download/a/5/0/a505dbce-6cc8-4f92-a777-cda556da9266/Win10_21H2_Lab_v2.zip)|[Windows 11 lab environment](https://download.microsoft.com/download/b/3/9/b3959d76-6ea6-4b4a-84e2-d863b9f38887/Win11_22H2_2211_Lab.zip)| -|[Windows 10 lab guides](https://download.microsoft.com/download/a/5/0/a505dbce-6cc8-4f92-a777-cda556da9266/Win10_21H2_Lab_Guides_v2.zip)|[Windows 11 lab guides](https://download.microsoft.com/download/b/3/9/b3959d76-6ea6-4b4a-84e2-d863b9f38887/Win11_22H2_2211_Lab_Guides.zip)| +|[Windows 10 lab environment](https://download.microsoft.com/download/a/5/0/a505dbce-6cc8-4f92-a777-cda556da9266/Win10_21H2_Lab_v2.zip)|[Windows 11 lab environment](https://download.microsoft.com/download/1/0/3/103138e0-b22c-4c7a-a404-e73220954309/Win11_22H2_Lab_2.28.zip)| +|[Windows 10 lab guides](https://download.microsoft.com/download/a/5/0/a505dbce-6cc8-4f92-a777-cda556da9266/Win10_21H2_Lab_Guides_v2.zip)|[Windows 11 lab guides](https://download.microsoft.com/download/1/0/3/103138e0-b22c-4c7a-a404-e73220954309/Win11_22H2_Guides_02.28.zip)| ## A complete lab environment Detailed lab guides take you through multiple deployment and management scenario - Servicing Windows using Microsoft Intune - Servicing Windows with Configuration Manager -### Deploy Microsoft 365 Apps +### Manage Windows ++- Device Management for Windows 11 using Microsoft Intune +- Dynamic Management with Windows 11 +- Deploying Windows apps (Win32) with Intune +- Remote Help ++### Deploy Microsoft 365 Apps for enterprise - Cloud managed deployment - Locally managed deployment - Microsoft 365 Apps deployment on Non-AD Joined Devices - Enterprise managed deployment using Configuration Manager - Enterprise managed deployment using Microsoft Intune-- Servicing Microsoft 365 Apps using Configuration Manager-- Servicing Microsoft 365 Apps using Intune+- Servicing Microsoft 365 Apps for enterprise using Configuration Manager +- Servicing Microsoft 365 Apps for enterprise using Intune - LOB Deployment and Management with Microsoft Intune - Deploy Microsoft Teams - Assignment filters Detailed lab guides take you through multiple deployment and management scenario > [!NOTE]-> Please use a broadband internet connection to download this content and allow approximately 30 minutes for automatic provisioning. The lab environment requires a minimum of 16 GB of available memory and 150 GB of free disk space. For optimal performance, 32 GB of available memory and 300 GB of free space is recommended. The Windows client virtual machines expire 90 days after activation of the lab. New versions of the labs will be published on or before March 8, 2023. +> Please use a broadband internet connection to download this content and allow approximately 30 minutes for automatic provisioning. The lab environment requires a minimum of 16 GB of available memory and 150 GB of free disk space. For optimal performance, 32 GB of available memory and 300 GB of free space is recommended. The Windows client virtual machines expire 90 days after activation of the lab. New versions of the labs will be published on or before May 28, 2023. ## Additional guidance |
| enterprise | M365 Personnel Location | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/personnel-loc/m365-personnel-location.md | Remote access to data by Microsoft personnel, including contract staff, is limit For more information on remote access to data by personnel, see [Continuing data transfers that apply to all EU Data Boundary services](/privacy/eudb/eu-data-boundary-transfers-for-all-services). -| Microsoft Subsidiary <br>Personnel Locations |||| +| Microsoft Subsidiary <br>Personnel Locations | | | | ||||| | Albania | Egypt | Latvia | Qatar | | Algeria | El Salvador | Lebanon | Romania | For more information on remote access to data by personnel, see [Continuing data | Dominican Republic | Kuwait | Poland | | | Ecuador | Kyrgyzstan | Portugal | | -| Contract Staff <br>Personnel Locations |||| +| Contract Staff <br>Personnel Locations | | | | ||||| | Argentina | Egypt | Japan | Serbia | | Armenia | El Salvador | Korea | Singapore | |
| security | Trial Playbook Defender Business | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/trial-playbook-defender-business.md | Quickly see how Defender for Business works by trying a tutorial. Simulate an attack that introduces file-based malware on a test device. The tutorial describes how to use the simulation file and what to watch for in the Microsoft 365 Defender portal. ->[!NOTE] +> [!NOTE] > This tutorial requires Microsoft Word to be installed on your test device. To access the tutorial, do the following: |
| security | Add Or Remove Machine Tags | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/add-or-remove-machine-tags.md | Delegated (work or school account)|Machine.ReadWrite|'Read and write machine inf ## HTTP request ```http-POST https://api.securitycenter.microsoft.com/api/machines/{id}/tags +PATCH https://api.securitycenter.microsoft.com/api/machines/{id}/tags ``` ## Request headers |
| security | Admin Submissions Mde | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/admin-submissions-mde.md | ->Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-usewdatp-abovefoldlink). +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-usewdatp-abovefoldlink). In Microsoft Defender for Endpoint, admins can use the unified submissions feature to submit files and file hashes (SHAs) to Microsoft for review. The unified submissions experience is a one-stop shop for submitting emails, URLs, email attachments, and files in one, easy-to-use submission experience. Admins can use the Microsoft 365 Defender portal or the Microsoft Defender for Endpoint Alert page to submit suspicious files. |
| security | Alerts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/alerts.md | Last updated 12/18/2020 > [!NOTE] > For the full available Alerts API experience across all Microsoft Defenders' products, visit: [Use the Microsoft Graph security API - Microsoft Graph | Microsoft Learn](/graph/api/resources/security-api-overview). ->Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) [!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] Last updated 12/18/2020 |comments|List of Alert comments|Alert Comment object contains: comment string, createdBy string, and createTime date time.| |Evidence|List of Alert evidence|Evidence related to the alert. See example below.| ->[!NOTE] ->Around August 29, 2022, previously supported alert determination values ('Apt' and 'SecurityPersonnel') will be deprecated and no longer available via the API. +> [!NOTE] +> Around August 29, 2022, previously supported alert determination values ('Apt' and 'SecurityPersonnel') will be deprecated and no longer available via the API. ### Response example for getting single alert: |
| security | Android Configure Mam | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/android-configure-mam.md | Web protection helps to secure devices against web threats and protect users fro 4. Include or exclude the groups you want the policy to apply to. Proceed to review and submit the policy. > [!NOTE]-> Users need to enable location permission (which is an optional permission); this enables Defender for Endpoint to scan their networks and alert them when there are WiFi-related threats. If the location permission is denied by the user, Defender for Endpoint will only be able to provide limited protection against network threats and will only protect the users from rogue certificates.ΓÇ» +> Users need to enable location permission (which is an optional permission); this enables Defender for Endpoint to scan their networks and alert them when there are WiFi-related threats. If the location permission is denied by the user, Defender for Endpoint will only be able to provide limited protection against network threats and will only protect the users from rogue certificates. ## Configure privacy controls |
| security | Android Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/android-configure.md | Defender for Endpoint on Android enables admins to configure custom indicators t ## Configure web protection Defender for Endpoint on Android allows IT Administrators the ability to configure the web protection feature. This capability is available within the Microsoft Intune admin center. -[Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. Note that anti-phishing and custom indicators (URL and IP addresses) are supported as part of web protection. Web content filtering is currently not supported on mobile platforms. +[Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. Anti-phishing and custom indicators (URL and IP addresses) are supported as part of web protection. Web content filtering is currently not supported on mobile platforms. > [!NOTE]-> Defender for Endpoint on Android would use a VPN in order to provide the Web Protection feature. This is not a regular VPN and is a local/self-looping VPN that does not take traffic outside the device. +> Defender for Endpoint on Android would use a VPN in order to provide the Web Protection feature. This VPN is not a regular VPN. Instead, it's a local/self-looping VPN that does not take traffic outside the device. +> > For more information, see [Configure web protection on devices that run Android](/mem/intune/protect/advanced-threat-protection-manage-android). ## Network Protection -This feature provides protection against rogue Wi-Fi related threats and rogue certificates which are the primary attack vector for Wi-Fi networks. Admins can list the root Certificate Authority (CA) and private root CA certificates in Microsoft Intune admin center and establish trust with endpoints. It provides the user a guided experience to connect to secure networks and also notifies them if a related threat is detected. +This feature provides protection against rogue Wi-Fi related threats and rogue certificates, which are the primary attack vector for Wi-Fi networks. Admins can list the root Certificate Authority (CA) and private root CA certificates in Microsoft Intune admin center and establish trust with endpoints. It provides the user a guided experience to connect to secure networks and also notifies them if a related threat is detected. -It includes several admin controls to offer flexibility, such as the ability to configure the feature from within the Microsoft Intune admin center as well as add trusted certificates. Admins can also enable [privacy controls](/microsoft-365/security/defender-endpoint/android-configure#privacy-controls) to configure the data that is sent by Defender for Endpoint from Android devices. +It includes several admin controls to offer flexibility, such as the ability to configure the feature from within the Microsoft Intune admin center and add trusted certificates. Admins can also enable [privacy controls](/microsoft-365/security/defender-endpoint/android-configure#privacy-controls) to configure the data that's sent by Defender for Endpoint from Android devices. Network protection in Microsoft Defender for endpoint is disabled by default. Admins can use the following steps to **configure Network protection in Android devices.** 1. In the Microsoft Intune admin center, navigate to Apps > App configuration policies. Create a new App configuration policy.+ > [!div class="mx-imgBorder"] > + 1. Provide a name and description to uniquely identify the policy. Select **'Android Enterprise'** as the platform and **'Personally-owned work profile only'** as the profile type and **'Microsoft Defender'** as the Targeted app.+ > [!div class="mx-imgBorder"] > + 1. In Settings page, select **'Use configuration designer'** and add **'Enable Network Protection in Microsoft Defender'** as the key and value as **'1'** to enable Network Protection. (Network protection is disabled by default)+ > [!div class="mx-imgBorder"] > - + > [!div class="mx-imgBorder"] > -1. If your organization uses root CA's which could be private in nature, explicit trust needs to be established between Intune (MDM solution) and user's devices so that defender doesn't detect flag them as rogue certificates. - To establish trust for the root CAs use **'Trusted CA certificate list for Network Protection'** as the key and in value add the **'comma separated list of certificate thumbprints (SHA 1)'**. - - **Example of Thumbprint format to added will be** - 50 30 06 09 1d 97 d4 f5 ae 39 f7 cb e7 92 7d 7d 65 2d 34 31, - 503006091d97d4f5ae39f7cbe7927d7d652d3431 +1. If your organization uses root CAs that are private in nature, you need to establish explicit trust between Intune (MDM solution) and user devices so Defender doesn't flag them as rogue certificates. ++ To establish trust for the root CAs, use **'Trusted CA certificate list for Network Protection'** as the key. In the value, add the **'comma separated list of certificate thumbprints (SHA 1)'**. -> [!IMPORTANT] - > Certificate SHA-1 Thumbprint characters should be with either white space saperated, or non separated. -> This format is invalid -> 50:30:06:09:1d:97:d4:f5:ae:39:f7:cb:e7:92:7d:7d:65:2d:34:31 + **Example of Thumbprint format to add**: `50 30 06 09 1d 97 d4 f5 ae 39 f7 cb e7 92 7d 7d 65 2d 34 31, 503006091d97d4f5ae39f7cbe7927d7d652d3431` -Any other separation characters are invalid. - >  + > [!IMPORTANT] + > Certificate SHA-1 Thumbprint characters should be with either white space separated, or non separated. + > + > This format is invalid: `50:30:06:09:1d:97:d4:f5:ae:39:f7:cb:e7:92:7d:7d:65:2d:34:31` -5. For other configurations related to Network protection, add the following keys and appropriate corresponding value. -<br> + Any other separation characters are invalid. ++ >  ++1. For other configurations related to Network protection, add the following keys and appropriate corresponding value. | Configuration Key| Description| ||| |Trusted CA certificate list for Network Protection|This setting is managed by a security admin to establish trust for root CA and self-signed certificates|- |Enable Network protection in Microsoft Defender|1 - Enable, 0- Disable (default) ; This setting is used by the IT admin to enable or disable the network protection capabilities in the defender app| - |Enable Network Protection Privacy|1 - Enable (default) , 0 - Disable ; This setting is managed by IT admins to enable or disable privacy in network protection.| - |Enable Users to Trust Networks and Certificates|1 - Enable , 0 - Disable (default) ; This setting is used by IT admins to enable or disable the end user in-app experience to trust and untrust the unsecure and suspicious networks and malicious certificates.| - |Automatic Remediation of Network Protection Alerts|1 - Enable (default) , 0 - Disable ; This setting is used by IT admins to enable or disable the remediation alerts that are sent when a user performs remediation activities, such as switching to a safer Wi-Fi access points or deleting suspicious certificates detected by Defender| - |Manage Network Protection detection for Open Networks|0 - Disable (default), 1 - Audit Mode; This setting is managed by IT Admin to enable or disable open network detection| - |Manage Network protection Detection for Certificates|0 - Disable , 1 - Audit mode (default) , 2 - Enable ; When network protection is enabled, Audit mode for certificate detection is enabled by default. In audit mode, notification alerts are sent to SOC admins, but no end user notifications is displayed to the user when defender detects a bad certificate.Admins can however disable this detection with 0 as the value and enable full feature functionality by setting 2 as the value ,when the feature is enabled with value as 2, end user notifications are sent to the user when defender detects a bad certificate and alerts are also sent to the SOC Admin| -6. Add the required groups on which the policy will have to be applied. Review and create the policy. + |Enable Network protection in Microsoft Defender|1: Enable <br/> 0: Disable (default) <br/><br/> This setting is used by the IT admin to enable or disable the network protection capabilities in the Defender app.| + |Enable Network Protection Privacy|1: Enable (default) <br/> 0: Disable <br/><br/> This setting is managed by IT admins to enable or disable privacy in network protection.| + |Enable Users to Trust Networks and Certificates|1 <br/> Enable <br/> 0:Disable (default) <br/><br/> This setting is used by IT admins to enable or disable the end user in-app experience to trust and untrust the unsecure and suspicious networks and malicious certificates.| + |Automatic Remediation of Network Protection Alerts|1: Enable (default) <br/> 0: Disable <br/><br/> This setting is used by IT admins to enable or disable the remediation alerts that are sent when a user does remediation activities. For example, the user switches to a safer Wi-Fi access point or deletes suspicious certificates that were detected by Defender.| + |Manage Network Protection detection for Open Networks|0: Disable (default) <br/> 1: Audit Mode <br/><br/> This setting is managed by IT Admin to enable or disable open network detection.| + |Manage Network protection Detection for Certificates|0: Disable <br/> 1: Audit mode (default) <br/> 2: Enable <br/><br/> When network protection is enabled, Audit mode for certificate detection is enabled by default. In audit mode, notification alerts are sent to SOC admins, but no end user notifications are shown when Defender detects a bad certificate. Admins can disable this detection with the value 0 or enable full feature functionality by setting the value 2. When the value is 2, end user notifications are sent to users and alerts are sent to SOC admins when Defender detects a bad certificate.| ++1. Add the required groups on which the policy will have to be applied. Review and create the policy. > [!NOTE]-> Users need to enable location permission (which is an optional permission); this enables Defender for Endpoint to scan their networks and alert them when there are WIFI-related threats. If the location permission is denied by the user, Defender for Endpoint will only be able to provide limited protection against network threats and will only protect the users from rogue certificates.ΓÇ» +> Users need to enable location permission (which is an optional permission); this enables Defender for Endpoint to scan their networks and alert them when there are WIFI-related threats. If the location permission is denied by the user, Defender for Endpoint will only be able to provide limited protection against network threats and will only protect the users from rogue certificates. ## Privacy Controls Following privacy controls are available for configuring the data that is sent b |Network Protection (preview)| Admins can enable or disable privacy in network protection - If enabled, then Defender will not send network details.| ### Configure privacy alert report-Admins can now enable privacy control for the phish report, malware report and network report sent by Microsoft Defender for Endpoint on android. This will ensure that the domain name, app details and network details respectively are not sent as part of the alert whenever a corresponding threat is detected. ++Admins can now enable privacy control for the phish report, malware report and network report sent by Microsoft Defender for Endpoint on android. This configuration ensures that the domain name, app details and network details respectively are not sent as part of the alert whenever a corresponding threat is detected. Admin Privacy Controls (MDM) Use the following steps to enable privacy. Admin Privacy Controls (MDM) Use the following steps to enable privacy. 3. Select **Microsoft Defender for Endpoint** as the target app. -4. In Settings page, select **Use configuration designer** and add click on **Add**. +4. In Settings page, select **Use configuration designer** and add click on **Add**. + 5. Select the required privacy setting - - Hide URLs in report - Hide URLs in report for personal profile Admin Privacy Controls (MDM) Use the following steps to enable privacy. 7. Review and assign this profile to targeted devices/users. -**End user privacy controls** +### End user privacy controls These controls help the end user to configure the information shared to their organization. These toggles will only be visible if enabled by the admin. Users can decide if Enabling/disabling the above privacy controls will not impact the device compliance check or conditional access. - ## Configure vulnerability assessment of apps for BYOD devices From version 1.0.3425.0303 of Microsoft Defender for Endpoint on Android, you'll be able to run vulnerability assessments of OS and apps installed on the onboarded mobile devices. > [!NOTE]-> Vulnerability assessment is part of [Microsoft Defender Vulnerability Management](../defender-vulnerability-management/defender-vulnerability-management.md) in Microsoft Defender for Endpoint. +> Vulnerability assessment is part of [Microsoft Defender Vulnerability Management](../defender-vulnerability-management/defender-vulnerability-management.md) in Microsoft Defender for Endpoint. **Notes about privacy related to apps from personal devices (BYOD):** From version 1.0.3425.0303 of Microsoft Defender for Endpoint on Android, you'll ### Configure privacy for device administrator mode -Use the following steps to **enable vulnerability assessment of apps** from devices in **device administrator** mode for targeted users. +Use the following steps to **enable vulnerability assessment of apps** from devices in **device administrator** mode for targeted users. > [!NOTE] > By default, this is turned off for devices enrolled with device admin mode. Use the following steps to **enable vulnerability assessment of apps** from devi ### Configure privacy for Android Enterprise work profile -Defender for Endpoint supports vulnerability assessment of apps in the work profile. However, in case you want to turn this feature off for targeted users, you can use the following steps: +Defender for Endpoint supports vulnerability assessment of apps in the work profile. However, in case you want to turn off this feature for targeted users, you can use the following steps: -1. In [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App configuration policies** > **Add** > **Managed devices**. -2. Give the policy a name; **Platform > Android Enterprise**; select the profile type. +1. In [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Apps** \> **App configuration policies** \\> **Add** > **Managed devices**. +2. Give the policy a name; **Platform \> Android Enterprise**; select the profile type. 3. Select **Microsoft Defender for Endpoint** as the target app. 4. In Settings page, select **Use configuration designer** and add **DefenderTVMPrivacyMode** as the key and value type as **Integer** - To disable vulnerability of apps in the work profile, enter value as `1` and assign this policy to users. By default, this value is set to `0`. Turning the above privacy controls on or off will not impact the device complian ## Configure privacy for phishing alert report -Privacy control for phish report can be used to disable the collection of domain name or website information in the phish threat report. This gives organizations the flexibility to choose whether they want to collect the domain name when a malicious or phish website is detected and blocked by Defender for Endpoint. +Privacy control for phish report can be used to disable the collection of domain name or website information in the phish threat report. This setting gives organizations the flexibility to choose whether they want to collect the domain name when a malicious or phish website is detected and blocked by Defender for Endpoint. ### Configure privacy for phishing alert report on Android Device Administrator enrolled devices: Turning the above privacy controls on or off will not impact the device complian ## Configure privacy for malware threat report -Privacy control for malware threat report can be used to disable the collection of app details (name and package information) from the malware threat report. This gives organizations the flexibility to choose whether they want to collect the app name when a malicious app is detected. +Privacy control for malware threat report can be used to disable the collection of app details (name and package information) from the malware threat report. This setting gives organizations the flexibility to choose whether they want to collect the app name when a malicious app is detected. ### Configure privacy for malware alert report on Android Device Administrator enrolled devices: |
| security | Android Support Signin | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/android-support-signin.md | Enable the required permission on Xiaomi devices. ## Unable to allow permission for 'Permanent protection' during onboarding on some OEM devices - **Applies to:** Specific OEM devices only. - **Xiaomi** Xiaomi changed the battery optimization permissions in Android 11. Defender for **Solution:** ->[!IMPORTANT] ->This issue has been resolved. Please update to the latest app version to complete the onboarding process. If the issue persists, please send an **[in-app feedback](/microsoft-365/security/defender-endpoint/android-support-signin#send-in-app-feedback)**. -+> [!IMPORTANT] +> This issue has been resolved. Please update to the latest app version to complete the onboarding process. If the issue persists, please send an **[in-app feedback](/microsoft-365/security/defender-endpoint/android-support-signin#send-in-app-feedback)**. ## Send in-app feedback If a user faces an issue which is not already addressed in the above sections or :::image type="content" source="images/finalsubmit5.png" alt-text="The pane on which you can add details and attach diagnostic data" lightbox="images/finalsubmit5.png"::: 6. Click on "Submit" to successfully send the feedback.- |
| security | Android Whatsnew | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/android-whatsnew.md | Last updated 11/01/2021 Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) ->[!IMPORTANT] -> Microsoft Defender for Endpoint's **Anti malware engine** is now generally available. All the users are required to have a Microsoft Defender for Endpoint version above **1.0.3815.0000** to utilize this new malware protection capability. Users on Microsoft Defender for Endpoint version below 1.0.3815.0000 will be sent notifications and in-app overlay messages to update their Microsoft Defender for Endpoint application. Users can click on the link provided in the overlay message to go to the managed play store and update the application. +> [!IMPORTANT] +> Microsoft Defender for Endpoint's **Anti malware engine** is now generally available. All the users are required to have a Microsoft Defender for Endpoint version above **1.0.3815.0000** to utilize this new malware protection capability. Users on Microsoft Defender for Endpoint version below 1.0.3815.0000 will be sent notifications and in-app overlay messages to update their Microsoft Defender for Endpoint application. Users can click on the link provided in the overlay message to go to the managed play store and update the application. >-> If users can't access the play store, the app can be updated through the company portal. +> If users can't access the play store, the app can be updated through the company portal. ## Microsoft Defender for Endpoint on Company-owned personally enabled devices+ MDE is now generally available on AE COPE devices. Enterprises can onboard devices on COPE mode and push MDE to user's devices through the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). With this support, Android Enterprise COPE devices will get the full capabilities of our offering on Android including phishing and web protection, malware scanning, Network protection (preview) and additional breach prevention through integration with Microsoft Intune and Conditional Access. Read the announcement [here](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-for-endpoint-is-now-available-on-android/ba-p/3626100). ## Privacy Controls Microsoft Defender for Endpoint on Android enables Privacy Controls for both the Microsoft Defender for Endpoint on Android enables **Optional Permissions** in the onboarding flow. Currently the permissions required by MDE are mandatory in the onboarding flow. With this feature, admin can deploy MDE on devices without enforcing the mandatory **VPN** and **Accessibility** permissions during onboarding. End Users can onboard the app without the mandatory permissions and can later review these permissions. This feature is currently present only for unenrolled devices (MAM). For more information, see [optional permissions](/microsoft-365/security/defender-endpoint/android-configure-mam#optional-permissions). - ## Microsoft defender on Android enterprise BYOD personal profile+ Microsoft Defender for Endpoint is now supported on Android Enterprise personal profile (BYOD only) with all the key features including malware scanning, protection from phishing links, network protection and vulnerability management. This support is coupled with [privacy controls](/microsoft-365/security/defender-endpoint/android-configure#privacy-controls) to ensure user privacy on personal profile. For more information, read the [announcement](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-the-public-preview-of-defender-for-endpoint-personal/ba-p/3370979) and the [deployment guide](/microsoft-365/security/defender-endpoint/android-intune#set-up-microsoft-defender-in-personal-profile-on-android-enterprise-in-byod-mode). ## Network protection+ Network Protection on Microsoft Defender for Endpoint is now available. Network protection provides protection against rogue Wi-Fi related threats, rogue hardware like pineapple devices and notifies the user if a related threat is detected. Users will also see a guided experience to connect to secure networks and change networks when they are connected to an unsecure connection. -It includes several admin controls to offer flexibility, such as the ability to configure the feature from within the Microsoft Intune admin center. Admins can also enable privacy controls to configure the data that is sent by Defender for Endpoint from Android devices. +It includes several admin controls to offer flexibility, such as the ability to configure the feature from within the Microsoft Intune admin center. Admins can also enable privacy controls to configure the data that is sent by Defender for Endpoint from Android devices. If you are interested in participating in this public preview, please share your tenant id with us on networkprotection@microsoft.com. For more information, see [network protection](/microsoft-365/security/defender-endpoint/android-configure). ->[!NOTE] ->Microsoft Defender is no longer supported for versions below 1.0.3011.0302. Users are requested to upgrade to latest versions to keep their devices secure. +> [!NOTE] +> Microsoft Defender is no longer supported for versions below 1.0.3011.0302. Users are requested to upgrade to latest versions to keep their devices secure. To update, users can use the following steps:->1. On your work profile, go to Managed Play Store. ->2. Tap on the profile icon on the top right corner and select "Manage apps and device". ->3. Locate MDE under updates available and select update. >->If you encounter any issues, [submit in-app feedback](/security/defender-endpoint/android-support-signin#send-in-app-feedback). +> 1. On your work profile, go to Managed Play Store. +> 2. Tap on the profile icon on the top right corner and select "Manage apps and device". +> 3. Locate MDE under updates available and select update. +> +> If you encounter any issues, [submit in-app feedback](/security/defender-endpoint/android-support-signin#send-in-app-feedback). ## Microsoft Defender for Endpoint is now Microsoft Defender in the Play store |
| security | Api Hello World | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/api-hello-world.md | Last updated 12/18/2020 - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) [!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] |
| security | Api Power Bi | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/api-power-bi.md | Last updated 12/18/2020 - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ->Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) [!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] |
| security | Api Release Notes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/api-release-notes.md | Last updated 02/02/2021 - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) The following information lists the updates made to the Microsoft Defender for Endpoint APIs and the dates they were made. |
| security | Application Deployment Via Mecm | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/application-deployment-via-mecm.md | Copy the unified solution package, onboarding script and migration script to the 7. On this step, copy the UNC path that your content is located. Example: `\\ServerName\h$\SOFTWARE_SOURCE\path`. :::image type="content" source="images/deployment-type-wizard.png" alt-text="Screenshot that shows UNC path copy.":::- + 8. Additionally, set the following as the installation program: ```powershell- Powershell.exe -ExecutionPolicy ByPass -File install.ps1 -RemoveMMA <workspace ID> -OnboardingScript .\WindowsDefenderATPOnboardingScript.cmd + Powershell.exe -ExecutionPolicy ByPass -File install.ps1 -RemoveMMA <workspace ID> -OnboardingScript .\WindowsDefenderATPOnboardingScript.cmd ``` Click **Next** and make sure to add your own Workspace ID in this section. Copy the unified solution package, onboarding script and migration script to the :::image type="content" source="images/detection-wizard.png" alt-text="Screenshot that shows detection type wizard"::: - >[!TIP] - >The registry key value was obtained by running the Powershell command shown below on a device that has the unified solution installed. Other creative methods of detection can also be used. The goal is to identify whether the unified solution has already been installed on a specific device. You can leave the Value and Data Type fields as blank. + > [!TIP] + > The registry key value was obtained by running the Powershell command shown below on a device that has the unified solution installed. Other creative methods of detection can also be used. The goal is to identify whether the unified solution has already been installed on a specific device. You can leave the Value and Data Type fields as blank. ```powershell- get-wmiobject Win32_Product | Sort-Object -Property Name |Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize + get-wmiobject Win32_Product | Sort-Object -Property Name |Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize ``` 11. In the **User Experience** section, check the recommended settings shown in the screenshot. You can choose what suits your environment and click **Next**. For **Installation program visibility**, it's advisable to install with **Normal** during phase testing then change it to **Minimized** for general deployment. - >[!TIP] - >The maximum allowed runtime can be lowered from (default) 120 minutes to 60 minutes. + > [!TIP] + > The maximum allowed runtime can be lowered from (default) 120 minutes to 60 minutes. :::image type="content" source="images/user-experience-in-deployment-type-wizard.png" alt-text="Screenshot that shows user experience in deployment-type wizard."::: -12. Add any additional requirements then select **Next**. -13. Under the Dependencies section, select **Next**. +12. Add any additional requirements then select **Next**. +13. Under the Dependencies section, select **Next**. 14. Select **Next** until completion screen comes up, then **Close**. 15. Keep select **Next** until the completion of Application Wizard. Verify all have been green checked. 16. Close the wizard, right-click on the recently created application and deploy it to your down-level-server collection. Locally, the installation can be confirmed at Software Center. For details, check the CM logs at `C:\Windows\CCM\Logs\AppEnforce.log`. :::image type="content" source="images/deploy-application.png" alt-text="Screenshot that shows deployment of created application." lightbox="images/deploy-application.png":::- + 17. Verify the status of the migration at MECM > Monitoring > Deployments. :::image type="content" source="images/deployment-status.png" alt-text="Screenshot that shows deployment status check." lightbox="images/deployment-status.png":::- + 18. Troubleshooting .ETL files will be created and automatically saved locally in each server at this location `C:\Windows\ccmcache\#\`. These files can be leveraged by support to troubleshoot onboarding issues. ## Related topics |
| security | Attack Surface Reduction Rules Deployment Operationalize | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-operationalize.md | |
| security | Attack Surface Reduction Rules Deployment Plan | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-plan.md | |
| security | Attack Surface Reduction Rules Deployment Test | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-test.md | In this section of the ASR rules deployment guide, you will learn how to: Begin your attack surface reduction (ASR) rules deployment with ring 1. > :::image type="content" source="images/asr-rules-testing-steps.png" alt-text="The Microsoft Defender for Endpoint (MDE) attack surface reduction (ASR rules) test steps. Audit ASR rules, configure ASR rules exclusions. Configure ASR rules Intune. ASR rules exclusions. ASR rules event viewer." lightbox="images/asr-rules-testing-steps.png":::- + ## Step 1: Test ASR rules using Audit Begin the testing phase by turning on the ASR rules with the rules set to Audit, starting with your champion users or devices in ring 1. Typically, the recommendation is that you enable all the rules (in Audit) so that you can determine which rules are triggered during the testing phase. Note that rules that are set to Audit do not generally impact functionality of the entity or entities to which the rule is applied but do generate logged events for the evaluation; there is no effect on end users. You can use Microsoft Intune Endpoint Security to configure custom ASR rules. 2. Go to **Endpoint Security** > **Attack surface reduction**. 3. Select **Create Policy**. 4. In **Platform**, select **Windows 10 and later**, and in **Profile**, select **Attack surface reduction rules**.- + > [!div class="mx-imgBorder"] > :::image type="content" source="images/asr-mem-create-profile.png" alt-text="The profile creation page for ASR rules" lightbox="images/asr-mem-create-profile.png"::: You can use Microsoft Intune Endpoint Security to configure custom ASR rules. > [!div class="mx-imgBorder"] > :::image type="content" source="images/asr-mem-configuration-settings.png" alt-text="The configuration of ASR rules to Audit mode" lightbox="images/asr-mem-configuration-settings.png"::: - >[!Note] - >There are variations in some ASR rules mode listings; _Blocked_ and _Enabled_ provide the same functionality. + > [!NOTE] + > There are variations in some ASR rules mode listings; _Blocked_ and _Enabled_ provide the same functionality. 8. [Optional] In the **Scope tags** pane, you can add tag information to specific devices. You can also use role-based access control and scope tags to make sure that the right admins have the right access and visibility to the right Intune objects. Learn more: [Use role-based access control (RBAC) and scope tags for distributed IT in Intune](/mem/intune/fundamentals/scope-tags). 9. In the **Assignments** pane, you can deploy or "assign" the profile to your user or device groups. Learn more: [Assign device profiles in Microsoft Intune](/mem/intune/configuration/device-profile-assign#exclude-groups-from-a-profile-assignment)- - >[!Note] ++ > [!NOTE] > Device group creation is supported in Defender for Endpoint Plan 1 and Plan 2. -1. Review your settings in the **Review + create** pane. Click **Create** to apply the rules. +10. Review your settings in the **Review + create** pane. Click **Create** to apply the rules. - > [!div class="mx-imgBorder"] - > :::image type="content" source="images/asr-mem-review-create.png" alt-text="The Create profile page" lightbox="images/asr-mem-review-create.png"::: + > [!div class="mx-imgBorder"] + > :::image type="content" source="images/asr-mem-review-create.png" alt-text="The Create profile page" lightbox="images/asr-mem-review-create.png"::: Your new attack surface reduction policy for ASR rules is listed in **Endpoint security | Attack surface reduction**. Provides a 30-day timeline of detected audit and blocked events. The Attack Surface reduction rules pane provides an overview of detected events on a per-rule basis. ->[!Note] ->There are some variations in ASR rules reports. Microsoft is in the process of updating the behavior of the ASR rules reports to provide a consistent experience. +> [!NOTE] +> There are some variations in ASR rules reports. Microsoft is in the process of updating the behavior of the ASR rules reports to provide a consistent experience. :::image type="content" source="images/attack-surface-reduction-rules-report-main-detections-configuration-card.png" alt-text="Graph that shows the ASR rules report summary configuration card." lightbox="images/attack-surface-reduction-rules-report-main-detections-configuration-card.png"::: The **GroupBy** returns results set to the following groups: > [!div class="mx-imgBorder"] > :::image type="content" source="images/asr-defender365-filter.png" alt-text="The Attack surface reduction rules detections filter on rules" lightbox="images/asr-defender365-filter.png"::: ->[!Note] ->If you have a Microsoft Microsoft 365 Security E5 or A5, Windows E5 or A5 license, the following link opens the Microsoft Defender 365 Reports > [Attack surface reductions](https://security.microsoft.com/asr?viewid=detections) > Detections tab. +> [!NOTE] +> If you have a Microsoft Microsoft 365 Security E5 or A5, Windows E5 or A5 license, the following link opens the Microsoft Defender 365 Reports > [Attack surface reductions](https://security.microsoft.com/asr?viewid=detections) > Detections tab. ### Configuration tab The Endpoint Security | Attack surface reduction pane opens: > [!div class="mx-imgBorder"] > :::image type="content" source="images/asr-defender365-05b-mem3.png" alt-text="The Endpoint security Attack surface reduction pane" lightbox="images/asr-defender365-05b-mem3.png"::: ->[!Note] ->If you have a Microsoft Defender 365 E5 (or Windows E5?) license, this link will open the Microsoft Defender 365 Reports > Attack surface reductions > [Configurations](https://security.microsoft.com/asr?viewid=configuration) tab. +> [!NOTE] +> If you have a Microsoft Defender 365 E5 (or Windows E5?) license, this link will open the Microsoft Defender 365 Reports > Attack surface reductions > [Configurations](https://security.microsoft.com/asr?viewid=configuration) tab. ### Add exclusions This tab provides a method to select detected entities (for example, false positives) for exclusion. When exclusions are added, the report provides a summary of the expected impact. ->[!Note] +> [!NOTE] > Microsoft Defender Antivirus AV exclusions are honored by ASR rules. See [Configure and validate exclusions based on extension, name, or location](configure-extension-file-exclusions-microsoft-defender-antivirus.md). > [!div class="mx-imgBorder"] > :::image type="content" source="Images/asr-defender365-06d.png" alt-text="The pane for exclusion of the detected file" lightbox="Images/asr-defender365-06d.png"::: -> [!Note] ->If you have a Microsoft Defender 365 E5 (or Windows E5?) license, this link will open the Microsoft Defender 365 Reports > Attack surface reductions > [Exclusions](https://security.microsoft.com/asr?viewid=exclusions) tab. +> [!NOTE] +> If you have a Microsoft Defender 365 E5 (or Windows E5?) license, this link will open the Microsoft Defender 365 Reports > Attack surface reductions > [Exclusions](https://security.microsoft.com/asr?viewid=exclusions) tab. For more information about using the ASR rules report to manage ASR rules, see [Attack surface reduction rules reports](attack-surface-reduction-rules-report.md). |
| security | Attack Surface Reduction | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction.md | See [Requirements](enable-attack-surface-reduction.md#requirements) in the "Enab ### Audit mode -Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would affect your organization if enabled. Run all rules in audit mode first so you can understand how they affect your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they might perform tasks in ways that seem similar to malware. +Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would affect your organization if enabled. Run all rules in audit mode first so you can understand how they affect your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they might perform tasks in ways that seem similar to malware. ### Exclusions -By monitoring audit data and [adding exclusions](attack-surface-reduction-rules-deployment-test.md) for necessary applications, you can deploy attack surface reduction rules without reducing productivity. +By monitoring audit data and [adding exclusions](attack-surface-reduction-rules-deployment-test.md) for necessary applications, you can deploy attack surface reduction rules without reducing productivity. ### Per-rule exclusions You can set attack surface reduction rules for devices that are running any of t - [Windows Server 2016](/windows-server/get-started/whats-new-in-windows-server-2016) - [Windows Server 2012 R2](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh801901(v=ws.11)) - >[!NOTE] - >Windows Server 2016 and Windows Server 2012 R2 will need to be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016) for this feature to work. + > [!NOTE] + > Windows Server 2016 and Windows Server 2012 R2 will need to be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016) for this feature to work. Although attack surface reduction rules don't require a [Windows E5 license](/windows/deployment/deploy-enterprise-licenses), if you have Windows E5, you get advanced management capabilities. The advanced capabilities - available only in Windows E5 - include: These advanced capabilities aren't available with a Windows Professional or Wind Defender for Endpoint provides detailed reporting for events and blocks as part of alert investigation scenarios. -You can query Defender for Endpoint data in [Microsoft 365 Defender](microsoft-defender-endpoint.md) by using [advanced hunting](/microsoft-365/security/defender/advanced-hunting-query-language). +You can query Defender for Endpoint data in [Microsoft 365 Defender](microsoft-defender-endpoint.md) by using [advanced hunting](/microsoft-365/security/defender/advanced-hunting-query-language). Here is an example query: |
| security | Batch Update Alerts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/batch-update-alerts.md | Last updated 03/15/2021 [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** +**Applies to:** - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) ->Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) [!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] [!include[Improve request performance](../../includes/improve-request-performance.md)] - ## API description Updates properties of a batch of existing [Alerts](alerts.md). classification | String | Specifies the specification of the specified alerts. T determination | String | Specifies the determination of the specified alerts. <p>Possible determination values for each classification are: <br><li> <b>True positive</b>: `Multistage attack` (MultiStagedAttack), `Malicious user activity` (MaliciousUserActivity), `Compromised account` (CompromisedUser) ΓÇô consider changing the enum name in public api accordingly, `Malware` (Malware), `Phishing` (Phishing), `Unwanted software` (UnwantedSoftware), and `Other` (Other). <li> <b>Informational, expected activity:</b> `Security test` (SecurityTesting), `Line-of-business application` (LineOfBusinessApplication), `Confirmed activity` (ConfirmedUserActivity) - consider changing the enum name in public api accordingly, and `Other` (Other). <li> <b>False positive:</b> `Not malicious` (Clean) - consider changing the enum name in public api accordingly, `Not enough data to validate` (InsufficientData), and `Other` (Other). comment | String | Comment to be added to the specified alerts. ->[!NOTE] ->Around August 29, 2022, previously supported alert determination values ('Apt' and 'SecurityPersonnel') will be deprecated and no longer available via the API. +> [!NOTE] +> Around August 29, 2022, previously supported alert determination values ('Apt' and 'SecurityPersonnel') will be deprecated and no longer available via the API. ## Response |
| security | Built In Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/built-in-protection.md | Built-in protection is a set of default settings. You aren't required to keep th |:|:| | Determine whether tamper protection is turned on for your organization | 1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in.<br/>2. Go to **Settings** > **Endpoints** > **Advanced features** > **Tamper protection**. | | Manage tamper protection tenant wide using the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) | 1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in.<br/>2. Go to **Settings** > **Endpoints** > **Advanced features**.<br/>3. Set **Tamper protection** to **On** (*recommended*) or **Off**.<br/>4. Select **Save preferences**.<br/>See [Manage tamper protection for your organization using Microsoft 365 Defender portal](manage-tamper-protection-microsoft-365-defender.md). |-| Set tamper protection settings for some, but not all, devices | Use endpoint security policies and profiles that are applied to specific devices. See the following articles:<br/>- [Manage tamper protection using Microsoft Intune](manage-tamper-protection-microsoft-endpoint-manager.md)<br/>- [Manage tamper protection using tenant attach with Configuration Manager, version 2006](manage-tamper-protection-configuration-manager.md)| +| Set tamper protection settings for some, but not all, devices | Use endpoint security policies and profiles that are applied to specific devices. See the following articles:<br/>- [Manage tamper protection using Microsoft Intune](manage-tamper-protection-intune.md)<br/>- [Manage tamper protection using tenant attach with Configuration Manager, version 2006](manage-tamper-protection-configuration-manager.md)| | Turn tamper protection on or off on an individual Windows device | 1. On your Windows device, select **Start**, and start typing *Security*.<br/>2. In the search results, select **Windows Security**.<br/>3. Select **Virus & threat protection** > **Virus & threat protection settings**.<br/>4. Set **Tamper Protection** to **On** (*recommended*) or **Off**. <br/><br/>If the device is onboarded to Defender for Endpoint, or the device is managed in the Microsoft Intune admin center, those settings will override user settings on the individual device. See [Manage tamper protection on an individual device](manage-tamper-protection-individual-device.md). | | Turn tamper protection on or off manually on a Mac | 1. On your Mac, open Finder, and go to **Applications** > **Utilities** > **Terminal**.<br/>2. In Terminal, type the following command `sudo mdatp config tamper-protection enforcement-level --value (chosen mode)`.<br/><br/>See [Manual configuration](tamperprotection-macos.md#manual-configuration). | | Change tamper protection settings using a Mobile Device Management (MDM) solution | To change the tamper protection mode using an MDM, go to the configuration profile and change the enforcement level in [Intune](tamperprotection-macos.md#intune) or [JAMF](tamperprotection-macos.md#jamf).<br/><br/>The configuration profile set with the MDM will be your first point of reference. Any settings defined in the profile will be enforced on the device, and built-in-protection default settings won't override these applied settings. | |
| security | Collect Investigation Package | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/collect-investigation-package.md | Last updated 12/18/2020 - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ->Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) [!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] |
| security | Comprehensive Guidance On Linux Deployment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/comprehensive-guidance-on-linux-deployment.md | This article provides advanced deployment guidance for Microsoft Defender for En For information about Microsoft Defender for Endpoint capabilities, see [Advanced Microsoft Defender for Endpoint capabilities](#advanced-microsoft-defender-for-endpoint-capabilities). To learn about other ways to deploy Microsoft Defender for Endpoint on Linux, see:+ - [Manual deployment](linux-install-manually.md) - [Puppet based deployment](linux-install-with-puppet.md) - [Ansible based deployment](linux-install-with-ansible.md) Learn about the general guidance on a typical Microsoft Defender for Endpoint on [2. Capture performance data from the endpoint.](#2-capture-performance-data-from-the-endpoint) ->[!NOTE] ->Consider doing the following optional items, even though they are not Microsoft Defender for Endpoint specific, they tend to improve performance in Linux systems. +> [!NOTE] +> Consider doing the following optional items, even though they are not Microsoft Defender for Endpoint specific, they tend to improve performance in Linux systems. [3. (Optional) Check for filesystem errors 'fsck' (akin to chkdsk).](#3-optional-check-for-filesystem-errors-fsck-akin-to-chkdsk) Use the following steps to check the network connectivity of Microsoft Defender - WW - (Blanks) - >[!NOTE] - >You should ensure that there are no firewall or network filtering rules that would deny access to these URLs. If there are, you may need to create an allow rule specifically for them. + > [!NOTE] + > You should ensure that there are no firewall or network filtering rules that would deny access to these URLs. If there are, you may need to create an allow rule specifically for them. 3. Work with the Firewall/Proxy/Networking admins to allow the relevant URLs. Set up your device groups, device collections, and organizational units Device g } ``` - **Recommendations**: +**Recommendations**: ```JSON { High I/O workloads such as Postgres, OracleDB, Jira, and Jenkins may require add You can refer to these documents for more information if you experience performance degredation: - [Troubleshoot performance issues for Microsoft Defender for Endpoint on Linux](linux-support-perf.md).-- [Troubleshoot AuditD performance issues with Microsoft Defender for Endpoint on Linux ](troubleshoot-auditd-performance-issues.md).+- [Troubleshoot AuditD performance issues with Microsoft Defender for Endpoint on Linux](troubleshoot-auditd-performance-issues.md). ## 11. Download the Microsoft Defender for Endpoint on Linux onboarding package |
| security | Configure Contextual File Folder Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-contextual-file-folder-exclusions-microsoft-defender-antivirus.md | |
| security | Configure Device Discovery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-device-discovery.md | Last updated 03/23/2021 - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) - Discovery can be configured to be on standard or basic mode. Use the standard option to actively find devices in your network, which will better guarantee the discovery of endpoints and provide richer device classification. You can customize the list of devices that are used to perform standard discovery. You can either enable standard discovery on all the onboarded devices that also support this capability (currently - Windows 10 or later and Windows Server 2019 or later devices only) or select a subset or subsets of your devices by specifying their device tags. Navigate to **Settings** > **Device discovery** 2. If you've selected to use Standard discovery, select which devices to use for active probing: all devices or on a subset by specifying their device tags, and then select **Save** > [!NOTE]->Standard discovery uses various PowerShell scripts to actively probe devices in the network. Those PowerShell scripts are Microsoft signed and are executed from the following location: `C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\*.ps`. For example, `C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\UnicastScannerV1.1.0.ps1`. +> Standard discovery uses various PowerShell scripts to actively probe devices in the network. Those PowerShell scripts are Microsoft signed and are executed from the following location: `C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\*.ps`. For example, `C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads\UnicastScannerV1.1.0.ps1`. ## Exclude devices from being actively probed in standard discovery |
| security | Configure Proxy Internet | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-proxy-internet.md | The static proxy is configurable through group policy (GP), both the settings un | Configure connected user experiences and telemetry | `HKLM\Software\Policies\Microsoft\Windows\DataCollection` | `TelemetryProxyServer` | ```servername:port or ip:port``` <br> <br> For example: ```10.0.0.6:8080``` (REG_SZ) | > [!NOTE]-> If you are using 'TelemetryProxyServer' setting on devices that are otherwise **completely offline**, meaning the operating system is unable to connect for the online certificate revocation list or Windows Update, then it is recommended to add the additional registry setting `PreferStaticProxyForHttpRequest` with a value of `1`.<br> +> If you are using 'TelemetryProxyServer' setting on devices that are otherwise **completely offline**, meaning the operating system is unable to connect for the online certificate revocation list or Windows Update, then it is required to add the additional registry setting `PreferStaticProxyForHttpRequest` with a value of `1`.<br> > Parent registry path location for "PreferStaticProxyForHttpRequest" is "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection"<br> > The following command can be used to insert the registry value in the correct location:<br> > ```reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /v PreferStaticProxyForHttpRequest /t REG_DWORD /d 1 /f```<br> In your firewall, open all the URLs where the geography column is WW. For rows w > URLs that include v20 in them are only needed if you have Windows devices running version 1803 or later. For example, `us-v20.events.data.microsoft.com` is needed for a Windows device running version 1803 or later and onboarded to US Data Storage region. > -If a proxy or firewall is blocking anonymous traffic as Defender for Endpoint sensor, and it's connecting from system context to make sure anonymous traffic is permitted in the previously listed URLs. +If a proxy or firewall is blocking anonymous traffic from the Defender for Endpoint sensor and it's connecting from system context, it's important to make sure anonymous traffic is permitted in your proxy or firewall for the previously listed URLs. > [!NOTE] > Microsoft does not provide a proxy server. These URLs are accessible via the proxy server that you configure. |
| security | Delete Library | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/delete-library.md | Title: Delete a file from the live response library + Title: Delete a file from the live response library description: Learn how to delete a file from the live response library. keywords: apis, graph api, supported apis, delete from library search.product: eADQiWindows 10XVcnh-# Delete a file from the live response library +# Delete a file from the live response library [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] Last updated 06/03/2021 [!include[Prerelease information](../../includes/prerelease.md)] ->Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) [!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] Delete a file from live response library. ## Limitations -1. Rate limitations for this API are 100 calls per minute and 1500 calls per +1. Rate limitations for this API are 100 calls per minute and 1500 calls per hour. ## Permissions Empty ## Response -- If file exists in library and deleted successfully 204 No Content.+- If file exists in library and deleted successfully 204 No Content. -- If specified file name was not found 404 Not Found.+- If specified file name was not found 404 Not Found. ## Example DELETE https://api.securitycenter.microsoft.com/api/libraryfiles/script1.ps1 ``` ## Related topic+ - [Run live response](run-live-response.md) |
| security | Device Health Microsoft Defender Antivirus Health | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-health-microsoft-defender-antivirus-health.md | ms.pagetype: security localization_priority: Normal Previously updated : 09/06/2022 Last updated : 09/06/2022 audience: ITPro-+ - m365-security - tier2 Up-to-date reporting generates information for devices that meet the following c - Cloud protection enabled - MsSense.exe version 10.8210.x or later - Windows OS - Windows 10 1809 or later- >[!Note] - >Currently up to date reporting is only available for Windows devices. Cross platform devices such as Mac and Linux are listed under "No data available"/Unknown. ++ > [!NOTE] + > Currently up to date reporting is only available for Windows devices. Cross platform devices such as Mac and Linux are listed under "No data available"/Unknown. :::image type="content" source="images/device-health-defender-antivirus-health-tab.png" alt-text="Shows the Microsoft Defender Antivirus Health tab." lightbox="images/device-health-defender-antivirus-health-tab.png"::: The following table lays out the possible up to date report values for **Securit > - top scans per file > - top scans per file per process >-> You can use the information gathered using Performance analyzer to better assess performance issues and apply remediation actions. +> You can use the information gathered using Performance analyzer to better assess performance issues and apply remediation actions. > See: [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md).-> - [Export device antivirus health details API methods and properties](device-health-api-methods-properties.md) - [Export device antivirus health report](device-health-api-methods-properties.md) |
| security | Enable Attack Surface Reduction | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction.md | ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro-+ |
| security | Enable Cloud Protection Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus.md | For more information about the specific network-connectivity requirements to ens - **Send safe samples** (1) - **Send all samples** (3) - >[!NOTE] + > [!NOTE] > The **Send safe samples** (1) option means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation. > Setting the option to **Always Prompt** (0) will lower the protection state of the device. Setting it to **Never send** (2) means that the [Block at First Sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) feature of Microsoft Defender for Endpoint won't work. |
| security | Evaluation Lab | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/evaluation-lab.md | Automated investigation settings will be dependent on tenant settings. It will b 5. See the status of test devices, the risk and exposure levels, and the status of simulator installations by selecting the **Devices** tab. :::image type="content" source="images/machines-tab.png" alt-text="The devices tab" lightbox="images/machines-tab.png":::- > [!TIP] > In the **Simulator status** column, you can hover over the information icon to know the installation status of an agent. --## Add a domain controller +## Add a domain controller Add a domain controller to run complex scenarios such as lateral movement and multistage attacks across multiple devices. -->[!NOTE] ->Domain support is only available in the Microsoft 365 Defender portal (security.microsoft.com). +> [!NOTE] +> Domain support is only available in the Microsoft 365 Defender portal (security.microsoft.com). 1. From the dashboard, select **Add device**. -2. Select **Windows Server 2019**, then select **Set as domain controller**. --3. When your domain controller has been provisioned, you'll be able to create domain-joined devices by clicking **Add device**. Then select Windows 10 / Windows 11, and select **Join to domain**. -->[!NOTE] ->Only one domain controller can be live at a time. The domain controller device will remain live as long as there is a live device connected to it. +2. Select **Windows Server 2019**, then select **Set as domain controller**. +3. When your domain controller has been provisioned, you'll be able to create domain-joined devices by clicking **Add device**. Then select Windows 10 / Windows 11, and select **Join to domain**. +> [!NOTE] +> Only one domain controller can be live at a time. The domain controller device will remain live as long as there is a live device connected to it. ## Request for more devices If you are looking for a pre-made simulation, you can use our ["Do It Yourself" :::image type="content" source="images/test-machine-table.png" alt-text="The Connect button for the test devices" lightbox="images/test-machine-table.png"::: - :::image type="content" source="images/remote-connection.png" alt-text="The remote desktop connection screen" lightbox="images/remote-connection.png"::: - For **Linux devices**: you'll need to use a local SSH client and the provided command. -+ For **Linux devices**: you'll need to use a local SSH client and the provided command. > [!NOTE] > If you don't have a copy of the password saved during the initial setup, you can reset the password by selecting **Reset password** from the menu: If you are looking for a pre-made simulation, you can use our ["Do It Yourself" > > The device will change it's state to "Executing password reset", then you'll be presented with your new password in a few minutes. -3. Enter the password that was displayed during the device creation step. +2. Enter the password that was displayed during the device creation step. :::image type="content" source="images/enter-password.png" alt-text="The screen on which you enter credentials" lightbox="images/enter-password.png"::: -4. Run Do-it-yourself attack simulations on the device. +3. Run Do-it-yourself attack simulations on the device. ### Threat simulator scenarios |
| security | Export Security Baseline Assessment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/export-security-baseline-assessment.md | GET /api/machines/BaselineComplianceAssessmentExport > [!NOTE] > The files are gzip compressed & in multiline Json format. >->The download URLs are only valid for 3 hours; otherwise you can use the parameter. +> The download URLs are only valid for 3 hours; otherwise you can use the parameter. >->To maximize download speeds, make sure you are downloading the data from the same Azure region where your data resides. +> To maximize download speeds, make sure you are downloading the data from the same Azure region where your data resides. >->Some additional columns might be returned in the response. These columns are temporary and might be removed. Only use the documented columns. +> Some additional columns might be returned in the response. These columns are temporary and might be removed. Only use the documented columns. Property (ID)|Data type|Description :|:|: GET https://api.securitycenter.microsoft.com/api/machines/BaselineComplianceAsse ```json { "@odata.context": "https://api.securitycenter. contoso.com/api/$metadata#microsoft.windowsDefenderATP.api.ExportFilesResponse",- "exportFiles": + "exportFiles": [ "https://tvmexportexternalstgeus.blob.core.windows.net/temp-1ebd3d09-d06a-4aad-ab80-ebc536cec61c/2021-12-22/0500/BaselineAssessmentExport/json/OrgId= OrgId=<Org Id>/_RbacGroupId=<Rbac Group Id>/part-00000-c09dfd00-2278-4735-b23a-71733751fcbc.c000.json.gz?sv=ABCD", "https://tvmexportexternalstgeus.blob.core.windows.net/temp-1ebd3d09-d06a-4aad-ab80-ebc536cec61c/2021-12-22/0500/BaselineAssessmentExport/json/OrgId=<Org Id>/_RbacGroupId=<Rbac Group Id>/part-00001-c09dfd00-2278-4735-b23a-71733751fcbc.c000.json.gz?sv= ABCD", |
| security | Faqs Tamper Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/faqs-tamper-protection.md | -ms.pagetype: security -ms.sitesec: library ms.localizationpriority: medium Previously updated : 02/07/2023 Last updated : 03/06/2023 audience: ITPro search.appverid: met150 If you're using Configuration Manager, version 2006, with tenant attach, tamper protection can be extended to Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, and Windows Server 2022. See [Tenant attach: Create and deploy endpoint security Antivirus policy from the admin center (preview)](/mem/configmgr/tenant-attach/deploy-antivirus-policy). -## Will tamper protection affect non-Microsoft antivirus registration in the Windows Security app? +## How do I turn tamper protection on or off? -No. Non-Microsoft antivirus offerings will continue to register with the Windows Security application. +If you're an organization using [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint), you can choose from several options to manage tamper protection: -## What happens if Microsoft Defender Antivirus isn't active on a device? +- The [Microsoft 365 Defender portal](manage-tamper-protection-microsoft-365-defender.md) (turn tamper protection on or off, tenant wide) +- [Intune](manage-tamper-protection-intune.md) (turn tamper protection on or off, and/or configure tamper protection for some or all users) +- [Configuration Manager](manage-tamper-protection-configuration-manager.md) (with tenant attach, you can configure tamper protection for some or all devices by using the Windows Security experience profile) +- [Windows Security app](manage-tamper-protection-individual-device.md) (for an individual device used at home or that isn't centrally managed by a security team) -Devices that are onboarded to Microsoft Defender for Endpoint will have Microsoft Defender Antivirus running in passive mode. In these cases, tamper protection will continue to protect the service and its features. +For more information, see [How do I configure or manage tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md#how-do-i-configure-or-manage-tamper-protection)? -## How do I turn tamper protection on or off? +## Tamper protection is preventing my security team from managing a device. What should we do? -If you're an organization using [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint), you should be able to manage tamper protection in Intune similar to how you manage other endpoint protection features. See the following sections of this article: +If tamper protection prevents your IT or security team from performing a necessary task on a device, consider using [troubleshooting mode](enable-troubleshooting-mode.md). We recommend keeping tamper protection turned on for your organization. -- [Manage tamper protection using Microsoft Intune](manage-tamper-protection-microsoft-endpoint-manager.md)-- [Manage tamper protection using Microsoft 365 Defender](manage-tamper-protection-microsoft-365-defender.md)+## Can I change individual tamper-protected settings? -If you're a home user, see [Manage tamper protection on an individual device](manage-tamper-protection-individual-device.md). +If tamper protection is turned on for your organization, you won't be able to make changes to individual settings that are tamper protected. However, if you're managing tamper protection and devices in Intune, you can edit exclusions for Microsoft Defender Antivirus. See [Tamper protection for exclusions](manage-tamper-protection-intune.md#tamper-protection-for-exclusions). ## Does tamper protection apply to Microsoft Defender Antivirus exclusions? If you're using tenant attach, you can use Microsoft Configuration Manager. See - [Manage tamper protection using tenant attach with Configuration Manager, version 2006](manage-tamper-protection-configuration-manager.md) - [Tech Community blog: Announcing Tamper Protection for Configuration Manager Tenant Attach clients](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/announcing-tamper-protection-for-configuration-manager-tenant/ba-p/1700246#.X3QLR5Ziqq8.linkedin) +## Will tamper protection affect non-Microsoft antivirus registration in the Windows Security app? ++No. Non-Microsoft antivirus offerings will continue to register with the Windows Security application. ++## What happens if Microsoft Defender Antivirus isn't active on a device? ++Devices that are onboarded to Microsoft Defender for Endpoint will have Microsoft Defender Antivirus running in passive mode. In these cases, tamper protection will continue to protect the service and its features. + ## I have the Windows E3 enrollment. Can I use configuring tamper protection in Intune? -Currently, configuring tamper protection in Intune is only available for customers whose subscriptions include [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint). +Currently, configuring tamper protection in Intune is only available for customers whose subscriptions include [Microsoft Defender for Endpoint Plan 1 or Plan 2](/microsoft-365/security/defender-endpoint). ## I'm an enterprise customer. Can local admins change tamper protection on their devices? Your security operations team can also use hunting queries, such as the followin `AlertInfo|where Title == "Tamper Protection bypass"` -> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) +## Does tamper protection require cloud protection? + +Depending on the method or management tool you use to enable tamper protection, there might be a dependency on [cloud-delivered protection](cloud-protection-microsoft-defender-antivirus.md). Cloud-delivered protection is also referred to as cloud protection, or Microsoft Advanced Protection Service (MAPS). The following table summarizes whether there's a dependency on cloud protection. -## What are all the options for configuring tamper protection? +| How tamper protection is enabled | Dependency on cloud protection? | +||| +| Microsoft Intune | No | +| Microsoft Configuration Manager with Tenant Attach | No | +| Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) | Yes | -You can use any of the following methods to configure tamper protection: +## See also -- The [Microsoft 365 Defender portal](manage-tamper-protection-microsoft-365-defender.md) (turn tamper protection on or off, tenant wide)-- [Intune](manage-tamper-protection-microsoft-endpoint-manager.md) (turn tamper protection on or off, and/or configure tamper protection for some or all users)-- [Configuration Manager](manage-tamper-protection-configuration-manager.md) (with tenant attach, you can configure tamper protection for some or all devices by using the Windows Security experience profile)-- [Windows Security app](manage-tamper-protection-individual-device.md) (for an individual device used at home or that isn't centrally managed by a security team)+- [Protect security settings with tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) +- [Manage tamper protection for your organization using Microsoft Intune](manage-tamper-protection-intune.md) +- [Manage tamper protection for your organization using Microsoft 365 Defender portal](manage-tamper-protection-microsoft-365-defender.md) -> [!NOTE] -> We recommend keeping tamper protection turned on for your whole organization. If tamper protection prevents your IT or security team from performing a necessary task on a device, -consider using [troubleshooting mode](enable-troubleshooting-mode.md) instead of disabling tamper protection. +If you're looking for Antivirus related information for other platforms, see: +- [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) +- [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) +- [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Get Assessment Browser Extensions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-assessment-browser-extensions.md | Delegated (work or school account)|Software.Read|'Read Threat and Vulnerability ### 1.3 URL ```http-GET api/Machines/BrowserExtensionsInventoryByMachine +GET /api/Machines/BrowserExtensionsInventoryByMachine ``` ### 1.4 Parameters Delegated (work or school account)|Software.Read|'Read Threat and Vulnerability ### 2.3 URL ```http-GET /api/Machines/BrowserExtensionsInventoryByMachine +GET /api/machines/browserextensionsinventoryExport ``` ### 2.4 Parameters GeneratedTime|string|The time that the export was generated.|2021-05-20T08:00:00 #### 2.6.1 Request example ```http-GET https://api.securitycenter.microsoft.com/api/machines/BrowserExtensionsExport +GET https://api.securitycenter.microsoft.com/api/machines/browserextensionsinventoryExport ``` #### 2.6.2 Response example |
| security | Get Assessment Methods Properties | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-assessment-methods-properties.md | |
| security | Get Assessment Non Cpe Software Inventory | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-assessment-non-cpe-software-inventory.md | Delegated (work or school account)|Software.Read|\'Read Threat and Vulnerability ### 2.3 URL ```http-GET /api/machines/Api/Machines/SoftwareInventoryNonCpeExport +GET /api/machines/SoftwareInventoryNonCpeExport ``` ### Parameters |
| security | Get Assessment Secure Config | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-assessment-secure-config.md | |
| security | Get Assessment Software Inventory | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-assessment-software-inventory.md | DeviceName|string|Fully qualified domain name (FQDN) of the device.|johnlaptop.e DiskPaths|Array[string]|Disk evidence that the product is installed on the device.|[ "C:\\Program Files (x86)\\Microsoft\\Silverlight\\Application\\silverlight.exe" ] EndOfSupportDate|string|The date in which support for this software has or will end.|2020-12-30 EndOfSupportStatus|string|End of support status. Can contain these possible values: None, EOS Version, Upcoming EOS Version, EOS Software, Upcoming EOS Software.|Upcoming EOS-Id|string|Unique identifier for the record.|123ABG55_573AG&mnp! NumberOfWeaknesses|int|Number of weaknesses on this software on this device|3 OSPlatform|string|Platform of the operating system running on the device. These are specific operating systems with variations within the same family, such as Windows 10 and Windows 11. See Microsoft Defender Vulnerability Management supported operating systems and platforms for details.|Windows10 and Windows 11 RbacGroupName|string|The role-based access control (RBAC) group. If this device is not assigned to any RBAC group, the value will be "Unassigned." If the organization doesn't contain any RBAC groups, the value will be "None."|Servers |
| security | Get Assessment Software Vulnerabilities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-assessment-software-vulnerabilities.md | |
| security | Get Machines By Software | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-machines-by-software.md | Last updated 12/18/2020 [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** +**Applies to:** - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) [!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] Delegated (work or school account)|Software.Read|'Read Threat and Vulnerability ## HTTP request ```http-GET /api/Software/{Id}/machineReferences +GET /api/Software/{Id}/machineReferences ``` ## Request headers Empty ## Response -If successful, this method returns 200 OK and a list of devices with the software installed in the body. +If successful, this method returns 200 OK and a list of devices with the software installed in the body. ## Example |
| security | Get Remediation All Activities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-remediation-all-activities.md | |
| security | Get Remediation Exposed Devices Activities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-remediation-exposed-devices-activities.md | |
| security | Get Remediation Methods Properties | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-remediation-methods-properties.md | |
| security | Get Remediation One Activity | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-remediation-one-activity.md | |
| security | Import Ti Indicators | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/import-ti-indicators.md | Last updated 02/02/2021 [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** +**Applies to:** - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) ->Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) [!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] |
| security | Indicator Certificates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/indicator-certificates.md | It's important to understand the following requirements prior to creating indica - This feature is available if your organization uses Microsoft Defender Antivirus and Cloud-based protection is enabled. For more information, see [Manage cloud-based protection](/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus). - The Antimalware client version must be 4.18.1901.x or later. - Supported on machines on Windows 10, version 1703 or later, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, and Windows Server 2022.- - >[!NOTE] - >Windows Server 2016 and Windows Server 2012 R2 will need to be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016) for this feature to work. ++ > [!NOTE] + > Windows Server 2016 and Windows Server 2012 R2 will need to be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016) for this feature to work. - The virus and threat protection definitions must be up to date. - This feature currently supports entering .CER or .PEM file extensions. |
| security | Indicator File | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/indicator-file.md | Cert and File IoC policy handling conflict will follow the below order: - Else **Allow** (passes Windows Defender Application Control & AppLocker policy, no IoC rules apply to it) >[!NOTE]-> In situations when Microsoft Defender Antivirus is set to **Block**, but Defender for Endpoint is set to **Allow**, the policy will default to **Allow**. +> In situations when Microsoft Defender Antivirus is set to **Block**, but Defender for Endpoint - Indicators - File hash or Certificate is set to **Allow**, the policy will default to **Allow**. If there are conflicting file IoC policies with the same enforcement type and target, the policy of the more secure (meaning longer) hash will be applied. For example, an SHA-256 file hash IoC policy will win over an MD5 file hash IoC policy if both hash types define the same file. |
| security | Indicator Ip Domain | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/indicator-ip-domain.md | For processes other than Microsoft Edge and Internet Explorer, web protection sc - Encrypted URLs (FQDN only) can be blocked in third party browsers (i.e. other than Internet Explorer, Edge) - Full URL path blocks can be applied for unencrypted URLs - If there are conflicting URL indicator policies, the longer path is applied. For example, the URL indicator policy `https://support.microsoft.com/office` takes precedence over the URL indicator policy `https://support.microsoft.com`.-There may be up to 2 hours of latency (usually less) between the time the action is taken, and the URL and IP being blocked. ### Warn mode controls _Allow_ overrides _warn_ which overrides _block_: Allow > Warn > Block. Therefor ### Policy conflict handling follows the order below - Defender for Cloud Apps creates an unsanctioned indicator for all users but URL is allowed for a specific device group, the specific device group is Blocked access to the URL.-1. If the IP, URL/Domain is allowed +- If the IP, URL/Domain is allowed +- If the IP, URL/Domain is not allowed +- If the IP, URL/Domain is allowed - If the IP, URL/Domain is not allowed - If the IP, URL/Domain is allowed-1. If the IP, URL/Domain is not allowed -1. If the IP, URL/Domain is allowed Threat and vulnerability management's block vulnerable application features uses the file IoCs for enforcement and will follow the above conflict handling order. The result is that categories 1-4 are all blocked. This is illustrated in the fo 5. Review the details in the **Summary** tab, then select **Save**. +> [!NOTE] +> There may be up to 2 hours of latency between the time a policy is created and the URL or IP being blocked on the device. + ## Related articles - [Create indicators](manage-indicators.md) |
| security | Mac Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-updates.md | The `Current` channel contains the most stable version of the product. > [!IMPORTANT] > Prior to Microsoft AutoUpdate version 4.29, channels had different names: >-> - `Beta` was named `InsiderFast` (Insider Fast) -> - `Preview` was named `External` (Insider Slow) -> - `Current` was named `Production` +> - `Beta Channel` was named `InsiderFast` (Insider Fast) +> - `Current Channel` (Preview) was named `External` (Insider Slow) +> - `Current Channel` was named `Production` > [!TIP] > In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to `Beta` or `Preview`. |
| security | Manage Tamper Protection Configuration Manager | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-tamper-protection-configuration-manager.md | See the following resources: - [Settings for the Windows Security experience profile in Microsoft Intune](/mem/intune/protect/antivirus-security-experience-windows-settings) - [Tech Community Blog: Announcing Tamper Protection for Configuration Manager Tenant Attach clients](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/announcing-tamper-protection-for-configuration-manager-tenant/ba-p/1700246#.X3QLR5Ziqq8.linkedin)--> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) |
| security | Manage Tamper Protection Individual Device | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-tamper-protection-individual-device.md | search.appverid: met150 **Platforms** - Windows -> [!NOTE] -> Tamper protection blocks attempts to modify Microsoft Defender Antivirus settings through the registry. -> To help ensure that tamper protection doesn't interfere with non-Microsoft security products or enterprise installation scripts that modify these settings, go to **Windows Security** and update **Security intelligence** to version 1.287.60.0 or later. (See [Security intelligence updates](https://www.microsoft.com/wdsi/definitions).) -> After you've made this update, tamper protection continues to protect your registry settings, and logs attempts to modify them without returning errors. If you're a home user, or you aren't subject to settings managed by a security team, you can use the Windows Security app to manage tamper protection. You must have appropriate admin permissions on your device to do change security settings, such as tamper protection. Here's what you see in the Windows Security app: :::image type="content" source="images/tamperprotectionturnedon.png" alt-text="Turn tamper protection turned on in Windows 10 Home" lightbox="images/tamperprotectionturnedon.png"::: -1. Select **Start**, and start typing *Security*. In the search results, select **Windows Security**. +1. On a Windows device, select **Start**, and start typing *Security*. In the search results, select **Windows Security**. 2. Select **Virus & threat protection** \> **Virus & threat protection settings**. 3. Set **Tamper Protection** to **On** or **Off**. -> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) -+> [!NOTE] +> Tamper protection blocks attempts to modify Microsoft Defender Antivirus settings through the registry. +> +> To help ensure that tamper protection doesn't interfere with non-Microsoft security products or enterprise installation scripts that modify these settings, go to **Windows Security** and update **Security intelligence** to version 1.287.60.0 or later. (See [Security intelligence updates](https://www.microsoft.com/wdsi/definitions).) +> +> After you've made this update, tamper protection continues to protect your registry settings, and logs attempts to modify them without returning errors. |
| security | Manage Tamper Protection Intune | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-tamper-protection-intune.md | + + Title: Manage tamper protection for your organization using Microsoft Intune +++description: Turn tamper protection on or off for your organization in Microsoft Intune. +keywords: malware, defender, antivirus, tamper protection, Microsoft Intune ++ms.localizationpriority: medium Last updated : 03/06/2023+audience: ITPro +++++- nextgen +- admindeeplinkDEFENDER +++- m365-security +- tier2 +search.appverid: met150 +++# Manage tamper protection for your organization using Microsoft Intune ++**Applies to:** ++- [Microsoft Defender for Endpoint Plan 1 and Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) +- Microsoft Defender Antivirus ++**Platforms** +- Windows ++[Tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) helps protect your security settings from being disabled or changed. If your organization uses [Microsoft Intune](/mem/intune/fundamentals/what-is-intune), you manage tamper protection for your organization in the [Intune admin center](https://endpoint.microsoft.com). With Intune, you can enable tamper protection on some, but not all devices. You can also tamper protect exclusions that are defined for Microsoft Defender Antivirus. ++Tamper protection is part of anti-tampering capabilities that include [standard protection attack surface reduction rules](attack-surface-reduction-rules-reference.md). ++> [!IMPORTANT] +> If you're using Microsoft Intune to manage Defender for Endpoint settings, we recommend setting [DisableLocalAdminMerge](/windows/client-management/mdm/defender-csp#configurationdisablelocaladminmerge) to true on devices. +> +> When tamper protection is turned on, tamper protected settings cannot be changed from their default value. Changes might appear to be successful in Intune, but will not actually be allowed by tamper protection. For the most current list of tamper protected settings, contact support. ++## Requirements for managing tamper protection in Intune ++- You must have appropriate [permissions](/microsoft-365/security/defender-endpoint/assign-portal-access) assigned, such as global admin, security admin, or security operations. +- Your organization uses [Intune to manage devices](/mem/endpoint-manager-getting-started). (Intune licenses are required; Intune is included in Microsoft 365 E3/E5, Enterprise Mobility + Security E3/E5, Microsoft 365 Business Premium, Microsoft 365 F1/F3, Microsoft 365 Government G3/G5, and corresponding education licenses.) +- Your Windows devices must be running Windows 10 [version 1709 or later](/lifecycle/announcements/revised-end-of-service-windows-10-1709) or Windows 11. (For more information about releases, see [Windows release information](/windows/release-health/release-information).) +- You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above). +- Your devices must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version `1.1.15500.X` (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).) +- Your Intune and Defender for Endpoint tenants must share the same Microsoft Entra (Azure Active Directory) infrastructure. +- Your devices must be onboarded to Defender for Endpoint. ++> [!NOTE] +> If your devices are not enrolled in Microsoft Defender for Endpoint, tamper protection will show as **Not Applicable** until the onboarding process completes. +> Tamper protection can prevent changes to security settings from occurring. If you see an error code with Event ID 5013, see [Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus](troubleshoot-microsoft-defender-antivirus.md). ++## Turn tamper protection on (or off) in Microsoft Intune +++1. In the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Endpoint security** \> **Antivirus**, and then choose **+ Create Policy**. ++ - In the **Platform** list, select **Windows 10, Windows 11, and Windows Server**. + - In the **Profile** list, select **Windows Security experience**. ++2. Create a profile that includes the following setting: ++ - **TamperProtection (Device): Enable** ++3. Assign the profile to one or more groups. ++## How to tell if a Windows device is managed by Intune ++You can use a registry key to confirm whether a Windows device is managed by Intune, or co-managed by Intune and Configuration Manager. ++1. On a Windows device open Registry Editor. (Read-only mode is fine; you won't be editing the registry key.) ++2. Go to `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender` (or `HKLM\SOFTWARE\Microsoft\Windows Defender`), and look for a `REG_DWORD` entry called **ManagedDefenderProductType**. ++ - If **ManagedDefenderProductType** has a value of `6`, then the device is managed by Intune. + - If **ManagedDefenderProductType** has a value of `7`, then the device is [co-managed](/mem/configmgr/comanage/overview) by Intune and Configuration Manager. ++> [!CAUTION] +> Do not change the value of **ManagedDefenderProductType**. Use the preceding procedure for information only. Changing the key will have no effect on how the device is managed. ++## Tamper protection for exclusions ++If your organization has [exclusions defined for Microsoft Defender Antivirus](configure-exclusions-microsoft-defender-antivirus.md), tamper protection will protect those exclusions, provided all of the following conditions are met: ++- Tamper protection is deployed and managed by using Intune, and devices are managed by Intune. +- `DisableLocalAdminMerge` is enabled. (See [DisableLocalAdminMerge](/windows/client-management/mdm/defender-csp).) +- Microsoft Defender Antivirus exclusions are managed in Microsoft Intune. (See [Settings for Microsoft Defender Antivirus policy in Microsoft Intune for Windows devices](/mem/intune/protect/antivirus-microsoft-defender-settings-windows).) +- Devices are running Windows Defender platform `4.18.2211.5` or later. (See [Monthly platform and engine versions](manage-updates-baselines-microsoft-defender-antivirus.md#monthly-platform-and-engine-versions).) +- Functionality to protect exclusions is enabled on devices. (See [How to determine whether the functionality is enabled on a Windows device](#how-to-determine-whether-the-functionality-to-protect-exclusions-is-enabled-on-a-windows-device).) ++> [!TIP] +> For more detailed information about exclusions, see [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md). ++### How to determine whether the functionality to protect exclusions is enabled on a Windows device ++You can use a registry key to determine whether the functionality to protect Microsoft Defender Antivirus exclusions is enabled. Note that the following procedure describes how to view, but not change, tamper protection status. ++1. On a Windows device open Registry Editor. (Read-only mode is fine; you won't be editing the registry key.) ++2. To confirm that the device is managed by Intune only, go to `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender` (or `HKLM\SOFTWARE\Microsoft\Windows Defender`), and look for a `REG_DWORD` entry called **ManagedDefenderProductType**. ++ - If **ManagedDefenderProductType** has a value of `6`, then the device is managed by Intune only (*this value is required for exclusions to be tamper protected*). + - If **ManagedDefenderProductType** has a value of `7`, then the device is co-managed, such as by Intune and Configuration Manager. ++3. To confirm that tamper protection is deployed and that exclusions are tamper protected, go to `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features` (or `HKLM\SOFTWARE\Microsoft\Windows Defender\Features`), and look for the `REG_DWORD` entries that are listed in the following table: ++ | REG_DWORD | Value | What it means | + |:|:|:| + | **TamperProtection** | 5 | Tamper protection is deployed to the device. | + | **TamperProtectionSource** | 64 | Tamper protection is managed by Intune. | + | **TPExclusions** | 1 | Required conditions are met, and the new functionality to protect exclusions is enabled on the device. In this case, exclusions are tamper protected. | + | **TPExclusions** | 0 | Tamper protection isn't currently protecting exclusions on the device. | ++> [!CAUTION] +> Do not change the value of the registry keys. Use the preceding procedure for information only. Changing keys will have no effect on whether tamper protection applies to exclusions. +++++> [!TIP] +> If you're looking for Antivirus related information for other platforms, see: +> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) +> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) +> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) +> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) +> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) +> - [Configure Defender for Endpoint on Android features](android-configure.md) +> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) |
| security | Manage Tamper Protection Microsoft 365 Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-tamper-protection-microsoft-365-defender.md | search.appverid: met150 **Platforms** - Windows -Tamper protection can be turned on or off for your tenant using the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). Here are a few points to keep in mind: +[Tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) helps protect your security settings from being disabled or changed. Tamper protection is part of anti-tampering capabilities that include [standard protection attack surface reduction rules](attack-surface-reduction-rules-reference.md). Tamper protection is an important part of your security strategy, as it helps prevent important security settings from being disabled or turned off. -- Currently, the option to manage tamper protection in the Microsoft 365 Defender portal is on by default for new deployments. For existing deployments, tamper protection is available on an opt-in basis. To opt in, in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, choose **Settings** \> **Endpoints** \> **Advanced features** \> **Tamper protection**.-- When you use the Microsoft 365 Defender portal to manage tamper protection, you don't have to use Intune or the tenant attach method.-- When you manage tamper protection in the Microsoft 365 Defender portal, the setting is applied tenant wide, affecting all of your devices that are running Windows 10, Windows 10 Enterprise multi-session, Windows 11, Windows 11 Enterprise multi-session, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 or Windows Server 2022. To fine-tune tamper protection (such as having tamper protection on for some devices but off for others), use either [Manage tamper protection for your organization using Microsoft Intune](manage-tamper-protection-microsoft-endpoint-manager.md) or [Manage tamper protection using tenant attach with Configuration Manager, version 2006](manage-tamper-protection-configuration-manager.md).-- If you have a hybrid environment, tamper protection settings configured in Intune take precedence over settings configured in the Microsoft 365 Defender portal.-- Tamper protection is part of anti-tampering capabilities that include [standard protection attack surface reduction rules](attack-surface-reduction-rules-reference.md).+You can turn tamper protection on (or off) tenant wide by using the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). ## Requirements for managing tamper protection in the Microsoft 365 Defender portal For more information about releases, see [Windows 10 release information](/windo 3. Go to **General** \> **Advanced features**, and then turn tamper protection on. -> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) +## Important points to keep in mind ++- When you manage tamper protection in the Microsoft 365 Defender portal, the setting is applied tenant wide, affecting all of your devices that are running Windows 10, Windows 10 Enterprise multi-session, Windows 11, Windows 11 Enterprise multi-session, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 or Windows Server 2022. To turn tamper protection on for some devices but off for others, use either [Manage tamper protection for your organization using Microsoft Intune](manage-tamper-protection-intune.md) or [Manage tamper protection using tenant attach with Configuration Manager, version 2006](manage-tamper-protection-configuration-manager.md). +- Currently, the option to manage tamper protection in the Microsoft 365 Defender portal is on by default for new deployments. For existing deployments, tamper protection is available on an opt-in basis. To opt in, in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, choose **Settings** \> **Endpoints** \> **Advanced features** \> **Tamper protection**. +- If you're using the Microsoft 365 Defender portal to manage tamper protection, you don't have to use Intune or the tenant attach method. +- If your organization is currently using Microsoft Intune to manage security settings (such as tamper protection), turning tamper protection on or off in the Microsoft 365 Defender portal won't override settings managed in Intune. +- If you have a hybrid environment, tamper protection settings configured in Intune take precedence over settings configured in the Microsoft 365 Defender portal. + |
| security | Microsoft Defender Antivirus Compatibility | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility.md | Defender for Endpoint affects whether Microsoft Defender Antivirus can run in pa (<a id="fn4">4</a>) In general, when Microsoft Defender Antivirus is in passive mode, real-time protection doesn't provide any blocking or enforcement, even though it's enabled and in passive mode. -(<a id="fn5">5</a>) When Microsoft Defender Antivirus is in passive mode, scans aren't scheduled. +(<a id="fn5">5</a>) When Microsoft Defender Antivirus is in passive mode, scans aren't scheduled. Note that scan tasks that are enabled in Windows Task Scheduler will continue to run according to their schedule. If you have such scheduled tasks, you can remove these if preferred. (<a id="fn6">6</a>) When Microsoft Defender Antivirus is in passive mode, it doesn't remediate threats. However, threats can be remediated by [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md). In this case, you might see alerts showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode. |
| security | Overview Attack Surface Reduction | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction.md | |
| security | Prevent Changes To Security Settings With Tamper Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection.md | -ms.pagetype: security -ms.sitesec: library ms.localizationpriority: medium Previously updated : 03/01/2023 Last updated : 03/07/2023 audience: ITPro search.appverid: met150 **Applies to:** -- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037)-- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)+- [Microsoft Defender for Endpoint Plan 1 and Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - Microsoft Defender Antivirus **Platforms** - Windows - [macOS](tamperprotection-macos.md) -Tamper protection is available for devices that are running one of the following versions of Windows: --- Windows 10 and 11 (including Enterprise multi-session)-- Windows Server 2022, Windows Server 2019, and Windows Server, version 1803 or later-- Windows Server 2016 and Windows Server 2012 R2 (using the modern, unified solution)--Tamper protection is also available for Mac. See [Protect macOS security settings with tamper protection](tamperprotection-macos.md). --## Overview --During some kinds of cyber attacks, bad actors try to disable security features, such as antivirus protection, on your machines. Bad actors like to disable your security features to get easier access to your data, to install malware, or to otherwise exploit your data, identity, and devices. Tamper protection helps prevent these kinds of things from occurring. With tamper protection, malicious apps are prevented from taking actions such as: --- Disabling virus and threat protection-- Disabling real-time protection-- Turning off behavior monitoring-- Disabling antivirus protection, such as IOfficeAntivirus (IOAV)-- Disabling cloud-delivered protection-- Removing security intelligence updates-- Disabling automatic actions on detected threats-- Suppressing notifications in the Windows Security app-- Disabling scanning of archives and network files--> [!IMPORTANT] -> Built-in protection includes turning tamper protection on by default. To learn more about built-in protection, see: -> - [Built-in protection helps guard against ransomware](built-in-protection.md) (article) -> - [Tamper protection will be turned on for all enterprise customers](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/tamper-protection-will-be-turned-on-for-all-enterprise-customers/ba-p/3616478) (Tech Community blog post) -> -> Tamper protection is part of anti-tampering capabilities that include [standard protection attack surface reduction rules](attack-surface-reduction-rules-reference.md). -> -> If you're using Microsoft Intune to manage Defender for Endpoint settings, we recommend setting [DisableLocalAdminMerge](/windows/client-management/mdm/defender-csp#configurationdisablelocaladminmerge) to true on devices, and deploy using Intune. -> -> When tamper protection is turned on, tamper protected settings cannot be changed from their default value. Changes might appear to be successful in Intune, but will not actually be allowed by tamper protection. For the most current list of tamper protected settings, contact support. --## How tamper protection works -Tamper protection essentially locks Microsoft Defender Antivirus to its secure, default values, and prevents your security settings from being changed through apps and methods such as: +## What is tamper protection? -- Configuring settings in Registry Editor on your Windows device-- Changing settings through PowerShell cmdlets on your device+Tamper protection is a capability in Microsoft Defender for Endpoint that helps protect certain security settings from being disabled or changed. During some kinds of cyber attacks, bad actors try to disable security features, such as antivirus protection, on devices. Disabling security features provides bad actors with easier access to your data, the ability to install malware, and the ability to exploit your data, identity, and devices. Tamper protection helps guard against these types of activities. -Tamper protection doesn't prevent you from viewing your security settings. And, tamper protection doesn't affect how non-Microsoft antivirus apps register with the Windows Security app. If your organization is using Defender for Endpoint, individual users can't change the tamper protection setting; in those cases, tamper protection is managed by your security team. +Tamper protection is part of anti-tampering capabilities that include [standard protection attack surface reduction rules](attack-surface-reduction-rules-reference.md). Tamper protection is an important part of [built-in protection](built-in-protection.md). -## Tamper protection and cloud protection - -Depending on the method or management tool you use to enable tamper protection, there might be a dependency on [cloud-delivered protection](cloud-protection-microsoft-defender-antivirus.md). Cloud-delivered protection is also referred to as cloud protection, or Microsoft Advanced Protection Service (MAPS). The following table summarizes whether there's a dependency on cloud protection. +## What happens when tamper protection is turned on? -| How tamper protection is enabled | Dependency on cloud protection? | -||| -| Microsoft Intune | No | -| Microsoft Configuration Manager with Tenant Attach | No | -| Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) | Yes | +When tamper protection is turned on, tamper protected settings cannot be changed from their default values. -## Methods to configure tamper protection +- Virus and threat protection are enabled. +- Real-time protection is turned on. +- Behavior monitoring is turned on. +- Antivirus protection, including IOfficeAntivirus (IOAV) is enabled. +- Cloud protection is enabled. +- Security intelligence updates occur. +- Automatic actions are taken on detected threats. +- Notifications are visible in the Windows Security app on Windows devices. +- Archives and network files can be scanned. -The following table lists the various methods you can use to configure tamper protection: +Tamper protection doesn't prevent you from viewing your security settings. And, tamper protection doesn't affect how non-Microsoft antivirus apps register with the Windows Security app. If your organization is using Defender for Endpoint, individual users can't change the tamper protection setting; in those cases, tamper protection is managed by your security team. (See [How do I configure or manage tamper protection](#how-do-i-configure-or-manage-tamper-protection)?) -|To perform this task...|See this content...| -||| -|Manage tamper protection across your tenant <br/><br/> Use the Microsoft 365 Defender portal to turn tamper protection on or off|[Manage tamper protection for your organization using Microsoft 365 Defender](manage-tamper-protection-microsoft-365-defender.md)| -|Fine-tune tamper protection settings in your organization <br/><br/> Use Microsoft Intune to turn tamper protection on or off on devices managed by Intune. You can configure tamper protection for some or all users with this method.|[Manage tamper protection for your organization using Intune](manage-tamper-protection-microsoft-endpoint-manager.md)| -| Protect Microsoft Defender Antivirus exclusions | [What about exclusions?](#what-about-exclusions) <br/><br/>[How to determine whether the functionality to protect exclusions is enabled on a Windows device](#how-to-determine-whether-the-functionality-to-protect-exclusions-is-enabled-on-a-windows-device) | -|Turn tamper protection on (or off) for your organization by using Configuration Manager|[Manage tamper protection for your organization using tenant attach with Configuration Manager, version 2006](manage-tamper-protection-configuration-manager.md)| -|Turn tamper protection on (or off) for an individual device (for home users or devices that aren't managed by a security team)|[Manage tamper protection on an individual device](manage-tamper-protection-individual-device.md)| -|View details about tampering attempts on devices|[View information about tampering attempts in Microsoft 365 Defender](#view-information-about-tampering-attempts)| -|Review your security recommendations |[Review security recommendations](#review-your-security-recommendations)| -|Review the list of frequently asked questions (FAQs)|[Browse the FAQs](faqs-tamper-protection.md)| +## On what devices can tamper protection be enabled? -## What about exclusions? --If your organization has [exclusions defined for Microsoft Defender Antivirus](configure-exclusions-microsoft-defender-antivirus.md), tamper protection will protect those exclusions, provided all of the following conditions are met: --- `DisableLocalAdminMerge` is enabled. (See [DisableLocalAdminMerge](/windows/client-management/mdm/defender-csp).)-- Microsoft Defender Antivirus exclusions are managed in Microsoft Intune. (See [Settings for Microsoft Defender Antivirus policy in Microsoft Intune for Windows devices](/mem/intune/protect/antivirus-microsoft-defender-settings-windows).)-- Tamper protection is deployed and managed by using Intune, and devices are managed by Intune. (See [How to tell if a Windows device is managed by Intune](manage-tamper-protection-microsoft-endpoint-manager.md#how-to-tell-if-a-windows-device-is-managed-by-intune).)-- Devices are running Windows Defender platform `4.18.2211.5` or later. (See [Monthly platform and engine versions](manage-updates-baselines-microsoft-defender-antivirus.md#monthly-platform-and-engine-versions).)-- Functionality to protect exclusions is enabled on devices. (See [How to determine whether the functionality is enabled on a Windows device](#how-to-determine-whether-the-functionality-to-protect-exclusions-is-enabled-on-a-windows-device).)+Tamper protection is available for devices that are running one of the following versions of Windows: -> [!TIP] -> For more detailed information about exclusions, see [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md). +- Windows 10 and 11 (including Enterprise multi-session) +- Windows Server 2022, Windows Server 2019, and Windows Server, version 1803 or later +- Windows Server 2016 and Windows Server 2012 R2 (using the modern, unified solution) -### How to determine whether the functionality to protect exclusions is enabled on a Windows device +Tamper protection is also available for Mac. For more information, see [Protect macOS security settings with tamper protection](tamperprotection-macos.md). -You can use a registry key to determine whether the functionality to protect Microsoft Defender Antivirus exclusions is enabled. Note that the following procedure describes how to view, but not change, tamper protection status. +> [!IMPORTANT] +> Built-in protection includes turning tamper protection on by default. To learn more about built-in protection, see: +> - [Built-in protection helps guard against ransomware](built-in-protection.md) (article) +> - [Tamper protection will be turned on for all enterprise customers](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/tamper-protection-will-be-turned-on-for-all-enterprise-customers/ba-p/3616478) (Tech Community blog post) -1. On a Windows device open Registry Editor. (Read-only mode is fine; you won't be editing the registry key.) +## How do I configure or manage tamper protection? -2. To confirm that the device is managed by Intune only, go to `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender` (or `HKLM\SOFTWARE\Microsoft\Windows Defender`), and look for a `REG_DWORD` entry called **ManagedDefenderProductType**. +You can use Microsoft Intune and other methods to configure or manage tamper protection, as listed in the following table: - - If **ManagedDefenderProductType** has a value of `6`, then the device is managed by Intune only (*this value is required for exclusions to be tamper protected*). - - If **ManagedDefenderProductType** has a value of `7`, then the device is co-managed, such as by Intune and Configuration Manager. +| Method | Description | +|:|:| +| The [Microsoft 365 Defender portal](https://security.microsoft.com) | Turn tamper protection on (or off), tenant wide. Note that this method won't override settings managed in Microsoft Intune. <br/><br/>For more information, see [Manage tamper protection for your organization using Microsoft 365 Defender](manage-tamper-protection-microsoft-365-defender.md). | +| The [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) | Turn tamper protection on (or off), tenant wide, or all or some devices. Using this method, you can also [tamper protect exclusions](manage-tamper-protection-intune.md#tamper-protection-for-exclusions) for Microsoft Defender Antivirus. <br/><br/>For more information, see [Manage tamper protection for your organization using Intune](manage-tamper-protection-intune.md). | +| Configuration Manager | Turn tamper protection on or off by using Configuration Manager (with tenant attach). Note that this method won't override settings managed in Intune. <br/><br/>For more information, see [Manage tamper protection for your organization using tenant attach with Configuration Manager, version 2006](manage-tamper-protection-configuration-manager.md). | +| Windows Security app | Turn tamper protection on (or off) on an individual device that is not managed by a security team (such as devices for home use). Note that this method won't override settings managed by the Microsoft 365 Defender portal, Intune, or Configuration Manager, and it isn't intended to be used by organizations. <br/><br/>For more information, see [Manage tamper protection on an individual device](manage-tamper-protection-individual-device.md). | -3. To confirm that tamper protection is deployed and that exclusions are tamper protected, go to `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features` (or `HKLM\SOFTWARE\Microsoft\Windows Defender\Features`), and look for the `REG_DWORD` entries that are listed in the following table: +> [!IMPORTANT] +> When tamper protection is turned on, tamper-protected settings cannot be changed from their default values. It might appear that changes made were successful, but changes are not actually allowed by tamper protection. - | REG_DWORD | Value | What it means | - |:|:|:| - | **TamperProtection** | 5 | Tamper protection is deployed to the device. | - | **TamperProtectionSource** | 64 | Tamper protection is managed by Intune. | - | **TPExclusions** | 1 | Required conditions are met, and the new functionality to protect exclusions is enabled on the device. In this case, exclusions are tamper protected. | - | **TPExclusions** | 0 | Tamper protection isn't currently protecting exclusions on the device. | +## What about exclusions? -> [!CAUTION] -> Do not change the value of the registry keys. Use the preceding procedure for information only. Changing keys will have no effect on whether tamper protection applies to exclusions. +Under certain conditions, tamper protection will protect exclusions that are defined for Microsoft Defender Antivirus. For more information, see [Tamper protection for exclusions](manage-tamper-protection-intune.md#tamper-protection-for-exclusions). ## Are you using Windows Server 2012 R2, 2016, or Windows version 1709, 1803, or 1809? Using [endpoint detection and response](overview-endpoint-detection-response.md) ## Review your security recommendations -Tamper protection integrates with [Microsoft Defender Vulnerability Management](next-gen-threat-and-vuln-mgt.md) capabilities. [Security recommendations](tvm-security-recommendation.md) include making sure tamper protection is turned on. For example, you can search on *tamper*. In the results, you can select **Turn on Tamper Protection** to learn more and turn it on. +Tamper protection integrates with [Microsoft Defender Vulnerability Management](next-gen-threat-and-vuln-mgt.md) capabilities. [Security recommendations](tvm-security-recommendation.md) include making sure tamper protection is turned on. For example, in your [Vulnerability Management dashboard](/microsoft-365/security/defender-vulnerability-management/tvm-dashboard-insights#vulnerability-management-dashboard), you can search on *tamper*. In the results, you can select **Turn on Tamper Protection** to learn more and turn it on. To learn more about Microsoft Defender Vulnerability Management, see [Dashboard insights - Defender Vulnerability Management](tvm-dashboard-insights.md#dashboard-insightsthreat-and-vulnerability-management). -> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) - ## See also +- [Protect macOS security settings with tamper protection](tamperprotection-macos.md) - [Built-in protection helps guard against ransomware](built-in-protection.md)+- [Frequently asked questions on tamper protection](faqs-tamper-protection.md) - [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](/intune/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune)-- [Get an overview of Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint)-- [Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](why-use-microsoft-defender-antivirus.md)-- [Enable troubleshooting mode](enable-troubleshooting-mode.md)-- [Troubleshooting mode scenarios](troubleshooting-mode-scenarios.md) |
| security | Supported Capabilities By Platform | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/supported-capabilities-by-platform.md | The following table gives information about the supported Microsoft Defender for |**Response** | | | || |[Automated Investigation & Response (AIR)](automated-investigations.md) |  |  |  |  | |[Device response capabilities: collect investigation package, run AV scan](respond-machine-alerts.md) |  |  |  <sup>[[2](#fn2)][[3](#fn3)]</sup> |  <sup>[[2](#fn2)][[3](#fn3)]</sup> |-|[Device isolation](respond-machine-alerts.md) |  |  |  <sup>[[2](#fn2)][[3](#fn3)]</sup> |  | +|[Device isolation](respond-machine-alerts.md) |  |  |  <sup>[[2](#fn2)][[3](#fn3)]</sup> |  | |File response capabilities: collect file, deep analysis, block file, stop, and quarantine processes |  |  |  <sup>[[4](#fn4)]</sup> |  <sup>[[4](#fn4)]</sup> | |[Live Response](live-response.md) |  |  |  <sup>[[2](#fn2)]</sup> |  <sup>[[2](#fn2)]</sup> | |
| security | Troubleshoot Asr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-asr.md | ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium audience: ITPro--++ Last updated 03/27/2019 |
| security | Web Content Filtering | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/web-content-filtering.md | To add a new policy, follow these steps: > [!IMPORTANT] > If you're using either Microsoft 365 Business Premium or Defender for Business, your web content filtering policy is applied to all users by default. Scoping does not apply. -5. Review the summary and save the policy. The policy refresh might take up to 2 hours to apply to your selected devices. +5. Review the summary and save the policy. > [!NOTE]+> - There may be up to 2 hours of latency between the time a policy is created and the policy being enforced on the device. > - You can deploy a policy without selecting any category on a device group. This action will create an audit only policy to help you understand user behavior before creating a block policy. > - If you are removing a policy or changing device groups at the same time, this might cause a delay in policy deployment. > - Blocking the "Uncategorized" category could lead to unexpected and undesired results. |
| security | Before You Begin Defender Experts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/before-you-begin-defender-experts.md | Last updated 07/26/2022 - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -This document outlines the key infrastructure requirements you must meet and important information on data access and compliance you must know before enrolling in the Microsoft Defender Experts for Hunting service. Microsoft understands that customers who use our managed services entrust us with their most valued asset, their data. +This document outlines the key infrastructure requirements you must meet and important information on data access and compliance you must know before purchasing the Microsoft Defender Experts for Hunting service. Microsoft understands that customers who use our managed services entrust us with their most valued asset, their data. ## Check if your environment meets licensing and access prerequisites |
| security | Defender Experts For Hunting | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/defender-experts-for-hunting.md | Last updated 05/05/2022 - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -Defender Experts for Hunting was created for customers who have a robust security operations center but want Microsoft to help them proactively hunt threats using Microsoft Defender data. Defender Experts for Hunting is a proactive threat hunting service that goes beyond the endpoint to hunt across endpoints, Office 365, cloud applications, and identity. Our experts will investigate anything they find, then hand off the contextual alert information along with remediation instructions, so you can quickly respond. +> [!IMPORTANT] +> Microsoft Defender Experts for Hunting is sold separately from other Microsoft 365 Defender products. If you're a Microsoft 365 Defender customer and are interested in purchasing Defender Experts for Hunting, complete a [customer interest form](https://aka.ms/DEX4HuntingCustomerInterestForm). ++Microsoft Defender Experts for Hunting was created for customers who have a robust security operations center but want Microsoft to help them proactively hunt threats using Microsoft Defender data. Defender Experts for Hunting is a proactive threat hunting service that goes beyond the endpoint to hunt across endpoints, Office 365, cloud applications, and identity. Our experts will investigate anything they find, then hand off the contextual alert information along with remediation instructions, so you can quickly respond. The following capabilities included in this managed threat hunting service could also help with your daily SecOps work: The following capabilities included in this managed threat hunting service could [Watch this short video](https://youtu.be/4t1JgE0X0jc) to learn more about how Microsoft Defender Experts for Hunting can help you track the latest advanced threats in your environment. -Defender Experts for Hunting is sold separately from other Microsoft 365 Defender products. If you're a Microsoft 365 Defender customer and are interested in purchasing Defender Experts for Hunting, complete a [customer interest form](https://aka.ms/DEX4HuntingCustomerInterestForm). - ### Next step - [Before you begin using Defender Experts for Hunting](before-you-begin-defender-experts.md) |
| security | Defender Experts Report | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/defender-experts-report.md | All other identified activities are summarized in a table in the **Threat catego You can filter the activities displayed in the table by choosing any of the following options in the dropdown menu: - **Suspicious activities** (default) ΓÇô Displays identified true positive and benign true positive activities in your environment. Note that not all suspicious activities will have corresponding Defender Expert Notifications.- - **DEX notified** ΓÇô Displays activities with corresponding Defender Expert Notifications only.- - **All activities** ΓÇô Displays all true positive, benign true positive, and false positive activities. + + If an activity has a related Defender Expert Notification, its corresponding icon also appears under the activity name. Selecting an identified suspicious activity opens a flyout panel detailing the impacted devices and users: |
| security | Eval Defender Endpoint Architecture | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-endpoint-architecture.md | ms.sitesec: library ms.pagetype: security f1.keywords: - NOCSH--++ Last updated 07/09/2021 ms.localizationpriority: medium |
| security | Eval Defender Endpoint Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-endpoint-overview.md | ms.sitesec: library ms.pagetype: security f1.keywords: - NOCSH--++ Last updated 07/09/2021 ms.localizationpriority: medium |
| security | Eval Defender Endpoint Pilot | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/eval-defender-endpoint-pilot.md | ms.sitesec: library ms.pagetype: security f1.keywords: - NOCSH--++ Last updated 07/09/2021 ms.localizationpriority: medium |
| security | Onboarding Defender Experts For Hunting | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/onboarding-defender-experts-for-hunting.md | You can filter your incidents and alerts if you want to only see the Defender Ex ### Set up Defender Experts email notifications -You can set up Microsoft 365 Defender to notify you or your staff with an email about new incidents or updates to existing incidents, including those observed by Microsoft Defender Experts. [Learn more](/microsoft-365/security/defender/incidents-overview#get-incident-notifications-by-email) about getting incident notifications by email. +You can set up Microsoft 365 Defender to notify you or your staff with an email about new incidents or updates to existing incidents, including those observed by Microsoft Defender Experts. [Learn more about getting incident notifications by email](/microsoft-365/security/defender/incidents-overview#get-incident-notifications-by-email) 1. In the Microsoft 365 Defender navigation pane, select **Settings** > **Microsoft 365 Defender** > **Email notifications** > **Incidents**.--2. Update your existing email notification rules or create a new one. [Learn more about creating a rule for email notifications](/microsoft-365/security/defender/incidents-overview#create-a-rule-for-email-notifications). -+2. Update your existing email notification rules or create a new one. [Learn more about creating a rule for email notifications](/microsoft-365/security/defender/incidents-overview#create-a-rule-for-email-notifications) 3. On the ruleΓÇÖs **Notification settings** page, make sure to configure the following:- - **Source** ΓÇô Choose **Microsoft Defender Experts** under **Microsoft 365 Defender** and **Microsoft Defender for Endpoint**- - **Alert severity** ΓÇô Choose the alert severities that will trigger an incident notification. For example, if you only want to be informed about high-severity incidents, select High. -### Collaborate with Experts on Demand +## Collaborate with Experts on Demand > [!NOTE] > Experts on Demand is included in your Defender Experts for Hunting subscription with [monthly allocations](/microsoft-365/security/defender/before-you-begin-defender-experts#eligibility-and-licensing). However, it's not a security incident response service. It's intended to provide a better understanding of complex threats affecting your organization. Engage with your own security incident response team to address urgent security incident response issues. If you don't have your own security incident response team and would like Microsoft's help, create a support request in the [Premier Services Hub](/services-hub/). The option to **Ask Defender Experts** is available in several places throughout > [!NOTE] > If you'd like to track the status of your Experts on Demand cases through Microsoft Services Hub, reach out to your Customer Success Account Manager. Watch this [video](https://www.microsoft.com/videoplayer/embed/RE4pk9f) for a quick overview of the Microsoft Services Hub. -## Sample questions you can ask from Defender Experts +### Sample questions you can ask from Defender Experts -### Alert information +**Alert information** - We saw a new type of alert for a living-off-the-land binary. We can provide the alert ID. Can you tell us more about this alert and if it's related to any incident and how we can investigate it further? - We've observed two similar attacks, which both try to execute malicious PowerShell scripts but generate different alerts. One is "Suspicious PowerShell command line" and the other is "A malicious file was detected based on indication provided by Office 365." What is the difference? The option to **Ask Defender Experts** is available in several places throughout - Can you give more context or insight about the alert and any related incidents, "Suspicious behavior by a system utility was observed"? - I observed an alert titled "Creation of forwarding/redirect rule". I believe the activity is benign. Can you tell me why I received an alert? -### Possible device compromise +**Possible device compromise** - Can you help explain why we see a message or alert for "Unknown process observed" on many devices in our organization? We appreciate any input to clarify whether this message or alert is related to malicious activity or incidents. - Can you help validate a possible compromise on the following system, dating from last week? It's behaving similarly as a previous malware detection on the same system six months ago. -### Threat intelligence details +**Threat intelligence details** - We detected a phishing email that delivered a malicious Word document to a user. The document caused a series of suspicious events, which triggered multiple alerts for a particular malware family. Do you have any information on this malware? If yes, can you send us a link? - We recently saw a blog post about a threat that is targeting our industry. Can you help us understand what protection Microsoft 365 Defender provides against this threat actor? - We recently observed a phishing campaign conducted against our organization. Can you tell us if this was targeted specifically to our company or vertical? -### Microsoft Defender Experts for Hunting alert communications +**Microsoft Defender Experts for Hunting alert communications** - Can your incident response team help us address the Defender Experts Notification that we got? - We received this Defender Experts Notification from Microsoft Defender Experts for Hunting. We don't have our own incident response team. What can we do now, and how can we contain the incident? |
| security | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/whats-new.md | You can also get product updates and important notifications through the [messag ## January 2023 -- The new Microsoft Defender Experts for Hunting report is now available. The report's new interface now lets customers have more contextual details about the suspicious activities Defender Experts have observed in their environments. It also shows which suspicious activities have been continuously trending from month to month. For details, see [Understand the Defender Experts for Hunting report in Microsoft 365 Defender](defender-experts-report.md).+- The new version of Microsoft Defender Experts for Hunting report is now available. The report's new interface now lets customers have more contextual details about the suspicious activities Defender Experts have observed in their environments. It also shows which suspicious activities have been continuously trending from month to month. For details, see [Understand the Defender Experts for Hunting report in Microsoft 365 Defender](defender-experts-report.md). - (GA) Live Response is now generally available for macOS and Linux. |
| security | Scc Permissions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/scc-permissions.md | The following roles aren't assigned to the Organization Management role group by |**Purview Evaluation Administrator**|Used to create and manage M365 Purview Evaluation lab|Information Protection <br/><br/> Information Protection Admins <br/><br/> Information Protection Analysts <br/><br/> Information Protection Investigators| |**Quarantine**|Allows viewing and releasing quarantined email.|Organization Management <br/><br/> Quarantine Administrator <br/><br/> Security Administrator| |**RecordManagement**|View and edit the configuration of the records management feature.|Compliance Administrator <br/><br/> Compliance Data Administrator <br/><br/> Organization Management <br/><br/> Records Management|-|**Retention Management**|Manage retention policies, retention labels, and retention label policies.|Compliance Administrator <br/><br/> Compliance Data Administrator <br/><br/> Organization Management <br/><br/> Records Management| +|**Retention Management**|Manage retention policies, retention labels, and retention label policies. Includes permissions to add and remove adaptive scopes from these policies, and to create, delete, and modify adaptive scopes.|Compliance Administrator <br/><br/> Compliance Data Administrator <br/><br/> Organization Management <br/><br/> Records Management| |**Review**|This role lets users access review sets in eDiscovery (Premium) cases. Users who are assigned this role can see and open the list of cases on the **eDiscovery \> Advanced** page in the Microsoft Purview compliance portal that they're members of. After the user accesses an eDiscovery (Premium) case, they can select **Review sets** to access case data. This role doesn't allow the user to preview the results of a collection search that's associated with the case or do other search or case management tasks. Users with this role can only access the data in a review set.|Data Investigator <br/><br/> eDiscovery Manager <br/><br/> Insider Risk Management <br/><br/> Insider Risk Management Investigators <br/><br/> Reviewer| |**RMS Decrypt**|Decrypt RMS-protected content when exporting search results.|Data Investigator <br/><br/> eDiscovery Manager| |**Role Management**|Manage role group membership and create or delete custom role groups.|Organization Management| |
| syntex | Syntex Pay As You Go Services | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-pay-as-you-go-services.md | description: Learn about pay-as-you-go services and pricing for Microsoft Syntex # Pay-as-you-go services and pricing for Microsoft Syntex -When you use Microsoft Syntex, services are billed using Syntex meters in the Azure subscription that you specified when you set up Microsoft Syntex. The table below describes each meter, its pricing, and how it measures usage. When you connect your Azure subscription to Microsoft Syntex, users in your organization will be able to take advantage of Syntex features right away. Your tenant will be billed according to the details shown in this article. +When you use Microsoft Syntex pay-as-you-go, services are billed using Syntex meters in the Azure subscription that you specified when you set up Microsoft Syntex. The table below describes each meter, its pricing, and how it measures usage. When you connect your Azure subscription to Microsoft Syntex, users in your organization will be able to take advantage of Syntex services right away. Your tenant will be billed according to the details shown in this article. -|Feature|What's counted?|What's billed?| +|Service|What's counted?|What's billed?| |:-|:--|:-| |Unstructured document processing|The number of pages processed for Word, PDF, or TIFF files; the number of sheets for Excel files; the number of slides for PowerPoint files; or the number of files for other file types. You won't be charged for model training. You will be charged for processing whether or not there's a positive classification, or any entities extracted.<br><br>Processing occurs on document upload and on subsequent updates. Processing is counted for each model applied. For example, if you have two models applied to a library and you upload or update a five-page document in that library, the total pages processed is 10.|$0.10/page| |Prebuilt document processing|The number of pages processed for PDF or image files. You won't be charged for model training. You will be charged for processing whether or not there's a positive classification, or any entities extracted.<br><br>Processing occurs on document upload and on subsequent updates. Processing is counted for each model applied. For example, if you have two models applied to a library and you upload or update a five-page document in that library, the total pages processed is 10.|$0.01/page| When you use Microsoft Syntex, services are billed using Syntex meters in the Az ## Related topics [Microsoft Syntex - SharePoint Advanced Management overview](/sharepoint/advanced-management)++[Licensing for Microsoft Syntex](syntex-licensing.md) |
| syntex | Video Library | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/video-library.md | + + Title: Microsoft Syntex video library ++++ Last updated : 03/06/2023+audience: admin ++++search.appverid: ++ - enabler-strategic + - m365initiative-syntex +ms.localizationpriority: medium +description: Watch videos to learn about some of the different features in Microsoft Syntex. +++# Microsoft Syntex video library ++|Overview of model types |Create a content center | +||| +|[:::image type="content" source="../medi) | ++|Unstructured document processing |Apply a model to a document library | +||| +|[:::image type="content" source="../medi) | ++|Create and train a classifier |Import a training set | +||| +|[:::image type="content" source="../medi#add-your-example-files) | ++|Create and train an extractor |Apply a retention label | +||| +|[:::image type="content" source="../medi) | ++|Model usage analytics |Manage contracts solution | +||| +|[:::image type="content" source="../medi) | ++|Leverage term store taxonomy |Push content types to a hub | +||| +|[:::image type="content" source="../medi) | + |
| test-base | Contentguideline | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/test-base/contentguideline.md | Validation is necessary to properly diagnose where errors occur during a test ru > [!IMPORTANT] > **Avoid the following:**-> Scripts should not reboot the machine, if a reboot is necessary please specify this during the upload of your scripts. +> Scripts should not reboot the machine, if a reboot is necessary please specify this during the upload of your scripts. +> [!IMPORTANT] +> The maximum disc space available is 127 Gb. Packages that consume more than this amount of space will not be executed. +> [!IMPORTANT] +> Packages that interact with the Windows UI must have the Autologon Credentials enabled to execute properly. ## 3. Log collection |
| test-base | Faq | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/test-base/faq.md | The Out-of-box (OOB) tests provide you with standardized telemetry on your appli **A:** Yes, customers can also upload application packages for **functional tests** via the self-serve portal dashboard. **Functional tests** are tests that enable customers to execute their scripts to run custom functionality on their application. +**Q: How long does KB installation take?** ++**A:** The KB installation time can vary, the KB installation happens in between the install and launch scripts for OOB tests. + ## Testing **Q: Do you support functional tests?** |
| whiteboard | Manage Data Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-data-organizations.md | Data controls planned for future releases: - Analytics - More eDiscovery support +### Transferring whiteboard when a user leaves the company ++To preserve a former user's OneDrive files, including .whiteboard files, first give yourself access to their OneDrive, and then move the files you want to keep. ++- In the admin center, go to the **Users** > [Active users](https://go.microsoft.com/fwlink/p/?linkid=834822) page. +- Select a user. +- On the user properties page, select **OneDrive**. Under Get access to files, select **Create link to files**. +- Select the link to open the file location. +- Select the files or folders that you want to move, and then select **Move to**. ++Learn more about preserving former user’s content: [Step 5 - Give another employee access to OneDrive and Outlook data - Microsoft 365 admin | Microsoft Learn](/admin/add-users/remove-former-employee-step-5) ++### Managing moved whiteboards ++Once the .whiteboard file appears in the OneDrive for Business of the new owner, they can open, edit, rename or delete the files. ++- Open office.com and in the app launcher, select OneDrive. +- In the left-hand navigation pane, select My Files. +- Open the folder called Whiteboards. +- In the list of files, select the moved file and click the ... button to get rename, delete and other options. + ## See also [Manage access to Whiteboard](manage-whiteboard-access-organizations.md) |