| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Compare Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/compare-groups.md | Group members can send as or send on behalf of the group email address if this h Microsoft 365 Groups don't support nesting with other Microsoft 365 Groups or with distribution or security groups. +Microsoft 365 Groups can be added to one of the three SharePoint groups (Owners, Members, or Visitors) to give people permissions to the site. + ## Distribution groups [Distribution groups](/exchange/recipients-in-exchange-online/manage-distribution-groups/manage-distribution-groups) are used for sending notifications to a group of people. They can receive external email if enabled by the administrator. |
| admin | Room And Equipment Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/room-and-equipment-mailboxes.md | To use room or equipment mailboxes, open Outlook from your computer or sign in t 7. Type a message describing the purpose and attach any files if needed. -8. To allow others to join online or call in to the meeting, select **Skype Meeting**. +8. To allow others to join online or call in to the meeting, select **Teams Meeting**. 9. To make sure the room, equipment, and people you've invited are available, select **Scheduling Assistant** at the top. Then select an available time in the calendar. To set up a room or equipment mailbox, go to the <a href="https://go.microsoft.c - **Location**: the room number or location of the room in a building or region. - - **Phone number**: the number of the room itself. This is different from the meeting phone number generated when using Skype for Business. + - **Phone number**: the number of the room itself. This is different from the meeting phone number generated when using Microsoft Teams. 4. Select **Add**. |
| commerce | Cancel Your Subscription | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/cancel-your-subscription.md | If you want to cancel your subscription, the easiest way to do that is to [turn ### If you have a billing profile -You can only cancel and receive a prorated credit or refund if you cancel within 72 hours after the start or renewal of your subscription. If you cancel during this limited time window, the prorated amount is either credited towards your next invoice or returned to you in the next billing cycle. +You can only cancel and receive a prorated credit or refund if you cancel within seven days after the start or renewal of your subscription. If you cancel during this limited time window, the prorated amount is either credited towards your next invoice or returned to you in the next billing cycle. -If you need to cancel within 72 hours after the start or renewal of your subscription, go to [Steps to cancel your subscription](#steps-to-cancel-your-subscription) later in this article. +If you need to cancel within seven days after the start or renewal of your subscription, go to [Steps to cancel your subscription](#steps-to-cancel-your-subscription) later in this article. -If more than 72 hours have passed, [turn off recurring billing](renew-your-subscription.md). This prevents you from being charged again for your subscription, and lets you keep your access to your products and services for the remainder of your subscription. +If more than seven days have passed, [turn off recurring billing](renew-your-subscription.md). This prevents you from being charged again for your subscription, and lets you keep your access to your products and services for the remainder of your subscription. ### If you don't have a billing profile |
| compliance | Communication Compliance Case Study | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-case-study.md | Contoso IT administrators and compliance specialists attended online webinars ab The first step is to confirm that Contoso's Microsoft 365 licensing includes support for the communication compliance solution. To access and use communication compliance, Contoso IT administrators need to verify that Contoso has one of the following: -- Microsoft 365 E5 subscription (paid or trial version)-- Microsoft 365 E3 subscription + the Microsoft 365 E5 Compliance add-on-- Microsoft 365 E3 subscription + the Microsoft 365 E5 Insider Risk Management add-on-- Microsoft 365 A5 subscription (paid or trial version)-- Microsoft 365 A3 subscription + the Microsoft 365 A5 Compliance add-on-- Microsoft 365 A3 subscription + the Microsoft 365 A5 Insider Risk Management add-on-- Microsoft 365 G5 subscription (paid or trial version)-- Microsoft 365 G5 subscription + the Microsoft 365 G5 Compliance add-on-- Microsoft 365 G5 subscription + the Microsoft 365 G5 Insider Risk Management add-on+- Microsoft 365 E5/A5/F5/G5 subscription (paid or trial version) +- Microsoft 365 E3/A3/F3/G5 subscription + the Microsoft 365 E5/A5/F5/G5 Compliance add-on +- Microsoft 365 E3/A3/F3/G5 subscription + the Microsoft 365 E5/A5/F5/G5 Insider Risk Management add-on - Office 365 Enterprise E5 subscription (paid or trial version)+- Office 365 A5 subscription (paid or trial version) - Office 365 Enterprise E3 subscription + the Office 365 Advanced Compliance add-on (no longer available for new subscriptions, see note) -They must also confirm that users included in communication compliance policies must be assigned one of the licenses above. +Users included in communication compliance policies must be assigned one of the licenses above. For more information about subscriptions and licensing, see [Microsoft 365 guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#communication-compliance). > [!IMPORTANT] > Office 365 Advanced Compliance is no longer sold as a standalone subscription. When current subscriptions expire, customers should transition to one of the subscriptions above, which contain the same or additional compliance features. |
| compliance | Communication Compliance Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-configure.md | Use communication compliance policies to identify user communications for examin Before you get started with communication compliance, you should confirm your [Microsoft 365 subscription](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans) and any add-ons. To access and use communication compliance, your organization must have one of the following subscriptions or add-ons: -- Microsoft 365 E5/A5/G5 subscription (paid or trial version)-- Microsoft 365 E3/A3/G5 subscription + the Microsoft 365 E5/A5/G5 Compliance add-on-- Microsoft 365 E3/A3/G5 subscription + the Microsoft 365 E5/A5/G5 Insider Risk Management add-on+- Microsoft 365 E5/A5/F5/G5 subscription (paid or trial version) +- Microsoft 365 E3/A3/F3/G5 subscription + the Microsoft 365 E5/A5/F5/G5 Compliance add-on +- Microsoft 365 E3/A3/F3/G5 subscription + the Microsoft 365 E5/A5/F5/G5 Insider Risk Management add-on - Office 365 Enterprise E5 subscription (paid or trial version) - Office 365 A5 subscription (paid or trial version) - Office 365 Enterprise E3 subscription + the Office 365 Advanced Compliance add-on (no longer available for new subscriptions, see note) -Users included in communication compliance policies must be assigned one of the licenses above. +Users included in communication compliance policies must be assigned one of the licenses above. For more information about subscriptions and licensing, see [Microsoft 365 guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#communication-compliance). > [!IMPORTANT] > Communication compliance is currently available in tenants hosted in geographical regions and countries supported by Azure service dependencies. To verify that communication compliance is supported for your organization, see [Azure dependency availability by country/region](/troubleshoot/azure/general/dependency-availability-by-country). |
| compliance | Communication Compliance Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-policies.md | To copy a policy and create a new policy, complete the following steps: 3. In the **Copy policy** pane, you can accept the default name for the policy in the **Policy name** field or rename the policy. The policy name for the new policy canΓÇÖt be the same as an existing active or deactivated policy. Complete the **Description** field as needed. 4. If you don't need further customization of the policy, select **Copy policy** to complete the process. If you need to update the configuration of the new policy, select **Customize policy**. This starts the policy wizard to help you update and customize the new policy. +## User-reported messages policy ++As part of a layered defense to detect and remediate inappropriate messages in your organization, you can supplement communication compliance policies with user-reported messages in Microsoft Teams. This feature empowers users in your organization to self-report inappropriate messages, such as harassing or threatening language, sharing of adult content, and sharing of sensitive or confidential information, to help foster a safe and compliant work environment. ++Enabled by default in the [Teams admin center](/microsoftteams/manage-teams-in-modern-portal), the *Report a concern* option in Teams messages allows users in your organization to submit inappropriate messages for review by communication compliance reviewers for the policy. These messages are supported by a default system policy that supports reporting messages in Teams channels, group, and private chats. ++ ++When a user submits a Teams chat message for review, the message is copied to the User-reported message policy. Reported messages initially remain visible to all chat members and there isn't any notification to chat members or the submitter that a message has been reported in channel, private, or group chats. A user can't report the same message more than once and the message remains visible to all users included in the chat session during the policy review process. ++During the review process, communication compliance reviewers can perform all the standard [remediation actions](/microsoft-365/compliance/communication-compliance-investigate-remediate#step-3-decide-on-a-remediation-action) on the message, including removing the message from the Teams chat. Depending on how the messages are remediated, the message sender and recipients will see different [notification messages](/microsoftteams/communication-compliance#act-on-inappropriate-messages-in-microsoft-teams) in Teams chats after the review. ++ ++User reported messages from Teams chats are the only messages processed by the User-reported message policy and only the assigned reviewers for the policy can be modified. All other policy properties are not editable. When the policy is created, the initial reviewers assigned to the policy are all members of the *Communication Compliance Admins* role group (if populated with at least one user) or all members of your organization's *Global Admin* role group . The policy creator is a randomly selected user from the *Communication Compliance Admins* role group (if populated with at least one user) or a randomly selected user from your organization's *Global Admin* role group. ++Admins should immediately assign custom reviewers to this policy as appropriate for your organization. This may include reviewers such as your Compliance Officer, Risk Officer, or members of your Human Resources department. To customize the reviewers for chat messages submitted as user-reported messages, complete the following steps: ++1. Sign into [Microsoft 365 compliance center](https://compliance.microsoft.com/) using credentials for an admin account in your Microsoft 365 organization. +2. In the Microsoft 365 compliance center, go to **Communication compliance**. +3. On the **Policy** tab, select the *User-reported messages* policy and select **Edit**. +4. On the **Monitor for user-reported messages** pane, assign reviewers for the policy. Reviewers must have mailboxes hosted on Exchange Online. When reviewers are added to a policy, they automatically receive an email message that notifies them of the assignment to the policy and provides links to information about the review process. +5. Select **Save**. ++To disable users from reporting Teams messages with the *Report a concern option*, disable the **End user reporting** option in the [Teams Admin Center](/microsoftteams/manage-teams-in-modern-portal). + ## Storage limit notification (preview) Each communication compliance policy has a storage limit size of 100 GB or 1 million messages, whichever is reached first. As the policy approaches these limits, notification emails are automatically sent to users assigned to the *Communication Compliance* or *Communication Compliance Admin* role groups. Notifications messages are sent when the storage size or message count reach 80, 90, and 95 percent of the limit. When the policy limit is reached, the policy is automatically deactivated, and the policy stops processing messages for alerts. |
| compliance | Communication Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance.md | New interactive dashboards for alerts, policy matches, actions, and trends help Communication compliance policies scan and capture messages across several communication channels to help you quickly review and remediate compliance issues: -- **Microsoft Teams**: Chat communications for public and private [Microsoft Teams](/MicrosoftTeams/Teams-overview) channels and individual chats are supported in communication compliance as a standalone channel source or with other Microsoft 365 services. You'll need to manually add individual users, distribution groups, or specific Microsoft Teams channels when you select users and groups to supervise in a communication compliance policy.+- **Microsoft Teams**: Chat communications for public and private [Microsoft Teams](/MicrosoftTeams/Teams-overview) channels and individual chats are supported in communication compliance as a standalone channel source or with other Microsoft 365 services. You'll need to manually add individual users, distribution groups, or specific Microsoft Teams channels when you select users and groups to supervise in a communication compliance policy. Teams users can also self-report inappropriate messages in private and group channels and chats for review and remediation. - **Exchange Online**: All mailboxes hosted on [Exchange Online](/Exchange/exchange-online) in your Microsoft 365 organization are eligible for scanning. Emails and attachments matching communication compliance policy conditions are instantly available for monitoring and in compliance reports. Exchange Online is now an optional source channel and is no longer required in communication compliance policies. - **Yammer**: Private messages and public community conversations in [Yammer](/yammer/yammer-landing-page) are supported in communication compliance policies. Yammer is an optional channel and must be in [native mode](/yammer/configure-your-yammer-network/overview-native-mode) to support scanning of messages and attachments. - **Skype for Business Online**: Communication compliance policies support scanning chat communications and associated attachments in [Skype for Business Online](/SkypeForBusiness/skype-for-business-online). You can choose from the following policy templates in the Microsoft 365 complian - **Monitor for financial regulatory compliance**: Use this template to quickly create a policy to scan communications for references to standard financial terms associated with regulatory standards. - **Monitor for conflict of interest**: Use this template to quickly create a policy to monitor communications between two groups or two users to help avoid conflicts of interest. - **Custom policy**: Use this template to configure specific communication channels, individual detection conditions, and the amount of content to monitor and review in your organization.+- **User-reported messages policy**: This system policy supports user reported messages from channel, group, and private chat messages. Enabled by default in the Teams admin center. >[!TIP] >Use [recommended actions](communication-compliance-configure.md#recommended-actions-preview) to help you determine if you need a sensitive information type policy or if you need to update existing inappropriate content policies. |
| compliance | Create Retention Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-retention-policies.md | It's possible that a retention policy that's applied to Microsoft 365 groups, Sh ### Retention policy for Yammer locations > [!NOTE]-> Retention policies for Yammer are in preview and currently do not inform users when messages are deleted as a result of a retention policy. +> Retention policies for Yammer currently do not inform users when messages are deleted as a result of a retention policy. > > To use this feature, your Yammer network must be [Native Mode](/yammer/configure-your-yammer-network/overview-native-mode), not Hybrid Mode. It's possible that a retention policy that's applied to Microsoft 365 groups, Sh - If you chose **Static**: On the **Choose locations to apply the policy** page, toggle on one or both of the locations for Yammer: **Yammer community message** and **Yammer user messages**. - > [!IMPORTANT] - > Although you can create a retention policy for just Yammer user messages, a retention policy for this location can delete community messages from the Yammer app for all community members. - > - > If you choose this option and the retention policy will be configured to delete user messages, make sure you understand this implication. For more information, see [How retention works with Yammer](retention-policies-yammer.md#how-retention-works-with-yammer). - By default, all communities and users are selected, but you can refine this by specifying communities and users to be included or excluded. For Yammer user messages: |
| compliance | Disposition | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/disposition.md | As you can see from the example shown, the actions supported are: - **Approve disposal**: - When this action is selected for an interim stage of disposition review (you have configured multiple stages): The item moves to the next disposition stage.- - When this action is selected for the final stage of disposition review, or there is only one stage of disposition: The item is marked as eligible for permanent deletion, which then happens within 7 days. + - When this action is selected for the final stage of disposition review, or there is only one stage of disposition: The item is marked as eligible for permanent deletion, which a timer job then actions within 7 days. The exact timing for the item to then be permanently deleted depends on the workload. For more information, see [How retention works for SharePoint and OneDrive](retention-policies-sharepoint.md#how-retention-works-for-sharepoint-and-onedrive) and [How retention works for Exchange](retention-policies-exchange.md#how-retention-works-for-exchange). + - **Relabel**: - When this action is selected, the item exits the disposition review process for the original label. The item is then subject to the retention settings of the newly selected retention label.+ - **Extend**: - When this action is selected, disposition review is effectively suspended until the end of the extended period and then disposition review is triggered again from the first stage.+ - **Add reviewers**: - When this action is selected, the user is prompted to specify and add other users for review.- > [!NOTE] > This action doesn't automatically grant the [required permissions](#permissions-for-disposition) to the users who are added. If they don't have these permissions, they can't participate in the disposition review. |
| compliance | Insider Risk Solution Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-solution-overview.md | To help protect your organization against insider risks, use these Microsoft 365 Communication compliance helps minimize communication risks by helping you detect, capture, and act on inappropriate messages in your organization. Communication compliance is available in the following subscriptions: -- Microsoft 365 E5/A5/G5 subscription (paid or trial version)-- Microsoft 365 E3/A3/G5 subscription + the Microsoft 365 E5/A5/G5 Compliance add-on-- Microsoft 365 E3/A3/G5 subscription + the Microsoft 365 E5/A5/G5 Insider Risk Management add-on+- Microsoft 365 E5/A5/F5/G5 subscription (paid or trial version) +- Microsoft 365 E3/A3/F3/G5 subscription + the Microsoft 365 E5/A5/F5/G5 Compliance add-on +- Microsoft 365 E3/A3/F3/G5 subscription + the Microsoft 365 E5/A5/F5/G5 Insider Risk Management add-on - Office 365 Enterprise E5 subscription (paid or trial version) - Office 365 A5 subscription (paid or trial version)-- Office 365 Enterprise E3 subscription + the Office 365 Advanced Compliance add-on (no longer available for new subscriptions)+- Office 365 Enterprise E3 subscription + the Office 365 Advanced Compliance add-on (no longer available for new subscriptions, see note) ### Insider risk management |
| compliance | Mip Dbcs Relnotes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/mip-dbcs-relnotes.md | description: "Release notes for support for double byte character sets." - Korean - Japanese -This support is available for sensitive information types and keyword dictionaries and will be reflected in data loss prevention (for Exchange Online, SharePoint Online, OneDrive for Business, and Teams), Communications Compliance, Auto Labelling in office apps and Microsoft Defender for Cloud Apps. +This support is available for sensitive information types and keyword dictionaries and will be reflected in data loss prevention (for Exchange Online, SharePoint Online, OneDrive for Business, and Teams), Communications Compliance, Auto Labeling in office apps and Microsoft Defender for Cloud Apps. ## Known issues -- When a text file attached to an email is in UTF-8 format without byte order mark (BOM), the email is not detected by the Communication Compliance policy.+- When a text file attached to an email is in UTF-8 format without byte order mark (BOM), the email isn't detected by the Communication Compliance policy. -- Communication Compliance policies cannot detect values if a sentence is entered for the policy condition: “Message contains any of these words”. If the text specified in the policy is written as a word, it can be detected; however, if it is written in the middle of a sentence, it will not be detected.+- Communication Compliance policies can't detect values if a sentence is entered for the policy condition: “Message contains any of these words”. If the text specified in the policy is written as a word, it can be detected; however, if it's written in the middle of a sentence, it will not be detected. -- Communication Compliance policies that specify dictionaries as type information do not detect Teams private chats and channel chats.+- Communication Compliance policies that specify dictionaries as type information don't detect Teams private chats and channel chats. -- The following conditions are not supported for Communication Compliance at this stage (we plan to fix these issues in the future): +- The following conditions aren't supported for Communication Compliance at this stage (we plan to fix these issues in the future): - “Message contains any of these words” - “Message contains none of these words” - “Attachment contains any of these words” - “Attachment contains any of these words” +- Data loss prevention policies are enforceable on macOS devices (preview) running Catalina 10.15 and higher, except for the below mentioned conditions for East + Asian languages including Japanese. + - Full-width numbers aren’t detected such as using built-in template such as Japan bank account number + - Numbers without delimiters aren’t detected + - Keywords separated by a half-width space aren’t detected for a sensitive information type. For example: Japanese word is set at sensitive information type and + dictionary isn't detected if it is in a sentence + - Words containing both English and Japanese (東京2020) aren’t detected + Instead we recommend creating a custom Sensitive Information Type (SIT) with keyword dictionary which will detect patterns across messages and attachments, and using this custom SIT as a Communication Compliance policy condition. |
| compliance | Retention Limits | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention-limits.md | SharePoint example: For the [disposition of content](disposition.md), there are some limits to be aware of: -- 1,000,000 items pending disposition per stage for each retention label+- Maximum numbers per tenant: + + - 16,000,000 items in either of the following disposition review states: pending disposition or approved disposition + + - 16,000,000 items marked as records automatically disposed (no disposition review) -- Proof of disposition for up to seven years after the item was disposed, with a limit of 1,000,000 items per retention label for that period. +- Maximum numbers for each retention label: + + - 1,000,000 items pending disposition per stage for each retention label -If you need proof of disposition higher than this limit of 1,000,000 for items that are marked as records, contact [Microsoft Support](../admin/get-help-support.md). + - Proof of disposition for up to seven years after the item was disposed, with a limit of 1,000,000 items per retention label for that period. + + If you need proof of disposition higher than this limit of 1,000,000 for items that are marked as records, contact [Microsoft Support](../admin/get-help-support.md). |
| compliance | Retention Policies Yammer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention-policies-yammer.md | description: "Learn about retention policies that apply to Yammer." >*[Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance).* -> [!NOTE] -> This feature is in preview and subject to change. - The information in this article supplements [Learn about retention](retention.md) because it has information that's specific to Yammer. For other workloads, see: Copies of community messages can also be stored in the hidden folder of user mai These hidden folders are not designed to be directly accessible to users or administrators, but instead, store data that compliance administrators can search with eDiscovery tools. -> [!IMPORTANT] -> Because copies of community messages can also be stored in user mailboxes, a retention policy with a delete action for Yammer user messages can result in the original community message no longer visible to users in the Yammer app. -> -> However, a copy of the original message is still available in the hidden folder of the community group mailbox, and accessible with eDiscovery searches for compliance purposes. - Even though they are stored in Exchange, Yammer messages are only included in a retention policy that's configured for the **Yammer community messages** or **Yammer user messages** locations. > [!NOTE] If the user stored any files in Yammer, see the [equivalent section](retention-p ## Limitations -Yammer retention policies are currently in preview and we're continuously working on optimizing retention functionality. In the meantime, be aware of the following limitation when you use retention for Yammer community messages and user messages: +Be aware of the following limitation when you use retention for Yammer community messages and user messages: - When you select **Edit** for the **Yammer user messages** location, you might see guests and non-mailbox users. Retention policies aren't designed for these users, so don't select them. |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | The numbers listed are the minimum Office application versions required for each |--|-:|-|-|--|-| |[Manually apply, change, or remove label](https://support.microsoft.com/en-us/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)| Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) to new documents | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |-|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) to existing documents | Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Rolling out: [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | +|[Apply a default label](sensitivity-labels.md#what-label-policies-can-do) to existing documents | Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Require a justification to change a label](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Provide help link to a custom help page](sensitivity-labels.md#what-label-policies-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Mark the content](sensitivity-labels.md#what-sensitivity-labels-can-do) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 2.21+ | 16.0.11231+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |
| contentunderstanding | Metadata Search | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/metadata-search.md | -description: Learn how to use advanced metadata search to find items in SharePoint document libraries using SharePoint Syntex. +description: Learn how to use advanced metadata search and search for custom site columns to find items in SharePoint document libraries using SharePoint Syntex. # Search for metadata in document libraries in Microsoft SharePoint Syntex The advanced metadata search feature in SharePoint Syntex lets you perform specific metadata-based queries on SharePoint document libraries. You can make faster, more precise queries based on specific metadata column values, rather than just searching for keywords. -Advanced metadata search lets you use the metadata associated with a document to help locate the file in a SharePoint document library. This is particularly useful when you have a specific piece of information you want to search for, such as when a document was last modified, a specific person associated with a file, or a specific file type. +Advanced metadata search lets you use the metadata associated with a document to help locate the file in a SharePoint document library. This feature is particularly useful when you have a specific piece of information you want to search for, such as when a document was last modified, a specific person associated with a file, or a specific file type. > [!NOTE] > This feature is available only for users who are licensed for SharePoint Syntex. ## To use advanced metadata search -1. From a SharePoint document library, in the **Search this library** box, click or tap the metadata search icon (). +1. From a SharePoint document library, in the **Search this library** box, select the metadata search icon ().  Advanced metadata search lets you use the metadata associated with a document to  - Six metadata search fields are currently available. More fields will be added in the future. + The following metadata search fields are currently available. More fields will be added in the future. |Field |Use this field to | ||| Advanced metadata search lets you use the metadata associated with a document to |People |Search for a match on people in any column in the library. | |Modified date |Search by selected date range in the **Modified** column in the library. | |File type |Search by selected file type (for example, Word document or PDF). |- |Content type |Search by selected content type. This option will only appear if there is a non-default content type applied to the library. Default content types are *document* and *folder*. | + |Content type |Search by selected content type. This option will only appear if there's a non-default content type applied to the library. Default content types are *document* and *folder*. | -3. Select **Search**. The documents that match your metadata search are shown on the results page. +3. You can also search for custom site columns that are in the current library view. This is especially useful if you have a model running on the library because the metadata extractors automatically populate information into site columns. ++ To add a custom site column to your search, select **Add more options**, and then select the name of the site column. ++  ++ > [!NOTE] + > Currently, the ability to add managed metadata fields or multiline text fields is not available. ++4. Select **Search**. The documents that match your metadata search are shown on the results page. |
| enterprise | O365 Data Locations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/o365-data-locations.md | The following global geographies can store data at rest. The locations where cus | Global Geographies | Locations where customer data may be stored | | | |-| Global Geography 1 – EMEA (Europe, Middle East and Africa) | Austria, Finland, France, Ireland, Netherlands | +| Global Geography 1 – EMEA (Europe, Middle East and Africa) | Austria, Finland, France, Ireland, Netherlands, Sweden | | Global Geography 2 – Asia Pacific | Hong Kong, Japan, Malaysia, Singapore, South Korea | | Global Geography 3 - Americas | Brazil, Chile, United States | For country/region specific data centers, the following defines the cities where | Australia | Sydney, Melbourne | | Brazil | Rio, Campinas | | Canada | Quebec City, Toronto |-| European Union | Austria (Vienna), Finland (Helsinki), France (Paris, Marseille), Ireland (Dublin), Netherlands (Amsterdam) | +| European Union | Austria (Vienna), Finland (Helsinki), France (Paris, Marseille), Ireland (Dublin), Netherlands (Amsterdam), Sweden (Gävle, Sandviken, Staffanstorp) | | France | Paris, Marseille | | Germany | Frankfurt, Berlin | | India | Chennai, Mumbai, Pune | |
| lighthouse | M365 Lighthouse Configure Portal Security | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-configure-portal-security.md | When users access Lighthouse for the first time, they'll be prompted to set up M Role-based access control (RBAC) grants access to resources or information based on user roles. Access to customer tenant data and settings in Lighthouse is restricted to specific roles from the Cloud Solution Provider (CSP) program. To set up RBAC roles in Lighthouse, we recommend using Granular Delegated Admin Privileges (GDAP) to implement granular assignments for users. Delegated Admin Privileges (DAP) is still required for the tenant to onboard successfully, but GDAP-only customers will soon be able to onboard without a dependency on DAP. GDAP permissions take precedence when DAP and GDAP coexist for a customer. -To get started with GDAP, see [Set up roles to manage customer tenants](m365-lighthouse-set-up-roles.md). +To get started with GDAP, see [Overview of permissions in Microsoft 365 Lighthouse](m365-lighthouse-overview-of-permissions.md). MSP technicians may also access Lighthouse by using Admin Agent or Helpdesk Agent roles via Delegated Admin Privileges (DAP). |
| lighthouse | M365 Lighthouse Known Issues | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-known-issues.md | This article lists the known issues for Microsoft 365 Lighthouse by feature area | **Deactivate and Reactivate actions are not listed in audit logs** | The following activities are currently not reported on the Audit logs page in Lighthouse: <ul><li>Name: offboardTenant \| Action: Inactivate a customer</li> <li>Name: resetTenantOnboardingStatus \| Action: Reactive customer</li></ul> | There's no workaround, but we're working on a fix. These activities will appear in audit logs once the fix is deployed in the service. | | **Filter is not showing all users** | When MSP technicians try to filter by using **Initiated By**, the list of all User Principal Names (UPNs) ΓÇô corresponding to email IDs of the technicians who initiated actions generating audit logs ΓÇô isn't fully displayed under the filter.<br><br>Note that the audit logs themselves will be fully displayed; only the ability to filter them by using **Initiated By** is impacted. | There's no workaround, but we're working on a fix. The filter will revert to its expected behavior ΓÇô displaying the full list of UPNs to filter by ΓÇô once the fix is deployed in the service. | -## Delegated Admin PermissionsΓÇ»(DAP) +## Delegated Admin PrivilegesΓÇ»(DAP) | Issue | Description | Solution | | - | - | - | | **Permissions delay when changing DAP roles** | If an MSP technician is added to or removed from the Admin Agent or Helpdesk Agent group, there may be a delay in reflecting the appropriate permissions within Lighthouse. | The issue will resolve within 30 minutes. No additional steps are required. | -## Granular Delegated Admin PermissionsΓÇ»(GDAP) +## Granular Delegated Admin PrivilegesΓÇ»(GDAP) > [!NOTE] > GDAP is currently in [technical preview](/partner-center/announcements/2022-february#6) (public preview) to allow partners to assign granular permissions before GDAP is generally available. +Currently, DAP is required to onboard customers to Lighthouse. We recommend also establishing GDAP with your customers to enable more secure delegated access. While DAP and GDAP coexist, GDAP will take precedence for customers where both models are in place. Soon, customers with just GDAP (and no DAP) will be able to onboard to Lighthouse.<br><br> + | Issue | Description | Solution | | - | - | - |-| **Various GDAP permission issues across Lighthouse** | <ul><li>GDAP Security Administrators are unable to view risky users, dismiss risks, or confirm compromised users.</li><li>GDAP Security Readers are unable to view risky users.</li><li>GDAP Global Administrators see an error message when trying to view service health.</li></ul> | Before GDAP General Availability, the workaround is to assign the user a Global Administrator GDAP role or Admin Agent DAP role. For instructions on how to assign the Global Administrator GDAP role, see [Obtain granular admin permissions to manage a customer's service](/partner-center/gdap-obtain-admin-permissions-to-manage-customer). For instructions on how to assign the Admin Agent DAP role, see [Assign roles and permissions to users](/partner-center/permissions-overview). For a list of actions in Lighthouse that require certain Azure Active Directory roles in the partner tenant, see [Configure Microsoft 365 Lighthouse portal security](/microsoft-365/lighthouse/m365-lighthouse-configure-portal-security). +| **Various GDAP permission issues across Lighthouse** | Certain GDAP roles by themselves don't grant the same level of access to customer data in Lighthouse as they would in a single-tenant experience. If any of the following roles are assigned individually (this is, not in combination with other GDAP roles) to MSP technicians, they may encounter errors, including:<ul><li>GDAP Security Administrators are unable to view risky users, dismiss risks, or confirm compromised users within Lighthouse.</li><li>GDAP Security Readers are unable to view risky users within Lighthouse.</li><li>GDAP Global Administrators see an error message when trying to view service health within Lighthouse.</li><li>GDAP Global Administrators experience issues deploying deployment plan steps within Lighthouse.</li></ul> | The workaround is to assign a combination of GDAP roles to MSP technicians based on the level of access to customer data that they need. For a list of recommended GDAP roles to use Lighthouse, see [Overview of permissions in Microsoft 365 Lighthouse](m365-lighthouse-overview-of-permissions.md).<br><br>For issues where even GDAP Global Administrator permissions won't allow usage of a feature in Lighthouse, the workaround is to access the appropriate admin center from the customer tenant to manage the customer (for example, access the Microsoft 365 admin center from the customer tenant to check service health). For instructions on how to modify a GDAP relationship, see [Obtain granular admin permissions to manage a customer's service - Partner Center](/partner-center/gdap-obtain-admin-permissions-to-manage-customer). | ## Localization |
| lighthouse | M365 Lighthouse Overview Of Permissions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-overview-of-permissions.md | + + Title: "Overview of permissions in Microsoft 365 Lighthouse" +f1.keywords: CSH ++++audience: Admin ++ms.localizationpriority: medium ++- M365-subscription-management +- Adm_O365 ++- AdminSurgePortfolib +- M365-Lighthouse +search.appverid: MET150 +description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn more about Lighthouse permission requirements." +++# Overview of permissions in Microsoft 365 Lighthouse ++Delegated access to customer tenants is required for Managed Service Providers (MSPs) to use Microsoft 365 Lighthouse. Granular Delegated Admin Privileges (GDAP) give MSPs a high level of control and flexibility by providing customer access through [Azure Active Directory (Azure AD) built-in roles](/azure/active-directory/roles/permissions-reference). Assigning the least privileged roles by task through GDAP to MSP technicians reduces security risk for both MSPs and customers. For more information on least privileged roles by task, see [Least-privileged roles - Partner Center](/partner-center/gdap-least-privileged-roles-by-task) and [Least privileged roles by task in Azure Active Directory](/azure/active-directory/roles/delegate-by-task). For more information on setting up a GDAP relationship with a customer tenant, see [Obtain granular admin permissions to manage a customer's service - Partner Center.](/partner-center/gdap-obtain-admin-permissions-to-manage-customer) ++We recommend assigning roles to groups of MSP technicians based on the tasks each group needs to perform on behalf of the customer. For example, Service Desk Technicians may just need to read customer tenant data or reset user passwords. In contrast, Escalation Engineers may need to take more corrective actions to update customer tenant security settings. It's a best practice to assign the least permissive role required to complete a task so that customer and partner data is kept secure. We recommend using Privileged Identity Management (PIM) to enable time-scoped access to the Global Administrator role, if needed. Giving too many users global access is a security risk, and we recommend limiting it as much as possible. For more information on how to enable PIM, see [Set up Azure AD PIM.](m365-lighthouse-configure-portal-security.md#set-up-azure-ad-privileged-identity-management-pim) ++The table in the next section describes which GDAP roles grant permission to read customer data and take action on customer tenants in Lighthouse. See [Permissions in the partner tenant](#permissions-in-the-partner-tenant) in this article for additional roles required to manage Lighthouse entities (for example, tags and Lighthouse service requests). ++> [!NOTE] +>GDAP is currently in [technical preview](/partner-center/announcements/2022-february#6) (public preview) to allow partners to assign granular permissions before GDAP is generally available. Check [Known Issues](m365-lighthouse-known-issues.md) if you're having a problem accessing or performing an action in Lighthouse. ++## Example MSP service tiers and recommended GDAP roles ++The following table lists the recommended GDAP roles for some example MSP service tiers and the actions those roles can perform on the different Lighthouse pages. ++|| Account Managers| Service Desk Technician |System Administrators | Escalation Engineers| +|||||| +| **Recommended GDAP roles** |<ul><li>Helpdesk Administrator</li></ul> |<ul><li>Security Reader<br>+</li><li>Helpdesk Administrator</li></ul> |<ul><li>Global Reader<br>+</li><li>User Administrator<br>+</li><li>Authentication Administrator</li></ul> |<ul><li>Global Reader<br>+</li><li>User Administrator<br>+</li><li>Intune Administrator<br>+</li><li>Security Administrator</li></ul>| +|**Lighthouse page + allowed actions** | +| **Home** | <ul><li>View all data</li></ul> | <ul><li>View all data</li></ul> | <ul><li>View all data</li></ul> | <ul><li>View all data</li></ul> | +| **Tenants** | <ul><li>View tenants list</li><li>Update customer contacts and website</li><li>View deployment plans</li></ul> | <ul><li>View tenants list</li><li>Update customer contacts and website</li><li>View deployment plans</li></ul> | <ul><li>View tenants list</li><li>Update customer contacts and website</li><li>View deployment plans</li><li>View Microsoft 365 services usage</li></ul> | <ul><li>View tenants list</li><li>Update customer contacts and website</li><li>View deployment plans</li><li>View Microsoft 365 services usage</li></ul> | +| **Users** | <ul><li>View tenant level (non-user specific) data</li><li>Search user accounts across tenants</li><li>Reset password for non-administrators*</li></ul> | <ul><li>View all user-specific data</li><li>Search user accounts across tenants</li><li>Reset password for non-administrators*</li></ul>| <ul><li>View all user-specific data</li><li>Search user accounts across tenants</li><li>Reset password for non-administrators*</i><li>Block sign-in</li></ul> | <ul><li>View all user-specific data</li><li>Search user accounts across tenants</li><li>Reset password for non-administrators*</li><li>Block sign-in</li><li>Confirm compromised users</li><li>Dismiss risk for users</li></ul> | +| **Devices** | <ul><li>View all data</li></ul> | <ul><li>View all data</li></ul> | <ul><li>View all data</li></ul> | <ul><li>View all data</li><li>Sync device</li><li>Restart device</li><li>Collect diagnostics</li></ul>| +| **Threat management** | <ul><li>View all data</li></ul> | <ul><li>View all data</li></ul> | <ul><li>View all data</li></ul> | <ul><li>View all data</li><li>Run full scan</li><li>Run quick scan</li><li>Update antivirus protection</li><li>Reboot device</li></ul>| +| **Baselines** | <ul><li>View all data</li></ul> | <ul><li>View all data</li></ul> | <ul><li>View all data</li></ul> | <ul><li>View all data</li></ul> | +| **Windows 365** | <ul><li>View all data</li></ul> | <ul><li>View all data</li></ul> | <ul><li>View all data</li></ul> | <ul><li>View all data</li></ul> | +| **Service health****| +|**Audit logs****| ++*See [Password reset permissions](/azure/active-directory/roles/permissions-reference#password-reset-permissions) for a table that lists which roles are required to reset passwords for customer tenant administrators. ++**Other roles and permissions are required to view service health and audit logs. For more information, see [Permissions in the partner tenant](#permissions-in-the-partner-tenant). ++> [!NOTE] +> If you get a message in Lighthouse saying that you don't have permission to view or edit information, you're assigned a role that doesn't have the appropriate permissions to perform the action. You'll need to reach out to an admin in your partner tenant who can assign you the appropriate role for the action you're trying to perform. ++## Delegated Admin Privileges (DAP) in Lighthouse ++GDAP will eventually replace DAP as the primary method to configure delegated access for customer tenants. However, if GDAP hasn't been set up, MSP technicians may still access Lighthouse by using the Helpdesk Agent or Admin Agent roles granted through DAP. For customers where GDAP and DAP coexist, roles granted to MSP technicians through GDAP take precedence. For more information on GDAP or DAP deprecation, see [GDAP frequently asked questions](/partner-center/gdap-faq) or the [Partner Center announcements](/partner-center/announcements/2022-march#15) for dates and timelines. ++For customers with DAP and no GDAP, the Admin Agent role grants permissions to view all tenant data and take any action in Lighthouse (see below for other actions that also require a role in the partner tenant). ++The Helpdesk Agent role grants permissions to view all tenant data and take limited action in Lighthouse, such as resetting user passwords, blocking user sign-ins, and updating customer contact information and websites. ++Given the broad permissions granted to partner users with DAP roles, we recommend adopting GDAP as soon as possible. ++## Permissions in the partner tenant ++For certain actions in Lighthouse, role assignments in the partner tenant are required. The following table lists partner tenant roles and their associated permissions. ++| Partner tenant roles | Permissions | +|--|--| +| Global Administrator of partner tenant | <ul><li>Sign up for Lighthouse in the Microsoft 365 admin center.</li><li>Accept partner contract amendments during the first-run experience.</li><li>Activate and inactivate a tenant.</li><li>Create, update, and delete tags.</li><li>Assign and remove tags from a customer tenant.</li></ul> | +| Partner tenant member with at least one Azure AD role assigned with the following property set:<br>**microsoft.office365.supportTickets/allEntities/allTasks**<br>(For a complete list of Azure AD roles, see [Azure AD built-in roles](/azure/active-directory/roles/permissions-reference).) | Create Lighthouse service requests. | +| Partner tenant member who meets *both* of the following requirements: <ul><li>Has at least one Azure AD role assigned with the following property set:<br>**microsoft.office365.serviceHealth/allEntities/allTasks**<br>(For a complete list of Azure AD roles, see [Azure AD built-in roles](/azure/active-directory/roles/permissions-reference).)</li><li>Has at least one DAP delegated role assigned (Admin Agent or Helpdesk Agent)</li></ul> | View service health information. | ++## Related content ++[Requirements for Microsoft 365 Lighthouse](m365-lighthouse-requirements.md) (article) +[Delegated administration privileges (DAP) FAQ](/partner-center/dap-faq) (article) +[Assign roles and permissions to users](/partner-center/permissions-overview) (article) +[Overview of Microsoft 365 Lighthouse](m365-lighthouse-overview.md) (article) +[Sign up for Microsoft 365 Lighthouse](m365-lighthouse-sign-up.md) (article) +[Microsoft 365 Lighthouse FAQ](m365-lighthouse-faq.yml) (article) |
| lighthouse | M365 Lighthouse Set Up Roles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-set-up-roles.md | - Title: "Set up roles to manage customer tenants"------- M365-subscription-management-- Adm_O365--- AdminSurgePortfolio-- M365-Lighthouse -description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn how to set up roles to manage customer tenants." ---# Set up roles to manage customer tenants --Managed Service Providers (MSPs) may enable granular and time-bound access to their customer tenants in Microsoft 365 Lighthouse by configuring Granular Delegated Admin Privileges (GDAP) in Partner Center. GDAP offers MSPs a high level of control and flexibility by providing customer access through [Azure Active Directory (Azure AD) built-in roles](/azure/active-directory/roles/permissions-reference). Assigning [the least privileged roles by task](/azure/active-directory/roles/delegate-by-task) through GDAP to MSP technicians reduces security risk for both MSPs and customers. Enable GDAP to assign more granular roles to your technicians who use Lighthouse and adopt a least-privileged approach to security across customer tenants. --If MSP technicians still access customer environments with the Helpdesk Agent or Admin Agent roles granted through Delegated Admin Privileges (DAP), see [DAP in Lighthouse](#dap-in-lighthouse) in this article. If both GDAP and DAP coexist, roles granted to users through GDAP take precedence for customers where a GDAP relationship has been established. --## Set up GDAP in Lighthouse --> [!NOTE] -> GDAP is currently in [technical preview](/partner-center/announcements/2022-february#6) (public preview) to allow partners to assign granular permissions before GDAP is generally available. --The high-level steps below are required to create a GDAP relationship with a customer. For more information on GDAP, see [Introduction to granular delegated admin privileges (GDAP).](/partner-center/gdap-introduction) --1. [Categorize users into security groups](/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal#create-a-basic-group-and-add-members) within the partner tenant's Azure AD. --2. [Create and send a GDAP relationship request](/partner-center/gdap-obtain-admin-permissions-to-manage-customer) to the customer. --3. Make sure the [customer approves the GDAP relationship request](/partner-center/gdap-customer-approval). --4. [Assign the relevant security groups](/partner-center/gdap-assign-azure-ad-roles#grant-permissions-to-security-groups) to the GDAP relationship. --5. Assign the appropriate [Azure Active Directory built-in roles](/azure/active-directory/roles/permissions-reference) to the Lighthouse security groups aligned for customer management. --We recommend naming security groups based on the tasks MSP technicians handle in Lighthouse. For example, you could create security groups for helpdesk technicians, system administrators, and escalation engineers. We recommend using the roles outlined in the following table to manage Lighthouse. --### Example security groups --||Helpdesk technicians |System administrators |Escalation engineers| -|--|-|-|| -|**Recommended GDAP roles** |<ul><li>Helpdesk Administrator</li><li>Security Reader</li></ul> |<ul><li>User Administrator</li><li>Authentication Administrator</li><li>Global Reader</li><li>Intune Administrator</li><li>Security Administrator</li></ul> |Global Administrator | -|**Tasks** |Read customer information in Lighthouse and take limited actions (for example, resetting user passwords or updating contact information) |Maintain customer security by taking corrective actions in Lighthouse (for example, rebooting devices). |Take privileged actions when needed to protect the customer tenant (for example, blocking sign-in of a compromised administrator). | --For descriptions of specific permissions, see [Azure AD built-in roles](/azure/active-directory/roles/permissions-reference). For partner-specific roles and tasks, see [Least-privileged roles](/partner-center/gdap-least-privileged-roles-by-task). --## DAP in Lighthouse --DAP restricts access to customers in Lighthouse with two roles: Admin Agent and Helpdesk Agent. You can check which users in the partner tenant have the Admin Agent or Helpdesk Agent roles by reviewing security group memberships on the [Azure AD – All Groups](https://portal.azure.com/#blade/Microsoft_AAD_IAM/GroupsManagementMenuBlade/AllGroups) page. To review which customers still have DAP in place, see [Monitoring administrative relationships and self-service DAP removal](/partner-center/dap-monitor-self-serve-removal). --For customers with DAP and no GDAP, the Admin Agent role grants permissions to view all tenant information and take any action in Lighthouse (see below for other actions that also require a role in the partner tenant). --The Helpdesk Agent role grants permissions to view all tenant information and take limited action in Lighthouse (such as resetting user passwords, blocking user sign-ins, and updating customer contact information and websites). --Given the broad permissions granted to partner users with DAP, we recommend adopting GDAP as soon as possible. Both models coexist, but GDAP will eventually replace DAP, and GDAP permissions take precedence over DAP permissions during the transition period. For more information, see [GDAP frequently asked questions](/partner-center/gdap-faq). --## Other roles and permissions --For certain actions in Lighthouse, role assignments in the partner tenant are required. The following table lists partner tenant roles and their associated permissions.<br><br> --| Partner tenant roles | Permissions | -|--|--| -| Global Administrator of partner tenant | <ul><li>Sign up for Lighthouse in the Microsoft 365 admin center.</li><li>Accept partner contract amendments during the first-run experience.</li><li>Activate and inactivate a tenant.</li><li>Create, update, and delete tags.</li><li>Assign and remove tags from a customer tenant.</li></ul> | -| Partner tenant member with at least one Azure AD role assigned with the following property set: **microsoft.office365.supportTickets/allEntities/allTasks**<br>(For a complete list of Azure AD roles, see [Azure AD built-in roles](/azure/active-directory/roles/permissions-reference). | Create Lighthouse service requests. | -| Partner tenant member who meets *both* of the following requirements: <ul><li>Has at least one Azure AD role assigned with the following property set: **microsoft.office365.serviceHealth/allEntities/allTasks**<br>(For a complete list of Azure AD roles, see [Azure AD built-in roles](/azure/active-directory/roles/permissions-reference)</li><li>Has at least one DAP delegated role assigned (Admin Agent or Helpdesk Agent)</li></ul> | View service health information. | --## Next steps --After creating roles, you must set up additional Lighthouse portal security, specifically multifactor authentication (MFA) and optionally Azure AD Identity Management (PIM). For more information, see [Configure Microsoft 365 Lighthouse portal security](m365-lighthouse-configure-portal-security.md). --## Related content --[Least privileged roles by task](/partner-center/gdap-least-privileged-roles-by-task?branch=pr-en-us-2577) (article) -[Delegated administration privileges (DAP) FAQ](/partner-center/dap-faq) (article) -[Assign roles and permissions to users](/partner-center/permissions-overview) (article) -[Requirements for Microsoft 365 Lighthouse](m365-lighthouse-requirements.md) (article) -[Overview of Microsoft 365 Lighthouse](m365-lighthouse-overview.md) (article) -[Sign up for Microsoft 365 Lighthouse](m365-lighthouse-sign-up.md) (article) -[Microsoft 365 Lighthouse FAQ](m365-lighthouse-faq.yml) (article) |
| managed-desktop | Change History Managed Desktop | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/change-history-managed-desktop.md | This article lists new and updated articles in the [Microsoft Managed Desktop do New or changed article | Description | -| [Configurable settings reference](working-with-managed-desktop/config-setting-ref.md) | Added additional Proxy requirements | +| [Device images](service-description/device-images.md) | Added Windows 10 Pro section | +| [Admin support](working-with-managed-desktop/admin-support.md) | Added severity note to the Edit case details section | +| [Configurable settings reference](working-with-managed-desktop/config-setting-ref.md) | Added additional proxy requirements | | [Localize the user experience](get-started/localization.md) | Added note to the Install more languages section | | [Configurable settings reference](working-with-managed-desktop/config-setting-ref.md) | Added note about legacy Edge | |
| managed-desktop | Device Images | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/service-description/device-images.md | When you order a new device from an [approved manufacturer](device-requirements. Anytime you plan to enroll a particular device model in the service for the first time, you should test an example to ensure it will deliver the user experience you expect. For more information, see [Validate new devices](/microsoft-365/managed-desktop/get-started/validate-device). +### Windows 10 Pro +If you're ordering devices with Windows 10, work directly with your OEM sales preresentative. As of November 1, 2022, OEMs can only sell Windows 10 Pro under the Windows 11 Pro with Windows 10 Pro Downgrade license. For more information, see [Windows 10 support dates](https://docs.microsoft.com/lifecycle/products/windows-10-enterprise-and-education?msclkid=4a74c7b9b04111eca478c6fdafbc51a5) for the retirement dates of Windows 10 versions. ++For customers interested in moving to Windows 11, you can find more information on the recommended process [here](https://docs.microsoft.com/microsoft-365/managed-desktop/intro/win11-overview?view=o365-worldwide). + ### Dell Work directly with the Dell sales representative. |
| managed-desktop | Admin Support | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/managed-desktop/working-with-managed-desktop/admin-support.md | You can edit case details, for example, updating the primary case contact or cha Once a case is resolved, it can no longer be edited. If a request has been resolved for less than 24 hours, you'll see the option to **reactivate** instead of **Edit**. Once reactivated, you can again edit the request. +> [!NOTE] +> The severity level can only be set for certain support request types. If selecting a severity level wasn't an option when you created the support request, you won't be able to edit your support request. + ### Provide feedback We appreciate your feedback and use it to improve the admin support experience. |
| security | Configure Extension File Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus.md | You can define exclusions for Microsoft Defender Antivirus that apply to [schedu > Microsoft Defender Antivirus exclusions don't apply to other Microsoft Defender for Endpoint capabilities, including [endpoint detection and response (EDR)](/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response), [attack surface reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction), and [controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders). Files that you exclude using the methods described in this article can still trigger EDR alerts and other detections. > To exclude files broadly, add them to the Microsoft Defender for Endpoint [custom indicators](/microsoft-365/security/defender-endpoint/manage-indicators). -## Before you begin... +## Before you begin See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md) before defining your exclusion lists. To exclude certain files from Microsoft Defender Antivirus scans, you modify you > > Automatic exclusions apply only to Windows Server 2016 and later. These exclusions are not visible in the Windows Security app and in PowerShell. -The following table lists some examples of exclusions based on file extension and folder location. -<br/><br/> +The following table lists some examples of exclusions based on file extension and folder location. |Exclusion|Examples|Exclusion list| |||| See [How to create and deploy antimalware policies: Exclusion settings](/configm 1. Set the option to **Enabled**. 2. Under the **Options** section, select **Show**. 3. Specify each folder on its own line under the **Value name** column.- 4. If you are specifying a file, ensure that you enter a fully qualified path to the file, including the drive letter, folder path, file name, and extension. + 4. If you are specifying a file, ensure that you enter a fully qualified path to the file, including the drive letter, folder path, file name, and extension. 5. Enter **0** in the **Value** column. 5. Choose **OK**. The format for the cmdlets is as follows: The following table lists cmdlets that you can use in the `<cmdlet>` portion of the PowerShell cmdlet: -<br/><br/> - |Configuration action|PowerShell cmdlet| |:|:| |Create or overwrite the list|`Set-MpPreference`| The following table lists cmdlets that you can use in the `<cmdlet>` portion of The following table lists values that you can use in the `<exclusion list>` portion of the PowerShell cmdlet: -<br/><br/> - |Exclusion type|PowerShell parameter| ||| |All files with a specified file extension|`-ExclusionExtension`| The following table describes how the wildcards can be used and provides some ex The following table lists and describes the system account environment variables. -<br/><br/> - |This system environment variable...|Redirects to this| ||| |`%APPDATA%`|`C:\Users\UserName.DomainName\AppData\Roaming`| You can retrieve the items in the exclusion list using one of the following meth - [Intune](/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) - [Microsoft Endpoint Configuration Manager](/configmgr/protect/deploy-use/endpoint-antimalware-policies)-- MpCmdRun-- PowerShell+- [MpCmdRun](command-line-arguments-microsoft-defender-antivirus.md) +- [PowerShell](/powershell/module/defender) - [Windows Security app](microsoft-defender-security-center-antivirus.md) > [!IMPORTANT] |
| security | Web Content Filtering | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/web-content-filtering.md | A panel will open where you can select the priority and add more details such as ### URL category lookup -To determine the category of a website, you can use the URL search function available on the Microsoft 365 Defender portal (<https://security.microsoft.com>) under **Endpoints** \> **Search**. In the URL search results, the web content filtering category appears under **URL/Domain details**. Administrators can also dispute the category of the domain directly from this page, as shown in the following image. If the category result is not shown, the URL is not currently assigned to an existing web content filtering category. +To determine the category of a website, you can use the URL search function available on the Microsoft 365 Defender portal (<https://security.microsoft.com>) under **Endpoints** \> **Search**. In the URL search results, the web content filtering category appears under **URL/Domain details**. If the category result is not shown, the URL is not currently assigned to an existing web content filtering category. +<!:::image type="content" source="../../media/web-content-filtering-category-lookup.png" alt-text="The web content filtering category lookup results" lightbox="../../media/web-content-filtering-category-lookup.png":::> ## Web content filtering cards and details |
| security | Mdo Email Entity Page | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-email-entity-page.md | Users will see enriched detonation details for known malicious attachments or UR - *Spam Confidence Level (SCL)*: The spam confidence level (SCL) of the message. A higher value indicates the message is more likely to be spam. +- *Client type*: Indicates the Client type from which the email was sent like REST. ++- *Forwarding*: For scenarios with autoforwaridng, it indicates the forwarding user as well as the forwarding type like ETR or SMTP forwarding. ++- *Distribution list*: Shows the distribution list, if the recipient receieved the email as a member of the list. It shows the top level distribution list if there are nested distribution lists involved. ++- *To, Cc*: Indicates the addresses which are listed in To, Cc fields of an email. The information in these fields is restricted to 5000 characters. + - *Domain Name*: Is the sender domain name. - *Domain Owner*: Specifies the owner of the sending domain. In addition to the above sections, you will also see sections specific to few ex - Released to: All email addresses (if any) to which the message has been released. - Not yet released to: All email addresses (if any) to which the message has not yet been released. - - *Quarantine actions*: For more information on different quarantine actions, see [Manage quarantined messages](manage-quarantined-messages-and-files.md#take-action-on-quarantined-email). + - *Quarantine actions*: For more information on different quarantine actions, see [Manage quarantined messages](manage-quarantined-messages-and-files.md#take-action-on-quarantined-email). |
| security | Threat Trackers | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/threat-trackers.md | Most tracker pages include trending numbers that are updated periodically, widge Trackers are just a few of the many great features you get with [Microsoft Defender for Office 365 Plan 2](office-365-ti.md). Threat Trackers include [Noteworth trackers](#noteworthy-trackers), [Trending trackers](#trending-trackers), [Tracked queries](#tracked-queries), and [Saved queries](#saved-queries). -To view and use your Threat Trackers for your organization, open the Microsoft 365 Defender portal at <https://security.microsoft.com>, and go to **Email & collaboration** \> **Threat tracker**. To go directly to the **Threat tracker** page, use <https://security.microsoft.com/threattracker>. +To view and use your Threat Trackers for your organization, open the Microsoft 365 Defender portal at <https://security.microsoft.com>, and go to **Email & collaboration** \> **Threat tracker**. To go directly to the **Threat tracker** page, use <https://security.microsoft.com/threattrackerv2>. > [!NOTE] > To use Threat Trackers, you must be a global administrator, security administrator, or security reader. See [Permissions in the Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md). Typically Noteworthy trackers will be posted for just a couple of weeks when we ### Trending trackers -Trending trackers (formerly called Campaigns) highlight new threats received in your organization's email in the past week. +Trending trackers (formerly called Campaigns) highlight new threats received in your organization's email in the past week. The Trending trackers view provides dynamic assessments of email threats impacting your organizationΓÇÖs Office 365 environment. This view shows tenant level malware trends, identifying malware families on the rise, flat, or declining, giving admins greater insight into which threats require further attention. :::image type="content" source="../../media/d2ccc1a0-2a1d-4e36-99b5-6766c207772f.png" alt-text="The example of trending malware campaigns widget" lightbox="../../media/d2ccc1a0-2a1d-4e36-99b5-6766c207772f.png"::: |
| security | User Submission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/user-submission.md | To correctly identify the original attached messages, messages that are sent to If you want to specify the reported reason for the original attached messages, messages that are sent to the custom mailbox (don't modify the attachment) need to start with one of the following prefixes in the Subject (Envelope Title): - 1| or Junk:-- 2| or Not junk-- 3| or Phishing+- 2| or Not junk: +- 3| or Phishing: For example: |
| solutions | Microsoft 365 Guest Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/microsoft-365-guest-settings.md | These settings affect all of the sites in the organization. They do not affect M Because OneDrive is a hierarchy of sites within SharePoint, the organization-level sharing settings directly affect OneDrive just as they do other SharePoint sites. -**Navigation:** SharePoint admin center > <a href="https://go.microsoft.com/fwlink/?linkid=2185222" target="_blank">**Sharing**</a> +**Navigation:** SharePoint admin center > **Policies** > <a href="https://go.microsoft.com/fwlink/?linkid=2185222" target="_blank">**Sharing**</a>  Because OneDrive is a hierarchy of sites within SharePoint, the organization-lev ### SharePoint and OneDrive advanced sharing settings -**Navigation:** SharePoint admin center > <a href="https://go.microsoft.com/fwlink/?linkid=2185222" target="_blank">**Sharing**</a> +**Navigation:** SharePoint admin center > **Policies** > <a href="https://go.microsoft.com/fwlink/?linkid=2185222" target="_blank">**Sharing**</a>  Because OneDrive is a hierarchy of sites within SharePoint, the organization-lev When files and folders are shared in SharePoint and OneDrive, sharing recipients are sent a link with permissions to the file or folder rather than being granted direct access to the file or folder themselves. Several types of links are available, and you can choose the default link type presented to users when they share a file or folder. You can also set permissions and expiration options for *Anyone* links. -**Navigation:** SharePoint admin center > <a href="https://go.microsoft.com/fwlink/?linkid=2185222" target="_blank">**Sharing**</a> +**Navigation:** SharePoint admin center > **Policies** > <a href="https://go.microsoft.com/fwlink/?linkid=2185222" target="_blank">**Sharing**</a>  |