| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| business-premium | Index | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/index.md | ms.audience: Admin Previously updated : 01/23/2023 Last updated : 04/10/2023 ms.localizationpriority: medium - M365-Campaigns description: "Learn how to implement cybersecurity for small or medium sized bus # Microsoft 365 Business Premium ΓÇô productivity and cybersecurity for small business -Microsoft 365 Business Premium with its world class productivity tools is a wise choice for small and medium-sized businesses. Designed with cybersecurity in mind, Microsoft 365 Business Premium safeguards your data, devices and information. You are your organization's first and best defense against hackers and cyberattackers, including random individuals, organized crime, or highly sophisticated nation states. +Microsoft 365 Business PremiumΓÇöwith its world class [productivity and cybersecurity](m365bp-secure-users.md) capabilitiesΓÇöis a wise choice for small and medium-sized businesses. Designed for small and medium-sized businesses (up to 300 users), Microsoft 365 Business Premium safeguards your data, devices, and information. -The task before you is this: let Microsoft 365 Business Premium help secure your organizationΓÇÖs future! Approach this task by taking on the following six missions: +You are your organization's first and best defense against hackers and cyberattackers, including random individuals, organized crime, or highly sophisticated nation states. The task before you is this: let Microsoft 365 Business Premium help secure your organizationΓÇÖs future! Approach this task by taking on the following six missions: :::image type="content" source="media/sixmissions.png" alt-text="Diagram listing your six missions."::: |
| business-premium | M365bp Prepare For Office Client Deployment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-prepare-for-office-client-deployment.md | - Title: "Prepare for Office client deployment with Microsoft 365 Business Premium"-- CSH------ Previously updated : 10/18/2022--- tier1--- MiniMaven-- BCS160-- MET150 -ROBOTS: NO INDEX, NO FOLLOW -description: "Learn how to automatically install the 32-bit Microsoft 365 apps on Windows computers and keep them updated in Microsoft 365 Business Premium." ---# Prepare to automatically install Microsoft 365 apps to client computers --Use Microsoft 365 Business Premium to automatically install the 32-bit Microsoft 365 apps on Windows computers and keep them current with updates. - -Automatic installation works best if the computer: --- is on Windows for Business.- -- doesn't have existing Office desktop apps (Word, Excel, PowerPoint, Outlook, OneNote, Publisher, Access, and OneDrive) OR has an existing version of Click-to-Run Office installed.--To determine if you have the Click-to-Run version of Office, in any Office app go to **File** \> **Account** ( **Office Account** in Outlook). If you see **Office Updates** as shown in the following figure, then the installation was done by using Click-to-Run. - - - -## Requirements for using this feature - -Works with: - -- A user who has a Windows Business user license, an active Microsoft 365 for Business license, Windows 10 Creators Update, and is joined to Azure Active Directory.--Doesn't work with: --- 64-bit Microsoft 365 apps (example: Word, Excel, PowerPoint). If 64-bit Microsoft 365 apps are required, then this feature isn't a good fit because there's no support for triggering a 64-bit 2016 Click-to-Run version of Office from the Microsoft 365 for business admin console.--- Any 2016 Windows Installer (MSI) standalone apps (for example, Visio or Project). Microsoft 365 for business upgrades Office to the Click-to-Run version of Office 2016, and that doesn't work with Office 2016 MSI standalone applications.--The following table shows what action the end users or admins may need to take, depending on their beginning state, to have a successful 32-bit Click-to-Run version of Office deployment from the Microsoft 365 for business admin console.<br/> ---|Starting Office install status|Action to take before Microsoft 365 for business Office install|End state| -|:--|:--|:--| -|No Office suite installed |None |Office 2016 32-bit is installed by using Click-to-Run | -|Existing Click-to-Run 32-bit version of Office (2016 or earlier) and no standalone apps |None |Upgraded to the latest 32-bit Click-to-Run version of Office 2016, as needed **\*** | -|Existing Click-to-Run 32-bit version of Office and Click-to-Run 32-bit or 64-bit standalone Microsoft 365 apps (for example, Visio, Project) |None |Standalone apps aren't affected. Suite is upgraded to Click-to-Run 32-bit version of Office 2016 | -|Existing Click-to-Run 32-bit version of Office and any 32-bit or 64-bit (except 2016) MSI standalone Microsoft 365 apps |None |Standalone apps aren't affected. Suite is upgraded to Click-to-Run 32-bit version of Office 2016 | -|Any existing Click-to-Run 64-bit version of Office |Uninstall the 64-bit Microsoft 365 apps, if it's OK to replace them with 32-bit Microsoft 365 apps |If Office 64-bit apps are removed, the Click-to-Run 32-bit version of Office 2016 is installed | -|An existing MSI install of Office 2016 with or without standalone apps |Uninstall MSI Office 2016. |Click-to-Run 32-bit version of Office 2016 is installed. No change to standalone apps | -|Existing MSI install of Office 2013 (or earlier) and/or standalone Microsoft 365 apps |None |Click-to-Run 32-bit version of Office 2016 with the pre-existing MSI Office install (and standalone apps) exist side-by-side | -- **(\*) Note:** Does not upgrade to Click-to-Run 32-bit version of Office 2016 due to a known bug. A fix is in progress. --## Next objective --[Create app protection settings](m365bp-protection-settings-for-windows-10-devices.md) - |
| business-premium | M365bp Secure Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-secure-users.md | Microsoft 365 Business Premium offers you one comprehensive solution for product ## Video: Top 5 benefits of Microsoft 365 Business Premium -Watch the following video to see how Microsoft 365 Business Premium helps your business be more productive and secure: <p> +Watch the following video to see how Microsoft 365 Business Premium helps your business be more productive and secure: <br/><br/> > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4Pq0G] > [!TIP] > For more detailed information about what's included in Microsoft 365 Business Premium, see the [Microsoft 365 User Subscription Suites for Small and Medium-sized Businesses](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWR6bM). -## Resources to train your users +## Resources to train everyone -The security recommendations provided in [this guidance](index.md) make it much harder for cyberattackers to gain access to your environment. However, an important part of your security strategy includes training everyone in your organization—the people in your company who use your systems regularly. Users can be your first line of defense. Everyone needs to know how to work productively while maintaining a more secure environment. +The security recommendations provided in [this guidance](index.md) make it much harder for cyberattackers to gain access to your environment. An important part of your security strategy also includes training everyone in your organization — the people in your company who use your systems regularly. Users can be your first line of defense. Everyone needs to know how to work productively while maintaining a more secure environment. Resources are available to help everyone in your organization to: Our digital threats guide describes different kinds of threats and what you and 2. [Start the setup process](m365bp-setup-overview.md). 3. [Set up your security capabilities](m365bp-security-overview.md).++4. Help everyone [Set up unmanaged (BYOD) devices](m365bp-devices-overview.md), [Use email securely](m365bp-protect-email-overview.md), and [Collaborate and share securely](m365bp-collaborate-share-securely.md). ++5. [Set up and secure managed devices](m365bp-protect-devices.md) |
| business-premium | M365bp Setup Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-setup-overview.md | description: "Start the setup process of Microsoft 365 Business Premium or Micro Your first critical mission is to complete your initial setup process right away. Let's get you going! +[:::image type="content" source="medi) Your objective is to: |
| business-premium | M365bp Setup | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-setup.md | audience: Admin Previously updated : 11/10/2022 Last updated : 04/10/2023 ms.localizationpriority: medium f1.keywords: NOCSH +- Start with the guided setup experience for basic setup and configuration, and then proceed to [Boost your security protection](m365bp-security-overview.md); or +- Work with a Microsoft partner who can help you get everything set up and configured. -## Before you begin -Make sure that you meet the following requirements before you begin your setup process: +## [**Guided setup process**](#tab/Guided) -| Requirement | Description | -|:|:| -| Subscription | Microsoft 365 Business Premium or Microsoft 365 for Campaigns <br/><br/> To start a trial or purchase your subscription, see the following articles: <br/>- [Get Microsoft 365 Business Premium](get-microsoft-365-business-premium.md)<br/>- [Get Microsoft 365 for Campaigns](get-microsoft-365-campaigns.md) | -| Permissions | To complete the initial setup process, you must be a Global Admin. [Learn more about admin roles](../admin/add-users/about-admin-roles.md). | -| Browser requirements | Microsoft Edge, Safari, Chrome or Firefox. [Learn more about browser requirements](https://www.microsoft.com/microsoft-365/microsoft-365-and-office-resources#coreui-heading-uyetipy). | -| Operating systems (client) | **Windows**: Windows 10 or 11 Pro<br/>**macOS**: One of the three most recent versions of macOS -| Operating systems (servers) | Windows Server or Linux Server <br/>(Requires an additional license, such as [Microsoft Defender for Business servers](../security/defender-business/get-defender-business-servers.md).) | --> [!NOTE] -> For more detailed information about Microsoft 365, Office, and system requirements, see [Microsoft 365 and Office Resources](https://www.microsoft.com/microsoft-365/microsoft-365-and-office-resources). --## Guided setup process --Microsoft 365 Business Premium includes a guided process. The following video shows the guided setup process for Microsoft 365 Business Standard, which also applies to Microsoft 365 Business Premium. (Microsoft 365 Business Premium includes [advanced security settings that you'll configure](m365bp-security-overview.md) after your basic setup process is complete.)<br/><br/> +Microsoft 365 Business Premium includes a guided process, as shown in the following video, and described step by step in this article: > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE471FJ] **As soon as you've completed the guided setup process, proceed to [boost your security protection](m365bp-security-overview.md)**. -> [!TIP] -> After you have added users, give them a link to the [Employee quick setup guide](https://support.microsoft.com/office/7f34c318-e772-46a5-8c0a-ab86661542d1). The guide walks them through signing in, getting Microsoft 365 apps, and saving, copying, and sharing files. - ### The guided setup process, step by step 1. As a global administrator, go to the [Microsoft 365 admin center](https://admin.microsoft.com/) and sign in. By default, you'll see the simplified view, as shown in the following image: Microsoft 365 Business Premium includes a guided process. The following video sh 6. If you added your domain in step 4, you can now connect your domain to Microsoft 365. To get help with this task, see [Change nameservers to set up Microsoft 365 with any domain registrar](../admin/get-help-with-domains/change-nameservers-at-any-domain-registrar.md). -When you're finished with the basic setup process, you'll see **Setup is complete**, where you can tell us how setup went and then go to your Microsoft 365 admin center. At this point, basic setup is complete, but you still need to [set up and configure your security settings](m365bp-security-overview.md). +When you're finished with the basic setup process, you'll see **Setup is complete**, where you can tell us how setup went and then go to your Microsoft 365 admin center. :::image type="content" source="media/m365bp-setupcomplete.png" alt-text="Screenshot of the Setup is Complete confirmation screen."lightbox="media/m365bp-setupcomplete.png"::: -## Work with a Microsoft partner +> [!IMPORTANT] +> At this point, basic setup is complete, but you still need to [set up and configure your security settings](m365bp-security-overview.md). ++## [**Work with a Microsoft partner**](#tab/Partner) If you'd prefer to have a Microsoft partner help you get and set up Microsoft 365 Business Premium, follow these steps: If you'd prefer to have a Microsoft partner help you get and set up Microsoft 36 3. Review the list of results. Select a provider to learn more about their expertise and the services they provide. +++## Employee quick setup guide ++[:::image type="content" source="media/employee-setup-guide.png" alt-text="Screenshot of employee setup guide steps.":::](https://support.microsoft.com/en-us/office/employee-quick-setup-in-microsoft-365-for-business-7f34c318-e772-46a5-8c0a-ab86661542d1) ++After you have added users to your Microsoft 365 subscription, give them a link to the [Employee quick setup guide](https://support.microsoft.com/office/7f34c318-e772-46a5-8c0a-ab86661542d1). The guide walks them through signing in, getting Microsoft 365 apps, and saving, copying, and sharing files. ++## Next objective ++Proceed to [Boost your security protection](m365bp-security-overview.md). + ## See also - [Overview of the Microsoft 365 admin center](../admin/admin-overview/admin-center-overview.md) - [Business subscriptions and billing documentation](../commerce/index.yml) - [Find a Microsoft partner or reseller](../admin/manage/find-your-partner-or-reseller.md) -## Next objective --Proceed to [Boost your security protection](m365bp-security-overview.md). |
| compliance | Archive Facebook Data With Sample Connector | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/archive-facebook-data-with-sample-connector.md | Complete the following prerequisites before you can set up and configure a conne The first step is to register a new app in Azure Active Directory (AAD). This app corresponds to the web app resource that you implement in Step 4 and Step 5 for the Facebook connector. -For step-by-step instructions, see [Create an app in Azure Active Directory](deploy-facebook-connector.md#step-1-create-an-app-in-azure-active-directory). +For step-by-step instructions, see [Create an app in Azure Active Directory](archive-facebook-data.md#step-1-create-an-app-in-azure-active-directory). During the completion of this step (by using the previous step-by-step instructions), you'll save the following information to a text file. These values are used in later steps in the deployment process. During the completion of this step (by using the previous step-by-step instructi The next step is to deploy the source code for the Facebook Business pages connector app that will use the Facebook API to connect to your Facebook account and extract data so you can import it to Microsoft 365. The Facebook connector that you deploy for your organization will upload the items from your Facebook Business pages to the Azure Storage location that is created in this step. After you create a Facebook business pages connector in the compliance portal (in Step 5), the Import service will copy the Facebook business pages data from the Azure Storage location to a mailbox in your Microsoft 365 organization. As previous explained in the [Prerequisites](#prerequisites-for-setting-up-a-connector-for-facebook-business-pages) section, you must have a valid Azure subscription to create an Azure Storage account. -For step-by-step instructions, see [Deploy the connector web service from GitHub to your Azure account](deploy-facebook-connector.md#step-2-deploy-the-connector-web-service-from-github-to-your-azure-account). +For step-by-step instructions, see [Deploy the connector web service from GitHub to your Azure account](archive-facebook-data.md#step-2-deploy-the-connector-web-service-from-github-to-your-azure-account). In the step-by-step instructions to complete this step, you'll provide the following information: After completing this step, be sure to copy the Azure app service URL (for examp The next step is to create and configure a new app on Facebook. The Facebook business pages connector that you create in Step 5 uses the Facebook web app to interact with the Facebook API to obtain data from your organization's Facebook Business pages. -For step-by-step instructions, see [Register the Facebook app](deploy-facebook-connector.md#step-3-register-the-facebook-app). +For step-by-step instructions, see [Register the Facebook app](archive-facebook-data.md#step-3-register-the-facebook-app). During the completion of this step (by following the step-by-step instructions), you save the following information to a text file. These values are used to configure the Facebook connector app in Step 4. During the completion of this step (by following the step-by-step instructions), The final step is to set up the connector in the compliance portal that will import data from your Facebook Business pages to a specified mailbox in Microsoft 365. After you complete this step, the Microsoft 365 Import service will start importing data from your Facebook Business pages to Microsoft 365. -For step-by-step instructions, see [Step 5: Set up a Facebook connector in the compliance portal](deploy-facebook-connector.md#step-5-set-up-a-facebook-connector-in-the-compliance-portal). +For step-by-step instructions, see [Step 5: Set up a Facebook connector in the compliance portal](archive-facebook-data.md#step-5-set-up-a-facebook-connector-in-the-compliance-portal). During the completion of this step (by following the step-by-step instructions), you provide the following information (that you've copied to a text file after completing the steps). |
| compliance | Archive Facebook Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/archive-facebook-data.md | + + Title: "Deploy a connector to archive Facebook Business pages data" +description: "Administrators can set up a native connector to import and archive Facebook Business pages to Microsoft 365. After this data is imported to Microsoft 365, you can use compliance features such as legal hold, content search, and retention policies to manage the governance of your organization's Facebook data." +f1.keywords: +- NOCSH +++ Last updated : 01/01/2023+audience: Admin +++ms.localizationpriority: medium +search.appverid: +- MET150 ++- tier3 +- purview-compliance +- data-connectors +++++# Deploy a connector to archive Facebook Business pages data ++This article contains the step-by-step process to deploy a connector that uses the Office 365 Import service to import data from Facebook Business pages to Microsoft 365. For a high-level overview of this process and a list of prerequisites required to deploy a Facebook connector, see [Set up a connector to archive Facebook data](archive-facebook-data-with-sample-connector.md). +++## Step 1: Create an app in Azure Active Directory ++1. Go to <https://portal.azure.com> and sign in using the credentials of a global admin account. ++  ++2. In the left navigation pane, select **Azure Active Directory**. ++  ++3. In the left navigation pane, select **App registrations (Preview)** and then select **New registration**. ++  ++4. Register the application. Under Redirect URI, select Web in the application type dropdown list and then type <https://portal.azure.com> in the box for the URI. ++  ++5. Copy the **Application (client) ID** and **Directory (tenant) ID** and save them to a text file or other safe location. You use these IDs in later steps. ++  ++6. Go to **Certificates & secrets for the new app.** ++  ++7. Select **New client secret** ++  ++8. Create a new secret. In the description box, type the secret and then choose an expiration period. ++  ++9. Copy the value of the secret and save it to a text file or other storage location. This is the AAD application secret that you use in later steps. ++  ++## Step 2: Deploy the connector web service from GitHub to your Azure account ++1. Go to [this GitHub site](https://github.com/microsoft/m365-sample-connector-csharp-aspnet) and select **Deploy to Azure**. ++  ++2. After you select **Deploy to Azure**, you will be redirected to an Azure portal with a custom template page. Fill in the **Basics** and **Settings** details and then select **Purchase**. ++ - **Subscription:** Select your Azure subscription that you want to deploy the Facebook Business pages connector web service to. ++ - **Resource group:** Choose or create a new resource group. A resource group is a container that holds related resources for an Azure solution. ++ - **Location:** Choose a location. ++ - **Web App Name:** Provide a unique name for the connector web app. Th name must be between 3 and 18 characters in length. This name is used to create the Azure app service URL; for example, if you provide the Web app name of **fbconnector** then the Azure app service URL will be **fbconnector.azurewebsites.net**. ++ - **tenantId:** The tenant ID of your Microsoft 365 organization that you copied after creating the Facebook connector app in Azure Active Directory in Step 1. ++ - **APISecretKey:** You can type any value as the secret. This is used to access the connector web app in Step 5. ++  ++3. After the deployment is successful, the page will look similar to the following screenshot: ++  ++## Step 3: Register the Facebook app ++1. Go to <https://developers.facebook.com>, log in using the credentials for the account for your organization's Facebook Business pages, and then select **Add New App**. ++  ++2. Create a new app ID. ++  ++3. In the left navigation pane, select **Add Products** and then select **Set Up** in the **Facebook Login** tile. ++  ++4. On the Integrate Facebook Login page, select **Web**. ++  ++5. Add the Azure app service URL; for example `https://fbconnector.azurewebsites.net`. ++  ++6. Complete the QuickStart section of the Facebook Login setup. ++  ++7. In the left navigation pane under **Facebook Login**, select **Settings**, and add the OAuth redirect URI in the **Valid OAuth Redirect URIs** box. Use the format **\<connectorserviceuri>/Views/FacebookOAuth**, where the value for connectorserviceuri is the Azure app service URL for your organization; for example, `https://fbconnector.azurewebsites.net`. ++  ++8. In the left navigation pane, select **Add Products** and then select **Webhooks.** In the **Page** pull-down menu, select **Page**. ++  ++9. Add Webhooks Callback URL and add a verify token. The format of the callback URL, use the format `<connectorserviceuri>/api/FbPageWebhook`, where the value for connectorserviceuri is the Azure app service URL for your organization; for example `https://fbconnector.azurewebsites.net`. ++ The verify token should similar to a strong password. Copy the verify token to a text file or other storage location. ++  ++10. Test and subscribe to the endpoint for feed. ++  ++11. Add a privacy URL, app icon, and business use. Also, copy the app ID and app secret to a text file or other storage location. ++  ++12. Make the app public. ++  ++13. Add user to the admin or tester role. ++  ++14. Add the **Page Public Content Access** permission. ++  ++15. Add Manage Pages permission. ++  ++16. Get the application reviewed by Facebook. ++  ++## Step 4: Configure the connector web app ++1. Go to `https://<AzureAppResourceName>.azurewebsites.net` (where AzureAppResourceName is the name of your Azure app resource that you named in Step 4). For example, if the name is **fbconnector**, go to `https://fbconnector.azurewebsites.net`. The home page of the app will look like the following screenshot: ++  ++2. Select **Configure** to display a sign in page. ++  ++3. In the Tenant Id box, type or paste your tenant Id (that you obtained in Step 2). In the password box, type or paste the APISecretKey (that you obtained in Step 2), and then select **Set Configuration Settings** to display the configuration details page. ++  ++4. Enter the following configuration settings ++ - **Facebook application ID:** The app ID for the Facebook application that you obtained in Step 3. ++ - **Facebook application secret:** The app secret for the Facebook application that you obtained in Step 3. ++ - **Facebook webhooks verify token:** The verify token that you created in Step 3. ++ - **AAD application ID:** The application ID for the Azure Active Directory app that you created in Step 1. ++ - **AAD application secret:** The value for the APISecretKey secret that you created in Step 1. ++5. Select **Save** to save the connector settings. ++## Step 5: Set up a Facebook connector in the compliance portal ++1. Go to the Microsoft Purview compliance portal, and then select <a href="https://go.microsoft.com/fwlink/p/?linkid=2173865" target="_blank">**Data connectors**</a. ++2. On the **Data connectors** page under **Facebook Business pages**, select **View**. ++3. On the **Facebook business pages** page, select **Add connector**. ++4. On the **Terms of service** page, select **Accept**. ++5. On the **Add credentials for your connector app** page, enter the following information and then select **Validate connection**. ++  ++ - In the **Name** box, type a name for the connector, such as **Facebook news page**. ++ - In the **Connection URL** box, type or paste the Azure app service URL; for example `https://fbconnector.azurewebsites.net`. ++ - In the **Password** box, type or paste the value of the APISecretKey that you added in Step 2. ++ - In the **Azure App ID** box, type or paste the value of the Application (client) ID also called as AAD Application ID that you created in Step 1. ++6. After the connection is successfully validated, select **Next**. ++7. On the **Authorize Microsoft 365 to import data** page, type or paste the APISecretKey again and then select **Login web app**. ++8. On the **Configure Facebook connector app** page, select **Login with Facebook** and log in using the credentials for the account for your organization's Facebook Business pages. Make sure the Facebook account that you logged in to is assigned the admin role for your organization's Facebook Business pages. ++  ++9. A list of the business pages managed by the Facebook account that you logged in to is displayed. Select the page to archive and then select **Next**. ++  ++10. Select **Continue** to exit the setup of the connector service app. ++11. On the **Set filters** page, you can apply a filter to initially import items that are a certain age. Select an age, and then select **Next**. ++12. On the **Choose storage location** page, type the email address of Microsoft 365 mailbox that the Facebook items will be imported to, and then select **Next**. ++13. Select **Next** to review the connector settings and then select **Finish** to complete the connector setup. ++14. In the compliance center, go to the **Data connectors** page, and select the **Connectors** tab to see the progress of the import process. |
| compliance | Archive Partner Third Party Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/archive-partner-third-party-data.md | + + Title: "Work with a partner to archive third-party data" +description: Learn how to set up a custom connector to import third-party data from data sources such as Salesforce Chatter, Yahoo Messenger, or Yammer. +f1.keywords: +- NOCSH +++ Last updated : 01/01/2023+audience: Admin +++ms.localizationpriority: medium +search.appverid: +- MET150 ++- tier3 +- purview-compliance +- data-connectors ++- seo-marvel-apr2020 +- admindeeplinkEXCHANGE +++# Work with a partner to archive third-party data ++You can work with a Microsoft Partner to import and archive data from a third-party data source to Microsoft 365. A partner can provide you with a custom connector that is configured to extract items from the third-party data source (on a regular basis) and then import those items. The partner connector converts the content of an item from the data source to an email message format and then stores the items in mailboxes. After third-party data is imported, you can apply Microsoft Purview features such as Litigation Hold, eDiscovery, In-Place Archiving, Auditing, and Microsoft 365 retention policies to this data. ++> [!IMPORTANT] +> The [Communication compliance](communication-compliance.md) solution in Microsoft 365 can't be applied to the third-party data imported by partner connectors mentioned in this article. ++Here's an overview of the process and the steps necessary to work with a Microsoft Partner to import third-party data. ++[Step 1: Find a third-party data partner](#step-1-find-a-third-party-data-partner) ++[Step 2: Create and configure a third-party data mailbox](#step-2-create-and-configure-a-third-party-data-mailbox-in-microsoft-365) ++[Step 3: Configure user mailboxes for third-party data](#step-3-configure-user-mailboxes-for-third-party-data) ++[Step 4: Provide your partner with information](#step-4-provide-your-partner-with-information) ++[Step 5: Register the third-party data connector in Azure Active Directory](#step-5-register-the-third-party-data-connector-in-azure-active-directory) +++## How the third-party data import process works ++The following illustration and description explain how the third-party data import process works when working with a partner. ++ ++1. Customer works with their partner of choice to configure a connector that will extract items from the third-party data source and then import those items to Microsoft 365. ++2. The partner connector connects to third-party data sources via a third-party API (on a scheduled or as-configured basis) and extracts items from the data source. The partner connector converts the content of an item to an email message format. See the [More information](#more-information) section for a description of the message-format schema. ++3. Partner connector connects to the Azure service in Microsoft 365 by using Exchange Web Service (EWS) via a well-known end point. ++4. Items are imported into the mailbox of a specific user or into a "catch-all" third-party data mailbox. Whether an item is imported into a specific user mailbox or to the third-party data mailbox is based on the following criteria: ++ 1. **Items that have a user ID that corresponds to a user account:** If the partner connector can map the user ID of the item in the third-party data source to a specific user ID in Microsoft 365, the item is copied to the **Purges** folder in the user's Recoverable Items folder. Users can't access items in the Purges folder. However, you can use eDiscovery tools to search for items in the Purges folder. ++ 1. **Items that don't have a user ID that corresponds to a user account:** If the partner connector can't map the user ID of an item to a specific user ID, the item is copied to the **Inbox** folder of the third-party data mailbox. Importing items to the inbox allows you or someone in your organization to sign in to the third-party mailbox to view and manage these items, and see if any adjustments need to be made in the partner connector configuration. ++## Step 1: Find a third-party data partner ++A key component for archiving third-party data in Microsoft 365 is finding and working with a Microsoft partner that specializes in capturing data from a third-party data source and importing it to Microsoft 365. After the data is imported, it can be archived and preserved along with your organization's other Microsoft data, such as email from Exchange and documents from SharePoint and OneDrive for Business. A partner creates a connector that extracts data from your organization's third-party data sources (such as BlackBerry, Facebook, Google+, Thomson Reuters, Twitter, and YouTube) and passes that data to a Microsoft 365 API that imports items to Exchange mailboxes as email messages. ++The following sections list the Microsoft partners (and the third-party data sources they support) that are participating in the program for archiving third-party data in Microsoft 365. ++[17a-4 LLC](#17a-4-llc) ++[ArchiveSocial](#archivesocial) ++[Veritas](#veritas) ++[OpenText](#opentext) ++[Smarsh](#smarsh) ++[Verba](#verba) ++### 17a-4 LLC ++[17a-4 LLC](https://www.17a-4.com) supports the following third-party data sources: ++- BlackBerry ++- Bloomberg Data Streams ++- Cisco Jabber ++- FactSet ++- HipChat ++- InvestEdge ++- LivePerson ++- MessageLabs Data Streams ++- OpenText ++- Oracle/ATG 'click-to-call' Live Help ++- Pivot IMTRADER ++- Microsoft SharePoint ++- MindAlign ++- Sitrion One (Newsgator) ++- Skype for Business (Lync/OCS) ++- Skype for Business Online (Lync Online) ++- SQL Databases ++- Squawker ++- Thomson Reuters Eikon Messenger ++### ArchiveSocial ++[ArchiveSocial](https://www.archivesocial.com) supports the following third-party data sources: ++- Facebook ++- Flickr ++- Instagram ++- LinkedIn ++- Pinterest ++- Twitter ++- YouTube ++- Vimeo ++### Veritas ++[Veritas](https://www.globanet.com) supports the following third-party data sources: ++- AOL with Pivot Client ++- BlackBerry Call Logs (v5, v10, v12) ++- BlackBerry Messenger (v5, v10, v12) ++- BlackBerry PIN (v5, v10, v12) ++- BlackBerry SMS (v5, v10, v12) ++- Bloomberg Chat ++- Bloomberg Mail ++- Box ++- CipherCloud for Salesforce Chatter ++- Cisco IM & Presence Server (v10, v10.5.1 SU1, v11.0, v11.5 SU2) ++- Cisco Webex Teams ++- Citrix Workspace & ShareFile ++- CrowdCompass ++- Custom-delimited text files ++- Custom XML files ++- Facebook (Pages) ++- Factset ++- FXConnect ++- ICE Chat/YellowJacket ++- Jive ++- Macgregor XIP ++- Microsoft Exchange Server ++- Microsoft OneDrive for Business ++- Microsoft Teams ++- Microsoft Yammer ++- Mobile Guard ++- Pivot ++- Salesforce Chatter ++- Skype for Business Online ++- Skype for Business, versions 2007 R2 - 2016 (on-premises) ++- Slack Enterprise Grid ++- Symphony ++- Thomson Reuters Eikon ++- Thomson Reuters Messenger ++- Thomson Reuters Dealings 3000 / FX Trading ++- Twitter ++- UBS Chat ++- YouTube ++### OpenText ++[OpenText](https://www.opentext.com/what-we-do/products/opentext-product-offerings-catalog/rebranded-products/daegis) supports the following third-party data sources: ++- Axs Encrypted ++- Axs Exchange ++- Axs Local Archive ++- Axs PlaceHolder ++- Axs Signed ++- Bloomberg ++- Thomson Reuters ++### Smarsh ++[Smarsh](https://www.smarsh.com) supports the following third-party data sources: ++- AIM ++- American Idol ++- Apple Juice ++- AOL with Pivot client ++- Ares ++- Bazaar Voice ++- Bear Share ++- Bit Torrent ++- BlackBerry Call Logs (v5, v10, v12) ++- BlackBerry Messenger (v5, v10, v12) ++- BlackBerry PIN (v5, v10, v12) ++- BlackBerry SMS (v5, v10, v12) ++- Bloomberg Mail ++- CellTrust ++- Chat Import ++- Chat Real Time Logging and Policy ++- Chatter ++- Cisco IM & Presence Server (v9.0.1, v9.1, v9.1.1 SU1, v10, v10.5.1 SU1) ++- Cisco Unified Presence Server (v8.6.3, v8.6.4, v8.6.5) ++- Collaboration Import ++- Collaboration Real Time Logging ++- Direct Connect ++- Facebook ++- FactSet ++- FastTrack ++- Gnutella ++- Google+ ++- GoToMyPC ++- Hopster ++- HubConnex ++- IBM Connections (v3.0.1, v4.0, v4.5, v4.5 CR3, v5) ++- IBM Connections Chat Cloud ++- IBM Connections Social Cloud ++- IBM SameTime Advanced 8.5.2 IFR1 ++- IBM SameTime Communicate 9.0 ++- IBM SameTime Community (v8.0.2, v8.5.1 IFR2, v8.5.2 IFR1, v9.1) ++- IBM SameTime Complete 9.0 ++- IBM SameTime Conference 9.0 ++- IBM SameTime Meeting 8.5.2 IFR1 ++- ICE/YellowJacket ++- IM Import ++- IM Real Time Logging and Policy ++- Indii Messenger ++- Instant Bloomberg ++- IRC ++- Jive ++- Jive 6 Real Time Logging (v6, v7) ++- Jive Import ++- JXTA ++- LinkedIn ++- Microsoft Lync (2010, 2013) ++- MFTP ++- Microsoft Lync 2013 Voice ++- Microsoft SharePoint (2010, 2013) ++- Microsoft SharePoint Online ++- Microsoft UC (Unified Communications) ++- MindAlign ++- Mobile Guard ++- MSN ++- My Space ++- NEONetwork ++- Microsoft 365 Lync Dedicated ++- Microsoft 365 Shared IM ++- Pinterest ++- Pivot ++- QQ ++- Skype for Business 2015 ++- SoftEther ++- Symphony ++- Thomson Reuters Eikon ++- Thomson Reuters Messenger ++- Tor ++- TTT ++- Twitter ++- WinMX ++- Winny ++- Yahoo ++- Yammer ++- YouTube ++### Verba ++[Verba](https://www.verba.com) supports the following third-party data sources: ++- Avaya Aura Video ++- Avaya Aura Voice ++- Avtec Radio ++- Bosch/Telex Radio ++- BroadSoft Video ++- BroadSoft Voice ++- Centile Voice ++- Cisco Jabber IM ++- Cisco UC Video ++- Cisco UC Voice ++- Cisco UCCX/UCCE Video ++- Cisco UCCX/UCCE Voice ++- ESChat Radio ++- Geoman Contact Expert ++- IP Trade Voice ++- Luware LUCS Contact Center ++- Microsoft UC (Unified Communications) ++- Mitel MiContact Center for Lync (prairieFyre) ++- Oracle / Acme Packet Session Border Controller Video ++- Oracle / Acme Packet Session Border Controller Voice ++- Singtel Mobile Voice ++- SIPREC Video ++- SIPREC Voice ++- Skype for Business / Lync IM ++- Skype for Business / Lync Video ++- Skype for Business / Lync Voice ++- Speakerbus Voice ++- Standard SIP/H.323 Video ++- Standard SIP/H.323 Voice ++- Truphone Voice ++- TwistedPair Radio ++- Windows Desktop Computer Screen ++## Step 2: Create and configure a third-party data mailbox in Microsoft 365 ++Here are the steps for creating and configuring a third-party data mailbox for importing data to Microsoft 365. As previous explained, items are imported to this mailbox if the partner connector can't map the user ID of the item to a user account. ++### Complete these tasks in the Microsoft 365 admin center ++1. Create a user account and assign it an Exchange Online Plan 2 license; see [Add users to Microsoft 365](../admin/add-users/add-users.md). A Plan 2 license is required to place the mailbox on Litigation Hold or enable an archive mailbox that has a storage quota up to 1.5 TB. ++2. Add the user account for the third-party data mailbox to the **Exchange administrator** admin role in Microsoft 365; see [Assign admin roles in Microsoft 365](../admin/add-users/assign-admin-roles.md). ++ > [!TIP] + > Write down the credentials for this user account. You need to provide them to your partner, as described in Step 4. ++### Complete these tasks in the Exchange admin center ++1. Hide the third-party data mailbox from the address book and other address lists in your organization; see [Manage user mailboxes](/exchange/recipients-in-exchange-online/manage-user-mailboxes/manage-user-mailboxes). Alternatively, you can run the following [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) command: ++ ```powershell + Set-Mailbox -Identity <identity of third-party data mailbox> -HiddenFromAddressListsEnabled $true + ``` ++2. Assign the **FullAccess** permission to the third-party data mailbox so that administrators or compliance officers can open the third-party data mailbox in the Outlook desktop client; see [Manage permissions for recipients](https://go.microsoft.com/fwlink/p/?LinkId=692104). ++3. Enable the following compliance-related features for the third-party data mailbox: ++ - Enable the archive mailbox; see [Enable archive mailboxes](enable-archive-mailboxes.md) and [Enable auto-expanding archiving](enable-autoexpanding-archiving.md). This lets you free-up storage space in the primary mailbox by setting up an archive policy that moves third-party data items to the archive mailbox. This provides you with up to 1.5 TB of storage for third-party data. ++ - Place the third-party data mailbox on Litigation Hold. You can also apply a Microsoft 365 retention policy in the security and compliance center. Placing this mailbox on hold retains third-party data items (indefinitely or for a specified duration) and prevent them from being purged from the mailbox. See one of the following topics: ++ - [Place a mailbox on Litigation Hold](./ediscovery-create-a-litigation-hold.md) ++ - [Learn about retention policies and retention labels](retention.md) ++ - Enable mailbox audit logging for owner, delegate, and admin access to the third-party data mailbox; see [Enable mailbox auditing](audit-mailboxes.md). This allows you to audit all activity performed by any user who has access to the third-party data mailbox. ++## Step 3: Configure user mailboxes for third-party data ++The next step is to configure user mailboxes to support third-party data. Complete these tasks by using the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a> or by using the corresponding cmdlets. ++1. Enable the archive mailbox for each user; see [Enable archive mailboxes](enable-archive-mailboxes.md) and [Enable auto-expanding archiving](enable-autoexpanding-archiving.md). ++2. Place user mailboxes on Litigation Hold or apply a Microsoft 365 retention policy; see one of the following topics: ++ - [Place a mailbox on Litigation Hold](./ediscovery-create-a-litigation-hold.md) ++ - [Learn about retention policies and retention labels](retention.md) ++ As previously stated, when you place mailboxes on hold, you can set a duration for how long to hold items from the third-party data source or you can choose to hold items indefinitely. ++## Step 4: Provide your partner with information ++The final step is to provide your partner with the following information so they can configure the connector to connect to your organization to import data to user mailboxes and to the third-party data mailbox. ++- The endpoint used to connect to the Azure service in Microsoft 365: ++ ```http + https://office365ingestionsvc.gble1.protection.outlook.com/service/ThirdPartyIngestionService.svc + ``` ++- The sign-in credentials (Microsoft 365 user ID and password) of the third-party data mailbox that you created in Step 2. These credentials are required so that the partner connector can access and import items to user mailboxes and to the third-party data mailbox. ++## Step 5: Register the third-party data connector in Azure Active Directory ++Starting September 30, 2018, the Azure service in Microsoft 365 will begin using modern authentication in Exchange Online to authenticate third-party data connectors that attempt to connect to your organization to import data. The reason for this change is that modern authentication provides more security than the current method, which was based on an allow list for third-party connectors that use the previously described endpoint to connect to the Azure service. ++To enable a third-party data connector to connect to Microsoft 365 using the new modern authentication method, an administrator in your organization must consent to register the connector as a trusted service application in Azure Active Directory. This is done by accepting a permission request to allow the connector to access your organization's data in Azure Active Directory. After you accept this request, the third-party data connector is added as an enterprise application to Azure Active Directory and represented as a service principal. For more information the consent process, see [Tenant Admin Consent](/skype-sdk/trusted-application-api/docs/tenantadminconsent). ++Here are the steps to access and accept the request to register the connector: ++1. Go to [this page](https://login.microsoftonline.com/common/oauth2/authorize?client_id=8dfbc50b-2111-4d03-9b4d-dd0d00aae7a2&response_type=code&redirect_uri=https://portal.azure.com/&nonce=1234&prompt=admin_consent) and sign in using the credentials of a global administrator. ++ The following dialog box is displayed. You can expand the carets to review the permissions that will be assigned to the connector. ++  ++2. Select **Accept**. ++After you accept the request, the [Azure portal](https://portal.azure.com) is displayed. To view the list of applications for your organization, select **Azure Active Directory** > **Enterprise applications**. The Microsoft 365 third-party data connector is listed on the **Enterprise applications** blade. ++> [!IMPORTANT] +> After September 30, 2018, third-party data will no longer be imported into mailboxes in your organization if you don't register a third-party data connector in Azure Active Directory. Note existing third-party data connectors (those created before September 30, 2018) must also be registered in Azure Active Directory by following the procedure in Step 5. ++### Revoking consent for a third-party data connector ++After your organization consents to the permissions request to register a third-party data connector in Azure Active Directory, your organization can revoke that consent at any time. However, revoking the consent for a connector means that data from the third-party data source will no longer be imported into Microsoft 365. ++To revoke consent for a third-party data connector, you can delete the application (by deleting the corresponding service principal) from Azure Active Directory using the **Enterprise applications** blade in the Azure portal, or by using the [Remove-MsolServicePrincipal](/powershell/module/msonline/remove-msolserviceprincipal) in Microsoft 365 PowerShell. You can also use the [Remove-AzureADServicePrincipal](/powershell/module/azuread/remove-azureadserviceprincipal) cmdlet in Azure Active Directory PowerShell. ++## More information ++- As previous explained, items from third-party data sources are imported to Exchange mailboxes as email messages. The partner connector imports the item using a schema required by the Microsoft 365 API. The following table describes the message properties of an item from a third-party data source after it's imported to an Exchange mailbox as an email message. The table also indicates if the message property is mandatory. Mandatory properties must be populated. If an item is missing a mandatory property, it won't be imported to Microsoft 365. The import process returns an error message explaining why an item wasn't imported and which property is missing. ++ |Message property|Mandatory?|Description|Example value| + ||||| + |**FROM**|Yes|The user who originally created or sent the item in the third-party data source. The partner connector attempts to map the user ID from the source item (for example a Twitter handle) to a user account for all participants (users in the FROM and TO fields). A copy of the message will be imported to the mailbox of every participant. If none of the participants from the item can be mapped to a user account, the item will be imported to the third-party archiving mailbox in Microsoft 365. <br/> <br/> The participant who's identified as the sender of the item must have an active mailbox in the organization that the item is being imported to. If the sender doesn't have an active mailbox, the following error is returned:<br/><br/> `One or more messages in the Request failed to be delivered to either From or Sender email address. You will need to resend your entire Request. Error: The request failed. The remote server returned an error: (401) Unauthorized.`|`bob@contoso.com`| + |**TO**|Yes|The user who received an item, if applicable for an item in the data source.|`bob@contoso.com`| + |**SUBJECT**|No|The subject from the source item.|`"Mega deals with Contoso coming your way! #ContosoHolidayDeals"`| + |**DATE**|Yes|The date the item was originally created or posted in the customer data source. For example, that date when a Twitter message was tweeted.|`01 NOV 2015`| + |**BODY**|No|The contents of the message or post. For some data sources, the contents of this property could be the same as the content for the **SUBJECT** property. During the import process, the partner connector attempts to maintain full fidelity from the content source as possible. If possible files, graphics, or other content from the body of the source item is included in this property. Otherwise, content from the source item is included in the **ATTACHMENT** property. The contents of this property depends on the partner connector and on the capability of the source platform.|` + |**ATTACHMENT**|No|If an item in the data source (such as a tweet in Twitter or an instant messaging conversation) has an attached file or include images, the partner connect will first attempt to include attachments in the **BODY** property. If that isn't possible, then it's added to the ** ATTACHMENT ** property. Other examples of attachments include Likes in Facebook, metadata from the content source, and responses to a message or post.|`image.gif`| + |**MESSAGECLASS**|Yes|This is a multi-value property, which is created and populated by partner connector. The format of this property is `IPM.NOTE.Source.Event`. (This property must begin with `IPM.NOTE`. This format is similar to the one for the `IPM.NOTE.X` message class.) This property includes the following information: <br/><br/>`Source`: Indicates the third-party data source; for example, Twitter, Facebook, or BlackBerry. <br/> <br/> `Event`: Indicates the type of activity that was performed in the third-party data source that produced the items; for example, a tweet in Twitter or a post in Facebook. Events are specific to the data source. <br/> <br/> One purpose of this property is to filter specific items based on the data source where an item originated or based on the type of event. For example, in an eDiscovery search you could create a search query to find all the tweets that were posted by a specific user.|`IPM.NOTE.Twitter.Tweet`| ++- When items are successfully imported to mailboxes in Microsoft 365, a unique identifier is returned back to the caller as part of the HTTP response. This identifier, called `x-IngestionCorrelationID`, can be used for subsequent troubleshooting purposes by partners for end-to-end tracking of items. It's recommended that partners capture this information and log it accordingly at their end. Here's an example of an HTTP response showing this identifier: ++ ```http + HTTP/1.1 200 OK + Content-Type: text/xml; charset=utf-8 + Server: Microsoft-IIS/8.5 + x-IngestionCorrelationID: 1ec7667d-f097-47fe-a9a2-bc7ab0a7552b + X-AspNet-Version: 4.0.30319 + X-Powered-By: ASP.NET + Date: Tue, 02 Feb 2016 22:55:33 GMT + ``` ++- You can use the Content Search tool in the security and compliance center to search for items that were imported to mailboxes from a third-party data source. To search specifically for these imported items, you can use the following message property-value pairs in the keyword box for a Content Search. ++ - **`kind:externaldata`**: Use this property-value pair to search all third-party data types. For example, to search for items that were imported from a third-party data source and contained the word "contoso" in the Subject property of the imported item, you would use the keyword query `kind:externaldata AND subject:contoso`. ++ - **`itemclass:ipm.externaldata.<third-party data type>`**: Use this property-value pair to only search a specify type of third-party data. For example, to only search Facebook data that contains the word "contoso" in the Subject property, you would use the keyword query `itemclass:ipm.externaldata.Facebook* AND subject:contoso`. ++ For a complete list of values to use for third-party data types for the `itemclass` property, see [Use Content Search to search third-party data that was imported to Microsoft 365](use-content-search-to-search-third-party-data-that-was-imported.md). ++ For more information about using Content Search and creating keyword search queries, see: ++ - [Content Search](ediscovery-content-search.md) ++ - [Keyword queries and search conditions for Content Search](ediscovery-keyword-queries-and-search-conditions.md) |
| compliance | Archive Third Party Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/archive-third-party-data.md | + + Title: "Use data connectors to import and archive third-party data in Microsoft 365" +description: "Learn how to import and archive third-party data from social media platforms, instant messaging platforms, and document collaboration platforms to Microsoft 365 mailboxes." +f1.keywords: +- NOCSH +++ Last updated : 03/22/2023+audience: Admin +++ms.localizationpriority: medium ++- tier3 +- purview-compliance +- data-connectors +search.appverid: +- MOE150 +- MET150 ++- seo-marvel-apr2020 +++# Learn about connectors for third-party data ++Microsoft 365 lets administrators use data connectors to import and archive non-Microsoft, third-party data from social media platforms, instant messaging platforms, and document collaboration platforms, to mailboxes in your Microsoft 365 organization. One primary benefit of using data connectors to import and archive third-party data in Microsoft 365 is that you can apply various Microsoft Purview solutions to the data after it's been imported. This helps you ensure that your organization's non-Microsoft data is in compliance with the regulations and standards that affect your organization. ++Watch this interactive guide that demonstrates how to create data connectors to import and archive third-party data and examples of applying compliance solutions to data after it's imported to Microsoft 365. +<br><br> ++> [!VIDEO https://mslearn.cloudguides.com/guides/Archive%20data%20from%20non-Microsoft%20sources%20in%20Microsoft%20365] +++## Third-party data connectors ++The Microsoft Purview compliance portal provides native third-party data connectors from Microsoft to import data from various data sources, such as LinkedIn, Instant Bloomberg, and Twitter and data connectors that support the Insider risk management solution. In addition to these data connectors, Microsoft works with the following partners to provide many more third part data connectors in the compliance portal. Your organization works with these partners to set up their archiving service before creating a corresponding data connector in the compliance portal. ++- [Veritas](#veritas-data-connectors) +- [TeleMessage](#telemessage-data-connectors) +- [17a-4 LLC](#17a-4-data-connectors) +- [CellTrust](#celltrust-data-connectors) ++The third-party data listed in the next sections (except for HR data and physical badging data that is used for the Microsoft Purview Insider Risk Management solution) is imported into user mailboxes. The Microsoft Purview solutions that support third-party data are applied to the user mailbox where the data is stored. ++### Microsoft data connectors ++The following table lists the native third-party data connectors available in the compliance portal. The table also summarizes the compliance solutions that you can apply after you import and archive third-party data in Microsoft 365. See the [Overview of compliance solutions that support third-party data](#overview-of-microsoft-purview-solutions-that-support-third-party-data) section for a more detailed description of each compliance solution and how it supports third-party data. ++Select the link in the **Third-party data** column to go the step-by-step instructions for creating a connector for that data type. ++|**Third-party data**|**Litigation hold**|**eDiscovery**|**Retention settings**|**Records management**|**Communication compliance**|**Insider risk management**| +|:|::|::|:|::|::|::| +|[Bloomberg Message](archive-bloomberg-message-data.md)||||||| +|[Epic EHR healthcare](import-epic-data.md)||||||| +|[Facebook](archive-facebook-data-with-sample-connector.md)||||||| +|[Generic EHR healthcare](import-healthcare-data.md) ||||||| +|[Human resources (HR)](import-hr-data.md) ||||||| +|[ICE Chat](archive-icechat-data.md)||||||| +|[Instant Bloomberg](archive-instant-bloomberg-data.md)||||||| +|[LinkedIn](archive-linkedin-data.md)||||||| +|[Physical badging](import-physical-badging-data.md) ||||||| +|[Twitter](archive-twitter-data-with-sample-connector.md)||||||| +|||||||| ++### Veritas data connectors ++The table in this section lists the third-party data connectors available in partnership with Veritas. The table also summarizes the compliance solutions that you can apply to third-party data after you import and archive it in Microsoft 365. See the [Overview of compliance solutions that support third-party data](#overview-of-microsoft-purview-solutions-that-support-third-party-data) section for a more detailed description of each compliance solution and how it supports third-party data. ++Before you can archive third-party data in Microsoft 365, you have to work with Veritas to set up their archiving service (called *Merge1*) for your organization. For more information, select the link in the **Third-party data** column to go the step-by-step instructions for creating a connector for that data type. ++|**Third-party data**|**Litigation hold**|**eDiscovery**|**Retention settings**|**Records management**|**Communication compliance**|**Insider risk management**| +|:|::|::|::|::|::|::| +|[CellTrust](archive-celltrust-data.md)||||||| +|[Cisco Jabber on MS SQL](archive-ciscojabberonmssql-data.md)||||||| +|[Cisco Jabber on Oracle](archive-ciscojabberonoracle-data.md)||||||| +|[Cisco Jabber on PostgreSQL](archive-ciscojabberonpostgresql-data.md)||||||| +|[EML](archive-eml-data.md)||||||| +|[FX Connect](archive-fxconnect-data.md)||||||| +|[Jive](archive-jive-data.md)||||||| +|[MS SQL Database](archive-mssqldatabaseimporter-data.md)||||||| +|[Pivot](archive-pivot-data.md)||||||| +|[Redtail Speak](archive-redtailspeak-data.md)||||||| +|[Reuters Dealing](archive-reutersdealing-data.md)||||||| +|[Reuters Eikon](archive-reuterseikon-data.md)||||||| +|[Reuters FX](archive-reutersfx-data.md)||||||| +|[RingCentral](archive-ringcentral-data.md)||||||| +|[Salesforce Chatter](archive-salesforcechatter-data.md)||||||| +|[ServiceNow](archive-servicenow-data.md)||||||| +|[Skype for Business](archive-skypeforbusiness-data.md)||||||| +|[Slack eDiscovery](archive-slack-data.md)||||||| +|[Symphony](archive-symphony-data.md)||||||| +|[Text-delimited](archive-text-delimited-data.md)||||||| +|[Twitter](archive-veritas-twitter-data.md)||||||| +|[Webex Teams](archive-webexteams-data.md)||||||| +|[Webpages](archive-webpagecapture-data.md)||||||| +|[Workplace from Facebook](archive-workplacefromfacebook-data.md)||||||| +|[XIP](archive-xip-data.md)||||||| +|[XSLT/XML](archive-xslt-xml-data.md)||||||| +|[Yieldbroker](archive-yieldbroker-data.md)||||||| +|[YouTube](archive-youtube-data.md)||||||| +|[Zoom Meetings](archive-zoommeetings-data.md)||||||| +|||||||| ++### TeleMessage data connectors ++The table in this section lists the third-party data connectors available in partnership with TeleMessage. The table also summarizes the compliance solutions that you can apply to third-party data after you import and archive it in Microsoft 365. See the [Overview of compliance solutions that support third-party data](#overview-of-microsoft-purview-solutions-that-support-third-party-data) section for a more detailed description of each compliance solution and how it supports third-party data. ++Before you can archive third-party data in Microsoft 365, you have to work with TeleMessage to set up their archiving service for your organization. For more information, select the link in the **Third-party data** column to go the step-by-step instructions for creating a connector for that data type. ++TeleMessage data connectors are also available in GCC environments in the Microsoft 365 US Government cloud. For more information, see the [Data connectors in the US Government cloud](#data-connectors-in-the-us-government-cloud) section in this article. ++|**Third-party data**|**Litigation hold**|**eDiscovery**|**Retention settings**|**Records management**|**Communication compliance**|**Insider risk management**| +|:|::|::|::|::|::|::| +|[Android](archive-android-archiver-data.md)||||||| +|[AT&T Network](archive-att-network-archiver-data.md)||||||| +|[Bell Network](archive-bell-network-data.md)||||||| +|[Enterprise Number](archive-enterprise-number-data.md)||||||| +|[O2 Network](archive-o2-network-data.md)||||||| +|[Rogers Network](archive-rogers-network-archiver-data.md)||||||| +|[Signal](archive-signal-archiver-data.md)||||||| +|[Telegram](archive-telegram-archiver-data.md)||||||| +|[TELUS Network](archive-telus-network-data.md)||||||| +|[Verizon Network](archive-verizon-network-data.md)||||||| +|[WeChat](archive-wechat-data.md)||||||| +|[WhatsApp](archive-whatsapp-data.md)||||||| +|||||||| ++### 17a-4 data connectors ++The table in this section lists the third-party data connectors available in partnership with 17a-4 LLC. The table also summarizes the compliance solutions that you can apply to third-party data after you import and archive it in Microsoft 365. See the [Overview of compliance solutions that support third-party data](#overview-of-microsoft-purview-solutions-that-support-third-party-data) section for a more detailed description of each compliance solution and how it supports third-party data. ++Before you can archive third-party data in Microsoft 365, you have to work with 17a-4 LLC to set up their archiving service (called *DataParser*) for your organization. For more information, select the link in the **Third-party data** column to go the step-by-step instructions for creating a connector for that data type. ++17a-4 data connectors are also available in GCC environments in the Microsoft 365 US Government cloud. For more information, see the [Data connectors in the US Government cloud](#data-connectors-in-the-us-government-cloud) section in this article. ++|**Third-party data**|**Litigation hold**|**eDiscovery**|**Retention settings**|**Records management**|**Communication compliance**|**Insider risk management**| +|:|::|::|::|::|::|::| +|[BlackBerry](archive-17a-4-blackberry-data.md)||||||| +|[Bloomberg](archive-17a-4-bloomberg-data.md)||||||| +|[Cisco Jabber](archive-17a-4-cisco-jabber-data.md)||||||| +|[Cisco Webex](archive-17a-4-webex-teams-data.md)||||||| +|[FactSet](archive-17a-4-factset-data.md)||||||| +|[Fuze](archive-17a-4-fuze-data.md)||||||| +|[FX Connect](archive-17a-4-fxconnect-data.md)||||||| +|[ICE Chat](archive-17a-4-ice-im-data.md)||||||| +|[InvestEdge](archive-17a-4-investedge-data.md)||||||| +|[LivePerson Conversational Cloud](archive-17a-4-liveperson-data.md)||||||| +|[Quip](archive-17a-4-quip-data.md)||||||| +|[Refinitiv Eikon Messenger](archive-17a-4-refinitiv-messenger-data.md)||||||| +|[ServiceNow](archive-17a-4-servicenow-data.md)||||||| +[Skype for Business Server](archive-17a-4-skype-for-business-server-data.md)||||||| +|[Slack](archive-17a-4-slack-data.md)||||||| +|[SQL](archive-17a-4-sql-database-data.md)||||||| +|[Symphony](archive-17a-4-symphony-data.md)||||||| +|[Zoom](archive-17a-4-zoom-data.md)||||||| +|||||||| ++### CellTrust data connectors ++The table in this section lists the third-party data connector available in partnership with CellTrust. The table also summarizes the compliance solutions that you can apply to third-party data after you import and archive it in Microsoft 365. See the [Overview of compliance solutions that support third-party data](#overview-of-microsoft-purview-solutions-that-support-third-party-data) section for a more detailed description of each compliance solution and how it supports third-party data. ++Before you can archive third-party data in Microsoft 365, you have to work with CellTrust to set up their archiving service (called *CellTrust SL2*) for your organization. For more information, select the link in the **Third-party data** column to go the step-by-step instructions for creating a CellTrust SL2 connector. ++|**Third-party data**|**Litigation hold**|**eDiscovery**|**Retention settings**|**Records management**|**Communication compliance**|**Insider risk management**| +|:|::|::|::|::|::|::| +|[CellTrust SL2](archive-data-from-celltrustsl2.md)||||||| +|||||||| ++The CellTrust SL2 data connector is also available in GCC environments in the Microsoft 365 US Government cloud. For more information, see the [Data connectors in the US Government cloud](#data-connectors-in-the-us-government-cloud) section in this article. ++## Overview of Microsoft Purview solutions that support third-party data ++The following sections describe some of the things that the Microsoft Purview solutions can help you to manage the third-party data listed in the previous table. ++### Litigation hold ++You place a [Litigation hold](ediscovery-create-a-litigation-hold.md) on a user mailbox to retain third-party data. When you create a hold, you can specify a hold duration (also called a *time-based hold*) so that deleted and modified third-party data is retained for a specified period and then permanently deleted from the mailbox. Or you can just retain content indefinitely (called an *infinite hold*) or until the Litigation hold is removed. ++### eDiscovery ++The three primary eDiscovery tools in Microsoft 365 are Content search, Microsoft Purview eDiscovery (Standard), and Microsoft Purview eDiscovery (Premium). ++- **[Content search](ediscovery-content-search.md).** You can use the content search tool to search mailboxes for third-party data that you imported. You can use search queries and conditions to narrow your search results, and the export the search results. +- **[eDiscovery (Standard)](ediscovery-standard-get-started.md).** This tool builds on the basic search and export functionality by enabling you to create cases that let you control who can access case data, place a hold on user mailboxes or mailbox content that matches search criteria. That means you can place an eDiscovery hold on the third-party data that was imported to user mailboxes. +- **[eDiscovery (Premium)](ediscovery-overview.md).** This powerful tool expands the case functionality of eDiscovery (Standard) by letting you add custodians to a case, placing custodian's data on hold, and then loading a custodian's third-party data into a review for further analysis such as themes and duplicate detection. After you load third-party data into a review set, you can query and filter it to a narrow result set. Both eDiscovery (Standard) and eDiscovery (Premium) let you manage third-party data that may be relevant to your organization's legal or internal investigations. ++### Retention settings ++You can apply a [retention policy](retention.md) to user mailboxes to retain and then delete third-party data (and other mailbox content) after retention period expires. You can also use retention policies to delete third-party data of a certain age or [use retention labels to trigger a disposition review](disposition.md) when the retention period for third-party data expires. ++### Records management ++The [records management](records-management.md) feature in Microsoft 365 lets you declare third-party data as a record. This can be done manually by users who apply a retention label that marks third-party data in their mailbox as record. Or you can auto-apply retention labels by identifying sensitive information, keywords, or content types in third-party data. ++### Communication compliance ++You can use [Communication compliance](communication-compliance.md) to examine third-party data to make sure it's compliant with your organization's data standards. You can do this by you detecting, capturing, and taking remediation actions for inappropriate messages in your organization. For example, you can monitor the third-party data that you import for offensive language, sensitive information, and regulatory compliance. ++### Insider risk management ++Signals from third-party data, like selective HR data, can be used by the [Insider risk management](insider-risk-management.md) solution to minimize internal risks by letting you to detect, investigate, and act on risky activities in your organization. For example, data imported by the HR data connector is used as risk indicators to help detect departing employee data theft. ++## Using eDiscovery tools to search for third-party data ++After you use data connectors to import and archive third-party data in user mailboxes, you can use Microsoft 365 eDiscovery tools to search for third-party data. You can also eDiscovery tools to create query-based holds associated with eDiscovery (Standard) and eDiscovery (Premium) cases to preserve third-party data. For more information about eDiscovery tools, see [eDiscovery solutions in Microsoft 365](ediscovery.md). ++To search for (or place a hold on) any type of third-party data that you've imported to user mailboxes using a data connector, you can use the following search query. Be sure to scope the search to user mailboxes. ++```powershell +kind:externaldata +``` ++You can use this query in the **Keywords** box for a Content search, a search associated with a eDiscovery (Standard) case, or a collection in eDiscovery (Premium). ++ ++You can also use the `kind:externaldata` property:value pair to narrow the scope of searches to third-party data. For example, to search for items imported from any third-party data source that contain the word *contoso* in the **Subject** property of the imported item, use the following query in the **Keywords** box: ++```powershell +subject:contoso AND kind:externaldata +``` ++Alternatively, you can use the **Message kind** condition to configure the same query. ++ ++To search for a specific type of archived third-party data, use the **itemclass** mailbox property in a search query. Use the following property:value format: ++```powershell +itemclass:ipm.externaldata.<third-party data type> +``` ++Every item imported by a third-party data connector includes the **itemclass** property with a value that corresponds to the third-party data type. For example, to search for Facebook data that contains the word *contoso*, in the **Subject** property of the imported item, use the following query: ++```powershell +subject:contoso AND itemclass:ipm.externaldata.facebook* +``` ++Here are a few examples for **itemclass** values for different types of third-party data. ++| **Third-party data type** | **Value for itemclass property** | +||-| +| Bloomberg Message | ipm.externaldata.bloombergmessage* | +| CellTrust | ipm.externaldata.celltrust* | +| Pivot | ipm.externaldata.pivot* | +| WhatsApp Archiver | ipm.externaldata.whatsapparchiver* | +||| ++Values for the *itemclass* property aren't case-sensitive. In general, use the name of the third-party data type (without spaces) followed by a wildcard ( * ) character. ++For more information about creating eDiscovery search queries, see [Keyword queries and search conditions for eDiscovery](ediscovery-keyword-queries-and-search-conditions.md). ++## Data connectors in the US Government cloud ++Some data connectors are available in the US Government cloud. The following sections indicate the specific government environments that support third-party data connectors. For more information about US Government clouds, see [Microsoft 365 US Government](/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/microsoft-365-government-how-to-buy). ++### Veritas data connectors in the US Government cloud (preview) ++|Data connector |GCC |GCC High |DoD | +|:|::|::|::| +|CellTrust| Yes | No | No | +|Cisco Jabber on MS SQL| Yes | No | No | +|Cisco Jabber on Oracle| Yes | No | No | +|Cisco Jabber on PostgreSQL| Yes | No | No | +|EML| Yes | No | No | +|FX Connect| Yes | No | No | +|Jive| Yes | No | No | +|MS SQL Database| Yes | No | No | +|Pivot| Yes | No | No | +|Redtail Speak| Yes | No | No | +|Reuters Dealing| Yes | No | No | +|Reuters Eikon| Yes | No | No | +|Reuters FX| Yes | No | No | +|RingCentral| Yes | No | No | +|Salesforce Chatter| Yes | No | No | +|ServiceNow| Yes | No | No | +|Skype for Business| Yes | No | No | +|Slack eDiscovery| Yes | No | No | +|Symphony| Yes | No | No | +|Text-delimited| Yes | No | No | +|Twitter| Yes | No | No | +|Webex Teams| Yes | No | No | +|Webpages| Yes | No | No | +|Workplace from Facebook| Yes | No | No | +|XIP| Yes | No | No | +|XSLT/XML| Yes | No | No | +|Yieldbroker| Yes | No | No | +|YouTube| No | No | No | +|Zoom Meetings| Yes | No | No | +||||| ++### TeleMessage data connectors in the US Government cloud ++|Data connector |GCC |GCC High |DoD | +|:|::|::|::| +|Android Archiver | Yes | No | No | +|AT&T SMS/MMS Network Archiver | Yes | No | No | +|Bell SMS/MMS Network Archiver | Yes | No | No | +|Enterprise Number Archiver | Yes | No | No | +|O2 SMS and Voice Network Archiver | Yes | No | No | +|Rogers Network Archiver | Yes | No | No | +|Signal Archiver | Yes | No | No | +|Telegram Archiver | Yes | No | No | +|TELUS SMS Network Archiver | Yes | No | No | +|Verizon SMS/MMS Network Archiver | Yes | No | No | +|WeChat Archiver | Yes | No | No | +|WhatsApp Archiver | Yes | No | No | +||||| ++### 17a-4 data connectors in the US Government cloud ++|Data connector |GCC |GCC High |DoD | +|:|::|::|::| +|BlackBerry DataParser | Yes | No | No | +|Bloomberg DataParser | Yes | No | No | +|Cisco Jabber DataParser | Yes | No | No | +|Cisco Webex DataParser | Yes | No | No | +|FactSet DataParser | Yes | No | No | +|Fuze DataParser | Yes | No | No | +|FX Connect DataParser | Yes | No | No | +|ICE DataParser | Yes | No | No | +|InvestEdge DataParser | Yes | No | No | +|LivePerson Conversational Cloud DataParser | Yes | No | No | +|Quip DataParser | Yes | No | No | +|Refinitiv Eikon Messenger DataParser | Yes | No | No | +|ServiceNow DataParser | Yes | No | No | +|Skype for Business Server DataParser | Yes | No | No | +|Slack DataParser | Yes | No | No | +|SQL DataParser | Yes | No | No | +|Symphony DataParser | Yes | No | No | +|Zoom DataParser | Yes | No | No | +||||| ++### CellTrust data connectors in the US Government cloud ++|Data connector |GCC |GCC High |DoD | +|:|::|::|::| +|CellTrust SL2 | Yes | No | No | +||||| ++## Working with a Microsoft partner to archive third-party data ++Another option for importing and archiving third-party data is for your organization to work with a Microsoft Partner. If a third-party data type isn't supported by the data connectors available in the compliance portal, you can work with a partner who can provide a custom connector that will be configured to extract items from the third-party data source regularly and then connect to the Microsoft cloud by a third-party API and import those items to Microsoft 365. The partner connector also converts the content of an item from the third-party data source to an email message and then imports it to a mailbox in Microsoft 365. ++For a list of partners that you can work with and the step-by-step process for this method, see [Work with a partner to archive third-party data in Microsoft 365](archive-partner-third-party-data.md). |
| compliance | Archive Twitter Data With Sample Connector | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/archive-twitter-data-with-sample-connector.md | Complete the following prerequisites before you can set up and configure a conne The first step is to register a new app in Azure Active Directory (AAD). This app corresponds to the web app resource that you implement in Step 2 for the Twitter connector. -For step-by-step instructions, see [Create an app in Azure Active Directory](deploy-twitter-connector.md#step-1-create-an-app-in-azure-active-directory). +For step-by-step instructions, see [Create an app in Azure Active Directory](archive-twitter-data.md#step-1-create-an-app-in-azure-active-directory). During the completion of this step (by following the step-by-step instructions), you'll save the following information to a text file. These values will be used in later steps in the deployment process. To deploy the source code for the Twitter connector app: 2. Select **Deploy to Azure**. -For step-by-step instructions, see [Deploy the connector web service from GitHub to your Azure account](deploy-twitter-connector.md#step-2-deploy-the-connector-web-service-from-github-to-your-azure-account). +For step-by-step instructions, see [Deploy the connector web service from GitHub to your Azure account](archive-twitter-data.md#step-2-deploy-the-connector-web-service-from-github-to-your-azure-account). While you follow the step-by-step instructions to complete this step, you provide the following information After completing this step, be sure to copy the app Service URL (for example, `h The next step is to create and configure a developer app on Twitter. The custom connector that you create in Step 7 uses the Twitter app to interact with the Twitter API to obtain data from your organization's Twitter account. -For step-by-step instructions, see [Create the Twitter app](deploy-twitter-connector.md#step-3-create-the-twitter-app). +For step-by-step instructions, see [Create the Twitter app](archive-twitter-data.md#step-3-create-the-twitter-app). During the completion of this step (by following the step-by-step instructions), you save the following information to a text file. These values will be used to configure the Twitter connector app in Step 4. During the completion of this step (by following the step-by-step instructions), The next step is to add configurations settings to the Twitter connector app that you deployed in Step 2. You do this by going to the home page of your connector app and configuring it. -For step-by-step instructions, see [Configure the connector web app](deploy-twitter-connector.md#step-4-configure-the-connector-web-app). +For step-by-step instructions, see [Configure the connector web app](archive-twitter-data.md#step-4-configure-the-connector-web-app). During the completion of this step (by following the step-by-step instructions), you'll provide the following information (that you've copied to a text file after completing the previous steps): During the completion of this step (by following the step-by-step instructions), The final step is to set up the Twitter connector in the compliance portal that will import data from your organization's Twitter account to a specified mailbox in Microsoft 365. After you complete this step, the Microsoft 365 Import service will start importing data from your organization's Twitter account to Microsoft 365. -For step-by-step instructions, see [Set up a Twitter connector in the Microsoft Purview compliance portal](deploy-twitter-connector.md#step-5-set-up-a-twitter-connector-in-the-compliance-portal). +For step-by-step instructions, see [Set up a Twitter connector in the Microsoft Purview compliance portal](archive-twitter-data.md#step-5-set-up-a-twitter-connector-in-the-compliance-portal). During the completion of this step (by following the step-by-step instructions), you'll provide the following information (that you've copied to a text file after completing the steps). |
| compliance | Archive Twitter Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/archive-twitter-data.md | + + Title: "Deploy a connector to archive Twitter data" +description: "Administrators can set up a native connector to import and archive Twitter data to Microsoft 365. After this data is imported to Microsoft 365, you can use compliance features such as legal hold, content search, and retention policies to manage the governance of your organization's Twitter data." +f1.keywords: +- NOCSH +++ Last updated : 01/01/2023+audience: Admin +++ms.localizationpriority: medium +search.appverid: +- MET150 ++- tier3 +- purview-compliance +- data-connectors +++++# Deploy a connector to archive Twitter data ++This article contains the step-by-step process to deploy a connector that uses the Office 365 Import service to import data from your organization's Twitter account to Microsoft 365. For a high-level overview of this process and a list of prerequisites required to deploy a Twitter connector, see [Set up a connector to archive Twitter data ](archive-twitter-data-with-sample-connector.md). +++## Step 1: Create an app in Azure Active Directory ++1. Go to <https://portal.azure.com> and sign in using the credentials of a global admin account. ++  ++2. In the left navigation pane, select **Azure Active Directory**. ++  ++3. In the left navigation pane, select **App registrations (Preview)** and then select **New registration**. ++  ++4. Register the application. Under **Redirect URI (optional)**, select **Web** in the application type dropdown list and then type `https://portal.azure.com` in the box for the URI. ++  ++5. Copy the **Application (client) ID** and **Directory (tenant) ID** and save them to a text file or other safe location. You use these IDs in later steps. ++  ++6. Go to **Certificates & secrets for the new app** and under **Client secrets** select **New client secret**. ++  ++7. Create a new secret. In the description box, type the secret and then choose an expiration period. ++  ++8. Copy the value of the secret and save it to a text file or other storage location. This is the AAD application secret that you use in later steps. ++  +++## Step 2: Deploy the connector web service from GitHub to your Azure account ++1. Go to [this GitHub site](https://github.com/microsoft/m365-sample-twitter-connector-csharp-aspnet) and select **Deploy to Azure**. ++  ++2. After you select **Deploy to Azure**, you will be redirected to an Azure portal with a custom template page. Fill in the **Basics** and **Settings** details and then select **Purchase**. ++  ++ - **Subscription:** Select your Azure subscription that you want to deploy the Twitter connector web service to. ++ - **Resource group:** Choose or create a new resource group. A resource group is a container that holds related resources for an Azure solution. ++ - **Location:** Choose a location. ++ - **Web App Name:** Provide a unique name for the connector web app. Th name must be between 3 and 18 characters in length. This name is used to create the Azure app service URL; for example, if you provide the Web app name of **twitterconnector** then the Azure app service URL will be **twitterconnector.azurewebsites.net**. ++ - **tenantId:** The tenant ID of your Microsoft 365 organization that you copied after creating the Facebook connector app in Azure Active Directory in Step 1. ++ - **APISecretKey:** You can type any value as the secret. This is used to access the connector web app in Step 5. ++3. After the deployment is successful, the page will look similar to the following screenshot: ++  ++## Step 3: Create the Twitter app ++1. Go to https://developer.twitter.com, log in using the credentials for the developer account for your organization, and then select **Apps**. ++  +2. Select **Create an app**. ++  ++3. Under **App details**, add information about the application. ++  ++4. On the Twitter developer dashboard, select the app that you just created and then select **Details**. ++  ++5. On the **Keys and tokens** tab, under **Consumer API keys** copy both the API Key and the API secret key and save them to a text file or other storage location. Then select **Create** to generate an access token and access token secret and copy these to a text file or other storage location. ++  ++ Then select **Create** to generate an access token and an access token secret, and copy these to a text file or other storage location. ++6. Select the **Permissions** tab and configure the permissions as shown in the following screenshot: ++  ++7. After you save the permission settings, select the **App details** tab, and then select **Edit > Edit details**. ++  ++8. Do the following tasks: ++ - Select the checkbox to allow the connector app to sign in to Twitter. ++ - Add the OAuth redirect Uri using the following format: **\<connectorserviceuri>/Views/TwitterOAuth**, where the value of *connectorserviceuri* is the Azure app service URL for your organization; for example, https://twitterconnector.azurewebsites.net/Views/TwitterOAuth. ++  ++The Twitter developer app is now ready to use. ++## Step 4: Configure the connector web app ++1. Go to https://\<AzureAppResourceName>.azurewebsites.net (where **AzureAppResourceName** is the name of your Azure app resource that you named in Step 4). For example, if the name is **twitterconnector**, go to https://twitterconnector.azurewebsites.net. The home page of the app looks like the following screenshot: ++  ++2. Select **Configure** to display a sign in page. ++  ++3. In the Tenant Id box, type or paste your tenant Id (that you obtained in Step 2). In the password box, type or paste the APISecretKey (that you obtained in Step 2), and then select **Set Configuration Settings** to display the configuration details page. ++  ++4. Enter the following configuration settings ++ - **Twitter Api Key:** The API key for the Twitter application that you created in Step 3. ++ - **Twitter Api Secret Key:** The API secret key for the Twitter application that you created in Step 3. ++ - **Twitter Access Token:** The access token that you created in Step 3. ++ - **Twitter Access Token Secret:** The access token secret that you created in Step 3. ++ - **AAD Application ID:** The application ID for the Azure Active Directory app that you created in Step 1 ++ - **AAD Application Secret:** The value for the APISecretKey secret that you created in Step 1. ++5. Select **Save** to save the connector settings. ++## Step 5: Set up a Twitter connector in the compliance portal ++1. Go to the Microsoft Purview compliance portal, and select <a href="https://go.microsoft.com/fwlink/p/?linkid=2173865" target="_blank">**Data connectors** page</a. ++2. On the **Data connectors** page under **Twitter**, select **View**. ++3. On the **Twitter** page, select **Add connector**. ++4. On the **Terms of service** page, select **Accept**. ++5. On the **Add credentials for your connector app** page, enter the following information and then select **Validate connection**. ++  ++ - In the **Name** box, type a name for the connector, such as **Twitter help handle**. ++ - In the **Connector URL** box, type or paste the Azure app service URL; for example `https://twitterconnector.azurewebsites.net`. ++ - In the **Password** box, type or paste the value of the APISecretKey that you created in Step 2. ++ - In the **Azure App ID** box, type or paste the value of the Azure Application App Id (also called the *client ID*) that you obtained in Step 1. ++6. After the connection is successfully validated, select **Next**. ++7. On the **Authorize Microsoft 365 to import data** page, type or paste the APISecretKey again and then select **Login web app**. ++8. Select **Login with Twitter**. ++9. On the Twitter sign in page, sign in using the credentials for your organization's Twitter account. ++  ++ After you sign in, the Twitter page will display the following message, "Twitter Connector Job Successfully set up." ++10. Select **Continue** to complete setting up the Twitter connector. ++11. On the **Set filters** page, you can apply a filter to initially import items that are a certain age. Select an age, and then select **Next**. ++12. On the **Choose storage location** page, type the email address of Microsoft 365 mailbox that the Twitter items will be imported to, and then select **Next**. ++13. Select **Next** to review the connector settings and then select **Finish** to complete the connector setup. ++14. In the compliance center, go to the **Data connectors** page, and select the **Connectors** tab to see the progress of the import process. |
| compliance | Communication Compliance Channels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-channels.md | Yammer must be configured in [Native Mode](/yammer/configure-your-yammer-network ## Third-party sources -You can analyze communications for data imported into all mailboxes in your Microsoft 365 organization from third-party sources like [Instant Bloomberg](/microsoft-365/compliance/archive-instant-bloomberg-data), [Slack](/microsoft-365/compliance/archive-slack-data), [Zoom](/microsoft-365/compliance/archive-zoommeetings-data), SMS, and many others. For a full list of connectors supported in communication compliance, see [Learn about connectors for third-party data](/microsoft-365/compliance/archiving-third-party-data). +You can analyze communications for data imported into all mailboxes in your Microsoft 365 organization from third-party sources like [Instant Bloomberg](/microsoft-365/compliance/archive-instant-bloomberg-data), [Slack](/microsoft-365/compliance/archive-slack-data), [Zoom](/microsoft-365/compliance/archive-zoommeetings-data), SMS, and many others. For a full list of connectors supported in communication compliance, see [Learn about connectors for third-party data](/microsoft-365/compliance/archive-third-party-data). -You must configure a [third-party connector](/microsoft-365/compliance/archiving-third-party-data) for your Microsoft 365 organization before you can assign the connector to a communication compliance policy. The **Third-Party Sources** section of the communication compliance policy wizard only displays currently configured third-party connectors. +You must configure a [third-party connector](/microsoft-365/compliance/archive-third-party-data) for your Microsoft 365 organization before you can assign the connector to a communication compliance policy. The **Third-Party Sources** section of the communication compliance policy wizard only displays currently configured third-party connectors. ## Channel limits |
| compliance | Communication Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance.md | Communication compliance policies check, detect, and capture messages across sev - **Microsoft Teams**: Chat communications for public and private [Microsoft Teams](/MicrosoftTeams/Teams-overview) channels and individual chats are supported in communication compliance as a standalone channel source or with other Microsoft 365 services. You'll need to manually add individual users, distribution groups, or specific Microsoft Teams channels when you select users and groups to apply a communication compliance policy to. Teams users can also self-report potentially inappropriate messages in private and group channels and chats for review and remediation. - **Exchange Online**: All mailboxes hosted on [Exchange Online](/Exchange/exchange-online) in your Microsoft 365 organization are eligible for analyses. Emails and attachments matching communication compliance policy conditions are instantly available for investigation and in compliance reports. Exchange Online is now an optional source channel and is no longer required in communication compliance policies. - **Yammer**: Private messages and public community conversations in [Yammer](/yammer/yammer-landing-page) are supported in communication compliance policies. Yammer is an optional channel and must be in [native mode](/yammer/configure-your-yammer-network/overview-native-mode) to support checking of messages and attachments.-- **Third-party sources**: You can check messages from [third-party sources](/microsoft-365/compliance/archiving-third-party-data) for data imported into mailboxes in your Microsoft 365 organization. Communication compliance supports connections to several popular platforms, including Instant Bloomberg and others.+- **Third-party sources**: You can check messages from [third-party sources](/microsoft-365/compliance/archive-third-party-data) for data imported into mailboxes in your Microsoft 365 organization. Communication compliance supports connections to several popular platforms, including Instant Bloomberg and others. To learn more about messaging channel support in communication compliance policies, see [Detect channel signals with communication compliance](/microsoft-365/compliance/communication-compliance-channels). |
| compliance | Compliance Extensibility | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-extensibility.md | There are two key building blocks for compliance extensibility: ## Data connectors -Microsoft provides third-party data connectors that can be configured in the Microsoft Purview compliance portal. For a list of data connectors provided by Microsoft, see the [Third-party data connectors](archiving-third-party-data.md#third-party-data-connectors) table. The table of third-party data connectors also summarizes the compliance solutions that you can apply to third-party data after you import and archive data in Microsoft 365, and links to the step-by-step instructions for each connector. +Microsoft provides third-party data connectors that can be configured in the Microsoft Purview compliance portal. For a list of data connectors provided by Microsoft, see the [Third-party data connectors](archive-third-party-data.md#third-party-data-connectors) table. The table of third-party data connectors also summarizes the compliance solutions that you can apply to third-party data after you import and archive data in Microsoft 365, and links to the step-by-step instructions for each connector. -To learn more about Microsoft Purview Data Connectors, see [Archiving third-party data](archiving-third-party-data.md). If a third-party data type isn't supported by the data connectors available in the compliance portal, you can work with a partner who can provide you with a custom connector. For a list of partners you can work with and the step-by-step process for this method, see [Work with a partner to archive third-party data](work-with-partner-to-archive-third-party-data.md). +To learn more about Microsoft Purview Data Connectors, see [Archiving third-party data](archive-third-party-data.md). If a third-party data type isn't supported by the data connectors available in the compliance portal, you can work with a partner who can provide you with a custom connector. For a list of partners you can work with and the step-by-step process for this method, see [Work with a partner to archive third-party data](archive-partner-third-party-data.md). ### Prerequisites for data connectors |
| compliance | Dlp Configure Endpoint Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-configure-endpoint-settings.md | To prevent sensitive items from being synced to the cloud by cloud sync apps, li When enabled, Auto-quarantine kicks in when an unallowed app attempts to access a DLP protected sensitive item. Auto-quarantine moves the sensitive item to an admin configured folder and can leave a placeholder **.txt** file in the place of the original. You can configure the text in the placeholder file to tell users where the item was moved to and other pertinent information. -You can use auto-quarantine to prevent an endless chain of DLP notifications for the user and adminsΓÇösee [Scenario 4: Avoid looping DLP notifications from cloud synchronization apps with auto-quarantine (preview)](endpoint-dlp-using.md#scenario-4-avoid-looping-dlp-notifications-from-cloud-synchronization-apps-with-auto-quarantine-preview). +You can use auto-quarantine to prevent an endless chain of DLP notifications for the user and adminsΓÇösee [Scenario 4: Avoid looping DLP notifications from cloud synchronization apps with auto-quarantine](endpoint-dlp-using.md#scenario-4-avoid-looping-dlp-notifications-from-cloud-synchronization-apps-with-auto-quarantine). ### Unallowed Bluetooth apps You can assign these policy actions to the group in a DLP policy: 1. Add other printers as needed. 1. Select **Close**. -The most common use case is to use printers groups as an allowlist as in the above example for allowing the printing of contracts only to printers that are in the legal department. After you define a printer group here, it's available to be used in your policies that are scoped to **Devices**. See, [Scenario 7 Authorization groups](endpoint-dlp-using.md#scenario-7-authorization-groups-preview) for more information on configuring policy actions to use authorization groups. +The most common use case is to use printers groups as an allowlist as in the above example for allowing the printing of contracts only to printers that are in the legal department. After you define a printer group here, it's available to be used in your policies that are scoped to **Devices**. See, [Scenario 7 Authorization groups](endpoint-dlp-using.md#scenario-7-authorization-groups) for more information on configuring policy actions to use authorization groups. ### Removable storage device groups You can assign these policy actions to the group in a DLP policy: 1. Add other devices to the group as needed. 1. Select **Close**. -The most common use case is to use removable storage devices groups as an allowlist as in the above example for allowing the copying of files only to devices that are in the **Backup** group. After you define a removable storage device group here, it's available to be used in your policies that are scoped to **Devices**. See, [Scenario 7 Authorization groups](endpoint-dlp-using.md#scenario-7-authorization-groups-preview) for more information on configuring policy actions to use authorization groups. While scenario 7 uses printer authorization groups as an example, the principles are identical. The only thing that changes are the names of the groups and the actions you select. +The most common use case is to use removable storage devices groups as an allowlist as in the above example for allowing the copying of files only to devices that are in the **Backup** group. After you define a removable storage device group here, it's available to be used in your policies that are scoped to **Devices**. See, [Scenario 7 Authorization groups](endpoint-dlp-using.md#scenario-7-authorization-groups) for more information on configuring policy actions to use authorization groups. While scenario 7 uses printer authorization groups as an example, the principles are identical. The only thing that changes are the names of the groups and the actions you select. ### Network share groups You can assign these policy actions to the group in a DLP policy: 1. Select **Close**. -The most common use case is to use network share group as an allowlist as in the above example for allowing users to save or copy protected files only to the network shares that are defined in the group. After you define a networks share group here, it's available to be used in your policies that are scoped to **Devices**. See, [Scenario 7 Authorization groups](endpoint-dlp-using.md#scenario-7-authorization-groups-preview) for more information on configuring policy actions to use authorization groups. +The most common use case is to use network share group as an allowlist as in the above example for allowing users to save or copy protected files only to the network shares that are defined in the group. After you define a networks share group here, it's available to be used in your policies that are scoped to **Devices**. See, [Scenario 7 Authorization groups](endpoint-dlp-using.md#scenario-7-authorization-groups) for more information on configuring policy actions to use authorization groups. ### VPN settings |
| compliance | Ediscovery Limits For Content Search | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery-limits-for-content-search.md | f1.keywords: Previously updated : 03/27/2023 Last updated : 04/07/2023 audience: Admin For limits related to the Microsoft Purview eDiscovery (Premium) tool, see [Limi The following table lists the search limits when using the content search tool in the compliance portal and for searches that are associated with a Microsoft Purview eDiscovery (Standard) case. -<br> --**** --|Description of limit|Limit| -||| +|**Description of limit**|**Limit**| +|:--|:--| |The maximum number of mailboxes or sites that can be searched in a single search|No limit <sup>1</sup>| |The maximum number of items found in all user mailboxes that can possibly be displayed on the preview page when previewing search results. The newest items are displayed.|1,000 <sup>2</sup>| |The maximum number of user mailboxes that can be previewed for search results. If there are more than 1000 mailboxes that contain content that matches the search query, at most, only the top 1000 mailboxes with the most search results will be available for preview.|1,000| The following table lists the search limits when using the content search tool i |The maximum number of items found in all public folder mailboxes that are displayed on the preview page when previewing content search results.|200| |The maximum number of public folder mailboxes that can be previewed for search results. If there are more than 500 public folder mailboxes that contain content that matches the search query, only the top 500 public folder mailboxes with the most search results will be available for preview.|500| |The maximum size of an item that can be viewed on the preview page.|10,000,000 bytes (approximately 9.5 MB)|-|The maximum number of characters for the search query (including operators and conditions) for a search. <p> **Note:** This limit takes effect after the query is expanded and includes characters from the keyword query, any search permissions filters applied to the user, and the URLs of all site locations. This means the query will get expanded against each of the keywords. For example, if a search query has 15 keywords and additional parameters and conditions, the query gets expanded 15 times, each with the other parameters and conditions in the query. So even though the number of characters in the search query may be below the limit, it's the expanded query that may contribute to exceeding this limit.|**Mailboxes:** 10,000. <p> **Sites:** 4,000 when searching all sites or 2,000 when searching up to 20 sites. <sup>3</sup>| +|The maximum number of characters for the search query (including operators and conditions) for a search.|**Mailboxes:** 10,000. <p> **Sites:** 4,000 when searching all sites or 2,000 when searching up to 20 sites. <sup>3</sup>| |The maximum number of variants returned when using a prefix wildcard to search for an exact phrase in a search query or when using a prefix wildcard and the **NEAR** Boolean operator.|10,000 <sup>4</sup>| |The minimum number of alpha characters for prefix wildcards; for example, `time*`, `one*`, or `set*`.|3| |The maximum number of mailboxes in a search that you can delete items in by doing a "search and purge" action (by using the **New-ComplianceSearchAction -Purge** command). If the search that you're doing a purge action for has more source mailboxes than this limit, the purge action will fail. For more information about search and purge, see [Search for and delete email messages in your organization](search-for-and-delete-messages-in-your-organization.md).|50,000| The following table lists the search limits when using the content search tool i > [!NOTE] > <sup>1</sup> Although you can search an unlimited number of mailboxes in a single search, you can only download the exported search results from a maximum of 100,000 mailboxes using the eDiscovery Export Tool in the compliance portal. >-> <sup>2</sup> The intent of the preview page is to show a limited sample of the results. Even for massive searches with thousands of results, the number of items that are shown on the preview page can, and often will, be much less than maximum possible value of 1000. To see the complete search results, you need to export the results. +> <sup>2</sup> The intent of the preview page is to show a limited sample of the results. Even for massive searches with thousands of results, the number of items shown on the preview page can, and often will, be much less than maximum possible value of 1000. To see the complete search results, you need to export the results. >-> <sup>3</sup> When searching SharePoint and OneDrive for Business locations, the characters in the URLs of the sites being searched are counted against this limit. +> <sup>3</sup> When searching SharePoint and OneDrive for Business locations, the characters in the URLs of the sites being searched are counted against this limit. This limit takes effect after the query is expanded and includes characters from the keyword query, any search permissions filters applied to the user, and the URLs of all site locations. This means the query will get expanded against each of the keywords. For example, if a search query has 15 keywords and additional parameters and conditions, the query gets expanded 15 times, each with the other parameters and conditions in the query. So even though the number of characters in the search query may be below the limit, it's the expanded query that may contribute to exceeding this limit. >-> <sup>4</sup> For non-phrase queries (a keyword value that doesn't use double quotation marks) we use a special prefix index. This tells us that a word occurs in a document, but not where it occurs in the document. To do a phrase query (a keyword value with double quotation marks), we need to compare the position within the document for the words in the phrase. This means that we can't use the prefix index for phrase queries. In this case, we internally expand the query with all possible words that the prefix expands to; for example, `"time*"` can expand to `"time OR timer OR times OR timex OR timeboxed OR ..."`. 10,000 is the maximum number of variants the word can expand to, not the number of documents matching the query. There is no upper limit for non-phrase terms. +> <sup>5</sup> For non-phrase queries (a keyword value that doesn't use double quotation marks) we use a special prefix index. This tells us that a word occurs in a document, but not where it occurs in the document. To do a phrase query (a keyword value with double quotation marks), we need to compare the position within the document for the words in the phrase. This means that we can't use the prefix index for phrase queries. In this case, we internally expand the query with all possible words that the prefix expands to; for example, `"time*"` can expand to `"time OR timer OR times OR timex OR timeboxed OR ..."`. 10,000 is the maximum number of variants the word can expand to, not the number of documents matching the query. There is no upper limit for non-phrase terms. ## Search times Microsoft collects performance information for searches run by all organizations. While the complexity of the search query can impact search times, the biggest factor that affects how long searches take is the number of mailboxes searched. Although Microsoft doesn't provide a Service Level Agreement for search times, the following table lists average search times for collection searches based on the number of mailboxes included in the search. -<br> --**** --|Number of mailboxes|Average search time| -||| +|**Number of mailboxes**|**Average search time**| +|:-|:-| |100|30 seconds| |1,000|45 seconds| |10,000|4 minutes| Microsoft collects performance information for searches run by all organizations The following table lists the limits when exporting the results of a content search. These limits also apply when you export content from an eDiscovery (Standard) case. -<br> --**** --|Description of limit|Limit| -||| -|Maximum amount of exportable data from a single search <p> **Note:** If the search results are larger than 2 TB, consider using date ranges, or other types of filters to decrease the total size of the search results.|2 TB| -|Maximum an organization can export in a single day <p> **Note:** This limit is reset daily at 12:00AM UTC|2 TB| +|**Description of limit**|**Limit**| +|:--|:--| +|Maximum amount of exportable data from a single search<sup>1</sup>|2 TB| +|Maximum an organization can export in a single day<sup>2</sup>|2 TB| |Maximum number of mailboxes for search results that can be downloaded using the eDiscovery Export Tool|100,000|-|Maximum size of PST file that can be exported <p> **Note:** If the search results from a user's mailbox are larger than 10 GB, the search results for the mailbox will be exported in two (or more) separate PST files. If you choose to export all search results in a single PST file, the PST file will be spilt into additional PST files if the total size of the search results is larger than 10 GB. If you want to change this default size, you can edit the Windows Registry on the computer that you use to export the search results. See [Change the size of PST files when exporting eDiscovery search results](ediscovery-change-the-size-of-pst-files-when-exporting-results.md). The search results from a specific mailbox won't be divided among multiple PST files unless the content from a single mailbox is more than 10 GB. If you chose to export the search results in one PST file for that contains all messages in a single folder and the search results are larger than 10 GB, the items are still organized in chronological order, so they'll be spilt into additional PST files based on the sent date.|10 GB| +|Maximum size of PST file that can be exported<sup>3</sup>|10 GB| +|Maximum number of exports or reports displayed in Content Search or eDiscovery cases|1,000| |Rate at which search results from mailboxes and sites are uploaded to a Microsoft-provided Azure Storage location.|Maximum of 2 GB per hour| +> [!NOTE] +> <sup>1</sup> If the search results are larger than 2 TB, consider using date ranges, or other types of filters to decrease the total size of the search results. +> +> <sup>2</sup> This limit is reset daily at 12:00AM UTC. +> +> <sup>3</sup> If the search results from a user's mailbox are larger than 10 GB, the search results for the mailbox will be exported in two (or more) separate PST files. If you choose to export all search results in a single PST file, the PST file will be spilt into additional PST files if the total size of the search results is larger than 10 GB. If you want to change this default size, you can edit the Windows Registry on the computer that you use to export the search results. See [Change the size of PST files when exporting eDiscovery search results](ediscovery-change-the-size-of-pst-files-when-exporting-results.md). The search results from a specific mailbox won't be divided among multiple PST files unless the content from a single mailbox is more than 10 GB. If you chose to export the search results in one PST file for that contains all messages in a single folder and the search results are larger than 10 GB, the items are still organized in chronological order, so they'll be spilt into additional PST files based on the sent date. + ## Indexing limits for email messages The following table describes the indexing limits that might result in an email message being returned as an unindexed item or a partially indexed item in the results of a content search. -<br> --**** --|Indexing limit|Maximum value|Description| -|||| -|Maximum attachment size|150 MB|The maximum size of an email attachment that will parse for indexing. Any attachment that's larger than this limit won't be parsed for indexing, and the message with the attachment will be marked as partially indexed. <p> **Note:** Parsing is the process where the indexing service extracts text from the attachment, removes unnecessary characters like punctuation and spaces, and then divides the text into words (in a process called tokenization), that are then stored in the index.| +|**Indexing limit**|**Maximum value**|**Description**| +|:--|:-|:--| +|Maximum attachment size <sup>1</sup>|150 MB|The maximum size of an email attachment that will parse for indexing. Any attachment that's larger than this limit won't be parsed for indexing, and the message with the attachment will be marked as partially indexed.| |Maximum number of attachments|250|The maximum number of files attached to an email message that will be parsed for indexing. If a message has more than 250 attachments, the first 250 attachments are parsed and indexed, and the message is marked as partially indexed because it had additional attachments that weren't parsed.| |Maximum attachment depth|30|The maximum number of nested attachments that are parsed. For example, if an email message has another message attached to it and the attached message has an attached Word document, the Word document and the attached message will be indexed. This behavior will continue for up to 30 nested attachments.| |Maximum number of attached images|0|An image that's attached to an email message is skipped by the parser and isn't indexed.| The following table describes the indexing limits that might result in an email |Maximum unique tokens in body|1 million|As previously explained, tokens are the result of extracting text from content, removing punctuation and spaces, and then dividing it into words (called tokens) that are stored in the index. For example, the phrase `"cat, mouse, bird, dog, dog"` contains 5 tokens. But only 4 of these are unique tokens. There's a limit of 1 million unique tokens per email message, which helps prevent the index from getting too large with random tokens.| ||| +> [!NOTE] +> <sup>1</sup> Parsing is the process where the indexing service extracts text from the attachment, removes unnecessary characters like punctuation and spaces, and then divides the text into words (in a process called tokenization), that are then stored in the index. + ## Jobs limits -|Description|Limit| -|:-|:-| +|**Description**|**Limit**| +|:--|:--| |Maximum number of concurrent jobs in your organization.|50| |Maximum number of concurrent jobs that a single user can start at the same time.|25| |Maximum number of concurrent tenant-wide jobs(for example, tenant-wide searches) in your organization.|5| |Maximum number of concurrent tenant-wide jobs(for example, tenant-wide searches) that a single user can start at one time.|5|-|Maximum number of jobs per day in your organization. <p> **Note:** This limit is reset daily at 12:00AM UTC|500| +|Maximum number of jobs per day in your organization.<sup>1</sup>|500| ++> [!NOTE] +> <sup>1</sup> This limit is reset daily at 12:00AM UTC. ## More information |
| compliance | Ediscovery Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery-overview.md | Native search and collection capabilities for data in Teams, Yammer, SharePoint - Reconstructs Teams conversations (instead of returning individual messages from conversations). - Collects cloud-based content shared with users by use of links or modern attachments in email message and Teams chats. - Has built-in support for hundreds of non-Microsoft 365 file types.-- Collects data from third-party sources (such as Bloomberg, Facebook, Slack, and Zoom Meetings) that's imported and archived in Microsoft 365 by [data connectors](archiving-third-party-data.md).+- Collects data from third-party sources (such as Bloomberg, Facebook, Slack, and Zoom Meetings) that's imported and archived in Microsoft 365 by [data connectors](archive-third-party-data.md). ### Manage eDiscovery workflow in one platform |
| compliance | Endpoint Dlp Using | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/endpoint-dlp-using.md | This scenario is for an unrestricted admin modifying a full directory policy. 1. Check Activity explorer for the event. -## Scenario 4: Avoid looping DLP notifications from cloud synchronization apps with auto-quarantine (preview) +## Scenario 4: Avoid looping DLP notifications from cloud synchronization apps with auto-quarantine This scenario is for an unrestricted admin creating a full directory policy. The user must be accessing the website through Microsoft Edge. 1. Finish configuring the rule and policy and apply it. -## Scenario 7 Authorization groups (preview) +## Scenario 7 Authorization groups This scenario is for an unrestricted admin creating a full directory policy. |
| compliance | Microsoft 365 Compliance Center | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/microsoft-365-compliance-center.md | In addition to links in cards on the home page, you'll see a navigation pane on |Navigation|Comments| |||-| <br> Manage retention and deletion of high-value items for business, legal, or regulatory record-keeping requirements.| +| <br> Manage retention and deletion of high-value items for business, legal, or regulatory record-keeping requirements.| ## How do I access the compliance portal? |
| compliance | Sensitivity Labels Aip | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-aip.md | The following configurations from the AIP add-in that aren't yet supported by bu - This option is currently rolling out in preview. For more information, see [Configure label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments). - [Oversharing popup messages for Outlook](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#implement-pop-up-messages-in-outlook-that-warn-justify-or-block-emails-being-sent)- - The equivalent of this configuration is now rolling out in preview. For more information, see the [migration playbook to configure oversharing popups](https://microsoft.github.io/ComplianceCxE/playbooks/AIP2MIP/Features/Collaboration/OversharingPopups/). + - The equivalent of this configuration is now available in preview as a DLP policy configuration. For more information, see [Scenario 2 Show policy tip as oversharing popup (preview)](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup-preview). - [Remove external content markings](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#remove-headers-and-footers-from-other-labeling-solution) |
| compliance | Use Content Search To Search Third Party Data That Was Imported | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/use-content-search-to-search-third-party-data-that-was-imported.md | -For more information about working with a partner to import third-party data and a list of the third-party data types that you can import to Microsoft 365, see [Work with a partner to archive third-party data in Office 365](work-with-partner-to-archive-third-party-data.md). +For more information about working with a partner to import third-party data and a list of the third-party data types that you can import to Microsoft 365, see [Work with a partner to archive third-party data in Office 365](archive-partner-third-party-data.md). > [!IMPORTANT]-> The guidance in this article only applies to third-party data that was imported by a custom partner connector. This article doesn't apply to third-party data that is imported by using the [third-party data connectors](archiving-third-party-data.md#third-party-data-connectors) in the Microsoft compliance center. +> The guidance in this article only applies to third-party data that was imported by a custom partner connector. This article doesn't apply to third-party data that is imported by using the [third-party data connectors](archive-third-party-data.md#third-party-data-connectors) in the Microsoft compliance center. [!INCLUDE [purview-preview](../includes/purview-preview.md)] To search (or place on hold) any type of third-party data that you've imported t kind:externaldata AND subject:contoso ``` -The previous keyword query example includes the subject property. For a list of other properties for third-party data items that can include in a keyword query, see the "More information" section in [Work with a partner to archive third-party data in Office 365](work-with-partner-to-archive-third-party-data.md#more-information). +The previous keyword query example includes the subject property. For a list of other properties for third-party data items that can include in a keyword query, see the "More information" section in [Work with a partner to archive third-party data in Office 365](archive-partner-third-party-data.md#more-information). When creating queries to search and hold third-party data, you can also use conditions to narrow the search results. For more information about creating Content Search queries, see [Keyword queries and search conditions for Content Search](ediscovery-keyword-queries-and-search-conditions.md). |
| frontline | Shifts Connector Blue Yonder Admin Center Manage | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/shifts-connector-blue-yonder-admin-center-manage.md | For a complete list of error messages and how to resolve them, see [List of erro You'll need to choose the data that your Shifts users can see and change. You'll be given the following options for these settings: -- **Shifts users will not see provider data**: Data won't sync between UKG Dimensions and Shifts. <br>-- **Shifts users can see provider data**: Data syncing is unidirectional from UKG Dimensions to Shifts. <br>-- **Shifts users can see and change provider data**: Data syncing is bidirectional between UKG Dimensions and Shifts.+- **Shifts users will not see provider data**: Data won't sync between Blue Yonder WFM and Shifts. <br> +- **Shifts users can see provider data**: Data syncing is unidirectional from Blue Yonder WFM to Shifts. <br> +- **Shifts users can see and change provider data**: Data syncing is bidirectional between Blue Yonder WFM and Shifts. > [!IMPORTANT] > Before you disable a feature by selecting the option **Shifts users will not see provider data**, be aware that: You'll need to choose the data that your Shifts users can see and change. You'll > - Swap requests: **Shifts users will not see provider data** > - Time off requests: **Shifts users will not see provider data** >-> After you edit your settings, make sure you follow the steps to [Disable open shifts, open shifts requests, swap requests, and time off requests.](/microsoft-365/frontline/shifts-connector-wizard-ukg#disable-open-shifts-open-shifts-requests-swap-requests-and-time-off-requests) +> After you edit your settings, make sure you follow the steps to [Disable open shifts, open shifts requests, swap requests, and time off requests.](/microsoft-365/frontline/shifts-connector-wizard#disable-open-shifts-open-shifts-requests-swap-requests-and-time-off-requests) ## List of error messages |
| frontline | Shifts Connector Wizard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/shifts-connector-wizard.md | On the Settings page, you choose the information to sync from Blue Yonder WFM to > [!TIP] > You'll be given the following options for the next group of settings: <br>- > **Shifts users will not see provider data**: Data won't sync between UKG Dimensions and Shifts. <br> - > **Shifts users can see provider data**: Data syncing is unidirectional from UKG Dimensions to Shifts. <br> - > **Shifts users can see and change provider data**: Data syncing is bidirectional between UKG Dimensions and Shifts. + > **Shifts users will not see provider data**: Data won't sync between Blue Yonder WFM and Shifts. <br> + > **Shifts users can see provider data**: Data syncing is unidirectional from Blue Yonder WFM to Shifts. <br> + > **Shifts users can see and change provider data**: Data syncing is bidirectional between Blue Yonder WFM and Shifts. 4. Choose your basic, **Time card**, and **Request** settings from the options listed above. |
| includes | Microsoft 365 Content Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-365-content-updates.md | +## Week of April 03, 2023 +++| Published On |Topic title | Change | +|||--| +| 4/3/2023 | [Endpoint detection and response (EDR) in block mode frequently asked questions (FAQ)](/microsoft-365/security/defender-endpoint/edr-block-mode-faqs?view=o365-worldwide) | added | +| 4/3/2023 | [Endpoint detection and response in block mode](/microsoft-365/security/defender-endpoint/edr-in-block-mode?view=o365-worldwide) | modified | +| 4/3/2023 | [macOS Device control policies frequently asked questions (FAQ)](/microsoft-365/security/defender-endpoint/mac-device-control-faq?view=o365-worldwide) | added | +| 4/3/2023 | [Deploy and manage Device Control using Intune](/microsoft-365/security/defender-endpoint/mac-device-control-intune?view=o365-worldwide) | modified | +| 4/3/2023 | [Deploy and manage device control using JAMF](/microsoft-365/security/defender-endpoint/mac-device-control-jamf?view=o365-worldwide) | modified | +| 4/3/2023 | [Device control for macOS](/microsoft-365/security/defender-endpoint/mac-device-control-overview?view=o365-worldwide) | modified | +| 4/3/2023 | [Errors during admin submissions](/microsoft-365/security/office-365-security/submissions-error-messages?view=o365-worldwide) | modified | +| 4/3/2023 | [Allow or block URLs using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-urls-configure?view=o365-worldwide) | modified | +| 4/3/2023 | [Overview of Copilot for Microsoft Syntex](/microsoft-365/syntex/syntex-copilot) | modified | +| 4/3/2023 | [Pay for your Microsoft business subscription with a billing profile](/microsoft-365/commerce/billing-and-payments/pay-for-subscription-billing-profile?view=o365-worldwide) | modified | +| 4/3/2023 | [Payment options for your Microsoft business subscription](/microsoft-365/commerce/billing-and-payments/pay-for-your-subscription?view=o365-worldwide) | modified | +| 4/3/2023 | [Understand your bill or invoice for Microsoft 365 for business](/microsoft-365/commerce/billing-and-payments/understand-your-invoice2?view=o365-worldwide) | modified | +| 4/3/2023 | [Security baselines assessment](/microsoft-365/security/defender-vulnerability-management/tvm-security-baselines?view=o365-worldwide) | modified | +| 4/3/2023 | [Get started with Endpoint data loss prevention](/microsoft-365/compliance/endpoint-dlp-getting-started?view=o365-worldwide) | modified | +| 4/3/2023 | [Tailor Teams apps for your frontline workers](/microsoft-365/frontline/pin-teams-apps-based-on-license?view=o365-worldwide) | modified | +| 4/3/2023 | [What's new in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-whats-new?view=o365-worldwide) | modified | +| 4/5/2023 | [Setup guides for Microsoft 365 Defender](/microsoft-365/security/defender/deploy-configure-m365-defender?view=o365-worldwide) | added | +| 4/5/2023 | [Use Content Search in Microsoft Teams](/microsoft-365/compliance/ediscovery-teams-content-search?view=o365-worldwide) | added | +| 4/5/2023 | [Place a Microsoft Teams user or team on legal hold](/microsoft-365/compliance/ediscovery-teams-legal-hold?view=o365-worldwide) | added | +| 4/5/2023 | [Conduct an eDiscovery investigation of content in Microsoft Teams](/microsoft-365/compliance/ediscovery-teams-investigation?view=o365-worldwide) | modified | +| 4/5/2023 | [eDiscovery (Premium) workflow for content in Microsoft Teams](/microsoft-365/compliance/ediscovery-teams-workflow?view=o365-worldwide) | modified | +| 4/5/2023 | [Minimum versions for sensitivity labels in Microsoft 365 Apps](/microsoft-365/compliance/sensitivity-labels-versions?view=o365-worldwide) | modified | +| 4/6/2023 | [Use Content Search in Microsoft Teams](/microsoft-365/compliance/ediscovery-teams-content-search?view=o365-worldwide) | modified | +| 4/6/2023 | [Place a Microsoft Teams user or team on legal hold](/microsoft-365/compliance/ediscovery-teams-legal-hold?view=o365-worldwide) | modified | +| 4/6/2023 | Frequently asked questions on tamper protection | removed | +| 4/7/2023 | [Upgrade your Office 2010 to Microsoft 365 - Microsoft 365 admin](/microsoft-365/admin/setup/upgrade-users-to-latest-office-client?view=o365-worldwide) | modified | +| 4/7/2023 | [Virtual Appointments with Teams - Integration into Epic EHR](/microsoft-365/frontline/ehr-admin-epic?view=o365-worldwide) | modified | +| 4/7/2023 | [Configure anti-malware policies](/microsoft-365/security/office-365-security/anti-malware-policies-configure?view=o365-worldwide) | modified | +| 4/7/2023 | [Configure anti-phishing policies in EOP](/microsoft-365/security/office-365-security/anti-phishing-policies-eop-configure?view=o365-worldwide) | modified | +| 4/7/2023 | [Configure anti-phishing policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure?view=o365-worldwide) | modified | +| 4/7/2023 | [Configure spam filter policies](/microsoft-365/security/office-365-security/anti-spam-policies-configure?view=o365-worldwide) | modified | +| 4/7/2023 | [Protect against threats in Microsoft Defender for Office 365, Anti-malware, Anti-Phishing, Anti-spam, Safe links, Safe attachments, Zero-hour auto purge (ZAP), MDO security configuration](/microsoft-365/security/office-365-security/protect-against-threats?view=o365-worldwide) | modified | +| 4/7/2023 | [Quarantined messages FAQ](/microsoft-365/security/office-365-security/quarantine-faq?view=o365-worldwide) | modified | +| 4/7/2023 | [Quarantine policies](/microsoft-365/security/office-365-security/quarantine-policies?view=o365-worldwide) | modified | +| 4/7/2023 | [Quarantine notifications (end-user spam notifications) in Microsoft 365](/microsoft-365/security/office-365-security/quarantine-quarantine-notifications?view=o365-worldwide) | modified | +| 4/7/2023 | [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-worldwide) | modified | +| 4/7/2023 | [Set up Safe Attachments policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/safe-attachments-policies-configure?view=o365-worldwide) | modified | +| 4/7/2023 | [Zero-hour auto purge in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide) | modified | +| 4/7/2023 | [Overview of the Tenants page in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-tenants-page-overview?view=o365-worldwide) | modified | ++ ## Week of March 27, 2023 | 3/10/2023 | [Set up secure file and document sharing and collaboration with Teams in Microsoft 365](/microsoft-365/solutions/setup-secure-collaboration-with-teams?view=o365-worldwide) | modified | | 3/10/2023 | [Overview of the Apps page in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-apps-page-overview?view=o365-worldwide) | added | | 3/10/2023 | [Overview of the Device health page in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-device-health-overview?view=o365-worldwide) | added |---## Week of February 27, 2023 ---| Published On |Topic title | Change | -|||--| -| 2/28/2023 | [Learn about retention policies & labels to retain or delete](/microsoft-365/compliance/retention?view=o365-worldwide) | modified | -| 2/28/2023 | [Hash and upload the sensitive information source table for exact data match sensitive information types](/microsoft-365/compliance/sit-get-started-exact-data-match-hash-upload?view=o365-worldwide) | modified | -| 2/28/2023 | [Advanced deployment guides for Microsoft 365 and Office 365 services](/microsoft-365/enterprise/setup-guides-for-microsoft-365?view=o365-worldwide) | modified | -| 2/28/2023 | [Microsoft Defender for Business frequently asked questions](/microsoft-365/security/defender-business/mdb-faq?view=o365-worldwide) | modified | -| 2/28/2023 | [Compare Microsoft endpoint security plans](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2?view=o365-worldwide) | modified | -| 2/28/2023 | [Manage your Microsoft Defender for Endpoint subscription settings across client devices](/microsoft-365/security/defender-endpoint/defender-endpoint-subscription-settings?view=o365-worldwide) | added | -| 2/28/2023 | [Create and manage device tags](/microsoft-365/security/defender-endpoint/machine-tags?view=o365-worldwide) | modified | -| 2/28/2023 | [Zero Trust with Microsoft 365 Defender](/microsoft-365/security/defender/zero-trust-with-microsoft-365-defender?view=o365-worldwide) | added | -| 2/28/2023 | [Manage allows and blocks in the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-about?view=o365-worldwide) | modified | -| 2/28/2023 | [Allow or block email using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure?view=o365-worldwide) | modified | -| 2/27/2023 | [Information protection configuration tasks that you used to do in the Azure portal](/microsoft-365/compliance/azure-portal-migration?view=o365-worldwide) | added | -| 2/27/2023 | [Get started with data loss prevention on-premises repositories](/microsoft-365/compliance/dlp-on-premises-scanner-get-started?view=o365-worldwide) | modified | -| 2/27/2023 | [Learn about data loss prevention on-premises repositories](/microsoft-365/compliance/dlp-on-premises-scanner-learn?view=o365-worldwide) | modified | -| 2/27/2023 | [Use data loss prevention on-premises repositories](/microsoft-365/compliance/dlp-on-premises-scanner-use?view=o365-worldwide) | modified | -| 2/27/2023 | [Remove blocked connectors from the Restricted entities portal in Microsoft 365](/microsoft-365/security/office-365-security/connectors-remove-blocked?view=o365-worldwide) | modified | -| 2/27/2023 | [Remove blocked users from the Restricted users portal](/microsoft-365/security/office-365-security/removing-user-from-restricted-users-portal-after-spam?view=o365-worldwide) | modified | -| 2/27/2023 | [Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview compliance](/microsoft-365/security/office-365-security/scc-permissions?view=o365-worldwide) | modified | -| 2/27/2023 | [Manage submissions](/microsoft-365/security/office-365-security/submissions-admin?view=o365-worldwide) | modified | -| 2/27/2023 | [Manage allows and blocks in the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-about?view=o365-worldwide) | modified | -| 2/27/2023 | [Allow or block email using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure?view=o365-worldwide) | modified | -| 2/28/2023 | [Get started with DLP for Power BI](/microsoft-365/compliance/dlp-powerbi-get-started?view=o365-worldwide) | modified | -| 2/28/2023 | [Troubleshoot error messages and problems in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-troubleshoot?view=o365-worldwide) | modified | -| 2/28/2023 | [Overview of the Users page in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-users-page-overview?view=o365-worldwide) | modified | -| 2/28/2023 | [What's new in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-whats-new?view=o365-worldwide) | modified | -| 2/28/2023 | Manage your Microsoft Defender for Endpoint subscription settings across client devices | removed | -| 3/1/2023 | [Automatically apply a sensitivity label in Microsoft 365](/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) | modified | -| 3/1/2023 | [Investigate insider risk management activities](/microsoft-365/compliance/insider-risk-management-activities?view=o365-worldwide) | modified | -| 3/1/2023 | [Use the Microsoft 365 admin center to manage your Shifts connection to Blue Yonder Workforce Management (Preview)](/microsoft-365/frontline/shifts-connector-blue-yonder-admin-center-manage?view=o365-worldwide) | modified | -| 3/1/2023 | [Use PowerShell to connect Shifts to Blue Yonder Workforce Management](/microsoft-365/frontline/shifts-connector-blue-yonder-powershell-setup?view=o365-worldwide) | modified | -| 3/1/2023 | [Use PowerShell to manage your Shifts connection to Blue Yonder Workforce Management](/microsoft-365/frontline/shifts-connector-powershell-manage?view=o365-worldwide) | modified | -| 3/1/2023 | [Use the Microsoft 365 admin center to manage your Shifts connection to UKG Dimensions (Preview)](/microsoft-365/frontline/shifts-connector-ukg-admin-center-manage?view=o365-worldwide) | modified | -| 3/1/2023 | [Team Shifts connector for UKG Dimensions known issues](/microsoft-365/frontline/shifts-connector-ukg-known-issues?view=o365-worldwide) | modified | -| 3/1/2023 | [Use PowerShell to manage your Shifts connection to UKG Dimensions](/microsoft-365/frontline/shifts-connector-ukg-powershell-manage?view=o365-worldwide) | modified | -| 3/1/2023 | [Use PowerShell to connect Shifts to UKG Dimensions](/microsoft-365/frontline/shifts-connector-ukg-powershell-setup?view=o365-worldwide) | modified | -| 3/1/2023 | [Use the Shifts connector wizard to connect Shifts to UKG Dimensions (Preview)](/microsoft-365/frontline/shifts-connector-wizard-ukg?view=o365-worldwide) | modified | -| 3/1/2023 | [Use the Shifts connector wizard to connect Shifts to Blue Yonder Workforce Management (Preview)](/microsoft-365/frontline/shifts-connector-wizard?view=o365-worldwide) | modified | -| 2/28/2023 | [Use multi-segment support in information barriers](/microsoft-365/compliance/information-barriers-multi-segment?view=o365-worldwide) | added | -| 2/28/2023 | [Manage information barriers policies](/microsoft-365/compliance/information-barriers-edit-segments-policies?view=o365-worldwide) | modified | -| 2/28/2023 | [Get started with information barriers](/microsoft-365/compliance/information-barriers-policies?view=o365-worldwide) | modified | -| 2/28/2023 | [Information barriers](/microsoft-365/compliance/information-barriers-solution-overview?view=o365-worldwide) | modified | -| 2/28/2023 | [Learn about information barriers](/microsoft-365/compliance/information-barriers?view=o365-worldwide) | modified | -| 2/28/2023 | [Learn about the DLP alerts dashboard](/microsoft-365/compliance/dlp-alerts-dashboard-learn?view=o365-worldwide) | modified | -| 2/28/2023 | [What's new in Microsoft Purview risk and compliance solutions](/microsoft-365/compliance/whats-new?view=o365-worldwide) | modified | -| 2/28/2023 | [Manage tamper protection for your organization using Microsoft Intune](/microsoft-365/security/defender-endpoint/manage-tamper-protection-microsoft-endpoint-manager?view=o365-worldwide) | modified | -| 2/28/2023 | [Protect security settings with tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide) | modified | -| 2/28/2023 | [Built-in virus protection in SharePoint Online, OneDrive, and Microsoft Teams](/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about?view=o365-worldwide) | modified | -| 2/28/2023 | [Anti-spoofing protection FAQ](/microsoft-365/security/office-365-security/anti-phishing-protection-spoofing-faq?view=o365-worldwide) | modified | -| 2/28/2023 | [Anti-spam protection FAQ](/microsoft-365/security/office-365-security/anti-spam-protection-faq?view=o365-worldwide) | modified | -| 2/28/2023 | [Payloads in Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-payloads?view=o365-worldwide) | modified | -| 2/28/2023 | [Respond to a compromised connector in Microsoft 365](/microsoft-365/security/office-365-security/connectors-detect-respond-to-compromise?view=o365-worldwide) | modified | -| 2/28/2023 | [EOP general FAQ](/microsoft-365/security/office-365-security/eop-faq?view=o365-worldwide) | modified | -| 2/28/2023 | [Application Guard for Office for admins](/microsoft-365/security/office-365-security/install-app-guard?view=o365-worldwide) | modified | -| 2/28/2023 | [Microsoft Defender for Office 365 email entity page](/microsoft-365/security/office-365-security/mdo-email-entity-page?view=o365-worldwide) | modified | -| 2/28/2023 | [Zero Trust identity and device access configurations - Microsoft 365 for enterprise](/microsoft-365/security/office-365-security/microsoft-365-policies-configurations?view=o365-worldwide) | modified | -| 2/28/2023 | [Security recommendations for priority accounts in Microsoft 365, priority accounts, priority accounts in Office 365, priority accounts in Microsoft 365](/microsoft-365/security/office-365-security/priority-accounts-security-recommendations?view=o365-worldwide) | modified | -| 2/28/2023 | [Threat Explorer and Real-time detections basics in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/real-time-detections?view=o365-worldwide) | modified | -| 2/28/2023 | [Remediate malicious email that was delivered in Office 365](/microsoft-365/security/office-365-security/remediate-malicious-email-delivered-office-365?view=o365-worldwide) | modified | -| 2/28/2023 | [Connect Microsoft Defender for Office 365 to Microsoft Sentinel](/microsoft-365/security/office-365-security/step-by-step-guides/connect-microsoft-defender-for-office-365-to-microsoft-sentinel?view=o365-worldwide) | modified | -| 2/28/2023 | [Getting started with defense in-depth configuration for email security](/microsoft-365/security/office-365-security/step-by-step-guides/defense-in-depth-guide?view=o365-worldwide) | modified | -| 2/28/2023 | [How-to deploy and configure the report message add-in](/microsoft-365/security/office-365-security/step-by-step-guides/deploy-and-configure-the-report-message-add-in?view=o365-worldwide) | modified | -| 2/28/2023 | [Steps to quickly set up the Standard or Strict preset security policies for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/ensuring-you-always-have-the-optimal-security-controls-with-preset-security-policies?view=o365-worldwide) | modified | -| 2/28/2023 | [How to configure quarantine permissions and policies](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-configure-quarantine-permissions-with-quarantine-policies?view=o365-worldwide) | modified | -| 2/28/2023 | [How to prioritize, Manage, Investigate & Respond to Incidents in Microsoft 365 Defender](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-prioritize-manage-investigate-and-respond-to-incidents-in-microsoft-365-defender?view=o365-worldwide) | modified | -| 2/28/2023 | [Protect your c-suite with Priority account protection in Microsoft Defender for Office 365 Plan 2](/microsoft-365/security/office-365-security/step-by-step-guides/protect-your-c-suite-with-priority-account-protection?view=o365-worldwide) | modified | -| 2/28/2023 | [Review and remove unnecessary allow list entries with Advanced Hunting in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/review-allow-entries?view=o365-worldwide) | modified | -| 2/28/2023 | [Search for emails and remediate threats using Threat Explorer in Microsoft 365 Defender](/microsoft-365/security/office-365-security/step-by-step-guides/search-for-emails-and-remediate-threats?view=o365-worldwide) | modified | -| 2/28/2023 | [Steps to set up a weekly digest email of message center changes for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/stay-informed-with-message-center?view=o365-worldwide) | modified | -| 2/28/2023 | [Microsoft Defender for Office 365 step-by-step guides and how to use them](/microsoft-365/security/office-365-security/step-by-step-guides/step-by-step-guide-overview?view=o365-worldwide) | modified | -| 2/28/2023 | [Assess and tune your filtering for bulk mail in Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/tune-bulk-mail-filtering-walkthrough?view=o365-worldwide) | modified | -| 2/28/2023 | [Allow or block files using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-files-configure?view=o365-worldwide) | modified | -| 2/28/2023 | [Allow or block URLs using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-urls-configure?view=o365-worldwide) | modified | -| 2/28/2023 | [Threat hunting in Threat Explorer for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/threat-explorer-threat-hunting?view=o365-worldwide) | modified | -| 2/28/2023 | [Use Trusted ARC senders for legitimate devices and services between the sender and receiver](/microsoft-365/security/office-365-security/use-arc-exceptions-to-mark-trusted-arc-senders?view=o365-worldwide) | modified | -| 2/28/2023 | [Remove yourself from the blocked senders list and address 5.7.511 Access denied errors](/microsoft-365/security/office-365-security/use-the-delist-portal-to-remove-yourself-from-the-office-365-blocked-senders-lis?view=o365-worldwide) | modified | -| 2/28/2023 | [User tags in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/user-tags-about?view=o365-worldwide) | modified | -| 2/28/2023 | [Zero-hour auto purge in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide) | modified | -| 3/1/2023 | [Learn about and configure insider risk management browser signal detection](/microsoft-365/compliance/insider-risk-management-browser-support?view=o365-worldwide) | modified | -| 3/1/2023 | [Get started with insider risk management forensic evidence (preview)](/microsoft-365/compliance/insider-risk-management-forensic-evidence-configure?view=o365-worldwide) | modified | -| 3/1/2023 | [Compare Microsoft Defender Vulnerability Management plans and capabilities](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-capabilities?view=o365-worldwide) | modified | -| 3/1/2023 | [Microsoft Defender Vulnerability Management frequently asked questions](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-faq?view=o365-worldwide) | modified | -| 3/1/2023 | [About the Microsoft Defender Vulnerability Management public preview trial](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-trial?view=o365-worldwide) | modified | -| 3/1/2023 | [Microsoft Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management?view=o365-worldwide) | modified | -| 3/1/2023 | [Sign up for Microsoft Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/get-defender-vulnerability-management?view=o365-worldwide) | modified | -| 3/1/2023 | [Trial user guide - Microsoft Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/trial-user-guide-defender-vulnerability-management?view=o365-worldwide) | modified | -| 3/1/2023 | [Block vulnerable applications](/microsoft-365/security/defender-vulnerability-management/tvm-block-vuln-apps?view=o365-worldwide) | modified | -| 3/1/2023 | [Browser extensions assessment](/microsoft-365/security/defender-vulnerability-management/tvm-browser-extensions?view=o365-worldwide) | modified | -| 3/1/2023 | [Certificate inventory](/microsoft-365/security/defender-vulnerability-management/tvm-certificate-inventory?view=o365-worldwide) | modified | -| 3/1/2023 | [Create and view exceptions for security recommendations](/microsoft-365/security/defender-vulnerability-management/tvm-exception?view=o365-worldwide) | modified | -| 3/1/2023 | [Firmware and hardware assessment](/microsoft-365/security/defender-vulnerability-management/tvm-hardware-and-firmware?view=o365-worldwide) | modified | -| 3/1/2023 | [Hunt for exposed devices](/microsoft-365/security/defender-vulnerability-management/tvm-hunt-exposed-devices?view=o365-worldwide) | modified | -| 3/1/2023 | [Network share configuration assessment](/microsoft-365/security/defender-vulnerability-management/tvm-network-share-assessment?view=o365-worldwide) | modified | -| 3/1/2023 | [Prerequisites & permissions for Microsoft Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/tvm-prerequisites?view=o365-worldwide) | modified | -| 3/1/2023 | [Security baselines assessment](/microsoft-365/security/defender-vulnerability-management/tvm-security-baselines?view=o365-worldwide) | modified | -| 3/1/2023 | [Software inventory](/microsoft-365/security/defender-vulnerability-management/tvm-software-inventory?view=o365-worldwide) | modified | -| 3/1/2023 | [Supported operating systems platforms and capabilities](/microsoft-365/security/defender-vulnerability-management/tvm-supported-os?view=o365-worldwide) | modified | -| 3/1/2023 | [Mitigate zero-day vulnerabilities](/microsoft-365/security/defender-vulnerability-management/tvm-zero-day-vulnerabilities?view=o365-worldwide) | modified | -| 3/1/2023 | [What's new in Microsoft Defender Vulnerability Management Public Preview](/microsoft-365/security/defender-vulnerability-management/whats-new-in-microsoft-defender-vulnerability-management?view=o365-worldwide) | modified | -| 3/1/2023 | [Authenticated scan for Windows in Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/windows-authenticated-scan?view=o365-worldwide) | modified | -| 3/1/2023 | [Get started with insider risk management forensic evidence](/microsoft-365/compliance/insider-risk-management-forensic-evidence-configure?view=o365-worldwide) | modified | -| 3/1/2023 | [Manage insider risk management forensic evidence](/microsoft-365/compliance/insider-risk-management-forensic-evidence-manage?view=o365-worldwide) | modified | -| 3/1/2023 | [Learn about insider risk management forensic evidence](/microsoft-365/compliance/insider-risk-management-forensic-evidence?view=o365-worldwide) | modified | -| 3/2/2023 | [Business subscriptions and billing documentation # < 60 chars](/microsoft-365/commerce/index?view=o365-worldwide) | modified | -| 3/2/2023 | [Microsoft business subscriptions and billing documentation # < 60 chars](/microsoft-365/commerce/index2?view=o365-worldwide) | added | -| 3/2/2023 | [Best practices for managing your alerts queue](/microsoft-365/compliance/communication-compliance-alerts-best-practices?view=o365-worldwide) | added | -| 3/2/2023 | [Create custom sensitive information types](/microsoft-365/compliance/create-a-custom-sensitive-information-type?view=o365-worldwide) | modified | -| 3/2/2023 | [Create a keyword dictionary](/microsoft-365/compliance/create-a-keyword-dictionary?view=o365-worldwide) | modified | -| 3/2/2023 | [Customize a built-in sensitive information type](/microsoft-365/compliance/customize-a-built-in-sensitive-information-type?view=o365-worldwide) | modified | -| 3/2/2023 | [About Document Fingerprinting](/microsoft-365/compliance/document-fingerprinting?view=o365-worldwide) | modified | -| 3/2/2023 | [Common usage scenarios for sensitive information types](/microsoft-365/compliance/sit-common-scenarios?view=o365-worldwide) | modified | -| 3/2/2023 | [Create EDM SIT using the new experience](/microsoft-365/compliance/sit-create-edm-sit-unified-ux-schema-rule-package?view=o365-worldwide) | modified | -| 3/2/2023 | [Custom sensitive information type filters reference](/microsoft-365/compliance/sit-custom-sit-filters?view=o365-worldwide) | modified | -| 3/2/2023 | [Create notifications for exact data match activities](/microsoft-365/compliance/sit-edm-notifications-activities?view=o365-worldwide) | modified | -| 3/2/2023 | [Get started with exact data match based sensitive information types](/microsoft-365/compliance/sit-get-started-exact-data-match-based-sits-overview?view=o365-worldwide) | modified | -| 3/2/2023 | [Hash and upload the sensitive information source table for exact data match sensitive information types](/microsoft-365/compliance/sit-get-started-exact-data-match-hash-upload?view=o365-worldwide) | modified | -| 3/2/2023 | [Use the Shifts connector wizard to connect Shifts to UKG Dimensions (Preview)](/microsoft-365/frontline/shifts-connector-wizard-ukg?view=o365-worldwide) | modified | -| 3/2/2023 | [Use the Shifts connector wizard to connect Shifts to Blue Yonder Workforce Management (Preview)](/microsoft-365/frontline/shifts-connector-wizard?view=o365-worldwide) | modified | -| 3/1/2023 | [Sensitive information type REGEX validators and additional checks](/microsoft-365/compliance/sit-regex-validators-additional-checks?view=o365-worldwide) | modified | -| 3/1/2023 | [What's new in Microsoft Purview risk and compliance solutions](/microsoft-365/compliance/whats-new?view=o365-worldwide) | modified | -| 3/1/2023 | [Protect security settings with tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide) | modified | -| 3/1/2023 | [Manage sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide) | modified | -| 3/3/2023 | [Automatic Service Health Incident Creation](/microsoft-365/admin/manage/servicenow-incidents?view=o365-worldwide) | modified | -| 3/3/2023 | [France national ID card (CNI) entity definition](/microsoft-365/compliance/sit-defn-france-national-id-card?view=o365-worldwide) | modified | -| 3/3/2023 | [U.S. individual taxpayer identification number (ITIN) entity definition](/microsoft-365/compliance/sit-defn-us-individual-taxpayer-identification-number?view=o365-worldwide) | modified | -| 3/3/2023 | [Test an exact data match sensitive information type](/microsoft-365/compliance/sit-get-started-exact-data-match-test?view=o365-worldwide) | modified | -| 3/3/2023 | [Learn about exact data match based sensitive information types](/microsoft-365/compliance/sit-learn-about-exact-data-match-based-sits?view=o365-worldwide) | modified | -| 3/3/2023 | [Sensitive information type limits](/microsoft-365/compliance/sit-limits?view=o365-worldwide) | modified | -| 3/3/2023 | [Manage custom sensitive information types in compliance portal](/microsoft-365/compliance/sit-manage-custom-sits-compliance-center?view=o365-worldwide) | modified | -| 3/3/2023 | [Modify Exact Data Match schema to use configurable match](/microsoft-365/compliance/sit-modify-edm-schema-configurable-match?view=o365-worldwide) | modified | -| 3/3/2023 | [How to schedule scans with Microsoft Defender for Endpoint (Linux)](/microsoft-365/security/defender-endpoint/linux-schedule-scan-mde?view=o365-worldwide) | modified | -| 3/3/2023 | [Understand the Defender Experts for Hunting report in Microsoft 365 Defender](/microsoft-365/security/defender/defender-experts-report?view=o365-worldwide) | modified | -| 3/3/2023 | [How to subscribe to Microsoft Defender Experts for Hunting](/microsoft-365/security/defender/onboarding-defender-experts-for-hunting?view=o365-worldwide) | modified | -| 3/2/2023 | [Anti-phishing policies](/microsoft-365/security/office-365-security/anti-phishing-policies-about?view=o365-worldwide) | modified | -| 3/3/2023 | [Get started with Activity explorer](/microsoft-365/compliance/data-classification-activity-explorer?view=o365-worldwide) | modified | -| 3/3/2023 | [Find and release quarantined messages as a user](/microsoft-365/security/office-365-security/quarantine-end-user?view=o365-worldwide) | modified | -| 3/3/2023 | [Quarantine policies](/microsoft-365/security/office-365-security/quarantine-policies?view=o365-worldwide) | modified | -| 3/3/2023 | [Configure a default sensitivity label for a SharePoint document library](/microsoft-365/compliance/sensitivity-labels-sharepoint-default-label?view=o365-worldwide) | modified | -| 3/3/2023 | [Increase Classifier Accuracy](/microsoft-365/compliance/data-classification-increase-accuracy?view=o365-worldwide) | modified | -| 3/3/2023 | [Microsoft Teams Advanced Virtual Appointments activity report](/microsoft-365/frontline/advanced-virtual-appointments-activity-report?view=o365-worldwide) | modified | -| 3/3/2023 | [Quarantine notifications (end-user spam notifications) in Microsoft 365](/microsoft-365/security/office-365-security/quarantine-quarantine-notifications?view=o365-worldwide) | modified | -| 3/3/2023 | [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-worldwide) | modified | |
| lighthouse | M365 Lighthouse Sign Up | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-sign-up.md | This article provides instructions for how to sign up for Microsoft 365 Lighthou 1. Go to the Microsoft 365 admin center at <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">https://admin.microsoft.com</a> and sign in using your partner tenant credentials. 2. Go to **Billing** > **Purchase services** > **Microsoft 365**.+ + > [!NOTE] + > Instead of **Billing**, some partners may need to go to **Marketplace** > **All products**, and then search for **Microsoft 365 Lighthouse**. 3. Under **Microsoft 365 Lighthouse**, select **Details**. |
| security | Attack Surface Reduction Rules Deployment Plan | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-plan.md | To start, you should get an inventory of the apps that are approved for use acro ## Define reporting and response ASR rules team roles and responsibilities -Clearly articulating roles and responsibilities of persons responsible for monitoring and communicating ASR rules status and activity is a core activity of ASR maintenance. Therefore, it is important to determine: +Clearly articulating roles and responsibilities of persons responsible for monitoring and communicating ASR rules status and activity is a core activity of ASR maintenance. Therefore, it is important to determine: - The person or team responsible for gathering reports - How and with whom reports are shared Clearly articulating roles and responsibilities of persons responsible for monit Typical roles and responsibilities include: - IT admins: Implement ASR rules, manage exclusions. Work with different business units on apps and processes. Assembling and sharing reports to stakeholders-- Certified security operations center (CSOC) analyst: Responsible for investing high-priority, blocked processes, to determine wither the threat is valid or not+- Certified security operations center (CSOC) analyst: Responsible for investigating high-priority, blocked processes, to determine whether the threat is valid or not - Chief information security officer (CISO): Responsible for the overall security posture and health of the organization ## ASR rules ring deployment -For large enterprises, Microsoft recommends deploying ASR rules in "rings." Rings are groups of devices that are visually represented as concentric circles that radiate outward like non-overlapping tree rings. When the innermost ring is successfully deployed, you can transition the next ring into the testing phase. Thorough assessment of your business units, ASR rules champions, apps, and processes is imperative to defining your rings. +For large enterprises, Microsoft recommends deploying ASR rules in "rings." Rings are groups of devices that are visually represented as concentric circles that radiate outward like non-overlapping tree rings. When the innermost ring is successfully deployed, you can transition to the next ring into the testing phase. Thorough assessment of your business units, ASR rules champions, apps, and processes is imperative to defining your rings. In most cases, your organization will have designed deployment rings for phased rollouts of Windows updates. You can use your existing ring design to implement ASR rules. See: [Create a deployment plan for Windows](/windows/deployment/update/create-deployment-plan) |
| security | Cloud Protection Microsoft Antivirus Sample Submission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission.md | Microsoft Defender Antivirus and cloud protection automatically block most new, 2. After examining the metadata, if Microsoft Defender Antivirus cloud protection can't reach a conclusive verdict, it can request a sample of the file for further inspection. This request honors the settings configuration for sample submission: - 1. **Send safe samples automatically** (default) + 1. **Send safe samples automatically** - Safe samples are samples considered to not commonly contain PII data like: .bat, .scr, .dll, .exe. - If file is likely to contain PII, the user gets a request to allow file sample submission. - This option is the default on Windows, macOS, and Linux. |
| security | Configure Block At First Sight Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus.md | This article describes an antivirus/antimalware feature known as "block at first ## What is "block at first sight"? -Block at first sight is a threat protection feature of next-generation protection that detects new malware and blocks it within seconds. Block at first sight is enabled when certain security settings are enabled. These settings include: +Block at first sight is a threat protection feature of next-generation protection that detects new malware and blocks it within seconds. Block at first sight is enabled when certain security settings are enabled: -- [Cloud protection](cloud-protection-microsoft-defender-antivirus.md);-- A specified sample submission timeout (such as 50 seconds); and-- A file-blocking level of high.+- [Cloud protection](cloud-protection-microsoft-defender-antivirus.md) is turned on; +- [Sample submission](cloud-protection-microsoft-antivirus-sample-submission.md) is configured for samples to be sent automatically; and +- [Microsoft Defender Antivirus is up to date](microsoft-defender-antivirus-updates.md) on devices. -In most enterprise organizations, the settings needed to enable block at first sight are configured with Microsoft Defender Antivirus deployments. +In most enterprise organizations, the settings needed to enable block at first sight are configured with Microsoft Defender Antivirus deployments. See [Turn on cloud protection in Microsoft Defender Antivirus](enable-cloud-protection-microsoft-defender-antivirus.md). ## How it works Microsoft Defender Antivirus uses multiple detection and prevention technologies - Block at first sight can block non-portable executable files (such as JS, VBS, or macros) and executable files, running the [latest Defender antimalware platform](microsoft-defender-antivirus-updates.md) on Windows or Windows Server. -- Block at first sight only uses the cloud protection backend for executable files and non-portable executable files that are downloaded from the Internet, or that originate from the Internet zone. A hash value of the .exe file is checked via the cloud backend to determine if the file is a previously undetected file.+- Block at first sight only uses the cloud protection backend for executable files and non-portable executable files that are downloaded from the Internet, or that originate from the Internet zone. A hash value of the `.exe` file is checked via the cloud backend to determine if the file is a previously undetected file. - If the cloud backend is unable to make a determination, Microsoft Defender Antivirus locks the file and uploads a copy to the cloud. The cloud performs more analysis to reach a determination before it either allows the file to run or blocks it in all future encounters, depending on whether it determines the file to be malicious or not a threat. Microsoft Defender Antivirus uses multiple detection and prevention technologies ## Turn on block at first sight with Microsoft Intune -### Create a device configuration profile --1. In the Microsoft Intune admin center (<https://endpoint.microsoft.com>), navigate to **Devices** \> **Configuration profiles**. --2. Select or create a profile using the **Device restrictions** profile type. --3. In the **Configuration settings** for the Device restrictions profile, set or confirm the following settings under **Microsoft Defender Antivirus**: -- - **Cloud-delivered protection**: Enabled - - **File Blocking Level**: High - - **Time extension for file scanning by the cloud**: 50 - - **Prompt users before sample submission**: Send all data without prompting -- :::image type="content" source="../../media/intune-block-at-first-sight.png" alt-text="Intune config block at first sight" lightbox="../../media/intune-block-at-first-sight.png"::: --4. Save your settings. --> [!TIP] -> -> - Setting the file blocking level to **High** applies a strong level of detection. In the unlikely event that file blocking causes a false positive detection of legitimate files, your security operations team can [restore quarantined files](./restore-quarantined-files-microsoft-defender-antivirus.md). -> - For more information about configuring Microsoft Defender Antivirus device restrictions in Intune, see [Configure device restriction settings in Microsoft Intune](/intune/device-restrictions-configure). -> - For a list of Microsoft Defender Antivirus device restrictions in Intune, see [Device restriction for Windows 10 (and newer) settings in Intune](/intune/device-restrictions-windows-10#microsoft-defender-antivirus). +1. In the Microsoft Intune admin center (<https://endpoint.microsoft.com>), go to **Endpoint security** \> **Antivirus**. -### Create an endpoint security policy +2. Select an existing policy, or create a new policy using the **Microsoft Defender Antivirus** profile type. In our example, we selected **Windows 10, Windows 11, or Windows Server** for the platform. -1. In the Microsoft Intune admin center (<https://endpoint.microsoft.com>), go to **Endpoint security** \> **Antivirus**. + :::image type="content" source="mediav-policy.png"::: -2. Select an existing policy, or create a new policy using the **Microsoft Defender Antivirus** profile type. +3. Set **Allow cloud protection** to **Allowed. Turns on Cloud Protection**. -3. Set or confirm the following configuration settings: + :::image type="content" source="mediav-cpallowed.png" alt-text="Screenshot of Cloud Protection set to allowed in Intune."::: - - **Turn on cloud-delivered protection**: Yes - - **Cloud-delivered protection level**: High - - **Microsoft Defender Antivirus Extended Timeout in Seconds**: 50 +4. Scroll down to **Submit Samples Consent**, and select one of the following settings: - :::image type="content" source="images/endpointmgr-antivirus-cloudprotection.png" alt-text="Block at first sight settings in the Microsoft Intune admin center portal" lightbox="images/endpointmgr-antivirus-cloudprotection.png"::: + - **Send all samples automatically** + - **Send safe samples automatically** -4. Apply the Microsoft Defender Antivirus profile to a group, such as **All users**, **All devices**, or **All users and devices**. +5. Apply the Microsoft Defender Antivirus profile to a group, such as **All users**, **All devices**, or **All users and devices**. ## Turn on block at first sight with Group Policy You can confirm that block at first sight is enabled on individual client device ## Turn off block at first sight > [!CAUTION]-> Turning off block at first sight will lower the protection state of your device(s) and your network. --You might choose to disable block at first sight if you want to retain the prerequisite settings without actually using block at first sight protection. You might temporarily turn block at first sight off to see how this feature affects your network. However, we do not recommend disabling block at first sight protection permanently. +> Turning off block at first sight will lower the protection state of your device(s) and your network. We do not recommend disabling block at first sight protection permanently. ### Turn off block at first sight with Microsoft Intune You might choose to disable block at first sight if you want to retain the prere 4. Next to **Configuration settings**, choose **Edit**. -5. Change one or more of the following settings: -- - Set **Turn on cloud-delivered protection** to **No** or **Not configured**. - - Set **Cloud-delivered protection level** to **Not configured**. - - Clear the check box for **Microsoft Defender Antivirus Extended Timeout In Seconds**. +5. Set **Allow cloud protection** to **Not allowed. Turns off Cloud Protection**. 6. Review and save your settings. If you have a personal device that is not managed by an organization, you might > [!CAUTION] > Turning off block at first sight lowers the level of protection for your device. We do not recommend permanently disabling block at first sight. -> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) - ## See also - [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) - [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) - [Stay protected with Windows Security](https://support.microsoft.com/windows/stay-protected-with-windows-security-2ae0363d-0ada-c064-8b56-6a39afb6a963)+- [Onboard non-Windows devices](configure-endpoints-non-windows.md) |
| security | Defender Endpoint False Positives Negatives | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-false-positives-negatives.md | Defender for Endpoint offers a wide variety of options, including the ability to ### Cloud-delivered protection -Check your cloud-delivered protection level for Microsoft Defender Antivirus. By default, cloud-delivered protection is set to **Not configured**; however, we recommend setting it to **High**. To learn more about configuring your cloud-delivered protection, see [Specify the cloud-delivered protection level](/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus). +Check your cloud-delivered protection level for Microsoft Defender Antivirus. By default, cloud-delivered protection is set to **Not configured**; however, we recommend turning it on. To learn more about configuring your cloud-delivered protection, see [Turn on cloud protection in Microsoft Defender Antivirus](enable-cloud-protection-microsoft-defender-antivirus.md). -You can use [Intune](/mem/intune/fundamentals/what-is-intune) or other methods, such as [Group Policy](/azure/active-directory-domain-services/manage-group-policy), to edit or set your cloud-delivered protection settings. (see [Manage Microsoft Defender for Endpoint](manage-mde-post-migration.md)). +You can use [Intune](/mem/intune/fundamentals/what-is-intune) or other methods, such as [Group Policy](/azure/active-directory-domain-services/manage-group-policy), to edit or set your cloud-delivered protection settings. -#### Use Intune to review and edit cloud-delivered protection settings (for existing policies) --1. In the [Microsoft Intune admin center](https://endpoint.microsoft.com), choose **Endpoint security** \> **Antivirus** and then select an existing policy. (If you don't have an existing policy, or you want to create a new policy, skip to [the next procedure](#use-intune-to-set-cloud-delivered-protection-settings-for-a-new-policy)). --2. Under **Manage**, select **Properties**. Then, next to **Configuration settings**, choose **Edit**. --3. Expand **Cloud protection**, and review your current setting in the **Cloud-delivered protection level** row. We recommend setting cloud-delivered protection to **Not configured**, which provides strong protection while reducing the chances of getting false positives. --4. Choose **Review + save**, and then **Save**. --#### Use Intune to set cloud-delivered protection settings (for a new policy) --1. In the [Microsoft Intune admin center](https://endpoint.microsoft.com), choose **Endpoint security** \> **Antivirus** \> **+ Create policy**. --2. For **Platform**, select an option, and then for **Profile**, select **Antivirus** or **Microsoft Defender Antivirus** (the specific option depends on what you selected for **Platform**.) Then choose **Create**. --3. On the **Basics** tab, specify a name and description for the policy. Then choose **Next**. --4. On the **Configuration settings** tab, expand **Cloud protection**, and specify the following settings: -- - Set **Turn on cloud-delivered protection** to **Yes**. - - Set **Cloud-delivered protection level** to **Not configured**. (This level provides a strong level of protection by default while reducing the chances of getting false positives.) --5. On the **Scope tags** tab, if you're using scope tags in your organization, specify scope tags for the policy. (See [Scope tags](/mem/intune/fundamentals/scope-tags).) --6. On the **Assignments** tab, specify the users and groups to whom your policy should be applied, and then choose **Next**. (If you need help with assignments, see [Assign user and device profiles in Microsoft Intune](/mem/intune/configuration/device-profile-assign).) --7. On the **Review + create** tab, review the settings, and then choose **Create**. +See [Turn on cloud protection in Microsoft Defender Antivirus](enable-cloud-protection-microsoft-defender-antivirus.md). ### Remediation for potentially unwanted applications Potentially unwanted applications (PUA) are a category of software that can cause devices to run slowly, display unexpected ads, or install other software that might be unexpected or unwanted. Examples of PUA include advertising software, bundling software, and evasion software that behaves differently with security products. Although PUA isn't considered malware, some kinds of software are PUA based on their behavior and reputation. -> [!TIP] -> To learn more about PUA, see [Detect and block potentially unwanted applications](/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus). +To learn more about PUA, see [Detect and block potentially unwanted applications](/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus). Depending on the apps your organization is using, you might be getting false positives as a result of your PUA protection settings. If necessary, consider running PUA protection in audit mode for a while, or apply PUA protection to a subset of devices in your organization. PUA protection can be configured for the Microsoft Edge browser and for Microsoft Defender Antivirus. -We recommend using [Intune](/mem/endpoint-manager-overview) to edit or set PUA protection settings; however, you can use other methods, such as [Group Policy](/azure/active-directory-domain-services/manage-group-policy) (see [Manage Microsoft Defender for Endpoint](manage-mde-post-migration.md). --#### Use Intune to edit PUA protection (for existing configuration profiles) +We recommend using [Intune](/mem/endpoint-manager-overview) to edit or set PUA protection settings; however, you can use other methods, such as [Group Policy](/azure/active-directory-domain-services/manage-group-policy). -1. In the [Microsoft Intune admin center](https://endpoint.microsoft.com), choose **Devices** \> **Configuration profiles**, and then select an existing policy. (If you don't have an existing policy, or you want to create a new policy, skip to [the next procedure](#use-intune-to-set-pua-protection-for-a-new-configuration-profile).) --2. Under **Manage**, choose **Properties**, and then, next to **Configuration settings**, choose **Edit**. --3. On the **Configuration settings** tab, scroll down and expand **Microsoft Defender Antivirus**. --4. Set **Detect potentially unwanted applications** to **Audit**. (You can turn it off, but by using audit mode, you'll be able to see detections.) --5. Choose **Review + save**, and then choose **Save**. --#### Use Intune to set PUA protection (for a new configuration profile) --1. In the [Microsoft Intune admin center](https://endpoint.microsoft.com), choose **Devices** \> **Configuration profiles** \> **+ Create profile**. --2. For the **Platform**, choose **Windows 10 and later**, and for **Profile**, select **Device restrictions**. --3. On the **Basics** tab, specify a name and description for your policy. Then choose **Next**. --4. On the **Configuration settings** tab, scroll down and expand **Microsoft Defender Antivirus**. --5. Set **Detect potentially unwanted applications** to **Audit**, and then choose **Next**. (You can turn off PUA protection, but by using audit mode, you'll be able to see detections.) --6. On the **Assignments** tab, specify the users and groups to whom your policy should be applied, and then choose **Next**. (If you need help with assignments, see [Assign user and device profiles in Microsoft Intune](/mem/intune/configuration/device-profile-assign).) --7. On the **Applicability Rules** tab, specify the OS editions or versions to include or exclude from the policy. For example, you can set the policy to be applied to all devices certain editions of Windows 10. Then choose **Next**. --8. On the **Review + create** tab, review your settings, and, and then choose **Create**. +See [Configure PUA protection in Microsoft Defender Antivirus](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md#configure-pua-protection-in-microsoft-defender-antivirus). ### Automated investigation and remediation If you've worked through all the steps in this article and still need help, cont 2. In the **Support Assistant** window, describe your issue, and then send your message. From there, you can open a service request. -> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) - ## See also - [Manage Defender for Endpoint](manage-mde-post-migration.md) - [Manage exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md) - [Overview of Microsoft 365 Defender portal](/microsoft-365/security/defender-endpoint/use)+- [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) +- [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) +- [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) +- [Configure Defender for Endpoint on Android features](android-configure.md) |
| security | Enable Cloud Protection Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus.md | For more information about the specific network-connectivity requirements to ens | Task | Steps | |||- | Create a new policy | 1. For **Platform**, select **Windows 10, Windows 11, and Windows Server**. <br/>2. For **Profile**, select **Microsoft Defender Antivirus**.<br/>3. On the **Basics** page, specify a name and description for the policy, and then choose **Next**.<br/>4. In the **Defender** section, find **Allow Cloud Protection**, and set it to **Allowed**. Then choose **Next**. <br/>5. On the **Scope tags** step, if your organization is using [scope tags](/mem/intune/fundamentals/scope-tags), select the tags you want to use, and then choose **Next**.<br/>6. On the **Assignments** step, select the groups, users, or devices that you want to apply this policy to, and then choose **Next**.<br/>7. On the **Review + create** step, review the settings for your policy, and then choose **Create**. | - | Edit an existing policy | 1. Select the policy that you want to edit.<br/>2. Under **Configuration settings**, choose **Edit**.<br/>3. In the **Defender** section, find **Allow Cloud Protection**, and set it to **Allowed**.<br/>4. Select **Review + save**. | + | Create a new policy | 1. For **Platform**, select **Windows 10, Windows 11, and Windows Server**. <br/><br/>2. For **Profile**, select **Microsoft Defender Antivirus**.<br/><br/>3. On the **Basics** page, specify a name and description for the policy, and then choose **Next**.<br/><br/>4. In the **Defender** section, find **Allow Cloud Protection**, and set it to **Allowed**. Then choose **Next**. <br/><br/>5. Scroll down to **Submit Samples Consent**, and select one of the following settings:<br/>- **Send all samples automatically**<br/>- **Send safe samples automatically**<br/><br/>6. On the **Scope tags** step, if your organization is using [scope tags](/mem/intune/fundamentals/scope-tags), select the tags you want to use, and then choose **Next**.<br/><br/>7. On the **Assignments** step, select the groups, users, or devices that you want to apply this policy to, and then choose **Next**.<br/><br/>8. On the **Review + create** step, review the settings for your policy, and then choose **Create**. | + | Edit an existing policy | 1. Select the policy that you want to edit.<br/><br/>2. Under **Configuration settings**, choose **Edit**.<br/><br/>3. In the **Defender** section, find **Allow Cloud Protection**, and set it to **Allowed**.<br/><br/>4. Scroll down to **Submit Samples Consent**, and select one of the following settings:<br/>- **Send all samples automatically**<br/>- **Send safe samples automatically**<br/><br/>5. Select **Review + save**. | > [!TIP] > To learn more about Microsoft Defender Antivirus settings in Intune, see [Antivirus policy for endpoint security in Intune](/mem/intune/protect/endpoint-security-antivirus-policy). For more information about allowed parameters, see [Windows Defender WMIv2 APIs] 3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. > [!NOTE]- > If automatic sample submission has been configured with Group Policy then the setting will be greyed-out and unavailable. + > If automatic sample submission has been configured with Group Policy, then the setting will be greyed-out and unavailable. ++## See also ++- [Use Microsoft cloud protection in Microsoft Defender Antivirus](cloud-protection-microsoft-defender-antivirus.md) ++- [Configuration ++- [Use PowerShell cmdlets to manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) > [!TIP] > If you're looking for Antivirus related information for other platforms, see: For more information about allowed parameters, see [Windows Defender WMIv2 APIs] > - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) > - [Configure Defender for Endpoint on Android features](android-configure.md) > - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md)--## See also --- [Use Microsoft cloud protection in Microsoft Defender Antivirus](cloud-protection-microsoft-defender-antivirus.md)--- [Configuration --- [Use PowerShell cmdlets to manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) |
| security | Specify Cloud Protection Level Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/specify-cloud-protection-level-microsoft-defender-antivirus.md | ms.localizationpriority: medium Previously updated : 03/28/2023 Last updated : 04/10/2023 search.appverid: met150 Cloud protection works together with Microsoft Defender Antivirus to deliver protection to your devices faster than through traditional security intelligence updates. You can configure your level of cloud protection by using Microsoft Intune (recommended) or Group Policy. -> [!NOTE] -> Selecting **High**, **High +**, or **Zero tolerance** could cause some legitimate files to be detected. If that happens, you can unblock the detected file or dispute that detection in the Microsoft 365 Defender portal. - ## Use Microsoft Intune to specify the level of cloud protection 1. Go to the Microsoft Intune admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. 2. Choose **Endpoint security** \> **Antivirus**. -3. Select an antivirus profile. (If you don't have one yet, or if you want to create a new profile, see [Configure device restriction settings in Microsoft Intune](/intune/device-restrictions-configure). +3. Select an antivirus profile. If you don't have one yet, or if you want to create a new profile, see [Configure device restriction settings in Microsoft Intune](/intune/device-restrictions-configure). 4. Select **Properties**. Then, next to **Configuration settings**, choose **Edit**. |
| security | M365d Autoir | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-autoir.md | f1.keywords: ms.localizationpriority: medium Previously updated : 07/19/2022 Last updated : 04/10/2023 audience: ITPro The new Automated investigation & response card is available in the Microsoft 36 Using the Automated investigation & response card, your security operations team can quickly navigate to the Action center by selecting the **Approve in Action Center** link, and then taking appropriate actions. The card enables your security operations team to more effectively manage actions that are pending approval. -## Training for security analysts --Use this learning module from Microsoft Learn to understand how Microsoft 365 Defender uses automated self-healing for incident investigation and response. --|Training:|Automate self-healing with Microsoft 365 Defender| -||| -|| Microsoft 365 Defender uses AI to automate remediation for incidents, helping your security operations team address threats more efficiently and effectively. <p> 11 min - 5 Units | --> [!div class="nextstepaction"] -> [Start >](/training/modules/defender-self-healing/) - ## Next steps - [See the prerequisites for automated investigation and response](m365d-configure-auto-investigation-response.md#prerequisites-for-automated-investigation-and-response-in-microsoft-365-defender) |
| security | Attack Simulation Training Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-get-started.md | In Attack simulation training, multiple types of social engineering techniques a - **Link to Malware**: An attacker sends the recipient a message that contains a link to an attachment on a well-known file sharing site (for example, SharePoint Online or Dropbox). When the recipient clicks on the URL, the attachment opens and arbitrary code (for example, a macro) is run on the user's device to help the attacker install additional code or further entrench themselves. -- **Drive-by-url**: An attacker sends the recipient a messages that contains a URL. When the recipient clicks on the URL, they're taken to a website that tries to run background code. This background code attempts to gather information about the recipient or deploy arbitrary code on their device. Typically, the destination website is a well-known website that has been compromised or a clone of a well-known website. Familiarity with the website helps convince the user that the link is safe to click. This technique is also known as a *watering hole attack*.+- **Drive-by-url**: An attacker sends the recipient a message that contains a URL. When the recipient clicks on the URL, they're taken to a website that tries to run background code. This background code attempts to gather information about the recipient or deploy arbitrary code on their device. Typically, the destination website is a well-known website that has been compromised or a clone of a well-known website. Familiarity with the website helps convince the user that the link is safe to click. This technique is also known as a *watering hole attack*. - **OAuth Consent Grant**: An attacker creates a malicious Azure Application that seeks to gain access to data. The application sends an email request that contains a URL. When the recipient clicks on the URL, the consent grant mechanism of the application asks for access to the data (for example, the user's Inbox). The URLs that are used by Attack simulation training are described in the following list: +- <https://www.bankmenia.com> +- <https://www.bankmenia.de> +- <https://www.bankmenia.fr> +- <https://www.bankmenia.it> +- <https://www.bankmenia.org> +- <https://www.banknown.de> +- <https://www.banknown.fr> +- <https://www.banknown.it> +- <https://www.banknown.org> +- <https://www.browsersch.com> +- <https://www.browsersch.de> +- <https://www.browsersch.fr> +- <https://www.browsersch.it> +- <https://www.browsersch.org> +- <https://www.doctorican.de> +- <https://www.doctorican.fr> +- <https://www.doctorican.it> +- <https://www.doctorican.org> +- <https://www.doctrical.com> +- <https://www.doctrical.de> +- <https://www.doctrical.fr> +- <https://www.doctrical.it> +- <https://www.doctrical.org> +- <https://www.doctrings.com> +- <https://www.doctrings.de> +- <https://www.doctrings.fr> +- <https://www.doctrings.it> +- <https://www.doctrings.org> +- <https://www.exportants.com> +- <https://www.exportants.de> +- <https://www.exportants.fr> +- <https://www.exportants.it> +- <https://www.exportants.org> +- <https://www.financerta.com> +- <https://www.financerta.de> +- <https://www.financerta.fr> +- <https://www.financerta.it> +- <https://www.financerta.org> +- <https://www.financerts.com> +- <https://www.financerts.de> +- <https://www.financerts.fr> +- <https://www.financerts.it> +- <https://www.financerts.org> +- <https://www.passwordle.de> +- <https://www.passwordle.fr> +- <https://www.passwordle.it> +- <https://www.passwordle.org> +- <https://www.prizeably.com> +- <https://www.prizeably.de> +- <https://www.prizeably.fr> +- <https://www.prizeably.it> +- <https://www.prizeably.org> +- <https://www.resetts.de> +- <https://www.resetts.fr> +- <https://www.resetts.it> +- <https://www.resetts.org> +- <https://www.securembly.com> +- <https://www.securembly.de> +- <https://www.securembly.fr> +- <https://www.securembly.it> +- <https://www.securembly.org> +- <https://www.securetta.de> +- <https://www.securetta.fr> +- <https://www.securetta.it> +- <https://www.supportin.de> +- <https://www.supportin.fr> +- <https://www.supportin.it> +- <https://www.supportres.com> +- <https://www.supportres.de> +- <https://www.supportres.fr> +- <https://www.supportres.it> +- <https://www.supportres.org> +- <https://www.techidal.com> +- <https://www.techidal.de> +- <https://www.techidal.fr> +- <https://www.techidal.it> +- <https://www.techidal.org> +- <https://www.techniel.de> +- <https://www.techniel.fr> +- <https://www.techniel.it> +- <https://www.techniel.org> +- <https://www.bankmenia.es> +- <https://www.banknown.es> +- <https://www.browsersch.es> +- <https://www.doctorican.es> +- <https://www.doctrical.es> +- <https://www.doctrings.es> +- <https://www.exportants.es> +- <https://www.financerta.es> +- <https://www.financerts.es> +- <https://www.passwordle.es> +- <https://www.prizeably.es> +- <https://www.resetts.es> +- <https://www.securembly.es> +- <https://www.securetta.es> +- <https://www.supportin.es> +- <https://www.supportres.es> +- <https://www.techidal.es> +- <https://www.techniel.es> +- <https://www.msteamsexternalone.com> +- <https://www.msteamsexternaltwo.com> +- <https://www.attacksimulationtraining.com> - <https://www.mcsharepoint.com>-- <https://www.attemplate.com>-- <https://www.doctricant.com> - <https://www.mesharepoint.com> - <https://www.officence.com> - <https://www.officenced.com> The URLs that are used by Attack simulation training are described in the follow - <https://www.templatent.com> - <https://www.templatern.com> - <https://www.windocyte.com>+- <https://www.attemplate.com> +- <https://www.doctricant.com> +- <https://www.salarytoolint.com> +- <https://www.prizesforall.com> +- <https://www.payrolltooling.com> +- <https://www.hrsupportint.com> +- <https://www.docstoreinternal.com> +- <https://www.docdeliveryapp.com> +- <https://www.docstoreinternal.net> +- <https://www.hardwarecheck.net> +- <https://www.payrolltooling.net> +- <https://www.prizegiveaway.net> +- <https://www.salarytoolint.net> +- <https://www.docdeliveryapp.net> +- <https://www.securescoreteam.com> +- <https://www.securescoreteam.net> + > [!NOTE] > Check the availability of the simulated phishing URL in your supported web browsers before you use the URL in a phishing campaign. While we work with many URL reputation vendors to always allow these simulation URLs, we don't always have full coverage (for example, Google Safe Browsing). Most vendors provide guidance that allows you to always allow specific URLs (for example, <https://support.google.com/chrome/a/answer/7532419>). For step by step instructions on how to gain insights with reporting, see [Gain ### Predicted compromise rate -One of the most crucial elements in a phishing simulation is the payload selection. If you're tracking only click-through as a quality metric, there's an incentive to decrease the click rate by selecting easier-to-spot phishing payloads. Eventually, it's less likely that the user will change their behavior when a real phishing messages comes along. +One of the most crucial elements in a phishing simulation is the payload selection. If you're tracking only click-through as a quality metric, there's an incentive to decrease the click rate by selecting easier-to-spot phishing payloads. Eventually, it's less likely that the user will change their behavior when a real phishing message comes along. To combat the tendency to use low click rate payloads and to maximize educational returns, we've created a new piece of metadata for every global payload called the predicted compromise rate (PCR). |
| security | Scc Permissions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/scc-permissions.md | Managing permissions in Defender for Office 365 or Purview compliance gives user |**Data Investigator**|Perform searches on mailboxes, SharePoint Online sites, and OneDrive for Business locations.|Communication <br/><br/> Compliance Search <br/><br/> Custodian <br/><br/> Data Investigation Management <br/><br/> Export <br/><br/> Preview <br/><br/> Review <br/><br/> RMS Decrypt <br/><br/> Search And Purge| |**eDiscovery Manager**|Members can perform searches and place holds on mailboxes, SharePoint Online sites, and OneDrive for Business locations. Members can also create and manage eDiscovery cases, add and remove members to a case, create and edit Content Searches associated with a case, and access case data in eDiscovery (Premium). <br/><br/> An eDiscovery Administrator is a member of the eDiscovery Manager role group who has been assigned additional permissions. In addition to the tasks that an eDiscovery Manager can perform, an eDiscovery Administrator can:<ul><li>View all eDiscovery cases in the organization.</li><li>Manage any eDiscovery case after they add themselves as a member of the case.</li></ul> <br/><br/> The primary difference between an eDiscovery Manager and an eDiscovery Administrator is that an eDiscovery Administrator can access all cases that are listed on the **eDiscovery cases** page in the compliance portal. An eDiscovery manager can only access the cases they created or cases they are a member of. For more information about making a user an eDiscovery Administrator, see [Assign eDiscovery permissions in the compliance portal](../../compliance/assign-ediscovery-permissions.md).|Case Management <br/><br/> Communication <br/><br/> Compliance Search <br/><br/> Custodian <br/><br/> Export <br/><br/> Hold <br/><br/> Manage Review Set Tags <br/><br/> Preview <br/><br/> Review <br/><br/> RMS Decrypt <br/><br/> Scope Manager| |**Global Reader**|Members have read-only access to reports, alerts, and can see all the configuration and settings. <br/><br/> The primary difference between Global Reader and Security Reader is that a Global Reader can access **configuration and settings**.|Compliance Manager Reader <br/><br/> Security Reader <br/><br/> Sensitivity Label Reader <br/><br/> Service Assurance View <br/><br/> View-Only Audit Logs <br/><br/> View-Only Device Management <br/><br/> View-Only DLP Compliance Management <br/><br/> View-Only IB Compliance Management <br/><br/> View-Only Manage Alerts <br/><br/> View-Only Recipients <br/><br/> View-Only Record Management <br/><br/> View-Only Retention Management|-|**Information Protection**|Full control over all information protection features, including sensitivity labels and their policies, DLP, all classifier types, activity and content explorers, and all related reports.|Data Classification Content Viewer <br/><br/> Data Classification List Viewer <br/><br/> Information Protection Admin <br/><br/> Information Protection Analyst <br/><br/> Information Protection Investigator <br/><br/> Information Protection Reader <br/><br/> Purview Evaluation Administrator| -|**Information Protection Admins**|Create, edit, and delete DLP policies, sensitivity labels and their policies, and all classifier types. Manage endpoint DLP settings and simulation mode for auto-labeling policies.|Information Protection Admin <br/><br/> Purview Evaluation Administrator| -|**Information Protection Analysts**|Access and manage DLP alerts and activity explorer. View-only access to DLP policies, sensitivity labels and their policies, and all classifier types.|Data Classification List Viewer <br/><br/> Information Protection Analyst <br/><br/> Purview Evaluation Administrator| -|**Information Protection Investigators**|Access and manage DLP alerts, activity explorer, and content explorer. View-only access to DLP policies, sensitivity labels and their policies, and all classifier types.|Data Classification Content Viewer <br/><br/> Data Classification List Viewer <br/><br/> Information Protection Analyst <br/><br/> Information Protection Investigator <br/><br/> Purview Evaluation Administrator| +|**Information Protection**|Full control over all information protection features, including sensitivity labels and their policies, DLP, all classifier types, activity and content explorers, and all related reports.|Data Classification Content Viewer <br/><br/> Data Classification List Viewer <br/><br/> Information Protection Admin <br/><br/> Information Protection Analyst <br/><br/> Information Protection Investigator <br/><br/> Information Protection Reader| +|**Information Protection Admins**|Create, edit, and delete DLP policies, sensitivity labels and their policies, and all classifier types. Manage endpoint DLP settings and simulation mode for auto-labeling policies.|Information Protection Admin| +|**Information Protection Analysts**|Access and manage DLP alerts and activity explorer. View-only access to DLP policies, sensitivity labels and their policies, and all classifier types.|Data Classification List Viewer <br/><br/> Information Protection Analyst| +|**Information Protection Investigators**|Access and manage DLP alerts, activity explorer, and content explorer. View-only access to DLP policies, sensitivity labels and their policies, and all classifier types.|Data Classification Content Viewer <br/><br/> Data Classification List Viewer <br/><br/> Information Protection Analyst <br/><br/> Information Protection Investigator| |**Information Protection Readers**|View-only access to reports for DLP policies and sensitivity labels and their policies.|Information Protection Reader| |**Insider Risk Management**|Use this role group to manage insider risk management for your organization in a single group. By adding all user accounts for designated administrators, analysts, and investigators, you can configure insider risk management permissions in a single group. This role group contains all the insider risk management permission roles. This is the easiest way to quickly get started with insider risk management and is a good fit for organizations that do not need separate permissions defined for separate groups of users.|Case Management <br/><br/> Data Connector Admin <br/><br/> Insider Risk Management Admin <br/><br/> Insider Risk Management Analysis <br/><br/> Insider Risk Management Approval <br/><br/> Insider Risk Management Audit <br/><br/> Insider Risk Management Investigation <br/><br/> Insider Risk Management Sessions <br/><br/> Review <br/><br/> View-Only Case| |**Insider Risk Management Admins**|Use this role group to initially configure insider risk management and later to segregate insider risk administrators into a defined group. Users in this role group can create, read, update, and delete insider risk management policies, global settings, and role group assignments.|Case Management <br/><br/> Custodian <br/><br/> Data Connector Admin <br/><br/> Insider Risk Management Admin <br/><br/> View-Only Case| The following roles aren't assigned to the Organization Management role group by |**Privacy Management Permanent contribution**|Access Privacy Management cases as a permanent contributor.|Privacy Management <br/><br/> Privacy Management Contributors| |**Privacy Management Temporary contribution**|Access Privacy Management cases as a temporary contributor.|Privacy Management <br/><br/> Privacy Management Contributors| |**Privacy Management Viewer**|Access dashboards and widgets in Privacy Management.|Privacy Management <br/><br/> Privacy Management Viewers|-|**Purview Evaluation Administrator**|Used to create and manage M365 Purview Evaluation lab|Information Protection <br/><br/> Information Protection Admins <br/><br/> Information Protection Analysts <br/><br/> Information Protection Investigators| |**Quarantine**|Allows viewing and releasing quarantined email.|Organization Management <br/><br/> Quarantine Administrator <br/><br/> Security Administrator| |**RecordManagement**|View and edit the configuration of the records management feature.|Compliance Administrator <br/><br/> Compliance Data Administrator <br/><br/> Organization Management <br/><br/> Records Management| |**Retention Management**|Manage retention policies, retention labels, and retention label policies. Includes permissions to add and remove adaptive scopes from these policies, and to create, delete, and modify adaptive scopes.|Compliance Administrator <br/><br/> Compliance Data Administrator <br/><br/> Organization Management <br/><br/> Records Management| |
| solutions | Team Security Isolation Dev Test | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/team-security-isolation-dev-test.md | - Title: "Configure a team with security isolation in a dev/test environment"-- NOCSH--- Previously updated : 08/14/2020----- highpri-- M365-security-compliance-- Strat_O365_Enterprise-- remotework--- admindeeplinkCOMPLIANCE-- admindeeplinkSPO -description: Configure the security and infrastructure that allows your employees to work remotely from anywhere and at any time. ---# Configure a team with security isolation in a dev/test environment --This article provides step-by-step instructions to create a [team with security isolation](secure-teams-security-isolation.md) in a dev/test environment. --[Configuration for the Company Strategy isolated team.](../media/team-security-isolation-dev-test/team-security-isolation-dev-test-config.png) --Use this dev/test environment to experiment and fine-tune settings for your specific needs before deploying this type of team in production. --## Phase 1: Build out your Microsoft 365 Enterprise test environment --If you just want to test sensitive and highly sensitive teams in a lightweight way with the minimum requirements, follow the instructions in [Lightweight base configuration](../enterprise/lightweight-base-configuration-microsoft-365-enterprise.md). --If you want to test sensitive and highly sensitive teams in a simulated enterprise, follow the instructions in [Password hash synchronization](../enterprise/password-hash-sync-m365-ent-test-environment.md). --> [!NOTE] -> Testing a team with security isolation does not require the simulated enterprise test environment, which includes a simulated intranet connected to the Internet and directory synchronization for an Active Directory Domain Services (AD DS) forest. It is provided here as an option so that you can test a team with security isolation and experiment with it in an environment that represents a typical organization. --## Phase 2: Create and configure your Azure Active Directory (Azure AD) group and users --In this phase, you create and configure an Azure AD group and users for your fictional organization. --First, create a security group with the Azure portal. --1. Create a separate tab in your browser, and then go to the Azure portal at [https://portal.azure.com](https://portal.azure.com). If needed, sign in with the credentials of the global administrator account for your Microsoft 365 E5 trial or paid subscription. --2. In the Azure portal, click **Azure Active Directory > Groups**. --3. On the **Groups - All groups** blade, click **+ New group**. --4. On the **Group** blade: -- - Select **Security** in **Group type**. -- - Type **C-Suite** in **Name**. -- - Select **Assigned** in **Membership type**. --5. Click **Create**, and then close the **Group** blade. --Next, configure automatic licensing so that members of the new **C-Suite** group are automatically assigned a Microsoft 365 E5 license. --1. In the Azure portal, click **Azure Active Directory > Licenses > All products**. --2. In the list, select **Microsoft 365 Enterprise E5**, and then click **Assign**. --3. In the **Assign license** blade, click **Users and groups**. --4. In the list of groups, select the **C-Suite** group. --5. Click **Select**, and then click **Assign**. --6. Close the Azure portal tab in your browser. --Next, [connect with the Azure Active Directory PowerShell for Graph module](../enterprise/connect-to-microsoft-365-powershell.md#connect-with-the-azure-active-directory-powershell-for-graph-module). --Fill in your organization name, your location, and a common password, and then run these commands from the PowerShell command prompt or Integrated Script Environment (ISE) to create new user accounts and add them to the C-Suite group: --```powershell -$orgName="<organization name, such as contoso-test for the contoso-test.onmicrosoft.com trial subscription domain name>" -$location="<the ISO ALPHA2 country code, such as US for the United States>" -$commonPassword="<common password for all the new accounts>" --$PasswordProfile=New-Object -TypeName Microsoft.Open.AzureAD.Model.PasswordProfile -$PasswordProfile.Password=$commonPassword --$groupName="C-Suite" -$userNames=@("CEO","CFO","CIO") -$groupID=(Get-AzureADGroup | Where { $_.DisplayName -eq $groupName }).ObjectID -ForEach ($element in $userNames){ -New-AzureADUser -DisplayName $element -PasswordProfile $PasswordProfile -UserPrincipalName ($element + "@" + $orgName + ".onmicrosoft.com") -AccountEnabled $true -MailNickName $element -UsageLocation $location -Add-AzureADGroupMember -RefObjectId (Get-AzureADUser | Where { $_.DisplayName -eq $element }).ObjectID -ObjectId $groupID -} -``` --> [!NOTE] -> The use of a common password here is for automation and ease of configuration for a dev/test environment. Obviously, this is highly discouraged for production subscriptions. --Use these steps to verify that group-based licensing is working correctly. --1. Sign in to the [Microsoft 365 admin center](https://admin.microsoft.com). --2. From the new **Microsoft 365 admin center** tab of your browser, click **Users**. --3. In the list of users, click **CEO**. --4. In the pane that lists the properties of the **CEO** user account, verify that it has been assigned the **Microsoft 365 Enterprise E5** license in **Product licenses**. --## Phase 3: Create your team --In this phase, you create and configure a team with security isolation for members of the senior leadership team to collaborate on company strategy. --First, enable sensitivity labels to protect content in Microsoft Teams, Office 365 groups, and SharePoint sites before you proceed with the steps in [this article](../compliance/sensitivity-labels-teams-groups-sites.md). --Next, create the team: --1. In Teams, click **Teams** on the left side of the app, then click **Join or create a team** at the bottom of the teams list. -2. Click **Create team** (first card, top left corner). -3. Choose **Build a team from scratch**. -4. In the **Sensitivity** list, keep the default. -5. Under **Privacy**, click **Private**. -6. Type **Company Strategy**, and then click **Create** > **Close**. --Next, restrict the creation of private channels to owners of the Company Strategy group. --1. In the team, click **More options**, and then click **Manage team**. -2. On the **Settings** tab, expand **Member permissions**. -3. Clear the **Allow members to create private channels** check box. --Next, you need to configure a sensitivity label with the following settings: --- The name is Company Strategy-- Encryption is enabled-- The Company Strategy group has Co-Author permissions--Follow these steps: --1. Open the Microsoft Purview compliance portal, under **Solutions**, select <a href="https://go.microsoft.com/fwlink/p/?linkid=2174015" target="_blank">**Information protection**</a>. -1. Click **Create a label**. -1. Type **Company Strategy** for the label name. -1. Type **Senior leadership company strategy documents** as the tool tip, and then click **Next**. -1. On the **Encryption** page, in the **Encryption** dropdown, choose **Apply**. -1. To add the team permissions:<br> - a. Click **Assign permissions**.<br> - b. Click **Add users or groups**, select **Company Strategy**, and then click **Add**.<br> - c. Click **Choose permissions**.<br> - d. Choose **Co-Author** from the dropdown list, and then click **Save**.<br> -1. Click **Next**. -1. On the **Content marking** page, click **Next**. -1. On the **Site and group settings** page, set **Site and group settings** to **On**. -1. In the **Privacy of Office 365 group-connected team sites** dropdown, choose **Private - only members can access the site**. -1. Under **Unmanaged devices**, choose **Block access**. -1. Click **Next**. -1. On the **Auto-labeling for Office apps** page, click **Next**. -1. Click **Submit**, and then click **Done**. --Next, publish the new label with these steps: --1. In the Microsoft Purview compliance portal, on the <a href="https://go.microsoft.com/fwlink/p/?linkid=2174015" target="_blank">**Information protection**</a>, choose the **Label policies** tab. -2. Click **Publish labels**. -3. On the **Choose sensitivity labels to publish** page, click **Choose sensitivity labels to publish**. -4. Select **Company Strategy**, and then click **Add**. -5. Click **Next**. -6. On the **Publish to users and groups** page, click **Choose users and groups**. -7. Click **Add**, and then select **Company Strategy**. -8. Click **Add**, and then click **Done**. -9. Click **Next**. -10. On the Policy settings page, select the **Users must provide justification to remove a label or lower classification label** check box, and then click **Next**. -11. Type **Company Strategy** for the policy name, and then click **Next**. -12. Click **Submit** and then click **Done**. --It may take some time for the **Company Strategy** label to become available after it's been published. --Next, apply your new label to the **Company Strategy** team and update the default sharing link type to reduce the risk of accidentally sharing files and folders to a wider audience than intended. --1. Open the SharePoint admin center, under **Sites**, select <a href="https://go.microsoft.com/fwlink/?linkid=2185220" target="_blank">**Active sites**</a>. -1. Select the **Company Strategy** site. -1. On the **Policies** tab, under **Sensitivity**, select **Edit**. -1. Select the **Company Strategy** label, and then select **Save**. -1. On the **Policies** tab, under **External sharing**, select **Edit**. -1. Choose **Only people in your organization**. -1. Under **Default sharing** link type, clear the **Same as organization-level setting** check box, and select **People with existing access**. -1. Select **Save**. --Next, configure owners-only site sharing for the **Company Strategy** team. --1. In Teams, navigate to the **General** tab of the **Company Strategy** team. -2. In the tool bar for the team, click **Files**. -3. Click the ellipsis, and then click **Open in SharePoint**. -4. In the tool bar of the underlying SharePoint site, click the settings icon, and then click **Site permissions**. -5. In the Site permissions pane, under **Site Sharing**, click **Change how members can share**. -6. Under **Sharing permissions**, choose **Only site owners can share files, folders, and the site**, and then click **Save**. -7. Close the **Permissions** and **Settings** panes. --If you sign in as a member of the Company Strategy group, you will see **Company Strategy** in the **Sensitivity** option in the Home toolbar of Word, Excel, and PowerPoint. Select the **Company Strategy** label from the **Sensitivity** option to assign the label to a file. --Here is the resulting configuration for the Company Strategy team. -- --## Next step --When you're ready for production deployment, see these [configuration instructions](secure-teams-security-isolation.md). |
| solutions | Test Lab Guides Overview Solutions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/test-lab-guides-overview-solutions.md | - Title: "Test Lab Guides for solutions and scenarios"-- NOCSH--- Previously updated : 02/09/2021---- MET150--- highpri-- M365-security-compliance--- Ent_Architecture -description: "Use Test Lab Guides to build out Microsoft 365 solutions and scenarios in a dev/test environment." ---# Test Lab Guides for solutions and scenarios --Test Lab Guides (TLGs) help you quickly learn about Microsoft products. They provide prescriptive instructions to configure simplified but representative test environments. You can use these environments for demonstration, customization, or creation of complex proofs of concept for the duration of a trial or paid subscription. --TLGs are designed to be modular. They build upon each other to create multiple configurations that more closely match your learning or test configuration needs. The "I built it out myself and it works" hands-on experience helps you understand the deployment requirements of a new product or scenario so you can better plan for hosting it in production. --You can also use TLGs to create representative environments for development and testing of applications, also known as dev/test environments. - - --Try [this Test Lab Guide](team-security-isolation-dev-test.md) to set up a team with security isolation. --For additional guides for Microsoft 365 features and configuration, see [Microsoft 365 for enterprise Test Lab Guides](../enterprise/m365-enterprise-test-lab-guides.md). |