| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Manage Guest Access In Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/manage-guest-access-in-groups.md | search.appverid: - MET150 - MOE150 ms.assetid: 9de497a9-2f5c-43d6-ae18-767f2e6fe6e0-description: "Learn how to add guests to a Microsoft 365 group, view guest users, and use PowerShell to control guest access." +description: "Learn how to add guests to a Microsoft 365 group, view guests, and use PowerShell to control guest access." # Manage guest access in Microsoft 365 groups By default, guest access for Microsoft 365 groups is turned on for your organization. Admins can control whether to allow guest access to groups for their whole organization or for individual groups. -When it's turned on, group members can invite guest users to a Microsoft 365 group through Outlook on Web. Invitations are sent to the group owner for approval. +When it's turned on, group members can invite guests to a Microsoft 365 group through Outlook on Web. Invitations are sent to the group owner for approval. -Once approved, the guest user is added to the directory and the group. +Once approved, the guest is added to the directory and the group. > [!Note] > Yammer Enterprise networks that are in Native Mode or the [EU Geo](/yammer/manage-security-and-compliance/manage-data-compliance) do not support network guests. Guest access in groups is often used as part of a broader scenario that includes If you want to enable or disable guest access in groups, you can do so in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2052855" target="_blank">**Groups**</a>. -1. In the admin center, go to **Show all** \> **Settings** \> **Org settings** and on the **Services** tab, select <a href="https://go.microsoft.com/fwlink/p/?linkid=2052855" target="_blank">**Microsoft 365 Groups**</a>. +1. In the admin center, go to **Show all** \> **Settings** \> **Org settings** and on the <a href="https://go.microsoft.com/fwlink/p/?linkid=2053743" target="_blank">**Services** tab</a>, select **Microsoft 365 Groups**. 2. On the **Microsoft 365 Groups** page, choose whether you want to let people outside your organization access group resources or let group owners add people outside your organization to groups. If you want to edit any of a guest's information, you can [Add or update a user' ## Related content -[Block guest users from a specific group](../../solutions/per-group-guest-access.md) (article)\ +[Block guests from a specific group](../../solutions/per-group-guest-access.md) (article)\ [Manage group membership in the Microsoft 365 admin center](add-or-remove-members-from-groups.md) (article)\ [Azure Active Directory access reviews](/azure/active-directory/active-directory-azure-ad-controls-perform-access-review) (article)\-[Set-AzureADUser](/powershell/module/azuread/set-azureaduser) (article) +[Set-AzureADUser](/powershell/module/azuread/set-azureaduser) (article) |
| admin | Setup Business Standard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/setup/setup-business-standard.md | When you purchase Microsoft 365 Business Standard, you have the option of adding In this article, we'll walk you through the steps of adding an existing domain your already own or buying a new one. If you purchased a new domain when you signed up, your domain is all set up and you can move to [Add users and assign licenses](#add-users-and-assign-licenses). +## Set up Microsoft 365 for business ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE471FJ] + ## Before you begin To add, modify or remove domains you must be a global administrator. For more info, see [About admin roles](../add-users/about-admin-roles.md). |
| admin | Signup Business Standard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/simplified-signup/signup-business-standard.md | There are a couple of ways to get started: > [!IMPORTANT] > Microsoft 365 Business Standard subscriptions are for commercial use and are intended for business and enterprise customers. +## Sign up for Microsoft 365 for business ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3znhX] + ## Sign up steps To sign up and purchase Microsoft 365 Business Standard, complete the following steps. |
| business-premium | Create And Edit Autopilot Profiles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/create-and-edit-autopilot-profiles.md | + + Title: "Create and edit AutoPilot profiles" +f1.keywords: +- NOCSH ++++audience: Admin +++ms.localizationpriority: medium ++- Adm_O365 +- M365-subscription-management +- M365-identity-device-management +- Adm_TOC ++- Adm_O365 +- Core_O365Admin_Migration +- MiniMaven +- MSB365 +- OKR_SMB_M365 +- seo-marvel-mar +- AdminSurgePortfolio +search.appverid: +- BCS160 +- MET150 +- MOE150 +ms.assetid: 5cf7139e-cfa1-4765-8aad-001af1c74faa +description: "Learn to create an AutoPilot profile and apply it to a device, as well as edit or delete a profile or remove a profile from a device." +++# Create and edit AutoPilot profiles ++> [!NOTE] +> Microsoft Defender for Business is rolling out to Microsoft 365 Business Premium customers, beginning March 1, 2022. This offering provides additional security features for devices. [Learn more about Defender for Business](../security/defender-business/mdb-overview.md). ++## Create a profile ++A profile applies to a device, or a group of devices, + +1. In the Microsoft 365 admin center, choose **Devices** \> **AutoPilot**. + +2. On the **AutoPilot** page, choose the **Profiles** tab \> **Create profile**. + +3. On the **Create profile** page, enter a name for the profile that helps you identify it, for example Marketing. Turn on the setting you want, and then choose **Save**. For more information about AutoPilot profile settings, see [About AutoPilot Profile settings](m365bp-autopilot-profile-settings.md). + +  + +### Apply profile to a device ++After you create a profile, you can apply it to a device or a group of devices. You can pick an existing profile in the [step-by-step guide](m365bp-add-autopilot-devices-and-profile.md) and apply it to new devices, or replace an existing profile for a device or group of devices. + +1. On the **Prepare Windows** page, choose the **Devices** tab. + +2. Select the check box next to a device name, and in the **Device** panel, choose a profile from the **Assigned profile** drop-down list \> **Save**. + +  + +## Edit, delete, or remove a profile ++Once you've assigned a profile to a device, you can update it, even if you've already given the device to a user. When the device connects to the internet, it downloads the latest version of your profile during the setup process. If the user restores their device to its factory default settings, the device will again download the latest updates to your profile. + +### Edit a profile ++1. On the **Prepare Windows** page, choose the **Profiles** tab. + +2. Select the check box next to a device name, and in the **Profile** panel, update any of the available settings \> **Save**. + + If you do this before a user connects the device to the internet, then the profile gets applied to the setup process. + +### Delete a profile ++1. On the **Prepare Windows** page, choose the **Profiles** tab. + +2. Select the check box next to a device name, and in the **Profile** panel, select **Delete profile** \> **Save**. + + When you delete a profile, it gets removed from a device or a group of devices it was assigned to. + +### Remove a profile ++1. On the **Prepare Windows** page, choose the **Devices** tab. + +2. Select the check box next to a device name, and in the **Device** panel, choose **None** from the **Assigned profile** drop-down list \> **Save**. + +## See also ++[Top 10 ways to secure Microsoft 365 for business plans](../admin/security-and-compliance/secure-your-business-data.md) |
| compliance | Create Apply Retention Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-apply-retention-labels.md | End users, as well as administrators, can manually apply retention labels from t - SharePoint -- Microsoft 365 groups (both the group site and group mailbox in Outlook on the web)+- Microsoft 365 group site for Teams Use the following sections to understand how to apply retention labels. |
| compliance | Insider Risk Management Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-configure.md | For more information about how insider risk policies can help you manage risk in Before you get started with insider risk management, you should confirm your [Microsoft 365 subscription](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans) and any add-ons. To access and use insider risk management, your organization must have one of the following subscriptions or add-ons: -- Microsoft 365 E5/A5/G5 subscription (paid or trial version)-- Microsoft 365 E3/A3/G3 subscription + the Microsoft 365 E5/A5/G5 Compliance add-on-- Microsoft 365 E3/A3/G3 subscription + the Microsoft 365 E5/A5/G5 Insider Risk Management add-on+- Microsoft 365 E5/A5/F5/G5 subscription (paid or trial version) +- Microsoft 365 E3/A3/F3/G3 subscription + the Microsoft 365 E5/A5/F5/G5 Compliance add-on +- Microsoft 365 E3/A3/F3/G3 subscription + the Microsoft 365 E5/A5/F5/G5 Insider Risk Management add-on - Office 365 E3 subscription + Enterprise Mobility and Security E3 + the Microsoft 365 E5 Compliance add-on Users included in insider risk management policies must be assigned one of the licenses above. |
| compliance | Insider Risk Solution Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-solution-overview.md | Insider risk management helps minimize internal risks by enabling you to detect, Insider risk management is available in the following subscriptions: -- Microsoft 365 E5/A5/G5 subscription (paid or trial version)-- Microsoft 365 E3/A3/G3 subscription + the Microsoft 365 E5/A5/G5 Compliance add-on-- Microsoft 365 E3/A3/G3 subscription + the Microsoft 365 E5/A5/G5 Insider Risk Management add-on+- Microsoft 365 E5/A5/F5/G5 subscription (paid or trial version) +- Microsoft 365 E3/A3/F3/G3 subscription + the Microsoft 365 E5/A5/F5/G5 Compliance add-on +- Microsoft 365 E3/A3/F3/G3 subscription + the Microsoft 365 E5/A5/F5/G5 Insider Risk Management add-on - Office 365 E3 subscription + Enterprise Mobility and Security E3 + the Microsoft 365 E5 Compliance add-on ### Information barriers |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | The numbers listed are the minimum Office application versions required for each |[Let users assign permissions: <br /> - Do Not Forward](encryption-sensitivity-labels.md#let-users-assign-permissions) | Current Channel: 1910+ <br /><br> Monthly Enterprise Channel: 1910+ <br /><br> Semi-Annual Enterprise Channel: 2002+ | 16.21+ | 4.7.1+ | 4.0.39+ | Yes | |[Let users assign permissions: <br /> - Encrypt-Only](encryption-sensitivity-labels.md#let-users-assign-permissions) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.48+ <sup>\*</sup> | 4.2112.0+ | 4.2112.0+ | Yes | |[Require users to apply a label to their email and documents](#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes |-|[Audit label-related user activity](#auditing-labeling-activities) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2022+ | 16.51+ <sup>\*</sup> | 4.2126+ | 4.2126+ | Yes | +|[Audit label-related user activity](#auditing-labeling-activities) | Current Channel: 2011+ <br /><br> Monthly Enterprise Channel: 2011+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.51+ <sup>\*</sup> | 4.2126+ | 4.2126+ | Yes | |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ <sup>\*</sup> | Under review | Under review | Yes | |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | Yes | |[Different settings for default label and mandatory labeling](#outlook-specific-options-for-default-label-and-mandatory-labeling) | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes | |
| lighthouse | M365 Lighthouse Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-overview.md | description: "For Managed Service Providers (MSPs), learn how Microsoft 365 Ligh # Overview of Microsoft 365 Lighthouse -Microsoft 365 Lighthouse is an admin portal that helps Managed Service Providers (MSPs) secure and manage devices, data, and users at scale for small- and medium-sized business (SMB) customers who are using Microsoft 365 Business Premium or Microsoft 365 E3. +Microsoft 365 Lighthouse is an admin portal that helps Managed Service Providers (MSPs) secure and manage devices, data, and users at scale for small- and medium-sized business (SMB) customers who are using Microsoft 365 Business Premium, Microsoft 365 E3, or Windows 365 Business. -Lighthouse simplifies onboarding of Microsoft 365 Business Premium and Microsoft 365 E3 tenants by recommending security configuration baselines tailored to SMB customers and providing multi-tenant views across all customer environments. With Lighthouse, MSPs can scale the management of their customers, focus on what's most important, quickly find and investigate risks, and take action to get their customers to a healthy and secure state. +Lighthouse simplifies onboarding of Microsoft 365 Business Premium, Microsoft 365 E3, and Windows 365 Business tenants by recommending security configuration baselines tailored to SMB customers and providing multi-tenant views across all customer environments. With Lighthouse, MSPs can scale the management of their customers, focus on what's most important, quickly find and investigate risks, and take action to get their customers to a healthy and secure state. -No additional costs are associated with using Lighthouse to manage Microsoft 365 services and connected devices. Lighthouse is available to MSPs enrolled in the Cloud Solution Provider (CSP) program and serving SMB customers with a Microsoft 365 Business Premium or Microsoft 365 E3 subscription. +No additional costs are associated with using Lighthouse to manage Microsoft 365 services and connected devices. Lighthouse is available to MSPs enrolled in the Cloud Solution Provider (CSP) program and serving SMB customers with a Microsoft 365 Business Premium, Microsoft 365 E3, or Windows 365 Business subscription. -Use of Lighthouse by Microsoft CSP channel partners that have customers using Microsoft 365 Business Premium or Microsoft 365 E3 is supported. This includes CSP partners transacting directly with Microsoft and those transacting through an indirect provider (distributor). +Use of Lighthouse by Microsoft CSP channel partners that have customers using Microsoft 365 Business Premium, Microsoft 365 E3, or Windows 365 Business is supported. This includes CSP partners transacting directly with Microsoft and those transacting through an indirect provider (distributor). > [!IMPORTANT] > To use Lighthouse, MSPs and their customer tenants must meet the requirements listed in [Microsoft 365 Lighthouse requirements](m365-lighthouse-requirements.md). |
| lighthouse | M365 Lighthouse Sign Up | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-sign-up.md | description: "For Managed Service Providers (MSPs), learn how to sign up for Mic # Sign up for Microsoft 365 Lighthouse -This article provides instructions for how to sign up for Microsoft 365 Lighthouse. Microsoft 365 Lighthouse is an admin portal that helps Managed Service Providers (MSPs) secure and manage devices, data, and users at scale for small- and medium-sized business (SMB) customers who are using Microsoft 365 Business Premium or Microsoft 365 E3. +This article provides instructions for how to sign up for Microsoft 365 Lighthouse. Microsoft 365 Lighthouse is an admin portal that helps Managed Service Providers (MSPs) secure and manage devices, data, and users at scale for small- and medium-sized business (SMB) customers who are using Microsoft 365 Business Premium, Microsoft 365 E3, or Windows 365 Business. ## Before you begin |
| lighthouse | M365 Lighthouse Troubleshoot | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-troubleshoot.md | This article describes error messages and problems that you might encounter whil **Cause:** Your customer tenants don't meet the following criteria: - Must have delegated access set up for the Managed Service Provider (MSP) to be able to manage the customer tenant*- - Must have at least one Microsoft 365 Business Premium, Microsoft 365 E3 license, or Windows 365 Business license + - Must have at least one Microsoft 365 Business Premium, Microsoft 365 E3, or Windows 365 Business license - Must have no more than 1000 licensed users  **Resolution:** The following table describes the different tenant statuses that require action and explains how to resolve them. |
| security | Attack Surface Reduction Rules Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference.md | Links to information about configuration management system versions referenced i |Rule name | Intune | Microsoft Endpoint Manager |Microsoft Endpoint Configuration Manager |Group Policy<sup>[[1](#fn1)]<sup></sup> | PowerShell<sup>[[1](#fn1)]<sup></sup> | ||::|::|::|::|::| |[Block abuse of exploited vulnerable signed drivers](#block-abuse-of-exploited-vulnerable-signed-drivers) | Y | Y MEM OMA-URI | | Y | Y |-|[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | Y | | Y | Y | Y | +|[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | Y | | | Y | Y | |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | Y | |Y <br><br> CB 1710 | Y | Y | |[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | Y | | Y <br><br>CB 1802 | Y | Y | |[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | Y | |Y <br><br> CB 1710 | Y | Y | |
| security | Edr In Block Mode | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/edr-in-block-mode.md | You can also define an exclusion for Microsoft Defender Antivirus. See [Configur The primary purpose of EDR in block mode is to remediate post-breach detections that were missed by a non-Microsoft antivirus product. There is minimal benefit in enabling EDR in block mode when Microsoft Defender Antivirus is in active mode, because real-time protection is expected to catch and remediate detections first. We recommend enabling EDR in block mode on endpoints where Microsoft Defender for Antivirus is running in passive mode. EDR detections can be automatically remediated by [PUA protection](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) or by [automated investigation & remediation capabilities](automated-investigations.md) in block mode. -- When Microsoft Defender Antivirus is in passive mode, EDR in block mode provides another layer of defense together with Microsoft Defender for Endpoint.--- When Microsoft Defender Antivirus is in active mode, EDR in block mode does not provide extra scanning, but it does allow Microsoft Defender Antivirus to take automatic actions on post-breach, behavioral EDR detections.- ### Will EDR in block mode affect a user's antivirus protection? EDR in block mode does not affect third-party antivirus protection running on users' devices. EDR in block mode works if the primary antivirus solution misses something, or if there is a post-breach detection. EDR in block mode works just like Microsoft Defender Antivirus in passive mode, except that EDR in block mode also blocks and remediates malicious artifacts or behaviors that are detected. |
| security | Microsoft Defender Antivirus Compatibility | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility.md | The table in this section summarizes the features and capabilities that are acti (<a id="fn5">5</a>) When Microsoft Defender Antivirus is in passive mode, scans are not scheduled. -(<a id="fn6">6</a>) When Microsoft Defender Antivirus is in passive mode, it does not remediate threats. However, Threats can be remediated by [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md). In this case, you might see alerts showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode. +(<a id="fn6">6</a>) When Microsoft Defender Antivirus is in passive mode, it does not remediate threats. However, threats can be remediated by [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md). In this case, you might see alerts showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode. > [!NOTE] > [Microsoft 365 Endpoint data loss prevention](/microsoft-365/compliance/endpoint-dlp-learn-about) protection continues to operate normally when Microsoft Defender Antivirus is in either active or passive mode. |
| security | Install App Guard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/install-app-guard.md | To learn more about Office update channels, see [Overview of update channels for * Microsoft 365 E5 or Microsoft 365 E5 Security > [!NOTE]-> Microsoft 365 Apps for enterprise with the device-based license do not have access to Application Guard for Office. +> Microsoft 365 Apps for enterprise with shared computer activation or device-based licensing do not have access to Application Guard for Office. ## Deploy Application Guard for Office |
| security | Remediate Malicious Email Delivered Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/remediate-malicious-email-delivered-office-365.md | Admins can take required action on emails, but to get those actions approved, th *Manual hunting* occurs when security teams identify threats manually by using the search and filtering capabilities in Explorer. Manual email remediation can be triggered through any email view (*Malware*, *Phish*, or *All email*) after you identify a set of emails that need to be remediated. > [!div class="mx-imgBorder"]-> [](../../media/tp-RemediationArticle1.png#lightbox) +> [](../../media/tp-RemediationArticle1.png#lightbox) Security teams can use Explorer to select emails in several ways: - Choose emails by hand: Use filters in various views. Select up to 100 emails to remediate. -- Query selection: Select an entire query by using the top **select all** button. The same query is also shown in action center mail submission details.+- Query selection: Select an entire query by using the top **select all** button. The same query is also shown in action center mail submission details. Customers can submit maximum 200,000 emails from threat explorer. - Query selection with exclusion: Sometimes security operations teams may want to remediate emails by selecting an entire query and excluding certain emails from the query manually. To do so, an admin can use the **Select all** check box and scroll down to exclude emails manually. The query can hold a maximum of 1,000 emails. The maximum number of exclusions is 100. Once emails are selected through Explorer, you can start remediation by taking direct action or by queuing up emails for an action: -- Direct approval: When actions like *move to inbox*, *move to junk*, *move to deleted items*, *soft delete*, or *hard delete* are selected by security personnel who have appropriate permissions, and the next steps in remediation are followed, the remediation process begins to execute the selected action. A temporary flyout shows remediation in progress.+- Direct approval: When actions like *move to inbox*, *move to junk*, *move to deleted items*, *soft delete*, or *hard delete* are selected by security personnel who have appropriate permissions, and the next steps in remediation are followed, the remediation process begins to execute the selected action. +> [!NOTE] +>As the remediation gets kicked-off, it generates an alert and an investigation in parallel. Alert shows up in the alerts queue with the name "Administrative action submitted by an Administrator" suggesting that security personnel took the action of remediating an entity. It presents details like name of the person who performed the action, supporting investigation link, time etc. It works really well to know every time a harsh action like remediation is performed on entities. All these actions can be trcaked under the **Actions & Submissions** \> **Action center** -> **History tab** (public preview). - Two-step approval: An "add to remediation" action can be taken by admins who don't have appropriate permissions or who need to wait to execute the action. In this case, the targeted emails are added to a remediation container. Approval is needed before the remediation is executed. Once emails are selected through Explorer, you can start remediation by taking d > [!div class="mx-imgBorder"] > [](../../media/tp-RemediationArticle3.png#lightbox) -All remediations (either direct approval or two-step approval) that were created in Explorer as well as approved actions coming from automated investigations are displayed in the Action Center. Access these via the left navigation panel under **Review** \> **Action Center**. +All remediation (direct approvals ) created in Explorer, Advanced hunting, or through Automated investigation are displayed in the Action Center. Access these via the left navigation panel under **Actions & Submissions** \> **Action center** -> **History tab**. -> [!div class="mx-imgBorder"] -> [](../../media/tp-RemediationArticle4.png#lightbox) +All remediations (direct approvals ) that were created in Explorer or Advanced hunting or through Automated investigation are displayed in the Action Center. Access these via the left navigation panel under **Actions & Submissions** \> **Action center** -> **History tab**. ++Manual actions pending approval using the two-step approval process (1. add to remediation by one security operation team member, 2. reviewed and approved by another security operation team member) are only visible in the legacy Defender for Office 365 action center **Review** \> **Action center** and not in incidents/investigations and the Unified Action center. ++> [!NOTE] +> Two-step approval: actions only available in the office action center **Review** \> **Action center** + -Action Center shows all remediation actions for the past 30 days. Actions taken through Explorer are listed by the name that the security operations team provided when the remediation was created. Actions taken through automated investigations have titles that begin with the related alert that triggered the investigation, such as "Zap email cluster... ." +Unified Action Center shows remediation actions for the past 30 days. Actions taken through Explorer are listed by the name that the security operations team provided when the remediation was created as well as approval Id, Investigation Id. Actions taken through automated investigations have titles that begin with the related alert that triggered the investigation, such as *Zap email cluster*. -Open any remediation item to view details about it, including its name, creation date, description, threat severity, and status. It also shows the following two tabs. +Open any remediation item to view details about it, including its remediation name, approval Id, Investigation Id, creation date, description, status, action source, action type, decided by, status. It also opens a side pane with action details, email cluster details, alert and Incident details. -- **Mail submission** tab: Displays the number of emails submitted through Threat Explorer or automated investigations to be remediated. These emails can be actionable or not actionable.+- *Open Investigation page* this opens up an admin Investigation that contains fewer details and tabs. It shows details like: related alert, entity selected for remediation, action taken, remediation status, entity count, logs, approver of action. This investigation keeps a track of investigation done by the admin manually and contains details to selections made by the admin, hence is called admin action investigation. No need to act on the investigation and alert its already in approved state. +- *Email count* Displays the number of emails submitted through Threat Explorer. These emails can be actionable or not actionable. +- *Action logs* Shows the details of remediation status like successful/ failed/ already in destination > [!div class="mx-imgBorder"]- > [](../../media/tp-RemediationArticle5.png#lightbox) + > [](../../media/tp-RemediationArticle5.png#lightbox) - **Actionable**: Emails in the following cloud mailbox locations can be acted on and moved: - Inbox Open any remediation item to view details about it, including its name, creation Admins can take actions on emails in quarantine if necessary, but those emails will expire out of quarantine if they're not manually purged. By default, emails quarantined because of malicious content aren't accessible by users, so security personnel don't have to take any action to get rid of threats in quarantine. If the emails are on-premises or external, the user can be contacted to address the suspicious email. Or the admins can use separate email server/security tools for removal. These emails can be identified by applying the *delivery location = on-prem* external filter in Explorer. For failed or dropped email, or email not accessible by users, there won't be any email to mitigate, since these mails don't reach the mailbox. - The following image shows how a submission looks in Action Center. A remediation can contain multiple submissions. If multiple actions get approved through one automated investigation, each email or email cluster action appears in the same remediation as a different submission. -- > [!div class="mx-imgBorder"] - > [](../../media/tp-RemediationArticle6.png#lightbox) -- Select a mail submission item to show the details of that remediation, such as the query (when remediation is triggered through automated investigations or Explorer through selecting a query) and the start and end times of remediation. It also displays a list of messages that were submitted for remediation. As messages move out of the Explorer retention period, the messages disappear from this list. The list also shows individual messages that are remediable. --- **Action logs**: This tab shows the messages remediated, including approved date, admin who approved the action, action, status, and counts.+ +- **Action logs**: This shows the messages remediated, successful, failed, already in destination. Status can be: Select any item in the action log to display remediation details. If the details In case of remediating large batches of email, export the messages sent for remediation via Mail Submission, and messages that were remediated via Action Logs. The export limit is increased to 100,000 records. + Admins can take remediation actions like moving email messages to Junk, Inbox, or Deleted items folder and delete actions like soft deleted or hard delete from Advanced Hunting pages. ++ Remediation mitigates threats, addresses suspicious emails, and helps keep an organization secure. |