| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Choose Between Basic Mobility And Security And Intune | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/choose-between-basic-mobility-and-security-and-intune.md | Microsoft Intune and built-in Basic Mobility and Security both give you the abil |Mobile application protection |Enable your users to securely access corporate information using the Office mobile and line-of-business apps they know, while ensuring security of data by helping to restrict actions like copy, cut, paste, and save as, to only those apps managed approved for corporate data. Works even if the devices are not enrolled to Basic Mobility and Security. See Protect app data using MAM policies. |No|Yes| |Managed browser |Enable more secure web browsing using the Edge app. |No|Yes| |Zero touch enrollment programs (AutoPilot) |Enroll large numbers of corporate-owned devices, while simplifying user setup. |No|Yes|-||| -In addition to features listed in the preceding table, Basic Mobility and Security and Intune both include a set of remote actions that send commands to devices over the internet. For example, you can remove Office data from an employeeΓÇÖs device while leaving personal data in place (retire), remove Office apps from a employee's device (wipe), or reset a device to its factory settings (full wipe). +In addition to features listed in the preceding table, Basic Mobility and Security and Intune both include a set of remote actions that send commands to devices over the internet. For example, you can remove Office data from an employeeΓÇÖs device while leaving personal data in place (retire), remove Office apps from an employee's device (wipe), or reset a device to its factory settings (full wipe). Basic Mobility and Security remote actions include retire, wipe and full wipe. For more information on Basic Mobility and Security actions, see [capabilities of Basic Mobility and Security](capabilities.md). |
| bookings | Bookings Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/bookings-overview.md | description: "An overview of the Microsoft Bookings app, which includes a web-ba > [!NOTE] > This article helps you to interact with the latest version of Microsoft Bookings. Previous versions will be retired in coming months. -Microsoft Bookings makes scheduling and managing appointments a breeze. Bookings includes a web-based booking calendar and integrates with Outlook to optimize your staffΓÇÖs calendar and give your customers flexibility to book a time that works best for them. Email and SMS text notifications reduce no-shows and enhances customer satisfaction Your organization saves time with a reduction in repetitive scheduling tasks. With built in flexibility and ability to customize, Bookings can be designed to fit the situation and needs of many different parts of an organization. +Microsoft Bookings makes scheduling and managing appointments a breeze. Bookings includes a web-based booking calendar and integrates with Outlook to optimize your staffΓÇÖs calendar and give your customers flexibility to book a time that works best for them. Email and SMS text notifications reduce no-shows and enhances customer satisfaction. Your organization saves time with a reduction in repetitive scheduling tasks. With built-in flexibility and ability to customize, Bookings can be designed to fit the situation and needs of many different parts of an organization. > [!NOTE] > The Bookings calendar is a mailbox in Exchange Online. |
| bookings | Bookings Sms | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/bookings-sms.md | You can configure SMS notification in Bookings in a couple of ways: > [!NOTE] > You need to be a Teams admin to see Teams and Bookings data on the Teams admin center. -You can track key data on SMS notifications usage in your organization in the Teams admin center. Usage reports includes data such as time and date sent, origin number, message type, event type and delivery status. You can use SMS notification telemetry during the promotional period to help forecast and budget for SMS notifications after May 1, 2022. +You can track key data on SMS notifications usage in your organization in the Teams admin center. Usage reports include data such as time and date sent, origin number, message type, event type and delivery status. You can use SMS notification telemetry during the promotional period to help forecast and budget for SMS notifications after May 1, 2022. 1. On the Teams admin center, **Virtual Visits SMS notifications**. |
| bookings | Customize Booking Page | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/customize-booking-page.md | The section below gives you information about setting up your bookings page and - **Booking page access control: Disable direct search engine indexing of booking page** This setting prevents your page from appearing in the search results for Google, Bing, or other search engines. Selecting this box will ensure access to the page is limited to the generated page link. -- **Customer data usage consent** When selected, text requesting the user's or customer's consent for your organization to use their data will appear on the Self-Service page. The box will have to be checked by the user in order to to complete the booking.+- **Customer data usage consent** When selected, text requesting the user's or customer's consent for your organization to use their data will appear on the Self-Service page. The box will have to be checked by the user in order to complete the booking. - **Scheduling policy**, **Email notifications**, and **Staff** All of these settings are similar to the ones available for each service on the Services tab. |
| bookings | Define Service Offerings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/define-service-offerings.md | You can also add customized information and URLs to the email confirmation and r :::image type="content" source="media/bookings-additional-info.jpg" alt-text="Additional information in a Bookings email."::: -9. **Enable text message notifications for your customer** If selected, SMS messages are sent to the customer, but only if they opt-in. +9. **Enable text message notifications for your customer** If selected, SMS messages are sent to the customer, but only if they opt in. - Opt-in box on the manual booking and Self-Service Page: |
| bookings | Enter Business Information | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/enter-business-information.md | description: "Follow these instructions to create your About Us page, including > [!NOTE] > This article helps you to interact with the latest version of Microsoft Bookings. Previous versions will be retired in coming months. -In Microsoft Bookings, the Business Information page within the web app contains all the details that you'd typically find on a business' "About us" page. These details include your a relevant name, address, phone number, web site URL, privacy policy URL, logo, and business hours. +In Microsoft Bookings, the Business Information page within the web app contains all the details that you'd typically find on a business' "About us" page. These details include a relevant name, address, phone number, web site URL, privacy policy URL, logo, and business hours. The information you provide here will be displayed on the page customers and clients use to book appointments (known as the booking page) and in messages and reminders sent to them by Bookings. An example of this information on the booking page is highlighted below. |
| bookings | Get Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/get-access.md | description: "Learn how to get access to the Bookings feature in Microsoft 365." > [!NOTE] > This article helps you to interact with the latest version of Microsoft Bookings. Previous versions will be retired in coming months. -This topic describes how get access to Bookings for the first time. It also tells you how to turn on or off Bookings in your organization. It also explains how you can assign licenses to your users so they can access and use Bookings. +This topic describes how to get access to Bookings for the first time. It also tells you how to turn on or off Bookings in your organization. It also explains how you can assign licenses to your users so they can access and use Bookings. ## Access Bookings for the first time |
| bookings | Set Scheduling Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/set-scheduling-policies.md | This table explains the various scheduling policies available on the booking pag | Time increments | Determines the intervals between appointments. You can set your time increments from 5 minutes to 4 hours. You can also set your own customized time increments. An interval of 15 minutes, for example, means a customer could schedule a 60-minute appointment at 8:00, 8:15, 8:30, and so on. Conversely, a 60-minute interval means that appointments are only available on the hour. (To set service durations, see [Define your service offerings](define-service-offerings.md).) | | Lead time in hours | You build your staffing plan based on the appointments that are scheduled so it's important to know in advance how many customers are coming in for service on any particular day. The lead time policy enables you to specify the number of hours in advance that customers must book or cancel an appointment. | | Maximum days in advance | If you want to limit how far in advance customers can book appointments, then this is the setting for you! You can set the maximum for 365 days or more. |-| Notify when a booking is created or changed | Select this option when you want to receive an email any time a customer books an appointment or changes an existing one. The email will go to the mailbox specified on the Business information page. See [Enter your business information](enter-business-information.md) for details. | +| Notify when a booking is created or changed | Select this option when you want to receive an email anytime a customer books an appointment or changes an existing one. The email will go to the mailbox specified on the Business information page. See [Enter your business information](enter-business-information.md) for details. | ## Set your policies |
| commerce | Add Storage Space | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/add-storage-space.md | f1.keywords: -+ audience: Admin Last updated 04/02/2021 # Add more SharePoint storage to your subscription+ If you start to run out of storage for your SharePoint sites, you can add storage to your subscription if your plan is eligible. If you don't see the **Office 365 Extra File Storage** in the list of available add-ons, it means your plan is not eligible. For more information, see [Is my plan eligible?](#is-my-plan-eligible-for-office-365-extra-file-storage) > [!NOTE] You must be a Global or SharePoint admin to do the tasks in this article. For mo 2. In the upper right of the page, see the amount of storage used across all sites, and the total storage for your subscription. If your organization has configured Multi-Geo in Office 365, the bar also shows the amount of storage used across all geo locations. -  +  > [!NOTE] > The storage used doesn't include changes made within the last 24-48 hours. Office 365 Extra File Storage is available for the following subscriptions: ## Related content -[Manage site storage limits](/sharepoint/manage-site-collection-storage-limits) (article)\ -+[Manage site storage limits](/sharepoint/manage-site-collection-storage-limits) (article) |
| commerce | Tax Information | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/tax-information.md | f1.keywords: -+ audience: Admin -description: "Find out how much tax you will be charged for your Microsoft 365 for business subscription in different regions. " - commerce_billing - okr_SMB - AdminSurgePortfolio - AdminTemplateSet+description: "Find out how much tax you will be charged for your Microsoft 365 for business subscription in different regions." Last updated 03/17/2021 When you buy Microsoft 365 services in the EMEA region, this purchase could be s You might qualify for VAT zero-rating if: -- **You're in a European Union Member State outside Ireland:** You can provide your valid local VAT ID. This lets Microsoft Ireland Operations Ltd. to VAT zero-rate the transaction. However, you might have a local VAT accounting obligation. If you have any concerns, check with your tax advisers. For instructions, see [Add your VAT ID](#add-your-vat-id).+- **You're in a European Union Member State outside Ireland:** You can provide your valid local VAT ID. This lets Microsoft Ireland Operations Ltd. to VAT zero-rate the transaction. However, you might have a local VAT accounting obligation. If you have any concerns, check with your tax advisors. For instructions, see [Add your VAT ID](#add-your-vat-id). - **You're in Ireland and have the relevant valid VAT exemption certification:** Microsoft Ireland Operations Ltd. may be entitled to exempt the transaction from VAT. If you don't, Microsoft Ireland Operations Ltd. applies the current Irish VAT rate, whether you provide a VAT ID or not. -- **You're in Armenia, Belarus, Norway, Turkey, or United Arab Emirates:** You can provide your local VAT ID. This entitles Microsoft Ireland Operations Ltd. to VAT zero-rate the transaction. However, you may have a local VAT accounting obligation, so please check with your tax advisers if you have any concerns. For instructions, see [Add your VAT ID](#add-your-vat-id).+- **You're in Armenia, Belarus, Norway, Turkey, or United Arab Emirates:** You can provide your local VAT ID. This entitles Microsoft Ireland Operations Ltd. to VAT zero-rate the transaction. However, you may have a local VAT accounting obligation, so please check with your tax advisors if you have any concerns. For instructions, see [Add your VAT ID](#add-your-vat-id). ## Asia Pacific countries (APAC) |
| commerce | Manage Billing Accounts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/manage-billing-accounts.md | f1.keywords: -+ audience: Admin |
| compliance | Dlp Policy Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-policy-reference.md | In the below example, Rule 1 takes precedence over the other matching rules sinc All the other rules are evaluated but their actions are not enforced. Audit logs will show the most restrictive rule applied on the file. If there is more than one rule that matches and they are equally restrictive, then policy and rule priority governs which rule would be applied on the file. -For endpoints, you can configure the actions that DLP takes for all supported activities in a single rule for a particular set of inclusion conditions. - ### Conditions Conditions are inclusive and are where you define what you want the rule to look for and context in which those items are being used. They tell the rule — when you find an item that looks like *this* and is being used like *that* — it's a match and the rest of the actions in the policy should be taken on it. You can use conditions to assign different actions to different risk levels. For example, sensitive content shared internally might be lower risk and require fewer actions than sensitive content shared with people outside the organization. |
| compliance | Enable Mailbox Auditing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/enable-mailbox-auditing.md | To keep mailbox auditing disabled for specific mailboxes, you configure mailbox The following table shows the mailbox types that are currently supported by mailbox auditing on by default: -<br> --**** - |Mailbox type|Supported| ||::| |User mailboxes|| The following table shows the mailbox types that are currently supported by mail |Microsoft 365 Group mailboxes|| |Resource mailboxes|| |Public folder mailboxes||-| ## Logon types and mailbox actions The following table describes the mailbox actions that are available in mailbox - An asterisk ( <sup>\*</sup> ) after the check mark indicates the mailbox action is logged by default for the logon type. - Remember, an admin with Full Access permission to a mailbox is considered a delegate. -<br> --**** - |Mailbox action|Description|Admin|Delegate|Owner| |||::|::|::| |**AddFolderPermissions**|Although this value is accepted as a mailbox action, it's already included in the **UpdateFolderPermissions** action and isn't audited separately. In other words, don't use this value.|||| The following table describes the mailbox actions that are available in mailbox |**FolderBind**|A mailbox folder was accessed. This action is also logged when the admin or delegate opens the mailbox. <br/><br/> **Note**: Audit records for folder bind actions performed by delegates are consolidated. One audit record is generated for individual folder access within a 24-hour period.|||| |**HardDelete**|A message was purged from the Recoverable Items folder.|<sup>\*</sup>|<sup>\*</sup>|<sup>\*</sup>| |**MailboxLogin**|The user signed into their mailbox.||||-|**MailItemsAccessed**|**Note**: This value is available only for E5 or E5 Compliance add-on subscription users. For more information, see [Set up Advanced Audit in Microsoft 365](set-up-advanced-audit.md). <p> Mail data is accessed by mail protocols and clients.|<sup>\*</sup>|<sup>\*</sup>|<sup>\*</sup>| -|**MessageBind**|**Note**: This value is available only for E3 users (users without E5 or E5 Compliance add-on subscriptions). <p> A message was viewed in the preview pane or opened by an admin.|||| +|**MailItemsAccessed**|**Note**: This value is available only for E5 or E5 Compliance add-on subscription users. For more information, see [Set up Advanced Audit in Microsoft 365](set-up-advanced-audit.md). <br/><br/> Mail data is accessed by mail protocols and clients.|<sup>\*</sup>|<sup>\*</sup>|<sup>\*</sup>| +|**MessageBind**|**Note**: This value is available only for E3 users (users without E5 or E5 Compliance add-on subscriptions). <br/><br/> A message was viewed in the preview pane or opened by an admin.|||| |**ModifyFolderPermissions**|Although this value is accepted as a mailbox action, it's already included in the **UpdateFolderPermissions** action and isn't audited separately. In other words, don't use this value.|||| |**Move**|A message was moved to another folder.|||| |**MoveToDeletedItems**|A message was deleted and moved to the Deleted Items folder.|<sup>\*</sup>|<sup>\*</sup>|<sup>\*</sup>| |**RecordDelete**|An item that's labeled as a record was soft-deleted (moved to the Recoverable Items folder). Items labeled as records can't be permanently deleted (purged from the Recoverable Items folder).|||| |**RemoveFolderPermissions**|Although this value is accepted as a mailbox action, it's already included in the **UpdateFolderPermissions** action and isn't audited separately. In other words, don't use this value.||||-|**SearchQueryInitiated**|**Note**: This value is available only for E5 or E5 Compliance add-on subscription users. For more information, see [Set up Advanced Audit in Microsoft 365](set-up-advanced-audit.md). <p> A person uses Outlook (Windows, Mac, iOS, Android, or Outlook on the web) or the Mail app for Windows 10 to search for items in a mailbox.|||| -|**Send**|**Note**: This value is available only for E5 or E5 Compliance add-on subscription users. For more information, see [Set up Advanced Audit in Microsoft 365](set-up-advanced-audit.md). <p> The user sends an email message, replies to an email message, or forwards an email message.|<sup>\*</sup>||<sup>\*</sup>| +|**SearchQueryInitiated**|**Note**: This value is available only for E5 or E5 Compliance add-on subscription users. For more information, see [Set up Advanced Audit in Microsoft 365](set-up-advanced-audit.md). <br/><br/> A person uses Outlook (Windows, Mac, iOS, Android, or Outlook on the web) or the Mail app for Windows 10 to search for items in a mailbox.|||| +|**Send**|**Note**: This value is available only for E5 or E5 Compliance add-on subscription users. For more information, see [Set up Advanced Audit in Microsoft 365](set-up-advanced-audit.md). <br/><br/> The user sends an email message, replies to an email message, or forwards an email message.|<sup>\*</sup>||<sup>\*</sup>| |**SendAs**|A message was sent using the SendAs permission. This means another user sent the message as though it came from the mailbox owner.|<sup>\*</sup>|<sup>\*</sup>|| |**SendOnBehalf**|A message was sent using the SendOnBehalf permission. This means another user sent the message on behalf of the mailbox owner. The message indicates to the recipient who the message was sent on behalf of and who actually sent the message.|<sup>\*</sup>|<sup>\*</sup>|| |**SoftDelete**|A message was permanently deleted or deleted from the Deleted Items folder. Soft-deleted items are moved to the Recoverable Items folder.|<sup>\*</sup>|<sup>\*</sup>|<sup>\*</sup>| The following table describes the mailbox actions that are available in mailbox |**UpdateComplianceTag**|A different retention label is applied to a mail item (an item can only have one retention label assigned to it).|||| |**UpdateFolderPermissions**|A folder permission was changed. Folder permissions control which users in your organization can access folders in a mailbox and the messages located in those folders.|<sup>\*</sup>|<sup>\*</sup>|<sup>\*</sup>| |**UpdateInboxRules**|An inbox rule was added, removed, or changed. Inbox rules are used to process messages in the user's Inbox based on the specified conditions and take actions when the conditions of a rule are met, such as moving a message to a specified folder or deleting a message.|<sup>\*</sup>|<sup>\*</sup>|<sup>\*</sup>|-| > [!IMPORTANT] > If you customized the mailbox actions to audit for any logon type *before* mailbox auditing on by default was enabled in your organization, the customized settings are preserved on the mailbox and aren't overwritten by the default mailbox actions as described in this section. To revert the audit mailbox actions to their default values (which you can do at any time), see the [Restore the default mailbox actions](#restore-the-default-mailbox-actions) section later in this article. The following table describes the mailbox actions that are logged by default on Remember, an admin with Full Access permission to a Microsoft 365 Group mailbox is considered a delegate. -<br> --**** - |Mailbox action|Description|Admin|Delegate|Owner| |||::|::|::| |**Create**|Creation of a calendar Item. Creating, sending, or receiving a message isn't audited.|<sup>\*</sup>|<sup>\*</sup>|| Remember, an admin with Full Access permission to a Microsoft 365 Group mailbox |**SendOnBehalf**|A message was sent using the SendOnBehalf permission.|<sup>\*</sup>|<sup>\*</sup>|| |**SoftDelete**|A message was permanently deleted or deleted from the Deleted Items folder. Soft-deleted items are moved to the Recoverable Items folder.|<sup>\*</sup>|<sup>\*</sup>|<sup>\*</sup>| |**Update**|A message or any of its property was changed.|<sup>\*</sup>|<sup>\*</sup>|<sup>\*</sup>|-| ### Verify that default mailbox actions are being logged for each logon type The value **True** indicates that mailbox audit logging is bypassed for the user - Manually enable mailbox auditing on individual mailboxes (run the command, `Set-Mailbox -Identity <MailboxIdentity> -AuditEnabled $true`). After you do this, you can use audit log searches in the Microsoft 365 compliance center or via the Office 365 Management Activity API. > [!NOTE]- > If mailbox auditing already appears to be enabled on the mailbox, but your searches return no results, change the value of the _AuditEnabled_ parameter to `$false` and then back to `$true`. + > If mailbox auditing already appears to be enabled on the mailbox, but your searches return no results, change the value of the *AuditEnabled* parameter to `$false` and then back to `$true`. - Use the following cmdlets in Exchange Online PowerShell: - [Search-MailboxAuditLog](/powershell/module/exchange/search-mailboxauditlog) to search the mailbox audit log for specific users. - [New-MailboxAuditLogSearch](/powershell/module/exchange/new-mailboxauditlogsearch) to search the mailbox audit log for specific users and to have the results sent via email to specified recipients. - - Use the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center (EAC)</a> in Exchange Online to do the following actions: + - Use the Exchange admin center (EAC) in Exchange Online to do the following actions: - [Export mailbox audit logs](/Exchange/security-and-compliance/exchange-auditing-reports/export-mailbox-audit-logs) - [Run a non-owner mailbox access report](/Exchange/security-and-compliance/exchange-auditing-reports/non-owner-mailbox-access-report) |
| compliance | Endpoint Dlp Learn About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/endpoint-dlp-learn-about.md | Microsoft Endpoint DLP enables you to audit and manage the following types of ac |create an item|Detects when a user creates an item|supported | |auditable| |rename an item|Detects when a user renames an item|supported | |auditable| +## Best practice for endpoint DLP policies ++Say you want to block all items that contain credit card numbers from leaving endpoints of Finance department users. We recommend: ++- Create a policy and scope it to endpoints and to that group of users. +- Create a rule in the policy that detects the type of information that you want to protect. In this case, **content contains** set to *Sensitive information type**, and select **Credit Card**. +- Set the actions for each activity to **Block**. ++See, [Design a data loss prevention policy](dlp-policy-design.md) for more guidance on designing your DLP policies. + ## Monitored files Endpoint DLP supports monitoring of these file types. DLP audits the activities for these file types, even if there isn't a policy match. |
| compliance | Information Barriers Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/information-barriers-policies.md | When you define policies for information barriers, you'll work with user account | **Steps** | **What's involved** | |:|:-|-| **Step 1**: [Make sure prerequisites are met](#step-1-make-sure-prerequisites-are-met) | - Verify that you have the [required licenses and permissions](information-barriers.md#required-licenses-and-permissions)<br/>- Verify that your directory includes data for segmenting users<br/>- Enable scoped directory search for Microsoft Teams<br/>- Make sure audit logging is turned on<br/>- Make sure no Exchange address book policies are in place<br/>- Use PowerShell (examples are provided)<br/>- Provide admin consent for Microsoft Teams (steps are included) | +| **Step 1**: [Make sure prerequisites are met](#step-1-make-sure-prerequisites-are-met) | - Verify that you have the [required licenses and permissions](information-barriers.md#required-licenses-and-permissions)<br/>- Verify that your directory includes data for segmenting users<br/>- Enable [search by name for Microsoft Teams](/microsoftteams/teams-scoped-directory-search)<br/>- Make sure audit logging is turned on<br/>- Make sure no Exchange address book policies are in place<br/>- Use PowerShell (examples are provided)<br/>- Provide admin consent for Microsoft Teams (steps are included) | | **Step 2**: [Segment users in your organization](#step-2-segment-users-in-your-organization) | - Determine what policies are needed<br/>- Make a list of segments to define<br/>- Identify which attributes to use<br/>- Define segments in terms of policy filters | | **Step 3**: [Define information barrier policies](#step-3-define-information-barrier-policies) | - Define your policies (do not apply yet)<br/>- Choose from two kinds (block or allow) | | **Step 4**: [Apply information barrier policies](#step-4-apply-information-barrier-policies) | - Set policies to active status<br/>- Run the policy application<br/>- View policy status | In addition to the [required licenses and permissions](information-barriers.md#r 1. When prompted, sign in using your work or school account for Office 365. - 1. In the **Permissions requested** dialog box, review the information, and then choose **Accept**. The permissions requested by the App is given below. + 1. In the **Permissions requested** dialog box, review the information, and then choose **Accept**. The permissions requested by the App are given below. > [!div class="mx-imgBorder"] >  The following IB modes are supported on Microsoft 365 resources: | **Mode** | **Description** | **Example** | |:--|:|:--| | **Open** | There aren't any IB policies or segments associated with the Microsoft 365 resource. Anyone can be invited to be a member of the resource. | A team site created for picnic event for your organization. |-| **Owner Moderated (preview)** | The IB policy of the Microsoft 365 resource is determined from the resource owner's IB policy. The resource owners can invite any user to the resource based on their IB policies. This mode is useful when your company wants to allow collaboration among incompatible segment users that are moderated by the owner. Only the resource owner can add new members per their IB policy. | The VP of the HR want to collaborate with the VPs of Sales and Research. A new SharePoint site that is set with IB mode *Owner Moderated* to add both Sales and Research segment users to the same site. It is the responsibility of the owner to ensure appropriate members are added to the resource. | +| **Owner Moderated (preview)** | The IB policy of the Microsoft 365 resource is determined from the resource owner's IB policy. The resource owners can invite any user to the resource based on their IB policies. This mode is useful when your company wants to allow collaboration among incompatible segment users that are moderated by the owner. Only the resource owner can add new members per their IB policy. | The VP of HR wants to collaborate with the VPs of Sales and Research. A new SharePoint site that is set with IB mode *Owner Moderated* to add both Sales and Research segment users to the same site. It is the responsibility of the owner to ensure appropriate members are added to the resource. | | **Implicit** | The IB policy or segments of the Microsoft 365 resource is inherited from the resource members IB policy. The owner can add members as long as they are compatible with the existing members of the resource. This is the default IB mode for Microsoft Teams. | The Sales segment user creates a Microsoft Teams team to collaborate with other compatible segments in the organization. | | **Explicit** | The IB policy of the Microsoft 365 resource is per the segments associated with the resource. The resource owner or SharePoint administrator has the ability to manage the segments on the resource. | A site created only for Sales segment members to collaborate by associating the Sales segment with the site. | |
| enterprise | Upgrade Office 2013 Clients Servers | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/upgrade-office-2013-clients-servers.md | + + Title: "Resources to help you upgrade from Office 2013 clients and servers" ++++audience: ITPro +++ms.localizationpriority: medium ++description: Plan your upgrade from Office 2013 clients and servers, because support ends on April 11, 2023. +++# Resources to help you upgrade from Office 2013 clients and servers ++If you're using Office 2013 clients and servers, be aware that ***support ends on April 11, 2023***. If you haven't already begun to upgrade from them to newer versions, we recommend you start now. ++As you plan your upgrade, consider moving to Microsoft 365. ++- Microsoft 365 has cloud-based services, such as Exchange Online, SharePoint, and Teams. ++- Microsoft 365 Apps for enterprise provides Office client apps that you can install on local devices. The apps are updated regularly from the Microsoft cloud with new productivity and security features. ++## Upgrade planning resources ++The following table provides links to planning resources to help you upgrade from these Office 2013 clients and servers. ++|Product|Planning resource| +||| +|Office 2013 (desktop apps)<br/>Project 2013<br/>Visio 2013|[Plan an upgrade from older versions of Office to Microsoft 365 Apps](/deployoffice/endofsupport/plan-upgrade-older-versions-office)| +|Exchange Server 2013|[Exchange 2013 end of support roadmap](exchange-2013-end-of-support.md)| +|SharePoint Server 2013 <br/> SharePoint Foundation 2013|[Upgrading from SharePoint 2013](upgrade-from-sharepoint-2013.md)| +|Project Server 2013|[Project Server 2013 end of support roadmap](project-server-2013-end-of-support.md)| +|Lync Server 2013|[Upgrading from Lync Server 2013](upgrade-from-lync-2013.md)| ++We also recommend business and enterprise customers use the deployment benefits provided by Microsoft and Microsoft Certified Partners, including [Microsoft FastTrack](https://www.microsoft.com/fasttrack) for cloud migrations. ++> [!NOTE] +> If you use Office 2013 products and applications at home, [review this information](plan-upgrade-previous-versions-office.md#im-a-home-user-what-do-i-do) for your upgrade choices. ++## Related articles ++- [Microsoft Lifecycle Policy](/lifecycle/) +- [Plan your upgrade from Office 2007 or Office 2010 servers and clients](plan-upgrade-previous-versions-office.md) |
| security | Compare Mdb M365 Plans | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/compare-mdb-m365-plans.md | Defender for Business brings enterprise-grade capabilities of Defender for Endpo The following table compares security features and capabilities in Defender for Business to Microsoft Defender for Endpoint Plans 1 and 2. <br/><br/> -| Feature/Capability | [Defender for Business](mdb-overview.md) (preview) | [Defender for Endpoint Plan 1](../defender-endpoint/defender-endpoint-plan-1.md) | [Defender for Endpoint Plan 2](../defender-endpoint/microsoft-defender-endpoint.md) | -|:|:|:| +| Feature/Capability | [Defender for Business](mdb-overview.md)<br/>(standalone; currently in preview) | [Defender for Endpoint Plan 1](../defender-endpoint/defender-endpoint-plan-1.md) | [Defender for Endpoint Plan 2](../defender-endpoint/microsoft-defender-endpoint.md) | +|:|:|:|:| | [Centralized management](../defender-endpoint/manage-atp-post-migration.md) <sup>[[1](#fn1)]</sup> | Yes | Yes | Yes | | [Simplified client configuration](mdb-simplified-configuration.md) | Yes | No | No | | [Threat & vulnerability management](../defender-endpoint/next-gen-threat-and-vuln-mgt.md) | Yes | No | Yes | The following table compares security features and capabilities in Defender for ## Next steps - [See the requirements for Microsoft Defender for Business](mdb-requirements.md)- - [Get Microsoft Defender for Business](get-defender-business.md)- - [Learn how to set up and configure Microsoft Defender for Business](mdb-setup-configuration.md) |
| security | Mdb Next Gen Configuration Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-next-gen-configuration-settings.md | The following table describes settings that are preconfigured for Defender for B | [Scan network files](/windows/client-management/mdm/policy-csp-defender#defender-allowscanningnetworkfiles) | By default, [AllowScanningNetworkFiles](/windows/client-management/mdm/policy-csp-defender#defender-allowscanningnetworkfiles) isn't enabled, and network files aren't scanned. | | [Scan email messages](/windows/client-management/mdm/policy-csp-defender#defender-allowemailscanning) | By default, [AllowEmailScanning](/windows/client-management/mdm/policy-csp-defender#defender-allowemailscanning) isn't enabled, and email messages aren't scanned. | | [Number of days (0-90) to keep quarantined malware](/windows/client-management/mdm/policy-csp-defender#defender-daystoretaincleanedmalware) | By default, [DaysToRetainCleanedMalware](/windows/client-management/mdm/policy-csp-defender#defender-daystoretaincleanedmalware) this setting is set to zero (0) days. Artifacts that in quarantine aren't removed automatically. |-| [Submit samples consent](/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent) | By default, [SubmitSamplesConsent](/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent) is et to send safe samples automatically. Examples of safe samples include `.bat`, `.scr`, `.dll`, and `.exe` files that don't contain personally identifiable information (PII). If a file does contain PII, the user receives a request to allow the sample submission to proceed.<br/><br/>[Learn more about cloud protection and sample submission](../defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission.md) | +| [Submit samples consent](/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent) | By default, [SubmitSamplesConsent](/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent) is set to send safe samples automatically. Examples of safe samples include `.bat`, `.scr`, `.dll`, and `.exe` files that don't contain personally identifiable information (PII). If a file does contain PII, the user receives a request to allow the sample submission to proceed.<br/><br/>[Learn more about cloud protection and sample submission](../defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission.md) | | [Scan removable drives](/windows/client-management/mdm/policy-csp-defender#defender-allowfullscanremovabledrivescanning) | By default, [AllowFullScanRemovableDriveScanning](/windows/client-management/mdm/policy-csp-defender#defender-allowfullscanremovabledrivescanning) is configured to scanning removable drives, such as USB thumb drives on devices.<br/><br/>[Learn more about antimalware policy settings](/mem/configmgr/protect/deploy-use/endpoint-antimalware-policies#list-of-antimalware-policy-settings) | | [Run daily quick scan time](/windows/client-management/mdm/policy-csp-defender#defender-schedulequickscantime) | By default, [ScheduleQuickScanTime](/windows/client-management/mdm/policy-csp-defender#defender-schedulequickscantime) is set to 2:00 AM.<br/><br/>[Learn more about scan settings](/mem/configmgr/protect/deploy-use/endpoint-antimalware-policies#scan-settings). | | [Check for signature updates before running scan](/windows/client-management/mdm/policy-csp-defender#defender-checkforsignaturesbeforerunningscan) | By default, [CheckForSignaturesBeforeRunningScan](/windows/client-management/mdm/policy-csp-defender#defender-checkforsignaturesbeforerunningscan) is configured to check for security intelligence updates prior to running antivirus/antimalware scans.<br/><br/>[Learn more about scan settings](/mem/configmgr/protect/deploy-use/endpoint-antimalware-policies#scan-settings) and [Security intelligence updates](../defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus.md#security-intelligence-updates). | The following table describes settings that are preconfigured for Defender for B - [Manage firewall settings in Microsoft Defender for Business](mdb-custom-rules-firewall.md) -- [Policy CSP - Defender](/windows/client-management/mdm/policy-csp-defender)+- [Policy CSP - Defender](/windows/client-management/mdm/policy-csp-defender) |
| security | TOC | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/TOC.md | ### [Endpoint detection and response]() #### [Endpoint detection and response overview](overview-endpoint-detection-response.md) #### [Security operations dashboard](security-operations-dashboard.md) +#### [Submit suspicious files](admin-submissions-mde.md) #### [Incidents queue]() ##### [View and organize the Incidents queue](view-incidents-queue.md) ##### [Manage incidents](manage-incidents.md) |
| security | Admin Submissions Mde | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/admin-submissions-mde.md | + + Title: Submit suspicious files in Microsoft Defender for Endpoint +description: Learn how to use the unified submissions feature in Microsoft 365 Defender to submit suspicious emails, URLs, email attachments, and files to Microsoft for scanning. +keywords: antivirus, spam, phish, file, alert, Microsoft Defender for Endpoint, false positive, false negative, blocked file, blocked url, submission, submit, report +search.product: eADQiWindows 10XVcnh +search.appverid: met150 Last updated : 06/15/2021+ms.technology: mde +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ++++localization_priority: Normal +audience: ITPro +++- m365-security-compliance +- m365initiative-defender-endpoint +- m365solution-scenario +- m365scenario-fpfn ++++# Submit suspicious files in Microsoft Defender for Endpoint +++**Applies to** ++- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146806) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ++>Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-usewdatp-abovefoldlink). ++In Microsoft Defender for Endpoint, admins can use the unified submissions feature to submit files and file hashes (SHAs) to Microsoft for review. The unified submissions experience is a one-stop shop for submitting emails, URLs, email attachments, and files in one, easy-to-use submission experience. Admins can use the Microsoft 365 Defender portal or the Microsoft Defender for Endpoint Alert page to submit suspicious files. ++## What do you need to know before you begin? ++- The new unified submissions experience is available only in subscriptions that include Microsoft 365 Defender, Microsoft Defender for Endpoint Plan 2, or Microsoft Defender for Office Plan 2. ++- To submit files to Microsoft, you need to be a member of one of the following role groups: ++ - **Organization Management** or **Security Administrator** in the [Microsoft 365 Defender portal](../office-365-security/permissions-microsoft-365-security-center.md). ++- For more information about how you can submit spam, phish, URLs, and email attachments to Microsoft, see [Report messages and files to Microsoft](../office-365-security/report-junk-email-messages-to-microsoft.md). ++## Report suspicious items to Microsoft from the portal ++If you have a file that you suspect might be malware or is being incorrectly detected, you can submit it to Microsoft for analysis using the Microsoft 365 Defender portal at https://security.microsoft.com/. ++### Submit a suspected file or file hash ++1. Open Microsoft 365 Defender at <https://security.microsoft.com/>, click **Actions & submissions**, click **Submissions**, go to **Files** tab, and then select **Add new submission**. ++ > [!div class="mx-imgBorder"] + >  ++2. Use the **Submit items to Microsoft for review** flyout that appears to submit the **File** or **File hash**. ++3. In the **Select the submission type** box, select **File** or **File hash** from the drop-down list. ++4. When submitting a file, click **Browse files**. In the dialog that opens, find and select the file, and then click **Open**. Note that for **File hash** submissions, you'll either have to copy or type in the file hash. ++5. In the **This file should have been categorized as** section, choose either **Malware** (false negative), or **Unwanted software**, or **Clean** (false positive). + +6. Next, **Choose the priority**. Note that for **File hash** submissions, **Low - bulk file or file hash submission** is the only choice, and is automatically selected. ++ > [!div class="mx-imgBorder"] + >  ++8. Click **Submit**. + + If you want to view the details of your submission, select your submission from the **Submissions name** list to open the **Result details** flyout. ++## Report suspicious items to Microsoft from the Alerts page ++You can also submit a file or file hash directly from the list of alerts on the **Alerts** page. ++1. Open the Microsoft 365 Defender at <https://security.microsoft.com/>, click **Incidents & alerts**, and then click **Alerts** to view the list of alerts. ++2. Select the alert you want to report. Note that you are submitting a file that is nestled within the alert. ++3. Click the ellipses next to **Manage alert** to see additional options. Select **Submit items to Microsoft for review**. ++ > [!div class="mx-imgBorder"] + >  ++4. In the next flyout that opens, select the submission type. ++ > [!div class="mx-imgBorder"] + >  ++ If you select **File** as the submission type, upload the file, categorize your submission, and choose the priority. + + If you select **File Hash** as the submission type, choose the file hashes that are available from the drop-down. You can select multiple file hashes. + +5. Click **Submit**. ++## Related information ++- [Microsoft Defender for Endpoint in Microsoft 365 Defender](../defender/microsoft-365-security-center-mde.md) +- [Address false positives/negatives](defender-endpoint-false-positives-negatives.md) +- [View and organize alerts queue in Microsoft Defender for Endpoint](alerts-queue.md) |
| security | Manage Protection Update Schedule Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-protection-update-schedule-microsoft-defender-antivirus.md | You can also randomize the times when each endpoint checks and downloads protect ## Use Group Policy to schedule protection updates > [!IMPORTANT]-> By default, Microsoft Defender Antivirus will check for an update 15 minutes before the time of any scheduled scans. Enabling these settings will override that default. +> By default, "SignatureScheduleDay" is set as "8" and "SignatureUpdateInterval" is set as "0" so Microsoft Defender Antivirus will not schedule protection updates. +Enabling these settings will override that default. 1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. |
| security | Manage Protection Updates Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-protection-updates-microsoft-defender-antivirus.md | Keeping your antivirus protection up to date is critical. There are two componen This article describes how to specify from where updates should be downloaded (this is also known as the fallback order). See [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) topic for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates). > [!IMPORTANT]-> Microsoft Defender Antivirus Security intelligence updates are delivered through Windows Update and starting Monday, October 21, 2019, all security intelligence updates will be SHA-2 signed exclusively. Your devices must be updated to support SHA-2 in order to update your security intelligence. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). +> Microsoft Defender Antivirus Security intelligence updates and platform updates are delivered through Windows Update and starting Monday, October 21, 2019, all security intelligence updates will be SHA-2 signed exclusively. Your devices must be updated to support SHA-2 in order to update your security intelligence. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). <a id="fallback-order"></a> There are five locations where you can specify where an endpoint should obtain u (<a id="fn1">2</a>) Your policy and registry might have this listed as Microsoft Malware Protection Center (MMPC) security intelligence, its former name. -To ensure the best level of protection, Microsoft Update allows for rapid releases, which means smaller downloads on a frequent basis. The Windows Server Update Service, Microsoft Endpoint Configuration Manager, and Microsoft security intelligence updates sources deliver less frequent updates. Thus, the delta can be larger, resulting in larger downloads. +To ensure the best level of protection, Microsoft Update allows for rapid releases, which means smaller downloads on a frequent basis. The Windows Server Update Service, Microsoft Endpoint Configuration Manager, Microsoft security intelligence updates, and platform updates sources deliver less frequent updates. Thus, the delta can be larger, resulting in larger downloads. ++> [!NOTE] +> Security intelligence updates contain engine updates and are released on a monthly cadence. +Security intelligence updates are also delivered multiple times a day, but this package doesnΓÇÖt contain an engine. + > [!IMPORTANT]-> If you have set [Microsoft Security intelligence page](https://www.microsoft.com/security/portal/definitions/adl.aspx) updates as a fallback source after Windows Server Update Service or Microsoft Update, updates are only downloaded from security intelligence updates when the current update is considered out-of-date. (By default, this is seven consecutive days of not being able to apply updates from the Windows Server Update Service or Microsoft Update services). +> If you have set [Microsoft Security intelligence page](https://www.microsoft.com/security/portal/definitions/adl.aspx) updates as a fallback source after Windows Server Update Service or Microsoft Update, updates are only downloaded from security intelligence updates and platform updates when the current update is considered out-of-date. (By default, this is seven consecutive days of not being able to apply updates from the Windows Server Update Service or Microsoft Update services). > You can, however, [set the number of days before protection is reported as out-of-date](/windows/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).<p>-> Starting Monday, October 21, 2019, security intelligence updates will be SHA-2 signed exclusively. Devices must be updated to support SHA-2 in order to get the latest security intelligence updates. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). +> Starting Monday, October 21, 2019, security intelligence updates and platform updates will be SHA-2 signed exclusively. Devices must be updated to support SHA-2 in order to get the latest security intelligence updates and platform updates. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). Each source has typical scenarios that depend on how your network is configured, in addition to how often they publish updates, as described in the following table: Each source has typical scenarios that depend on how your network is configured, |Microsoft Update|You want your endpoints to connect directly to Microsoft Update. This can be useful for endpoints that irregularly connect to your enterprise network, or if you do not use Windows Server Update Service to manage your updates.| |File share|You have non-Internet-connected devices (such as VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-microsoft-defender-antivirus.md) for how file shares can be used in virtual desktop infrastructure (VDI) environments.| |Microsoft Endpoint Manager|You are using Microsoft Endpoint Manager to update your endpoints.|-|Security intelligence updates for Microsoft Defender Antivirus and other Microsoft anti-malware (formerly referred to as MMPC)|[Make sure your devices are updated to support SHA-2](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). Microsoft Defender Antivirus Security intelligence updates are delivered through Windows Update, and starting Monday October 21, 2019 security intelligence updates will be SHA-2 signed exclusively. <br/>Download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-microsoft-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. It will only be used if updates cannot be downloaded from Windows Server Update Service or Microsoft Update for [a specified number of days](/windows/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).| +|Security intelligence updates and platform updates for Microsoft Defender Antivirus and other Microsoft anti-malware (formerly referred to as MMPC)|[Make sure your devices are updated to support SHA-2](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). Microsoft Defender Antivirus Security intelligence and platform updates are delivered through Windows Update, and starting Monday October 21, 2019 security intelligence updates and platform updates will be SHA-2 signed exclusively. <br/>Download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-microsoft-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. It will only be used if updates cannot be downloaded from Windows Server Update Service or Microsoft Update for [a specified number of days](/microsoft-365/security/defender-endpoint/manage-outdated-endpoints-microsoft-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).| You can manage the order in which update sources are used with Group Policy, Microsoft Endpoint Configuration Manager, PowerShell cmdlets, and WMI. For example, suppose that Contoso has hired Fabrikam to manage their security so <a id="unc-share"></a> -## Create a UNC share for security intelligence updates +## Create a UNC share for security intelligence and platform updates -Set up a network file share (UNC/mapped drive) to download security intelligence updates from the MMPC site by using a scheduled task. +Set up a network file share (UNC/mapped drive) to download security intelligence and platform updates from the MMPC site by using a scheduled task. 1. On the system on which you want to provision the share and download the updates, create a folder to which you will save the script. |
| security | Manage Updates Baselines Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus.md | All our updates contain - Integration improvements (Cloud, [Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-defender)) <br/><br/> <details>+<summary>March-2022 (Platform: 4.18.2203.5 | Engine: 1.1.19100.5)</summary> ++ Security intelligence update version: **1.361.1449.0**<br/> + Released: **March 7, 2022**<br/> + Platform: **4.18.2203.5**<br/> + Engine: **1.1.19100.5**<br/> + Support phase: **Security and Critical Updates**<br/> ++Engine version: 1.1.19100.5 <br/> +Security intelligence update version: 1.361.1449.0<br/> ++### What's new ++- Added fix for an [attack surface reduction rule](attack-surface-reduction.md) that blocked an Outlook add-in +- Added fix for [behavior monitoring](configure-protection-features-microsoft-defender-antivirus.md) performance issue related to short live processes +- Added fix for [AMSI](/windows/win32/amsi/antimalware-scan-interface-portal) exclusion +- Improved [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) capabilities +- Added a fix for [real-time protection](configure-protection-features-microsoft-defender-antivirus.md) getting disabled in some cases when using `SharedSignaturesPath` config (For more details about the `SharedSignaturesPath` parameter, see [Set-MpPreference](/powershell/module/defender/set-mppreference)) ++### Known Issues ++No known issues ++<br/><br/> +</details><details> <summary>February-2022 (Platform: 4.18.2202.4 | Engine: 1.1.19000.8)</summary>  Security intelligence update version: **1.361.14.0**<br/> Security intelligence update version: 1.357.8.0 <br/> No known issues <br/><br/>-</details><details> +</details> +++### Previous version updates: Technical upgrade support only ++After a new package version is released, support for the previous two versions is reduced to technical support only. Versions older than that are listed in this section, and are provided for technical upgrade support only.<br/><br/> ++<details> <summary>November-2021 (Platform: 4.18.2111.5 | Engine: 1.1.18800.4)</summary>  Security intelligence update version: **1.355.2.0**<br/>  Released: **December 9th, 2021**<br/>  Platform: **4.18.2111.5**<br/>  Engine: **1.1.18800.4**<br/>- Support phase: **Security and Critical Updates**<br/> + Support phase: **Technical upgrade support (only)**<br/> Engine version: 1.1.18800.4 Security intelligence update version: 1.355.2.0 Security intelligence update version: 1.355.2.0 ### Known Issues No known issues <br/>-</details> ---### Previous version updates: Technical upgrade support only --After a new package version is released, support for the previous two versions is reduced to technical support only. Versions older than that are listed in this section, and are provided for technical upgrade support only.<br/><br/> --<details> +</details><details> <summary> October-2021 (Platform: 4.18.2110.6 | Engine: 1.1.18700.4)</summary>  Security intelligence update version: **1.353.3.0**<br/> |
| security | Prevent Changes To Security Settings With Tamper Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection.md | +- Windows 10 +- Windows 10 Enterprise multi-session - Windows Server 2022+- Windows Server 2019 - Windows Server, version 1803 or later - Windows Server 2016 - Windows Server 2012 R2 > [!NOTE]-> Tamper protection in Windows Server 2012 R2 is available for devices onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016 Preview](/microsoft-365/security/defender-endpoint/configure-server-endpoints#new-functionality-in-the-modern-unified-solution-for-windows-server-2012-r2-and-2016-preview). +> Tamper protection in Windows Server 2012 R2 is available for devices that are onboarded to Microsoft Defender for Endpoint by using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016 Preview](/microsoft-365/security/defender-endpoint/configure-server-endpoints#new-functionality-in-the-modern-unified-solution-for-windows-server-2012-r2-and-2016-preview). ## Overview -During some kinds of cyber attacks, bad actors try to disable security features, such as anti-virus protection, on your machines. Bad actors like to disable your security features to get easier access to your data, to install malware, or to otherwise exploit your data, identity, and devices. Tamper protection helps prevent these kinds of things from occurring. --With tamper protection, malicious apps are prevented from taking actions such as: +During some kinds of cyber attacks, bad actors try to disable security features, such as antivirus protection, on your machines. Bad actors like to disable your security features to get easier access to your data, to install malware, or to otherwise exploit your data, identity, and devices. Tamper protection helps prevent these kinds of things from occurring. With tamper protection, malicious apps are prevented from taking actions such as: - Disabling virus and threat protection - Disabling real-time protection Tamper protection doesn't prevent you from viewing your security settings. And, ### What do you want to do? -<br/><br/> - |To perform this task...|See this section...| ||| |Manage tamper protection across your tenant <p> Use the Microsoft 365 Defender portal to turn tamper protection on or off|[Manage tamper protection for your organization using the Microsoft 365 Defender](#manage-tamper-protection-for-your-organization-using-the-microsoft-365-defender-portal)| Tamper protection doesn't prevent you from viewing your security settings. And, |Review your security recommendations|[Review security recommendations](#review-your-security-recommendations)| |Review the list of frequently asked questions (FAQs)|[Browse the FAQs](#view-information-about-tampering-attempts)| -Depending on the method or management tool you use to enable tamper protection, there might be a dependency on cloud-delivered protection. +## Potential dependency on cloud protection + +Depending on the method or management tool you use to enable tamper protection, there might be a dependency on [cloud-delivered protection](cloud-protection-microsoft-defender-antivirus.md) Cloud-delivered protection is also referred to as cloud protection, or Microsoft Advanced Protection Service (MAPS). The following table provides details on the methods, tools, and dependencies. -<br/><br/> --|How tamper protection is enabled|Dependency on cloud-delivered protection (MAPS)| +| How tamper protection is enabled | Dependency on cloud protection | ||| |Microsoft Intune|No|-|Microsoft Endpoint Configuration Manager + Tenant Attach|No| +|Microsoft Endpoint Configuration Manager with Tenant Attach|No| |Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com))|Yes| ## Manage tamper protection for your organization using the Microsoft 365 Defender portal The following table provides details on the methods, tools, and dependencies. Tamper protection can be turned on or off for your tenant using the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). Here are a few points to keep in mind: - Currently, the option to manage tamper protection in the Microsoft 365 Defender portal is on by default for new deployments. For existing deployments, tamper protection is available on an opt-in basis. To opt in, in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, choose **Settings** \> **Endpoints** \> **Advanced features** \> **Tamper protection**.- - When you use the Microsoft 365 Defender portal to manage tamper protection, you do not have to use Intune or the tenant attach method.- - When you manage tamper protection in the Microsoft 365 Defender portal, the setting is applied tenant wide, affecting all of your devices that are running Windows 10, Windows 10 Enterprise multi-session, Windows 11, Windows 11 Enterprise multi-session, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 or Windows Server 2022. To fine-tune tamper protection (such as having tamper protection on for some devices but off for others), use either [Microsoft Endpoint Manager](#manage-tamper-protection-for-your-organization-using-microsoft-endpoint-manager) or [Configuration Manager with tenant attach](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006).- - If you have a hybrid environment, tamper protection settings configured in Intune take precedence over settings configured in the Microsoft 365 Defender portal. ### Requirements for managing tamper protection in the Microsoft 365 Defender portal Tamper protection can be turned on or off for your tenant using the Microsoft 36 - Your Windows devices must be running one of the following versions of Windows: - - Windows 10 - Windows 11- - Windows 10 Enterprise multi-session - Windows 11 Enterprise multi-session - - Windows Server 2019 + - Windows 10 + - Windows 10 Enterprise multi-session - Windows Server 2022+ - Windows Server 2019 - Windows Server, version 1803 or later - Windows Server 2016 - Windows Server 2012 R2 Tamper protection can be turned on or off for your tenant using the Microsoft 36 For more information about releases, see [Windows 10 release information](/windows/release-health/release-information). - Your devices must be [onboarded to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboarding).- - Your devices must be using anti-malware platform version `4.18.2010.7` (or above) and anti-malware engine version `1.1.17600.5` (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).)- - [Cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) must be turned on. +> [!NOTE] +> When tamper protection is enabled via the Microsoft 365 Defender portal, cloud-delivered protection is required, so that the enabled state of tamper protection can be controlled. +> Starting with the November 2021 update (platform version `4.18.2111.5`), if cloud-delivered protection is not turned on for a device and tamper protection is turned on in the Microsoft 365 Defender portal, then cloud-delivered protection will be automatically turned on for that device along with tamper protection. + ### Turn tamper protection on (or off) in the Microsoft 365 Defender portal :::image type="content" source="../../medie-turn-tamperprotectionon.png"::: If your organization uses Microsoft Endpoint Manager (MEM) you can turn tamper p ### Requirements for managing tamper protection in Endpoint Manager - Your devices must be [onboarded to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboarding).- - You must have appropriate [permissions](/microsoft-365/security/defender-endpoint/assign-portal-access) assigned, such as global admin, security admin, or security operations.- - Your organization uses [Microsoft Endpoint Manager to manage devices](/mem/endpoint-manager-getting-started). (Microsoft Endpoint Manager (MEM) licenses are required; MEM is included in Microsoft 365 E3/E5, Enterprise Mobility + Security E3/E5, Microsoft 365 Business Premium, Microsoft 365 F1/F3, Microsoft 365 Government G3/G5, and corresponding education licenses.)- - Your Windows devices must be running Windows 11 or Windows 10 [1709](/windows/release-health/status-windows-10-1709), [1803](/windows/release-health/status-windows-10-1803), [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), or later. (For more information about releases, see [Windows 10 release information](/windows/release-health/release-information).)- - You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above).- - Your devices must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version `1.1.15500.X` (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).) ### Turn tamper protection on (or off) in Microsoft Endpoint Manager See the following resources: > Tamper protection blocks attempts to modify Microsoft Defender Antivirus settings through the registry. > > To help ensure that tamper protection doesn't interfere with non-Microsoft security products or enterprise installation scripts that modify these settings, go to **Windows Security** and update **Security intelligence** to version 1.287.60.0 or later. (See [Security intelligence updates](https://www.microsoft.com/wdsi/definitions).)-> > Once you've made this update, tamper protection continues to protect your registry settings, and logs attempts to modify them without returning errors. If you are a home user, or you are not subject to settings managed by a security team, you can use the Windows Security app to manage tamper protection. You must have appropriate admin permissions on your device to do change security settings, such as tamper protection. To learn more about Threat & Vulnerability Management, see [Dashboard insights - ### On which versions of Windows can I configure tamper protection? -Windows 10 OS [1709](/windows/release-health/status-windows-10-1709), [1803](/windows/release-health/status-windows-10-1803), [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), or later together with [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint). - -Windows 10 Enterprise multi-session --Windows 11 --Windows 11 Enterprise multi-session +- Windows 11 +- Windows 11 Enterprise multi-session +- Windows 10 OS [1709](/windows/release-health/status-windows-10-1709), [1803](/windows/release-health/status-windows-10-1803), [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), or later together with [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint). +- Windows 10 Enterprise multi-session If you are using Configuration Manager, version 2006, with tenant attach, tamper protection can be extended to Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, and Windows Server 2022. See [Tenant attach: Create and deploy endpoint security Antivirus policy from the admin center (preview)](/mem/configmgr/tenant-attach/deploy-antivirus-policy). Your security operations team can also use hunting queries, such as the followin ## See also -[Help secure Windows PCs with Endpoint Protection for Microsoft Intune](/intune/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) --[Get an overview of Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint) --[Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](why-use-microsoft-defender-antivirus.md) +- [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](/intune/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) +- [Get an overview of Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint) +- [Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](why-use-microsoft-defender-antivirus.md) |
| security | Advanced Hunting Devicelogonevents Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicelogonevents-table.md | For information on other tables in the advanced hunting schema, [see the advance | `AppGuardContainerId` | `string` | Identifier for the virtualized container used by Application Guard to isolate browser activity | | `AdditionalFields` | `string` | Additional information about the event in JSON array format | +>[!NOTE] +>The collection of DeviceLogonEvents is not supported on Windows 7 or Windows Server 2008R2 devices onboarded to Defender for Endpoint. We recommend upgrading to a more recent operating system for optimal visibility into user logon activity. + ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) - [Learn the query language](advanced-hunting-query-language.md) |
| security | Advanced Hunting Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-overview.md | ms.technology: m365d **Applies to:** - Microsoft 365 Defender -> Want to experience Microsoft 365 Defender? You can [evaluate it in a lab environment](m365d-evaluation.md?ocid=cx-docs-MTPtriallab) or [run your pilot project in production](m365d-pilot.md?ocid=cx-evalpilot). -> - Advanced hunting is a query-based threat hunting tool that lets you explore up to 30 days of raw data. You can proactively inspect events in your network to locate threat indicators and entities. The flexible access to data enables unconstrained hunting for both known and potential threats. <br><br> |
| security | Incidents Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/incidents-overview.md | ms.technology: m365d **Applies to:** - Microsoft 365 Defender -> Want to experience Microsoft 365 Defender? You can [evaluate it in a lab environment](m365d-evaluation.md?ocid=cx-docs-MTPtriallab) or [run your pilot project in production](m365d-pilot.md?ocid=cx-evalpilot). -> - An incident in Microsoft 365 Defender is a collection of correlated alerts and associated data that make up the story of an attack. Microsoft 365 services and apps create alerts when they detect a suspicious or malicious event or activity. Individual alerts provide valuable clues about a completed or ongoing attack. However, attacks typically employ various techniques against different types of entities, such as devices, users, and mailboxes. The result is multiple alerts for multiple entities in your tenant. |
| security | M365d Autoir | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/m365d-autoir.md | If your organization is using [Microsoft 365 Defender](microsoft-365-defender.md This article provides an overview of AIR and includes links to next steps and additional resources. -> [!TIP] -> Want to experience Microsoft 365 Defender? You can [evaluate it in a lab environment](m365d-evaluation.md?ocid=cx-docs-MTPtriallab) or [run your pilot project in production](m365d-pilot.md?ocid=cx-evalpilot). - ## How automated investigation and self-healing works As security alerts are triggered, it's up to your security operations team to look into those alerts and take steps to protect your organization. Prioritizing and investigating alerts can be very time consuming, especially when new alerts keep coming in while an investigation is going on. Security operations teams can feel overwhelmed by the sheer volume of threats they must monitor and protect against. Automated investigation and response capabilities, with self-healing, in Microsoft 365 Defender can help. |
| security | Microsoft 365 Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-defender.md | ms.technology: m365d **Applies to:** - Microsoft 365 Defender -> Want to experience Microsoft 365 Defender? You can [evaluate it in a lab environment](m365d-evaluation.md?ocid=cx-docs-MTPtriallab) or [run your pilot project in production](m365d-pilot.md?ocid=cx-evalpilot). -> - Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. With the integrated Microsoft 365 Defender solution, security professionals can stitch together the threat signals that each of these products receive and determine the full scope and impact of the threat; how it entered the environment, what it's affected, and how it's currently impacting the organization. Microsoft 365 Defender takes automatic action to prevent or stop the attack and self-heal affected mailboxes, endpoints, and user identities. |
| security | Threat Analytics Analyst Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/threat-analytics-analyst-reports.md | -> Want to experience Microsoft 365 Defender? You can [evaluate it in a lab environment](m365d-evaluation.md?ocid=cx-docs-MTPtriallab) or [run your pilot project in production](m365d-pilot.md?ocid=cx-evalpilot). -> - [!INCLUDE [Prerelease](../includes/prerelease.md)] Each [threat analytics report](threat-analytics.md) includes dynamic sections and a comprehensive written section called the _analyst report_. To access this section, open the report about the tracked threat and select the **Analyst report** tab. |
| security | Threat Analytics | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/threat-analytics.md | -> Want to experience Microsoft 365 Defender? You can [evaluate it in a lab environment](m365d-evaluation.md?ocid=cx-docs-MTPtriallab) or [run your pilot project in production](m365d-pilot.md?ocid=cx-evalpilot). -> - [!INCLUDE [Prerelease](../includes/prerelease.md)] Threat analytics is our in-product threat intelligence solution from expert Microsoft security researchers. It's designed to assist security teams to be as efficient as possible while facing emerging threats, such as: |
| security | Top Scoring Industry Tests | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/top-scoring-industry-tests.md | ms.technology: m365d [!INCLUDE [Microsoft 365 Defender rebranding](../includes/microsoft-defender.md)] -> Want to experience Microsoft 365 Defender? You can [evaluate it in a lab environment](m365d-evaluation.md?ocid=cx-docs-MTPtriallab) or [run your pilot project in production](m365d-pilot.md?ocid=cx-evalpilot). -> - [Microsoft 365 Defender](https://www.microsoft.com/security/business/threat-protection/integrated-threat-protection) technologies consistently achieve high scores in independent tests, demonstrating the strength of its enterprise threat protection capabilities. Microsoft aims to be transparent about these test scores. This page summarizes the results and provides analysis. ## Microsoft 365 Defender |
| security | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/whats-new.md | ms.technology: m365d [!INCLUDE [Microsoft 365 Defender rebranding](../includes/microsoft-defender.md)] -> Want to experience Microsoft 365 Defender? You can [evaluate it in a lab environment](m365d-evaluation.md?ocid=cx-docs-MTPtriallab) or [run your pilot project in production](m365d-pilot.md?ocid=cx-evalpilot). --The following features are in preview or generally available (GA) in the latest release of Microsoft 365 Defender. +>The following features are in preview or generally available (GA) in the latest release of Microsoft 365 Defender. RSS feed: Get notified when this page is updated by copying and pasting the following URL into your feed reader: |
| security | Microsoft Defender For Office | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/includes/microsoft-defender-for-office.md | -> [!IMPORTANT] -> The improved <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> is now available. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 Defender portal. [Learn what's new](/microsoft-365/security/defender/overview-security-center). +> [!NOTE] +> Want to experience Microsoft 365 Defender? Learn more about how you can [evaluate and pilot Microsoft 365 Defender](/microsoft-365/security/defender/eval-overview?ocid=cx-docs-MTPtriallab). |
| security | Microsoft Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/includes/microsoft-defender.md | -> [!IMPORTANT] -> The improved <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> is now available. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 Defender portal. [Learn what's new](/microsoft-365/security/mtp/overview-security-center). +> [!NOTE] +> Want to experience Microsoft 365 Defender? Learn more about how you can [evaluate and pilot Microsoft 365 Defender](/microsoft-365/security/defender/eval-overview?ocid=cx-docs-MTPtriallab). |
| security | Configure Advanced Delivery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-advanced-delivery.md | To keep your organization [secure by default](secure-by-default.md), Exchange On You use the _advanced delivery policy_ in Microsoft 365 to prevent inbound messages _in these specific scenarios_ from being filtered.<sup>\*</sup> The advanced delivery policy ensures that messages in these scenarios achieve the following results: - Filters in EOP and Microsoft Defender for Office 365 take no action on these messages.<sup>\*</sup>-- [Zero-hour Purge (ZAP)](zero-hour-auto-purge.md) for spam and phishing take no action on these messages.<sup>\*</sup>+- [Zero-hour Purge (ZAP)](zero-hour-auto-purge.md) for spam and phishing take no action on these messages.<sup>\*\*</sup> - [Default system alerts](/microsoft-365/compliance/alert-policies#default-alert-policies) aren't triggered for these scenarios. - [AIR and clustering in Defender for Office 365](office-365-air.md) ignores these messages. - Specifically for third-party phishing simulations: You use the _advanced delivery policy_ in Microsoft 365 to prevent inbound messa - [Safe Links in Defender for Office 365](safe-links.md) doesn't block or detonate the specifically identified URLs in these messages at time of click. URLs are still wrapped, but they aren't blocked. - [Safe Attachments in Defender for Office 365](safe-attachments.md) doesn't detonate attachments in these messages. -<sup>\*</sup> You can't bypass malware filtering or ZAP for malware. +<sup>\*</sup> You can't bypass malware filtering. ++<sup>\*\*</sup> You can bypass ZAP for malware by creating an anti-malware policy for the SecOps mailbox where ZAP for malware is turned off. For instructions, see [Configure anti-malware policies in EOP](configure-anti-malware-policies.md). Messages that are identified by the advanced delivery policy aren't security threats, so the messages are marked with system overrides. Admin experiences will show these messages as due to either a **Phishing simulation** system override or a **SecOps mailbox** system override. Admins can filter and analyze on these system overrides in the following experiences: |
| security | Configure Review Priority Account | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-review-priority-account.md | + + Title: Configure and review priority accounts in Microsoft Defender for Office 365 +f1.keywords: + - NOCSH +++ Last updated : 3/21/2022+audience: ITPro ++ms.localizationpriority: medium +search.appverid: + - MET150 ++ - M365-security-compliance ++description: Learn how to identify critical people in an organization and add the priority account tag to provide them with extra protection. +ms.technology: mdo +++# Configure and review priority accounts in Microsoft Defender for Office 365 +++**Applies to** +- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) +- [Microsoft 365 Defender](../defender/microsoft-365-defender.md) ++In every organization, there are people that are critical, like executives, leaders, managers, or other users who have access to sensitive, proprietary, or high priority information. You can tag these users within Microsoft Defender for Office 365 as priority accounts, allowing security teams to prioritize their focus on these critical individuals. With differentiated protection for priority accounts, users tagged as priority accounts will receive a higher level of protection against threats. ++Priority accounts are targeted by attackers more often and are generally attacked with more sophisticated techniques. Differentiated protection for priority accounts focuses on this specific user set and provides higher level of protection using enhanced machine learning models. This differentiation in learning and message handling provides the highest level of protection for these accounts and helps maintain a low false positive rate, as a high rate of false positives can also have a negative impact on these users. ++## Configure priority account protection ++Priority account protection is turned on by default for pre-identified critical users. However, the security administrator of your organization can also turn on priority account protection by following these steps: ++1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Settings** \> **Email & collaboration** \> **Priority account protection**. ++2. Turn on **Priority account protection**. ++ > [!div class="mx-imgBorder"] + >  ++> [!NOTE] +> It is not recommended to disable or turn off priority account protection. ++### Enable the priority account tag ++Microsoft Defender for Office 365 supports priority accounts as tags that can be used as filters in alerts, reports, and investigations. ++For more information, see [User tags in Microsoft Defender for Office 365](user-tags.md). ++## Review differentiated protection in Threat protection status report, Threat Explorer, and email entity page ++### Threat protection status report ++The Threat protection status report is a single view that brings together information about malicious content and malicious email detected and blocked by Microsoft Defender for Office 365. ++To view the report in the Microsoft 365 Defender portal, go to **Reports** \> **Email & collaboration** \> **Email & collaboration reports**. On the **Email & collaboration reports** page, find **Threat protection status**, and then click **View details**. ++### Threat Explorer ++Context filter within Threat Explorer helps search for emails where priority account protection was involved in the detection of the message. This allows security operations teams to be able to see the value provided by this protection. You can still filter messages by priority account tag to find all messages for the specific set of users. ++To view the extra protection, in the Microsoft 365 Defender portal, go to **Email & collaboration** \> **Explorer**, select **Context** from the dropdown, and then select the checkbox next to **Priority account protection**. ++> [!div class="mx-imgBorder"] +>  ++### Email entity page ++The email entity page is available in the Microsoft 365 Defender portal at <https://security.microsoft.com> at **Email & collaboration** \> **Explorer**. In **Explorer**, select the subject of an email you're investigating. A gold bar will display at the top of the email flyout for that mail. Select to view the new page. ++The tabs along the top of the entity page will allow you to investigate email efficiently. Click the **Analysis** tab. Priority account protection is now listed under **Threat detection details**. ++## More information ++- [User tags in Microsoft Defender for Office 365](user-tags.md) +- [Manage and monitor priority accounts](../../admin/setup/priority-accounts.md) |
| security | Office 365 Evaluation | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/office-365-evaluation.md | - Title: Evaluate Microsoft Defender for Office 365 -description: Defender for Office 365 in evaluation mode creates Defender for Office 365 email policies that log verdicts, such as malware, but don't act on messages. -keywords: evaluate Office 365, Microsoft Defender for Office 365, office 365 evaluation, try office 365, Microsoft Defender, Microsoft Defender for Endpoint - - NOCSH --- Previously updated : 04/21/2021--- - MET150 - - MOE150 -- - M365-security-compliance --- seo-marvel-apr2020---# Evaluate Microsoft Defender for Office 365 ---> [!IMPORTANT] -> Microsoft Defender for Office 365 evaluation is in public preview. This preview version is provided without a service level agreement. Certain features might not be supported or might have constrained capabilities. --Conducting a thorough security product evaluation can help give you informed decisions on upgrades and purchases. It helps to try out the security product's capabilities to assess how it can help your security operations team in their daily tasks. --The [Microsoft Defender for Office 365](defender-for-office-365.md) evaluation experience is designed to eliminate the complexities of device and environment configuration so that you can focus on evaluating the capabilities of Microsoft Defender for Office 365. With evaluation mode, all messages sent to Exchange Online mailboxes can be evaluated without pointing MX records to Microsoft. The feature only applies to email protection and not to Office Clients like Word, SharePoint, or Teams. --If you don't already have a license that supports Microsoft Defender for Office 365, you can start a [free 30-day evaluation](https://admin.microsoft.com/AdminPortal/Home#/catalog/offer-details/microsoft-defender-for-office-365-plan-2-/223860DC-15D6-42D9-A861-AE05473069FA) and test the capabilities in the Microsoft 365 Defender portal at <https://security.microsoft.com>. You'll enjoy the quick set-up and you can easily turn it off if necessary. --> [!NOTE] -> If you're in the Microsoft 365 Defender portal at <https://security.microsoft.com>, you can start a Defender for Office 365 evaluation here: **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Evaluation mode** in the **Others** section. Or, to go directly to the **Evaluation mode** page, use <https://security.microsoft.com/atpEvaluation>. --## How the evaluation works --Defender for Office 365 in evaluation mode creates Defender for Office 365 email policies that log verdicts, such as malware, but don't act on messages. You're not required to change your MX record configuration. --With evaluation mode, [Safe Attachments](safe-attachments.md), [Safe Links](safe-links.md), and [mailbox intelligence in anti-pishing policies](set-up-anti-phishing-policies.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365) are set up on your behalf. All Defender for Office 365 policies are created in non-enforcement mode in the background and are not visible to you. --As part of the setup, evaluation mode also configures [Enhanced Filtering for Connectors](/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) (also known as _skip listing_). This configuration improves filtering accuracy by preserving IP address and sender information, which are otherwise lost when mail passes through an email security gateway (ESG) in front of Defender for Office 365. Enhanced Filtering for Connectors also improves the filtering accuracy for your existing Exchange Online Protection (EOP) anti-spam and anti-phishing policies. --Enhanced Filtering for Connectors improves filtering accuracy but may alter deliverability for certain messages if you have an ESG in front of Defender for Office 365 and currently don't bypass EOP filtering. The impact is limited to EOP policies; Defender for Office 365 policies set up as part of the evaluation are created in non-enforcement mode. To minimize potential production impact, you can bypass most EOP filtering by creating a mail flow rule (also known as a transport rule) to set the spam confidence level (SCL) of messages to -1. See [Use mail flow rules to set the spam confidence level (SCL) in messages in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl) for details. --When the evaluation mode is set up, you'll have a daily report with up to 90 days of data quantifying the messages that would have been blocked if the policies were implemented (for example, delete, send to junk, quarantine). Reports are generated for all Defender for Office 365 and EOP detections. Reports are aggregated per detection technology (for example, impersonation) and can be filtered by time range. Additionally, message reports can be created on-demand to create custom pivots or to deep dive messages using Explorer. --With the simplified set up experience, you can focus on: --- Running the evaluation-- Getting a detailed report-- Analyzing the report for action-- Presenting the evaluation outcome--## Before you begin --### Licensing --To access the evaluation, you'll need to meet the licensing requirements. Any of the following licenses will work: --- Microsoft Defender for Office 365 Plan 1-- Microsoft Defender for Office 365 Plan 2-- Microsoft 365 E5, Microsoft 365 E5 Security-- Office 365 E5--If you don't have one of those licenses, then you'll need to obtain a trial license. --#### Trial --To obtain a trial license for Microsoft Defender for Office 365, you need to have the **Billing admin role** or **Global admin role**. Request permission from someone that has the Global admin role. [Learn about subscriptions and licenses](../../commerce/licenses/subscriptions-and-licenses.md) --Once you have the proper role, the recommended path is to obtain a trial license for Microsoft Defender for Office 365 (Plan 2) in the Microsoft 365 admin center at <https://admin.microsoft.com> and then go to **Billing** \> **Purchase services** and then find and select the Microsoft Defender for Office 365 (Plan 2) trial. Or, to go directly to the trial page, use <https://admin.microsoft.com/AdminPortal/Home#/catalog/offer-details/microsoft-defender-for-office-365-plan-2-/223860DC-15D6-42D9-A861-AE05473069FA)> The trial includes a 30-day free trial for 25 licenses. --You'll have a 30-day window with the evaluation to monitor and report on advanced threats. You'll also have the option to buy a paid subscription if you want the full Defender for Office 365 capabilities. --### Roles --**Exchange Online roles** are required to set up Defender for Office 365 in evaluation mode. Assigning a Microsoft 365 compliance or security admin role won't work. --- [Learn about permissions in Exchange Online](/exchange/permissions-exo/permissions-exo)-- [Learn about assigning admin roles](../../admin/add-users/assign-admin-roles.md)--The following roles are needed: --|Task|Role (in Exchange Online)| -||| -|Get a free trial or buy Microsoft Defender for Office 365 (Plan 2)|Billing admin role OR Global admin role| -|Create evaluation policy|Remote and Accepted Domains role; Security admin role| -|Edit evaluation policy|Remote and Accepted Domains role; Security admin role| -|Delete evaluation policy|Remote and Accepted Domains role; Security admin role | -|View evaluation report|Security admin role OR Security reader role| --### Enhanced Filtering for Connectors --Your Exchange Online Protection policies, such as bulk and spam protection, will remain the same. However, the evaluation turns on Enhanced Filtering for Connectors, which may impact your mail flow and Exchange Online Protection policies unless bypassed. --Enhanced Filtering for Connectors allows tenants to use anti-spoofing protection. Anti-spoofing is not supported if you're using an email security gateway (ESG) without having turned on Enhanced Filtering for Connectors. --### URLs --URLs will be detonated during mail flow. If you don't want specific URLs detonated, manage your list of allowed URLs appropriately. See [Manage the Tenant Allow/Block List](tenant-allow-block-list.md) for details. --URL links in the email message bodies won't wrap, to lessen customer impact. --### Email routing --Prepare the corresponding details that you'll need to set up how your email is currently routed, including the name of the inbound connector that routes your mail. If you're just using Exchange Online Protection, you won't have a connector. [Learn about mail flow and email routing](/office365/servicedescriptions/exchange-online-service-description/mail-flow) --Supported email routing scenarios include: --- **Third-party partner and/or on-premises service provider**: The inbound connector that you want to evaluate uses a third-party provider and/or you're using a solution for email security on-premises.-- **Microsoft Exchange Online Protection only**: The tenant that you want to evaluate uses Office 365 for email security and the Mail Exchange (MX) record points to Microsoft.--### Email security gateway --If you're using a third-party email security gateway (ESG), you'll need to know the provider's name. If you're using an on-premises ESG or non-supported vendors, you'll need to know the public IP address(es) for the devices. --Supported third-party partners include: --- Barracuda-- IronPort-- Mimecast-- Proofpoint-- Sophos-- Symantec-- Trend Micro--### Scoping --You'll be able to scope the evaluation to an inbound connector. If there's no connector configured, then the evaluation scope will allow admins to gather data from any user in your tenant to evaluate Defender for Office 365. --## Get started with the evaluation --Find the Microsoft Defender for Office 365 evaluation set-up card in the Microsoft 365 Defender portal from the following access points: --- **Endpoints** \> **Vulnerability Management** \> **Dashboard** (<https://security.microsoft.com/tvm_dashboard>)-- **Email & collaboration** \> **Policies & rules** \> **Threat policies** (<https://security.microsoft.com/threatpolicy>)-- **Reports** \> **Email & collaboration** \> **Email & collaboration reports** (<https://security.microsoft.com/emailandcollabreport>)--## Setting up the evaluation --Once you start the set-up flow for your evaluation, you'll be given two routing options. Depending on your organization's mail routing setup and evaluation needs, you can select whether you're using a third-party and/or on-premises service provider or only Microsoft Exchange Online. --- If you're using a third-party partner and/or on-premises service provider, you'll need to select the name of the vendor from the drop-down menu. Provide the other connector-related details.--- Select **Microsoft Exchange Online** if the MX record points to Microsoft and you have an Exchange Online mailbox.--Review your settings and edit them if necessary. Then, select **Create evaluation**. You should get a confirmation message to indicate that your set-up is complete. --Your Microsoft Defender for Office 365 evaluation report is generated once per day. It may take up to 24 hours for the data to populate. --### Exchange mail flow rules (optional) --If you have an existing gateway, enabling evaluation mode will activate Enhanced Filtering for Connectors. This feature improves filtering accuracy by altering the incoming sender IP address. This feature might change the filter verdicts, and if you're not bypassing Exchange Online Protection, this may alter deliverability for certain messages. In this case, you might want to temporarily bypass filtering to analyze impact. To bypass filtering, create a mail flow rule (also known as a transport rule) in the Exchange admin center (EAC) at <https://admin.exchange.microsoft.com/#/transportrules> that sets the SCL of messages to -1 (if you don't already have one). For instructions, see [Use mail flow rules to set the spam confidence level (SCL) in messages in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl). --## Evaluate capabilities --After the evaluation report has been generated, see how many advanced threat links, advanced threat attachments, and potential impersonations were identified in the emails and collaboration workspaces in your organization. --Once the trial has expired, you can continue to access the report for 90 days. However, it won't collect any more information. If you want to continue using Microsoft Defender for Office 365 after your trial has expired, make sure you [buy a paid subscription for Microsoft Defender for Office 365 (Plan 2)](https://admin.microsoft.com/AdminPortal/Home#/catalog/offer-details/microsoft-defender-for-office-365-plan-2-/223860DC-15D6-42D9-A861-AE05473069FA). --You can go to **Settings** to update your routing or turn off your evaluation at any time. However, you need to go through the same set-up process again should you decide to continue your evaluation after having turned it off. --## Provide feedback --Your feedback helps us get better at protecting your environment from advanced attacks. Share your experience and impressions of product capabilities and evaluation results. --Select **Give feedback** to let us know what you think. |
| security | Remediate Malicious Email Delivered Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/remediate-malicious-email-delivered-office-365.md | Admins can take required action on emails, but to get those actions approved, th :::image type="content" source="../../media/microsoft-365-defender-threat-explorer-manual-remediation.png" alt-text="Screenshot of manual hunting in Office 365 Explorer by date."::: -*Action logs* Shows the details of remediation status like successful, failed, and already in destination. -- Security teams can use Explorer to select emails in several ways: - Choose emails by hand: Use filters in various views. Select up to 100 emails to remediate. Unified Action Center shows remediation actions for the past 30 days. Actions ta Open any remediation item to view details about it, including its remediation name, approval Id, Investigation Id, creation date, description, status, action source, action type, decided by, status. It also opens a side pane with action details, email cluster details, alert and Incident details. -- *Open Investigation page* this opens up an admin Investigation that contains fewer details and tabs. It shows details like: related alert, entity selected for remediation, action taken, remediation status, entity count, logs, approver of action. This investigation keeps a track of investigation done by the admin manually and contains details to selections made by the admin, hence is called admin action investigation. No need to act on the investigation and alert its already in approved state. -- *Email count* Displays the number of emails submitted through Threat Explorer. These emails can be actionable or not actionable. -- *Action logs* Shows the details of remediation status like successful/ failed/ already in destination+- *Open Investigation page* this opens up an admin Investigation that contains fewer details and tabs. It shows details like: related alert, entity selected for remediation, action taken, remediation status, entity count, logs, approver of action. This investigation keeps a track of investigation done by the admin manually and contains details to selections made by the admin, hence is called admin action investigation. No need to act on the investigation and alert its already in approved state. +- *Email count* Displays the number of emails submitted through Threat Explorer. These emails can be actionable or not actionable. +- *Action logs* Show the details of remediation statuses like successful, failed, and already in destination. - > [!div class="mx-imgBorder"] - > [](../../media/tp-RemediationArticle5.png#lightbox) - **Actionable**: Emails in the following cloud mailbox locations can be acted on and moved: - Inbox |
| security | Try Microsoft Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/try-microsoft-defender-for-office-365.md | Title: Try Microsoft Defender for Office 365 -description: + Title: Try and evaluate Defender for Office 365 +description: Learn how to evaluate and try the capabilities of Microsoft Defender for Office 365 without affecting your existing mail flow. keywords: f1.keywords: - NOCSH+ROBOTS: # Try Microsoft Defender for Office 365 |
| security | User Tags | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/user-tags.md | After you apply system tags or custom tags to users, you can use those tags as f - [Threat Explorer and real-time detections](threat-explorer.md) - [Email entity page](mdo-email-entity-page.md#other-innovations) - [Threat protection status report](view-email-security-reports.md#threat-protection-status-report)+- [Attack simulation](attack-simulation-training.md#target-users) - [Campaign Views](campaigns.md) - [Admin and user submissions](admin-submission.md) - [Quarantine](quarantine.md) To see how user tags are part of the strategy to help protect high-impact user a 2. On the **User tags** page, select the user tag from the list, and then click  **Delete tag**. 3. Read the warning in the confirmation dialog that appears, and then click **Yes, remove**.++## More information ++- [Configure and review priority accounts in Microsoft Defender for Office 365](configure-review-priority-account.md) |
| solutions | Manage Devices With Intune Configuration Profiles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-configuration-profiles.md | For now, just deploy the most appropriate MDM security baseline. See [Manage sec Later, when Microsoft Defender for Endpoint is set up and youΓÇÖve connected Intune, deploy the Defender for Endpoint baselines. This topic is covered in the next article in this series: [Step 6. Monitor device risk and compliance to security baselines](manage-devices-with-intune-monitor-risk.md). -It is important to understand that these security baselines are not CIS or NIST compliant but closely mirror their recommendations. For more information, see [Are the Intune security baselines CIS or NIST compliant](/mem/intune/protect/security-baselines)? +It is important to understand that these security baselines are not CIS or NIST compliant but closely mirror their recommendations. For more information, see [Are the Intune security baselines CIS or NIST compliant?](/mem/intune/protect/security-baselines#are-the-intune-security-baselines-cis-or-nist-compliant) ## Customize configuration profiles for your organization |
| solutions | Manage Devices With Intune Monitor Risk | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-monitor-risk.md | If Defender for Endpoint hasnΓÇÖt already been set up, work with your threat pro With Microsoft Defender for Endpoint deployed, you can take advantage of threat risk signals. This allows you to block access to devices based on their risk score. Microsoft recommends allowing access to devices with a risk score of medium or below. -For Android and iOS/iPadOS, threat signals can be used within your App Protection Policies (APP). For information on configuring this, see [Create and assign app protection policy to set device risk level](/mem/intune/protect/advanced-threat-protection-configure). +For Android and iOS/iPadOS, threat signals can be used within your App Protection Policies (APP). For information on configuring this, see [Create and assign app protection policy to set device risk level](/mem/intune/protect/advanced-threat-protection-configure#create-and-assign-compliance-policy-to-set-device-risk-level). -For all platforms, you can set the risk level in the existing device compliance policies. See [Create and assign compliance policy to set device risk level](/mem/intune/protect/advanced-threat-protection-configure). +For all platforms, you can set the risk level in the existing device compliance policies. See [Create a conditional access policy](/mem/intune/protect/advanced-threat-protection-configure#create-a-conditional-access-policy). ## Deploy security baselines and monitor compliance to these settings |