| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Increase Threat Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/security-and-compliance/increase-threat-protection.md | For additional details about securing data and managed devices in Microsoft 365 | 2 | **[Protect your administrator accounts](../../business-premium/m365bp-protect-admin-accounts.md)**. | Administrator accounts (also called admins) have elevated privileges, making these accounts more susceptible to cyberattacks. You'll need to set up and manage the right number of admin and user accounts for your business. We also recommend adhering to the information security principle of least privilege, which means that users and applications should be granted access only to the data and operations they require to perform their jobs. <br/><br/>See [Protect your administrator accounts](../../business-premium/m365bp-protect-admin-accounts.md). | | 3 | **[Use preset security policies](../../business-premium/m365bp-protect-against-malware-cyberthreats.md)** | Your subscription includes [preset security policies](../../security/office-365-security/preset-security-policies.md) that use recommended settings for anti-spam, anti-malware, and anti-phishing protection. Set your policies in the [Microsoft 365 Defender portal](https://security.microsoft.com) to at least **Standard** protection. <br/><br/>See [Protect against malware and other cyberthreats](../../business-premium/m365bp-protect-against-malware-cyberthreats.md). | | 4 | **[Protect all devices](../../business-premium/m365bp-set-up-unmanaged-devices.md)**. | Every device is a possible attack avenue into your network and must be configured properly, even devices that are owned personally but also used for work. <br/><br/>See these articles: <br/>- [Help users set up MFA on their devices](https://support.microsoft.com/office/set-up-your-microsoft-365-sign-in-for-multi-factor-authentication-ace1d096-61e5-449b-a875-58eb3d74de14)<br/>- [Protect unmanaged Windows and Mac computers](../../business-premium/m365bp-protect-pcs-macs.md) <br/>- [Set up managed devices](../../business-premium/m365bp-managed-devices-setup.md) (requires Microsoft 365 Business Premium or Microsoft Defender for Business) |-| 5 | **[Set sharing settings for SharePoint and OneDrive files and folders](../../business-premium/m365bp-protect-against-malware-cyberthreats.md)**. | Default sharing settings for SharePoint and OneDrive are set to the most permissive level, which might be a more permissive level than you should use. We recommend reviewing, and if necessary changing, the settings to better protect your business. Grant member of your organization only the access they need to do their jobs. <br/><br/>See [Set sharing settings for SharePoint and OneDrive files and folders](../../business-premium/m365bp-protect-against-malware-cyberthreats.md#set-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). | +| 5 | **[Adjust sharing settings for SharePoint and OneDrive files and folders](../../business-premium/m365bp-protect-against-malware-cyberthreats.md#3-adjust-sharing-settings-for-sharepoint-and-onedrive-files-and-folders)**. | Default sharing settings for SharePoint and OneDrive are set to the most permissive level, which might be a more permissive level than you should use. We recommend reviewing, and if necessary changing, the settings to better protect your business. Grant member of your organization only the access they need to do their jobs. <br/><br/>See [Set sharing settings for SharePoint and OneDrive files and folders](../../business-premium/m365bp-protect-against-malware-cyberthreats.md#3-adjust-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). | ## Related content |
| business-premium | M365bp Admin Guide | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-admin-guide.md | Admin tasks are typically performed in the Microsoft 365 admin center ([https:// - [Microsoft 365 admin center help](../admin/index.yml) - [Secure your data with Microsoft 365 for business](secure-your-business-data.md)-- [Microsoft 365 Business Premium security operations guide](m365bp-security-operations-guide.md)+- [Microsoft 365 Business Premium security operations guide](m365bp-security-operations-guide.md) +- [Microsoft 365 Business Premium security administration guide](m365bp-security-admin-guide.md) |
| business-premium | M365bp Maintain Environment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-maintain-environment.md | audience: Admin Previously updated : 05/08/2023 Last updated : 05/09/2023 ms.localizationpriority: medium - M365-Campaigns description: "Maintain your systems, user accounts, and policies to help protect # Maintain your environment -The [missions](index.md) that were completed during the setup and configuration process focused on setting up your subscription, user accounts, and devices, as well as securing users, devices, and data. Now, you can put together plans for security operations and administration. +The [missions](index.md) that were completed during the setup and configuration process focused on setting up your subscription, user accounts, and devices, as well as securing users, devices, and data. Now, you can put together plans for administration and security operations. -## Administration --Administration includes tasks that your administrators (also referred to as *admins*) perform in the Microsoft 365 admin center ([https://admin.microsoft.com](https://admin.microsoft.com)). --As new employees come in and other employees leave, it's important to manage user accounts and devices. Your admins can add or remove users, reset passwords, reset devices to factory settings, and more. These kinds of tasks (and more!) are listed in the [Microsoft 365 Business Premium administration guide](m365bp-admin-guide.md). --## Security operations --Security operations (also referred to as *SecOps*) includes tasks that your security team performs in the Microsoft Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). --As threats are detected, those threats must be reviewed and addressed. Regular antivirus scans should occur on devices, and you can initiate scans when needed. In addition, you can run automated investigations on devices that have a high risk level or detected threats. These kinds of security tasks (and more!) are listed in the [Microsoft 365 Business Premium security operations guide](m365bp-security-operations-guide.md). +| Area | Description | +||| +| Microsoft 365 administration | Microsoft 365 administration includes tasks that your administrators (also referred to as *admins*) perform in the Microsoft 365 admin center ([https://admin.microsoft.com](https://admin.microsoft.com)) (and potentially other admin centers, such as the Exchange admin center). <br/><br/>As new employees come in and other employees leave, it's important to manage user accounts and devices. Your admins can add or remove users, reset passwords, reset devices to factory settings, and more. These kinds of tasks (and more!) are listed in the [Microsoft 365 Business Premium administration guide](m365bp-admin-guide.md). | +| Security administration | Security administration includes tasks that your security administrators (also referred to as *security admins*) perform in portals, such as the Microsoft 365 admin center, the Microsoft 365 Defender portal, the Microsoft Intune admin center, and more. <br/><br/>These kinds of tasks include defining or editing security policies, onboarding or offboarding devices, and so forth, and are listed in the [Microsoft 365 Business Premium security admin guide](m365bp-security-admin-guide.md). | +| Security operations | Security operations (also referred to as *SecOps*) and includes tasks that your security team performs in the Microsoft Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). <br/><br/>As threats are detected, those threats must be reviewed and addressed. Regular antivirus scans should occur on devices, and you can initiate scans when needed. In addition, you can run automated investigations on devices that have a high risk level or detected threats. These kinds of security tasks (and more!) are listed in the [Microsoft 365 Business Premium security operations guide](m365bp-security-operations-guide.md). | ## See also -[Security incident management](m365bp-security-incident-management.md) +[Security incident management](m365bp-security-incident-management.md) |
| business-premium | M365bp Map Protection Features To Intune Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-map-protection-features-to-intune-settings.md | - Title: "How protection features in Microsoft 365 Business Premium map to Intune settings"-- NOCSH------ Previously updated : 01/03/2023--- tier1--- MiniMaven-- BCS160-- MET150 -description: "Learn how protection features in Microsoft 365 Business Premium map to Intune settings. The subscription provides you with a license to modify Intune settings." ---# How protection features in Microsoft 365 Business Premium map to Intune settings --## Android and iOS application protection settings --The following table details how the Android and iOS application policy settings map to Intune settings. - -To find the Intune setting, sign in with your Microsoft 365 Business Premium admin credentials, and go to **Admin centers**, and then **Intune**. - - > [!IMPORTANT] - > - > A Microsoft 365 Business Premium subscription gives you a license to modify all the Intune settings. See [Introduction to Intune to get started.](/intune/introduction-intune) - -Select the Policy name you want — for example, Application policy for Android — and then choose **Policy settings**. - -Under **Protect work files when devices are lost or stolen** - -|**Android or iOS application policy setting**|**Intune setting(s)**| -|:--|:--| -|Delete work files from an inactive device after |Offline interval (days) before app data is wiped | -|Force users to save work files to OneDrive for Business <br/> Note that only OneDrive for Business is allowed |Select which storage services corporate data can be saved to | - -Under **Manage how user access Office files in mobile devices** - -|**Android or iOS application policy setting**|**Intune setting(s)**| -|:--|:--| -|Delete work files from an inactive device after |Offline interval (days) before app data is wiped | -|Force users to save work files to OneDrive for Business <br/> Note that only OneDrive for Business is allowed |Select which storage services corporate data can be saved to | -|Encrypt work files |Encrypt app data | -|Under **Manage how user access Office files in mobile devices** || -|Require a PIN or fingerprint to access Microsoft 365 Apps | Require PIN to access <br/> This also sets: <br/> **Allow simple PIN** to **Yes** <br/> **Pin Length** to 4 <br/> **Allow fingerprint instead of PIN** to **Yes** <br/> **Disable app PIN when device PIN is managed** to **No** | -|Reset PIN when login fails this many times (this is disabled if PIN isn't required) |Number of attempts before PIN reset | -|Require users to sign in again after Microsoft 365 Apps have been idle for (this is disabled if PIN isn't required) | Recheck the access requirements after (minutes) <br/> This also sets: <br/> **Timeout** is set to minutes <br/> This is same number of minutes you set in Microsoft 365 Business. <br/> **Offline grace period** is set to 720 minutes by default | -|Deny access to work files on jailbroken or rooted devices |Block managed apps from running on jailbroken or rooted devices | -|Allow users to copy content from Microsoft 365 Apps into personal apps | Restrict cut, copy, and paste with other apps <br/> If the Microsoft 365 Business Premium option is set to **On**, then these three options are also set to **All Apps** in Intune: <br/> **Allow app to transfer data to other apps** <br/> **Allow app to receive data from other apps** <br/> **Restrict cut, copy, and paste with other apps** <br/> If the Microsoft 365 Business option is set to **On**, then all the Intune options are set to: <br/> **Allow app to transfer data to other apps** is set to **Policy managed apps** <br/> **Allow app to receive data from other apps** is set to **All Apps** <br/> **Restrict cut, copy, and paste with other apps** is set to **Policy Managed apps with Paste-In** | - -## Windows 10 app protection settings --The following table details how the Windows 10 application policy settings map to Intune settings. - -To find the Intune setting, sign in with your Microsoft 365 Business Premium admin credentials, and go to [Azure portal](https://portal.azure.com). Select **More services**, and type Intune into the **Filter**. Select **Intune App Protection** \> **App Policy**. - - > [!IMPORTANT] - > A Microsoft 365 Business Premium subscription gives you a license to modify only the Intune settings that map to the settings available in Microsoft 365 Business Premium. - -To explore the available settings, select the policy name you want, and then choose **General, Assignments**, **Allowed apps**, **Exempt apps**, **Required settings**, or **Advanced settings** from the left navigation pane. - -|**Windows 10 application policy setting**|**Intune setting(s)**| -|:--|:--| -|Encrypt work files |**Advanced settings** \> **Data protection**: **Revoke encryption keys on unenroll** and **Revoke access to protected data device enrolls to MDM** are both set to **On**. | -|Prevent users from copying company data to personal files. |**Required settings** \> **Windows Information Protection mode**. **On** in Microsoft 365 Business Premium maps to: **Hide Overrides**, **Off** in Microsoft 365 Business Premium maps to: **Off**. | -|Office documents access control | If this is set to **On** in Microsoft 365 Business Premium, then <br/> **Advanced settings** \> **Access**, **Use Windows Hello for Business as a method for signing into Windows** is set to **On**, with the following additional settings: <br/> **Set the minimum number of characters required for the PIN** is set to **4**. <br/> **Configure the use of uppercase letters in the Windows Hello for Business PIN** is set to **Do not allow use of upper case letters for PIN**. <br/> **Configure the use of lowercase letters in the Windows Hello for Business PIN** is set to **Do not allow use of lower case letters for PIN**. <br/> **Configure the use of special characters in the Windows Hello for Business PIN** is set to **Do not allow the use of special characters in PIN**. <br/> **Specify the period of time (in days) that a PIN can be used before the system requires the user to change** is set to **0**. <br/> **Specify the number of past PINs that can be associated to a user account that can't be reused** is set to **0**. <br/> **Number of authentication failures allowed before the device will be wiped** is set to same as in Microsoft 365 Business (5 by default). <br/> **Maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked** is set to same as in Microsoft 365 Business. | -|Enable recovery of protected data |**Advanced settings** \> **Data protection**: **Show the enterprise data protection icon** and **Use Azure RMS for WIP** are set to **On**. | -|Protect additional company cloud locations |**Advanced settings** \> **Protected domains** and **Cloud resources** show domains and SharePoint sites. | -|Files used by these apps are protected |The list of protected apps is listed in **Allowed apps**. | - -## Windows 10 device protection settings --The following table details how the Windows 10 device configuration settings map to Intune settings. - -To find the Intune setting, sign in with your Microsoft 365 Business Premium admin credentials, and go to [Azure portal](https://portal.azure.com), then select **More services**, and type in Intune into the **Filter**, select **Intune** \> **Device configuration** \> **Profiles**. Then select **Device policy for Windows 10** \> **Properties** \> **Settings**. - -|**Windows 10 device policy setting**|**Intune setting(s)**| -|:--|:--| -|Help protect PCs from viruses and other threats using Microsoft Defender Antivirus |Allow Real-time Monitoring = ON <br/> Allow Cloud Protection = ON <br/> Prompt Users for Samples Submission = Send Safe samples automatically (Default Non PII auto submit) | -|Help protect PCs from web-based threats in Microsoft Edge |**SmartScreen** in **Edge Browser settings** is set to **Required**. | -|Turn off device screen when idle for (minutes) |Maximum minutes of inactivity until screen locks (minutes) | -|Allow users to download apps from Microsoft Store |Custom URI policy | -|Allow users to access Cortana |**General** \> **Cortana** is set to **block** in Intune when set to **off** in Microsoft 365 Business Premium. | -|Allow users to receive Windows tips and advertisements from Microsoft |**Windows spotlight**, all blocked if this is set to **off** in Microsoft 365 Business Premium. | -|Keep Windows 10 devices up to date automatically | This setting is in **Microsoft Intune** \> **Service updates - Windows 10 Update Rings**, choose **Update policy for Windows 10 devices**, and then **Properties** \> **Settings**. <br/> When the Microsoft 365 Business Premium setting is set to **On**, all the following settings are set: <br/> **Service branch** is set to **CB** (CBB when this is turned off in Microsoft 365 Business Premium). <br/> **Microsoft product updates** is set to **Allow**. <br/> **Windows drivers** is set to **Allow**. <br/> **Automatic update behavior** is set to **Auto install at maintenance time** with: <br/> **After hours start** is set to **6 AM**. <br/> **Active hours end** is set to **10 PM**. <br/> **Quality update deferral period (days)** is set to **0**. <br/> **Feature update deferral period (days)** is set to **0**. <br/> **Delivery optimization download mode** is set to **HTTP blended with peering behind same NAT**. | --## See also --[Best practices for securing Microsoft 365 for business plans](secure-your-business-data.md) |
| business-premium | M365bp Protect Against Malware Cyberthreats | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-protect-against-malware-cyberthreats.md | audience: Admin Previously updated : 05/02/2023 Last updated : 05/09/2023 ms.localizationpriority: medium - M365-Campaigns description: "Get help with increasing the level of protection in Microsoft 365 # Protect against malware and other cyberthreats -In this objective, you increase your threat protection with Microsoft 365 Business Premium. It's critical to protect your business against phishing, malware, and other threats. This article includes information about: +In this objective, you increase your threat protection with Microsoft 365 Business Premium. It's critical to protect your business against phishing, malware, and other threats. Use this article as a guide to walk through the following steps: -- [Preset security policies](#review-and-apply-preset-security-policies) that can save a lot of time in setup and configuration.-- [Custom security policies](#create-custom-security-policies) that you can define to suit your business needs.-- [How to adjust your sharing settings for SharePoint and OneDrive files and folders](#set-sharing-settings-for-sharepoint-and-onedrive-files-and-folders).-- [Alert policies](#review-your-alert-policies) that monitor specific files and how they are used.-- [Manage calendar sharing](#manage-calendar-sharing) to enable people to schedule meetings appropriately.-- [Your next objectives](#next-objectives).+1. [Review and apply preset security policies for email and collaboration](#1-review-and-apply-preset-security-policies-for-email-and-collaboration). Preset security policies can save a lot of time in setup and configuration. +2. [Turn on Microsoft Defender for Business](#2-turn-on-microsoft-defender-for-business) now so that you'll be ready to secure your organization's managed devices. +3. [Adjust sharing settings for SharePoint and OneDrive files and folders](#3-adjust-sharing-settings-for-sharepoint-and-onedrive-files-and-folders) to prevent accidental oversharing of files. +4. [Set up and review your alert policies](#4-set-up-and-review-your-alert-policies) to protect against data loss. +5. [Manage calendar sharing](#5-manage-calendar-sharing) to determine whether employees can share their calendars with external users or manage the level of detail that can be shared. +6. [Create additional security policies for email and collaboration](#6-create-additional-security-policies-for-email-and-collaboration-if-needed) (if needed). Preset security policies provide strong protection; however, you can define your own custom policies to suit your company's needs. -## Review and apply preset security policies +## 1. Review and apply preset security policies for email and collaboration Your subscription includes [preset security policies](../security/office-365-security/preset-security-policies.md) that use recommended settings for anti-spam, anti-malware, and anti-phishing protection. By default, built-in protection is enabled; however, consider applying standard or strict protection for increased security. :::image type="content" source="media/m365bp-presetsecuritypolicies.png" alt-text="Screenshot of preset security policies."::: > [!NOTE]-> Preset security policies are not the same thing as [security defaults](m365bp-turn-on-mfa.md). Typically, you'll be using *either* security defaults *or* Conditional Access first, and then you'll add your security policies. [Preset security policies](#what-are-preset-security-policies) simplify the process of adding your security policies. You can also [add your own custom policies](#create-custom-security-policies). +> Preset security policies are not the same thing as [security defaults](m365bp-turn-on-mfa.md). Typically, you'll be using *either* security defaults *or* Conditional Access first, and then you'll add your security policies. [Preset security policies](#what-are-preset-security-policies) simplify the process of adding your security policies. You can also [create optional custom security policies](#6-create-additional-security-policies-for-email-and-collaboration-if-needed) (if needed). ### What are preset security policies? To assign preset security policies, follow these steps: > - [Assign preset security policies to users](../security/office-365-security/preset-security-policies.md#assign-preset-security-policies-to-users) > - [Recommended settings for email and collaboration content](../security/office-365-security/recommended-settings-for-eop-and-office365.md) (Microsoft 365 Business Premium includes Exchange Online Protection and Microsoft Defender for Office 365 Plan 1) -## Create custom security policies +## 2. Turn on Microsoft Defender for Business -The [preset security policies](#what-are-preset-security-policies) described earlier in this article provide strong protection for most businesses. However, you're not limited to using preset security policies only. You can define your own custom security policies to suit your company's needs. +Microsoft 365 Business Premium includes [Defender for Business](../security/defender-business/mdb-overview.md), which provides advanced protection for your organization's devices, including client computers, tablets, and mobile phones. Server protection is also available if you have Microsoft Defender for Business servers. -Use our quick-start guide, [Protect against threats](../security/office-365-security/protect-against-threats.md), to get started creating your own custom policies. The guidance not only walks you through how to set up your own security policies, it also provides recommended settings to use as a starting point for: +To turn on Defender for Business, you actually initiate the provisioning process. -- [Antimalware protection](../security/office-365-security/protect-against-threats.md#part-1anti-malware-protection-in-eop)-- [Advanced antiphishing protection](../security/office-365-security/protect-against-threats.md#part-2anti-phishing-protection-in-eop-and-defender-for-office-365)-- [Antispam protection](../security/office-365-security/protect-against-threats.md#part-3anti-spam-protection-in-eop)-- [Safe Links and Safe Attachments](../security/office-365-security/protect-against-threats.md#part-4protection-from-malicious-urls-and-files-safe-links-and-safe-attachments-in-defender-for-office-365)+1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in. ++2. In the navigation bar, go to **Assets** > **Devices**. This action initiates the provisioning of Defender for Business for your tenant. You'll know this process has started when you see a message like what's displayed in the following screenshot: ++ :::image type="content" source="../security/defender-business/media/mdb-hangon-provisioning.png" alt-text="Screenshot of the screen that indicates Defender for Business is provisioning."::: ++ It might take a few hours for your tenant to finish provisioning before you can onboard devices or complete the setup and configuration process. ++3. Do one of the following steps: ++ - Proceed to [3. Adjust sharing settings for SharePoint and OneDrive files and folders](#3-adjust-sharing-settings-for-sharepoint-and-onedrive-files-and-folders) (recommended) and set up Defender for Business later, when you get to [Mission 6: Secure managed devices with Microsoft 365 Business Premium](m365bp-protect-managed-devices.md). + - [Set up and configure Microsoft Defender for Business](../security/defender-business/mdb-setup-configuration.md) now, and then return to this article to complete the remaining steps. -## Set sharing settings for SharePoint and OneDrive files and folders +## 3. Adjust sharing settings for SharePoint and OneDrive files and folders By default, sharing levels are set to the most permissive level for both SharePoint and OneDrive. We recommend changing the default settings to better protect your business. By default, sharing levels are set to the most permissive level for both SharePo > [!TIP] > To learn more about these settings, see [Manage sharing settings](/sharepoint/turn-external-sharing-on-or-off). -## Review your alert policies +## 4. Set up and review your alert policies Alert policies are useful for tracking user and admin activities, potential malware threats, and data loss incidents in your business. Your subscription includes a set of default policies, but you can also create custom ones. For example, if you store an important file in SharePoint that you don't want anyone to share externally, you can create a notification that alerts you if someone does share it. You can view your alerts in either the Microsoft 365 Defender portal or the Micr For more information, see [View alerts](../compliance/alert-policies.md#view-alerts). -## Manage calendar sharing +## 5. Manage calendar sharing You can help people in your organization share their calendars appropriately for better collaboration. You can manage what level of detail they can share, such as by limiting the details that are shared to free/busy times only. -1. Go [Org settings in the Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=2053743) and sign in. +1. Go to [Org settings in the Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=2053743) and sign in. 2. Choose **Calendar**, and choose whether people in your organization can share their calendars with people outside who have Office 365 or Exchange, or with anyone. We recommend clearing the **External sharing** option. If you choose to share calendars with anyone option, you can choose to also share free/busy information only. You can help people in your organization share their calendars appropriately for If your users are allowed to share their calendars, see [these instructions](https://support.office.com/article/7ecef8ae-139c-40d9-bae2-a23977ee58d5) for how to share from Outlook on the web. +## 6. Create additional security policies for email and collaboration (if needed) ++The [preset security policies](#what-are-preset-security-policies) described earlier in this article provide strong protection for most businesses. However, you're not limited to using preset security policies only. You can define your own custom security policies to suit your company's needs. ++Use our quick-start guide, [Protect against threats](../security/office-365-security/protect-against-threats.md), to get started creating your own custom policies. The guidance not only walks you through how to set up your own security policies, it also provides recommended settings to use as a starting point for: ++- [Antimalware protection](../security/office-365-security/protect-against-threats.md#part-1anti-malware-protection-in-eop) +- [Advanced antiphishing protection](../security/office-365-security/protect-against-threats.md#part-2anti-phishing-protection-in-eop-and-defender-for-office-365) +- [Antispam protection](../security/office-365-security/protect-against-threats.md#part-3anti-spam-protection-in-eop) +- [Safe Links and Safe Attachments](../security/office-365-security/protect-against-threats.md#part-4protection-from-malicious-urls-and-files-safe-links-and-safe-attachments-in-defender-for-office-365) ++ ## Next objectives Proceed to: |
| business-premium | M365bp Security Admin Guide | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-security-admin-guide.md | + + Title: "Security administration guide for Microsoft 365 Business Premium" +f1.keywords: +- NOCSH ++++audience: Admin +++ Last updated : 05/09/2023+ms.localizationpriority: medium ++- m365solution-smb +- highpri +- m365-security +- tier1 ++- MiniMaven +search.appverid: +- BCS160 +- MET150 +description: "Learn about tasks that security admins perform in Microsoft 365 Business Premium." +++# Microsoft 365 Business Premium security administration guide ++Security administrators (also referred to as *security admins*) perform various tasks, such as: ++- Defining or editing security policies +- Onboarding or offboarding devices +- Taking steps to protect high-risk user accounts or devices ++The following table lists common tasks that security admins typically perform, with links to more detailed information. ++| Task | Description | +||| +| **Manage false positives/negatives** | A false positive is an entity, such as a file or a process that was detected and identified as malicious even though the entity isn't actually a threat. A false negative is an entity that wasn't detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution, including Microsoft Defender for Office 365 and Microsoft Defender for Business, which are both included in Microsoft 365 Business Premium. Fortunately, steps can be taken to address and reduce these kinds of issues. <br/><br/>For false positives/negatives on devices, see [Address false positives/negatives in Microsoft Defender for Endpoint](../security/defender-endpoint/defender-endpoint-false-positives-negatives.md).<br/><br/>For false positives/negatives in email, see the following articles: <br/>- [How to handle malicious emails that are delivered to recipients (False Negatives), using Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-negatives-in-microsoft-defender-for-office-365)<br/>- [How to handle Legitimate emails getting blocked (False Positive), using Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-positives-in-microsoft-defender-for-office-365) | +| **Strengthen your security posture** | Defender for Business includes a vulnerability management dashboard that provides you with exposure score and enables you to view information about exposed devices and see relevant security recommendations. You can use your Defender Vulnerability Management dashboard to reduce exposure and improve your organization's security posture. <br/><br/>See the following articles:<br/>- [Use your vulnerability management dashboard in Microsoft Defender for Business](../security/defender-business/mdb-view-tvm-dashboard.md)<br/>- [Dashboard insights](../security/defender-vulnerability-management/tvm-dashboard-insights.md) | +| **Adjust security policies** | [Reports](../security/defender-business/mdb-reports.md) are available so that you can view information about detected threats, device status, and more. Sometimes it's necessary to adjust your security policies. For example, you might apply strict protection to some user accounts or devices, and standard protection to others. <br/><br/>See the following articles: <br/>- For device protection: [View or edit policies in Microsoft Defender for Business](../security/defender-business/mdb-view-edit-create-policies.md) <br/>- For email protection: [Recommended settings for EOP and Microsoft Defender for Office 365 security](../security/office-365-security/recommended-settings-for-eop-and-office365.md) | +| **Analyze admin submissions** | Sometimes it's necessary to submit entities, such as email messages, URLs, or attachments to Microsoft for further analysis. Reporting items can help reduce the occurrence of false positives/negatives and improve threat detection accuracy. <br/><br/>See the following articles: <br/>- [Use the Submissions page to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft](../security/office-365-security/submissions-admin.md)<br/>- [Admin review for user reported messages](../security/office-365-security/submissions-admin-review-user-reported-messages.md) | +| **Protect priority user accounts** | Not all user accounts have access to the same company information. Some accounts have access to sensitive information, such as financial data, product development information, partner access to critical build systems, and more. If compromised, accounts that have access to highly confidential information pose a serious threat. We call these types of accounts priority accounts. Priority accounts include (but aren't limited to) CEOs, CISOs, CFOs, infrastructure admin accounts, build system accounts, and more.<br/><br/>See the following articles: <br/>- [Protect your administrator accounts](m365bp-protect-admin-accounts.md) <br/>- [Security recommendations for priority accounts in Microsoft 365](../security/office-365-security/priority-accounts-security-recommendations.md) | +| **Protect high-risk devices** | The overall risk assessment of a device is based on a combination of factors, such as the types and severity of active alerts on the device. As your security team resolves active alerts, approves remediation activities, and suppresses subsequent alerts, the risk level decreases. <br/><br/>See [Manage devices in Microsoft Defender for Business](../security/defender-business/mdb-manage-devices.md). | +| **Onboard or offboard devices** | As devices are replaced or retired, new devices are purchased, or your business needs change, you can onboard or offboard devices from Defender for Business. <br/><br/>See the following articles: <br/>- [Onboard devices to Microsoft Defender for Business](../security/defender-business/mdb-onboard-devices.md) <br/>- [Offboard a device from Microsoft Defender for Business](../security/defender-business/mdb-offboard-devices.md) | ++## See also ++- [Microsoft 365 Business Premium general administration guide](m365bp-admin-guide.md) +- [Microsoft 365 Business Premium security operations guide](m365bp-security-operations-guide.md) +- [Microsoft Defender for Office 365 Security Operations Guide](../security/office-365-security/mdo-sec-ops-guide.md) ++ |
| business-premium | M365bp Security Operations Guide | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-security-operations-guide.md | The following table summarizes remediation actions that are available in Microso ## See also -- [Microsoft 365 Business Premium administrator guide](m365bp-admin-guide.md)+- [Microsoft 365 Business Premium security administration guide](m365bp-security-admin-guide.md) +- [Microsoft 365 Business Premium general administrator guide](m365bp-admin-guide.md) - [Best practices for securing Microsoft 365 for business plans](secure-your-business-data.md) |
| business-premium | M365bp Security Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-security-overview.md | Stay vigilant - the safety and reliability of your system relies upon you. Your objectives are to: -- [Turn on MFA](m365bp-turn-on-mfa.md).-- [Protect your admin accounts](m365bp-protect-admin-accounts.md).-- [Secure managed and unmanaged devices](m365bp-managed-unmanaged-devices.md).-- [Protect against malware and other threats](m365bp-protect-against-malware-cyberthreats.md).-- [Set up information protection capabilities](m365bp-set-up-compliance.md).+1. [Turn on MFA](m365bp-turn-on-mfa.md). +2. [Protect your admin accounts](m365bp-protect-admin-accounts.md). +3. [Protect against malware and other threats](m365bp-protect-against-malware-cyberthreats.md). +4. [Secure managed and unmanaged devices](m365bp-managed-unmanaged-devices.md). +5. [Set up information protection capabilities](m365bp-set-up-compliance.md). |
| business-premium | Secure Your Business Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/secure-your-business-data.md | For more information about what each plan includes, see [Microsoft 365 User Subs ## Top 10 ways to secure your business data +++ 1. [Use multi-factor authentication](#1-use-multi-factor-authentication). 2. [Protect your administrator accounts](#2-protect-your-administrator-accounts). 3. [Use preset security policies](#3-use-preset-security-policies). Microsoft 365 Business Premium also includes: - [Defender for Office 365 Plan 1](/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet), with [Safe Links](/microsoft-365/security/office-365-security/safe-links-about) and [Safe Attachments](/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-about) for Microsoft Teams, SharePoint, and OneDrive. - [Azure Information Protection Plan 1](/azure/information-protection/what-is-information-protection), with capabilities to discover, classify, protect, and govern sensitive information. -See the following articles: +See the following resources: -- [Set sharing settings for SharePoint and OneDrive](m365bp-protect-against-malware-cyberthreats.md#set-sharing-settings-for-sharepoint-and-onedrive-files-and-folders)+- [Adjust sharing settings for SharePoint and OneDrive files and folders](m365bp-protect-against-malware-cyberthreats.md#3-adjust-sharing-settings-for-sharepoint-and-onedrive-files-and-folders) - [Sensitivity labels for Office files in SharePoint and OneDrive](/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files) | Subscription | Recommendations | |||-| [Microsoft 365 Business Premium](index.md) | Use SharePoint and OneDrive for storing and sharing files. <br/>[Set sharing settings for SharePoint and OneDrive](m365bp-protect-against-malware-cyberthreats.md#set-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). <br/>Use [Safe Links](/microsoft-365/security/office-365-security/safe-links-about) and [Safe Attachments](/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-about) with SharePoint and OneDrive. <br/>Use [sensitivity labels](/microsoft-365/compliance/get-started-with-sensitivity-labels) and [DLP](/microsoft-365/compliance/get-started-with-the-default-dlp-policy). | +| [Microsoft 365 Business Premium](index.md) | Use SharePoint and OneDrive for storing and sharing files. <br/>[Set sharing settings for SharePoint and OneDrive](m365bp-protect-against-malware-cyberthreats.md#3-adjust-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). <br/>Use [Safe Links](/microsoft-365/security/office-365-security/safe-links-about) and [Safe Attachments](/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-about) with SharePoint and OneDrive. <br/>Use [sensitivity labels](/microsoft-365/compliance/get-started-with-sensitivity-labels) and [DLP](/microsoft-365/compliance/get-started-with-the-default-dlp-policy). | | [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md) <br/> [Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | Use SharePoint and OneDrive.<br/>(*Defender for Office 365 can be added on*) | ## 8. Use Microsoft 365 Apps on devices Microsoft 365 Business Premium also includes [Azure Information Protection Plan See the following articles: -- [Manage calendar sharing](m365bp-protect-against-malware-cyberthreats.md#manage-calendar-sharing) +- [Manage calendar sharing](m365bp-protect-against-malware-cyberthreats.md#5-manage-calendar-sharing) - [Get started with the default DLP policy](/microsoft-365/compliance/get-started-with-the-default-dlp-policy) | Subscription | Recommendations | |
| compliance | Create Retention Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-retention-policies.md | f1.keywords: Previously updated : 04/28/2023 Last updated : 05/09/2023 audience: Admin When settings from the retention policy are already applied to content, a change Some settings can't be changed after the policy is created and saved, which include the name of the retention policy, the scope type (adaptive or static), and the retention settings except the retention period. +If you no longer need the retention settings that you've configured, see [Releasing a policy for retention](retention.md#releasing-a-policy-for-retention). + ## Troubleshooting retention policies If your retention policies aren't working as expected or you see errors related to your retention policies, use the following troubleshooting resources: |
| compliance | Endpoint Dlp Getting Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/endpoint-dlp-getting-started.md | You can onboard virtual machines as monitored devices in Microsoft Purview compl Here are the virtual operating systems that are supported by virtualization environments. +|Virtualization </br> platform|Windows 10|Windows 11| +|:|:|:| +|Azure virtual desktop (AVD)|<ul><li>Single session supported for 20H2, 21H1, 21H2</li><li>Multi session supported for 20H2, 21H1, 21H2</li></ul>|<ul><li>Single session supported for 22H2</li><li>Multi session supported for 22H2</li></ul>| +|Citrix Virtual Apps and Desktops 7 (2209)|<ul><li>Single session supported for 20H2, 21H1, 21H2</li><li>Multi session supported for 20H2, 21H1, 21H2|<ul><li>Single session supported for 21H2 (Gen2)</li><li>Multi session supported for 21H2 (Gen 2)</li></ul>| +|Hyper-V|<ul><li>Single session supported for 20H2, 21H1, 21H2</li><li>Multi session with Hybrid AD join supported for 20H2, 21H1, 21H2</li></ul>|<ul><li>Single session supported for 22H2</li><li>Multi session with Hybrid AD join supported for 22H2</li></ul>| ++<!-- +### Endpoint DLP support for virtualized environments (preview) ++You can onboard virtual machines as monitored devices in Microsoft Purview compliance portal. There's no change to the onboarding procedures listed above. ++Here are the virtual operating systems that are supported by virtualization environments. + |Virtualization </br> platform|Windows 10|Windows 11|Windows Server 2019| Windows Server 2022</br>21H2 Data Center | |:|:|:|:|:| |Azure virtual desktop (AVD)|<ul><li>Single session supported for 20H2, 21H1, 21H2</li><li>Multi session supported for 20H2, 21H1, 21H2</li></ul>|<ul><li>Single session supported for 22H2</li><li>Multi session supported for 22H2</li></ul>| Supported|Supported| |Citrix Virtual Apps and Desktops 7 (2209)|<ul><li>Single session supported for 20H2, 21H1, 21H2</li><li>Multi session supported for 20H2, 21H1, 21H2|<ul><li>Single session supported for 21H2 (Gen2)</li><li>Multi session supported for 21H2 (Gen 2)</li></ul>|Supported|Supported| |Amazon workspaces|<ul><li>Single session supported for 20H2, 21H1, 21H2|N/A|N/A|N/A| |Hyper-V|<ul><li>Single session supported for 20H2, 21H1, 21H2</li><li>Multi session with Hybrid AD join supported for 20H2, 21H1, 21H2</li></ul>|<ul><li>Single session supported for 22H2</li><li>Multi session with Hybrid AD join supported for 22H2</li></ul>|Supported with Hybrid AD join|Supported with Hybrid AD join|-+--> #### Known issues |
| compliance | Insider Risk Management Activities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-activities.md | f1.keywords: Previously updated : 02/28/2023 Last updated : 05/09/2023 audience: itpro - tier1 Reviewing, investigating, and acting on potentially risky insider alerts are imp ### Too many alerts to review -Becoming overwhelmed with the number of alerts produced by your insider risk management policies could be frustrating. The number of alerts can be quickly addressed with simple steps, depending on the types of alert volume you're receiving. You may be receiving too many valid alerts or have too many stale low-risk alerts. Consider taking the following actions: +If you're receiving too many valid alerts or have too many stale low-risk alerts, consider taking the following actions: +- **Enable analytics**: Enabling analytics can help you quickly identify potential risk areas for your users and help determine the type and scope of insider risk management policies that you might want to configure. To learn more about analytics insights, see [Insider risk management settings: Analytics](insider-risk-management-settings.md#analytics). You can also get real-time insights from analytics if you want to take advantage of a guided (data-driven) threshold configuration experience that will help you configure the appropriate thresholds when you create a new policy or tune an existing one. These insights can help you efficiently adjust the selection of indicators and thresholds of activity occurrence so that you donΓÇÖt receive too few or too many policy alerts. For more information on real-time analytics for threshold settings, see [Indicator level settings](insider-risk-management-settings.md#indicator-level-settings). - **Adjust your insider risk policies**: Selecting and configuring the correct insider risk policy is the most basic method to address the type and volume of alerts. Starting with the appropriate [policy template](insider-risk-management-policy-templates.md#policy-templates) helps focus the types of risk activities and alerts you'll see. Other factors that may impact alert volume are the size of the in-scope user and groups and the content and [channels that are prioritized](insider-risk-management-policies.md#prioritize-content-in-policies). Consider adjusting policies to refine these areas to what is most important for your organization. - **Modify your insider risk settings**: Insider risk settings include a wide variety of configuration options that can impact the volume and types of alerts you'll receive. These include settings for [policy indicators](insider-risk-management-settings.md#policy-indicators), [indicator thresholds](insider-risk-management-settings.md#indicator-level-settings), and [policy timeframes](insider-risk-management-settings.md#policy-timeframes). Consider configuring [intelligent detections](insider-risk-management-settings.md#intelligent-detections) options to exclude specific file types and sensitive info types, trainable classifiers, define minimum thresholds before activity alerts are reported by your policies, and change the alert volume configuration to a lower setting. - **Enable inline alert customization (preview)**: Enabling [inline alert customization](/microsoft-365/compliance/insider-risk-management-settings#inline-alert-customization-preview) allows analysts and investigators to quickly edit policies when reviewing alerts. They can update thresholds for activity detection with Microsoft recommendations, configure custom thresholds, or choose to ignore the type of activity that created the alert. If this is not enabled, then only users assigned to the *Insider Risk Management* role group can use inline alert customization. |
| compliance | Insider Risk Management Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-configure.md | f1.keywords: Previously updated : 04/17/2023 Last updated : 05/09/2023 audience: itpro - highpri For step-by-step instructions to turn on auditing, see [Turn audit log search on ## Step 3 (optional): Enable and view insider risk analytics insights -Insider risk management analytics enables you to conduct an evaluation of potential insider risks in your organization without configuring any insider risk policies. This evaluation can help your organization identify potential areas of higher user risk and help determine the type and scope of insider risk management policies you may consider configuring. This evaluation may also help you determine needs for additional licensing or future optimization of existing policies. Analytics scan results may take up to 48 hours before insights are available as reports for review. To learn more about analytics insights, see [Insider risk management settings: Analytics](insider-risk-management-settings.md#analytics) and check out the [Insider Risk Management Analytics video](https://www.youtube.com/watch?v=5c0P5MCXNXk) to help understand how analytics can help accelerate the identification of potential insider risks and help you to quickly take action. -To enable insider risk analytics, you must be a member of the *Insider Risk Management*, *Insider Risk Management Admins*, or Microsoft 365 *Global admin* role group. +If you enable insider risk management analytics, you can: -Complete the following steps to enable insider risk analytics: +- **Scan for potential insider risks before creating policies.** You can conduct an evaluation of potential insider risks in your organization without configuring any insider risk policies. This evaluation can help your organization identify potential areas of higher user risk and help determine the type and scope of insider risk management policies you might want to configure. This evaluation may also help you determine needs for additional licensing or future optimization of existing policies. Analytics scan results may take up to 48 hours before insights are available +as reports for review. To learn more about analytics insights, see [Insider risk management settings: Analytics](insider-risk-management-settings.md#analytics) and check out the [Insider Risk Management Analytics video](https://www.youtube.com/watch?v=5c0P5MCXNXk) to help understand how analytics can help accelerate the identification of potential insider risks and help you to quickly take action. +- **Receive real-time guidance for indicator threshold settings.** Manually tuning policies to reduce "noise" can be a very time-consuming experience that requires you to do a lot of trial and error to determine the desired configuration for your policies. If analytics is turned on, and you decide to customize your indicator threshold settings, you can get real-time insights if you want to take advantage of a guided (data-driven) threshold configuration experience that will help you configure the appropriate thresholds when you create a new policy or tune an existing one. These insights can help you efficiently adjust the selection of indicators and thresholds of activity occurrence so that you donΓÇÖt receive too few or too many policy alerts. Real-time analytics (preview) is based on the last 10 days of audit data in your tenant and global exclusions are taken into account. For more information on real-time analytics for threshold settings, [see Indicator level settings](insider-risk-management-settings.md#indicator-level-settings). ++> [!NOTE] +> To enable insider risk analytics, you must be a member of the *Insider Risk Management*, *Insider Risk Management Admins*, or Microsoft 365 *Global admin* role group. ++To enable insider risk analytics: 1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com), go to **Insider risk management**. 2. Select **Run scan** on the **Scan for insider risks in your organization** card on the insider risk management **Overview** tab. This action turns on analytics scanning for your organization. You can also turn on scanning in your organization by navigating to **Insider risk settings** > **Analytics** and enabling **Scan your tenant's user activity to identify potential insider risks**. Insider risk management policies include assigned users and define which types o 6. Select **Next** to continue. 7. On the **Users and groups** page, select **Include all users and groups** or **Include specific users and groups** to define which users or groups are included in the policy, or if you've chosen a priority users-based template; select **Add or edit priority user groups**. Selecting **Include all users and groups** will look for triggering events for all users and groups in your organization to start assigning risk scores for the policy. Selecting **Include specific users and groups** allows you to define which users and groups to assign to the policy. Guest user accounts aren't supported.++ > [!NOTE] + > To take advantage of real-time analytics (preview) for indicator threshold settings, you must scope your policy to **Include all users and groups**. Real-time analytics enables you to see estimates of the number of users that could potentially match a given set of policy conditions in real time. This helps you efficiently adjust the selection of indicators and thresholds of activity occurrence so you donΓÇÖt have too few or too many policy alerts. Scoping your policy to **Include all users and groups** also provides better overall protection across your tenant. For more information on real-time analytics for indicator threshold settings, [see Indicator level settings](insider-risk-management-settings.md#indicator-level-settings). + 8. Select **Next** to continue. 9. On the **Content to prioritize** page, you can assign (if needed) the sources to prioritize, which increases the chance of generating a high severity alert for these sources. Select one of the following choices: - **I want to prioritize content**. Selecting this option will enable you to prioritize *SharePoint sites*, *Sensitivity labels*, *Sensitive info types*, and *File extensions* content types. If you choose this option, you must select at least one priority content type.+ - **I don't want to specify priority content right now**. Selecting this option will skip the priority content detail pages in the wizard. 10. Select **Next** to continue. -11. If you've selected **I want to prioritize content** in the previous step, you'll see the detail pages for *SharePoint sites*, *sensitive info types*, *sensitivity labels*, *file extensions*, and *Scoring*. Use these detail pages to define the SharePoint, sensitive info types, sensitivity labels, trainable classifiers, and file extensions to prioritize in the policy. The *Scoring* detail page allows you to scope the policy to only assign risk scores and generate alerts for specified activities that include priority content. +11. If you've selected **I want to prioritize content** in the previous step, you'll see the detail pages for *SharePoint sites*, *sensitivity labels*, *sensitive info types*, *file extensions*, and *Scoring*. Use these detail pages to define the SharePoint, sensitive info types, sensitivity labels, trainable classifiers, and file extensions to prioritize in the policy. The *Scoring* detail page allows you to scope the policy to only assign risk scores and generate alerts for specified activities that include priority content. - **SharePoint sites**: Select **Add SharePoint site** and select the SharePoint sites you have access to and want to prioritize. For example, *"group1@contoso.sharepoint.com/sites/group1"*. - **Sensitive info type**: Select **Add sensitive info type** and select the sensitivity types you want to prioritize. For example, *"U.S. Bank Account Number"* and *"Credit Card Number"*. Insider risk management policies include assigned users and define which types o If you've selected the *Risky browser usage* policy template, select one or more of the **Browsing indicators**. 21. Select **Next** to continue.-22. On the **Decide whether to use default or custom indicator thresholds** page, choose custom or default thresholds for the policy indicators that you've selected. Choose either the **Use default thresholds for all indicators** or **Specify custom thresholds** for the selected policy indicators. If you've selected Specify custom thresholds, choose the appropriate level to generate the desired level of activity alerts for each policy indicator. +22. On the **Decide whether to use default or custom indicator thresholds** page, choose custom or default thresholds for the policy indicators that you've selected. Choose either the **Use default thresholds for all indicators** or **Specify custom thresholds** for the selected policy indicators. If you've selected **Specify custom thresholds**, choose the appropriate level to generate the desired level of activity alerts for each policy indicator. ++ > [!NOTE] + > If analytics is turned on, and if you've scoped the policy to include all users, you can take advantage of real-time analytics to tune your threshold settings. [Learn more about real-time analytics for indicator threshold settings](insider-risk-management-settings.md#indicator-level-settings) + 23. Select **Next** to continue. 24. On the **Review** page, review the settings you've chosen for the policy and any suggestions or warnings for your selections. Select **Edit** to change any of the policy values or select **Submit** to create and activate the policy. |
| compliance | Insider Risk Management Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-policies.md | f1.keywords: Previously updated : 02/28/2023 Last updated : 05/09/2023 audience: itpro - tier1 When you create an insider risk management policy in the policy wizard, you can - **SharePoint sites**: Any activity associated with all file types in defined SharePoint sites is assigned a higher risk score. Users configuring the policy and selecting priority SharePoint sites can select SharePoint sites that they have permission to access. If SharePoint sites aren't available for selection in the policy by the current user, another user with the required permissions can select the sites for the policy later, or the current user should be given access to the required sites. - **Sensitive information types**: Any activity associated with content that contains [sensitive information types](sensitive-information-type-entity-definitions.md) are assigned a higher risk score. - **Sensitivity labels**: Any activity associated with content that has specific [sensitivity labels](sensitivity-labels.md) applied are assigned a higher risk score.-- **File extensions**: Any activity associated with content that has specific file extensions. Users configuring a data theft/leak policy that select **File extensions to prioritize** in the policy wizard can define up to 50 file extensions to prioritize in the policy. Entered extensions can include or omit a '.' as the first character of the prioritized extension.-- **Trainable classifiers**: Any activity associated with content that is included in a [trainable classifier](/microsoft-365/compliance/classifier-learn-about). Users configuring a policy that select Trainable classifiers in the policy wizard can select up to 5 trainable classifiers to apply to the policy. These classifiers can be existing classifiers that identify patterns of sensitive information like social security, credit card, or bank account numbers or custom classifiers created in your organization.+- **File extensions**: Any activity associated with content that has specific file extensions. Users configuring a data theft/leak policy that selects **File extensions to prioritize** in the policy wizard can define up to 50 file extensions to prioritize in the policy. Entered extensions can include or omit a '.' as the first character of the prioritized extension. +- **Trainable classifiers**: Any activity associated with content that is included in a [trainable classifier](/microsoft-365/compliance/classifier-learn-about). Users configuring a policy that selects Trainable classifiers in the policy wizard can select up to 5 trainable classifiers to apply to the policy. These classifiers can be existing classifiers that identify patterns of sensitive information like social security, credit card, or bank account numbers or custom classifiers created in your organization. ## Sequence detection (preview) Complete the following steps to manage an existing policy: 5. On the **Name and description** page, update the description for the policy in the **Description** field. 6. Select **Next** to continue. 7. On the **Users and groups** page, select **Include all users and groups** or **Include specific users and groups** to define which users or groups are included in the policy, or if you've chosen a priority users-based template; select **Add or edit priority user groups**. Selecting **Include all users and groups** will look for triggering security and compliance related events for all users and groups in your organization to start assigning risk scores for the policy. Selecting **Include specific users and groups** allows you to define which users and groups to assign to the policy. Guest user accounts aren't supported.++ > [!NOTE] + > To take advantage of real-time analytics (preview) for indicator threshold settings, you must scope your policy to **Include all users and groups**. Real-time analytics enables you to see the number of users that could potentially match a given set of policy conditions in real time. This helps you efficiently adjust the selection of indicators and thresholds of activity occurrence so you donΓÇÖt have too few or too many policy alerts. Scoping your policy to **Include all users and groups** also provides better overall protection across your tenant. For more information on real-time analytics for threshold settings, [see Indicator level settings](insider-risk-management-settings.md#indicator-level-settings). + 8. Select **Next** to continue. 9. On the **Content to prioritize** page, you can assign (if needed) the sources to prioritize, which increases the chance of generating a high severity alert for these sources. Select one of the following choices: - **I want to prioritize content**. Selecting this option will enable you to prioritize *SharePoint sites*, *Sensitivity labels*, *Sensitive info types*, and *File extensions* content types. If you choose this option, you must select at least one priority content type.+ - **I don't want to specify priority content right now**. Selecting this option will skip the priority content detail pages in the wizard. 10. Select **Next** to continue. Complete the following steps to manage an existing policy: > [!IMPORTANT] > If you're unable to select a listed indicator, it's because they aren't enabled for your organization. To make them available to select and assign to the policy, enable the indicators in **Insider risk management** > **Settings** > **Policy indicators**. > If you've selected other policy templates, custom triggering events aren't supported. The built-in policy triggering events apply and you'll continue to Step 23 without defining policy attributes.-14. If you've selected the *Data leaks by risky users* or *Security policy violations by risky users* templates, you'll see options on the **Triggers for this policy** page for [integration with communication compliance](/microsoft-365/compliance/communication-compliance-policies#policy-for-insider-risk-management-integration-preview) and HR data connector events. You have the choice to assign risk scores when users send messages that contain potentially threatening, harassing, or discriminatory language or to bring users into the the policy scope after risky user events are reported in your HR system. If you select the **Risk triggers from communication compliance (preview)** option, you can accept the default communication compliance policy (automatically created), choose a previously created policy scope for this trigger, or create another scoped policy. If you select **HR data connector events**, you must configure a HR data connector for your organization. +14. If you've selected the *Data leaks by risky users* or *Security policy violations by risky users* templates, you'll see options on the **Triggers for this policy** page for [integration with communication compliance](/microsoft-365/compliance/communication-compliance-policies#policy-for-insider-risk-management-integration-preview) and HR data connector events. You have the choice to assign risk scores when users send messages that contain potentially threatening, harassing, or discriminatory language or to bring users into the policy scope after risky user events are reported in your HR system. If you select the **Risk triggers from communication compliance (preview)** option, you can accept the default communication compliance policy (automatically created), choose a previously created policy scope for this trigger, or create another scoped policy. If you select **HR data connector events**, you must configure an HR data connector for your organization. 15. Select **Next** to continue. 16. If you've selected the *Data leaks* or *Data leaks by priority users* templates and have selected the **User performs an exfiltration activity and associated indicators**, you can choose custom or default thresholds for the indicator triggering events that you've selected. Choose either the **Use default thresholds (Recommended)** or **Use custom thresholds for the triggering events**. 17. Select **Next** to continue. Complete the following steps to manage an existing policy: 21. Select **Next** to continue. 22. On the **Decide whether to use default or custom indicator thresholds** page, choose custom or default thresholds for the policy indicators that you've selected. Choose either the **Use default thresholds for all indicators** or **Specify custom thresholds** for the selected policy indicators. If you've selected Specify custom thresholds, choose the appropriate level to generate the desired level of activity alerts for each policy indicator.++ > [!NOTE] + > If analytics is turned on, and if you've scoped the policy to include all users, you can take advantage of real-time analytics to tune your threshold settings. [Learn more about real-time analytics for indicator threshold settings](insider-risk-management-settings.md#indicator-level-settings) + 23. Select **Next** to continue. 24. On the **Review** page, review the settings you've chosen for the policy and any suggestions or warnings for your selections. Select **Edit** to change any of the policy values or select **Submit** to create and activate the policy. |
| compliance | Insider Risk Management Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-settings.md | f1.keywords: Previously updated : 03/13/2023 Last updated : 05/09/2023 audience: itpro - highpri For the first daily event level, you set the threshold at *10 or more events per Another option for policy thresholds is to assign the policy triggering event to risk management activity that is above the typical daily number of users. Instead of being defined by specific threshold settings, each threshold is dynamically customized for anomalous activities detected for in-scope policy users. If threshold activity for anomalous activities is supported for an individual indicator, you can select **Activity is above user's usual activity for the day** in the policy wizard for that indicator. If this option isn't listed, anomalous activity triggering isn't available for the indicator. If the **Activity is above user's usual activity for the day** option is listed for an indicator, but not selectable, you need to enable this option in **Insider risk settings** > **Policy indicators**. +#### Use real-time analytics (preview) to manage alert volume ++You can use real-time analytics if you want to take advantage of a guided (data-driven) threshold configuration experience that enables you to quickly select the appropriate thresholds for each policy indicator. This guided experience can help you efficiently adjust selection of indicators and thresholds of activity occurrence so you don't have too few or too many policy alerts. When analytics is turned on, you can choose the **Customize thresholds** option in the policy wizard to see: ++- **A**. A gauge that shows the approximate number of scoped users whose activities from the past 10 days exceeded the lowest daily thresholds for at least one of the selected indicators in the policy. This gauge can help you estimate the number of alerts that might be generated if all users included in the policy were being assigned risk scores. +- **B**. A list of the top five indicators sorted by the number of users exceeding the lowest daily thresholds. If your policies are generating a lot of alerts, these are the indicators you might want to focus on to reduce "noise." +- **C**. An insight for each indicator, displayed below the thresholds. The insight shows the approximate number of users whose activities from the past 10 days exceeded the currently specified low thresholds for this indicator. For example, if the low threshold setting for *Downloading content from SharePoint* is set to 100, the insight shows the number of users in the policy who performed more than 100 download activities on an average in the past 10 days. If you adjust the threshold setting to 200, the insight will update in real time to show you the number of users whose activity exceeded levels that exceeded the new thresholds. This helps you quickly configure the appropriate thresholds for each indicator and achieve the highest level of alert effectiveness before activating your policies. ++  ++Real-time analytics (preview) is based on the last 10 days of activity data in your tenant and [global exclusions (intelligent detections) are taken into account](#intelligent-detections). ++##### Prerequisites for using real-time analytics ++To use real-time analytics (preview), you must: ++1. [Enable insider risk analytics insights](insider-risk-management-configure.md#step-3-optional-enable-and-view-insider-risk-analytics-insights). +2. Choose the **Include all users and groups** option when you [create the policy](insider-risk-management-configure.md#step-6-required-create-an-insider-risk-management-policy). ++ > [!NOTE] + > If you've chosen to receive alerts only for activities that include priority content for this policy, real-time analytics insights (preview) will not be displayed since they're not supported for these policies. + ## Policy timeframes Policy timeframes allow you to define past and future review periods that are triggered after policy matches based on events and activities for the insider risk management policy templates. Depending on the policy template you choose, the following policy timeframes are available: Turning on this setting significantly eliminates noise from email signature atta ### File activity detection -To exclude specific file types from all insider risk management policy matching, enter file type extensions separated by commas. For example, to exclude certain types of music files from policy matches you may enter *aac,mp3,wav,wma* in the **File type exclusions** field. Files with these extensions will be ignored by all insider risk management policies. +To exclude specific file types from all insider risk management policy matching, enter file type extensions separated by commas. For example, to exclude certain types of music files from policy matches, enter *aac,mp3,wav,wma* in the **File type exclusions** field. Files with these extensions will be ignored by all insider risk management policies. ### Alert volume Depending on the number of users assigned to insider risk management role groups ## Analytics -Insider risk analytics enables you to conduct an evaluation of potential insider risks in your organization without configuring any insider risk policies. This evaluation can help your organization identify potential areas of higher user risk and help determine the type and scope of insider risk management policies you may consider configuring. Analytics scans offer the following advantages for your organization: +Enabling insider risk analytics offers two important benefits. When analytics is enabled, you can: ++- Conduct an evaluation of potential insider risks in your organization without configuring any insider risk policies. +- Receive real-time guidance on configuring indicator threshold settings. ++### Conduct an evaluation of insider risks in your organization ++Insider risk analytics enables you to conduct an evaluation of potential insider risks in your organization without configuring any insider risk policies. This evaluation can help your organization identify potential areas of higher user risk and help determine the type and scope of insider risk management policies you might want to configure. Analytics scans offer the following advantages for your organization: - Easy to configure: To get started with analytics scans, you can select Run scan when prompted by the analytics recommendation or go to **Insider risk settings** > **Analytics** and enable analytics.-- Privacy by design: Scan results and insights are returned as aggregated and anonymized user activity, individual user names aren't identifiable by reviewers.+- Privacy by design: Scanned results and insights are returned as aggregated and anonymized user activity; individual usernames aren't identifiable by reviewers. Since insider risk management doesn't classify any identity in the organization for analytics, the solution accounts for all the UPNs/identities that might be involved in data leaving the organization boundary. This might involve user accounts, system accounts, guest accounts, and so on. - Understand potential risks through consolidated insights: Scan results can help you quickly identify potential risk areas for your users and which policy would be best to help mitigate these risks. Check out the [Insider Risk Management Analytics video](https://www.youtube.com/watch?v=5c0P5MCXNXk) to help understand how analytics can help accelerate the identification of potential insider risks and help you to quickly take action. Analytics scans for risk management activity from several sources to help identi Analytics insights from scans are based on the same risk management activity signals used by insider risk management policies and report results based on both single and sequence user activities. However, the risk scoring for analytics is based on up to 10 days of activity while insider risk policies use daily activity for insights. When you first enable and run analytics in your organization, you'll see the scan results for one day. If you leave analytics enabled, you'll see the results of each daily scan added to the insight reports for a maximum range of the previous 10 days of activity. -### Enable analytics and start your scan +### Receive real-time guidance on configuring indicator threshold settings ++Manually tuning policies to reduce "noise" can be a very time-consuming experience that requires you to do a lot of trial and error to determine the desired configuration for your policies. If analytics is turned on, and you decide to customize your indicator threshold settings, you can get real-time insights from analytics if you want to take advantage of a guided (data-driven) threshold configuration experience that will help you configure the appropriate thresholds when you create a new policy or tune an existing one. These insights can help you efficiently adjust the selection of indicators and thresholds of activity occurrence so that you donΓÇÖt receive too few or too many policy alerts. Real-time analytics (preview) is based on the last 10 days of activity data in your tenant and global exclusions are taken into account. For more information on real-time analytics for threshold settings, [see Indicator level settings](insider-risk-management-settings.md#indicator-level-settings). ++### Enable analytics and start a scan of potential insider risks in your organization To enable insider risk analytics, you must be a member of the *Insider Risk Management*, *Insider Risk Management Admins*, or *Microsoft 365 Global admin* role group. Complete the following steps to enable insider risk analytics: Complete the following steps to enable insider risk analytics:  -### Viewing analytics insights and creating new policies +### Viewing analytics insights after the first analytics scan After the first analytics scan is complete for your organization, members of the *Insider Risk Management Admins* role group will automatically receive an email notification and can view the initial insights and recommendations for potentially risky activities by your users. Daily scans continue unless you turn off analytics for your organization. Email notifications to admins are provided for each of the three in-scope categories for analytics (data leaks, theft, and exfiltration) after the first instance of potentially risky activity in your organization. Email notifications aren't sent to admins for follow-up risk management activity detection resulting from the daily scans. If analytics in **Insider risk management** > **Settings** > **Analytics** are disabled and then re-enabled in your organization, automatic email notifications are reset and emails are sent to members of the *Insider Risk Management Admins* role group for new scanning insights. To view potential risks for your organization, go to the **Overview** tab and se  -For completed analyses, you'll see the potential risks discovered in your organization and insights and recommendations to address these risks. Identified risks and specific insights are included in reports grouped by area, the total number of users with identified risks, the percentage of these users with potentially risky activities, and a recommended insider risk policy to help mitigate these risks. The reports include: +For completed analyses, you'll see the potential risks discovered in your organization and insights and recommendations to address these risks. Identified risks and specific insights are included in reports grouped by area, the total number of users (all types of Azure AD accounts, including user, guest, system, and so on) with identified risks, the percentage of these users with potentially risky activities, and a recommended insider risk policy to help mitigate these risks. The reports include: - **Data leaks insights**: For all users that may include accidental oversharing of information outside your organization or data leaks by users with malicious intent. - **Data theft insights**: For departing users or users with deleted Azure AD accounts that may include risky sharing of information outside your organization or data theft by users with malicious intent. To display more information for an insight, select **View details** to display t ### Turn off analytics -To turn off insider risk analytics, you must be a member of the *Insider Risk Management*, *Insider Risk Management Admins*, or Microsoft 365 *Global admin* role group. After you disable analytics, analytics insight reports will remain static and not be updated for new risks. +To turn off insider risk analytics, you must be a member of the *Insider Risk Management*, *Insider Risk Management Admins*, or Microsoft 365 *Global admin* role group. After you disable analytics: ++- Analytics insight reports will remain static and will not be updated for new risks. +- You won't be able to [see real-time analytics when you customize indicator threshold settings for your policies](#indicator-level-settings). Complete the following steps to turn off insider risk analytics: 1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com), go to **Insider risk management**.-2. Select **Insider risk settings** > **Analytics** page. +2. Select **Insider risk settings** > **Analytics**. 3. On the **Analytics** page, turn off **Scan your tenant's user activity to identify potential insider risks**. ## Admin notifications |
| compliance | Sensitivity Labels Versions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-versions.md | The numbers listed are the minimum Office application versions required for each |[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)|Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Under review |Under review |Under review |Under review | |[Scope labels to files or emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails) |Current Channel: 2303+ <br /><br> Monthly Enterprise Channel: Under review <br /><br> Semi-Annual Enterprise Channel: 2302+ |Rolling out: 16.70+ <sup>\*</sup> | Rolling out: 4.2309+ |Rolling out: 4.2309+ |Yes | |[Preventing oversharing as DLP policy tip](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup-preview)|Preview: [Current Channel (Preview)](https://office.com/insider) |Under review |Under review |Under review |Under review |-|[Label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments) |Current Channel: Rolling out to 2303+ <br /><br> Monthly Enterprise Channel: 2304+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Under review |Under review |Under review |Under review | +|[Label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments) |Current Channel: 2303+ <br /><br> Monthly Enterprise Channel: 2304+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Under review |Under review |Under review |Under review | **Footnotes:** |
| frontline | Browser Join | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/browser-join.md | Here are some things about the user experience to know about with browser join. ### Screen sharing -The staff member who conducts the appointment can share their screen from their Teams desktop, mobile, or web client with an attendee who joins from a desktop or mobile browser. However, attendees can't share their screen from a desktop or mobile browser. +The staff member who conducts the appointment can share their screen from their Teams desktop, mobile, or web client with an attendee who joins from a desktop or mobile browser. Attendees can share their screen when joining on desktop, but can't share on a mobile browser. ### Live captions |
| lighthouse | M365 Lighthouse Deployment Insights Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-deployment-insights-overview.md | Microsoft 365 Lighthouse provides deployment insights within and across the tena - Review deployment exceptions such as **Dismissed** tasks and **Excluded** users -- Review regressions such as tasks the change from a **Compliant** or **Dismissed** status to a status of **Not compliant** or **Not licensed**.+- Review regressions such as tasks that change from a **Compliant** or **Dismissed** status to a status of **Not compliant** or **Not licensed**. - Quantify threats based on user- and task-level deployment progress |
| security | Mdb Setup Configuration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-setup-configuration.md | When you're ready to set up and configure Defender for Business, you can choose > > Defender for Business also offers automatic onboarding for Windows devices enrolled in Intune. Automatic onboarding is a simplified way to onboard Windows devices to Defender for Business. We recommend selecting the "all devices enrolled" option so that as Windows devices are enrolled in Intune, they're onboarded to Defender for Business automatically. -7. **Configure your security policies**. Defender for Business includes default security policies for next-generation protection and firewall protection that can be applied to your company's devices. These default policies use recommended settings and are designed to provide strong protection for your devices. You can start with your default policies, and add more later. See [View and edit your security policies and settings](mdb-configure-security-settings.md). +7. **Configure your security policies**. Defender for Business includes default security policies for next-generation protection and firewall protection that can be applied to your company's devices. These default policies use recommended settings and are designed to provide strong protection for your devices. You can start with your default policies, and add more later. See [Set up, review, and edit your security policies and settings](mdb-configure-security-settings.md). 8. **Select your next step**. After the setup wizard has completed, you're prompted to choose a next step. For example, you can onboard devices, view your security dashboard, or view your security policies. |
| security | Mac Jamfpro Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-jamfpro-policies.md | JAMF requires you to define a set of machines for a configuration profile. You need to make sure that all machines receiving Defender's package, also receive *all* configuration profiles listed above. > [!WARNING]-> JAMF supports Smart Computer Groups, that allow deployoing e.g. configuration profiles or policies to all machines matching certain criteria evaluated dynamically. +> JAMF supports Smart Computer Groups that allow deploying, such as configuration profiles or policies to all machines matching certain criteria evaluated dynamically. > It is a powerful concept that is widely used for configuration profiles distribution. > > However, keep in mind that these criteria should not include presence of Defender on a machine. |
| security | Integrate Microsoft 365 Defender Secops Services | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/integrate-microsoft-365-defender-secops-services.md | Title: Step 3. Plan for Microsoft 365 Defender integration with your SOC catalog of services description: The basics of integrating Microsoft 365 Defender into your security operations catalog of services. keywords: incidents, alerts, investigate, correlation, attack, devices, users, identities, identity, mailbox, email, 365, microsoft, m365, incident response, cyber-attack, secops, security operations, soc -search.product: eADQiWindows 10XVcnh -ms.sitesec: library -ms.pagetype: security f1.keywords: - NOCSH An established Security Operations Center (SOC) should have a catalog of service - Data loss prevention - Brand monitoring -Because Microsoft 365 Defender technologies span various functions, your SOC team will need to determine which roles and responsibilities are best suited to manage each component of Microsoft 365 Defender and align to service function. - The components of Microsoft 365 Defender are: - **Microsoft Defender for Identity** (formerly Azure Advanced Threat Protection, also known as Azure ATP) is a cloud-based security solution that uses Active Directory Domain Services (AD DS) signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at organizations. |
| security | Investigate Alerts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/investigate-alerts.md | The **Recommendations** tab provides next-step actions and advice for investigat :::image type="content" source="../../media/investigate-alerts/alerts-ss-alerts-recommendations-example.png" lightbox="../../media/investigate-alerts/alerts-ss-alerts-recommendations-example.png" alt-text="Screenshot of an example of alert recommendations"::: -## Suppress an alert +## Public preview: Tune an alert -As a security operations center (SOC) analyst, one of the top issues is triaging the sheer number of alerts that are triggered daily. For lower priority alerts, an analyst is still required to triage and resolve the alert which tends to be a manual process. A SOC analyst's time is valuable, wanting to focus only on high severity and high priority alerts. +> [!IMPORTANT] +> Some information relates to pre-release feature that might be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ++As a security operations center (SOC) analyst, one of the top issues is triaging the sheer number of alerts that are triggered daily. An analyst's time is valuable, wanting to focus only on high severity and high priority alerts. Meanwhile, analysts are also required to triage and resolve lower priority alerts, which tends to be a manual process. -Alert suppression provides the ability to tune and manage alerts in advance. This streamlines the alert queue and saves triage time by hiding or resolving alerts automatically, each time a certain expected organizational behavior occurs, and rule conditions are met. +Alert tuning provides the ability to tune and manage alerts in advance. This streamlines the alert queue and saves triage time by hiding or resolving alerts automatically, each time a certain expected organizational behavior occurs, and rule conditions are met. -You can create rule conditions based on 'evidence types' such as files, processes, scheduled tasks, and many other evidence types that trigger the alert. After creating the rule, user can apply the rule on the selected alert or any alert type that meets the rule conditions to suppress the alert. +You can create rule conditions based on 'evidence types' such as files, processes, scheduled tasks, and many other evidence types that trigger the alert. After creating the rule, you can apply the rule on the selected alert or any alert type that meets the rule conditions to tune the alert. ++In addition, the feature also covers alerts coming from various Microsoft 365 Defender service sources. The alert tuning feature in public preview is getting alerts from workloads like Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Azure Active Directory Identity Protection (AAD IP), and others, if these sources are available on your platform and plan. Previously, the alert tuning capability only captured alerts from the Defender for Endpoint workload. > [!NOTE]-> Suppression of alerts is not recommended. However in certain situations, a known internal business application or security tests trigger an expected activity and you don't want to see these alerts. So, you can create a suppression rule for the alert. +> We recommend using alert tuning, previously known as **alert suppression**, with caution. In certain situations, a known internal business application or security tests trigger an expected activity and you don't want to see these alerts. So, you can create a rule to tune these alert types. -### Create rule conditions to suppress alerts +### Create rule conditions to tune alerts -To create a suppression rule for alerts: +There are two ways to tune an alert in Microsoft 365 Defender. To tune an alert from the **Settings** page: -1. Select the investigated alert. In the main alert page, select **Create suppression rule** in the summary details section of the alert page. +1. Go to Settings. On the left pane, go to **Rules** and select **Alert tuning**. - :::image type="content" source="../../media/investigate-alerts/suppression-click.png" lightbox="../../media/investigate-alerts/suppression-click.png" alt-text="Screenshot of Create separation rule action."::: + :::image type="content" source="../../media/investigate-alerts/alert-tuning-settings.png" lightbox="../../media/investigate-alerts/alert-tuning-settings.png" alt-text="Screenshot of Alert tuning option in Microsoft 365 Defender's Settings page."::: + + Select **Add new rule** to tune a new alert. You can also edit an existing rule in this view by selecting a rule from the list. -2. In the **Create suppression rule** pane, select **Only this alert type** to apply the rule on the selected alert. + :::image type="content" source="../../media/investigate-alerts/alert-tuning-add-new.png" lightbox="../../media/investigate-alerts/alert-tuning-add-new.png" alt-text="Screenshot of adding new rules in the Alert tuning page."::: - However, to apply the rule on any alert type that meets rule conditions select **Any alert type based on IOC conditions**. +2. In the **Tune alert** pane, you can select service sources where the rule applies in the dropdown menu under **Service sources**. ++ :::image type="content" source="../../media/investigate-alerts/alert-tuning-select-service.png" lightbox="../../media/investigate-alerts/alert-tuning-select-service.png" alt-text="Screenshot of service source dropdown menu in Tune an alert page."::: ++ > [!NOTE] + > Only services that the user has permission to are shown. ++3. Add indicators of compromise (IOCs) that triggers the alert under the **IOCs** section. You can add a condition to stop the alert when triggered by a specific IOC or by any IOC added in the alert. ++ IOCs are indicators such as files, processes, scheduled tasks, and other evidence types that trigger the alert. ++ :::image type="content" source="../../media/investigate-alerts/alert-tuning-choose-ioc.png" lightbox="../../media/investigate-alerts/alert-tuning-choose-ioc.png" alt-text="Screenshot of the IOC menu in Tune an alert page."::: ++ To set multiple rule conditions, use **AND**, **OR**, and grouping options to build relationship between these multiple 'evidence types' that cause the alert. ++ 1. For example, select the triggering evidence **Entity Role: Trigger**, **equals**, and **any** to stop the alert when triggered by any IOC added in the alert. All the properties of this 'evidence' will auto populate as a new subgroup in the respective fields below. + + > [!NOTE] + > Condition values are not case sensitive. - IOCs are indicators such as files, processes, scheduled tasks, and other evidence types that trigger the alert. + 2. You can edit and/or delete properties of this 'evidence' depending on your requirement (using wildcards, when supported). - > [!NOTE] - > You can no longer suppress an alert triggered by 'custom detection' source. You can't create a suppression rule for this alert. + 3. Other than files and processes, AntiMalware Scan Interface (AMSI) script, Windows Management Instrumentation (WMI) event, and scheduled tasks are some of the newly added evidence types that you can select from the evidence types drop-down list. -3. In the **IOCs** section, select **Any IOC** to suppress the alert no matter what 'evidence' has caused the alert. + 4. To add another IOC, click **Add filter**. + > [!NOTE] + > Adding at least one IOC to the rule condition is required to tune any alert type. - To set multiple rule conditions, select **Choose IOCs**. Use **AND**, **OR** and grouping options to build relationship between these multiple 'evidence types' that cause the alert. +4. In the **Action** section, take the appropriate action of either **Hide alert** or **Resolve alert**. - 1. For example, in the **Conditions** section, select the triggering evidence **Entity Role: Triggering**, **Equals** and select the evidence type from the drop-down list. + Enter **Name**, **Description**, and click **Save**. - :::image type="content" source="../../media/investigate-alerts/evidence-types-drop-down-list.png" alt-text="Screenshot of evidence types drop-down list." lightbox="../../media/investigate-alerts/evidence-types-drop-down-list.png"::: + > [!NOTE] + > The **alert title (Name)** is based on the **alert type (IoaDefinitionId)**, which decides the alert title. Two alerts that have the same alert type can change to a different alert title. - 2. All the properties of this 'evidence' will auto populate as a new subgroup in the respective fields below. + :::image type="content" source="../../media/investigate-alerts/alert-tuning-choose-action.png" lightbox="../../media/investigate-alerts/alert-tuning-choose-action.png" alt-text="Screenshot of the Action menu in the Tune an alert page."::: - :::image type="content" source="../../media/investigate-alerts/properties-evidence.png" alt-text="Screenshot of properties of evidence auto-populating." lightbox="../../media/investigate-alerts/properties-evidence.png" ::: +To tune an alert from the **Alerts** page: - > [!NOTE] - > Condition values are not case sensitive. +1. Select an alert in the **Alerts** page under **Incidents and alerts**. Alternatively, you can select an alert when reviewing incident details in the Incident page. - 3. You can edit and/or delete properties of this 'evidence' as per your requirement (using wildcards, when supported). + You can tune an alert through the **Tune alert** pane that automatically opens on the right side of the alert details page. - 4. Other than files and processes, AntiMalware Scan Interface (AMSI) script, Windows Management Instrumentation (WMI) event, and scheduled tasks are some of the newly added evidence types that you can select from the evidence types drop-down list. + :::image type="content" source="../../media/investigate-alerts/alert-tuning-tune-pane.png" lightbox="../../media/investigate-alerts/alert-tuning-tune-pane.png" alt-text="Screenshot of Tune an alert pane within an Alert page."::: - :::image type="content" source="../../media/investigate-alerts/other-evidence-types.png" alt-text="Screenshot of other types of evidence." lightbox="../../media/investigate-alerts/other-evidence-types.png"::: +2. Select the conditions where the alert applies in the **Alert types** section. Select **Only this alert type** to apply the rule on the selected alert. - 5. To add another IOC, click **Add filter**. + However, to apply the rule on any alert type that meets rule conditions select **Any alert type based on IOC conditions**. - > [!NOTE] - > Adding at least one IOC to the rule condition is required to suppress any alert type. + :::image type="content" source="../../media/investigate-alerts/alert-tuning-alert-types.png" lightbox="../../media/investigate-alerts/alert-tuning-alert-types.png" alt-text="Screenshot of Tune an alert pane highlighting the Alert types section."::: -4. Alternatively, you can select **Auto fill all alert 7 related IOCs** in the **IOC** section to add all alert related evidence types and their properties at once in the **Conditions** section. +3. Filling out the **Scope** section is required if the alert tuning is Defender for Endpoint-specific. Select whether the rule applies to all devices in the organization or for a specific device. - :::image type="content" source="../../media/investigate-alerts/autofill-iocs.png" alt-text="Screenshot of auto fill all alert related IOCs." lightbox="../../media/investigate-alerts/autofill-iocs.png"::: + > [!NOTE] + > Applying the rule to all organization requires an administrative role permission. -5. In the **Scope** section, set the Scope in the **Conditions** sub-section by selecting specific device, multiple devices, device groups, the entire organization or by user. + :::image type="content" source="../../media/investigate-alerts/alert-tuning-scope.png" lightbox="../../media/investigate-alerts/alert-tuning-scope.png" alt-text="Screenshot of Tune an alert pane highlighting the Scope section."::: ++4. Add conditions in the **Conditions** section to stop the alert when triggered by a specific IOC or by any IOC added in the alert. You can select a specific device, multiple devices, device groups, the entire organization or by user in this section. > [!NOTE]- > You must have Admin permission when the **Scope** is set only for **User**. Admin permission is not required when the **Scope** is set for **User** together with **Device**, **Device groups**. + > You must have Admin permission when the **Scope** is set only for User. Admin permission is not required when the **Scope** is set for **User** together with **Device, Device groups**. ++ :::image type="content" source="../../media/investigate-alerts/alert-tuning-conditions.png" lightbox="../../media/investigate-alerts/alert-tuning-conditions.png" alt-text="Screenshot of Tune an alert pane highlighting the Conditions section."::: ++5. Add IOCs where the rule applies in the **IOCs** section. You can select **Any IOC** to stop the alert no matter what 'evidence' has caused the alert. - :::image type="content" source="../../media/investigate-alerts/suppression-choose-scope.png" lightbox="../../media/investigate-alerts/suppression-choose-scope.png" alt-text="Screenshot of create suppression rule pane: Conditions, Scope, Action."::: + :::image type="content" source="../../media/investigate-alerts/alert-tuning-any-ioc.png" lightbox="../../media/investigate-alerts/alert-tuning-any-ioc.png" alt-text="Screenshot of Tune an alert pane highlighting the IOCs section."::: -6. In the **Action** section, take the appropriate action of either **Hide alert** or **Resolve alert**. +6. Alternatively, you can select **Auto fill all alert 7 related IOCs** in the **IOCs** section to add all alert-related evidence types and their properties at once in the **Conditions** section. ++ :::image type="content" source="../../media/investigate-alerts/alert-tuning-auto-fill-conditions.png" alt-text="Screenshot of auto fill all alert related IOCs." lightbox="../../media/investigate-alerts/alert-tuning-auto-fill-conditions.png"::: ++7. In the **Action** section, take the appropriate action of either **Hide alert** or **Resolve alert**. Enter **Name**, **Comment**, and click **Save**. -7. **Prevent the IOCs from being blocked in the future:** + :::image type="content" source="../../media/investigate-alerts/alert-tuning-tune-pane-action.png" alt-text="Screenshot of Action section in the Tune alert pane." lightbox="../../media/investigate-alerts/alert-tuning-tune-pane-action.png"::: ++8. **Prevent the IOCs from being blocked in the future:** - Once you save the suppression rule, in the **Successful suppression rule creation** page that appears, you can add the selected IOCs as indicators to the "allow list" and prevent them from being blocked in the future. + Once you save the alert tuning rule, in the **Successful rule creation** page that appears, you can add the selected IOCs as indicators to the "allow list" and prevent them from being blocked in the future. All alert-related IOCs will be shown in the list. To create a suppression rule for alerts: 2. Enter the scope to the **Select scope to apply to**. By default scope for the related alert is selected. 3. Click **Save**. Now the file is not blocked as it is in the allow list. - :::image type="content" source="../../media/investigate-alerts/suppression-2-choose-iocs.png" lightbox="../../media/investigate-alerts/suppression-2-choose-iocs.png" alt-text="Screenshot of successful suppression rule creation. "::: +9. The new alert tuning functionality is available by default. -8. The new suppression alert functionality is available by default. -- However, you can switch back to the previous experience in Microsoft 365 Defender portal by navigating to **Settings > Endpoints > Alert suppression**, then switch off the **New suppression rules creation enabled** toggle. -- :::image type="content" source="../../media/investigate-alerts/suppression-toggle.png" lightbox="../../media/investigate-alerts/suppression-toggle.png" alt-text="Screenshot of toggle for turning on/off the suppression rule creation feature."::: + However, you can switch back to the previous experience in Microsoft 365 Defender portal by navigating to **Settings > Microsoft 365 Defender > Rules > Alert tuning**, then switch off the **New tuning rules creation enabled** toggle. > [!NOTE]- > Soon, only the new alert suppression experience will be available. You will not be able to go back to the previous experience. --9. **Edit existing rules:** + > Soon, only the new alert tuning experience will be available. You will not be able to go back to the previous experience. - You can always add or change rule conditions and scope of new or existing rules in Microsoft Defender portal, by selecting the relevant rule and clicking **Edit rule**. +10. **Edit existing rules:** - To edit existing rules, ensure that the **New suppression rules creation enabled** toggle is enabled. + You can always add or change rule conditions and scope of new or existing rules in the Microsoft 365 Defender portal, by selecting the relevant rule and clicking **Edit rule**. - :::image type="content" source="../../media/investigate-alerts/suppression-toggle-on-edit.png" lightbox="../../media/investigate-alerts/suppression-toggle-on-edit.png" alt-text="Screenshot of edit suppression rule."::: + To edit existing rules, ensure that the **New alert tuning rules creation enabled** toggle is enabled. ## Resolve an alert |
| security | Safe Attachments About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/safe-attachments-about.md | The following table describes scenarios for Safe Attachments in Microsoft 365 an |Pat's Microsoft 365 E5 organization has no Safe Attachments policies configured.|Pat is protected by Safe Attachments due to the **Built-in protection** preset security policy that applies to all recipients who are not otherwise defined in Safe Attachments policies.| |Lee's organization has a Safe Attachments policy that applies only to finance employees. Lee is a member of the sales department.|Lee and the rest of the sales department are protected by Safe Attachments due to the **Built-in protection** preset security policy that applies to all recipients who are not otherwise defined in Safe Attachments policies.| |Yesterday, an admin in Jean's organization created a Safe Attachments policy that applies to all employees. Earlier today, Jean received an email message that included an attachment.|Jean is protected by Safe Attachments due to that custom Safe Attachments policy. <br/><br/> Typically, it takes about 30 minutes for a new policy to take effect.|-|Chris's organization has long-standing Safe Attachments policies for everyone in the organization. Chris receives an email that has an attachment, and then forwards the message to external recipients.|Chis is protected by Safe Attachments. <br/><br/> If the external recipients are in a Microsoft 365 organization, then the forwarded messages are also protected by Safe Attachments.| +|Chris's organization has long-standing Safe Attachments policies for everyone in the organization. Chris receives an email that has an attachment, and then forwards the message to external recipients.|Chris is protected by Safe Attachments. <br/><br/> If the external recipients are in a Microsoft 365 organization, then the forwarded messages are also protected by Safe Attachments.| Safe Attachments scanning takes place in the same region where your Microsoft 365 data resides. For more information about datacenter geography, see [Where is your data located?](https://products.office.com/where-is-your-data-located?geo=All) |
| syntex | Adoption Scenarios | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/adoption-scenarios.md | description: Find business scenarios about how to use Microsoft Syntex in your o # Scenarios and use cases for Microsoft Syntex +Use these example scenarios to prompt ideas about how you can use Microsoft Syntex in your organization. ++|Scenario |Description | +||| +|[:::image type="content" source="../medi) <br>Use SharePoint site templates for Syntex to jumpstart a professional site to manage, process, and track the status of business documents. <br>[Accounts payable](https://support.microsoft.com/office/c7ff13e7-66d9-4040-b8c6-78924272ec4d) <br>[Contracts management](https://support.microsoft.com/office/80820115-c700-4a62-bb59-69b33c8e3b4f) | +|[:::image type="content" source="../medi#routine-maintenance-reports) | +|[:::image type="content" source="../medi#contract-renewals) | +|[:::image type="content" source="../medi#construction-documentation-verification)| +|[:::image type="content" source="../medi#policies-and-procedures) | +|[:::image type="content" source="../medi#patent-information) | +|[:::image type="content" source="../medi#event-or-conference-files) | ++<! +OLD Use the following example scenarios to prompt ideas about how you can use Microsoft Syntex in your organization. - [Scenario: Track information from invoices by using the structured document processing model](adoption-scenarios.md#scenario-track-information-from-invoices-by-using-the-structured-document-processing-model) When you automate this scenario, you can ensure that: - The levels of non-compliance are reduced. - The number of manual reminders is reduced. - The number of fines for non-compliance is reduced.-+> ## See also [Get started driving adoption of Microsoft Syntex](adoption-getstarted.md) |
| syntex | Scenario Document Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/scenario-document-compliance.md | + + Title: Document compliance with Microsoft Syntex ++++ Last updated : 05/01/2023+audience: admin ++++ - enabler-strategic + - m365initiative-syntex ++search.appverid: +ms.localizationpriority: medium +description: Learn how to use Microsoft Syntex to implement document compliance for files in document libraries. +++# Scenario: Document compliance with Microsoft Syntex ++ :::column span=""::: + Use Syntex to help comply with retention and sensitivity requirements for your business documents. ++ Features used: + - Document processing models + - Sensitivity labels + :::column-end::: + :::column span=""::: +  + :::column-end::: ++## Event or conference files ++You need to set compliance on documents uploaded into a document library storing files for a marketing event and a conference. You want to ensure that: ++- Compliance is upheld and risk is reduced. +- Taxonomy and records management is consistently and accurately applied. +- Content volumes are controlled. +- Employees can easily discover the right information in the right context. ++Set up some processes for compliance with Syntex to capture and appropriately classify, audit, and flag documents and forms that need better governance. You can rely on Syntex to automatically classify content rather than relying on users to manually tag, or the compliance team to manually apply governance rules and archiving. And you can enable a simplified search experience, manage data volumes, apply records management and retention policies, ensure compliance, and best practice archiving and purging practices. ++The policies can be set to be added on document upload when the sensitivity and retention labels are set as a part of document processing model. Each time content is then uploaded to the library, these labels are applied directly. ++<br> ++> [!div class="nextstepaction"] +> [See more scenarios and use cases for Syntex](adoption-scenarios.md) |
| syntex | Scenario Find Content Details | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/scenario-find-content-details.md | + + Title: Find content details with Microsoft Syntex ++++ Last updated : 05/01/2023+audience: admin ++++ - enabler-strategic + - m365initiative-syntex ++search.appverid: +ms.localizationpriority: medium +description: Learn how to use Microsoft Syntex to find content details in document libraries. +++# Scenario: Find content details with Microsoft Syntex ++ :::column span=""::: + Use Syntex to centralize, organize, and retrieve content to make the specific details easier to discover. ++ Features used: + - Document processing models + - Power Automate + - Content query + :::column-end::: + :::column span=""::: +  + :::column-end::: ++## Patent information ++The legal team of a retail manufacturer is looking for a solution to centralize, organize, and streamline searching of legal content, specifically patent filings and intellectual property documents. ++The team has been using Microsoft Outlook to manage legal content, but is having difficulty with team visibility, search, and content decentralized through mailboxes. ++The team decides to use Microsoft Syntex as the solution. First, sets up a SharePoint document library where you want to store the legal content. Then copies the content of the email messages and attachments to the document library. Finally, uses Syntex to extract information and metadata from email messages as well as the attachments to help organize content. ++The legal team is now able to easily manage and search the patent filings and intellectual property documents. ++<br> ++> [!div class="nextstepaction"] +> [See more scenarios and use cases for Syntex](adoption-scenarios.md) |
| syntex | Scenario Generate Documents Bulk | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/scenario-generate-documents-bulk.md | + + Title: Generate documents in bulk with Microsoft Syntex ++++ Last updated : 05/01/2023+audience: admin ++++ - enabler-strategic + - m365initiative-syntex ++search.appverid: +ms.localizationpriority: medium +description: Learn how to use Microsoft Syntex for generating documents in bulk. +++# Scenario: Generate documents in bulk with Microsoft Syntex ++ :::column span=""::: + You can use content assembly to automatically generate documents in bulk. These documents are based on a modern template that is populated with values from a data source such as a SharePoint list or database. ++ Features used: + - Content assembly + - Power Automate + :::column-end::: + :::column span=""::: +  + :::column-end::: ++## Contract renewals ++You can use content assembly to generate documents in bulk using a template. You need to send correspondence to all of your vendors to remind them about upcoming contract renewals. ++To implement a Syntex solution: ++  ++1. Set up a SharePoint document library where you want to store the reminder letters.ΓÇ» ++2. Set up a SharePoint list with the required vendor details.ΓÇ» ++3. Go to the document library and create a modern template using a reminder letter. Create fields for the values that represent vendor details and associate them with the columns of the SharePoint list you previously set up.ΓÇ» ++4. Now create a Power Automate flow using the action ΓÇ£Generate document using SyntexΓÇ¥ and with a manual trigger to get items in the list. This ensures that you can generate documents when you want for all values in the list.ΓÇ» ++> [!Note] +> Although this example uses a SharePoint list as a data source, you can use any data source as a trigger for generating documents if you have access to the required Power Automate connector.ΓÇ» ++<br> ++> [!div class="nextstepaction"] +> [See more scenarios and use cases for Syntex](adoption-scenarios.md) |
| syntex | Scenario Generate Routine Documents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/scenario-generate-routine-documents.md | + + Title: Automatically generate routine documents with Microsoft Syntex ++++ Last updated : 05/01/2023+audience: admin ++++ - enabler-strategic + - m365initiative-syntex ++search.appverid: +ms.localizationpriority: medium +description: Learn how to use Microsoft Syntex to automatically generate routine business documents. +++# Scenario: Automatically generate routine documents with Microsoft Syntex ++ :::column span=""::: + Use the content assembly feature in Microsoft Syntex to create modern templates for files that need to be created on a regular basis. Files can then be generated based on these templates, either through manual request or through an automation. ++ Features used: + - Content assembly + - Power Automate + :::column-end::: + :::column span=""::: +  + :::column-end::: ++## Routine maintenance reports ++You can use content assembly to automate the generation of daily inspection or maintenance reports. These reports generally have a lot of standardized text with certain fields or values that are entered by the user after inspection. ++Today, users physically inspect parts and then fill in a list or a form or physical paper reports. This leads to additional work in transforming this data into digital content that can be used further. ++To implement a Syntex solution: ++  ++1. Set up a document library where you want to store the reports.ΓÇ» ++2. Set up a SharePoint list with the required columns that you need to be filled in by the frontline workers.ΓÇ» ++3. Go to the document library and create a modern template using an existing report. Create fields for the values that are entered by the frontline workers and then associate the fields with the columns of the SharePoint list you previously set up.ΓÇ» ++4. Now create a Power Automate flow using the action ΓÇ£Generate document using SyntexΓÇ¥ and use the trigger ΓÇ£When a list item is created.ΓÇ¥ This ensures that whenever a new entry is added by a frontline worker to the list, a new report is generated.ΓÇ» ++5. Using Microsoft Forms, you can create a form for frontline workers to enter values in the list or expose the list itself for them to add values.ΓÇ» ++You can now review all daily reports as they get created based on values that frontline workers enter in the form.ΓÇ» ++> [!Note] +> Although this example uses a SharePoint list as a data source, you can use any data source as a trigger for generating documents if you have access to the required Power Automate connector.ΓÇ» ++<br> ++> [!div class="nextstepaction"] +> [See more scenarios and use cases for Syntex](adoption-scenarios.md) + |
| syntex | Scenario Handle Incoming Documents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/scenario-handle-incoming-documents.md | + + Title: Handle incoming documents with Microsoft Syntex ++++ Last updated : 05/01/2023+audience: admin ++++ - enabler-strategic + - m365initiative-syntex ++search.appverid: +ms.localizationpriority: medium +description: Learn how to use Microsoft Syntex to manage various incoming business documents. +++# Scenario: Handle incoming documents with Microsoft Syntex ++ :::column span=""::: + Use Syntex to manage and process incoming business documents, such as insurance forms, business verifications, and rental contracts. ++ Features used: + - Document processing models + - Power Automate + - Power BI + - Content assembly + :::column-end::: + :::column span=""::: +  + :::column-end::: ++## Insurance claims ++A healthcare provider fills in a paper-based enrollment application form and submits it to insurance company for processing. Currently, the enrollment forms are processed manually, and the data is fed into a system for review. Manual data entry leads to loss in productivity along with increased risk due to human error. ++Microsoft Syntex uses advanced AI to extract information including checkboxes and handwritten content. The information is stored as metadata in SharePoint along with the document. Power Automate is then used to drive review and integrate the data with downstream applications. ++AI-based automation significantly reduces the time needed to process these forms and increase the response rate to providers. The AI model takes 10 minutes to train, and it saves hours of manual data entry every week for the staff. SharePoint also lets you analyze this data using Power BI dashboards. Content query can be used by providers to locate specific patient information. ++## Rental contract management ++Most landlords use a standard rental agreement with their tenants. Once a new tenant completes the agreement and sends it to the landlord, it's then placed in a SharePoint library where Syntex will extract the key information. ++During the life of the contract, certain events can occur that require correspondence to be sent to the tenant such as late rental notices, grievances, and eviction notices. Correspondence for these events will also use standard templates that can use the information originally captured from the agreement. ++Taking this a little further, PowerApps can begin to list all the active tenants, the correspondence sent and even allow them to create new correspondence using content assembly and Power Automate. ++## Construction documentation verification ++As part of annual verification of partners and vendors, W-9 forms and Certificates of Liability (CLIs) are sent in. These documents are reviewed and updates are made accordingly. Thousands of CLIs and W-9 forms are reviewed manually for changes and updates into the appropriate systems used for bids. ++An improved process is required to do more with less. A Power Platform solution is created to extract attachments from incoming emails to save them to SharePoint. Syntex models are then created to identify and extract information from CLIs and W-9 forms, such as name, type of coverage, amount of coverage, date. Extracted information can be used to populate other applications used during construction proposals. +<br> +<br> ++> [!div class="nextstepaction"] +> [See more scenarios and use cases for Syntex](adoption-scenarios.md) |
| syntex | Scenario Organize Repositories | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/scenario-organize-repositories.md | + + Title: Make information easier to find with Microsoft Syntex ++++ Last updated : 05/01/2023+audience: admin ++++ - enabler-strategic + - m365initiative-syntex ++search.appverid: +ms.localizationpriority: medium +description: Learn how to use Microsoft Syntex to manage and organize document libraries. +++# Scenario: Make information easier to find with Microsoft Syntex ++ :::column span=""::: + Use Syntex to make business documents and employee information in stored in document libraries easier for users to find and use. ++ Features used: + - Document processing models + - Term store + - Search + - Viva Topics + :::column-end::: + :::column span=""::: +  + :::column-end::: ++## Policies and procedures ++Your organization drafts and stores policies and procedures in a few large documents in SharePoint or several smaller documents, all in a document library that typically has a well-defined folder structure. Experienced users might know where the policy or procedure is they need to reference to do their job effectively. However, new users or users who donΓÇÖt regularly focus on a specific policy might not know where to look. ++By using Syntex and the SharePoint term store, as policies are added to the library and processed Syntex can assign the correct term. Users are then able to filter or search using these terms, or thier synonyms. The terms can also be used to generate topics in Viva Topics. The Viva Topics curation AI will then generate topics for these terms and associate files tagged with the term. Instead of navigating a folder structure, users can then search for synonyms or alternate names as defined in the topic and see the appropriate policy or procedure. ++<br> ++> [!div class="nextstepaction"] +> [See more scenarios and use cases for Syntex](adoption-scenarios.md) |