| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Restore Deleted Group | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/restore-deleted-group.md | search.appverid: - MET150 - MOE150 ms.assetid: b7c66b59-657a-4e1a-8aa0-8163b1f4eb54-description: "A deleted group is retained for 30 days and you can still restore the group. After 30 days, the group and its content is permanently deleted." +description: "A deleted group is retained for 30 days and you can still restore the group. After 30 days, the group and its content are permanently deleted." # Restore a deleted Microsoft 365 group If you are a global administrator or a groups administrator, you can restore a d Visit the [Microsoft Tech Community](https://techcommunity.microsoft.com/t5/microsoft-365-groups/bd-p/Microsoft365Groups) to post questions and participate in conversations about Microsoft 365 groups. -## Related content +## Related topics -[Manage Microsoft 365 Groups with PowerShell](../../enterprise/manage-microsoft-365-groups-with-powershell.md) (article)\ -[Delete groups using the Remove-UnifiedGroup cmdlet](/powershell/module/exchange/remove-unifiedgroup) (article)\ -[Manage your group-connected team site settings](https://support.microsoft.com/office/8376034d-d0c7-446e-9178-6ab51c58df42) (article)\ -[Delete a group in Outlook](https://support.microsoft.com/office/ca7f5a9e-ae4f-4cbe-a4bc-89c469d1726f) (article) +[Restore deleted items](/Exchange/recipients-in-exchange-online/restore-deleted-items-group) ++[Manage Microsoft 365 Groups with PowerShell](../../enterprise/manage-microsoft-365-groups-with-powershell.md) ++[Delete groups using the Remove-UnifiedGroup cmdlet](/powershell/module/exchange/remove-unifiedgroup) ++[Manage your group-connected team site settings](https://support.microsoft.com/office/8376034d-d0c7-446e-9178-6ab51c58df42) ++[Delete a group in Outlook](https://support.microsoft.com/office/ca7f5a9e-ae4f-4cbe-a4bc-89c469d1726f) |
| bookings | Bookings In Outlook | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/bookings-in-outlook.md | description: "Use Bookings with me to let others schedule meetings with you in O # Bookings with me -**Bookings with me** in Outlook is a web-based personal scheduling page that integrates with the free/busy information from your Outlook calendar. Bookings with me lets people schedule a meeting or appointment with you. You can create custom meeting types to share with others so they can easily schedule time with you based on your availability and preferences. You both get an email confirmation and attendees can update or cancel scheduled meetings with you from your Bookings with me page. +**Bookings with me** in Outlook is a web-based personal time management solution that provides a simple and powerful scheduling page with seamless integration with outlook. Bookings with me lets people schedule a meeting or appointment with you through a personal scheduling page that integrates with the free/busy information from your Outlook calendar. You can create custom meeting types to share with others so they can easily schedule time with you based on your availability and preferences. You both get an email confirmation and attendees can update or cancel scheduled meetings with you from your Bookings with me page. Bookings with me has two different views: -- [Bookings with me: setup and sharing](https://support.microsoft.com/office/bookings-with-me-setup-and-sharing-ad2e28c4-4abd-45c7-9439-27a789d254a2) A personal booking page where you can create meeting types that others can book with you. Custom meeting types give you the ability to customize when you want to meet and how that meeting type is shared with others. You control whether each meeting type is public to your scheduling page or is private and can only be accessed by a select group of people. You can also choose to add a Teams meeting to all meetings booked through your Bookings with me page. You can access your Bookings with me page through Outlook on the web. After you set up your page and publish it, you can share it with others. For example, you can add it to your Outlook signature.+- **Organizer view**: An organizer is someone who creates meeting types and shares the booking page with others so that they can easily schedule meetings with them. A personal booking page where you can create meeting types that others can book with you. Custom meeting types give you the ability to customize when you want to meet and how that meeting type is shared with others. You control whether each meeting type is public to your scheduling page or is private and can only be accessed by a select group of people. You can also choose to add a Teams meeting to all meetings booked through your Bookings with me page. You can access your Bookings with me page through Outlook on the web. After you set up your page and publish it, you can share it with others. For example, you can add it to your Outlook signature. [Learn more about setup and sharing in Bookings with me](https://support.microsoft.com/office/bookings-with-me-setup-and-sharing-ad2e28c4-4abd-45c7-9439-27a789d254a2). -- [Attendee view](https://support.microsoft.com/office/select-a-meeting-time-in-bookings-with-me-8f3bbe5b-4bc6-4073-bf61-57383c00b43a) When you share your Bookings with me page with others, they'll see the attendee view. If the organizer has shared their Bookings with me page link with you, you'll be able to see all of their public meeting types. If the organizer has shared a meeting link, you'll only be able to view that meeting.+- **Attendee view**: An attendee is someone who uses the booking page to create or attend a meeting scheduled by an organizer. After the organizer shares their Bookings with me page with others, those visitors will see the attendee view. If the organizer has shared their Bookings with me page link with you, you'll be able to see all of their public meeting types. If the organizer has shared a meeting link, you'll only be able to view that meeting. [Learn more about selecting a booking time in Bookings with me](https://support.microsoft.com/office/select-a-meeting-time-in-bookings-with-me-8f3bbe5b-4bc6-4073-bf61-57383c00b43a). - Public meetings can be viewed and scheduled by anyone that has your Bookings with me page link. You are in control of who you share that link with. All public meeting types will be visible to anyone that has your Bookings with me page link. - Private meetings can only be viewed by people who have the link for that meeting type. The difference between public meetings and private meetings is private meetings can have different links and the links expire after 90 days. You can also set private links to expire after a one-time booking. When accessing the scheduling view for a private meeting, only that meeting type will be visible. Bookings with me is an ideal solution for enterprise, small business, and users - Schedule interviews with external candidates - Set up customer and client meetings - Schedule tech support-- Set up office hours+- Set up office/consultation hours - Set up mentoring hours - 1:1 meetings with direct reports - Lunch and coffee breaks For more information, see the [Bookings with me Microsoft 365 Roadmap item](http To turn on Bookings with me without access to Bookings, block access to Microsoft Bookings using the [OWA Mailbox policy PowerShell command](/powershell/module/exchange/set-owamailboxpolicy) or follow the instructions here: [Turn Microsoft Bookings on or off](turn-bookings-on-or-off.md). -2. For mailboxes that get assigned a customized SharingPolicy, the policy must have Anonymous:SharingPolicyAction as one of the domains. -- ```Powershell: - get-mailbox adam@contoso.com | Format-List SharingPolicy - ``` -- If the command returns: -- `SharingPolicy : "contoso.onmicrosoft.com\Default Sharing (CONTOSO)"` -- You must update the policy with one of the required domains: -- ```Powershell - Set-SharingPolicy "Default Sharing (CONTOSO)" -Domains @{Add="Anonymous:CalendarSharingFreeBusySimple"} - ``` --For more information, see [Set-SharingPolicy](/powershell/module/exchange/set-sharingpolicy). - ## Turn Bookings with me on or off Bookings with me can be turned on or off for your entire organization or specific users. When Bookings with me is turned on, users can create a Bookings with me page and share links with others inside or outside your organization. Bookings with me integrates with your Outlook calendar and can only be used for Also, Bookings with me won't create a new mailbox for each Bookings with me page. -### Why is Bookings with me in preview? --Bookings with me is in preview for all enterprise users worldwide. We're collecting feedback and making improvement while it is being integrated into scheduling experiences in Bookings and Outlook. - ### Who can access my public Bookings page? Public meeting types can be accessed by anyone that has your Bookings with me page address. You decide who you share your Bookings with me page address with. For more information, see [Select a meeting time in Bookings with me](https://support.microsoft.com/office/select-a-meeting-time-in-bookings-with-me-8f3bbe5b-4bc6-4073-bf61-57383c00b43a). Private meeting types can also generate single use links. Single use links expir ### Do people need to have a Microsoft account or Bookings license to schedule time with me? -No. Anyone can schedule time with you using your Bookings with me page, even if they don't have a Microsoft account. You need a Bookings license to create a Bookings with me page. +No. Anyone or any attendee can schedule time with you using your Bookings with me page, even if they don't have a Microsoft account. You, as an organizer, need a Bookings license to create a Bookings with me page. ## Privacy |
| commerce | Upgrade To Different Plan | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/upgrade-to-different-plan.md | -description: "Learned how to upgrade or change to a different plan in the Microsoft 365 admin center." +description: "Learn how to upgrade or change to a different plan in the Microsoft 365 admin center." Last updated 04/27/2023 |
| compliance | Apply Retention Labels Automatically | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/apply-retention-labels-automatically.md | f1.keywords: Previously updated : 04/28/2023 Last updated : 05/12/2023 audience: Admin Auto-applying retention labels are powerful because: - You don't need to rely on users to classify all content correctly. - Users no longer need to know about data governance policies - they can focus on their work. -You can apply retention labels to content automatically when that content doesn't already have a retention label applied and contains sensitive information, keywords or searchable properties, or a match for [trainable classifiers](classifier-get-started-with.md). Now in preview, you can also automatically apply a retention label to cloud attachments that are stored in SharePoint or OneDrive. +You can apply retention labels to content automatically when that content doesn't already have a retention label applied and contains sensitive information, keywords or searchable properties, or a match for [trainable classifiers](classifier-get-started-with.md). You can also automatically apply a retention label to cloud attachments that are stored in SharePoint or OneDrive. > [!TIP] > Use searchable properties to identify [Teams meeting recordings](#microsoft-teams-meeting-recordings) and [items that have a sensitivity label applied](#identify-files-and-emails-that-have-a-sensitivity-label). To consider when using trainable classifiers to auto-apply retention labels: #### Auto-apply labels to cloud attachments > [!NOTE]-> This option is in preview and subject to change. +> Support for cloud attachments that are shared in Yammer is in preview. You might need to use this option if you're required to capture and retain all copies of files in your tenant that are sent over communications by users. You use this option in conjunction with retention policies for the communication services themselves; Exchange, Teams, and Yammer. |
| compliance | Audit Log Retention Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/audit-log-retention-policies.md | f1.keywords: Previously updated : 03/16/2023 Last updated : 05/11/2023 audience: Admin You can create and manage audit log retention policies in the Microsoft Purview ## Default audit log retention policy -Audit (Premium) in Microsoft 365 provides a default audit log retention policy for all organizations. This policy retains all Exchange Online, SharePoint Online, OneDrive for Business, and Azure Active Directory audit records for one year. This default policy retains audit records that contain the value of **AzureActiveDirectory**, **Exchange**, **OneDrive**, and **SharePoint** for the **Workload** property (which is the service in which the activity occurred). The default policy can't be modified. See the [More information](#more-information) section in this article for a list of record types for each workload that are included in the default policy. +Audit (Premium) in Microsoft 365 provides a default audit log retention policy for all organizations. This policy retains all Exchange Online, SharePoint Online, OneDrive for Business, and Azure Active Directory audit records for one year. This default policy retains audit records that contain the value of **AzureActiveDirectory**, **Exchange**, **OneDrive**, and **SharePoint** for the **Workload** property (which is the service in which the activity occurred). The default policy can't be modified. See the [Default retention policy record types](#default-retention-policy-record-types) section in this article for a list of record types for each workload that are included in the default policy. > [!NOTE] > The default audit log retention policy only applies to audit records for activity performed by users who are assigned an Office 365 or Microsoft 365 E5 license or have a Microsoft 365 E5 Compliance or E5 eDiscovery and Audit add-on license. If you have non-E5 users or guest users in your organization, their corresponding audit records are retained for 90 days. ## Before you create an audit log retention policy -- You have to be assigned the Organization Configuration role in the compliance portal to create or modify an audit retention policy.+- You have to be assigned the *Organization Configuration* role in the compliance portal to create or modify an audit retention policy. - You can have a maximum of 50 audit log retention policies in your organization. - To retain an audit log for longer than 90 days (and up to 1 year), the user who generates the audit log (by performing an audited activity) must be assigned an Office 365 E5 or Microsoft 365 E5 license or have a Microsoft 365 E5 Compliance or E5 eDiscovery and Audit add-on license. To retain audit logs for 10 years, the user who generates the audit log must also be assigned a 10-year audit log retention add-on license in addition to an E5 license. Audit (Premium) in Microsoft 365 provides a default audit log retention policy f ## Create an audit log retention policy -1. Go to <https://compliance.microsoft.com> and sign in with a user account that's assigned the Organization Configuration role on the Permissions page in the compliance portal. +1. Go to <https://compliance.microsoft.com> and sign in with a user account that's assigned the *Organization Configuration* role on the **Permissions** page in the compliance portal. 2. In the left pane of the compliance portal, select **Audit**. Audit (Premium) in Microsoft 365 provides a default audit log retention policy f 4. Select **Create audit retention policy**, and then complete the following fields on the flyout page: -  +  1. **Policy name:** The name of the audit log retention policy. This name must be unique in your organization, and it can't be change after the policy is created. Audit (Premium) in Microsoft 365 provides a default audit log retention policy f - If you select a single record type, the **Activities** field is dynamically displayed. You can use the drop-down list to select activities from the selected record type to apply the policy to. If you don't choose specific activities, the policy will apply to all activities of the selected record type. - If you select multiple record types, you don't have the ability to select activities. The policy will apply to all activities of the selected record types. - 5. **Duration:** The amount of time to retain the audit logs that meet the criteria of the policy. + 5. **Duration:** The amount of time to retain the audit logs that meet the criteria of the policy. The available options are *7 Days*, *30 Days*, *6 Months*, *9 Months*, *1 Year*, *3 Years*, *5 Years*, and *7 Years*. Users with the 10-year Audit Log Retention add-on license can select a *10 Years* option. + + >[!IMPORTANT] + > To retain audit logs for the 7 and 30 days duration options, you must have a Microsoft 365 Enterprise E5 subscription. To retain audit logs for the 3, 5, and 7 years duration options, you must be assigned to a 10-Year Audit Log Retention add-on license in addition to your Microsoft 365 Enterprise E5 subscription. For more information about Audit subscriptions and add-ons, see [Auditing solutions in Microsoft Purview](/microsoft-365/compliance/audit-solutions-overview#licensing-requirements) - 6. **Priority:** This value determines the order in which audit log retention policies in your organization are processed. A lower value indicates a higher priority. Valid priorities are numerical values between **1** and **10000**. A value of **1** is the highest priority, and a value of **10000** is the lowest priority. For example, a policy with a value of **5** takes priority over a policy with a value of **10**. As previously explained, any custom audit log retention policy takes priority over the default policy for your organization. + 6. **Priority:** This value determines the order in which audit log retention policies in your organization are processed. A lower value indicates a higher priority. Valid priorities are numerical values between **1** and **10000**. A value of **1** is the highest priority, and a value of **10000** is the lowest priority. For example, a policy with a value of **5** takes priority over a policy with a value of **10**. Any custom audit log retention policy takes priority over the default policy for your organization. 5. Select **Save** to create the new audit log retention policy. To edit a policy, select it to display the flyout page. You can modify one or mo > [!IMPORTANT] >-> If you use the **New-UnifiedAuditLogRetentionPolicy** cmdlet, it's possible to create an audit log retention policy for record types or activities that aren't available in the **Create audit retention policy** tool in the dashboard. In this case, you won't be able to edit the policy (for example, change the retention duration or add and remove activities) from the **Audit retention policies** dashboard. You'll only be able to view and delete the policy in the Microsoft Purview compliance portal. To edit the policy, you'll have to use the [Set-UnifiedAuditLogRetentionPolicy](/powershell/module/exchange/set-unifiedauditlogretentionpolicy) cmdlet in Security & Compliance PowerShell.> +> If you use the *New-UnifiedAuditLogRetentionPolicy* cmdlet, it's possible to create an audit log retention policy for record types or activities that aren't available in the **Create audit retention policy** tool in the dashboard. In this case, you won't be able to edit the policy (for example, change the retention duration or add and remove activities) from the **Audit retention policies** dashboard. You'll only be able to view and delete the policy in the Microsoft Purview compliance portal. To edit the policy, you'll have to use the [Set-UnifiedAuditLogRetentionPolicy](/powershell/module/exchange/set-unifiedauditlogretentionpolicy) cmdlet in Security & Compliance PowerShell.> > > **Tip:** A message is displayed at the top of the flyout page for policies that have to be edited using PowerShell. ### Delete policies in the dashboard -To delete a policy, select the **Delete**  icon and then confirm that you want to delete the policy. The policy is removed from the dashboard, but it might take up to 30 minutes for the policy to be removed from your organization. +To delete a policy, select the **Delete** icon and then confirm that you want to delete the policy. The policy is removed from the dashboard, but it might take up to 30 minutes for the policy to be removed from your organization. ## Create and manage audit log retention policies in PowerShell Get-UnifiedAuditLogRetentionPolicy | Sort-Object -Property Priority -Descending ``` > [!NOTE]-> The **Get-UnifiedAuditLogRetentionPolicy** cmdlet doesn't return the default audit log retention policy for your organization. +> The *Get-UnifiedAuditLogRetentionPolicy* cmdlet doesn't return the default audit log retention policy for your organization. ### Edit policies in PowerShell Use the [Set-UnifiedAuditLogRetentionPolicy](/powershell/module/exchange/set-uni Use the [Remove-UnifiedAuditLogRetentionPolicy](/powershell/module/exchange/remove-unifiedauditlogretentionpolicy) cmdlet in Security & Compliance PowerShell to delete an audit log retention policy. It might take up to 30 minutes for the policy to be removed from your organization. -## More information +## Default retention policy record types -As previously stated, audit records for operations in Azure Active Directory, Exchange Online, SharePoint Online, and OneDrive for Business, are retained for one year by default. The following table lists all the record types (for each of these services) included in the default audit log retention policy. This means that audit logs for any operation with this record type are retained for one year unless a custom audit log retention policy takes precedence for a specific record type, operation, or user. The Enum value (which is displayed as the value for the RecordType property in an audit record) for each record type is shown in parentheses. +Audit records for operations in Azure Active Directory, Exchange Online, SharePoint Online, and OneDrive for Business, are retained for one year by default. The following table lists all the record types (for each of these services) included in the default audit log retention policy. -<br> +This means that audit logs for any operation with this record type are retained for one year unless a custom audit log retention policy takes precedence for a specific record type, operation, or user. The Enum value (which is displayed as the value for the *RecordType* property in an audit record) for each record type is shown in parentheses. -**** --|AzureActiveDirectory|Exchange |SharePoint or OneDrive| -|||| +|**AzureActiveDirectory**|**Exchange**|**SharePoint or OneDrive**| +|:--|:--|:-| |AzureActiveDirectory (8)|ExchangeAdmin (1)|ComplianceDLPSharePoint (11)| |AzureActiveDirectoryAccountLogon (9)|ExchangeItem (2)|ComplianceDLPSharePointClassification (33)| |AzureActiveDirectoryStsLogon (15)|Campaign (62)|Project (35)| |
| compliance | Audit Solutions Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/audit-solutions-overview.md | Title: "Microsoft Purview auditing solutions" -description: "Learn how to audit the activities of users and administrators in your Microsoft 365 organization." + Title: "Auditing solutions in Microsoft Purview" +description: "Learn how to audit the activities of users and administrators in Microsoft Purview." f1.keywords: - NOCSH |
| compliance | Create Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-sensitivity-labels.md | f1.keywords: Previously updated : 01/14/2020 Last updated : 05/12/2023 audience: Admin First, create and configure the sensitivity labels that you want to make availab Then, create one or more label policies that contain the labels and policy settings that you configure. It's the label policy that publishes the labels and settings for your chosen users and locations. -> [!TIP] +> [!NOTE] > If you don't yet have any sensitivity labels, you might be eligible for the automatic creation of default labels and a default label policy. Even if you have some labels, you might find it useful to see the configuration of these default labels that we're creating for new customers. For example, you can make the same manual configurations to help accelerate your own label deployment. > > For more information, see [Default labels and policies for Microsoft Purview Information Protection](mip-easy-trials.md). The global admin for your organization has full permissions to create and manage > By default, tenants don't have any labels and you must create them. The labels in the example picture show default labels that were [migrated from Azure Information Protection](/azure/information-protection/configure-policy-migrate-labels). 3. On the **Define the scope for this label** page, the options selected determine the label's scope for the settings that you can configure and where they will be visible when they're published:--  -- - If **Items** is selected, you can configure settings that apply to apps that support sensitivity labels, such as Office Word and Outlook. Optionally, in preview, you can extend these labels to [include meetings](sensitivity-labels-meetings.md) from Teams and Outlook, and to protecting Teams meetings themselves by enforcing settings for Teams meetings and related chat. + + :::image type="content" source="../media/sensitivity-labels-scopes.png" alt-text="Scopes for sensitivity labels." + + - If **Items** is selected, you can configure settings that apply to apps that support sensitivity labels, such as Office Word and Outlook. Optionally, you can extend these labels to [include meetings](sensitivity-labels-meetings.md) from Teams and Outlook, and to protecting Teams meetings themselves by enforcing settings for Teams meetings and related chat. If the **Items** option isn't selected, you see the first page of these settings but you can't configure them and the labels won't be available for users to select in these apps. |
| compliance | Dlp Configure Endpoint Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-configure-endpoint-settings.md | f1.keywords: Previously updated : 09/09/2019 Last updated : 05/12/2023 audience: ITPro f1_keywords: DLP can copy items that match policies on devices to an [Azure storage account]( - For more information on this feature, see [Learn about collecting files that match data loss prevention policies from devices](dlp-copy-matched-items-learn.md) - For more information on how to configure this feature, see [Get started with collecting files that match data loss prevention policies from devices](dlp-copy-matched-items-get-started.md) -### Network share coverage and exclusions (preview) +### Network share coverage and exclusions > [!IMPORTANT]-> If you want to use Network share coverage and exclusions, you have to register your tenant at [Network share coverage](https://aka.ms/networkfileshares-edlp). +> To use **Network share coverage and exclusions** devices must have these updates applied: +> - Windows 10 - [March 21, 2023—KB5023773 (OS Builds 19042.2788, 19044.2788, and 19045.2788) Preview](https://support.microsoft.com/en-us/topic/march-21-2023-kb5023773-os-builds-19042-2788-19044-2788-and-19045-2788-preview-5850ac11-dd43-4550-89ec-9e63353fef23), [March 28, 2023—KB5023774 (OS Build 22000.1761) Preview](https://support.microsoft.com/en-us/topic/march-28-2023-kb5023774-os-build-22000-1761-preview-67b4cfda-120a-422f-98c0-35124ddba839)  +>- Windows 11 - [March 28, 2023—KB5023778 (OS Build 22621.1485) Preview](https://support.microsoft.com/en-us/topic/march-28-2023-kb5023778-os-build-22621-1485-preview-d490bb51-492e-410c-871f-50ad01b0f765) +> +> - Microsoft Defender [April-2023 (Platform: 4.18.2304.8 | Engine: 1.1.20300.3)](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates.md#april-2023-platform-41823048--engine-11203003) -**Network share coverage and exclusions (preview)** extends endpoint DLP policies and actions to new and edited files on network shares and mapped network drives. If [just in time protection (preview)](endpoint-dlp-learn-about.md#just-in-time-protection-preview) is also enabled, it will also be extended to cover network shares and mapped drives when you enable network share coverage and exclusions. If you want to exclude a specific network path for all monitored devices, add the path value in **Exclude these network share paths**. +**Network share coverage and exclusions** extends endpoint DLP policies and actions to new and edited files on network shares and mapped network drives. If [just in time protection (preview)](endpoint-dlp-learn-about.md#just-in-time-protection-preview) is also enabled, it will also be extended to cover network shares and mapped drives when you enable network share coverage and exclusions. If you want to exclude a specific network path for all monitored devices, add the path value in **Exclude these network share paths**. |Network share coverage and exclusions (preview) |Just in time protection (preview) |Resultant behavior | |||| DLP can copy items that match policies on devices to an [Azure storage account]( #### Restricted apps -**Restricted apps** (previously called **Unallowed apps**) is a list of applications that you create. You configure what actions DLP will take when a user uses an app on the list to ***access*** a DLP protected file on a device. It's available for Windows 10/11 and macOS devices. +**Restricted apps** (previously called **Unallowed apps**) is a list of applications that you create. You configure what actions DLP takes when a user uses an app on the list to ***access*** a DLP protected file on a device. It's available for Windows 10/11 and macOS devices. -When **Access by restricted apps** is selected in a policy and a user uses an app that is on the restricted apps list to access a protected file, the activity will be `audited`, `blocked`, or `blocked with override` depending on how you configured it. That is unless the same app is a member of a **Restricted app group**, then the actions configured for activities in the **Restricted app group** override the actions configured for the access activity for the **Restricted apps** list. All activity is audited and available to review in activity explorer. +When **Access by restricted apps** is selected in a policy and a user uses an app that is on the restricted apps list to access a protected file, the activity is `audited`, `blocked`, or `blocked with override` depending on how you configured it. That is unless the same app is a member of a **Restricted app group**, then the actions configured for activities in the **Restricted app group** override the actions configured for the access activity for the **Restricted apps** list. All activity is audited and available to review in activity explorer. > [!IMPORTANT] > Do not include the path to the executable, but only the executable name (such as browser.exe). Restrict sensitive files that match your policies from being shared with unrestr #### Unallowed browsers -For Windows devices, you add browsers, identified by their executable names, that will be blocked from accessing files that match the conditions of an enforced a DLP policy where the upload to cloud services restriction is set to block or block override. When these browsers are blocked from accessing a file, the end users will see a toast notification asking them to open the file through Microsoft Edge. +For Windows devices you add browsers, identified by their executable names, that will be blocked from accessing files that match the conditions of an enforced a DLP policy where the upload to cloud services restriction is set to block or block override. When these browsers are blocked from accessing a file, the end users see a toast notification asking them to open the file through Microsoft Edge. For macOS devices, you must add the full file path. To find the full path of Mac apps: You can add maximum 50 websites into one group and can create maximum 20 groups. ##### Supported syntax for designating websites in a website group -Do not add protocol, for example, https://, file:// into the URL. You can use a flexible syntax to include and exclude domains, subdomains, websites, and subsites in your website groups. +Don't add protocol, for example, https://, file:// into the URL. You can use a flexible syntax to include and exclude domains, subdomains, websites, and subsites in your website groups. - use `*` as a wildcard to specify all domains or all subdomains - use `/` as a terminator at the end of a URL to scope to that specific site only. You can create up to five customized options that appear when users interact wit ### Always audit file activity for devices -By default, when devices are onboarded, activity for Office, PDF, and CSV files is automatically audited and available for review in activity explorer. Turn this feature off if you want this activity to be audited only when onboarded devices are included in an active policy. +By default, when devices are onboarded, activity for Office, PDF, and CSV files is automatically audited and available for review in activity explorer. Turn off this feature if you want this activity to be audited only when onboarded devices are included in an active policy. File activity will always be audited for onboarded devices, regardless of whether they're included in an active policy. |
| compliance | Encryption Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/encryption-sensitivity-labels.md | f1.keywords: Previously updated : 03/06/2023 Last updated : 05/12/2023 audience: Admin Finally, as an admin, when you configure a sensitivity label to apply encryption The encryption settings are available when you [create a sensitivity label](create-sensitivity-labels.md) in the Microsoft Purview compliance portal. > [!NOTE]-> Now in preview, a sensitivity label in Outlook can apply S/MIME protection rather than encryption and permissions from the Azure Rights Management service. For more information, see [Configure a label to apply S/MIME protection in Outlook](sensitivity-labels-office-apps.md#configure-a-label-to-apply-smime-protection-in-outlook). +> A sensitivity label in Outlook can apply S/MIME protection rather than encryption and permissions from the Azure Rights Management service. For more information, see [Configure a label to apply S/MIME protection in Outlook](sensitivity-labels-office-apps.md#configure-a-label-to-apply-smime-protection-in-outlook). [!INCLUDE [purview-preview](../includes/purview-preview.md)] |
| compliance | Ome Version Comparison | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ome-version-comparison.md | To assess whether this deprecation impacts your organization, see [How to migrat |*Sending an encrypted mail* |Through Exchange mail flow rules|End-user initiated from Outlook desktop or Outlook on the Web; or through Exchange mail flow rules|End-user initiated from Outlook desktop, Outlook for Mac, or Outlook on the Web; through Exchange mail flow rules (also known as transport rules) and data loss prevention (DLP)| |*Rights management template* | N/A |Do Not Forward option and custom templates|Do Not Forward option, encrypt-only option, and custom templates| |*Recipient type* |Internal and external recipients|Internal recipients only |Internal and external recipients|-|*Experience for internal recipient*|Recipients receive an HTML message, which they download and open in a web browser or mobile app|Native inline experience in Outlook clients|Native inline experience for recipients in the same organization using Outlook clients. Recipients can read message from encrypted message portal using clients other than Outlook (no download or app required).| -|*Experience for external recipient*|Recipients receive an HTML message, which they download and open in a web browser or mobile app|N/A|Native inline experience for Microsoft 365 recipients. All other recipients can read message from OME portal (no download or app required).| +|*Experience for internal recipient*|Recipients receive an HTML message that they download and open in a web browser or mobile app|Native inline experience in Outlook clients|Native inline experience for recipients in the same organization using Outlook clients. Recipients can read message from encrypted message portal using clients other than Outlook (no download or app required).| +|*Experience for external recipient*|Recipients receive an HTML message that they download and open in a web browser or mobile app|N/A|Native inline experience for Microsoft 365 recipients. All other recipients can read message from OME portal (no download or app required).| |*Attachment permissions* |No restrictions on attachments|Attachments are protected|Attachments are protected for the Do Not Forward option and custom templates. Admins can choose whether attachments for the encrypt-only option are protected or not.| |*Bring your own key (BYOK) support*|None |None |BYOK supported | |
| compliance | Sensitive Information Type Entity Definitions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitive-information-type-entity-definitions.md | description: "There are many sensitive information types that are ready for you # Sensitive information type entity definitions -This article is a list of all sensitive information type (SIT) entity definitions. Each link takes you to the definition of that specific SIT and shows what a DLP policy looks for to detect each type. To learn more about sensitive information types, see [Sensitive information types](sensitive-information-type-learn-about.md) +This article is a list of all sensitive information type (SIT) entity definitions. Each link takes you to the definition of that specific SIT and shows what a DLP policy looks for to detect each type. To learn more about sensitive information types, see [Sensitive information types](sensitive-information-type-learn-about.md). > [!NOTE] > Mapping of confidence level (high/medium/low) with accuracy number (numeric value of 1 to 100) This article is a list of all sensitive information type (SIT) entity definition - [Luxemburg passport number](sit-defn-luxemburg-passport-number.md) - [Luxemburg physical addresses](sit-defn-luxemburg-physical-addresses.md) - [Malaysia identification card number](sit-defn-malaysia-identification-card-number.md)+- [Malaysia passport number](sit-defn-malaysia-passport-number.md) - [Malta driver's license number](sit-defn-malta-drivers-license-number.md) - [Malta identity card number](sit-defn-malta-identity-card-number.md) - [Malta passport number](sit-defn-malta-passport-number.md) This article is a list of all sensitive information type (SIT) entity definition - [Russia passport number domestic](sit-defn-russia-passport-number-domestic.md) - [Russia passport number international](sit-defn-russia-passport-number-international.md) - [Saudi Arabia National ID](sit-defn-saudi-arabia-national-id.md)+- [Singapore passport number](sit-defn-singapore-passport-number.md#singapore-passport-number) - [Singapore national registration identity card (NRIC) number](sit-defn-singapore-national-registration-identity-card-number.md) - [Slack access token](sit-defn-slack-access-token.md) - [Slovakia driver's license number](sit-defn-slovakia-drivers-license-number.md) This article is a list of all sensitive information type (SIT) entity definition - [Slovenia tax identification number](sit-defn-slovenia-tax-identification-number.md) - [Slovenia Unique Master Citizen Number](sit-defn-slovenia-unique-master-citizen-number.md) - [South Africa identification number](sit-defn-south-africa-identification-number.md)+- [South Korea driver's license number](sit-defn-south-korea-drivers-license-number.md) +- [South Korea passport number](sit-defn-south-korea-passport-number.md) - [South Korea resident registration number](sit-defn-south-korea-resident-registration-number.md) - [Spain DNI](sit-defn-spain-dni.md) - [Spain driver's license number](sit-defn-spain-drivers-license-number.md) This article is a list of all sensitive information type (SIT) entity definition - [Turkey national identification number](sit-defn-turkey-national-identification-number.md) - [Turkey physical addresses](sit-defn-turkey-physical-addresses.md) - [Types of medication](sit-defn-types-of-medication.md)+- [U.A.E. identity card number](sit-defn-uae-identity-card-number.md) +- [U.A.E. passport number](sit-defn-uae-passport-number.md) - [U.K. driver's license number](sit-defn-uk-drivers-license-number.md) - [U.K. electoral roll number](sit-defn-uk-electoral-roll-number.md) - [U.K. national health service number](sit-defn-uk-national-health-service-number.md) |
| compliance | Sensitivity Labels Meetings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-meetings.md | description: "Configure sensitivity labels to protect calendar items, and Teams >*[Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance).* > [!NOTE]-> For this scenario, Outlook calendar events are still rolling out in general availability for Windows. -> > You won't be able to configure all the options referenced on this page if a [Teams Premium license](/MicrosoftTeams/enhanced-teams-experience) isn't found for your tenant. For those settings, you'll see an information bar in the Microsoft Purview compliance portal that your organization doesn't have this license. In addition to using [sensitivity labels](sensitivity-labels.md) to protect documents and emails, you can extend sensitivity labels to protect meeting invites and responses that use Outlook and Teams, and to protect Teams meetings and chat: Example showing a Teams meeting invite that has the label **Highly confidential* To apply a sensitivity label to meeting invites and appointments using Outlook, users must use Outlook on the web from a desktop computer, or use built-in labeling from Microsoft 365 Apps for enterprise: -- **Outlook for Windows**: Rolling out to Current Channel, version 2302++- **Outlook for Windows**: Current Channel, version 2302+ - **Outlook for Mac**: Version 16.70+ The AIP add-in for Outlook doesn't support applying labels to meeting invites. To apply a sensitivity label to meeting invites using Teams, enforce meeting opt > [!IMPORTANT] > If meeting participants or organizers don't use a Teams client that meets these requirements, the configured label meeting options can't be enforced for these users. +Sensitivity labels that apply [S/MIME protection](sensitivity-labels-office-apps.md#configure-a-label-to-apply-smime-protection-in-outlook) can't be used to protect calendar items, Teams meetings, and chat. + ## Limitations - Preventing copying chat has some limitations that are listed in the [Prevent copying chat to the clipboard label setting](#prevent-copying-chat-to-the-clipboard-label-setting) section on this page. |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | f1.keywords: Previously updated : 05/01/2023 Last updated : 05/11/2023 audience: Admin Before you can scope a label to just files or emails, you must first remove it i > [!NOTE] > Identify the minimum versions of Outlook that support this feature by using the [capabilities table for Outlook](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-outlook) and the row **Apply S/MIME protection**. > -> If you configure a label to apply S/MIME protection but your version of Outlook for Windows doesn't yet support it, the label is still displayed and can be applied, but the S/MIME settings are ignored. You won't be able to select this label for Exchange auto-labeling policies. +> If you configure a label to apply S/MIME protection but your version of Outlook for Windows doesn't yet support it, the label is still displayed and can be applied, but the S/MIME settings are ignored. You won't be able to select this label for Exchange auto-labeling policies or configure it to [protect calendar items, Teams meetings, and chat](sensitivity-labels-meetings.md). This configuration is not available in the Microsoft Purview compliance portal. You must use PowerShell advanced settings with the [Set-Label](/powershell/module/exchange/set-label) or [New-Label](/powershell/module/exchange/new-label) cmd after you've [connected to Security & Compliance PowerShell](/powershell/exchange/office-365-scc/connect-to-scc-powershell/connect-to-scc-powershell). |
| compliance | Sensitivity Labels Sharepoint Onedrive Files | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files.md | Uploading a labeled document, and then extracting and displaying that sensitivit - Mid-session, the document changes from unencrypted to encrypted. - Mid-session, the document changes from encrypted and the Copy usage right is granted, to encrypted but the Copy usage right is not granted. -- By default, Office desktop apps and mobile apps don't support co-authoring for files that are labeled with encryption. These apps continue to open labeled and encrypted files in exclusive editing mode.-- > [!NOTE] - > Co-authoring is now supported for Windows and macOS, and in preview for iOS and Android. For more information, see [Enable co-authoring for files encrypted with sensitivity labels](sensitivity-labels-coauthoring.md). +- By default, Office desktop apps and mobile apps don't support co-authoring for files that are labeled with encryption. These apps continue to open labeled and encrypted files in exclusive editing mode. To change the default behavior, see [Enable co-authoring for files encrypted with sensitivity labels](sensitivity-labels-coauthoring.md). - If an admin changes settings for a published label that's already applied to files downloaded to users' sync client, users might be unable to save changes they make to the file in their OneDrive Sync folder. This scenario applies to files that are labeled with encryption, and also when the label change is from a label that didn't apply encryption to a label that does apply encryption. Users see a [red circle with a white cross icon error](https://support.office.com/article/what-do-the-onedrive-icons-mean-11143026-8000-44f8-aaa9-67c985aa49b3), and they are asked to save new changes as a separate copy. Instead, they can close and reopen the file, or use Office for the web. |
| compliance | Sensitivity Labels Teams Groups Sites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-teams-groups-sites.md | f1.keywords: Previously updated : 10/11/2019 Last updated : 05/23/2023 audience: Admin Not all apps support authentication contexts. If a user with an unsupported app - OneDrive sync app, minimum versions: - Windows: 21.002 - macOS: 21.002- - iOS: Rolling out in 12.30 + - iOS: 12.30 - Android: Not yet supported Known limitations: |
| compliance | Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels.md | f1.keywords: Previously updated : 04/11/2023 Last updated : 05/12/2023 audience: Admin Each item that supports sensitivity labels can have a single sensitivity label a ## What sensitivity labels can do -After a sensitivity label is applied to an email, meeting invite (in preview), or document, any configured protection settings for that label are enforced on the content. You can configure a sensitivity label to: +After a sensitivity label is applied to an email, meeting invite, or document, any configured protection settings for that label are enforced on the content. You can configure a sensitivity label to: - **Encrypt** emails, meeting invites, and documents to prevent unauthorized people from accessing this data. You can additionally choose which users or group have permissions to perform which actions and for how long. For example, you can choose to allow all users in your organization to modify a document while a specific group in another organization can only view it. Alternatively, instead of administrator-defined permissions, you can allow your users to assign permissions to the content when they apply the label. When you configure a label policy, you can: - **Specify a default label** for unlabeled documents, emails and meeting invites, new containers (when you've [enabled sensitivity labels for Microsoft Teams, Microsoft 365 groups, and SharePoint sites](sensitivity-labels-teams-groups-sites.md)), and also a default label for [Power BI content](/power-bi/admin/service-security-sensitivity-label-default-label-policy). You can specify the same label for all five types of items, or different labels. Users can change the applied default sensitivity label to better match the sensitivity of their content or container. > [!NOTE]- > Although applying a default label to new documents has been supported for built-in labeling for a while, support for existing documents is still rolling out across the Office deployment channels. To identify the supported versions, use the [capabilities table](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-word-excel-and-powerpoint) and the row **Apply a default label to existing documents**. + > Although applying a default label to new documents has been supported for built-in labeling for a while, support for existing documents is more recently supported. To identify the supported versions, use the [capabilities table](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-word-excel-and-powerpoint) and the row **Apply a default label to existing documents**. Consider using a default label to set a base level of protection settings that you want applied to all your content. However, without user training and other controls, this setting can also result in inaccurate labeling. It's usually not a good idea to select a label that applies encryption as a default label to documents. For example, many organizations need to send and share documents with external users who might not have apps that support the encryption or they might not use an account that can be authorized. For more information about this scenario, see [Sharing encrypted documents with external users](sensitivity-labels-office-apps.md#sharing-encrypted-documents-with-external-users). |
| compliance | Sit Defn Malaysia Passport Number | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sit-defn-malaysia-passport-number.md | + + Title: "Malaysia passport number entity definition" +f1.keywords: +- CSH +++ Last updated : 05/04/2023+audience: Admin +search.appverid: MET150 ++f1_keywords: +- 'ms.o365.cc.UnifiedDLPRuleContainsSensitiveInformation' ++ms.localizationpriority: medium ++- tier3 +- purview-compliance +hideEdit: true +feedback_system: None +recommendations: false +description: "Malaysia passport number sensitive information type entity definition." +++# Malaysia passport number +++## Format ++nine alphanumeric characters with only specific values for letters ++## Pattern ++- a letter (A/H/K/a/h/k) followed by +- eight digits ++## Checksum ++NA ++## Definition ++A DLP policy has high confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++- The regular expression `Regex_malaysia_passport_number` finds content that matches the pattern. +- A keyword from `Keyword_malaysia_passport_number` is found. ++ ++A DLP policy has low confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++- The regular expression `Regex_malaysia_passport_number` finds content that matches the pattern. ++```xml + <!-- Malaysia Passport Number --> + <Entity id="62ea2a27-798e-4de3-a31f-a54c5d02ff37" patternsProximity="300" recommendedConfidence="85" relaxProximity="true"> + <Pattern confidenceLevel="85"> + <IdMatch idRef="Regex_malaysia_passport_number" /> + <Match idRef="Keyword_malaysia_passport_number" /> + </Pattern> + <Pattern confidenceLevel="65"> + <IdMatch idRef="Regex_malaysia_passport_number" /> + </Pattern> + </Entity> +``` ++## Keywords ++**Keyword_malaysia_passport_number** ++- passport# +- passport # +- passportno +- passport no +- passportnumber +- passport number +- passportnumbers +- passport numbers +- pasport# +- pasport # +- pasportno +- pasport no +- pasportnumber +- pasport number +- pasportnumbers +- pasport numbers +- no. pasport +- nombor pasport +- nomborpasport |
| compliance | Sit Defn Singapore Drivers License Number | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sit-defn-singapore-drivers-license-number.md | + + Title: "Singapore driver's license number entity definition" +f1.keywords: +- CSH +++ Last updated : 05/04/2023+audience: Admin +search.appverid: MET150 ++f1_keywords: +- 'ms.o365.cc.UnifiedDLPRuleContainsSensitiveInformation' ++ms.localizationpriority: medium ++- tier3 +- purview-compliance +hideEdit: true +feedback_system: None +recommendations: false +description: "Singapore driver's license number sensitive information type entity definition." +++# Singapore driver's license number +++## Format ++Nine alphanumeric characters ++## Pattern ++- One letter followed by +- seven digits followed by +- One letter ++## Checksum ++NA ++## Definition ++A DLP policy has high confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++- The regular expression Regex_singapore_driving_license finds content that matches the pattern. +- A keyword from Keyword_singapore_driving_license or Keywords_eu_driver's_license_number_common is found. + ++A DLP policy has low confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++- The regular expression Regex_singapore_driving_license finds content that matches the pattern. ++```xml + <!-- Singapore Driving License Number --> + <Entity id="beaa54d7-ec6a-4160-a37b-f3916b68934b" patternsProximity="300" recommendedConfidence="85" relaxProximity="true"> + <Pattern confidenceLevel="85"> + <IdMatch idRef="Regex_singapore_driving_license" /> + <Any minMatches="1"> + <Match idRef="Keywords_eu_driver's_license_number_common" /> + <Match idRef="Keyword_singapore_driving_license" /> + </Any> + </Pattern> + <Pattern confidenceLevel="65"> + <IdMatch idRef="Regex_singapore_driving_license" /> + </Pattern> + </Entity> +``` ++## Keywords ++**Keyword_singapore_driving-license** ++- Licence number +- licence no +- licence# +- lesen memandu +- lesen pemandu +- nombor lesen +- 驾驶执照 +- 驾驶 执照 +- 驾驶执照号码 +- 驾驶 执照 号码 ++**Keywords_eu_driver's_license_number_common** ++- driverlic +- driverlics +- driverlicense +- driverlicenses +- driverlicence +- driverlicences +- driver lic +- driver lics +- driver license +- driver licenses +- driver licence +- driver licences +- driverslic +- driverslics +- driverslicence +- driverslicences +- driverslicense +- driverslicenses +- drivers lic +- drivers lics +- drivers license +- drivers licenses +- drivers licence +- drivers licences +- driver'lic +- driver'lics +- driver'license +- driver'licenses +- driver'licence +- driver'licences +- driver' lic +- driver' lics +- driver' license +- driver' licenses +- driver' licence +- driver' licences +- driver'slic +- driver'slics +- driver'slicense +- driver'slicenses +- driver'slicence +- driver'slicences +- driver's lic +- driver's lics +- driver's license +- driver's licenses +- driver's licence +- driver's licences +- dl# +- dls# +- driverlic# +- driverlics# +- driverlicense# +- driverlicenses# +- driverlicence# +- driverlicences# +- driver lic# +- driver lics# +- driver license# +- driver licenses# +- driver licences# +- driverslic# +- driverslics# +- driverslicense# +- driverslicenses# +- driverslicence# +- driverslicences# +- drivers lic# +- drivers lics# +- drivers license# +- drivers licenses# +- drivers licence# +- drivers licences# +- driver'lic# +- driver'lics# +- driver'license# +- driver'licenses# +- driver'licence# +- driver'licences# +- driver' lic# +- driver' lics# +- driver' license# +- driver' licenses# +- driver' licence# +- driver' licences# +- driver'slic# +- driver'slics# +- driver'slicense# +- driver'slicenses# +- driver'slicence# +- driver'slicences# +- driver's lic# +- driver's lics# +- driver's license# +- driver's licenses# +- driver's licence# +- driver's licences# +- driving licence +- driving license +- dlno# +- driv lic +- driv licen +- driv license +- driv licenses +- driv licence +- driv licences +- driver licen +- drivers licen +- driver's licen +- driving lic +- driving licen +- driving licenses +- driving licence +- driving licences +- driving permit +- dl no +- dlno +- dl number |
| compliance | Sit Defn Singapore Passport Number | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sit-defn-singapore-passport-number.md | + + Title: "Singapore passport number entity definition" +f1.keywords: +- CSH +++ Last updated : 05/04/2023+audience: Admin +search.appverid: MET150 ++f1_keywords: +- 'ms.o365.cc.UnifiedDLPRuleContainsSensitiveInformation' ++ms.localizationpriority: medium ++- tier3 +- purview-compliance +hideEdit: true +feedback_system: None +recommendations: false +description: "Singapore passport number sensitive information type entity definition." +++# Singapore passport number +++## Format ++nine alphanumeric characters with only specific values for letters ++## Pattern ++- a letter e/E followed by +- seven digits followed by +- a letter ++## Checksum ++NA ++## Definition ++A DLP policy has high confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++- The regular expression `Regex_singapore_passport_number` finds content that matches the pattern. +- A keyword from `Keyword_singapore_passport_number` is found. ++ +A DLP policy has low confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++- The regular expression Regex_singapore_passport_number finds content that matches the pattern. ++```xml + <!-- Singapore Passport Number --> + <Entity id="4081ae73-c4ec-405d-932c-8b36ae35b20c" patternsProximity="300" recommendedConfidence="85" relaxProximity="true"> + <Pattern confidenceLevel="85"> + <IdMatch idRef="Regex_singapore_passport_number" /> + <Match idRef="Keyword_singapore_passport_number" /> + </Pattern> + <Pattern confidenceLevel="65"> + <IdMatch idRef="Regex_singapore_passport_number" /> + </Pattern> + </Entity> +``` +++## Keywords ++**Keyword_singapore_passport_number** ++- passport# +- passport # +- passportno +- passport no +- passportnumber +- passport number +- passportnumbers +- passport numbers +- pasport# +- pasport # +- pasportno +- pasport no +- pasportnumber +- pasport number +- pasportnumbers +- pasport numbers +- no. pasport +- nombor pasport +- nomborpasport |
| compliance | Sit Defn South Korea Drivers License Number | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sit-defn-south-korea-drivers-license-number.md | + + Title: "South Korea driver's license number entity definition" +f1.keywords: +- CSH +++ Last updated : 05/04/2023+audience: Admin +search.appverid: MET150 ++f1_keywords: +- 'ms.o365.cc.UnifiedDLPRuleContainsSensitiveInformation' ++ms.localizationpriority: medium ++- tier3 +- purview-compliance +hideEdit: true +feedback_system: None +recommendations: false +description: "South Korea driver's license number sensitive information type entity definition." +++# South Korea driver's license number +++## Format ++10 or 12 digits with optional hyphens ++## Pattern ++Pattern 1: ++- two digits +- optional hyphen +- six digits +- optional hyphen +- two digits ++Pattern 2: ++- optional 2 digits (allowed digits are 11-26 and 28) +- optional hyphen +- two digits +- optional hyphen +- six digits +- optional hyphen +- two digits ++## Checksum ++NA ++## Definition ++A DLP policy has high confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++- The regular expression `Regex_south_korea_driver's_license_10digits` or `Regex_south_korea_driver's_license_12digits` finds content that matches the pattern. +- A keyword from `Keyword_south_korea_driver's_license` or `Keywords_eu_driver's_license_number_common` is found. ++ +A DLP policy has low confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++- The regular expression `Regex_south_korea_driver's_license_12digits` finds content that matches the pattern. ++```xml + <!-- South Korea Driver's License Number --> + <Entity id="3da0b024-4c08-406b-9f9e-de96accd0209" patternsProximity="300" recommendedConfidence="85"> + <Pattern confidenceLevel="85"> + <IdMatch idRef="Regex_south_korea_driver's_license_10digits" /> + <Any minMatches="1"> + <Match idRef="Keywords_eu_driver's_license_number_common" /> + <Match idRef="Keyword_south_korea_driver's_license" /> + </Any> + </Pattern> + <Pattern confidenceLevel="85"> + <IdMatch idRef="Regex_south_korea_driver's_license_12digits" /> + <Any minMatches="1"> + <Match idRef="Keywords_eu_driver's_license_number_common" /> + <Match idRef="Keyword_south_korea_driver's_license" /> + </Any> + </Pattern> + <Pattern confidenceLevel="65"> + <IdMatch idRef="Regex_south_korea_driver's_license_12digits" /> + </Pattern> + </Entity> +``` ++## Keywords ++**Keyword_south_korea_driver's_license** ++- 운전면허번호 +- 운전면허 번호 +- 운전 면허 번호 +- 운전면허증 번호 +- 운전면허증 ++**Keywords_eu_driver's_license_number_common** ++- driverlic +- driverlics +- driverlicense +- driverlicenses +- driverlicence +- driverlicences +- driver lic +- driver lics +- driver license +- driver licenses +- driver licence +- driver licences +- driverslic +- driverslics +- driverslicence +- driverslicences +- driverslicense +- driverslicenses +- drivers lic +- drivers lics +- drivers license +- drivers licenses +- drivers licence +- drivers licences +- driver'lic +- driver'lics +- driver'license +- driver'licenses +- driver'licence +- driver'licences +- driver' lic +- driver' lics +- driver' license +- driver' licenses +- driver' licence +- driver' licences +- driver'slic +- driver'slics +- driver'slicense +- driver'slicenses +- driver'slicence +- driver'slicences +- driver's lic +- driver's lics +- driver's license +- driver's licenses +- driver's licence +- driver's licences +- dl# +- dls# +- driverlic# +- driverlics# +- driverlicense# +- driverlicenses# +- driverlicence# +- driverlicences# +- driver lic# +- driver lics# +- driver license# +- driver licenses# +- driver licences# +- driverslic# +- driverslics# +- driverslicense# +- driverslicenses# +- driverslicence# +- driverslicences# +- drivers lic# +- drivers lics# +- drivers license# +- drivers licenses# +- drivers licence# +- drivers licences# +- driver'lic# +- driver'lics# +- driver'license# +- driver'licenses# +- driver'licence# +- driver'licences# +- driver' lic# +- driver' lics# +- driver' license# +- driver' licenses# +- driver' licence# +- driver' licences# +- driver'slic# +- driver'slics# +- driver'slicense# +- driver'slicenses# +- driver'slicence# +- driver'slicences# +- driver's lic# +- driver's lics# +- driver's license# +- driver's licenses# +- driver's licence# +- driver's licences# +- driving licence +- driving license +- dlno# +- driv lic +- driv licen +- driv license +- driv licenses +- driv licence +- driv licences +- driver licen +- drivers licen +- driver's licen +- driving lic +- driving licen +- driving licenses +- driving licence +- driving licences +- driving permit +- dl no +- dlno +- dl number |
| compliance | Sit Defn South Korea Passport Number | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sit-defn-south-korea-passport-number.md | + + Title: "South Korea passport number entity definition" +f1.keywords: +- CSH +++ Last updated : 05/04/2023+audience: Admin +search.appverid: MET150 ++f1_keywords: +- 'ms.o365.cc.UnifiedDLPRuleContainsSensitiveInformation' ++ms.localizationpriority: medium ++- tier3 +- purview-compliance +hideEdit: true +feedback_system: None +recommendations: false +description: "South Korea passport number sensitive information type entity definition." +++# South Korea passport number ++ [!INCLUDE [purview-preview](../includes/purview-preview.md)] ++## Format ++nine alphanumeric characters; only specific values are allowed ++## Pattern ++- a letter (M|S|R|O|D) followed by +- eight digits ++Or ++- a letter (M|S|R|O|D) followed by +- three digits followed by +- one letter followed by +- four digits ++## Checksum ++NA ++## Definition ++A DLP policy has high confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++- The regular expression `Regex_south_korea_passport_number` finds content that matches the pattern. +- A keyword from `Keyword_south_korea_passport_number` is found. ++ ++A DLP policy has low confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++- The regular expression Regex_south_korea_passport_number finds content that matches the pattern. ++```xml + <!-- South Korea Passport Number --> + <Entity id="cb725748-0f69-4282-8a03-e9b222a10a18" patternsProximity="300" recommendedConfidence="85"> + <Pattern confidenceLevel="85"> + <IdMatch idRef="Regex_south_korea_passport_number" /> + <Match idRef="Keyword_south_korea_passport_number" /> + </Pattern> + <Pattern confidenceLevel="65"> + <IdMatch idRef="Regex_south_korea_passport_number" /> + </Pattern> + </Entity> +``` ++## Keywords ++**Keyword_south_korea_passport_number** ++- passport# +- passport # +- passportno +- passport no +- passportnumber +- passport number +- passportnumbers +- passport numbers +- 여권 번호 +- 한국어 여권 +- 여권 번호 +- 여권번호 +- 한국 여권 +- 한국여권 +- 한국 여권 번호 |
| compliance | Sit Defn Uae Identity Card Number | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sit-defn-uae-identity-card-number.md | + + Title: "UAE identity card number entity definition" +f1.keywords: +- CSH +++ Last updated : 05/04/2023+audience: Admin +search.appverid: MET150 ++f1_keywords: +- 'ms.o365.cc.UnifiedDLPRuleContainsSensitiveInformation' ++ms.localizationpriority: medium ++- tier3 +- purview-compliance +hideEdit: true +feedback_system: None +recommendations: false +description: "U.A.E identity card number sensitive information type entity definition." +++# U.A.E. identity card number +++## Format ++15 digits with optional hyphens and must pass the Luhn check ++## Pattern ++15 digits pattern ++- three digits +- optional hyphen +- four digits +- optional hyphen +- seven digits +- optional hyphen +- one digit ++## Checksum ++Luhn check ++## Definition ++A DLP policy has high confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++- The regular expression `Regex_uae_id_card_number` finds content that matches the pattern. +- A keyword from Keyword_uae_id_card_number is found. ++A DLP policy has medium confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++- The regular expression `Regex_uae_id_card_number` finds content that matches the pattern. ++```xml + <!-- UAE Identity Card Number --> + <Entity id="853a8051-ad90-417c-9345-c73ac0adc1c3" patternsProximity="300" recommendedConfidence="85"> + <Pattern confidenceLevel="85"> + <IdMatch idRef="Regex_uae_id_card_number" /> + <Match idRef="Keyword_uae_id_card_number" /> + </Pattern> + <Pattern confidenceLevel="75"> + <IdMatch idRef="Regex_uae_id_card_number" /> + </Pattern> + </Entity> +``` ++## Keywords ++**Keyword_uae_id_card_number** ++- Emirates id +- ID number +- id no +- id # +- id# +- identification number +- identification no +- identification # +- identification# +- emirates identity card +- Insurance Number +- insurance no +- insurance# +- insurance # +- التأمين رقم +- التأمينرقم# +- رقم الهوية +- رقم الهوية# |
| compliance | Sit Defn Uae Passport Number | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sit-defn-uae-passport-number.md | + + Title: "UAE passport number entity definition" +f1.keywords: +- CSH +++ Last updated : 05/04/2023+audience: Admin +search.appverid: MET150 ++f1_keywords: +- 'ms.o365.cc.UnifiedDLPRuleContainsSensitiveInformation' ++ms.localizationpriority: medium ++- tier3 +- purview-compliance +hideEdit: true +feedback_system: None +recommendations: false +description: "U.A.E passport number sensitive information type entity definition." +++# U.A.E. passport number +++## Format ++nine alphanumeric characters that must include letters of specific values ++## Pattern ++nine alphanumeric characters from numerals 0–9 and letters C, F, G, H, J, K, L, M, N, P, R, T, V, W, X, Y, Z ++## Checksum ++All nine characters should not be digits. ++## Definition ++A DLP policy has high confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++- The regular expression `Regex_uae_passport_number` finds content that matches the pattern. +- A keyword from `Keyword_uae_passport_number` is found. ++A DLP policy has low confidence that it's detected this type of sensitive information if, within a proximity of 300 characters: ++The regular expression `Regex_uae_passport_number` finds content that matches the pattern. ++```xml + <!-- UAE Passport Number --> + <Entity id="111b5e63-6f4e-47c6-99bc-dd95625a5acf" patternsProximity="300" recommendedConfidence="85"> + <Pattern confidenceLevel="85"> + <IdMatch idRef="Regex_uae_passport_number" /> + <Match idRef="Keyword_uae_passport_number" /> + </Pattern> + <Pattern confidenceLevel="65"> + <IdMatch idRef="Regex_uae_passport_number" /> + </Pattern> + </Entity> +``` ++## Keywords ++**Keyword_uae_passport_number** ++- جواز سفر +- جواز سفر# +- passport# +- passport # +- passportno +- passport no +- passportnumber +- passport number +- passportnumbers +- passport numbers |
| compliance | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md | f1.keywords: Previously updated : 05/03/2023 Last updated : 05/12/2023 audience: Admin Whether it be adding new solutions to the [Microsoft Purview compliance portal]( ### Data lifecycle management and records management - **General availability (GA)**: [Simulation mode](apply-retention-labels-automatically.md#learn-about-simulation-mode) for auto-apply retention label policies is now generally available.+- **General availability (GA)**: Auto-labeling retention policies for [cloud attachments](apply-retention-labels-automatically.md#auto-apply-labels-to-cloud-attachments) that are shared via Exchange or Teams are now generally available. Cloud attachments shared via Yammer remain in preview. ### Insider risk management +- **In preview**: [Fine-tune policy indicator thresholds with real-time analytics](insider-risk-management-settings.md#indicator-level-settings) to reduce alert noise. +- **In preview**: New [Ignore email signature attachments setting](insider-risk-management-settings.md#intelligent-detections) reduces alert noise. +- Updates for [forensic evidence billing](insider-risk-management-forensic-evidence-manage.md#capacity-and-billing). - Updates for forensic evidence policy enforcement SLA: [Get started with insider risk management forensic evidence](insider-risk-management-forensic-evidence-configure.md#next-steps). ## April 2023 Whether it be adding new solutions to the [Microsoft Purview compliance portal]( - [Endpoint DLP Aggregated most restrictive actions applied to endpoints](dlp-policy-reference.md#for-endpoints) - [Just in time protection for endpoints and network shares](endpoint-dlp-learn-about.md#just-in-time-protection-preview) - [Display of conditions matched when an item matches a policy](dlp-configure-view-alerts-policies.md#other-matched-conditions)- - [Endpoint DLP policies can be applied to network shares](dlp-configure-endpoint-settings.md#network-share-coverage-and-exclusions-preview) + - [Endpoint DLP policies can be applied to network shares](dlp-configure-endpoint-settings.md#network-share-coverage-and-exclusions) - Support for [endpoint DLP policies in Azure virtual desktop, Citrix Virtual Apps and Desktops 7, Amazon virtual workspaces and Hyper-v environments](endpoint-dlp-getting-started.md#endpoint-dlp-support-for-virtualized-environments-preview) - [Show policy tips as an oversharing popup](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup-preview) |
| enterprise | M365 Dr Legacy Move Program | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/m365-dr-legacy-move-program.md | -## How to Request your Data Move - FINAL OPPORTUNITY -With the launch of the Microsoft 365 Advanced Data Residency add-on and associated changes to the Move Program, we are providing a final opportunity for eligible commercial and public sector customers to receive a complimentary _Tenant_ migration into their local datacenter region. For a limited time, customers may only opt-in for complimentary migration from macro region into a local datacenter region that matches initial signup country. _Tenant_ migrations may take up to 24 months to complete, commencing at request deadline date. See table below for a list of eligible countries and associated dates. --Eligible customers will see a page in the Microsoft 365 admin center which will allow them to request to have their applicable customer data moved to their new datacenter region. --To access the page in the Microsoft 365 admin center, in the navigation pane on the left, expand **Settings**, and then click **Org Settings**. Select the tab **Organization profile**, then select the option **Data residency**. --You will not see this section if your _Tenant_ is not eligible for the Microsoft 365 Move Program. If your organization has data residency requirements and you need to request migration, mark the checkbox and then Save. ## When Can I Request a Move (final opt-in opportunity) -|**Customers with signup country in**|**Request period begins**|**Request deadline**| -|:--|:--|:--| -| Japan <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | -| Australia, New Zealand, Fiji <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | -| India <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | -| Canada <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | -| United Kingdom <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | -| South Korea <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | -| France <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | -| United Arab Emirates <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | -| South Africa <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | -| Switzerland, Liechtenstein <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | -| Norway <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | -| Germany <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | -| Brazil <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | -| Sweden <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | +|**Customers with signup country in**|**Request period begins**|**Request deadline**|**Migration Commitment**| +|:--|:--|:--|:--| +| Japan <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | +| Australia, New Zealand, Fiji <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | +| India <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | +| Canada <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | +| United Kingdom <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | +| South Korea <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | +| France <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | +| United Arab Emirates <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | +| South Africa <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | +| Switzerland, Liechtenstein <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | +| Norway <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | +| Germany <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | +| Brazil <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | +| Sweden <br/> | Nov. 1, 2022 <br/> | Apr. 30, 2023 <br/> | May 1, 2025 <br/> | ## Remaining Countries in the Move Program You will not see this section if your _Tenant_ is not eligible for the Microsoft | Sweden <br/> | June 1, 2024 <br/> | May 1, 2025 <br/> | | Qatar <br/> | March 1, 2025 <br/> | Not Applicable <br/> | ++ ### Data Residency Option Moving Forward With the release of Advanced Data Residency, we are only providing a data residency option to eligible Microsoft 365 customers who are covered by the data centers listed in the _Local Region Geography_ on the [Overview and Definitions page](m365-dr-overview.md). Microsoft will use reasonable efforts to try to complete a legacy Move Program m Data moves are a back-end service operation with minimal impact to end-users. We adhere to the [Microsoft Online Services Service Level Agreement (SLA)](https://go.microsoft.com/fwlink/p/?LinkId=523897) for availability so there is nothing that customers need to prepare for or to monitor during the move. Notification of any service maintenance is done if needed. -During the migration process, Microsoft temporarily copies your address book data into Microsoft global resources where it is encrypted and only used to support business continuity and disaster recovery operations (BCDR). After Microsoft has completed the mailbox data moves, Microsoft deletes that temporary data from the global resources. Microsoft continues to invest in global and regional resources on a regular basis. In calendar year 2023, Microsoft plans to utilize regional resources for BCDR purposes during the migration process. - ## Data move general FAQ >[!NOTE] During the migration process, Microsoft temporarily copies your address book dat Here are answers to general questions about moving applicable customer data at rest to a new datacenter geo. -### What customers are eligible to request a move? -<details><summary>Click to expand</summary> --Existing Microsoft 365 commercial customers who selected a country eligible for the new datacenter geo will be able to request a move. The program exists only for _Tenants_ with an eligible country code assigned to the Microsoft 365 _Tenant_ to migrate applicable customer data at rest for eligible workloads to the corresponding Microsoft 365 datacenter geo. For more information, see [Microsoft 365 Multi-Geo availability](microsoft-365-multi-geo.md#microsoft-365-multi-geo-availability) to confirm country eligibility. --</details> - ### How do we define Applicable Customer Data? <details><summary>Click to expand</summary> Customer _Tenant_ admins can view the data location card in the Admin Center at </details> -### When will I be able to request a move? -<details><summary>Click to expand</summary> --Please refer to the [Data Residency Legacy Move Program](m365-dr-legacy-move-program.md) page for supported timeframes for your datacenter geo. --</details> --### How can I request to be moved? -<details><summary>Click to expand</summary> --Eligible customers will see a page in their [Microsoft 365 admin center](https://admin.microsoft.com/). Please see [Data Residency Legacy Move Program](m365-dr-legacy-move-program.md) for instructions on how to request a move. --</details> --### Can I change my selection after requesting a move? -<details><summary>Click to expand</summary> --It is not possible for us to remove you from the process after you submit your request. --</details> --### What happens if I do not request a move before the deadline? -<details><summary>Click to expand</summary> --We cannot accept requests for migration after the open enrollment period. --</details> --### What if I want to move my data in order to get better network performance? -<details><summary>Click to expand</summary> --Physical proximity to a Microsoft 365 datacenter is not a guarantee for a better networking performance. There are many factors and components that affect the network performance between the end user and the Microsoft 365 service. For more information about this and performance tuning, see [Network planning and performance tuning for Microsoft 365](network-planning-and-performance.md). --</details> - ### Do all the services move their data on the same day? <details><summary>Click to expand</summary> Watch the Microsoft 365 Message Center for confirmation that the move of each se </details> -### I am a Microsoft 365 customer in one of the new datacenter geos, but when I signed up, I selected a different country. How can I be moved to the new datacenter geo? -<details><summary>Click to expand</summary> --It is not possible to change the signup country associated with your _Tenant_. Instead, you need to create a new Microsoft 365 _Tenant_ with a new subscription and manually move your users and data to the new _Tenant_. --</details> ### What happens if we are in process of email data migration to Microsoft 365 during the Exchange Online move? <details><summary>Click to expand</summary> This is a very common scenario and is fully supported. Cloud migration between d </details> -### Can I pilot some users? -<details><summary>Click to expand</summary> --You can create a separate trial _Tenant_ to test connectivity, but the trial _Tenant_ can't be combined in any way with your existing _Tenant_. --</details> - ### I don't want to wait for Microsoft to move my data. Can I just create a new _Tenant_ and move myself? <details><summary>Click to expand</summary> Yes. Microsoft maintains a large global network with public Internet connections </details> -### My _Tenant_ has configured the Multi Geo add-on. Can I still enroll in my _Tenant_ in the Microsoft 365 Move Program? to change my default geo and move any user not in a satellite region to the new default geo? -<details><summary>Click to expand</summary> --Yes, your _Tenant_ is eligible to enroll but there are significant considerations as tenant-level move is not fully supported for customers that have configured [Multi-Geo](https://aka.ms/multi-geo). --SharePoint Online and OneDrive for Business cannot migrate to the new datacenter geo at the _Tenant_ level through this program. The customer administrator can configure OneDrive for Business shares to move to any available region using Multi-Geo, but the default location for the _Tenant_ cannot be changed once Multi-Geo has been configured for a _Tenant_. --For customers that opt-in for migration - we will move all Exchange Online mailboxes from your current default geo to your new local datacenter geo and update the default Exchange Online region. We will not move any EXO mailboxes configured in Multi Geo satellite regions to continue to respect satellite region data residency as you"ve intended. Teams chat service _Tenant_ migrations for customers with a Multi Geo configuration behave similarly to Exchange Online. --</details> ### I have public folders deployed in my _Tenant_. What will be the impact on public folder access during or after the move? <details><summary>Click to expand</summary> |
| enterprise | M365 Dr Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/m365-dr-overview.md | -To provide clarity to the descriptions below on data residency functionality and behavior, it's necessary to have clear terms and definitions in order to better understand the capabilities that Microsoft provides in this area. +In order to promote clarity in the capability descriptions on data residency functionality in this document, refer to these terms. **Table 1: Definitions and Terms** To provide clarity to the descriptions below on data residency functionality and |Satellite Geography <br/> |If a customer subscribes to the Multi Geo service, then they can cause defined user customer data to be stored in other Geographies outside of the _Tenant_ _Primary Provisioned Geography_ <br/> | |AAD <br/> |Azure Active Directory <br/> | |Tenant <br/> |A _Tenant_ represents an organization in Azure Active Directory. It's a reserved Azure AD service instance that an organization receives and owns when it signs up for a Microsoft cloud service such as Azure or Microsoft 365. Each Azure AD _Tenant_ is distinct and separate from other Azure AD _Tenant's_ <br/> |-|Default Geography <br/> |When an _AAD Tenant_ is created, a country is provided by the customer during the sign-up process. This country will determine the default Geography for all Microsoft 365 services. In some cases, not all services are able to provision in this single _Default Geography_. See _Microsoft 365 Service provisioning mapping_ below for a description. <br/> | -|Microsoft 365 Service provisioning mapping <br/> |All Microsoft 365 Services will use the _Default Geography_ to determine where a given _Tenant's_ specified data will be provisioned and stored. <br/> | -|Microsoft 365 Service provisioning country mapping <br/> |Please refer to [data maps](https://aka.ms/datamaps) to learn where a given service will provision specified customer data, based on the _Tenant Default Geography._ <br/> | -|Primary Provisioned Geography <br/> |A given Microsoft 365 service will use the _Tenant Default Geography_ combined with the _Microsoft 365 Service provisioning country mapping_ to determine which _Geography_ to provision customer data into. <br/> | +|Default Geography <br/> |When an _AAD Tenant_ is created, a country is provided by the customer during the sign-up process. This country determines the default Geography for all Microsoft 365 services. In some cases, not all services are able to provision in this single _Default Geography_. See _Microsoft 365 Service provisioning mapping_ below for a description. <br/> | +|Microsoft 365 Service provisioning mapping <br/> |All Microsoft 365 Services use the _Default Geography_ to determine where a given _Tenant's_ specified data will be provisioned and stored. <br/> | +|Microsoft 365 Service provisioning country mapping <br/> |Refer to [data maps](https://aka.ms/datamaps) to learn where a given service provisions specified customer data, based on the _Tenant Default Geography._ <br/> | +|Primary Provisioned Geography <br/> |A given Microsoft 365 service use the _Tenant Default Geography_ combined with the _Microsoft 365 Service provisioning country mapping_ to determine which _Geography_ to provision customer data into. <br/> | |Microsoft 365 Admin Center Data Location <br/> |To see the _Primary Provisioned Geography_ for Exchange Online, SharePoint Online and Microsoft Teams refer to Office 365 Admin Center in Settings; Org settings; Organization profile; Data location card. <br/> |-|Microsoft 365 Multi-Geo Capabilities <br/> |Microsoft 365 Multi-Geo Capabilities allows a single _Tenant_ to store customer data-at-rest across multiple geographies rather than be limited to the single _Primary Provisioned Geography_. Please see the Multi-Geo description for more detail. <br/> | -|Preferred Data Location (PDL) <br/> |Used for _Tenants_ with a Multi-Geo subscription. A property set by the administrator that indicates where the user or shared resource's s data should be stored at-rest. Please see the Multi-Geo description for more detail. <br/> | +|Microsoft 365 Multi-Geo Capabilities <br/> |Microsoft 365 Multi-Geo Capabilities allows a single _Tenant_ to store customer data-at-rest across multiple geographies rather than be limited to the single _Primary Provisioned Geography_. See the Multi-Geo description for more detail. <br/> | +|Preferred Data Location (PDL) <br/> |Used for _Tenants_ with a Multi-Geo subscription. A property set by the administrator that indicates where the user or shared resource's s data should be stored at-rest. See the Multi-Geo description for more detail. <br/> | |Advanced Data Residency (ADR) <br/> |A new Microsoft 365 add-on service that guarantees customer data residency for a defined set of services. See section 3 <br/> |-|Privacy and Security Product Terms <br/> |Privacy and Security Terms for Microsoft 365 services provides some customer data location related commitments. The document can be found <a href="https://www.microsoft.com/licensing/terms/en-US/product/PrivacyandSecurityTerms/EAEAS" target="_blank">here</a>. The extract of the relevant section (on November 1, 2022) is:<br>**Office 365 Services.** If Customer provisions its _Tenant_ in Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, or the United States, Microsoft will store the following Customer Data at rest only within that Geo: (1) Exchange Online mailbox content (e-mail body, calendar entries, and the content of e-mail attachments), (2) SharePoint Online site content and the files stored within that site, (3) files uploaded to OneDrive for Business, and (4) Microsoft Teams chat messages (including private messages, channel messages, meeting messages and images used in chats), and for customers using Microsoft Stream (on SharePoint), meeting recordings. +|Privacy and Security Product Terms <br/> |Privacy and Security Terms for Microsoft 365 services provides some customer data location related commitments. The document can be found <a href="https://www.microsoft.com/licensing/terms/en-US/product/PrivacyandSecurityTerms/EAEAS" target="_blank">here</a>. The extract of the relevant section (on November 1, 2022) is:<br>**Office 365 Services.** If Customer provisions its _Tenant_ in Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, or the United States, Microsoft stores the following Customer Data at rest only within that Geo: (1) Exchange Online mailbox content (e-mail body, calendar entries, and the content of e-mail attachments), (2) SharePoint Online site content and the files stored within that site, (3) files uploaded to OneDrive for Business, and (4) Microsoft Teams chat messages (including private messages, channel messages, meeting messages and images used in chats), and for customers using Microsoft Stream (on SharePoint), meeting recordings. |Workloads <br/> |Often used to refer to a Microsoft 365 service such as but not limited to Exchange Online, SharePoint Online, Microsoft Teams, etc.| ## Overview of Data Residency Microsoft makes decisions on where to persistently store customer data based on ### _Default Geography_ of the AAD _Tenant_ -When a customer creates a new AAD _Tenant_, the customer will enter a country during the creation process. This country is what defines the _Default Geography_ for the _Tenant_. There are multiple paths to creating _Tenants_. They can be created through AAD forms, they can be created when trying out new Microsoft 365 services (trials), etc. Once a _Tenant_ is created, the _Default Geography_ cannot be changed. +When a customer creates a new AAD _Tenant_, the customer enters a country during the creation process. This country is what defines the _Default Geography_ for the _Tenant_. There are multiple paths to creating _Tenants_. They can be created through AAD forms, they can be created when trying out new Microsoft 365 services (trials), etc. Once a _Tenant_ is created, the _Default Geography_ cannot be changed. ### Available Geographies for a given service -Microsoft 365 services are not deployed to all Microsoft data centers globally. The larger services, like Exchange Online, SharePoint Online and Microsoft Teams are universally deployed to all _Geographies_. Other services make decisions on where to deploy their services based on the number of customers, regional affiliations, and software architectures. When a customer first uses a service in this category, the provisioning logic will use the _Default Geography_ and the supported _Geographies_ to determine where to provision a given customer. +Microsoft 365 services are not deployed to all Microsoft data centers globally. The larger services, like Exchange Online, SharePoint Online and Microsoft Teams are universally deployed to all _Geographies_. Other services make decisions on where to deploy their services based on the number of customers, regional affiliations, and software architectures. When a customer first uses a service in this category, the provisioning logic use the _Default Geography_ and the supported _Geographies_ to determine where to provision a given customer. -Over time, a particular service may deploy their software to additional _Geographies_, so the provisioning locations for new customers can change over time, and this does not necessarily cause customer data to be moved to a new _Geography_. +Over time, a particular service may deploy their software to additional _Geographies_, so the provisioning locations for new customers can change over time. This does not necessarily cause customer data to move to a new _Geography_. -In order to understand where your data, for a given service is stored, your primary tool for understanding this is in the _Tenant_ Admin Center. As a _Tenant_ administrator you can find the actual data location by navigating to Admin->Settings->Org Settings->Organization Profile->Data Location. Currently the data location is available for Exchange Online, SharePoint Online and Microsoft Teams. In addition to this resource, please see the [Data Maps page](o365-data-locations.md). +In order to understand where your data, for a given service is stored, your primary tool for understanding this is in the _Tenant_ Admin Center. As a _Tenant_ administrator you can find the actual data location by navigating to Admin->Settings->Org Settings->Organization Profile->Data Location. Currently the data location is available for Exchange Online, SharePoint Online and Microsoft Teams. In addition to this resource, see the [Data Maps page](o365-data-locations.md). Some examples: Some examples: ### Migrations/Moves -Once a Microsoft 365 service provisions a _Tenant_ into a particular _Geography_, there are five ways that this data could be moved to another _Geography_: +Once a Microsoft 365 service provisions a _Tenant_ into a particular _Geography_, there are five ways that this data could move to another _Geography_: 1. The Microsoft 365 service decides to move the data to a new _Geography_ for service operations reasons, if there are no other policies in place to prevent the move.-1. For _Local Geographies_ that have Microsoft data centers, and for _Tenants_ that have the same country, there are options to migrate data from the _Regional Geographies_ into the _Local Geographies_. This option is typically only available for 6 months after a _Local Region Geography_ has been established. 1. If a _Tenant_ subscribes to the _Multi-Geo_ service, then _Tenants_ user's data for Exchange Online, SharePoint Online and Microsoft Teams can be assigned to _Satellite Geographies_.-1. If a _Tenant_ has sign up country as a _Local Region Geography_ or _Expanded Local Region Geography_ and has a subscription to the _Advanced Data Residency_ service add-on, then the _Tenant_ data for the included services will be migrated from the _Regional Geography_ to the relevant _Local Region Geography_. -1. At times Microsoft reopens Migration opt in from _Regional Geography_ to the relevant _Local Geographies_ or _Expanded Local Geographies_. +1. If a _Tenant_ has sign up country as a _Local Region Geography_ and has a subscription to the _Advanced Data Residency_ service add-on, then the _Tenant_ data for the included services will be migrated from the _Regional Geography_ to the relevant _Local Region Geography_. ### Durable commitments on data location Review our [definitions for different types of customer data](https://go.microso <details><summary>Click to expand</summary> -Microsoft does not disclose the exact addresses of its data centers. We established this policy to help secure our data center facilities. However, we do list city locations. Please see Table 5 in the [Country/Region-specific Data Center City Locations](m365-dr-overview.md#countryregion-specific-data-center-city-locations) on the Overview and Definitions page to learn more. +Microsoft does not disclose the exact addresses of its data centers. We established this policy to help secure our data center facilities. However, we do list city locations. See Table 5 in the [Country/Region-specific Data Center City Locations](m365-dr-overview.md#countryregion-specific-data-center-city-locations) on the Overview and Definitions page to learn more. </details> The performance of Microsoft 365 is not simply proportional to a _Tenant_ user's #### How does Microsoft help me comply with my national, regional, and industry-specific regulations? <details><summary>Click to expand</summary> -To help a _Tenant_ comply with national, regional, and industry-specific requirements governing the collection and use of individuals' data, Microsoft 365 offers the most comprehensive set of compliance offerings of any global cloud productivity provider. Please review [our compliance offerings](/compliance/regulatory/offering-home) and more details in the [Microsoft Purview](https://go.microsoft.com/fwlink/p/?linkid=862317) section on the Microsoft Trust Center. Also, certain Microsoft 365 plans offer further compliance solutions to help a _Tenant_ manage their data, comply with legal and regulatory requirements, and monitor actions taken on their data. +To help a _Tenant_ comply with national, regional, and industry-specific requirements governing the collection and use of individuals' data, Microsoft 365 offers the most comprehensive set of compliance offerings of any global cloud productivity provider. Review [our compliance offerings](/compliance/regulatory/offering-home) and more details in the [Microsoft Purview](https://go.microsoft.com/fwlink/p/?linkid=862317) section on the Microsoft Trust Center. Also, certain Microsoft 365 plans offer further compliance solutions to help a _Tenant_ manage their data, comply with legal and regulatory requirements, and monitor actions taken on their data. </details> Microsoft 365 uses service-side technologies that encrypt customer data at rest #### Where can I find data residency information for Microsoft Azure? <details><summary>Click to expand</summary> -Please review the [Products available by region](https://go.microsoft.com/fwlink/p/?linkid=2093451) page to find data residency information for Microsoft Azure. +Review the [Products available by region](https://go.microsoft.com/fwlink/p/?linkid=2093451) page to find data residency information for Microsoft Azure. </details> |
| enterprise | M365 Dr Product Terms Dr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/m365-dr-product-terms-dr.md | For additional data residency capabilities, refer to the [_Multi-Geo_ service](m When Microsoft's data centers were launched in _Local Region Geographies_, it was possible for any _Tenant_ with the appropriate _Default Geography_ to opt in to move their data into the _Local Region Geographies_. This opt in period was open for six months after the Data Center was operational. -Practically, this means that there are a number of tenants that didn't opt in to move and remain in the _Macro Region Geography_ data centers. On or about November 1, 2022 with the introduction of the Advanced Data Residency add-on, all tenants that remain in the _Macro Region Geography_ data centers will have another six month period to opt in for data migration to their _Local Region Geography_. See the [Legacy Move Program page](m365-dr-legacy-move-program.md#how-to-request-your-data-movefinal-opportunity) for more details. |
| security | Mdb Setup Configuration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-setup-configuration.md | When you're ready to set up and configure Defender for Business, you can choose > > Defender for Business also offers automatic onboarding for Windows devices enrolled in Intune. Automatic onboarding is a simplified way to onboard Windows devices to Defender for Business. We recommend selecting the "all devices enrolled" option so that as Windows devices are enrolled in Intune, they're onboarded to Defender for Business automatically. -7. **Configure your security policies**. Defender for Business includes default security policies for next-generation protection and firewall protection that can be applied to your company's devices. These default policies use recommended settings and are designed to provide strong protection for your devices. You can start with your default policies, and add more later. See [Set up, review, and edit your security policies and settings](mdb-configure-security-settings.md). +7. **Configure your security policies**. Defender for Business includes default security policies for next-generation protection and firewall protection that can be applied to your company's devices. These default policies use recommended settings and are designed to provide strong protection for your devices. You can start with your default policies and add more later. See [Set up, review, and edit your security policies and settings](mdb-configure-security-settings.md). 8. **Select your next step**. After the setup wizard has completed, you're prompted to choose a next step. For example, you can onboard devices, view your security dashboard, or view your security policies. When you're ready to set up and configure Defender for Business, you can choose 2. **Add users and assign licenses**. Assign a license for Defender for Business (or Microsoft 365 Business Premium, if that's your subscription) to each member of your organization to protect their devices. You'll also want to make sure multifactor authentication is enabled for all users. See [Add users and assign licenses in Microsoft Defender for Business](mdb-add-users.md). -3. **Assign roles and permissions to your security team**. People on your security team need certain permissions to perform tasks, such as reviewing detected threats & remediation actions, viewing & editing policies, onboarding devices, and using reports. You can grant these permissions through roles. See [Assign roles and permissions](mdb-roles-permissions.md). +3. **Assign roles and permissions to your security team**. People on your security team need certain permissions to perform tasks such as reviewing detected threats & remediation actions, viewing & editing policies, onboarding devices, and using reports. You can grant these permissions through roles. See [Assign roles and permissions](mdb-roles-permissions.md). 4. **Set up email notifications for your security team**. As alerts are generated, or new vulnerabilities are discovered, people on your security team can be notified automatically, via email messages. See [Set up email notifications](mdb-email-notifications.md). |
| security | Device Discovery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-discovery.md | For more information, see [Device inventory](machines-view-overview.md). The large number of unmanaged network devices deployed in an organization creates a large surface area of attack, and represents a significant risk to the entire enterprise. Microsoft Defender for Endpoint network discovery capabilities helps you ensure network devices are discovered, accurately classified, and added to the asset inventory. -Network devices aren't managed as standard endpoints, as Defender for Endpoint doesn't have a sensor built into the network devices themselves. These types of devices require an agentless approach where a remote scan obtains the necessary information from the devices. To do this, a designated Microsoft Defender for Endpoint device is used on each network segment to perform periodic authenticated scans of preconfigured network devices. Once discovered, Defender for Endpoint's vulnerability management capabilities provide integrated workflows to secure discovered switches, routers, WLAN controllers, firewalls, and VPN gateways. +Network devices aren't managed as standard endpoints, as Defender for Endpoint doesn't have a sensor built into the network devices themselves. These types of devices require an agentless approach where a remote scan obtains the necessary information from the devices. To do this, a designated Microsoft Defender for Endpoint device is used on each network segment to perform periodic authenticated scans of preconfigured network devices. Defender for Endpoint's vulnerability management capabilities provide integrated workflows to secure discovered switches, routers, WLAN controllers, firewalls, and VPN gateways. For more information, see [Network devices](network-devices.md). |
| security | Anti Malware Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-malware-policies-configure.md | On the **Anti-malware** page, the following properties are displayed in the list - **On** or **Off** for other anti-malware policies. - **Priority**: For more information, see the [Set the priority of custom anti-malware policies](#use-the-microsoft-365-defender-portal-to-set-the-priority-of-custom-anti-malware-policies) section. -To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. +To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use the :::image type="icon" source="../../media/m365-cc-sc-search-icon.png" border="false"::: **Search** box and a corresponding value to find specific anti-malware policies. Use :::image type="icon" source="../../media/m365-cc-sc-download-icon.png" borde Select a policy by clicking anywhere in the row other than the check box next to the name to open the details flyout for the policy. > [!TIP]-> To see details about other anti-malware policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** buttons at the top of the policy details flyout. +> To see details about other anti-malware policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ## Use the Microsoft 365 Defender portal to take action on anti-malware policies |
| security | Anti Phishing Mdo Impersonation Insight | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-mdo-impersonation-insight.md | ms.assetid: - m365-security - tier2-description: Admins can learn how the impersonation insight works. They can quickly determine which senders are legitimately sending email into their organizations from domains that don't pass email authentication checks (SPF, DKIM, or DMARC). +description: Admins use the impersonation insight in Microsoft Defender for Office 365 to view information about the senders and sender domains that are detected as impersonation attempts over the last week by anti-phishing policies. - seo-marvel-apr2020 Previously updated : 11/30/2022 Last updated : 5/12/2023 # Impersonation insight in Defender for Office 365 Last updated 11/30/2022 - [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) - [Microsoft 365 Defender](../defender/microsoft-365-defender.md) -Impersonation is where the sender of an email message looks very similar to a real or expected sender email address. Attackers often user impersonated sender email addresses in phishing or other types of attacks in an effort to gain the trust of the recipient. There are basically two types of impersonation: +_Impersonation_ is when the sender of an email message looks similar to a real or expected sender's email address. Attackers often use impersonated sender email addresses in phishing or other types of attacks to gain the trust of the recipient. There are two basic types of impersonation: -- **Domain impersonation**: Instead of lila@contoso.com, the impersonated sender's email address is lila@ćóntoso.com.-- **User impersonation**: Instead of michelle@contoso.com, the impersonated sender's email address is rnichell@contoso.com.+- **Domain impersonation**: Contains subtle differences in the domain. For example, lila@ćóntoso.com impersonates lila@contoso.com. +- **User impersonation**: Contains subtle differences in the email alias. For example, rnichell@contoso.com impersonates michelle@contoso.com. -Domain impersonation is different from [domain spoofing](anti-phishing-protection-spoofing-about.md), because the impersonated domain is typically a real, registered domain. Messages from senders in the impersonated domain can and often do pass regular email authentication checks that would otherwise identify spoofing attempts (SPF, DKIM, and DMARC). +Domain impersonation is different from _[domain spoofing](anti-phishing-protection-spoofing-about.md)_, because the impersonated domain is often a real, registered domain, but with the intent to deceive. Messages from senders in the impersonated domain are able to pass regular email authentication checks that would otherwise identify the messages as spoofing attempts (SPF, DKIM, and DMARC). Impersonation protection is part of the anti-phishing policy settings that are exclusive to Microsoft Defender for Office 365. For more information about these settings, see [Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365). -You can use the impersonation insight in the Microsoft 365 Defender portal to quickly identify messages from impersonated senders or sender domains that you've configured for impersonation protection. +Admins can use the impersonation insight in the Microsoft 365 Defender portal to quickly identify messages from impersonated senders or sender domains that are specified in impersonation protection in anti-phishing policies. ## What do you need to know before you begin? You can use the impersonation insight in the Microsoft 365 Defender portal to qu - **Global Reader** - [Azure AD RBAC](../../admin/add-users/about-admin-roles.md): Membership in the **Global Administrator**, **Security Administrator**, **Security Reader**, or **Global Reader** roles gives users the required permissions _and_ permissions for other features in Microsoft 365. -- You enable and configure impersonation protection in anti-phishing policies in Microsoft Defender for Office 365. Impersonation protection isn't enabled by default. For more information, see [Configure anti-phishing policies in Microsoft Defender for Office 365](anti-phishing-policies-mdo-configure.md).+- You enable and configure impersonation protection in anti-phishing policies in Microsoft Defender for Office 365. Impersonation protection isn't enabled by default. For more information, see [Configure anti-phishing policies in Microsoft Defender for Office 365](anti-phishing-policies-mdo-configure.md) and [Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users](preset-security-policies.md#use-the-microsoft-365-defender-portal-to-assign-standard-and-strict-preset-security-policies-to-users). ## Open the impersonation insight in the Microsoft 365 Defender portal -1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. To go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. +In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. Or, to go directly to the **Anti-phishing** page, use <https://security.microsoft.com/antiphishing>. -2. On the **Anti-phishing** page, the impersonation insight looks like this: +On the **Anti-phishing** page, the impersonation insight looks like this: - :::image type="content" source="../../media/m365-sc-impersonation-insight.png" alt-text="The impersonation insight on the Anti-phishing policy page in the Microsoft 365 Defender portal." lightbox="../../media/m365-sc-impersonation-insight.png"::: - The insight has two modes: +The insight has two modes: - - **Insight mode**: If impersonation protection is enabled and configured in any anti-phishing policies, the insight shows the number of detected messages from impersonated domains and impersonated users (senders) over the past seven days. This is the total of all detected impersonated senders from all anti-phishing policies. - - **What if mode**: If impersonation protection isn't enabled and configured in any active anti-phishing policies, the insight shows you how many messages *would* have been detected by our impersonation protection capabilities over the past seven days. +- **Insight mode**: If impersonation protection is enabled and configured in any anti-phishing policies, the insight shows the number of detected messages from impersonated domains and impersonated users (senders) over the past seven days. The number shown is the total of all detected impersonation attempts from all anti-phishing policies. +- **What if mode**: If impersonation protection isn't enabled and configured in any active anti-phishing policies, the insight shows how many messages _would have been_ detected by impersonation protection over the past seven days. -To view information about the impersonation detections, click **View impersonations** in the impersonation insight. +To view information about the impersonation detections, select the **View impersonations** link in the impersonation insight. -## View information about messages from senders in impersonated domains +## View information about domain impersonation detections -On the **Impersonation insight** page that appears after you click **View impersonations** in the impersonation insight, verify that the **Domains** tab is selected. The **Domains** tab contains the following information: +After you select the **View impersonations** link in the impersonation insight, you're taken to the **Impersonation insight** page. To go directly to the **Impersonation insight** page, use <https://security.microsoft.com/impersonationinsight>. ++On the **Impersonation insight** page, verify that the **Domains** tab is selected. The following information is shown:<sup>\*</sup>: - **Sender Domain**: The impersonating domain, which is the domain that was used to send the email message.-- **Message count**: The number of messages from impersonating sender domain over the last 7 days.+- **Message count**: The number of messages from impersonating sender domain over the last seven days. - **Impersonation type**: This value shows the detected location of the impersonation (for example, **Domain in address**).-- **Impersonated domain(s)**: The impersonated domain, which should closely resemble the domain that's configured for impersonation protection in the anti-phishing policy.-- **Domain type**: This value is **Company domain** for internal domains or **Custom domain** for custom domains.+- **Impersonated domain(s)**: The domain that's protected by domain impersonation protection, which should resemble the domain in **Sender domain**. +- **Domain type**: This value is **Company domain** for [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) or **Custom domain** for custom domains. - **Policy**: The anti-phishing policy that detected the impersonated domain. - **Allowed to impersonate**: One of the following values:- - **Yes**: The domain was configured as trusted domain (an exception for impersonation protection) in the anti-phishing policy. Messages from senders in the impersonated domain were detected, but allowed. - - **No**: The domain was configured for impersonation protection in the anti-phishing policy. Messages from senders in the impersonated domain were detected and acted upon based on the action for impersonated domains in the anti-phishing policy. + - **Yes**: The domain was configured as trusted domain (an exception for impersonation protection) in the anti-phishing policy that detected the message. Messages from the impersonated domain were detected, but allowed. + - **No**: The domain was configured for impersonation protection in the anti-phishing policy that detected the message. The action for domain impersonation detections in the anti-phishing policy is done to the message. ++Select a column header to sort by that column. ++sup>\*</sup> To see all columns, you likely need to do one or more of the following steps: ++- Horizontally scroll in your web browser. +- Narrow the width of appropriate columns. +- Zoom out in your web browser. ++To change the list of domain impersonation detections from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. ++Use the :::image type="icon" source="../../media/m365-cc-sc-search-icon.png" border="false"::: **Search** box and a comma-separated list of values to find specific domain impersonation detections. ++Use :::image type="icon" source="../../media/m365-cc-sc-download-icon.png" border="false"::: **Export** to export the list of domain impersonation detections to a CSV file. ++### View details about a domain impersonation detection ++On the **Domains** tab on the **Impersonation insight** page at <https://security.microsoft.com/impersonationinsight?type=Domain>, select one of the impersonation detections by clicking anywhere in the row other than the check box. ++The details flyout that open contains the following actions and information: ++> [!TIP] +> To see details about other domain impersonation entries without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ++- **Select impersonation policy to modify** and **Add to the allowed to impersonation list**: These settings work together to add the domain to the [Trusted senders and domains](anti-phishing-policies-about.md#trusted-senders-and-domains) list in the selected policy so messages from senders in this domain are no longer identified as domain impersonation: + - Select the anti-phishing policy in the dropdown list. The anti-phishing policy that was responsible for detecting the message is shown in the **Policy** value on the **Domain** tab. + - Slide the toggle to on: :::image type="icon" source="../../media/scc-toggle-on.png" border="false"::: to add the domain to the **Trusted senders and domains** list in the selected policy. -You can click selected column headings to sort the results. + To remove the domain from the **Trusted senders and domains** list, slide the toggle back to :::image type="icon" source="../../media/scc-toggle-off.png" border="false"::: -To filter the results, you can use the  **Search** box to enter a comma-separated list of values to filter the results. +- The following information is available in the details flyout: + - **Why did we catch this?** + - **What do you need to do?** + - **Domain summary**: The domain that was detected as impersonation. + - **Whois data**: Contains information about the domain: + - **Sender location** + - **Domain created date** + - **Domain expiration date** + - **Registrant** -### View details about messages from senders in impersonated domains + - **Explorer investigation**: Select the link to open [Threat Explorer or Real-time detections](threat-explorer-about.md) for additional details about the sender. -On the **Domains** tab on the **Impersonation insight** page, select one of the available impersonation detections. The details flyout that appears contains the following information and features: + - **Email from sender**: This section shows the following information about similar messages from senders in the domain: + - **Date** + - **Recipient** + - **Subject** + - **Sender** + - **Sender IP** + - **Delivery action** -- **Selection impersonation policy to modify**: Select the affected anti-phishing policy that you want to modify. Only policies where the impersonated domain is defined in the policy are available. Refer to the previous page to see which policy was actually responsible for detecting the impersonated domain (likely based on the recipient and the priority of the policy).-- **Add to the allowed to impersonation list**: Use this toggle to add or remove the sender from the **Trusted senders and domains** (impersonation exceptions) for the anti-phishing policy that you selected:- - If the **Allowed to impersonate** value for this entry was **No**, the toggle is off. To exempt all senders in this domain from evaluation by impersonation protection, slide the toggle to on: . The domain is added to the **Trusted domains** list in the impersonation protection settings of the anti-phishing policy. - - If the **Allowed to impersonate** value for this entry was **Yes**, the toggle is on. To return all senders in this domain to evaluation by impersonation protection, slide the toggle to off: . The domain is removed from the **Trusted domains** list in the impersonation protection settings of the anti-phishing policy. -- Why we caught this.-- What you need to do.-- A domain summary that list the impersonated domain.-- WhoIs data about the sender.-- A link to open [Threat Explorer](threat-explorer-about.md) to see additional details about the sender.-- Similar messages from the same sender that were delivered to your organization.+When you're finished in the details flyout, select **Close**. -## View information about messages from impersonated senders +## View information about user impersonation detections -On the **Impersonation insight** page that appears after you click **View impersonations** in the impersonation insight, click the **Users** tab. The **Users** tab contains the following information: +After you select the **View impersonations** link in the impersonation insight, you're taken to the **Impersonation insight** page. To go directly to the **Impersonation insight** page, use <https://security.microsoft.com/impersonationinsight>. ++On the **Impersonation insight** page, select the **Users** tab. The following information is shown:<sup>\*</sup>: - **Sender**: The email address of the impersonating sender that sent the email message.-- **Message count**: The number of messages from the impersonating sender over the last 7 days.-- **Impersonation type**: This value is **User in display name**.-- **Impersonated user(s)**: The email address of the impersonated sender, which should closely resemble the user that's configured for impersonation protection in the anti-phishing policy.-- **User type**: This value shows the type of protection applied (for example, **Protected user** or **Mailbox Intelligence**).+- **Message count**: The number of messages from the impersonating sender over the last seven days. +- **Impersonation type**: For example, **User in display name**. +- **Impersonated user(s)**: The display name and email address of the sender that's protected by impersonation protection, which resembles the email address in **Sender**. +- **User type**: The type of protection applied (for example, **Protected user** or **Mailbox Intelligence**). - **Policy**: The anti-phishing policy that detected the impersonated sender. - **Allowed to impersonate**: One of the following values:- - **Yes**: The sender was configured as trusted user (an exception for impersonation protection) in the anti-phishing policy. Messages from the impersonated sender were detected, but allowed. - - **No**: The sender was configured for impersonation protection in the anti-phishing policy. Messages from the impersonated sender were detected and acted upon based on the action for impersonated users in the anti-phishing policy. + - **Yes**: The sender was configured as trusted user (an exception for impersonation protection) in the anti-phishing policy that detected the message. Messages from the impersonated sender were detected, but allowed. + - **No**: The sender was configured for impersonation protection in the anti-phishing policy that detected the message. The action for user impersonation detections in the anti-phishing policy is done to the message. ++Select a column header to sort by that column. ++sup>\*</sup> To see all columns, you likely need to do one or more of the following steps: ++- Horizontally scroll in your web browser. +- Narrow the width of appropriate columns. +- Zoom out in your web browser. ++To change the list of user impersonation detections from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. ++Use the :::image type="icon" source="../../media/m365-cc-sc-search-icon.png" border="false"::: **Search** box and a comma-separated list of values to find specific user impersonation detections. ++Use :::image type="icon" source="../../media/m365-cc-sc-download-icon.png" border="false"::: **Export** to export the list of user impersonation detections to a CSV file. ++### View details about a user impersonation detection ++On the **Users** tab on the **Impersonation insight** page at <https://security.microsoft.com/impersonationinsight?type=User>, select one of the impersonation detections by clicking anywhere in the row other than the check box. ++The details flyout that open contains the following actions and information: ++> [!TIP] +> To see details about other user impersonation entries without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ++- **Select impersonation policy to modify** and **Add to the allowed to impersonation list**: These settings work together to add the user to the [Trusted senders and domains](anti-phishing-policies-about.md#trusted-senders-and-domains) list in the selected policy so messages from this sender are no longer identified as user impersonation: + - Select the anti-phishing policy in the dropdown list. The anti-phishing policy that was responsible for detecting the message is shown in the **Policy** value on the **Domain** tab. + - Slide the toggle to on: :::image type="icon" source="../../media/scc-toggle-on.png" border="false"::: to add the user to the **Trusted senders and domains** list in the selected policy. -You can click selected column headings to sort the results. + To remove the user from the **Trusted senders and domains** list, slide the toggle back to :::image type="icon" source="../../media/scc-toggle-off.png" border="false"::: -To filter the results, you can use the **Filter sender** box to enter a comma-separated list of values to filter the results. +- The following information is available in the details flyout: + - **Why did we catch this?** + - **What do you need to do?** + - **Sender summary**: The sender that was detected as impersonation. -### View details about messages from impersonated senders + - **Explorer investigation**: Select the link to open [Threat Explorer or Real-time detections](threat-explorer-about.md) for additional details about the sender. -On the **Users** tab on the **Impersonation insight** page, select one of the available impersonation detections. The details flyout that appears contains the following information and features: + - **Email from sender**: This section shows the following information about similar messages from the sender: + - **Date** + - **Recipient** + - **Subject** + - **Sender** + - **Sender IP** + - **Delivery action** -- **Selection impersonation policy to modify**: Select the affected anti-phishing policy that you want to modify. Only policies where the impersonated sender is defined in the policy are available. Refer to the previous page to see which policy was actually responsible for detecting the impersonated sender (likely based on the recipient and the priority of the policy).-- **Add to the allowed to impersonation list**: Use this toggle to add or remove the sender from the **Trusted senders and domains** (impersonation exceptions) for the anti-phishing policy that you selected:- - If the **Allowed to impersonate** value for this entry was **No**, the toggle is off. To exempt the sender from evaluation by impersonation protection, slide the toggle to on: . The sender is added to the **Trusted users** list in the impersonation protection settings of the anti-phishing policy. - - If the **Allowed to impersonate** value for this entry was **Yes**, the toggle is on. To return the sender to evaluation by impersonation protection, slide the toggle to off: . The sender is removed from the **Trusted users** list in the impersonation protection settings of the anti-phishing policy. -- Why we caught this.-- What you need to do.-- A sender summary that list the impersonated sender.-- WhoIs data about the sender.-- A link to open [Threat Explorer](threat-explorer-about.md) to see additional details about the sender.-- Similar messages from the same sender that were delivered to your organization.+When you're finished in the details flyout, select **Close**. |
| security | Anti Phishing Policies Eop Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-policies-eop-configure.md | On the **Anti-phishing** page, the following properties are displayed in the lis - **On** or **Off** for other anti-spam policies. - **Priority**: For more information, see the [Set the priority of custom anti-spam policies](#use-the-microsoft-365-defender-portal-to-set-the-priority-of-custom-anti-phishing-policies) section. -To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. +To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter** to filter the policies by **Time range** (creation date) or **Status**. Use :::image type="icon" source="../../media/m365-cc-sc-download-icon.png" borde Select a policy by clicking anywhere in the row other than the check box next to the name to open the details flyout for the policy. > [!TIP]-> To see details about other anti-phishing policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** buttons at the top of the policy details flyout. +> To see details about other anti-phishing policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ## Use the Microsoft 365 Defender portal to take action on anti-phishing policies |
| security | Anti Phishing Policies Mdo Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure.md | For anti-phishing policy procedures in organizations without Defender for Office Back on the **Manage senders for impersonation protection** flyout, the users you selected are listed by **Display name** and **Sender email address**. - To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. + To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use the :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Search** box to find entries on the flyout. For anti-phishing policy procedures in organizations without Defender for Office Back on the **Manage custom domains for impersonation protection** flyout, the domains you entered are listed. - To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. + To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use the :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Search** box to find entries on the flyout. For anti-phishing policy procedures in organizations without Defender for Office Back on the **Sender** tab, the senders you entered are listed. - To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. + To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use the :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Search** box to find entries on the flyout. For anti-phishing policy procedures in organizations without Defender for Office Back on the **Domain** tab, the domains you added are now listed. - To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. + To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use the :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Search** box to find entries on the tab. On the **Anti-phishing** page, the following properties are displayed in the lis - **Always on** for the default anti-phishing policy. - **On** or **Off** for other anti-spam policies. - **Priority**: For more information, see the [Set the priority of custom anti-spam policies](#use-the-microsoft-365-defender-portal-to-set-the-priority-of-custom-anti-phishing-policies) section.-To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. +To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. -Select  **Filter** to filter the policies by **Time range** (creation date) or **Status**. +Select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter** to filter the policies by **Time range** (creation date) or **Status**. -Use the  **Search** box and a corresponding value to find specific anti-phishing policies. +Use the :::image type="icon" source="../../media/search-icon.png" border="false"::: **Search** box and a corresponding value to find specific anti-phishing policies. Use :::image type="icon" source="../../media/m365-cc-sc-download-icon.png" border="false"::: **Export** to export the list of policies to a CSV file. Select a policy by clicking anywhere in the row other than the check box next to the name to open the details flyout for the policy. > [!TIP]-> To see details about other anti-phishing policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** buttons at the top of the policy details flyout. +> To see details about other anti-phishing policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ## Use the Microsoft 365 Defender portal to take action on anti-phishing policies |
| security | Anti Spam Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-policies-configure.md | You can configure anti-spam policies in the Microsoft 365 Defender portal or in Back on the first flyout, the senders or domains that you added are listed. - To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. + To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use the :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Search** box to find entries on the flyout. On the **Anti-spam policies** page, the following properties are displayed in th - **Custom anti-spam policy** - Blank for the default anti-spam policy (for example, **Anti-spam inbound policy (Default)**). -To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. +To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use the :::image type="icon" source="../../media/m365-cc-sc-search-icon.png" border="false"::: **Search** box and a corresponding value to find specific policies. Select an anti-spam policy by clicking anywhere in the row other than the check box next to the name to open the details flyout for the policy. > [!TIP]-> To see details about other anti-spam policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** buttons at the top of the policy details flyout. +> To see details about other anti-spam policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ## Use the Microsoft 365 Defender portal to take action on anti-spam policies |
| security | Attack Simulation Training Simulations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-simulations.md | The rest of the details page contains the following tabs: - **Country** - **Manager** - To change the list of users from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. + To change the list of users from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. If you select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**, the following filters are available: |
| security | Attack Simulation Training Training Campaigns | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-training-campaigns.md | If you select a user from the list by clicking anywhere in the row other than th - **Training completed date** > [!TIP]-> To see details about other users in the Training campaign without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** buttons at the top of the policy details flyout. +> To see details about other users in the Training campaign without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. #### Details tab |
| security | Connection Filter Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/connection-filter-policies-configure.md | On the **Anti-spam policies** page, the following properties are displayed in th - **Priority**: The value is **Lowest** for the default connection filter policy. - **Type**: The value is blank for the default connection filter policy. -To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. +To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use the :::image type="icon" source="../../media/m365-cc-sc-search-icon.png" border="false"::: **Search** box and a corresponding value to find specific policies. |
| security | Defender For Office 365 Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/defender-for-office-365-whats-new.md | For more information on what's new with other Microsoft Defender security produc - [What's new in Microsoft Defender for Identity](/defender-for-identity/whats-new) - [What's new in Microsoft Defender for Cloud Apps](/cloud-app-security/release-notes) +## May 2023 ++- Built-in reporting in Outlook on the web supports reporting messages from shared mailboxes or other mailboxes by a delegate. + - Shared mailboxes require Send As or Send On Behalf permission for the user. + - Other mailboxes require Send As or Send On Behalf permission _and_ Read and Manage permissions for the delegate. + ## April 2023 - [Using machine learning to drive more effective simulations in Attack Simulation and Training](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/attack-simulation-training-using-machine-learning-to-drive-more/ba-p/3791023): Make use of intelligent predicted compromise rate (PCR) and Microsoft Defender for Office 365 payload recommendations for utilizing high-quality payloads in your simulation. |
| security | Email Authentication Dkim Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-authentication-dkim-configure.md | |
| security | Outbound Spam Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/outbound-spam-policies-configure.md | On the **Anti-spam policies** page, the following properties are displayed in th - **Custom outbound spam policy** - Blank for the default outbound spam policy (for example, **Anti-spam outbound policy (Default)**). -To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. +To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use the :::image type="icon" source="../../media/m365-cc-sc-search-icon.png" border="false"::: **Search** box and a corresponding value to find specific policies. Select an outbound spam policy by clicking anywhere in the row other than the check box next to the name to open the details flyout for the policy. > [!TIP]-> To see details about other outbound spam policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** buttons at the top of the policy details flyout. +> To see details about other outbound spam policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ## Use the Microsoft 365 Defender portal to take action on outbound spam policies |
| security | Quarantine Admin Manage Messages Files | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-admin-manage-messages-files.md | To filter the results, select :::image type="icon" source="../../media/m365-cc-s - **Transport rule** (mail flow rule) - **Bulk** - **Spam**- - **Data loss prevention** - **Malware**: Anti-malware policies in EOP or Safe Attachments policies in Defender for Office 365. The **Policy Type** value indicates which feature was used. - **Phishing**: The spam filter verdict was **Phishing** or anti-phishing protection quarantined the message ([spoof settings](anti-phishing-policies-about.md#spoof-settings) or [impersonation protection](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)). - **High confidence phishing** To filter the results, select :::image type="icon" source="../../media/m365-cc-s - **Anti-phishing policy** - **Anti-spam policy** - **Transport rule** (mail flow rule)- - **Data loss prevention rule** When you're finished on the **Filters** flyout, select **Apply**. To clear the filters, select :::image type="icon" source="../../media/m365-cc-sc-clear-filters-icon.png" border="false"::: **Clear filters**. In the details flyout that opens, the following information is available: To take action on the message, see the next section. > [!TIP]-> To see details about other quarantined messages without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** buttons at the top of the policy details flyout. +> To see details about other quarantined messages without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ### Take action on quarantined email In the details flyout that opens, the following information is available: To take action on the file, see the next section. > [!TIP]-> To see details about other quarantined files without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** buttons at the top of the policy details flyout. +> To see details about other quarantined files without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ### Take action on quarantined files In the details flyout that opens, the following information is available: To take action on the message, see the next section. > [!TIP]-> To see details about other quarantined messages without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** buttons at the top of the policy details flyout. +> To see details about other quarantined messages without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ### Take action on quarantined messages in Microsoft Teams |
| security | Quarantine End User | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-end-user.md | To filter the results, select :::image type="icon" source="../../media/m365-cc-s - **Transport rule** (mail flow rule) - **Bulk** - **Spam**- - **Data loss prevention** - **Malware**: Anti-malware policies in EOP or Safe Attachments policies in Defender for Office 365. The **Policy Type** value indicates which feature was used. - **Phishing**: The spam filter verdict was **Phishing** or anti-phishing protection quarantined the message ([spoof settings](anti-phishing-policies-about.md#spoof-settings) or [impersonation protection](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)). - **High confidence phishing** In the details flyout that opens, the following information is available: To take action on the message, see the next section. > [!TIP]-> To see details about other quarantined messages without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** buttons at the top of the policy details flyout. +> To see details about other quarantined messages without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ## Take action on quarantined email |
| security | Reports Email Security | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/reports-email-security.md | On the **Manage schedules** page, the following information is shown for each sc - **Frequency** - **Last sent** -To change the list from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. +To change the list from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use the :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Search** box to find an existing scheduled report entry. |
| security | Safe Attachments Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/safe-attachments-policies-configure.md | On the **Safe Attachments** page, the following properties are displayed in the - **Status**: Values are **On** or **Off**. - **Priority**: For more information, see the [Set the priority of Safe Attachments policies](#use-the-microsoft-365-defender-portal-to-set-the-priority-of-custom-safe-attachments-policies) section. -To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. +To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use the :::image type="icon" source="../../media/m365-cc-sc-search-icon.png" border="false"::: **Search** box and a corresponding value to find specific Safe Attachment policies. Use :::image type="icon" source="../../media/m365-cc-sc-view-reports-icon.png" b Select a policy by clicking anywhere in the row other than the check box next to the name to open the details flyout for the policy. > [!TIP]-> To see details about other Safe Attachments policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** buttons at the top of the policy details flyout. +> To see details about other Safe Attachments policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ## Use the Microsoft 365 Defender portal to take action on Safe Attachments policies |
| security | Safe Links Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/safe-links-policies-configure.md | You configure Safe Links policies in the Microsoft 365 Defender portal or in Exc 3. Back on the **Manage URLs to not rewrite** flyout, the URL entries that you added are listed on the flyout. - To change the list of URLs from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. + To change the list of URLs from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use the :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Search** box to find entries on the flyout. On the **Safe Links** page, the following properties are displayed in the list o - **Status**: Values are **On** or **Off**. - **Priority**: For more information, see the [Set the priority of Safe Links policies](#use-the-microsoft-365-defender-portal-to-set-the-priority-of-custom-safe-links-policies) section. -To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::. +To change the list of policies from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. Use the :::image type="icon" source="../../media/m365-cc-sc-search-icon.png" border="false"::: **Search** box and a corresponding value to find specific Safe Links policies. Use :::image type="icon" source="../../media/m365-cc-sc-view-reports-icon.png" b Select a policy by clicking anywhere in the row other than the check box next to the name to open the details flyout for the policy. > [!TIP]-> To see details about other Safe Links policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** buttons at the top of the policy details flyout. +> To see details about other Safe Links policies without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ## Use the Microsoft 365 Defender portal to take action on Safe Links policies |
| security | Skip Filtering Phishing Simulations Sec Ops Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/skip-filtering-phishing-simulations-sec-ops-mailboxes.md | Back on the **SecOps mailbox** tab, the SecOps mailbox entries that you configur - The **Display name** column contains display name of the mailboxes. - The **Email** column contains the email address for each entry.-- To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::.+- To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. ## Use the Microsoft 365 Defender portal to modify or remove SecOps mailboxes in the advanced delivery policy Back on the **Phishing simulation** tab, the third-party phishing simulation ent - The **Value** column contains the domain, IP address or URL entry. - The **Type** column contains the value **Sending IP**, **Domain**, or **Allowed simulation URL** for each entry. - The **Date** column shows when the entry was created.-- To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false":::.+- To change the list of entries from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. ## Use the Microsoft 365 Defender portal to modify or remove third-party phishing simulations in the advanced delivery policy |
| security | Submissions Outlook Report Messages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-outlook-report-messages.md | For more information about reporting messages to Microsoft, see [Report messages > If the toggle is **Off**  or if **Use a non-Microsoft add-in button** is selected, then the **Report** button is not available in Outlook on the web. > > - Currently, the **Report** button in Outlook on the web does not honor the **Before a message is reported** and **After a message is reported** settings (notification pop-ups) in the [User reported settings](submissions-user-reported-messages-custom-mailbox.md).+> +> - Built-in reporting in Outlook on the web supports reporting messages from shared mailboxes or other mailboxes by a delegate. +> - Shared mailboxes require Send As or Send On Behalf permission for the user. +> - Other mailboxes require Send As or Send On Behalf permission _and_ Read and Manage permissions for the delegate. ### Use the built-in Report button in Outlook on the web to report junk and phishing messages |