| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Manage Device Access Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/manage-device-access-settings.md | If you're using Basic Mobility and Security, there might be devices that you can Use these steps: -1. Sign in to Microsoft 365 with your global admin account. +1. Sign in to Microsoft 365 with your global admin account. -2. In your browser, type: [https://protection.office.com](https://protection.office.com/). +2. In your browser, type: <https://protection.office.com/>. > [!IMPORTANT] > If this is the first time you're using Basic Mobility and Security for Microsoft 365 Business Standard, activate it here: [Activate Basic Security and Mobility](https://admin.microsoft.com/EAdmin/Device/IntuneInventory.aspx). After you've activated it, manage your devices with [Office 365 Security & Compliance](https://protection.office.com/). -3. Go to **Data loss prevention** > **Device management** > **Device policies**, and select **Manage organization-wide device access settings**. +3. Go to **Data loss prevention** \> **Device management** \> **Device policies**, and select **Manage organization-wide device access settings**. 4. Select **Block**. |
| admin | Manage Enrolled Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/manage-enrolled-devices.md | description: "Basic Mobility and Security can help you secure and manage your or The built-in mobile device management for Microsoft 365 helps you secure and manage your users' mobile devices like iPhones, iPads, Androids, and Windows phones. The first step is to sign in to Microsoft 365 and set up Basic Mobility and Security. For more info, see [Set up Basic Mobility and Security](set-up.md). -After you've set it up, the people in your organization must enroll their devices in the service. For more info, see [Enroll your mobile device using Basic Mobility and Security](enroll-your-mobile-device.md). Then you can use Basic Mobility and Security to help manage devices in your organization. For example, you can use device security policies to help limit email access or other services, view devices reports, and remotely wipe a device. You'll typically go to the Security & Compliance Center to do these tasks. For more info, see [Microsoft Purview compliance portal](../../compliance/microsoft-365-compliance-center.md). +After you've set it up, the people in your organization must enroll their devices in the service. For more info, see [Enroll your mobile device using Basic Mobility and Security](enroll-your-mobile-device.md). Then you can use Basic Mobility and Security to help manage devices in your organization. For example, you can use device security policies to help limit email access or other services, view devices reports, and remotely wipe a device. You'll typically go to the Security & Compliance Center to do these tasks. For more info, see [Microsoft Purview compliance portal](../../compliance/microsoft-365-compliance-center.md). ## Device management tasks |
| admin | Set Up File Storage And Sharing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/setup/set-up-file-storage-and-sharing.md | Here's how each person on your team can set up OneDrive and share files.  -4. On the **Send Link** page, leave the default selection **Anyone with the link can view and edit**. +4. On the **Send Link** page, leave the default selection **Anyone with the link can view and edit**. Type names or email addresses of team members who you want to have access to the folder, and add an optional message. |
| bookings | Bookings In Outlook | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/bookings-in-outlook.md | Bookings in Outlook has two different views: - **Organizer view** A personal booking page where you can create meeting types that others can book with you. Custom meeting types give you the ability to customize when you want to meet and how that meeting type is shared with others. You control whether each meeting type is public to your scheduling page or is private and can only be accessed by a select group of people. You can also choose to add a Teams meeting to all meetings booked through your Bookings in Outlook page. You can access your Bookings in Outlook page through Outlook on the web. After you set up your page and publish it, you can share it with others. For example, you can add it to your Outlook signature. - **Scheduling view** When you share your Bookings in Outlook page with others, they will see the scheduling view. Which meetings are shown in the scheduling view depends on if you shared the link to your Bookings in Outlook page with public meetings or you shared a private link for an individual meeting.- - Public meetings can be viewed and scheduled by anyone that has your Bookings in Outlook page link. You are in control of who you share that link with. All public meeting types will be visible to anyone that has your Bookings in Outlook page link. - - Private meetings can only be viewed by people who have the link for that meeting type. The difference between public meetings and private meetings is private meetings can have different links and the links expire after 90 days. You can also set private links to expire after a one-time booking. When accessing the scheduling view for a private meeting, only that meeting type will be visible. + - Public meetings can be viewed and scheduled by anyone that has your Bookings in Outlook page link. You are in control of who you share that link with. All public meeting types will be visible to anyone that has your Bookings in Outlook page link. + - Private meetings can only be viewed by people who have the link for that meeting type. The difference between public meetings and private meetings is private meetings can have different links and the links expire after 90 days. You can also set private links to expire after a one-time booking. When accessing the scheduling view for a private meeting, only that meeting type will be visible. ## Before you begin Use the **Get-OrganizationConfig** and **Set-OrganizationConfig** commands to fi Set-OrganizationConfig -EwsBlockList @{Remove="MicrosoftOWSPersonalBookings"} ``` - **C**. If the value of **EwsApplicationAccessPolicy** is empty, all applications are allowed to access EWS and REST. + **C**. If the value of **EwsApplicationAccessPolicy** is empty, all applications are allowed to access EWS and REST. - To turn off Bookings in Outlook for your organization set the **EnforceBlockList** policy and add **MicrosoftOWSPersonalBookings** to the block list by running the following command: Use the **Get-CASMailbox** and **Set-CASMailbox** commands to check user status - To turn off Bookings in Outlook for this user, add **MicrosoftOWSPersonalBookings** to **EnforceBlockList** by running the following command: ```PowerShell- Set-CASMailbox -Identity adam@contoso.com -EwsApplicationAccessPolicy  EnforceBlockList @{Add="MicrosoftOWSPersonalBookings"} + Set-CASMailbox -Identity adam@contoso.com -EwsApplicationAccessPolicy EnforceBlockList @{Add="MicrosoftOWSPersonalBookings"} ``` - To turn on Bookings in Outlook for this user, remove **MicrosoftOWSPersonalBookings**, if present from EnforceBlockList by running the following command: Use the **Get-CASMailbox** and **Set-CASMailbox** commands to check user status Set-CASMailbox -Identity adam@contoso.com -EwsBlockList @{Remove="MicrosoftOWSPersonalBookings"} ``` - **C**. If the value of EwsApplicationAccessPolicy is empty, all applications are allowed to access EWS and REST. + **C**. If the value of EwsApplicationAccessPolicy is empty, all applications are allowed to access EWS and REST. - - To turn off Bookings in Outlook for this user, set the **EnforceBlockList** policy and add **MicrosoftOWSPersonalBookings** to EWSBlockList by running the following command: + - To turn off Bookings in Outlook for this user, set the **EnforceBlockList** policy and add **MicrosoftOWSPersonalBookings** to EWSBlockList by running the following command: ```PowerShell- Set-CASMailbox -Identity Adam -EwsApplicationAccessPolicy  EnforceBlockList -EWSBlockList @{Add="MicrosoftOWSPersonalBookings"} + Set-CASMailbox -Identity Adam -EwsApplicationAccessPolicy EnforceBlockList -EWSBlockList @{Add="MicrosoftOWSPersonalBookings"} ``` |
| business-premium | M365bp Conditional Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-conditional-access.md | This article provides information about: - [Conditional Access](#conditional-access) (for businesses with more stringent security requirements) > [!NOTE]-> If you've been using┬áConditional Access policies, you'll need to turn them off before using security defaults. You can use either security defaults or Conditional Access policies, but you can't use both at the same time. +> If you've been using Conditional Access policies, you'll need to turn them off before using security defaults. You can use either security defaults or Conditional Access policies, but you can't use both at the same time. ## Security defaults Security defaults were designed to help protect your company's user accounts fro - Requiring all users and admins to register for MFA using the Microsoft Authenticator app. - Challenging users with MFA, mostly when they show up on a new device or app, but more often for critical roles and tasks.-- Disabling authentication from legacy authentication clients that canΓÇÖt do MFA.+- Disabling authentication from legacy authentication clients that can't do MFA. - Protecting admins by requiring extra authentication every time they sign in. MFA is an important first step in securing your company, and security defaults make enabling MFA easy to implement. If your subscription was created on or after October 22, 2019, security defaults might have been automatically enabled for you—you should check your settings to confirm. > [!TIP]-> For more information about security defaults and the policies they enforce, see┬á[What are security defaults?](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults) +> For more information about security defaults and the policies they enforce, see [What are security defaults?](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults) ### To enable security defaults (or confirm they're already enabled) To learn more about Conditional Access, see [What is Conditional Access?](/azure ## Next objective Set up ways to [protect against malware and other threats](m365bp-increase-protection.md).- |
| business-premium | M365bp View Edit Create Mdb Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-view-edit-create-mdb-policies.md | To duplicate a policy in InTune: 1. Sign in to the Microsoft Endpoint Manager admin center. -1. Select the policy that you want to copy. Next, select **Duplicate** or select the ellipsis **(…)** to the right of the policy and select **Duplicate**. +1. Select the policy that you want to copy. Next, select **Duplicate** or select the ellipsis **(...)** to the right of the policy and select **Duplicate**. 1. Provide a New name for the policy, and then select **Save**. To edit a policy: |
| business-premium | Set Up Meetings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/set-up-meetings.md | description: "Set up online meetings with Microsoft Teams." # Set up meetings -Make sure members of the organization use Microsoft Teams for all meetings. Teams meetings files include audio, video, and sharing, and because they're online, there is always a meeting space and there's no need for a room with a projector! Microsoft Teams meetings are a great way to come together with your staff both inside and outside of your organization. +Make sure members of the organization use Microsoft Teams for all meetings. Teams meetings files include audio, video, and sharing, and because they're online, there is always a meeting space and there's no need for a room with a projector! Microsoft Teams meetings are a great way to come together with your staff both inside and outside of your organization. -Using Teams, you don’t need to be a member of the organization or even have an account to join a meeting. You can schedule and run online meetings where you can share your screen, share files, assign tasks, and more. Political campaigns can include staff, volunteers, or guests that are outside your organization. You can easily meet with clients, staff or partners over Microsoft Teams, and in a secure and worry-free environment. +Using Teams, you don't need to be a member of the organization or even have an account to join a meeting. You can schedule and run online meetings where you can share your screen, share files, assign tasks, and more. Political campaigns can include staff, volunteers, or guests that are outside your organization. You can easily meet with clients, staff or partners over Microsoft Teams, and in a secure and worry-free environment. [](https://go.microsoft.com/fwlink/?linkid=2078712) Learn more about meeting in Microsoft Teams: ## Next objective After this mission objective is accomplished, learn to securely [share files and videos](share-files-and-videos.md)-- |
| commerce | Add Licenses Bought Through Vlsc | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/add-licenses-bought-through-vlsc.md | |
| commerce | Allotment Basics | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/allotment-basics.md | |
| commerce | Manage Licenses For Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/manage-licenses-for-devices.md | |
| commerce | Subscriptions And Licenses | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/subscriptions-and-licenses.md | |
| commerce | Move Users Different Subscription | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/move-users-different-subscription.md | f1.keywords: -+ audience: Admin |
| compliance | Add Custodians To Case | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/add-custodians-to-case.md | To add custodians to a case, you must be a member of the eDiscovery Manager role 1. Go to [https://compliance.microsoft.com](https://compliance.microsoft.com) and sign in with a user account that has been assigned the appropriate eDiscovery permissions. -2. In the left navigation pane of the Microsoft Purview compliance portal, select **eDiscovery** > **eDiscovery (Premium)**, and select the [**Cases**](https://go.microsoft.com/fwlink/p/?linkid=2173764) tab. +2. In the left navigation pane of the Microsoft Purview compliance portal, select **eDiscovery** > **eDiscovery (Premium)**, and select the [**Cases**](https://go.microsoft.com/fwlink/p/?linkid=2173764) tab. 3. Select the case that you want to add custodians to. |
| compliance | Add Your Organization Brand To Encrypted Messages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/add-your-organization-brand-to-encrypted-messages.md | audience: Admin ms.localizationpriority: medium Previously updated : 4/1/2020 Last updated : 5/12/2022 search.appverid: - MET150 - MOE150 To remove a custom branding template: > [!IMPORTANT] > Third-party applications that scan and modify mail can prevent OME branding from being applied correctly. -After you've either modified the default template or created new branding templates, you can create Exchange mail flow rules to apply your custom branding based on certain conditions. Such a rule will apply custom branding in the following scenarios: +After you've either modified the default template or created new branding templates, you can create Exchange mail flow rules to apply your custom branding based on certain conditions. Most importantly, the email must be encrypted. Such a rule will apply custom branding in the following scenarios: - If the email was manually encrypted by the end user using Outlook or Outlook on the web, formerly Outlook Web App - If the email was automatically encrypted by an Exchange mail flow rule or Microsoft Purview Data Loss Prevention policy -For information on how to create an Exchange mail flow rule that applies encryption, see [Define mail flow rules to encrypt email messages in Office 365](define-mail-flow-rules-to-encrypt-email.md). +To ensure Microsoft Purview Message Encryption applies your custom branding, set up a mail flow rule to encrypt your email messages. The priority of the encryption rule should be higher than the branding rule so that the encryption rule is processed first. By default, if you create the encryption rule before the branding rule, then the encryption rule will have a higher priority. For information on how to create an Exchange mail flow rule that applies encryption, see [Define mail flow rules to encrypt email messages in Office 365](define-mail-flow-rules-to-encrypt-email.md). For information on setting the priority of a mail flow rule, see [Manage mail flow rules](/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules#set-the-priority-of-a-mail-flow-rule). 1. In a web browser, using a work or school account that has been granted global administrator permissions, [sign in to Office 365](https://support.office.com/article/b9582171-fd1f-4284-9846-bdd72bb28426#ID0EAABAAA=Web_browser). For information on how to create an Exchange mail flow rule that applies encrypt - Encrypted emails sent with a certain keyword such as "External" or "Partner" - Encrypted emails sent to a particular domain -7. From **Do the following**, select **Modify the message security** \> **Apply custom branding to OME messages**. Next, from the drop-down, select a branding template. --8. (Optional) You can configure the mail flow rule to apply encryption and custom branding. From **Do the following**, select **Modify the message security**, and then choose **Apply Office 365 Message Encryption and rights protection**. Select an RMS template from the list, choose **Save**, and then choose **OK**. +7. If you've already defined a mail flow rule to apply encryption, skip this step. Otherwise, to configure the mail flow rule to apply encryption, from **Do the following**, select **Modify the message security**, and then choose **Apply Office 365 Message Encryption and rights protection**. Select an RMS template from the list and then choose **add action**. The list of templates includes default templates and options and any custom templates you create. If the list is empty, ensure that you have set up Microsoft Purview Message Encryption. For instructions, see [Set up Microsoft Purview Message Encryption](set-up-new-message-encryption-capabilities.md). For information about the default templates, see [Configuring and managing templates for Azure Information Protection](/information-protection/deploy-use/configure-policy-templates). For information about the **Do Not Forward** option, see [Do Not Forward option for emails](/information-protection/deploy-use/configure-usage-rights#do-not-forward-option-for-emails). For information about the **encrypt only** option, see [Encrypt Only option for emails](/information-protection/deploy-use/configure-usage-rights#encrypt-only-option-for-emails).+ +8. From **Do the following**, select **Modify the message security** \> **Apply custom branding to OME messages**. Next, from the drop-down, select a branding template. - Choose **add action** if you want to specify another action. + Choose **add action** if you want to specify another action, or choose **Save**, and then choose **OK**. ## Background color reference |
| compliance | Archive Ciscojabberonoracle Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/archive-ciscojabberonoracle-data.md | The following overview explains the process of using a connector to archive the - Create a Merge1 account for Microsoft connectors. To do this, contact [Veritas Customer Support](https://www.veritas.com/content/support/en_US). You need to sign into this account when you create the connector in Step 1. -- The user who creates the Cisco Jabber on Oracle connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group).+- The user who creates the Cisco Jabber on Oracle connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group). - This Veritas data connector is in public preview in GCC environments in the Microsoft 365 US Government cloud. Third-party applications and services might involve storing, transmitting, and processing your organization's customer data on third-party systems that are outside of the Microsoft 365 infrastructure and therefore are not covered by the Microsoft Purview and data protection commitments. Microsoft makes no representation that use of this product to connect to third-party applications implies that those third-party applications are FEDRAMP compliant. |
| compliance | Archive Ringcentral Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/archive-ringcentral-data.md | The following overview explains the process of using a connector to archive the - Create a RingCentral application to fetch data from your RingCentral account. For step-by step instructions about creating the application, see [Merge1 Third-Party Connectors User Guide](https://docs.ms.merge1.globanetportal.com/Merge1%20Third-Party%20Connectors%20RingCentral%20User%20Guide.pdf). -- The user who creates the RingCentral connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group).+- The user who creates the RingCentral connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group). - This Veritas data connector is in public preview in GCC environments in the Microsoft 365 US Government cloud. Third-party applications and services might involve storing, transmitting, and processing your organization's customer data on third-party systems that are outside of the Microsoft 365 infrastructure and therefore are not covered by the Microsoft Purview and data protection commitments. Microsoft makes no representation that use of this product to connect to third-party applications implies that those third-party applications are FEDRAMP compliant. After you click **Save & Finish,** the **User mapping** page in the connector wi To map users and complete the connector setup in the compliance portal, follow these steps: -1. On the **Map RingCentral users to Microsoft 365 users** page, enable automatic user mapping. The RingCentral items include a property called *Email*, which contains email addresses for users in your organization. If the connector can associate this address with a Microsoft 365 user, the items are imported to that user’s mailbox. +1. On the **Map RingCentral users to Microsoft 365 users** page, enable automatic user mapping. The RingCentral items include a property called *Email*, which contains email addresses for users in your organization. If the connector can associate this address with a Microsoft 365 user, the items are imported to that user's mailbox. 2. Click **Next**, review your settings, and then go to the **Data connectors** page to see the progress of the import process for the new connector. |
| compliance | Archive Salesforcechatter Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/archive-salesforcechatter-data.md | description: "Admins can set up a connector to import and archive Salesforce Cha [!include[Purview banner](../includes/purview-rebrand-banner.md)] -Use a Veritas connector in the Microsoft Purview compliance portal to import and archive data from the Salesforce Chatter platform to user mailboxes in your Microsoft 365 organization. Veritas provides a [Salesforce Chatter](http://globanet.com/chatter/) connector that captures items from the third-party data source and imports those items to Microsoft 365. The connector converts the content such as chats, attachments, and posts from Salesforce Chatter to an email message format and then imports those items to the user’s mailbox in Microsoft 365. +Use a Veritas connector in the Microsoft Purview compliance portal to import and archive data from the Salesforce Chatter platform to user mailboxes in your Microsoft 365 organization. Veritas provides a [Salesforce Chatter](http://globanet.com/chatter/) connector that captures items from the third-party data source and imports those items to Microsoft 365. The connector converts the content such as chats, attachments, and posts from Salesforce Chatter to an email message format and then imports those items to the user's mailbox in Microsoft 365. After Salesforce Chatter data is stored in user mailboxes, you can apply Microsoft Purview features such as Litigation Hold, eDiscovery, retention policies and retention labels. Using a Salesforce Chatter connector to import and archive data in Microsoft 365 can help your organization stay compliant with government and regulatory policies. The following overview explains the process of using a connector to archive the - Create a Salesforce application and acquire a token at [https://salesforce.com](https://salesforce.com). You'll need to log into the Salesforce account as an admin and get a user personal token to import data. Also, triggers need to be published on the Chatter site to capture updates, deletes, and edits. These triggers will create a post on a channel, and Merge1 will capture the information from the channel. For step-by-step instructions about how to create the application and acquire the token, see [Merge1 Third-Party Connectors User Guide](https://docs.ms.merge1.globanetportal.com/Merge1%20Third-Party%20Connectors%20SalesForce%20Chatter%20User%20Guide%20.pdf). -- The user who creates the Salesforce Chatter connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group).+- The user who creates the Salesforce Chatter connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group). - This Veritas data connector is in public preview in GCC environments in the Microsoft 365 US Government cloud. Third-party applications and services might involve storing, transmitting, and processing your organization's customer data on third-party systems that are outside of the Microsoft 365 infrastructure and therefore are not covered by the Microsoft Purview and data protection commitments. Microsoft makes no representation that use of this product to connect to third-party applications implies that those third-party applications are FEDRAMP compliant. After you create the Salesforce Chatter connector, you can view the connector st ## Known issues -- At this time, we don't support importing attachments or items that are larger than 10 MB. Support for larger items will be available at a later date.+- At this time, we don't support importing attachments or items that are larger than 10 MB. Support for larger items will be available at a later date. |
| compliance | Archive Servicenow Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/archive-servicenow-data.md | The following overview explains the process of using a connector to archive the - Create a ServiceNow application to fetch data from your ServiceNow account. For step-by step instructions about creating the application, see [Merge1 Third-Party Connectors User Guide](https://docs.ms.merge1.globanetportal.com/Merge1%20Third-Party%20Connectors%20ServiceNow%20User%20Guide%20.pdf). -- The user who creates the ServiceNow connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group).+- The user who creates the ServiceNow connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group). - This Veritas data connector is in public preview in GCC environments in the Microsoft 365 US Government cloud. Third-party applications and services might involve storing, transmitting, and processing your organization's customer data on third-party systems that are outside of the Microsoft 365 infrastructure and therefore are not covered by the Microsoft Purview and data protection commitments. Microsoft makes no representation that use of this product to connect to third-party applications implies that those third-party applications are FEDRAMP compliant. |
| compliance | Archive Skypeforbusiness Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/archive-skypeforbusiness-data.md | description: "Learn how to set up and use a connector in the Microsoft Purview c [!include[Purview banner](../includes/purview-rebrand-banner.md)] -Use a Veritas connector in the Microsoft Purview compliance portal to import and archive data from the Skype for Business platform to user mailboxes in your Microsoft 365 organization. Veritas provides a [Skype for Business](https://www.veritas.com/en/au/insights/merge1/skype-for-business) connector that is configured to capture items from the third-party data source (on a regular basis) and import those items to Microsoft 365. The connector converts the content such as messages between users, persistent chats, and conference messages from Skype for Business to an email message format and then imports those items to the user’s mailbox in Microsoft 365. +Use a Veritas connector in the Microsoft Purview compliance portal to import and archive data from the Skype for Business platform to user mailboxes in your Microsoft 365 organization. Veritas provides a [Skype for Business](https://www.veritas.com/en/au/insights/merge1/skype-for-business) connector that is configured to capture items from the third-party data source (on a regular basis) and import those items to Microsoft 365. The connector converts the content such as messages between users, persistent chats, and conference messages from Skype for Business to an email message format and then imports those items to the user's mailbox in Microsoft 365. After Skype for Business data is stored in user mailboxes, you can apply Microsoft Purview features such as Litigation Hold, eDiscovery, retention policies and retention labels. Using a Skype for Business connector to import and archive data in Microsoft 365 can help your organization stay compliant with government and regulatory policies. The following overview explains the process of using a connector to archive the - Create a Merge1 account for Microsoft connectors. To do this, contact [Veritas Customer Support](https://www.veritas.com/form/requestacall/ms-connectors-contact.html). You need to sign into this account when you create the connector in Step 1. -- The user who creates the Skype for Business connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group).+- The user who creates the Skype for Business connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group). - This Veritas data connector is in public preview in GCC environments in the Microsoft 365 US Government cloud. Third-party applications and services might involve storing, transmitting, and processing your organization's customer data on third-party systems that are outside of the Microsoft 365 infrastructure and therefore are not covered by the Microsoft Purview and data protection commitments. Microsoft makes no representation that use of this product to connect to third-party applications implies that those third-party applications are FEDRAMP compliant. |
| compliance | Archive Veritas Twitter Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/archive-veritas-twitter-data.md | The following overview explains the process of using a connector to archive Twit - Create a Twitter application at <https://developer.twitter.com> to fetch data from your Twitter account. For step-by step instructions about creating the application, see [Merge1 Third-Party Connectors User Guide](https://docs.ms.merge1.globanetportal.com/Merge1%20Third-Party%20Connectors%20Twitter%20User%20Guide.pdf). -- The user who creates the YouTube connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group).+- The user who creates the YouTube connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group). - This Veritas data connector is in public preview in GCC environments in the Microsoft 365 US Government cloud. Third-party applications and services might involve storing, transmitting, and processing your organization's customer data on third-party systems that are outside of the Microsoft 365 infrastructure and therefore are not covered by the Microsoft Purview and data protection commitments. Microsoft makes no representation that use of this product to connect to third-party applications implies that those third-party applications are FEDRAMP compliant. |
| compliance | Archive Youtube Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/archive-youtube-data.md | The following overview explains the process of using a connector to archive the - Create a YouTube application to fetch data from your YouTube account. For step-by step instructions about creating the application, see [Merge1 Third-Party Connectors User Guide](https://docs.ms.merge1.globanetportal.com/Merge1%20Third-Party%20Connectors%20YouTube%20User%20Guide.pdf). -- The user who creates the YouTube connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group).+- The user who creates the YouTube connector in Step 1 (and completes it in Step 3) must be assigned the Data Connector Admin role. This role is required to add connectors on the **Data connectors** page in the compliance portal. This role is added by default to multiple role groups. For a list of these role groups, see the "Roles in the security and compliance centers" section in [Permissions in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role, and then add the appropriate users as members. For instructions, see the "Create a custom role group" section in [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md#create-a-custom-role-group). ## Step 1: Set up the YouTube connector |
| compliance | Assign Ediscovery Permissions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/assign-ediscovery-permissions.md | -If you want people to use any of the [eDiscovery-related tools](ediscovery.md) in the Microsoft Purview compliance portal, you have to assign them the appropriate permissions. The easiest way to do this is to add the person the appropriate role group on the **Permissions** page in the compliance center. This topic describes the permissions required to perform eDiscovery tasks. - +If you want people to use any of the [eDiscovery-related tools](ediscovery.md) in the Microsoft Purview compliance portal, you have to assign them the appropriate permissions. The easiest way to do this is to add the person the appropriate role group on the **Permissions** page in the compliance portal. This topic describes the permissions required to perform eDiscovery tasks. ++> [!TIP] +> You can view your own permissions on the eDiscovery (Premium) overview page in the compliance portal. You must have at least one role assigned for your permissions to be displayed. + The primary eDiscovery-related role group in compliance portal is called **eDiscovery Manager**. There are two subgroups within this role group. - **eDiscovery Manager** - An eDiscovery Manager can use eDiscovery search tools to search content locations in the organization, and perform various search-related actions such as preview and export search results. Members can also create and manage cases in Microsoft Purview eDiscovery (Standard) and Microsoft Purview eDiscovery (Premium), add and remove members to a case, create case holds, run searches associated with a case, and access case data. eDiscovery Managers can only access and manage the cases they create. They can't access or manage cases created by other eDiscovery Managers. |
| compliance | Compliance Easy Trials Compliance Playbook | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-easy-trials-compliance-playbook.md | description: "Microsoft Purview solutions trial playbook." Welcome to the Microsoft Purview solutions trial playbook. This playbook will help you make the most of your 90-day free trial by helping you discover robust and comprehensive capabilities of Microsoft Purview and security products. -Trying each solution will help you make informed decisions to meet your organizationΓÇÖs compliance needs. +Trying each solution will help you make informed decisions to meet your organization's compliance needs. Features: Optional add-ons: ## Compliance Actions with Microsoft Purview -Easily and quickly start trying MicrosoftΓÇÖs compliance solutions without changing your organizationΓÇÖs meta data. Depending on your priorities, you can start with any of these solution areas to see immediate value. Below are five top organizational concerns as communicated by our customers and recommended solutions to start with. +Easily and quickly start trying Microsoft's compliance solutions without changing your organization's meta data. Depending on your priorities, you can start with any of these solution areas to see immediate value. Below are five top organizational concerns as communicated by our customers and recommended solutions to start with. :::image type="content" source="../media/compliance-trial/workflow.png" alt-text="Compliance actions with Microsoft 365"::: ## Audit (Premium) -**Conduct investigations** +**Conduct investigations**: Microsoft Purview Audit (Premium) helps organizations to conduct forensic and compliance investigations by increasing audit log retention required to conduct an investigation, providing access to crucial events that help determine scope of compromise, and providing faster access to the Office 365 Management Activity API. -### Step 1: [Apply the E5 license to each user for which youΓÇÖd like to generate E5 events](set-up-advanced-audit.md#step-1-set-up-audit-premium-for-users) +### Step 1: [Apply the E5 license to each user for which you'd like to generate E5 events](set-up-advanced-audit.md#step-1-set-up-audit-premium-for-users) > [!TIP] > Trial best practice: Day 1 Set up Audit (Premium) for users - to verify that the Advanced Auditing app is a 1. Set up audit retention policies - [create additional audit log retention policies](set-up-advanced-audit.md#step-3-set-up-audit-retention-policies) to meet the requirements of your organization's security operations, IT, and compliance teams. 1. Search for Audit (Premium) events - [search for crucial Audit (Premium) events](set-up-advanced-audit.md#step-4-search-for-audit-premium-events) and other activities when conducting forensic investigations. -### Step 2: [Create new Audit Log policies to specify how long to retain audit logs in your org for activities performed by users and define priority levels for your policiesΓÇï](audit-log-retention-policies.md#before-you-create-an-audit-log-retention-policy) +### Step 2: [Create new Audit Log policies to specify how long to retain audit logs in your org for activities performed by users and define priority levels for your policies](audit-log-retention-policies.md#before-you-create-an-audit-log-retention-policy) > [!TIP] > Trial best practice: Create within the first 30 days Set up Audit (Premium) for users - to verify that the Advanced Auditing app is a Audit log retention policies are part of the new Audit (Premium) capabilities in Microsoft 365. An audit log retention policy lets you specify how long to retain audit logs in your organization. 1. Before you create an audit log retention policy ΓÇô [key things to know](audit-log-retention-policies.md#before-you-create-an-audit-log-retention-policy) before creating your policy.-1. [Create an audit log retention policyΓÇï](audit-log-retention-policies.md#create-an-audit-log-retention-policy) +1. [Create an audit log retention policy](audit-log-retention-policies.md#create-an-audit-log-retention-policy) 1. [Manage audit log retention policies in the Microsoft Purview compliance portal](audit-log-retention-policies.md#manage-audit-log-retention-policies-in-the-compliance-portal) - Audit log retention policies are listed on the Audit retention policies tab (also called the dashboard). You can use the dashboard to view, edit, and delete audit retention policies. 1. Create and manage audit log retention policies on PowerShell - You can also use Security & Compliance Center PowerShell to [create and manage audit log retention policies](audit-log-retention-policies.md#create-and-manage-audit-log-retention-policies-in-powershell). One reason to use PowerShell is to create a policy for a record type or activity that isn't available in the UI. ## Communication Compliance -**Identify and act on code of conduct policy violations** +**Identify and act on code of conduct policy violations**: Microsoft Purview Communication Compliance helps you intelligently identify communication violations to support a compliant and healthy work environment by helping you detect inappropriate messages, investigate possible policy violations, and take steps to remediate. Microsoft Purview Communication Compliance helps you intelligently identify comm [Assign all compliance users to the Communication Compliance role group](communication-compliance-configure.md#step-1-required-enable-permissions-for-communication-compliance). -### Step 2: [Enable the audit logΓÇï](communication-compliance-configure.md#step-2-required-enable-the-audit-log) +### Step 2: [Enable the audit log](communication-compliance-configure.md#step-2-required-enable-the-audit-log) > [!TIP] > Trial best practice: Setup within the first 30 days To use this feature, turn on auditing so your organization can start recording u ## Compliance Manager -**Manage your organizational compliance easily** +**Manage your organizational compliance easily**: Microsoft Purview Compliance Manager can help you throughout your compliance journey, from taking inventory of your data protection risks to managing the complexities of implementing controls, staying current with regulations and certifications, and reporting to auditors. Start working with assessments and taking improvement actions to implement contr > > Compliance Manager includes 300+ regulatory or premium templates that can be purchased as an add-on. See the list here. With any premium templates (included with your subscription or purchased as add-on) you will receive the universal version of those templates, allowing you to manage your compliance with any product or service -### Step 3: [Scaling up: use advanced functionality to meet your custom needsΓÇï](compliance-manager-templates-create.md) +### Step 3: [Scaling up: use advanced functionality to meet your custom needs](compliance-manager-templates-create.md) Custom assessments are helpful for: Custom assessments are helpful for: ## Data Lifecycle Management -**Govern at scale with automation** +**Govern at scale with automation**: Improve your ability to adapt to changes in your organization with policy scopes that automatically update. Automate labelling of content to reduce manual efforts and improve compliance posture. ### Step 1: Dynamically target retention policies with Adaptive Policy Scopes+ > [!TIP] > Trial best practice: Day 1 Default labels allow you to automatically apply a retention label to all items w ## Data Loss Prevention -**Protect sensitive data** +**Protect sensitive data**: To comply with business standards and industry regulations, organizations need to protect sensitive info to prevent its inadvertent disclosure. Set up Microsoft Purview Data Loss Prevention policies to identify, monitor, and automatically protect sensitive info across Microsoft 365. Microsoft Endpoint DLP allows you to monitor Windows 10 devices and detect when 1. [View Endpoint DLP alerts](dlp-configure-view-alerts-policies.md) in DLP Alerts Management dashboard. 1. [View Endpoint DLP data](data-classification-activity-explorer.md) in activity explorer. -### Step 3: [Expand policies in scope or protectionΓÇï](dlp-learn-about-dlp.md#dlp-policy-configuration-overview) +### Step 3: [Expand policies in scope or protection](dlp-learn-about-dlp.md#dlp-policy-configuration-overview) You have flexibility in how you configure your DLP policies. You can start with our default DLP policy for Teams and devices and expand those policies to protect additional locations, sensitive information types, or labels. In addition, you can expand upon the policy actions and customize alerting. You have flexibility in how you configure your DLP policies. You can start with ## eDiscovery -**Discover more with an end-to-end workflow** +**Discover more with an end-to-end workflow**: -Take advantage of an end-to-end workflow for preserving, collecting, analyzing, and exporting content thatΓÇÖs responsive to your organizationΓÇÖs internal and external investigations. Legal teams can also manage the entire legal hold notification process by communicating with custodians involved in a case. +Take advantage of an end-to-end workflow for preserving, collecting, analyzing, and exporting content that's responsive to your organization's internal and external investigations. Legal teams can also manage the entire legal hold notification process by communicating with custodians involved in a case. ### Step 1 (required): [Permissions](https://aka.ms/ediscoveryninja) Use the Content search tool in the Microsoft Purview compliance portal to quickl ## Information Protection -**Discover, classify and protect your sensitive information** +**Discover, classify and protect your sensitive information**: Implement Microsoft Purview Information Protection and sensitivity labels, to help you discover, classify, and protect your sensitive content wherever it lives or travels. When you're ready to run the policy without simulation, select the **Turn on pol ## Insider Risk Management -**Detect and remediate insider risks** +**Detect and remediate insider risks**: Leverage artificial intelligence to help you quickly identify, triage, and remediate internal risks. Using logs from Microsoft 365 and Azure services, you can define policies that monitor for insider risk signals, then take remediation actions such as promoting user education or initiating an investigation. To enable insider risk Analytics, you must be a member of the Insider Risk Manag ## Records Management -**Manage high-value items for business, legal, or regulatory record-keeping requirements** +**Manage high-value items for business, legal, or regulatory record-keeping requirements**: Use Microsoft Purview Records Management features to automate the retention schedule for organizational regulatory, legal, and business-critical records. Leverage automation capabilities from creation through collaboration, to declare records, retain contents, and dispose of them at the end. When content is declared a record, restrictions are placed on the item in terms - Create a retention label that declares content as a record or a regulatory record -### Step 2: Review content to approve before itΓÇÖs permanently deleted +### Step 2: Review content to approve before it's permanently deleted > [!TIP] > Trial best practice: Day 1 -At the end of the retention period, users you specify (ΓÇ£reviewersΓÇ¥) can be notified to review the content and approve the permanent disposal action. This supports if a different action than deletion is more appropriate, such as assigning a different retention period to the content or suspending deletion for an audit. +At the end of the retention period, users you specify ("reviewers") can be notified to review the content and approve the permanent disposal action. This supports if a different action than deletion is more appropriate, such as assigning a different retention period to the content or suspending deletion for an audit. - Create a retention label that uses disposition review Auto-applying labels removes the need for you users to manually perform the labe ### Compliance Manager premium assessments -**Assess risks and efficiently respond** +**Assess risks and efficiently respond**: Help your organization assess risks and efficiently respond to nations, regional and industry requirements governing the collection and use of data. Help your organization assess risks and efficiently respond to nations, regional ### Microsoft Priva Privacy Risk Management and Microsoft Priva Subject Rights Requests -**Identify & prevent privacy risks** +**Identify & prevent privacy risks**: Proactively identify and protect against privacy risks such as data hoarding, data transfers, and data oversharing and help your organization automate and manage subject requests at scale. Proactively identify and protect against privacy risks such as data hoarding, da ## Additional resources -**WhatΓÇÖs included**: For a full list of Microsoft Purview solutions and features listed by product tier, view the [Feature Matrix](https://go.microsoft.com/fwlink/?linkid=2139145). +**What's included**: For a full list of Microsoft Purview solutions and features listed by product tier, view the [Feature Matrix](https://go.microsoft.com/fwlink/?linkid=2139145). **Microsoft Security Technical Content Library**: Explore this library to find interactive guides and other learning content relevant to your needs. [Visit Library](/security). -**Microsoft Security Resources**: From antimalware to Zero Trust, get all the relevant resources for your organizationΓÇÖs security needs. [Visit Resources](/security/business/resources). +**Microsoft Security Resources**: From antimalware to Zero Trust, get all the relevant resources for your organization's security needs. [Visit Resources](/security/business/resources). |
| compliance | Create And Manage Inactive Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-and-manage-inactive-mailboxes.md | To view a list of the inactive mailboxes in your organization:  -4. The **Inactive mailboxes** page displays a list of inactive mailboxes. Select one to see details about that inactive mailbox. Details include how long it's been inactive, the Exchange identifier, when by whom it was put on hold. +4. The **Inactive mailboxes** page displays a list of inactive mailboxes. Select one to see details about that inactive mailbox. Details include the Exchange identifier for the mailbox and whether it's on [Litigation Hold](create-a-litigation-hold.md). + + You won't see other types of holds in the details pane, for example a Microsoft 365 retention policy or eDiscovery hold. To find this information, see [How to identify the type of hold placed on an Exchange Online mailbox](identify-a-hold-on-an-exchange-online-mailbox.md). -On the **Inactive mailboxes** page, select  **Export** to view or download a CSV file that contains additional information about the inactive mailboxes in your organization. +If you have many inactive mailboxes, you might find it easier to search and sort a CSV file for the details you see in the list: On the **Inactive mailboxes** page, select :::image type="icon" source="../media/47205c65-babd-4b3a-bd7b-98dfd92883ba.png"::: **Export**. Alternatively, you can run the following command in Exchange Online PowerShell to display the list of inactive mailboxes: |
| compliance | Customer Key Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/customer-key-overview.md | description: "In this article, you will learn about how service encryption works [!include[Purview banner](../includes/purview-rebrand-banner.md)] -Microsoft 365 provides baseline, volume-level encryption enabled through BitLocker and Distributed Key Manager (DKM). Microsoft 365 offers an added layer of encryption for your content. This content includes data from Exchange Online, Skype for Business, SharePoint Online, OneDrive for Business, and Microsoft Teams. +Microsoft 365 provides baseline, volume-level encryption enabled through BitLocker and Distributed Key Manager (DKM). Microsoft 365 offers an added layer of encryption for your content. This content includes data from Exchange Online, Skype for Business, SharePoint Online, OneDrive for Business, and Microsoft Teams. ## How service encryption, BitLocker, and Customer Key work together |
| compliance | Enhancing Mail Flow With Mta Sts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/enhancing-mail-flow-with-mta-sts.md | MTA-STS can be broken down into two scenarios: Inbound and Outbound Protection. ## Outbound Protection -All messages sent outbound from Exchange Online to MTA-STS protected recipients are being validated with these extra security checks set out by the MTA-STS standard. There's nothing admins need to do to apply it. Our outbound implementation respects the wishes of the recipient domain owners via their MTA-STS policy. MTA-STS forms part of the security infrastructure of Exchange Online, and it’s therefore always on (like other core SMTP features). +All messages sent outbound from Exchange Online to MTA-STS protected recipients are being validated with these extra security checks set out by the MTA-STS standard. There's nothing admins need to do to apply it. Our outbound implementation respects the wishes of the recipient domain owners via their MTA-STS policy. MTA-STS forms part of the security infrastructure of Exchange Online, and it's therefore always on (like other core SMTP features). ## Inbound Protection Domain owners can take action to protect emails sent to their domains with MTA-STS, if their MX record points to Exchange Online. If your MX record points to an intermediary third-party service, you'll need to check that MTA-STS requirements are met by them and follow their instructions. -Once MTA-STS is set up for your domain, any messages sent from senders who support MTA-STS will perform the validations laid out by the standard to ensure a secure connection. If you're receiving an email from a sender who doesn't support MTA-STS, the email will still be delivered without the extra protection. Likewise, there's no disruption to messages if you aren't using MTA-STS yet but the sender supports it. The only scenario where messages aren’t delivered is when both sides are using MTA-STS and MTA-STS validation fails. +Once MTA-STS is set up for your domain, any messages sent from senders who support MTA-STS will perform the validations laid out by the standard to ensure a secure connection. If you're receiving an email from a sender who doesn't support MTA-STS, the email will still be delivered without the extra protection. Likewise, there's no disruption to messages if you aren't using MTA-STS yet but the sender supports it. The only scenario where messages aren't delivered is when both sides are using MTA-STS and MTA-STS validation fails. ## How To Adopt MTA-STS -MTA-STS allows a domain to declare support for TLS and communicate the MX record and destination certificate to expect. It also indicates what a sending server should do if there’s a problem. This is done through a combination of a DNS TXT record and a policy file that’s published as an HTTPS web page. The HTTPS-protected policy introduces another security protection that attackers must overcome. +MTA-STS allows a domain to declare support for TLS and communicate the MX record and destination certificate to expect. It also indicates what a sending server should do if there's a problem. This is done through a combination of a DNS TXT record and a policy file that's published as an HTTPS web page. The HTTPS-protected policy introduces another security protection that attackers must overcome. A domain's MTA-STS TXT record indicates MTA-STS support to a sender, after which the domain's HTTPS-based MTA-STS policy is retrieved by the sender. The following TXT record is an example that declares support for MTA-STS: -`_mta-sts.contoso.com. 3600 IN  TXT v=STSv1; id=20220101000000Z;` +`_mta-sts.contoso.com. 3600 IN TXT v=STSv1; id=20220101000000Z;` -A domain's MTA-STS policy needs to be located at a predefined URL that’s hosted by the domain's web infrastructure. The URL syntax is `https://mta-sts.<domain name>/.well-known/mta-sts.txt`. For example, Microsoft.com's policy is found at: https://mta-sts.microsoft.com/.well-known/mta-sts.txt. +A domain's MTA-STS policy needs to be located at a predefined URL that's hosted by the domain's web infrastructure. The URL syntax is `https://mta-sts.<domain name>/.well-known/mta-sts.txt`. For example, Microsoft.com's policy is found at: <https://mta-sts.microsoft.com/.well-known/mta-sts.txt>. -``` +```text version: STSv1 mode: enforce mx: *.mail.protection.outlook.com Any customer whose MX records point directly to Exchange Online can specify in t These policies aren't something that Exchange Online can host on behalf of customers and customers should make use of the web hosting service they use. The policy needs to be protected by HTTPS with a certificate for the subdomain `mta-sts.<domain name>`. There are alternatives to hosting a policy including [this solution](https://github.com/jpawlowski/mta-sts.template) that uses GitHub Pages to host it. -Once the DNS TXT domain record is created and the policy file is available at the required HTTPS URL, the domain will be protected by MTA-STS. Details about MTA-STS are available in [RFC 8461](https://datatracker.ietf.org/doc/html/rfc8461). +Once the DNS TXT domain record is created and the policy file is available at the required HTTPS URL, the domain will be protected by MTA-STS. Details about MTA-STS are available in [RFC 8461](https://datatracker.ietf.org/doc/html/rfc8461). |
| compliance | File Plan Manager | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/file-plan-manager.md | For information about what retention labels are and how to use them, see [Learn To access file plan, you must have one of the following admin roles: - Retention Manager- - View-only Retention Manager -In the [Microsoft Purview compliance portal](https://compliance.microsoft.com/), go to **Solutions** > **Records management** > **File plan**. +In the [Microsoft Purview compliance portal](https://compliance.microsoft.com/), go to **Solutions** > **Records management** > **File plan**: ++. If **Records management** doesn't display in the navigation pane, first scroll down, and select **Show all**. However, it can take up to two days for content explorer to show the items that From your file plan, you can export the details of all retention labels into a .csv file to help you facilitate periodic compliance reviews with data governance stakeholders in your organization. -To export all retention labels: On the **File plan** page, click **Export**. +To export all retention labels: On the **File plan** page, select **Export**: ++ A *.csv file that contains all existing retention labels opens. For example: A *.csv file that contains all existing retention labels opens. For example: In file plan, you can bulk-import new retention labels by using a .csv file with a specific format: -1. On the **File plan** page, click **Import**: +1. On the **File plan** page, select **Import**:  2. On the **Fill out and import your file plan** pane, select **Download a blank template**: |
| compliance | Information Barriers Attributes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/information-barriers-attributes.md | -Certain attributes in Azure Active Directory can be used to segment users. Once segments are defined, those segments can be used as filters for information barrier policies. For example, you might use **Department** to define segments of users by department within your organization (assuming no single employee works for two departments at the same time). +Certain attributes in Azure Active Directory can be used to segment users in information barriers (IB). Once segments are defined, those segments can be used as filters for IB policies. For example, you might use **Department** to define segments of users by department within your organization (assuming no single employee works for two departments at the same time). This article describes how to use attributes with information barriers, and it provides a list of attributes that can be used. To learn more about information barriers, see the following resources: - [Information barriers](information-barriers.md) - [Define policies for information barriers in Microsoft Teams](information-barriers-policies.md)-- [Edit (or remove) information barrier policies](information-barriers-edit-segments-policies.md)+- [Edit (or remove) IB policies](information-barriers-edit-segments-policies.md) -## How to use attributes in information barrier policies +## How to use attributes in IB policies -The attributes listed in this article can be used to define or edit segments of users. Your defined segments serve as parameters (called *UserGroupFilter* values) in [information barrier policies](information-barriers-policies.md). +The attributes listed in this article can be used to define or edit segments of users. Your defined segments serve as parameters (called *UserGroupFilter* values) in [IB policies](information-barriers-policies.md). 1. Determine which attribute you want to use to define segments. (See the [Reference](#reference) section in this article.) |
| compliance | Information Barriers Edit Segments Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/information-barriers-edit-segments-policies.md | Title: "Manage information barrier policies" + Title: "Manage information barriers policies" description: "Learn how to edit or remove policies for information barriers." keywords: Microsoft 365, Microsoft Purview, compliance, information barriers f1.keywords: [!include[Purview banner](../includes/purview-rebrand-banner.md)] -After you have [defined information barrier policies](information-barriers-policies.md), you may need to make changes to those policies or to your user segments, as part of [troubleshooting](/office365/troubleshoot/information-barriers/information-barriers-troubleshooting) or as regular maintenance. +After you have [defined information barriers (IB) policies](information-barriers-policies.md), you may need to make changes to those policies or to your user segments, as part of [troubleshooting](/office365/troubleshoot/information-barriers/information-barriers-troubleshooting) or as regular maintenance. ## What do you want to do? Use this procedure edit the definition of a user segment. For example, you might |:|:-| | `Set-OrganizationSegment -Identity GUID -UserGroupFilter "attribute -eq 'attributevalue'"` |`Set-OrganizationSegment -Identity c96e0837-c232-4a8a-841e-ef45787d8fcd -UserGroupFilter "Department -eq 'HRDept'"` <br> In this example, we updated the department name to *HRDept* for the segment with GUID *c96e0837-c232-4a8a-841e-ef45787d8fcd*. | -3. When you have finished editing segments for your organization, you can either [define](information-barriers-policies.md#step-3-define-information-barrier-policies) or [edit](#edit-a-policy) information barriers policies. +3. When you have finished editing segments for your organization, you can either [define](information-barriers-policies.md#step-3-create-ib-policies) or [edit](#edit-a-policy) information barriers policies. ## Edit a policy Use this procedure edit the definition of a user segment. For example, you might In this example, we changed *SegmentsBlocked* to *SegmentsAllowed* and specified the *HR* segment. -3. When you have finished editing a policy, make sure to apply your changes. (See [Apply information barriers policies](information-barriers-policies.md#step-4-apply-information-barrier-policies).) +3. When you have finished editing a policy, make sure to apply your changes. (See [Apply information barriers policies](information-barriers-policies.md#step-4-apply-ib-policies).) ## Set a policy to inactive status After you have started applying information barriers policies, if you want to st - [Learn more about information barriers in Microsoft Teams](/MicrosoftTeams/information-barriers-in-teams) - [Learn more about information barriers in SharePoint Online](/sharepoint/information-barriers) - [Learn more about information barriers in OneDrive](/onedrive/information-barriers)-- [Attributes for information barrier policies](information-barriers-attributes.md)+- [Attributes for IB policies](information-barriers-attributes.md) - [Troubleshooting information barriers](/office365/troubleshoot/information-barriers/information-barriers-troubleshooting) |
| compliance | Information Barriers Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/information-barriers-policies.md | -This article describes how to configure information barrier (IB) policies in your organization. Several steps are involved, so make sure you review the entire process before you begin configuring IB policies. +This article describes how to configure information barriers (IB) policies in your organization. Several steps are involved, so make sure you review the entire process before you begin configuring IB policies. -You must be familiar with [PowerShell cmdlets](/powershell/exchange/scc-powershell) in order to define, validate, or edit IB policies. Although we provide several examples of PowerShell cmdlets in this article, you'll need to know other details (such as parameter values) for your organization. +You'll configure IB in your organization using the [Microsoft Purview compliance portal](https://compliance.microsoft.com) or by using [Office 365 Security and Compliance PowerShell](/powershell/exchange/scc-powershell). For organizations configuring IB for the first time, we recommend using the **Information barriers** solution in the compliance portal. If you're managing an existing IB configuration and you're comfortable using PowerShell, you still have this option. For more information about IB scenarios and features, see [Learn about information barriers](information-barriers.md). To learn more about roles and permissions, see [Permissions in the Office 365 Se ## Configuration concepts -When you define policies for IB, you'll work with several objects and concepts. +When you configure IB, you'll work with several objects and concepts. -- **User account attributes** are defined in Azure Active Directory (or Exchange Online). These attributes can include department, job title, location, team name, and other job profile details.-- **Segments** are sets of users that are defined in the Microsoft Purview compliance portal using a selected **user account attribute**. See the list of [IB supported attributes](information-barriers-attributes.md) for details.-- **Visibility of non-IB users and groups**. Non-IB users and groups are users and groups excluded from IB segments and policies. Depending on the type of IB policies (block or allow), the behavior for these users and group will differ in Microsoft Teams, SharePoint, OneDrive, and in your global address list. For users defined in *allow* policies, non-IB groups and users won't be visible to users included in IB segments and policies. For users defined in *block* policies, non-IB groups and users will be visible to users included in IB segments and policies.-- **Group support**. Only Modern Groups are currently supported in IB and Distribution Lists/Security Groups are treated as non-IB groups.-- **Hidden/disabled user accounts**. For hidden/disabled accounts in your organization, the *HiddenFromAddressListEnabled* parameter is automatically set to *True* when the users accounts are hidden or disabled. In IB-enabled organizations, these accounts are prevented from communicating with all other user accounts. In Microsoft Teams, all chats including these accounts are locked or the users are automatically removed from conversations.-- **IB policies** determine communication limits or restrictions. When you define information barrier policies, you choose from two kinds of policies:+- **User account attributes** are defined in Azure Active Directory (or Exchange Online). These attributes can include department, job title, location, team name, and other job profile details. You'll assign users or groups to segments with these attributes. +- **Segments** are sets of groups or users that are defined in the compliance portal or by using PowerShell that use selected group or user account attributes. See the list of [IB supported attributes](information-barriers-attributes.md) for details. +- **IB policies** determine communication limits or restrictions. When you define IB policies, you choose from two kinds of policies: - *Block* policies prevent one segment from communicating with another segment. - *Allow* policies allow one segment to communicate with only certain other segments. > [!NOTE]- > For **allow** policies, non-IB groups and users will not be visible to users included in IB segments and policies. If you need non-IB groups and users to be visible to users included in IB segments and policies, you must use **block** policies. + > For *allow* policies, non-IB groups and users will not be visible to users included in IB segments and policies. If you need non-IB groups and users to be visible to users included in IB segments and policies, you must use *block* policies. -- *Policy application* is done after all IB policies are defined, and you're ready to apply them in your organization.+- **Policy application** is done after all IB policies are defined, and you're ready to apply them in your organization. +- **Visibility of non-IB users and groups**. Non-IB users and groups are users and groups excluded from IB segments and policies. Depending on the type of IB policies (block or allow), the behavior for these users and group will differ in Microsoft Teams, SharePoint, OneDrive, and in your global address list. For users defined in *allow* policies, non-IB groups and users won't be visible to users included in IB segments and policies. For users defined in *block* policies, non-IB groups and users will be visible to users included in IB segments and policies. +- **Group support**. Only Modern Groups are currently supported in IB and Distribution Lists/Security Groups are treated as non-IB groups. +- **Hidden/disabled user accounts**. For hidden/disabled accounts in your organization, the *HiddenFromAddressListEnabled* parameter is automatically set to *True* when the users accounts are hidden or disabled. In IB-enabled organizations, these accounts are prevented from communicating with all other user accounts. In Microsoft Teams, all chats including these accounts are locked or the users are automatically removed from conversations. -## Configuration at a glance +## Configuration overview | **Steps** | **What's involved** | |:|:-|-| **Step 1**: [Make sure prerequisites are met](#step-1-make-sure-prerequisites-are-met) | - Verify that you have the required subscriptions and permissions <br/>- Verify that your directory includes data for segmenting users<br/>- Enable [search by name for Microsoft Teams](/microsoftteams/teams-scoped-directory-search)<br/>- Make sure audit logging is turned on<br/>- Make sure no Exchange address book policies are in place<br/>- Use PowerShell (examples are provided)<br/>- Provide admin consent for Microsoft Teams (steps are included) | +| **Step 1**: [Make sure prerequisites are met](#step-1-make-sure-prerequisites-are-met) | - Verify that you have the required subscriptions and permissions <br/>- Verify that your directory includes data for segmenting users<br/>- Enable [search by name for Microsoft Teams](/microsoftteams/teams-scoped-directory-search)<br/>- Make sure audit logging is turned on<br/>- Make sure no Exchange address book policies are in place <br/>- Provide admin consent for Microsoft Teams (steps are included) | | **Step 2**: [Segment users in your organization](#step-2-segment-users-in-your-organization) | - Determine what policies are needed<br/>- Make a list of segments to define<br/>- Identify which attributes to use<br/>- Define segments in terms of policy filters |-| **Step 3**: [Define information barrier policies](#step-3-define-information-barrier-policies) | - Define your policies (don't apply yet)<br/>- Choose from two kinds (block or allow) | -| **Step 4**: [Apply information barrier policies](#step-4-apply-information-barrier-policies) | - Set policies to active status<br/>- Run the policy application<br/>- View policy status | +| **Step 3**: [Create information barriers policies](#step-3-create-ib-policies) | - Create your policies (don't apply yet)<br/>- Choose from two kinds (block or allow) | +| **Step 4**: [Apply information barriers policies](#step-4-apply-ib-policies) | - Set policies to active status<br/>- Run the policy application<br/>- View policy status | | **Step 5**: [Configuration for information barriers on SharePoint and OneDrive (optional)](#step-5-configuration-for-information-barriers-on-sharepoint-and-onedrive) | - Configure IB for SharePoint and OneDrive | | **Step 6**: [Information barriers modes (optional)](#step-6-information-barriers-modes) | - Update IB modes if applicable | When you define policies for IB, you'll work with several objects and concepts. In addition to the required subscriptions and permissions, make sure that the following requirements are met before configuring IB: - **Directory data**: Make sure that your organization's structure is reflected in directory data. To take this action, make sure that user account attributes (such as group membership, department name, etc.) are populated correctly in Azure Active Directory (or Exchange Online). To learn more, see the following resources:- - [Attributes for information barrier policies](information-barriers-attributes.md) + - [Attributes for information barriers policies](information-barriers-attributes.md) - [Add or update a user's profile information using Azure Active Directory](/azure/active-directory/fundamentals/active-directory-users-profile-azure-portal) - [Configure user account properties with Office 365 PowerShell](../enterprise/configure-user-account-properties-with-microsoft-365-powershell.md) In addition to the required subscriptions and permissions, make sure that the fo - **Remove existing Exchange Online address book policies**: Before you define and apply IB policies, you must remove all existing Exchange Online address book policies in your organization. IB policies are based on address book policies and existing ABPs policies aren't compatible with the ABPs created by IB. To remove your existing address book policies, see [Remove an address book policy in Exchange Online](/exchange/address-books/address-book-policies/remove-an-address-book-policy). For more information about IB policies and Exchange Online, see [Information barriers and Exchange Online](information-barriers.md#information-barriers-and-exchange-online). -- **Manage using PowerShell**: Currently, IB policies are defined and managed in Security & Compliance Center PowerShell. Although several examples are provided in this article, you'll need to be familiar with PowerShell cmdlets and parameters. You'll also need the Azure Active Directory PowerShell module.- - [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) +- **Manage using PowerShell (optional)**: IB segments and policies can be defined and managed in Office 365 Security & Compliance PowerShell. Although several examples are provided in this article, you'll need to be familiar with PowerShell cmdlets and parameters if you choose to use PowerShell to configure and manage IB segments and policies. You'll also need the Azure Active Directory PowerShell module if you choose this configuration option. + - [Connect to Security & Compliance PowerShell](/powershell/exchange/connect-to-scc-powershell) - [Install Azure Active Directory PowerShell for Graph](/powershell/azure/active-directory/install-adv2) - **Admin consent for IB in Microsoft Teams**: When your IB policies are in place, they can remove non-IB compliance users from Groups (for example, Teams channels, which are based on groups). This configuration helps ensure your organization remains compliant with policies and regulations. Use the following procedure to enable IB policies to work as expected in Microsoft Teams. 1. Prerequisite: [Install Azure Active Directory PowerShell for Graph](/powershell/azure/active-directory/install-adv2). - 1. Run the following PowerShell cmdlets: + 2. Run the following PowerShell cmdlets: ```powershell Connect-AzureAD -Tenant "<yourtenantdomain.com>" //for example: Connect-AzureAD -Tenant "Contoso.onmicrosoft.com" In addition to the required subscriptions and permissions, make sure that the fo Start-Process "https://login.microsoftonline.com/common/adminconsent?client_id=$appId" ``` - 1. When prompted, sign in using your work or school account for Office 365. -- 1. In the **Permissions requested** dialog box, review the information, and then choose **Accept**. The permissions requested by the App are given below. + 3. When prompted, sign in using your work or school account for Office 365. - > [!div class="mx-imgBorder"] - >  + 4. In the **Permissions requested** dialog box, review the information, and then choose **Accept**. When all the prerequisites are met, proceed to the next step. ## Step 2: Segment users in your organization -During this step, you determine what IB policies are needed, make a list of segments to define, and then define your segments. +In this step, you'll determine what IB policies are needed, make a list of segments to define, and define your segments. Defining segments doesn't affect users, it just sets the stage for IB policies to be defined and then applied. ### Determine what policies are needed Determine which attributes in your organization's directory data you'll use to d > [!IMPORTANT] > **Before you proceed to the next section, make sure your directory data has values for attributes that you can use to define segments**. If your directory data does not have values for the attributes you want to use, then the user accounts must be updated to include that information before you proceed with configuring IB. To get help with this, see the following resources:<br/>- [Configure user account properties with Office 365 PowerShell](../enterprise/configure-user-account-properties-with-microsoft-365-powershell.md)<br/>- [Add or update a user's profile information using Azure Active Directory](/azure/active-directory/fundamentals/active-directory-users-profile-azure-portal) +### Define segments using the compliance portal ++To define segments in the compliance portal, complete the following steps: ++1. Sign into the [compliance portal](https://compliance.microsoft.com) using credentials for an admin account in your organization. +2. In the compliance portal, select **Information barriers** > **Segments**. +3. On the **Segments** page, select **New segment** to create and configure a new segment. +4. On the **Name** page, enter a name for the segment. You can't rename a segment once it's created. +5. Select **Next**. +6. On the **User group filter** page, select **Add** to configure the group and user attributes for the segment. Choose an attribute for the segment from the list of available attributes. +7. For the selected attribute, select either *Equal* or *Not equal* and then enter the value for the attribute. For example, if you selected *Department* as the attribute and *Equals*, you could enter *Marketing* as the defined *Department* for this segment condition. You can add additional conditions for an attribute by selecting **Add condition**. If you need to delete an attribute or attribute condition, select the delete icon for the attribute or condition. +8. Add additional attributes as needed on the **User group filter** page, then select **Next**. +9. On the **Review your settings** page, review the settings you've chosen for the segment and any suggestions or warnings for your selections. Select **Edit** to change any of the segment attributes and conditions or select **Submit** to create the segment. ++ > [!IMPORTANT] + > **Make sure that your segments do not overlap**. Each user who will be affected by IB policies should belong to one (and only one) segment. No user should belong to two or more segments. See [Example: Contoso's defined segments](#contosos-defined-segments) in this article for an example scenario. + ### Define segments using PowerShell -The next task is to define segments for your organization. Defining segments doesn't affect users, it just sets the stage for IB policies to be defined and then applied. +To define segments with PowerShell, complete the following steps: 1. Use the **New-OrganizationSegment** cmdlet with the **UserGroupFilter** parameter that corresponds to the [attribute](information-barriers-attributes.md) you want to use. | Syntax | Example | |:|:-|- | `New-OrganizationSegment -Name "segmentname" -UserGroupFilter "attribute -eq 'attributevalue'"` |`New-OrganizationSegment -Name "HR" -UserGroupFilter "Department -eq 'HR'"` <p>In this example, a segment called *HR* is defined using *HR*, a value in the *Department* attribute. The **-eq** portion of the cmdlet refers to "equals." (Alternately, you can use **-ne** to mean "not equals". See [Using "equals" and "not equals" in segment definitions](#using-equals-and-not-equals-in-segment-definitions).) | + | `New-OrganizationSegment -Name "segmentname" -UserGroupFilter "attribute -eq 'attributevalue'"` |`New-OrganizationSegment -Name "HR" -UserGroupFilter "Department -eq 'HR'"` <p>In this example, a segment called *HR* is defined using *HR*, a value in the *Department* attribute. The **-eq** portion of the cmdlet refers to "equals." (Alternately, you can use **-ne** to mean "not equals". See [Using "equals" and "not equals" in segment definitions](#using-equals-and-not-equals-in-powershell-segment-definitions).) | After you run each cmdlet, you should see a list of details about the new segment. Details include the segment's type, who created or last modified it, and so on. The next task is to define segments for your organization. Defining segments doe > [!IMPORTANT] > **Make sure that your segments do not overlap**. Each user who will be affected by IB policies should belong to one (and only one) segment. No user should belong to two or more segments. See [Example: Contoso's defined segments](#contosos-defined-segments) in this article for an example scenario. -After you've defined your segments, proceed to [Step 3: Define information barrier policies](#step-3-define-information-barrier-policies). +After you've defined your segments, proceed to [Step 3: Create IB policies](#step-3-create-ib-policies). -### Using "equals" and "not equals" in segment definitions +### Using "equals" and "not equals" in PowerShell segment definitions -In the following example, we're defining a segment such that "Department equals HR." +In the following example, we're configuring IB segments using PowerShell and defining a segment such that 'Department equals HR'. | Example | Note | |:-|:-| In addition to defining segments using "equals" or "not equals", you can define > [!TIP] > If possible, use segment definitions that include "-eq" or "-ne". Try not to define complex segment definitions. -## Step 3: Define information barrier policies +## Step 3: Create IB policies -Determine whether you need to prevent communications between certain segments or limit communications to certain segments. Ideally, you'll use the minimum number of IB policies to ensure your organization is compliant with internal, legal, and industry requirements. +When you create your IB policies, you'll determine whether you need to prevent communications between certain segments or limit communications to certain segments. Ideally, you'll use the minimum number of IB policies to ensure your organization is compliant with internal, legal, and industry requirements. You can use the compliance portal or PowerShell to create and apply IB policies. > [!TIP] > For user experience consistency, we recommend using Block policies for most scenarios if possible. With your list of user segments and the IB policies you want to define, select a - [Scenario 2: Allow a segment to communicate only with one other segment](#scenario-2-allow-a-segment-to-communicate-only-with-one-other-segment) > [!IMPORTANT]-> **Make sure that as you define policies, you do not assign more than one policy to a segment**. For example, if you define one policy for a segment called *Sales*, do not define an additional policy for *Sales*.<p> In addition, as you define IB policies, make sure to set those policies to inactive status until you are ready to apply them. Defining (or editing) policies does not affect users until those policies are set to active status and then applied. +> **Make sure that as you define policies, you do not assign more than one policy to a segment**. For example, if you define one policy for a segment called *Sales*, do not define an additional policy for the *Sales* segment.<br> In addition, as you define IB policies, make sure to set those policies to inactive status until you are ready to apply them. Defining (or editing) policies does not affect users until those policies are set to active status and then applied. ### Scenario 1: Block communications between segments When you want to block segments from communicating with each other, you define two policies: one for each direction. Each policy blocks communication in one direction only. -For example, suppose you want to block communications between Segment A and Segment B. In this case, you define one policy preventing Segment A from communicating with Segment B, and then define a second policy to prevent Segment B from communicating with Segment A. +For example, suppose you want to block communications between Segment A and Segment B. In this case, you'd define two policies: ++- One policy preventing Segment A from communicating with Segment B +- A second policy to prevent Segment B from communicating with Segment A ++#### Create policies using the compliance portal for Scenario 1 ++To define policies in the compliance portal, complete the following steps: ++1. Sign into the [compliance portal](https://compliance.microsoft.com) using credentials for an admin account in your organization. +2. In the compliance portal, select **Information barriers** > **Policies**. +3. On the **Policies** page, select **Create policy** to create and configure a new IB policy. +4. On the **Name** page, enter a name for the policy, then select **Next**. +5. On the **Assigned segment** page, select **Choose segment**. Use the search box to search for a segment by name or scroll to select the segment from the displayed list. Select **Add** to add the selected segment to the policy. You can only select one segment. +6. Select **Next**. +7. On the **Communication and collaboration** page, select the policy type in the **Communication and collaboration** field. The policy options are either *Allowed* or *Blocked*. In this example scenario, *Blocked* would be selected for the first policy. ++ >[!IMPORTANT] + >The Allowed and Blocked status for segments can't be changed after creating a policy. To change the status after you create a policy, you must delete the policy and create a new one. ++8. Select **Choose segment** to define the actions for the target segment. You can assign more than one segment in this step. For example, if you wanted to block users in a segment called *Sales* from communicating with users in a segment called *Research*, you would have defined the *Sales* segment in Step 5 and you would assign *Research* in the **Choose segment** option in this step. +9. Select **Next**. +10. On the **Policy status** page, toggle the active policy status to **On**. Select **Next** to continue. +11. On the **Review your settings** page, review the settings you've chosen for the policy and any suggestions or warnings for your selections. Select **Edit** to change any of the policy segments and status or select **Submit** to create the policy. ++In this example, you would repeat the previous steps to create a second *Block* policy to restrict to block users in a segment called *Research* from communicating with users in a segment called *Sales*. You would have defined the *Research* segment in Step 5 and you would assign *Sales* (or multiple segments) in the **Choose segment** option. ++#### Create policies using PowerShell for Scenario 1 ++To define policies with PowerShell, complete the following steps: 1. To define your first blocking policy, use the **New-InformationBarrierPolicy** cmdlet with the **SegmentsBlocked** parameter. For example, suppose you want to block communications between Segment A and Segm 3. Proceed to one of the following actions: - (If needed) [Define a policy to allow a segment to communicate only with one other segment](#scenario-2-allow-a-segment-to-communicate-only-with-one-other-segment) - - (After all your policies are defined) [Apply information barrier policies](#step-4-apply-information-barrier-policies) + - (After all your policies are defined) [Apply IB policies](#step-4-apply-ib-policies) ### Scenario 2: Allow a segment to communicate only with one other segment When you want to allow a segment to communicate with only one other segment, you define only one policy for that segment. The segment that is being communicated with doesn't require a similar directional policy (because they can communicate and collaborate with everyone by default). +#### Create a policy using the compliance portal for Scenario 2 ++To define policies in the compliance portal, complete the following steps: ++1. Sign into the [compliance portal](https://compliance.microsoft.com) using credentials for an admin account in your organization. +2. In the compliance portal, select **Information barriers** > **Policies**. +3. On the **Policies** page, select **Create policy** to create and configure a new IB policy. +4. On the **Name** page, enter a name for the policy, then select **Next**. +5. On the **Assigned segment** page, select **Choose segment**. Use the search box to search for a segment by name or scroll to select the segment from the displayed list. Select **Add** to add the selected segment to the policy. You can only select one segment. +6. Select **Next**. +7. On the **Communication and collaboration** page, select the policy type in the **Communication and collaboration** field. The policy options are either *Allowed* or *Blocked*. In this example scenario, *Allowed* would be selected for the policy. ++ >[!IMPORTANT] + >The Allowed and Blocked status for segments can't be changed after creating a policy. To change the status after you create a policy, you must delete the policy and create a new one. ++8. Select **Choose segment** to define the actions for the target segment. You can assign more than one segment in this step. For example, if you wanted to allow users in a segment called *Manufacturing* to communicate with users in a segment called *HR*, you would have defined the *Manufacturing* segment in Step 5 and you would assign *HR* in the **Choose segment** option in this step. +9. Select **Next**. +10. On the **Policy status** page, toggle the active policy status to **On**. Select **Next** to continue. +11. On the **Review your settings** page, review the settings you've chosen for the policy and any suggestions or warnings for your selections. Select **Edit** to change any of the policy segments and status or select **Submit** to create the policy. ++#### Create a policy using PowerShell for Scenario 2 ++To define policies with PowerShell, complete the following steps: + 1. To allow one segment to communicate with only one other segment, use the **New-InformationBarrierPolicy** cmdlet with the **SegmentsAllowed** parameter. | Syntax | Example | When you want to allow a segment to communicate with only one other segment, you 2. Proceed to one of the following actions: - (If needed) [Define a policy to block communications between segments](#scenario-1-block-communications-between-segments) - - (After all your policies are defined) [Apply information barrier policies](#step-4-apply-information-barrier-policies) + - (After all your policies are defined) [Apply IB policies](#step-4-apply-ib-policies) -## Step 4: Apply information barrier policies +## Step 4: Apply IB policies IB policies aren't in effect until you set them to active status and apply the policies. +### Apply policies using the compliance portal ++To apply policies in the compliance portal, complete the following steps: ++1. Sign into the [compliance portal](https://compliance.microsoft.com) using credentials for an admin account in your organization. +2. In the compliance portal, select **Information barriers** > **Policy application**. +3. On the **Policies application** page, select **Apply all policies** to apply all IB policies in your organization. ++ >[!NOTE] + >Allow 30 minutes for the system to start applying the policies. The system applies policies user by user. The system processes about 5,000 user accounts per hour. ++### Apply policies using PowerShell ++To apply policies using PowerShell, complete the following steps: + 1. Use the **Get-InformationBarrierPolicy** cmdlet to see a list of policies that have been defined. Note the status and identity (GUID) of each policy. Syntax: `Get-InformationBarrierPolicy` IB policies aren't in effect until you set them to active status and apply the p Repeat this step as appropriate for each policy. -3. When you have finished setting your IB policies to active status, use the **Start-InformationBarrierPoliciesApplication** cmdlet in Security & Compliance Center PowerShell. +3. When you have finished setting your IB policies to active status, use the **Start-InformationBarrierPoliciesApplication** cmdlet in Security & Compliance PowerShell. Syntax: `Start-InformationBarrierPoliciesApplication` With PowerShell, you can view status of user accounts, segments, policies, and p | To view this information | Take this action | |:|:-|-| User accounts | Use the **Get-InformationBarrierRecipientStatus** cmdlet with Identity parameters. <p> Syntax: `Get-InformationBarrierRecipientStatus -Identity <value> -Identity2 <value>` <p> You can use any value that uniquely identifies each user, such as name, alias, distinguished name, canonical domain name, email address, or GUID. <p> Example: `Get-InformationBarrierRecipientStatus -Identity meganb -Identity2 alexw` <p> In this example, we refer to two user accounts in Office 365: *meganb* for *Megan*, and *alexw* for *Alex*. <p> (You can also use this cmdlet for a single user: `Get-InformationBarrierRecipientStatus -Identity <value>`) <p> This cmdlet returns information about users, such as attribute values and any information barrier policies that are applied.| +| User accounts | Use the **Get-InformationBarrierRecipientStatus** cmdlet with Identity parameters. <p> Syntax: `Get-InformationBarrierRecipientStatus -Identity <value> -Identity2 <value>` <p> You can use any value that uniquely identifies each user, such as name, alias, distinguished name, canonical domain name, email address, or GUID. <p> Example: `Get-InformationBarrierRecipientStatus -Identity meganb -Identity2 alexw` <p> In this example, we refer to two user accounts in Office 365: *meganb* for *Megan*, and *alexw* for *Alex*. <p> (You can also use this cmdlet for a single user: `Get-InformationBarrierRecipientStatus -Identity <value>`) <p> This cmdlet returns information about users, such as attribute values and any IB policies that are applied.| | Segments | Use the **Get-OrganizationSegment** cmdlet.<p> Syntax: `Get-OrganizationSegment` <p> This cmdlet will display a list of all segments defined for your organization. |-| Information barrier policies | Use the **Get-InformationBarrierPolicy** cmdlet. <p> Syntax: `Get-InformationBarrierPolicy` <p> This cmdlet will display a list of information barrier policies that were defined, and their status. | -| The most recent information barrier policy application | Use the **Get-InformationBarrierPoliciesApplicationStatus** cmdlet. <p> Syntax: `Get-InformationBarrierPoliciesApplicationStatus`<p> This cmdlet will display information about whether policy application completed, failed, or is in progress. | -| All information barrier policy applications|Use `Get-InformationBarrierPoliciesApplicationStatus -All`<p> This cmdlet will display information about whether policy application completed, failed, or is in progress.| +| IB policies | Use the **Get-InformationBarrierPolicy** cmdlet. <p> Syntax: `Get-InformationBarrierPolicy` <p> This cmdlet will display a list of IB policies that were defined, and their status. | +| The most recent IB policy application | Use the **Get-InformationBarrierPoliciesApplicationStatus** cmdlet. <p> Syntax: `Get-InformationBarrierPoliciesApplicationStatus`<p> This cmdlet will display information about whether policy application completed, failed, or is in progress. | +| All IB policy applications|Use `Get-InformationBarrierPoliciesApplicationStatus -All`<p> This cmdlet will display information about whether policy application completed, failed, or is in progress.| ### What if I need to remove or change policies? The following IB modes are supported on Microsoft 365 resources: |:--|:|:--| | **Open** | There aren't any IB policies or segments associated with the Microsoft 365 resource. Anyone can be invited to be a member of the resource. | A team site created for picnic event for your organization. | | **Owner Moderated (preview)** | The IB policy of the Microsoft 365 resource is determined from the resource owner's IB policy. The resource owners can invite any user to the resource based on their IB policies. This mode is useful when your company wants to allow collaboration among incompatible segment users that are moderated by the owner. Only the resource owner can add new members per their IB policy. | The VP of HR wants to collaborate with the VPs of Sales and Research. A new SharePoint site that is set with IB mode *Owner Moderated* to add both Sales and Research segment users to the same site. It's the responsibility of the owner to ensure appropriate members are added to the resource. |-| **Implicit** | The IB policy or segments of the Microsoft 365 resource is inherited from the resource members IB policy. The owner can add members as long as they're compatible with the existing members of the resource. This is the default IB mode for Microsoft Teams. | The Sales segment user creates a Microsoft Teams team to collaborate with other compatible segments in the organization. | +| **Implicit** | The IB policy or segments of the Microsoft 365 resource is inherited from the resource members IB policy. The owner can add members as long as they're compatible with the existing members of the resource. This mode is the default IB mode for Microsoft Teams. | The Sales segment user creates a Microsoft Teams team to collaborate with other compatible segments in the organization. | | **Explicit** | The IB policy of the Microsoft 365 resource is per the segments associated with the resource. The resource owner or SharePoint administrator has the ability to manage the segments on the resource. | A site created only for Sales segment members to collaborate by associating the Sales segment with the site. | For more information about IB modes and how they're configured across services, see the following articles: Contoso will use the Department attribute in Azure Active Directory to define se With the segments defined, Contoso proceeds to define the IB policies. -### Contoso's information barrier policies +### Contoso's IB policies Contoso defines three IB policies, as described in the following table: | Policy | Policy Definition | |:|:--|-| **Policy 1: Prevent Sales from communicating with Research** | `New-InformationBarrierPolicy -Name "Sales-Research" -AssignedSegment "Sales" -SegmentsBlocked "Research" -State Inactive` <p> In this example, the information barrier policy is called *Sales-Research*. When this policy is active and applied, it will help prevent users who are in the Sales segment from communicating with users in the Research segment. This policy is a one-way policy; it won't prevent Research from communicating with Sales. For that, Policy 2 is needed. | -| **Policy 2: Prevent Research from communicating with Sales** | `New-InformationBarrierPolicy -Name "Research-Sales" -AssignedSegment "Research" -SegmentsBlocked "Sales" -State Inactive` <p> In this example, the information barrier policy is called *Research-Sales*. When this policy is active and applied, it will help prevent users who are in the Research segment from communicating with users in the Sales segment. | +| **Policy 1: Prevent Sales from communicating with Research** | `New-InformationBarrierPolicy -Name "Sales-Research" -AssignedSegment "Sales" -SegmentsBlocked "Research" -State Inactive` <p> In this example, the IB policy is called *Sales-Research*. When this policy is active and applied, it will help prevent users who are in the Sales segment from communicating with users in the Research segment. This policy is a one-way policy; it won't prevent Research from communicating with Sales. For that, Policy 2 is needed. | +| **Policy 2: Prevent Research from communicating with Sales** | `New-InformationBarrierPolicy -Name "Research-Sales" -AssignedSegment "Research" -SegmentsBlocked "Sales" -State Inactive` <p> In this example, the IB policy is called *Research-Sales*. When this policy is active and applied, it will help prevent users who are in the Research segment from communicating with users in the Sales segment. | | **Policy 3: Allow Manufacturing to communicate with HR and Marketing only** | `New-InformationBarrierPolicy -Name "Manufacturing-HRMarketing" -AssignedSegment "Manufacturing" -SegmentsAllowed "HR","Marketing","Manufacturing" -State Inactive` <p> In this case, the IB policy is called *Manufacturing-HRMarketing*. When this policy is active and applied, Manufacturing can communicate only with HR and Marketing. HR and Marketing aren't restricted from communicating with other segments. | With segments and policies defined, Contoso applies the policies by running the **Start-InformationBarrierPoliciesApplication** cmdlet. |
| compliance | Information Barriers Solution Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/information-barriers-solution-overview.md | -Microsoft Purview Information Barriers is supported in Microsoft Teams, SharePoint Online, and OneDrive for Business. A compliance administrator or information barriers administrator can define policies to allow or prevent communications between groups of users in Microsoft Teams. Information barrier policies can be used for situations like these: +Microsoft Purview Information Barriers (IB) is supported in Microsoft Teams, SharePoint Online, and OneDrive for Business. A compliance administrator or IB administrator can define policies to allow or prevent communications between groups of users in Microsoft Teams. IB policies can be used for situations like these: - User in the day trader group should not communicate or share files with the marketing team - Finance personnel working on confidential company information should not communicate or share files with certain groups within their organization Microsoft Purview Information Barriers is supported in Microsoft Teams, SharePoi ## Configure information barriers -Use the following steps to configure information barriers for your organization: +Use the following steps to configure IB for your organization:  1. Learn about [information barriers](information-barriers.md) 2. Configure [prerequisites and permissions](information-barriers-policies.md#step-1-make-sure-prerequisites-are-met) 3. Segment [users in your organization](information-barriers-policies.md#step-2-segment-users-in-your-organization)-4. Create and configure [information barrier policies](information-barriers-policies.md#step-3-define-information-barrier-policies) -5. Apply [information barrier policies](information-barriers-policies.md#step-4-apply-information-barrier-policies) +4. Create and configure [IB policies](information-barriers-policies.md#step-3-create-ib-policies) +5. Apply [IB policies](information-barriers-policies.md#step-4-apply-ib-policies) ## More information about information barriers -- [Attributes for information barrier policies](information-barriers-attributes.md)-- [Edit or remove information barrier policies](information-barriers-edit-segments-policies.md)+- [Attributes for IB policies](information-barriers-attributes.md) +- [Edit or remove IB policies](information-barriers-edit-segments-policies.md) |
| compliance | Information Barriers | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/information-barriers.md | Only Exchange Online deployments are currently supported for IB policies. If you ## Ready to get started? - [Get started with information barriers](information-barriers-policies.md)-- [Manage information barrier policies](information-barriers-edit-segments-policies.md)-- [See the attributes that can be used for information barrier policies](information-barriers-attributes.md)+- [Manage IB policies](information-barriers-edit-segments-policies.md) +- [See the attributes that can be used for IB policies](information-barriers-attributes.md) |
| compliance | Investigating Partially Indexed Items In Ediscovery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/investigating-partially-indexed-items-in-ediscovery.md | f1.keywords: Previously updated : Last updated : 05/13/2022 audience: Admin description: "Learn how to manage partially indexed items (also called unindexed An eDiscovery search that you run from the Microsoft Purview compliance portal automatically includes partially indexed items in the estimated search results when you run a search. Partially indexed items are Exchange mailbox items and documents on SharePoint and OneDrive for Business sites that for some reason weren't completely indexed for search. Most email messages and site documents are successfully indexed because they fall within the [Indexing limits for email messages](limits-for-content-search.md#indexing-limits-for-email-messages). However, some items may exceed these indexing limits, and will be partially indexed. Here are other reasons why items can't be indexed for search and are returned as partially indexed items when you run an eDiscovery search: -- Email messages have an attached file that can't be opened, such as image files; this is the most common cause of partially indexed email items.+- Email messages have an attached file that can't be opened; this is the most common cause of partially indexed email items. - Too many files attached to an email message. |
| compliance | Partially Indexed Items In Content Search | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/partially-indexed-items-in-content-search.md | f1.keywords: Previously updated : Last updated : 05/13/2022 audience: Admin f1_keywords: An Microsoft Purview eDiscovery search that you run from the Microsoft Purview c - The file type is unrecognized or unsupported for indexing. -- Messages have an attached file that can't be opened, such as image files; this is the most common cause of partially indexed email items.+- Messages have an attached file that can't be opened; this is the most common cause of partially indexed email items. - The file type is supported for indexing but an indexing error occurred for a specific file. |
| compliance | Retention | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention.md | Unlike retention policies, retention settings from retention labels travel with - Apply a default label for SharePoint items or Exchange messages. - Supported actions at the end retention period:- - [Disposition review](./disposition.md) to review the content before it's permanently deleted. - - Automatically apply another retention label + - [Disposition review](./disposition.md) to review the content before it's permanently deleted. + - Automatically apply another retention label - Mark the content as a [record](records-management.md#records) as part of the label settings, and always have [proof of disposition](disposition.md#disposition-of-records) when content is deleted at the end of its retention period. For standard retention labels (they don't mark items as a [record or regulatory - When content already has a retention label applied, the existing label won't be automatically removed or replaced by another retention label with one possible exception: The existing label was applied as a default label. When you use a default label, there are some scenarios when it can be replaced by another default label, or automatically removed. -- When content already has a retention label applied, the existing label won't be automatically removed or replaced by another retention label with two possible exceptions: - - - The existing label is configured to automatically apply a different retention label at the end of the retention period. - - The existing label was applied as a default label. When you use a default label, there are some scenarios when it can be replaced by another default label, or automatically removed. - - For more information about the label behavior when it's applied by using a default label: - - Default label for SharePoint: [Label behavior when you use a default label for SharePoint](create-apply-retention-labels.md#label-behavior-when-you-use-a-default-label-for-sharepoint) - - Default label for Outlook: [Applying a default retention label to an Outlook folder](create-apply-retention-labels.md#applying-a-default-retention-label-to-an-outlook-folder) +- When content already has a retention label applied, the existing label won't be automatically removed or replaced by another retention label with two possible exceptions: ++ - The existing label is configured to automatically apply a different retention label at the end of the retention period. + - The existing label was applied as a default label. When you use a default label, there are some scenarios when it can be replaced by another default label, or automatically removed. ++ For more information about the label behavior when it's applied by using a default label: ++ - Default label for SharePoint: [Label behavior when you use a default label for SharePoint](create-apply-retention-labels.md#label-behavior-when-you-use-a-default-label-for-sharepoint) + - Default label for Outlook: [Applying a default retention label to an Outlook folder](create-apply-retention-labels.md#applying-a-default-retention-label-to-an-outlook-folder) - If there are multiple auto-apply label policies that could apply a retention label, and content meets the conditions of multiple policies, the retention label for the oldest auto-apply label policy (by date created) is applied. The following examples are just some of the ways in which you can combine retent For more information about how retention policies and retention labels work together and how to determine their combined outcome, see the section on this page that explains the [principles of retention and what takes precedence](#the-principles-of-retention-or-what-takes-precedence). -**Example for users to override automatic deletion** +#### Example for users to override automatic deletion Scenario: By default, content in users' OneDrive accounts is automatically deleted after five years but users must have the option to override this for specific documents. Scenario: By default, content in users' OneDrive accounts is automatically delet 2. You create and configure a retention label that keeps content forever and add this to a label policy that you publish to all OneDrive accounts. You explain to users how to manually apply this label to specific documents that should be excluded from automatic deletion if not modified after five years. -**Example to retain items for longer** +Example to retain items for longer** Scenario: By default, SharePoint items are automatically retained and then deleted after five years, but documents in specific libraries must be retained for ten years. Scenario: By default, SharePoint items are automatically retained and then delet 2. You create and configure a retention label that automatically retains content for ten years. You publish this label to SharePoint site admins, so that they can apply it as a default label to be inherited by all items in specific document libraries. -**Example to delete items in a shorter time period** +#### Example to delete items in a shorter time period Scenario: By default, emails aren't retained but are automatically deleted after ten years. However, emails related to a specific project that has a prerelease code name must be automatically deleted after one year. |
| compliance | Sit Get Started Exact Data Match Hash Upload | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sit-get-started-exact-data-match-hash-upload.md | If the tool indicates a mismatch in number of columns it might be due to the pre **If you find single or double quote characters surrounding full values**: you can leave them as they are. -**If you find single quote characters or commas inside a value**: for example the person's name Tom O'Neil or the city 'sΓÇæGravenhage which starts with an apostrophe character, you will need to modify the data export process used to generate the sensitive information table to surround such columns with double quotes. +**If you find single quote characters or commas inside a value**: for example the person's name Tom O'Neil or the city 's-Gravenhage which starts with an apostrophe character, you will need to modify the data export process used to generate the sensitive information table to surround such columns with double quotes. **If double quote characters are found inside values**, it might be preferable to use the Tab-delimited format for the table which is less susceptible to such issues. |
| compliance | Sit Learn About Exact Data Match Based Sits | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sit-learn-about-exact-data-match-based-sits.md | -[Sensitive information types](sensitive-information-type-learn-about.md) are used to help identify sensitive items so that you can prevent them from being inadvertently or inappropriately shared, to help in locating relevant data in eDiscovery, and to apply governance actions to certain types of information. You define a custom sensitive information type (SIT) based on: +[Sensitive information types](sensitive-information-type-learn-about.md) are used to help identify sensitive items so that you can prevent them from being inadvertently or inappropriately shared, to help in locating relevant data in eDiscovery, and to apply governance actions to certain types of information. You define a custom sensitive information type (SIT) based on: - patterns - keyword evidence such as *employee*, *social security number*, or *ID* But what if you wanted a custom sensitive information type (SIT) that uses exact  -EDM-based classification enables you to create custom sensitive information types that refer to exact values in a database of sensitive information. The database can be refreshed daily, and contain up to 100 million rows of data. So as employees, patients, or clients come and go, and records change, your custom sensitive information types remain current and applicable. And, you can use EDM-based classification with policies, such as [Microsoft Purview data loss prevention policies](dlp-learn-about-dlp.md) or [Microsoft Cloud App Security file policies](/cloud-app-security/data-protection-policies). +EDM-based classification enables you to create custom sensitive information types that refer to exact values in a database of sensitive information. The database can be refreshed daily, and contain up to 100 million rows of data. So as employees, patients, or clients come and go, and records change, your custom sensitive information types remain current and applicable. And, you can use EDM-based classification with policies, such as [Microsoft Purview data loss prevention policies](dlp-learn-about-dlp.md) or [Microsoft Cloud App Security file policies](/cloud-app-security/data-protection-policies). > [!NOTE] > Microsoft Purview Information Protection supports double byte character set languages for: EDM finds matches by comparing content it finds against a table of sensitive dat ## See also - [Get started with exact data match based sensitive information types](sit-get-started-exact-data-match-based-sits-overview.md#get-started-with-exact-data-match-based-sensitive-information-types)- |
| compliance | Teams Workflow In Advanced Ediscovery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/teams-workflow-in-advanced-ediscovery.md | Here are some tips and best practices for viewing Teams content in a review set. ## Deleting Teams chat messages -You can use eDiscovery (Premium) and the Microsoft Graph Explorer to respond to data spillage incidents, when content containing confidential or malicious information is released through Teams chat messages.ΓÇï Admins in your organization can search for and delete chat messages in Microsoft Teams. This can help you remove sensitive information or inappropriate content in Teams chat messages. For more information, see [Search and purge chat messages in Teams](search-and-delete-Teams-chat-messages.md). +You can use eDiscovery (Premium) and the Microsoft Graph Explorer to respond to data spillage incidents, when content containing confidential or malicious information is released through Teams chat messages. Admins in your organization can search for and delete chat messages in Microsoft Teams. This can help you remove sensitive information or inappropriate content in Teams chat messages. For more information, see [Search and purge chat messages in Teams](search-and-delete-Teams-chat-messages.md). ## Reference guide |
| compliance | Use A Script To Add Users To A Hold In Ediscovery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/use-a-script-to-add-users-to-a-hold-in-ediscovery.md | Here are the steps to make this happen: ## Before you add users to a hold -- You have to be a member of the eDiscovery Manager role group in the compliance portal and a SharePoint Online administrator to run the script in Step 3. For more information, see [Assign eDiscovery permissions in the OfficeΓÇì 365 Security & Compliance Center](assign-ediscovery-permissions.md).+- You have to be a member of the eDiscovery Manager role group in the compliance portal and a SharePoint Online administrator to run the script in Step 3. For more information, see [Assign eDiscovery permissions in the Office 365 Security & Compliance Center](assign-ediscovery-permissions.md). - A maximum of 1,000 mailboxes and 100 sites can be added to a hold that's associated with an eDiscovery case in the compliance portal. Assuming that every user that you want to place on hold has a OneDrive for Business site, you can add a maximum of 100 users to a hold using the script in this article. |
| contentunderstanding | Image Tagging | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/image-tagging.md | If you turn tagging off, images will no longer be automatically tagged. Existing > [!NOTE] > System generated tags may change with updates to the image or our tag technology. - ## Configure image tagging -After you [set up SharePoint Syntex](set-up-content-understanding.md), you can configure image tagging in the Microsoft 365 admin center.ΓÇ» +After you [set up SharePoint Syntex](set-up-content-understanding.md), you can configure image tagging in the Microsoft 365 admin center. To turn image tagging on or off |
| lighthouse | M365 Lighthouse View Your Roles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-view-your-roles.md | If you don't have permission to perform an action that you need to perform in Li ## Related content -[Overview of permissions in Microsoft 365 Lighthouse](m365-lighthouse-overview-of-permissions.md) (article)\ -[Manage your tenant list in Microsoft 365 Lighthouse](m365-lighthouse-manage-tenant-list.md) (article) +[Overview of permissions in Microsoft 365 Lighthouse](m365-lighthouse-overview-of-permissions.md) (article)\ +[Manage your tenant list in Microsoft 365 Lighthouse](m365-lighthouse-manage-tenant-list.md) (article) |
| lti | Browser Cookies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lti/browser-cookies.md | Here are the steps to allow the cookies in your browser. ## Allow cookies for LMS URLS in Microsoft Edge -1. In the Edge **Settings** window, select **Cookies and site permissions** > **Cookies and data stored** > **Manage and delete cookies and site data**. -2. Turn on **Allow sites to save and read cookie data (recommended)**, and make sure that **Block third-party cookies** is turned off. +1. In the Edge **Settings** window, select **Cookies and site permissions** > **Cookies and data stored** > **Manage and delete cookies and site data**. +2. Turn on **Allow sites to save and read cookie data (recommended)**, and make sure that **Block third-party cookies** is turned off. If you must keep third-party cookies blocked: -1. In the Edge **Settings** window, select **Cookies and site permissions** > **Cookies and data stored** > **Manage and delete cookies and site data**. -2. Under **Allow**, select **Add** to add the domain URL of the LMS platform. +1. In the Edge **Settings** window, select **Cookies and site permissions** > **Cookies and data stored** > **Manage and delete cookies and site data**. +2. Under **Allow**, select **Add** to add the domain URL of the LMS platform. 1. For example, if the LMS platform is hosted at `https://contoso.com`, then that URL must be added under **Allow**.  If you must keep third-party cookies blocked: ## Allow cookies for LMS URLS in Google Chrome -1. In the Chrome **Settings** window, on the **Privacy and security** tab, select **Cookies and other site data**. +1. In the Chrome **Settings** window, on the **Privacy and security** tab, select **Cookies and other site data**. -2. Under **Sites that can always use cookies**, select **Add**, and then select the **Including third-party cookies on this site** checkbox. +2. Under **Sites that can always use cookies**, select **Add**, and then select the **Including third-party cookies on this site** checkbox. 3. Add the domain URL of the LMS platform. 1. For instance, if the LMS platform is hosted at `https://contoso.com`, then that URL must be used. If you must keep third-party cookies blocked: ## Allow cookies for LMS URLS in Mozilla Firefox -1. In the Firefox **Settings** window, select the **Privacy & Security** tab. +1. In the Firefox **Settings** window, select the **Privacy & Security** tab. -2. Under **Cookies and Site Data**, select **Manage Exceptions**. +2. Under **Cookies and Site Data**, select **Manage Exceptions**. -3. In the **Address of website** text box, enter the URL of the LMS platform. +3. In the **Address of website** text box, enter the URL of the LMS platform. 1. For instance, if the LMS platform is hosted at `https://contoso.com`, then that URL must be used. 4. Select **Allow** to allow cookies for the entered website. -5. Select **Save Changes**. +5. Select **Save Changes**.  If you must keep third-party cookies blocked: ## Allow cookies for LMS URLS in Safari -1. Select **Preferences** > **Privacy**. +1. Select **Preferences** > **Privacy**. -2. Clear the **Prevent cross-site tracking** checkbox. +2. Clear the **Prevent cross-site tracking** checkbox. |
| lti | Index | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lti/index.md | These tools include: - [Teams Meetings LTI](#teams-meetings-lti) - [Teams Classes LTI](#teams-classes-lti) -For general information on managing Microsoft OneLTI tools, see [Manage Microsoft OneLTI for any LMS](manage-microsoft-one-lti.md). +For general information on managing Microsoft LTI apps, see [Manage Microsoft LTI apps for any LMS](manage-microsoft-one-lti.md). ## OneDrive LTI apps |
| lti | Manage Microsoft One Lti | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lti/manage-microsoft-one-lti.md | Title: Manage Microsoft OneLTI for any LMS + Title: Manage Microsoft LMS Gateway for any LMS f1.keywords: - CSH ms.localizationpriority: medium-description: Learn how to conduct key Microsoft OneLTI management tasks including viewing, deleting, editing, and troubleshooting. +description: Learn how to conduct key Microsoft LMS Gateway management tasks including viewing, deleting, editing, and troubleshooting. -# Manage Microsoft OneLTI for any LMS +# Manage Microsoft LMS Gateway for any LMS -Microsoft OneLTI integrates with several LMSs including Canvas, Blackboard, and Moodle. +Microsoft LMS Gateway integrates with several LMSs including Canvas, Blackboard, and Moodle. -In this article, IT admins will find instructions on key OneLTI management tasks. +In this article, IT admins will find instructions on key Microsoft LMS Gateway management tasks. - [View an LTI registration](#view-an-lti-registration). - [Delete an LTI registration](#delete-an-lti-registration). - [Edit an LTI registration](#edit-an-lti-registration).-- [Troubleshoot issues with OneLTI](#troubleshoot-issues-with-onelti).-- [Report problems with OneLTI](#report-problems-with-onelti).+- [Troubleshoot issues with Microsoft LMS Gateway](#troubleshoot-issues-with-microsoft-lms-gateway). +- [Report problems with Microsoft LMS Gateway](#report-problems-with-lti-registration-portal). ## View an LTI registration If you would like to view the details of an LTI registration, follow the steps below. -1. Visit [Microsoft LTI Portal](https://lti.microsoft.com/). +1. Visit the [Microsoft LMS Gateway](https://lti.microsoft.com/). 2. Sign in with a Microsoft 365 administrator account. 3. In the registration list, find the LTI registration you wish to view. 4. Select the **eye icon** next to the listing. If you would like to view the details of an LTI registration, follow the steps b ## Delete an LTI registration -If you would like to delete a Microsoft OneLTI registration, follow the steps below. +If you would like to delete an LTI registration, follow the steps below. -1. Visit [Microsoft LTI Portal](https://lti.microsoft.com/). +1. Visit the [Microsoft LMS Gateway](https://lti.microsoft.com/). 2. Sign in with a Microsoft 365 administrator account. 3. In the registration list, find the LTI registration you wish to delete. 4. Select the **trash can icon** next to the listing. If you would like to delete a Microsoft OneLTI registration, follow the steps be ## Edit an LTI registration -Currently, we don't support editing an existing LTI registration after it’s added. +Currently, we don't support editing an existing LTI registration after it's added. To change an LTI registration, you'll need to: 1. [Delete the existing registration](#delete-an-lti-registration). 2. Add a new registration. -## Troubleshoot issues with OneLTI +## Troubleshoot issues with Microsoft LMS Gateway -If you or your educators are experiencing issues with Microsoft OneLTI, here are some things you can do to troubleshoot. +If you or your educators are experiencing issues with Microsoft LMS Gateway, here are some things you can do to troubleshoot. -### Issues while launching an LTI tool from the LMS +### Issues while launching an LTI app from the LMS -Educators might experience issues launching a Microsoft LTI tool in their LMS. +Educators might experience issues launching a Microsoft LTI app in their LMS. If so, here are some common issues and how to resolve them. If so, here are some common issues and how to resolve them. - To learn how to update your browser's cookie settings, see [Allow cookies for LMS URLs in your browser](browser-cookies.md). - **Registration details not found**- - This issue happens when registration of the LTI tool wasn't completed or if the registration was deleted in the OneLTI admin portal. - - The IT admin will need to complete registration of the LTI tool. + - This issue happens when registration of the LTI app wasn't completed or if the registration was deleted in the Microsoft LMS Gateway. + - The IT admin will need to complete registration of the LTI app. - **Some details from LMS aren't valid**- - This issue happens when the details sent from the LMS in the tool launch request aren't aligned with the IMS LTI 1.3 specification. + - This issue happens when the details sent from the LMS in the app launch request aren't aligned with the IMS LTI 1.3 specification. - The IT admin will need to reach out to [Microsoft's education support team](https://edusupport.microsoft.com/support?product_id=lti_apps&platform_id=web) if the issue persists. -### Issues with signing in to the registration portal +### Issues with signing in to the Microsoft LMS Gateway -When signing in to the Microsoft LTI registration portal, you may have issues accessing the registration page or receive a sign-in error. +When signing in to the Microsoft LMS Gateway, you may have issues accessing the registration page or receive a sign-in error. Here are some common sign-in issues and how to resolve them. - **Authorization error**- - If you see the error message, "Your account doesn’t have permission to access this page," then either: - - The account doesn't belong to a registered tenant, or - - The account doesn't belong to an educator or an admin. + - If you see the error message, "Your account doesn't have permission to access this page," then either: + - The account doesn't belong to a registered tenant, or + - The account doesn't belong to an educator or an admin. - For both these cases, you'll see a **Sign out & switch accounts** button. - Select this button or select the **Sign out** button under the user profile menu. Here are some common sign-in issues and how to resolve them. - If the tenant isn't registered, then the IT admin must register it before trying to register LTI integrations. - If after trying these steps, you still see this error, then sign out and sign in again.- - You can also clear cookies and local storage for the LTI registration portal and `https://login.microsoftonline.com/`. + - You can also clear cookies and local storage for the Microsoft LMS Gateway and `https://login.microsoftonline.com/`. - Try to sign in again. - If the issue persists, report the problem by selecting the **Report a problem** link at the top right. - **Authentication error**- - If you see the error message, “Authentication failed. Try again," the sign-in session may have expired. + - If you see the error message, "Authentication failed. Try again," the sign-in session may have expired. - Sign out and sign back in again.- - You can also clear cookies and local storage for the LTI registration portal and `https://login.microsoftonline.com/`. + - You can also clear cookies and local storage for the Microsoft LMS Gateway and `https://login.microsoftonline.com/`. - Try to sign in again. - If the issue persists, report the problem by selecting the **Report a problem** link at the top right. - **Other errors**- - For all other errors, you'll see the error message, “Something went wrong. Try again later.” + - For all other errors, you'll see the error message, "Something went wrong. Try again later." - This could be an internal processing error. - Try signing in again after a few hours. - Select the **Go to Home page** button. This will navigate back to the landing page.- - Select the **Go to registration portal** button to go back to the LTI registration portal. + - Select the **Go to registration portal** button to go back to the Microsoft LMS Gateway. -## Report problems with OneLTI +### Report problems with LTI registration portal -To report any issues or submit feedback for Microsoft OneLTI, follow the steps below. +To report any issues or submit feedback for the LTI registration portal, follow the steps below. -1. In the Microsoft OneLTI registration portal, select the **question mark icon** in the page header. +1. In the LTI registration portal, select the **question mark icon** in the page header. 2. In the dropdown, select **Report a problem**. 3. The Microsoft Education Support page will open. Sign in with your Microsoft 365 credentials. 4. Fill out the form and submit. |
| lti | Moodle Plugin Configuration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lti/moodle-plugin-configuration.md | Here are the prerequisites to install Moodle: ## 1. Install the Microsoft 365 Moodle Plugins -Moodle integration in Microsoft Teams is powered by the open source [Microsoft 365 Moodle plugins set](https://github.com/Microsoft/o365-moodle). +Moodle integration in Microsoft Teams is powered by the open source [Microsoft 365 Moodle plugins set](https://moodle.org/plugins/browse.php?list=set&id=72). ### Requisite applications and plugins Install and download the following items before proceeding with the Microsoft 36 #### Install plugins -1. Sign in to your Moodle server and navigate to **Site administration**. -1. Select the **Plugins** tab then select **Install plugins**. -1. From the **Install plugins from ZIP file** section, select **Choose a file**. -1. Select **Upload a file** from the left navigation panel, browse for the file that you downloaded, and select **Upload this file**. -1. Select **Site administration** from the left navigation panel to return to your admin dashboard. -1. Scroll down to the **Local plugins** and select the **Microsoft 365 Integration** link. +1. Download the plugins, extract them, and upload to their corresponding folders. e.g. extract the OpenID Connect plugin (auth_oidc) to a folder called **oidc**, and upload to the **auth** folder of your Moodle document root. +2. Sign in to your Moodle site as an administrator and select **Site administration**. +3. Upon detection of new plugins to be installed, Moodle should redirect you to the install new plugins page. If this does not happen, in the **Site administration** page, select **Notifications** in the **General** tab, this should trigger the installation of the plugins. > [!IMPORTANT] > Register Moodle as an application in your Azure AD, using the PowerShell script. Use the generated `AppID` and `Key` in your Microsoft 365 Moodle Plugins setup page to configure your Moodle server site with Azure AD. > [!IMPORTANT]-> -> * The PowerShell script is not updated with the latest configuration items, therefore, you must complete the configuration manually following the steps outlined on the Moodle [3.10.6 and 3.11.3](https://docs.moodle.org/311/en/Microsoft_365) release page. -> -> * For more information on registering your Moodle instance manually, see [Register your Moodle instance as an application](https://docs.moodle.org/311/en/Microsoft_365#Register_Application_in_Azure_manually). +> * For more information on registering your Moodle instance manually, see [Register your Moodle instance as an application](https://docs.moodle.org/400/en/Microsoft_365#Azure_App_Creation_and_Configuration). ### The Teams for Moodle set up process Use the generated `AppID` and `Key` in your Microsoft 365 Moodle Plugins setup p 1. In the **User Creation Restriction** section, you can set up a filter to limit the Azure AD users that are synced to Moodle. 1. In the **Course Sync** section, you can select **Course sync customization** option to enable the automatic creation of Groups and Teams for some, or all, of your existing Moodle courses. -1. To validate [cron](https://docs.moodle.org/310/en/Cron) tasks and to run them manually for the first time, navigate to **Site administration** > **Server** > **Tasks** > **Scheduled tasks**. +1. To validate [cron](https://docs.moodle.org/400/en/Cron) tasks and to run them manually for the first time, navigate to **Site administration** > **Server** > **Tasks** > **Scheduled tasks**. 1. Scroll down and find the task **Sync users with Azure AD** and select **Run now**. 1. This will sync the AAD user to your Moodle site. Use the generated `AppID` and `Key` in your Microsoft 365 Moodle Plugins setup p > [!NOTE] >- > The Moodle [Cron](https://docs.moodle.org/311/en/Scheduled_tasks) runs according to the task schedule. The default schedule is once a day at 1:00 AM in your server's local time zone. However, the cron should run more frequently to keep everything in sync. --1. Return to the site administration page. + > The Moodle [Cron](https://docs.moodle.org/400/en/Scheduled_tasks) runs according to the task schedule. The default schedule is once a day at 1:00 AM in your server's local time zone. However, the cron should run more frequently to keep everything in sync. -1. Configure the required settings to enable the Teams app integration. +1. Navigate to **Site administration** > **Plugins** > **Local plugins** > **Microsoft 365 Integration** > **Teams Settings** tab. - 1. To enable **OpenID Connect**, go to **Site administration** > **Plugins** > **Manage authentication**. - 1. Find **OpenID Connect**, and select the eye icon if it's greyed out. Save changes. - 1. To enable frame embedding, go to **Site administration** and select **HTTP Security** in the **Security** section. - 1. Select the checkbox next to **Allow frame embedding**. Save changes. - 1. To enable web services, which enable the Moodle API features, go to **Site administration** > **Advanced features**. - 1. Ensure the checkbox next to **Enable web services** is selected. Save changes. - 1. To enable the external services for Microsoft 365, go to **Site administration** > **Plugins**, and select **External services** in the **Web services** section. -- Γ£ö In the **Built-in services** section, find **Moodle Microsoft 365 Webservices**. - - Γ£ö Select **Edit** on the **Moodle Microsoft 365 Webservices** row. - - Γ£ö Select the eye icon if it's greyed out. Save changes. - -- 1. Edit your authenticated user permissions to allow them to create web service tokens. -- Γ£ö Go to **Site administration**, **Users** tab, and find **Define roles** in the **Permissions** section. - - Γ£ö On the **Manage users** tab, find **Authenticated user** role, and select the edit icon. - - Γ£ö Scroll down and find the **Create a web service token** capability and select the **Allow** checkbox. Save changes. +1. Click the **Check Moodle settings** button will update all required configurations for the Teams integration to work. After the plugins are installed and configured, you can: +* [Deploy Moodle Assistant Bot to Azure](/microsoftteams/install-moodle-integration#step-3-deploy-the-moodle-assistant-bot-to-azure). * [Add Moodle tabs to Teams classes](/microsoftteams/install-moodle-integration#step-4-deploy-your-microsoft-teams-app). * [Add Teams classes and meetings to the Moodle LMS](teams-classes-meetings-with-moodle.md). After the plugins are installed and configured, you can: If you would like to review Moodle's Microsoft 365 integration guides and release notes, see these resources: -* [Moodle and Microsoft 365 3.10.6](https://docs.moodle.org/310/en/Microsoft_365). -* [Moodle and Microsoft 365 3.11.3](https://docs.moodle.org/310/en/Microsoft_365). +* [Microsoft 365 integration documentation on Moodle Docs](https://docs.moodle.org/400/en/Microsoft_365). |
| lti | Teams Classes Meetings With Moodle | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lti/teams-classes-meetings-with-moodle.md | description: Create and manage Teams classes and meetings with Microsoft OneDriv This guide provides the IT admin steps for registering both Teams Classes and Teams Meetings LTI apps on Moodle. -For details on managing all OneLTI tools for any LMS, see [Manage Microsoft OneLTI for any LMS](manage-microsoft-one-lti.md). +For details on managing all LTI apps for any LMS, see [Manage Microsoft LMS Gateway for any LMS](manage-microsoft-one-lti.md). ## Prerequisites before set up Follow the [instructions for installing and configuring the Moodle plugin](moodl > [!IMPORTANT] > The person who performs this integration should be a Moodle administrator and a Microsoft 365 tenant administrator. -1. Visit [Microsoft LTI Portal](https://lti.microsoft.com/) and select **Go to registration portal**. +1. Visit [Microsoft LMS Gateway](https://lti.microsoft.com/) and select the **Go to registration portal** button. 2. Sign in with a Microsoft 365 administrator account. Follow the [instructions for installing and configuring the Moodle plugin](moodl 6. You'll be given a list of keys that need to be added to your Moodle site. -7. Open Moodle in another tab. Don't close the Microsoft LTI portal tab. +7. Open Moodle in another tab. Don't close the Microsoft LMS Gateway tab. 8. In Moodle, go to **Site administration** > **Plugins** > **Activity modules** > **External tools** > **Manage tools**. Follow the [instructions for installing and configuring the Moodle plugin](moodl 13. The new tool should now appear in the **Tools** section of Moodle's **Manage tools** page. Select the list icon to view **Tool configuration details**. -14. Go back to the Microsoft LTI portal tab. Select **Next** to go to the **LMS provided registration keys** step. +14. Go back to the Microsoft LMS Gateway tab. Select **Next** to go to the **LMS provided registration keys** step. 15. Copy and paste the values from Moodle's **Tool configuration details** to Microsoft's **LMS provided registration keys** step. You've completed registration of either the Teams Classes or Teams Meetings LTI If you would like to add the other app too, repeat the steps above, selecting the other Teams LTI app in step 4. -### Add Teams LTI tools to educators' Moodle courses +### Add Teams LTI apps to educators' Moodle courses After registering Teams LTI apps, educators can add the Teams Classes app and the Teams Meetings app to their Moodle courses. - [Educator instructions on adding the Teams Classes app](https://support.microsoft.com/topic/use-microsoft-teams-classes-in-your-lms-ac6a1e34-32f7-45e6-b83e-094185a1e78a). - [Educator instructions on adding the Teams Meetings app](https://support.microsoft.com/topic/use-microsoft-teams-meetings-in-your-lms-11b6095d-f90b-42b9-ab77-4dcff2bb3b76).++## Technical requirements to launch Teams LTI apps ++To launch the Teams LTI apps within Moodle, there are a few technical requirements that need to be met. ++> [!NOTE] +> IT admins and educators can register LTI apps on the LTI apps registration portal. ++### IT admin technical requirements ++- Use Moodle version 3.10 or above. +- Download the latest Microsoft O365 plugin for Moodle version 3.10 or above. +- Access the LTI apps registration portal to register the LTI apps. + - Registration must be on completed on a desktop device. +- Download the latest version of Microsoft Edge, Google Chrome, Safari, or Mozilla Firefox. ++### Educator technical requirements ++- Access the LTI apps registration portal to register the LTI apps, if the IT admin hasn't registered the apps. + - Registration must be on completed on a desktop device. +- Download the latest version of Microsoft Edge, Google Chrome, Safari, or Mozilla Firefox. +- [Teams LTI apps for Classes and Meetings in Moodle](#add-teams-lti-apps-to-educators-moodle-courses). ++### Student technical requirements ++- Teams LTI apps for Classes and Meetings in Moodle. + - Students don't need to take any actions to add the Teams Classes or Meetings LTI apps. |
| security | Mdb Onboard Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-onboard-devices.md | If you prefer to use Group Policy to onboard Windows clients, follow the guidanc ### Microsoft Intune for Windows clients -If your subscription includes Intune, you can onboard Windows clients and other devices in the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). For example, if you have [Microsoft 365 Business Premium](../../business/index.yml), you have Intune as part of your subscription. +If your subscription includes Intune, you can onboard Windows clients and other devices in the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). For example, if you have [Microsoft 365 Business Premium](../../business/index.yml), you've Intune as part of your subscription. There are several methods available for enrolling devices in Intune. We recommend starting with one of the following methods: When you run the local script on a macOS device, it creates a trust with Azure A 8. Select **Continue**, agree with the License terms, and then enter your password when prompted. -9. You will be prompted to allow a driver from Microsoft to be installed (either "System Extension Blocked" or "Installation is on hold", or both. The driver must be allowed to be installed. To allow the installation, select **Open Security Preferences** or **Open System Preferences** > **Security & Privacy**, and then select **Allow**. +9. You'll be prompted to allow a driver from Microsoft to be installed (either "System Extension Blocked" or "Installation is on hold", or both. The driver must be allowed to be installed. To allow the installation, select **Open Security Preferences** or **Open System Preferences** > **Security & Privacy**, and then select **Allow**. 10. Use the following Python command in Bash to run the onboarding package: `/usr/bin/python MicrosoftDefenderATPOnboardingMacOs.py` When you run the local script on a macOS device, it creates a trust with Azure A ### Microsoft Intune for macOS -If your subscription includes Microsoft Intune, you can onboard macOS devices in the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). For example, if you have [Microsoft 365 Business Premium](../../business/index.yml), you have Intune as part of your subscription. +If your subscription includes Microsoft Intune, you can onboard macOS devices in the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). For example, if you have [Microsoft 365 Business Premium](../../business/index.yml), you've Intune as part of your subscription. There are several methods available for enrolling devices in Intune. We recommend starting with one of the following methods: Choose one of the options in the following table to enroll company-managed macOS | Option | Description | ||| | Apple Automated Device Enrollment | Use this method to automate the enrollment experience on devices purchased through Apple Business Manager or Apple School Manager. Automated device enrollment deploys the enrollment profile over-the-air, so you don't need to have physical access to devices. <br/><br/>See [Automatically enroll macOS devices with the Apple Business Manager or Apple School Manager](/mem/intune/enrollment/device-enrollment-program-enroll-macos). |-| Device enrolllment manager (DEM) | Use this method for large-scale deployments and when there are multiple people in your organization who can help with enrollment setup. Someone with device enrollment manager (DEM) permissions can enroll up to 1,000 devices with a single Azure Active Directory account. This method uses the Company Portal app or Microsoft Intune app to enroll devices. You can't use a DEM account to enroll devices via Automated Device Enrollment.<br/><br/> See [Enroll devices in Intune by using a device enrollment manager account](/mem/intune/enrollment/device-enrollment-manager-enroll). | +| Device enrollment manager (DEM) | Use this method for large-scale deployments and when there are multiple people in your organization who can help with enrollment setup. Someone with device enrollment manager (DEM) permissions can enroll up to 1,000 devices with a single Azure Active Directory account. This method uses the Company Portal app or Microsoft Intune app to enroll devices. You can't use a DEM account to enroll devices via Automated Device Enrollment.<br/><br/> See [Enroll devices in Intune by using a device enrollment manager account](/mem/intune/enrollment/device-enrollment-manager-enroll). | | Direct enrollment | Direct enrollment enrolls devices with no user affinity, so this method is best for devices that aren't associated with a single user. This method requires you to have physical access to the Macs you're enrolling. <br/><br/>See [Use Direct Enrollment for macOS devices](/mem/intune/enrollment/device-enrollment-direct-enroll-macos). | #### Ask users to enroll their own macOS devices in Intune If your business prefers to have people enroll their own devices in Intune, ask 1. To confirm that the device is associated with your company, use the following Python command in Bash: `mdatp health --field org_id`. -2. If you are using macOS 10.15 (Catalina) or later, grant Defender for Business consent to protect your device. Go to **System Preferences** > **Security & Privacy** > **Privacy** > **Full Disk Access**. Select the lock icon to make changes (bottom of the dialog box), and then select **Microsoft Defender for Business** (or **Defender for Endpoint**, if that's what you see). +2. If you're using macOS 10.15 (Catalina) or later, grant Defender for Business consent to protect your device. Go to **System Preferences** > **Security & Privacy** > **Privacy** > **Full Disk Access**. Select the lock icon to make changes (bottom of the dialog box), and then select **Microsoft Defender for Business** (or **Defender for Endpoint**, if that's what you see). 3. To verify that the device is onboarded, use the following command in Bash: `mdatp health --field real_time_protection_enabled` To view the list of devices that are onboarded to Defender for Business, in the ## Mobile devices -You'll need Microsoft Intune to onboard mobile devices, such as Android and iOS/iPadOS devices. If you have [Microsoft 365 Business Premium](../../business/index.yml), you have Intune. +You'll need Microsoft Intune to onboard mobile devices, such as Android and iOS/iPadOS devices. If you have [Microsoft 365 Business Premium](../../business/index.yml), you've Intune. See the following resources to get help enrolling these devices into Intune: |
| security | Trial Playbook Defender Business | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/trial-playbook-defender-business.md | Defender for Business is a new endpoint security solution that was designed espe :::image type="content" source="media/mdb-offering-overview.png" alt-text="Microsoft Defender for Business features and capabilities."::: -**LetΓÇÖs get started!** +**Let's get started!** ## Set up your trial Defender for Business was designed to save small and medium-sized businesses tim To onboard other devices, see [step 4](#step-4-set-up-and-configure-defender-for-business). -4. **[View and if necessary, edit your security policies](mdb-configure-security-settings.md)**. Defender for Business includes default security policies for next generation protection and firewall protection that can be applied to your companyΓÇÖs devices. These preconfigured security policies use recommended settings so you're protected as soon as your devices are onboarded to Defender for Business. And you still have the ability to edit policies or create new ones. +4. **[View and if necessary, edit your security policies](mdb-configure-security-settings.md)**. Defender for Business includes default security policies for next generation protection and firewall protection that can be applied to your company's devices. These preconfigured security policies use recommended settings so you're protected as soon as your devices are onboarded to Defender for Business. And you still have the ability to edit policies or create new ones. ### Step 4: Set up and configure Defender for Business |
| security | TOC | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/TOC.md | ##### [Exclusions for Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) ##### [Common mistakes to avoid](common-exclusion-mistakes-microsoft-defender-antivirus.md) +#### Troubleshooting mode for Defender for Endpoint +##### [Get started with troubleshooting mode](enable-troubleshooting-mode.md) +##### [Troubleshooting mode scenarios](troubleshooting-mode-scenarios.md) + #### Diagnostics and performance for Microsoft Defender Antivirus ##### [Device health and compliance reports](machine-reports.md) ##### [Troubleshoot performance issues related to real-time protection](troubleshoot-performance-issues.md) |
| security | Admin Submissions Mde | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/admin-submissions-mde.md | +- m365-security-compliance - m365initiative-defender-endpoint - m365solution-scenario - m365scenario-fpfn-In Microsoft Defender for Endpoint, admins can use the unified submissions feature to submit files and file hashes (SHAs) to Microsoft for review. The unified submissions experience is a one-stop shop for submitting emails, URLs, email attachments, and files in one, easy-to-use submission experience. Admins can use the Microsoft 365 Defender portal or the Microsoft Defender for Endpoint Alert page to submit suspicious files. +In Microsoft Defender for Endpoint, admins can use the unified submissions feature to submit files and file hashes (SHAs) to Microsoft for review. The unified submissions experience is a one-stop shop for submitting emails, URLs, email attachments, and files in one, easy-to-use submission experience. Admins can use the Microsoft 365 Defender portal or the Microsoft Defender for Endpoint Alert page to submit suspicious files. ## What do you need to know before you begin? In Microsoft Defender for Endpoint, admins can use the unified submissions featu - To submit files to Microsoft, you need to be a member of one of the following role groups: - - **Organization Management** or **Security Administrator** in the [Microsoft 365 Defender portal](../office-365-security/permissions-microsoft-365-security-center.md). + - **Organization Management** or **Security Administrator** in the [Microsoft 365 Defender portal](../office-365-security/permissions-microsoft-365-security-center.md). - For more information about how you can submit spam, phish, URLs, and email attachments to Microsoft, see [Report messages and files to Microsoft](../office-365-security/report-junk-email-messages-to-microsoft.md). If you have a file that you suspect might be malware or is being incorrectly det ### Submit a file or file hash -1. Open Microsoft 365 Defender at <https://security.microsoft.com/>, click **Actions & submissions**, click **Submissions**, go to **Files** tab, and then select **Add new submission**. +1. Open Microsoft 365 Defender at <https://security.microsoft.com/>, click **Actions & submissions**, click **Submissions**, go to **Files** tab, and then select **Add new submission**. > [!div class="mx-imgBorder"]- >  + >  -2. Use the **Submit items to Microsoft for review** flyout that appears to submit the **File** or **File hash**. +2. Use the **Submit items to Microsoft for review** flyout that appears to submit the **File** or **File hash**. -3. In the **Select the submission type** box, select **File** or **File hash** from the drop-down list. +3. In the **Select the submission type** box, select **File** or **File hash** from the drop-down list. -4. When submitting a file, click **Browse files**. In the dialog that opens, find and select the file, and then click **Open**. Note that for **File hash** submissions, you'll either have to copy or type in the file hash. +4. When submitting a file, click **Browse files**. In the dialog that opens, find and select the file, and then click **Open**. Note that for **File hash** submissions, you'll either have to copy or type in the file hash. 5. In the **This file should have been categorized as** section, choose either **Malware** (false negative), or **Unwanted software**, or **Clean** (false positive).- + 6. Next, **Choose the priority**. Note that for **File hash** submissions, **Low - bulk file or file hash submission** is the only choice, and is automatically selected. > [!div class="mx-imgBorder"]- >  + >  ++7. Click **Submit**. -8. Click **Submit**. - If you want to view the details of your submission, select your submission from the **Submissions name** list to open the **Result details** flyout. ## Report items to Microsoft from the Alerts page -You can also submit a file or file hash directly from the list of alerts on the **Alerts** page. +You can also submit a file or file hash directly from the list of alerts on the **Alerts** page. 1. Open the Microsoft 365 Defender at <https://security.microsoft.com/>, click **Incidents & alerts**, and then click **Alerts** to view the list of alerts. -2. Select the alert you want to report. Note that you are submitting a file that is nestled within the alert. +2. Select the alert you want to report. Note that you are submitting a file that is nestled within the alert. 3. Click the ellipses next to **Manage alert** to see additional options. Select **Submit items to Microsoft for review**. > [!div class="mx-imgBorder"]- >  + >  -4. In the next flyout that opens, select the submission type. +4. In the next flyout that opens, select the submission type. > [!div class="mx-imgBorder"]- >  + >  If you select **File** as the submission type, upload the file, categorize your submission, and choose the priority.- - If you select **File Hash** as the submission type, choose the file hashes that are available from the drop-down. You can select multiple file hashes. - -5. Click **Submit**. ++ If you select **File Hash** as the submission type, choose the file hashes that are available from the drop-down. You can select multiple file hashes. ++5. Click **Submit**. ## Related information |
| security | Android Intune | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/android-intune.md | Learn how to deploy Defender for Endpoint on Android on Intune Company Portal en ## Deploy on Device Administrator enrolled devices -**Deploy Defender for Endpoint on Android on Intune Company Portal - Device Administrator enrolled devices** - Learn how to deploy Defender for Endpoint on Android on Intune Company Portal - Device Administrator enrolled devices. ### Add as Android store app Follow the steps below to add Microsoft Defender for Endpoint app into your mana > [!div class="mx-imgBorder"] > :::image type="content" source="images/07e6d4119f265037e3b80a20a73b856f.png" alt-text="The page of Managed Google Play in the Microsoft Endpoint Manager admin center portal" lightbox="images/07e6d4119f265037e3b80a20a73b856f.png":::- 4. You'll be presented with the permissions that Defender for Endpoint obtains for it to work. Review them and then select **Approve**. Follow the steps below to add Microsoft Defender for Endpoint app into your mana :::image type="content" source="images/android-create-app.png" alt-text=" The Associated app details pane" lightbox="images/android-create-app.png"::: - 1. In the **Settings** page, go to the **Configuration settings** section and choose **ΓÇÿUse configuration designerΓÇÖ** in Configuration settings format. + 1. In the **Settings** page, go to the **Configuration settings** section and choose **'Use configuration designer'** in Configuration settings format. :::image type="content" alt-text="Image of android create app configuration policy." source="images/configurationformat.png" lightbox="images/configurationformat.png"::: Follow the steps below to add Microsoft Defender for Endpoint app into your mana :::image type="content" alt-text="Image of selecting configuration policies for android." source="images/selectconfigurations.png" lightbox="images/selectconfigurations.png"::: - 1. You should see all the selected configurations listed. You can change the configuration value as required and then select **Next**.- - :::image type="content" alt-text="Image of selected configuration policies." source="images/listedconfigurations.png" lightbox="images/listedconfigurations.png"::: - ++ :::image type="content" alt-text="Image of selected configuration policies." source="images/listedconfigurations.png" lightbox="images/listedconfigurations.png"::: 1. In the **Assignments** page, select the user group to which this app config policy would be assigned to. Click **Select groups to include** and selecting the applicable group and then selecting **Next**. The group selected here is usually the same group to which you would assign Microsoft Defender for Endpoint Android app. Follow the steps below to add Microsoft Defender for Endpoint app into your mana 10. Select **Microsoft Defender ATP** app in the list \> **Properties** \> **Assignments** \> **Edit**. - :::image type="content" source="images/mda-properties.png" alt-text="The Edit option on the Properties page" lightbox="images/mda-properties.png"::: + :::image type="content" source="images/mda-properties.png" alt-text="The Edit option on the Properties page" lightbox="images/mda-properties.png"::: 11. Assign the app as a *Required* app to a user group. It is automatically installed in the *work profile* during the next sync of the device via Company Portal app. This assignment can be done by navigating to the *Required* section \> **Add group,** selecting the user group and click **Select**. The device configuration profile is now assigned to the selected user group. ## Set up Microsoft Defender in Personal Profile on Android Enterprise in BYOD mode ->[!NOTE] ->Microsoft Defender support in Personal profile in Android Enterprise (AE) in Bring-Your-Own-Device (BYOD) mode is now in public preview. The following information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> [!NOTE] +> Microsoft Defender support in Personal profile in Android Enterprise (AE) in Bring-Your-Own-Device (BYOD) mode is now in public preview. The following information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -With Microsoft defender support in Android personal profiles, user devices can be protected against phishing and malware attacks on a personal profile that could potentially compromise corporate resources on work profile. +With Microsoft defender support in Android personal profiles, user devices can be protected against phishing and malware attacks on a personal profile that could potentially compromise corporate resources on work profile. -**Set up Microsoft Defender in Personal Profile** +### Set up Microsoft Defender in Personal Profile Admins can go to the [Microsoft Endpoint Management admin center](https://endpoint.microsoft.com) to set up and configure Microsoft Defender support in personal profiles by following these steps:+ 1. Go to **Apps> App configuration policies** and click on **Add**. Select **Managed Devices**. > [!div class="mx-imgBorder"] >  -1. Enter **Name** and **Description** to uniquely identify the configuration policy. Select platform as **ΓÇÿAndroid EnterpriseΓÇÖ**, Profile type as **ΓÇÿPersonally-owned work profile onlyΓÇÖ** and Targeted app as **ΓÇÿMicrosoft DefenderΓÇÖ**. - +1. Enter **Name** and **Description** to uniquely identify the configuration policy. Select platform as **'Android Enterprise'**, Profile type as **'Personally-owned work profile only'** and Targeted app as **'Microsoft Defender'**. + > [!div class="mx-imgBorder"] >  -1. On the settings page, in **ΓÇÿConfiguration settings formatΓÇÖ**, select **ΓÇÿUse configuration designerΓÇÖ** and click on **Add**. From the list of configurations that are displayed, select **ΓÇÿMicrosoft Defender in Personal profileΓÇÖ**. +1. On the settings page, in **'Configuration settings format'**, select **'Use configuration designer'** and click on **Add**. From the list of configurations that are displayed, select **'Microsoft Defender in Personal profile'**. > [!div class="mx-imgBorder"] >  Admins can go to the [Microsoft Endpoint Management admin center](https://endpoi Admins can also setup **privacy controls** from the Microsoft Endpoint Manager admin center to control what data can be sent by the Defender mobile client to the security portal. For more information, see [configuring privacy controls](android-configure.md). Organizations can communicate to their users to protect Personal profile with Microsoft Defender on their enrolled BYOD devices.-- Pre-requisite: Microsoft Defender must be already installed and active in work profile to enabled Microsoft Defender in personal profiles.--**To complete onboarding a device** -1. Install the Microsoft Defender application in a personal profile with a personal Google Play store account. -2. Install the Company portal application on personal profile. No sign-in is required. -3. When a user launches the application, they'll see the sign-in screen. **Login using corporate account only**. -4. On a successful login, users will see the following screens: - a. **EULA screen**: Presented only if the user has not consented already in the Work profile. +- Pre-requisite: Microsoft Defender must be already installed and active in work profile to enabled Microsoft Defender in personal profiles. - b. **Notice screen**: Users need to provide consent on this screen to move forward with onboarding the application. This is required only during the first run of the app. -5. Provide the required permissions to complete onboarding. +### To complete onboarding a device ->[!NOTE] ->**Pre-requisite:** - >1. The Company portal needs to be enabled on personal profile. - >2. Microsoft Defender needs to be already installed and active in work profile. +1. Install the Microsoft Defender application in a personal profile with a personal Google Play store account. +2. Install the Company portal application on personal profile. No sign-in is required. +3. When a user launches the application, they'll see the sign-in screen. **Login using corporate account only**. +4. On a successful login, users will see the following screens: + 1. **EULA screen**: Presented only if the user has not consented already in the Work profile. + 2. **Notice screen**: Users need to provide consent on this screen to move forward with onboarding the application. This is required only during the first run of the app. +5. Provide the required permissions to complete onboarding. +> [!NOTE] +> **Pre-requisite:** +> +> 1. The Company portal needs to be enabled on personal profile. +> 2. Microsoft Defender needs to be already installed and active in work profile. ## Related topics |
| security | Attack Surface Reduction | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction.md | You can create a custom view that filters events to only show the following even The "engine version" listed for attack surface reduction events in the event log, is generated by Defender for Endpoint, not by the operating system. Defender for Endpoint is integrated with Windows 10 and Windows 11, so this feature works on all devices with Windows 10 or Windows 11 installed. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Behavioral Blocking Containment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/behavioral-blocking-containment.md | A few minutes after the artifact was blocked, multiple instances of the same fil This example shows that with behavioral blocking and containment capabilities, threats are detected, contained, and blocked automatically. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Client Behavioral Blocking | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/client-behavioral-blocking.md | If your organization is using Defender for Endpoint, client behavioral blocking - [Next-generation protection](configure-microsoft-defender-antivirus-features.md) (antivirus, antimalware, and other threat protection capabilities) > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Cloud Protection Microsoft Antivirus Sample Submission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission.md | There are two more scenarios where Defender for Endpoint might request a file sa | Automated investigation and response content analysis | When [automated investigations](automated-investigations.md) are running on devices (when configured to run automatically in response to an alert or manually run), files that are identified as suspicious can be collected from the endpoints for further inspection. If necessary, the file content analysis feature for automated investigations can be disabled in the Microsoft 365 Defender portal. <br/><br/> The file extension names can also be modified to add or remove extensions for other file types that will be automatically submitted during an automated investigation. <br/><br/> To learn more, see [Manage automation file uploads](manage-automation-file-uploads.md). | > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Cloud Protection Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus.md | Now that you have an overview of cloud protection in Microsoft Defender Antiviru 2. Proceed to [Enable cloud protection](enable-cloud-protection-microsoft-defender-antivirus.md) > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Command Line Arguments Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/command-line-arguments-microsoft-defender-antivirus.md | The following table lists common errors that can occur while using the MpCmdRun |**ValidateMapsConnection failed to establish a connection to MAPS (hr=80072EE7 httpcode=451)**|The firewall is blocking the connection or conducting SSL inspection.| > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Common Exclusion Mistakes Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/common-exclusion-mistakes-microsoft-defender-antivirus.md | Microsoft Defender Antivirus Service runs in system context using the LocalSyste See [Use wildcards in the file name and folder path or extension exclusion lists](configure-extension-file-exclusions-microsoft-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) for information on how to use wildcards in exclusion lists. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configuration Management Reference Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configuration-management-reference-microsoft-defender-antivirus.md | The following articles provide further information, links, and resources for usi |[Manage Microsoft Defender Antivirus with the MpCmdRun.exe command-line tool](command-line-arguments-microsoft-defender-antivirus.md)|Instructions on using the dedicated command-line tool to manage and use Microsoft Defender Antivirus| > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Advanced Scan Types Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-advanced-scan-types-microsoft-defender-antivirus.md | If Microsoft Defender Antivirus detects a threat inside an email message, it wil On any OS, only the network drives that are mapped at system level, are scanned. User-level mapped network drives aren't scanned. User-level mapped network drives are those that a user maps in their session manually and using their own credentials. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Block At First Sight Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus.md | If you have a personal device that is not managed by an organization, you might > Turning off block at first sight lowers the level of protection for your device. We do not recommend permanently disabling block at first sight. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Cloud Block Timeout Period Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md | You can use Group Policy to specify an extended timeout for cloud checks. 5. Select **OK**. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-exclusions-microsoft-defender-antivirus.md | Keep the following points in mind when you are defining exclusions: - Review and audit changes to your list of exclusions. Your security team should preserve context around why a certain exclusion was added to avoid confusion later on. Your security team should be able to provide specific answers to questions about why exclusions exist. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Extension File Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus.md | If you do not have Internet access, you can create your own EICAR test file by w You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you are attempting to exclude. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Local Policy Overrides Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-local-policy-overrides-microsoft-defender-antivirus.md | You can disable this setting to ensure that only globally-defined lists (such as > If you disable local list merging, it will override controlled folder access settings. It also overrides any protected folders or allowed apps set by the local administrator. For more information about controlled folder access settings, see [Allow a blocked app in Windows Security](https://support.microsoft.com/help/4046851/windows-10-allow-blocked-app-windows-security). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Microsoft Defender Antivirus Features | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-microsoft-defender-antivirus-features.md | The following broad categories of features can be configured: > Review [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Network Connections Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-network-connections-microsoft-defender-antivirus.md | A similar message occurs if you're using Internet Explorer: The Windows event log will also show [Windows Defender client event ID 1116](troubleshoot-microsoft-defender-antivirus.md). > [!TIP]- > If youΓÇÖre looking for Antivirus related information for other platforms, see: + > If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Notifications Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-notifications-microsoft-defender-antivirus.md | To add custom contact information to endpoint notifications, see [Customize the 5. Select **OK**. This will prevent additional notifications from appearing. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Process Opened File Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md | $WDAVprefs.ExclusionProcess See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Microsoft Defender Antivirus cmdlets](/powershell/module/defender) for more information on how to use PowerShell with Microsoft Defender Antivirus. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Protection Features Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-protection-features-microsoft-defender-antivirus.md | See [Use next-gen Microsoft Defender Antivirus technologies through cloud protec | [Enable and configure Microsoft Defender Antivirus protection capabilities](configure-real-time-protection-microsoft-defender-antivirus.md)|Enable and configure real-time protection, heuristics, and other always-on Microsoft Defender Antivirus monitoring features | > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Real Time Protection Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus.md | The main real-time protection capability is enabled by default, but you can disa 6. Close **Local Group Policy Editor**. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Remediation Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-remediation-microsoft-defender-antivirus.md | You can also use the [`Set-MpPreference` PowerShell cmdlet](/powershell/module/d Also see [Configure remediation-required scheduled full Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md#remed) for more remediation-related settings. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Server Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-server-endpoints.md | You'll need to complete the following general steps to successfully onboard serv :::image type="content" source="images/server-onboarding-tools-methods.png" alt-text="An illustration of onboarding flow for Windows Servers and Windows 10 devices" lightbox="images/server-onboarding-tools-methods.png"::: -**Windows Server 2012 R2 and Windows Server 2016** +**Windows Server 2012 R2 and Windows Server 2016**: - Download installation and onboarding packages - Apply the installation package - Follow the onboarding steps for the corresponding tool -**Windows Server Semi-Annual Enterprise Channel and Windows Server 2019** +**Windows Server Semi-Annual Enterprise Channel and Windows Server 2019**: - Download the onboarding package - Follow the onboarding steps for the corresponding tool >[!IMPORTANT]->In order to be eligible to purchase Microsoft Defender for Endpoint Server SKU, you must have already purchased a combined minimum of any of the following, Windows E5/A5, Microsoft 365 E5/A5 or Microsoft 365 E5 Security subscription licenses. For more information on licensing, see the [Product Terms](https://www.microsoft.com/licensing/terms/productoffering/MicrosoftDefenderforEndpointServer/all). --+>In order to be eligible to purchase Microsoft Defender for Endpoint Server SKU, you must have already purchased a combined minimum of any of the following, Windows E5/A5, Microsoft 365 E5/A5 or Microsoft 365 E5 Security subscription licenses. For more information on licensing, see the [Product Terms](https://www.microsoft.com/licensing/terms/productoffering/MicrosoftDefenderforEndpointServer/all). ### New Windows Server 2012 R2 and 2016 functionality in the modern unified solution If you have previously onboarded your servers using MMA, follow the guidance pro The following specifics apply to the new unified solution package for Windows Server 2012 R2 and 2016: -- Ensure connectivity requirements as specified in [Enable access to Microsoft Defender for Endpoint service URLs in the proxy server](/microsoft-365/security/defender-endpoint/configure-proxy-internet?enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server) are met. They are equivalent to those for Windows Server 2019. +- Ensure connectivity requirements as specified in [Enable access to Microsoft Defender for Endpoint service URLs in the proxy server](/microsoft-365/security/defender-endpoint/configure-proxy-internet?enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server) are met. They are equivalent to those for Windows Server 2019. - We have identified an issue with Windows Server 2012 R2 connectivity to cloud when static TelemetryProxyServer is used **and** the certificate revocation list (CRL) URLs are not reachable from the SYSTEM account context. The immediate mitigation is to either use an alternative proxy option ("system-wide") that provides such connectivity, or configure the same proxy via the WinInet setting on the SYSTEM account context. Alternatively, use the instructions provided at [Workaround for a known issue with TelemetryProxyServer on disconnected machines](#workaround-for-a-known-issue-with-telemetryproxyserver-on-disconnected-machines) to install a certificate as a workaround. - Previously, the use of the Microsoft Monitoring Agent (MMA) on Windows Server 2016 and below allowed for the OMS / Log Analytics gateway to provide connectivity to Defender cloud services. The new solution, like Microsoft Defender for Endpoint on Windows Server 2019, Windows Server 2022, and Windows 10, does not support this gateway.-- On Windows Server 2016, verify that Microsoft Defender Antivirus is installed, is active and up to date. You can download and install the latest platform version using Windows Update. Alternatively, download the update package manually from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623) or from [MMPC](https://go.microsoft.com/fwlink/?linkid=870379&arch=x64). +- On Windows Server 2016, verify that Microsoft Defender Antivirus is installed, is active and up to date. You can download and install the latest platform version using Windows Update. Alternatively, download the update package manually from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623) or from [MMPC](https://go.microsoft.com/fwlink/?linkid=870379&arch=x64). - On Windows Server 2012 R2, there is no user interface for Microsoft Defender Antivirus. In addition, the user interface on Windows Server 2016 only allows for basic operations. To perform operations on a device locally, refer to [Manage Microsoft Defender for Endpoint with PowerShell, WMI, and MPCmdRun.exe](/microsoft-365/security/defender-endpoint/manage-mde-post-migration-other-tools). As a result, features that specifically rely on user interaction, such as where the user is prompted to make a decision or perform a specific task, may not work as expected. It is recommended to disable or not enable the user interface nor require user interaction on any managed server as it may impact protection capability. - Not all Attack Surface Reduction rules are available on all operating systems. See [Attack Surface Reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules). - To enable [Network Protection](/microsoft-365/security/defender-endpoint/network-protection), additional configuration is required: Affected scenario: Workaround: 1. Ensure the machine is running Sense version 10.8048.22439.1065 or higher by either installing using the latest package available from the onboarding page, or by applying KB5005292. 2. Download and unzip the certificate from https://github.com/microsoft/mdefordownlevelserver/blob/main/InterCA.zip-3. Import the certificate to the Local Computer trusted ΓÇ£Intermediate Certification AuthoritiesΓÇ¥ store. +3. Import the certificate to the Local Computer trusted "Intermediate Certification Authorities" store. You can use the PowerShell command: Import-Certificate -FilePath .\InterCA.cer -CertStoreLocation Cert:\LocalMachine\Ca For more information, see [Integration with Microsoft Defender for Cloud](azure- ### Prerequisites -**Prerequisites for Windows Server 2012 R2** +#### Prerequisites for Windows Server 2012 R2 If you have fully updated your machines with the latest [monthly rollup](https://support.microsoft.com/topic/october-12-2021-kb5006714-monthly-rollup-4dc4a2cd-677c-477b-8079-dcfef2bda09e) package, there are **no** additional prerequisites. The installer package will check if the following components have already been i - [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/help/3080149/update-for-customer-experience-and-diagnostic-telemetry) - [Update for Universal C Runtime in Windows](https://support.microsoft.com/topic/update-for-universal-c-runtime-in-windows-c0514201-7fe6-95a3-b0a5-287930f3560c) -**Prerequisites for Windows Server 2016** +#### Prerequisites for Windows Server 2016 -- The Servicing Stack Update (SSU) from September 14, 2021 or later must be installed. +- The Servicing Stack Update (SSU) from September 14, 2021 or later must be installed. - The Latest Cumulative Update (LCU) from September 20, 2018 or later must be installed. It is recommended to install the latest available SSU and LCU on the server. - The Microsoft Defender Antivirus feature must be enabled/installed and up to date. You can download and install the latest platform version using Windows Update. Alternatively, download the update package manually from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623) or from [MMPC](https://go.microsoft.com/fwlink/?linkid=870379&arch=x64). -**Prerequisites for running with third-party security solutions** +#### Prerequisites for running with third-party security solutions If you intend to use a third-party antimalware solution, you'll need to run Microsoft Defender Antivirus in passive mode. You must remember to set to passive mode during the installation and onboarding process. > [!NOTE] > If you're installing Microsoft Defender for Endpoint on Servers with McAfee Endpoint Security (ENS) or VirusScan Enterprise (VSE), the version of the McAfee platform may need to be updated to ensure Microsoft Defender Antivirus is not removed or disabled. For more information including the specific version numbers required, see, [McAfee Knowledge Center article](https://kc.mcafee.com/corporate/index?page=content&id=KB88214). -**Update package for Microsoft Defender for Endpoint on Windows Server 2012 R2 and 2016** +#### Update package for Microsoft Defender for Endpoint on Windows Server 2012 R2 and 2016 To receive regular product improvements and fixes for the EDR Sensor component, ensure Windows Update [KB5005292](https://go.microsoft.com/fwlink/?linkid=2168277) gets applied or approved. In addition, to keep protection components updated, see [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus#monthly-platform-and-engine-versions). --If youΓÇÖre using Windows Server Update Services (WSUS) and/or Microsoft Endpoint Configuration Manager, this new "Microsoft Defender for Endpoint update for EDR Sensor" is available under the category "Microsoft Defender for Endpoint". --+If you're using Windows Server Update Services (WSUS) and/or Microsoft Endpoint Configuration Manager, this new "Microsoft Defender for Endpoint update for EDR Sensor" is available under the category "Microsoft Defender for Endpoint". ### Onboarding steps summary - STEP 1: [Download the installation and onboarding packages](#step-1-download-installation-and-onboarding-packages) - STEP 2: [Apply the installation and onboarding package](#step-2-apply-the-installation-and-onboarding-package)-- STEP 3: [Complete the onboarding steps](#step-3-complete-the-onboarding-steps) +- STEP 3: [Complete the onboarding steps](#step-3-complete-the-onboarding-steps) ### STEP 1: Download installation and onboarding packages You will need to download both the **installation** and **onboarding** packages > [!div class="mx-imgBorder"] >  - > [!NOTE] > On Windows Server 2012R2, Microsoft Defender Antivirus will get installed by the installation package and will be active unless you set it to passive mode. On Windows Server 2016, Microsoft Defender Antivirus must be installed as a feature (see [Switch to MDE](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2#re-enable-microsoft-defender-antivirus-on-windows-server-2016)) first and fully updated before proceeding with the installation.- > + > > If you are running a non-Microsoft antimalware solution ensure you add exclusions for Microsoft Defender Antivirus ([from this list of Microsoft Defender Processes on the Defender Processes tab](https://download.microsoft.com/download/6/b/f/6bfff670-47c3-4e45-b01b-64a2610eaefa/mde-urls-commercial.xlsx)) to the non-Microsoft solution before installation. It is also recommended to add non-Microsoft security solutions to the Defender Antivirus exclusion list. - The **installation package** contains an MSI file that installs the Microsoft Defender for Endpoint agent. The **onboarding package** contains the following files: The **onboarding package** contains the following files: - `OptionalParamsPolicy` - contains the setting that enables sample collection - `WindowsDefenderATPOnboardingScript.cmd` - contains the onboarding script -Use the following steps to download the packages: +Use the following steps to download the packages: 1. In Microsoft 365 Defender, go to **Settings > Device Management > Onboarding**. 2. Select **Windows Server 2012 R2 and 2016**. -3. Select **Download installation package** and save the .msi file. - +3. Select **Download installation package** and save the .msi file. + 4. Select **Download onboarding package** and save the .zip file. 5. Install the installation package using any of the options to install Microsoft Defender Antivirus. The installation requires administrative permissions. -- ### STEP 2: Apply the installation and onboarding package-In this step you will install the prevention and detection components required before onboarding your device to the Microsoft Defender for Endpoint cloud environment, to prepare the machine for onboarding. Ensure all [prerequisites](#prerequisites) have been met. ++In this step you will install the prevention and detection components required before onboarding your device to the Microsoft Defender for Endpoint cloud environment, to prepare the machine for onboarding. Ensure all [prerequisites](#prerequisites) have been met. > [!NOTE]- > Microsoft Defender Antivirus will get installed and will be active unless you set it to passive mode. + > Microsoft Defender Antivirus will get installed and will be active unless you set it to passive mode. #### Options to install the Microsoft Defender for Endpoint packages -In the previous section, you downloaded an installation package. The installation package contains the installer for all Microsoft Defender for Endpoint components. +In the previous section, you downloaded an installation package. The installation package contains the installer for all Microsoft Defender for Endpoint components. You can use any of the following options to install the agent:+ - [Install using the command line](#install-microsoft-defender-for-endpoint-using-the-command-line) - [Install using a script](#install-microsoft-defender-for-endpoint-using-a-script) - [Apply the installation and onboarding packages using Group Policy](#apply-the-microsoft-defender-for-endpoint-installation-and-onboarding-packages-using-group-policy) ##### Install Microsoft Defender For Endpoint using the command line-Use the installation package from the previous step to install Microsoft Defender for Endpoint. +Use the installation package from the previous step to install Microsoft Defender for Endpoint. Run the following command to install Microsoft Defender for Endpoint: You can use the [installer script](server-migration.md#installer-script) to help ```console -ExecutionPolicy RemoteSigned \\servername-or-dfs-space\share-name\install.ps1 -OnboardingScript \\servername-or-dfs-space\share-name\windowsdefenderatponboardingscript.cmd- ``` + ``` - >[!NOTE] - >If you need to troubleshoot agent installation issues, add '-etl -log' to the install.ps1 script parameters. + > [!NOTE] + > If you need to troubleshoot agent installation issues, add '-etl -log' to the install.ps1 script parameters. >- >The recommended execution policy setting is `Allsigned`. This requires importing the script's signing certificate into the Local Computer Trusted Publishers store if the script is running as SYSTEM on the endpoint. + > The recommended execution policy setting is `Allsigned`. This requires importing the script's signing certificate into the Local Computer Trusted Publishers store if the script is running as SYSTEM on the endpoint. Replace \\servername-or-dfs-space\share-name with the UNC path, using the file server's fully qualified domain name (FQDN), of the shared *install.ps1* file. The installer package md4ws.msi must be placed in the same directory. Also ensure that the permissions of the UNC path allow read access to the computer account that's installing the platform. - - For scenarios where you want Microsoft Defender Antivirus to co-exist with non-Microsoft antimalware solutions, add the $Passive parameter to set passive mode during installation. 9. Select **OK** and close any open GPMC windows. The following steps are only applicable if you're using a third-party anti-malwa - Type: `REG_DWORD` - Value: `1` - :::image type="content" source="images/atp-verify-passive-mode.png" alt-text="The passive mode verification result" lightbox="images/atp-verify-passive-mode.png"::: + :::image type="content" source="images/atp-verify-passive-mode.png" alt-text="The passive mode verification result" lightbox="images/atp-verify-passive-mode.png"::: + > [!IMPORTANT] > > - When you use Microsoft Defender for Cloud to monitor servers, a Defender for Endpoint tenant is automatically created (in the US for US users, in the EU for European users, and in the UK for UK users). Data collected by Defender for Endpoint is stored in the geo-location of the ten > - The Onboarding package for Windows Server 2019 and Windows Server 2022 through Microsoft Endpoint Manager currently ships a script. For more information on how to deploy scripts in Configuration Manager, see [Packages and programs in Configuration Manager](/configmgr/apps/deploy-use/packages-and-programs). > - A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, or Microsoft Endpoint Configuration Manager. -- ## Windows Server Semi-Annual Enterprise Channel (SAC), Windows Server 2019 and Windows Server 2022 ### Download package Data collected by Defender for Endpoint is stored in the geo-location of the ten 4. Follow the steps provided in the [Complete the onboarding steps](#step-3-complete-the-onboarding-steps) section. - ## Verify the onboarding and installation Verify that Microsoft Defender Antivirus and Microsoft Defender for Endpoint are running. After onboarding the device, you can choose to run a detection test to verify th 1. Run the following command to verify that Microsoft Defender Antivirus is installed: - >[!NOTE] - >This verifcation step is only required if you're using Microsoft Defender Antivirus as your active antimalware solution. -- `sc.exe query Windefend` -+ > [!NOTE] + > This verification step is only required if you're using Microsoft Defender Antivirus as your active antimalware solution. - If the result is 'The specified service doesn't exist as an installed service', then you'll need to install Microsoft Defender Antivirus. + ```DOS + sc.exe query Windefend + ``` + If the result is 'The specified service doesn't exist as an installed service', then you'll need to install Microsoft Defender Antivirus. For information on how to use Group Policy to configure and manage Microsoft Defender Antivirus on your Windows servers, see [Use Group Policy settings to configure and manage Microsoft Defender Antivirus](use-group-policy-microsoft-defender-antivirus.md). 2. Run the following command to verify that Microsoft Defender for Endpoint is running: - `sc.exe query sense` + ```DOS + sc.exe query sense + ``` The result should show it is running. If you encounter issues with onboarding, see [Troubleshoot onboarding](troubleshoot-onboarding.md). |
| security | Configure Server Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-server-exclusions-microsoft-defender-antivirus.md | If necessary, you can add or remove custom exclusions. To do that, see the follo - [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Configure Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-updates.md | Use `Set-MpPreference -PlatformUpdatesChannel Beta` to configure platform update For more information on the parameters and how to configure them, see [Set-MpPreference (Microsoft Defender Antivirus)|Microsoft Docs](/powershell/module/defender/set-mppreference). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Defender Endpoint False Positives Negatives | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-false-positives-negatives.md | If you have worked through all the steps in this article and still need help, co 3. In the **Support Assistant** window, describe your issue, and then send your message. From there, you can open a service request. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Deploy Manage Report Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deploy-manage-report-microsoft-defender-antivirus.md | Topic | Description [Monitor and report on Microsoft Defender Antivirus protection](report-monitor-microsoft-defender-antivirus.md) | You can use Microsoft Intune, Microsoft Endpoint Configuration Manager, the Update Compliance add-in for Microsoft Operations Management Suite, or a third-party SIEM product (by consuming Windows event logs) to monitor protection status and create reports about endpoint protection. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Deploy Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deploy-microsoft-defender-antivirus.md | The remaining article in this section provides end-to-end advice and best practi - [Deployment guide for Microsoft Defender Antivirus in a virtual desktop infrastructure (VDI) environment](deployment-vdi-microsoft-defender-antivirus.md) > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Deployment Vdi Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus.md | Exclusions can be added, removed, or customized to suit your needs. For more information, see [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-exclusions-microsoft-defender-antivirus.md). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Detect Block Potentially Unwanted Apps Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md | Sometimes a file is erroneously blocked by PUA protection, or a feature of a PUA For more information, see [Configure and validate exclusions based on file extension and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Device Discovery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-discovery.md | Search for "SSH" related security recommendations to find SSH vulnerabilities th :::image type="content" source="images/1156c82ffadd356ce329d1cf551e806c.png" alt-text="The security recommendations dashboard" lightbox="images/1156c82ffadd356ce329d1cf551e806c.png"::: - ## Use advanced hunting on discovered devices You can use advanced hunting queries to gain visibility on discovered devices. Find details about discovered devices in the DeviceInfo table, or network-related information about those devices in the DeviceNetworkInfo table. Run this query, on the DeviceInfo table, to return all discovered devices along DeviceInfo | summarize arg_max(Timestamp, *) by DeviceId // Get latest known good per device Id | where isempty(MergedToDeviceId) // Remove invalidated/merged devices-| where OnboardingStatus != "Onboarded" +| where OnboardingStatus != "Onboarded" ``` -By invoking the **SeenBy** function, in your advanced hunting query, you can get detail on which onboarded device a discovered device was seen by. This information can help determine the network location of each discovered device and subsequently, help to identify it in the network.  +By invoking the **SeenBy** function, in your advanced hunting query, you can get detail on which onboarded device a discovered device was seen by. This information can help determine the network location of each discovered device and subsequently, help to identify it in the network. ```query DeviceInfo-| where OnboardingStatus != "Onboarded" -| summarize arg_max(Timestamp, *) by DeviceId  -| where isempty(MergedToDeviceId)  -| limit 100 -| invoke SeenBy() -| project DeviceId, DeviceName, DeviceType, SeenBy +| where OnboardingStatus != "Onboarded" +| summarize arg_max(Timestamp, *) by DeviceId +| where isempty(MergedToDeviceId) +| limit 100 +| invoke SeenBy() +| project DeviceId, DeviceName, DeviceType, SeenBy ``` For more information, see the [SeenBy()](/microsoft-365/security/defender/advanced-hunting-seenby-function) function. |
| security | Enable Cloud Protection Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus.md | For more information about allowed parameters, see [Windows Defender WMIv2 APIs] > If automatic sample submission has been configured with Group Policy then the setting will be greyed-out and unavailable. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Enable Troubleshooting Mode | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-troubleshooting-mode.md | + + Title: Get started with troubleshooting mode in Microsoft Defender for Endpoint +description: Turn on the Microsoft Defender for Endpoint troubleshooting mode to address various antivirus issues. +keywords: antivirus, troubleshoot, troubleshooting mode, tamper protection, compatibility +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++ - m365-security-compliance ++ms.technology: mde +++# Get started with troubleshooting mode in Microsoft Defender for Endpoint +++**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037) ++> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) +++Microsoft Defender for Endpoint troubleshooting mode allows you to troubleshoot various Microsoft Defender antivirus features by enabling them from the device and testing different scenarios, even if they're controlled by the organization policy. The troubleshooting mode is disabled by default and requires you to turn it on for a device (and/or group of devices) for a limited time. Note that this is exclusively an Enterprise-only feature, and requires Microsoft 365 Defender access. ++## What do you need to know before you begin? ++- Use troubleshooting mode to disable/change the tamper protection setting to perform: ++ - Microsoft Defender Antivirus functional troubleshooting /application compatibility (false positive application blocks). ++ - Microsoft Defender Antivirus performance troubleshooting by using the troubleshooting mode and manipulating tamper protection and other antivirus settings. ++- If a tampering event occurs (for example, the `MpPreference` snapshot is altered or deleted), troubleshooting mode will end and tamper protection will be enabled on the device. ++- Local admins, with appropriate permissions, can change configurations on individual endpoints that are usually locked by policy. Having a device in troubleshooting mode can be helpful when diagnosing Microsoft Defender Antivirus performance and compatibility scenarios. ++ - Local admins won't be able to turn off Microsoft Defender Antivirus, or uninstall it. ++ - Local admins will be able to configure all other security settings in the Microsoft Defender Antivirus suite (for example, cloud protection, tamper protection). ++- Admins with “Manage Security settings” permissions will have access to turn on troubleshooting mode. ++- Microsoft Defender for Endpoint collects logs and investigation data throughout the troubleshooting process. ++ - Snapshot of `MpPreference` will be taken before troubleshooting mode begins. ++ - Second snapshot will be taken just before troubleshooting mode expires. ++ - Operational logs from during troubleshooting mode will also be collected. ++ - All the above logs and snapshots will be collected and will be available for an admin to collect using the [Collect investigation package](respond-machine-alerts.md#collect-investigation-package-from-devices) feature on the device page. Note that Microsoft won't remove this data from the device until an admin collects them. ++- Admins can also review the changes in settings that take place during Troubleshooting mode in **Event Viewer** on the device page. ++- Troubleshooting mode automatically turns off after reaching the expiration time (it lasts for 3 hours). After expiration, all policy-managed configurations will become read-only again and will revert back to how it was before setting the troubleshooting mode on. ++- It could take up to 15 minutes from the time the command is sent from Microsoft 365 Defender to when it becomes active on the device. ++- Notification will be sent to the end user when the troubleshooting mode begins and when the troubleshooting mode ends. A warning will also be sent notifying that it will end soon. ++- While troubleshooting mode is active, endpoint detection and response (EDR) will not block any files, folders, or processes that Microsoft Defender Antivirus has excluded from scans. ++- The beginning and ending of troubleshooting mode will be identified in the **Device Timeline** on the device page. ++- You can query all troubleshooting mode events in advanced hunting. ++> [!NOTE] +> Policy management changes will be applied to the machine when it is actively in Troubleshooting mode. However, the changes will not take effect until the Troubleshooting mode expires. Additionally, Microsoft Defender Antivirus Platform updates will not be applied during Troubleshooting mode. Platform updates will be applied once Troubleshooting mode ends with a Windows update. ++## Prerequisites ++- A device running Windows 10 (version 19044.1618 or later), Windows 11, Windows Server 2019, or Windows Server 2022. ++ Semester/Redstone|OS version|Release + :|:|: + 21H2/SV1|>=22000.593|[KB5011563: Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB5011563) + 20H1/20H2/21H1|>=19042.1620<br/> >=19041.1620<br/> >=19043.1620|[KB5011543: Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB5011543) + Windows Server 2022|>=20348.617|[KB5011558: Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB5011558) + Windows Server 2019 (RS5)|>=17763.2746|[KB5011551: Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB5011551) ++- For troubleshooting mode to be applied, Microsoft Defender for Endpoint must be tenant-enrolled and active on the device. ++- The device must be actively running Microsoft Defender Antivirus, version 4.18.2203 or later. ++## Enable the troubleshooting mode ++1. Go to the Microsoft 365 Defender portal (https://security.microsoft.com), and sign in. ++2. Navigate to the device page/machine page for the device you would like to turn on troubleshooting mode. Select **Turn on troubleshooting mode**. Note that this requires "Manage security settings in Security Center" permissions for Microsoft Defender for Endpoint. ++ :::image type="content" source="../../media/ts-mode-menu.png" alt-text="Turn on troubleshooting mode" lightbox="../../media/ts-mode-menu.png"::: ++3. Confirm you want to turn on troubleshooting mode for the device. ++ :::image type="content" source="../../media/ts-mode-conf-flyout.png" alt-text="The configuration flyout" lightbox="../../media/ts-mode-conf-flyout.png"::: + +4. The device page shows the device is now in troubleshooting mode. ++ :::image type="content" source="../../media/ts-mode-option-greyed-out.png" alt-text="The device is now in troubleshooting mode" lightbox="../../media/ts-mode-option-greyed-out.png"::: ++## Advanced hunting queries ++Here are some pre-built advanced hunting queries to give you visibility into the troubleshooting events that are occurring in your environment. You can also use these queries to [create detection rules](/defender/custom-detection-rules.md#create-a-custom-detection-rule) that'd alert you when the devices are in troubleshooting mode. ++### Get troubleshooting events for a particular device ++```kusto +let deviceName = "<device name>"; // update with device name +let deviceId = "<device id>"; // update with device id +search in (DeviceEvents) +(DeviceName == deviceName +) and ActionType == "AntivirusTroubleshootModeEvent" +| extend _tsmodeproperties = parse_json(AdditionalFields)  +| project $table, Timestamp,DeviceId, DeviceName, _tsmodeproperties, + _tsmodeproperties.TroubleshootingState, _tsmodeproperties.TroubleshootingPreviousState, _tsmodeproperties.TroubleshootingStartTime, + _tsmodeproperties.TroubleshootingStateExpiry, _tsmodeproperties.TroubleshootingStateRemainingMinutes, + _tsmodeproperties.TroubleshootingStateChangeReason, _tsmodeproperties.TroubleshootingStateChangeSource +``` ++### Devices currently in troubleshooting mode  ++```kusto +search in (DeviceEvents) +ActionType == "AntivirusTroubleshootModeEvent" +| extend _tsmodeproperties = parse_json(AdditionalFields)  +| where Timestamp > ago(3h) +| where _tsmodeproperties.TroubleshootingStateChangeReason == "Troubleshooting mode started" +|summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId +``` ++### Count of troubleshooting mode instances by device ++```kusto +search in (DeviceEvents) +ActionType == "AntivirusTroubleshootModeEvent" +| extend _tsmodeproperties = parse_json(AdditionalFields)  +| where Timestamp > ago(30d)  // choose the date range you want +| where _tsmodeproperties.TroubleshootingStateChangeReason == "Troubleshooting mode started" +| summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId +| sort by count_ +``` ++### Total count ++```kusto +search in (DeviceEvents) +ActionType == "AntivirusTroubleshootModeEvent" +| extend _tsmodeproperties = parse_json(AdditionalFields)  +| where Timestamp > ago(2d) //beginning of time range +| where Timestamp < ago(1d) //end of time range +| where _tsmodeproperties.TroubleshootingStateChangeReason == "Troubleshooting mode started" +| summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count()  +| where count_ > 5          // choose your max # of TS mode instances for your time range +``` ++## Related topic ++- [Troubleshooting mode scenarios](troubleshooting-mode-scenarios.md) +- [Protect security settings with tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) |
| security | Evaluate Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/evaluate-microsoft-defender-antivirus.md | You can also download a PowerShell that will enable all the settings described i > For the latest recommendations for real-world deployment and monitoring of Microsoft Defender Antivirus across a network, see [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Export Security Baseline Assessment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/export-security-baseline-assessment.md | - + # Export security baselines assessment per device [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] GET https://api.securitycenter.microsoft.com/api/machines/BaselineComplianceAsse ### 1.7.2 Response example ```json-{ -"@odata.context": " https://api.securitycenter.microsoft.com /api/$metadata#Collection(microsoft.windowsDefenderATP.api.AssetBaselineAssessment)", +{ +"@odata.context": " https://api.securitycenter.microsoft.com /api/$metadata#Collection(microsoft.windowsDefenderATP.api.AssetBaselineAssessment)", "value": [-{ - "id": "0000682575d5d473e82ed4d8680425d152411251_9e1b90be-e83e-485b-a5ec-4a429412e734_1.1.1", - "configurationId": "1.1.1", - "deviceId": "0000682575d5d473242222425d152411251", - "deviceName": " ComputerPII_365f5c0bb7202c163937dad3d017969b2d760eb4.DomainPII_29596 ", - "profileId": "9e1b90be-e83e-485b-a5ec-4a429412e734", - "osPlatform": "WindowsServer2019", - "osVersion": "10.0.17763.2330", - "rbacGroupId": 86, - "rbacGroupName": "UnassignedGroup", - "isApplicable": true, - "isCompliant": false, - "dataCollectionTimeOffset": "2021-12-22T00:08:02.478Z", - "recommendedValue": [ -                 "Greater than or equal '24'" -             ], -             "currentValue": [ -                 "24" -             ], -             "source": [ -                 "password_hist_len" -             ], +{ + "id": "0000682575d5d473e82ed4d8680425d152411251_9e1b90be-e83e-485b-a5ec-4a429412e734_1.1.1", + "configurationId": "1.1.1", + "deviceId": "0000682575d5d473242222425d152411251", + "deviceName": " ComputerPII_365f5c0bb7202c163937dad3d017969b2d760eb4.DomainPII_29596 ", + "profileId": "9e1b90be-e83e-485b-a5ec-4a429412e734", + "osPlatform": "WindowsServer2019", + "osVersion": "10.0.17763.2330", + "rbacGroupId": 86, + "rbacGroupName": "UnassignedGroup", + "isApplicable": true, + "isCompliant": false, + "dataCollectionTimeOffset": "2021-12-22T00:08:02.478Z", + "recommendedValue": [ + "Greater than or equal '24'" + ], + "currentValue": [ + "24" + ], + "source": [ + "password_hist_len" + ], } ``` GET /api/machines/BaselineComplianceAssessmentExport ### 2.4 Parameters -- sasValidHours: The number of hours that the download URLs will be valid for (Maximum 24 hours). +- sasValidHours: The number of hours that the download URLs will be valid for (Maximum 24 hours). ### 2.5 Properties (via files) GET https://api.securitycenter.microsoft.com/api/machines/BaselineComplianceAsse ### 2.6.2 Response example ```json-{ -    "@odata.context": "https://api.securitycenter. contoso.com/api/$metadata#microsoft.windowsDefenderATP.api.ExportFilesResponse", -    "exportFiles":  - [ -    "https://tvmexportexternalstgeus.blob.core.windows.net/temp-1ebd3d09-d06a-4aad-ab80-ebc536cec61c/2021-12-22/0500/BaselineAssessmentExport/json/OrgId= OrgId=<Org Id>/_RbacGroupId=<Rbac Group Id>/part-00000-c09dfd00-2278-4735-b23a-71733751fcbc.c000.json.gz?sv=ABCD", -   "https://tvmexportexternalstgeus.blob.core.windows.net/temp-1ebd3d09-d06a-4aad-ab80-ebc536cec61c/2021-12-22/0500/BaselineAssessmentExport/json/OrgId=<Org Id>/_RbacGroupId=<Rbac Group Id>/part-00001-c09dfd00-2278-4735-b23a-71733751fcbc.c000.json.gz?sv= ABCD", -    ], -    "generatedTime": "2021-01-11T11:01:00Z" +{ + "@odata.context": "https://api.securitycenter. contoso.com/api/$metadata#microsoft.windowsDefenderATP.api.ExportFilesResponse", + "exportFiles": + [ + "https://tvmexportexternalstgeus.blob.core.windows.net/temp-1ebd3d09-d06a-4aad-ab80-ebc536cec61c/2021-12-22/0500/BaselineAssessmentExport/json/OrgId= OrgId=<Org Id>/_RbacGroupId=<Rbac Group Id>/part-00000-c09dfd00-2278-4735-b23a-71733751fcbc.c000.json.gz?sv=ABCD", + "https://tvmexportexternalstgeus.blob.core.windows.net/temp-1ebd3d09-d06a-4aad-ab80-ebc536cec61c/2021-12-22/0500/BaselineAssessmentExport/json/OrgId=<Org Id>/_RbacGroupId=<Rbac Group Id>/part-00001-c09dfd00-2278-4735-b23a-71733751fcbc.c000.json.gz?sv= ABCD", + ], + "generatedTime": "2021-01-11T11:01:00Z" } ``` |
| security | Feedback Loop Blocking | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/feedback-loop-blocking.md | If your organization is using Defender for Endpoint, feedback-loop blocking is e - [Next-generation protection](/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features) (antivirus) > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Get Security Baselines Assessment Configurations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-security-baselines-assessment-configurations.md | +- Supports OData V4 queries - OData supported operators:- - `$filter` on:  `id`,  `category`,  `name`, `CCE` - - `$top` with max value of 10,000 + - `$filter` on: `id`, `category`, `name`, `CCE` + - `$top` with max value of 10,000 - `$skip` ### 1.2 HTTP request ```http-GET /api/baselineConfigurations  +GET /api/baselineConfigurations ``` ### 1.3 Request headers Authorization|String|Bearer {token}. **Required**. ### 1.4 Response -If successful, this method returns 200 OK with the list of baseline configurations in the body.  +If successful, this method returns 200 OK with the list of baseline configurations in the body. ### 1.5 Properties GET https://api.securitycenter.microsoft.com/api/baselineConfigurations ### 1.6.2 Response example ```json-{  -    "@odata.context": " https://api-df.securitycenter.microsoft.com/api/$metadata#BaselineConfigurations ",  -    "value": [  -        {  -            "id": "1.1.8",  -            "name": "(L1) Ensure 'Allow importing of payment info' is set to 'Disabled'",  -            "description": "<p xmlns:xhtml=\"http://www.w3.org/1999/xhtml\">This policy setting controls whether users are able to import payment information from another browser into Microsoft Edge as well as whether payment information is imported on first use.</p>",  -            "category": "Microsoft Edge",  -            "complianceLevels": [  -                "Level 1 (L1) - Corporate/Enterprise Environment (general use)",  -                "Level 2 (L2) - High Security/Sensitive Data Environment (limited functionality)"  -            ],  -            "cce": "",  -            "rationale": "<p xmlns:xhtml=\"http://www.w3.org/1999/xhtml\">Having payment information automatically imported or allowing users to import payment data from another browser into Microsoft Edge could allow for sensitive data to be imported into Edge.</p>",  -            "remediation": "<div xmlns:xhtml=\"http://www.w3.org/1999/xhtml\">\r\n  <p>\r\n    <p>\r\nTo establish the recommended configuration via GP, set the following UI path to                 <span class=\"inline_block\">Disabled</span></p>\r\n    <code class=\"code_block\">Computer Configuration\\Policies\\Administrative Templates\\Microsoft Edge\\Allow importing of payment info\r\n</code>\r\n    <p>\r\n      <strong>Note:</strong>\r\n This Group Policy path may not exist by default. It is provided by the Group Policy template                 <span class=\"inline_block\">MSEdge.admx/adml</span>\r\n that can be downloaded from Microsoft                 <a href=\"https://www.microsoft.com/en-us/edge/business/download\">here</a>\r\n.              </p>\r\n    <p class=\"bold\">Impact:</p>\r\n    <p>\r\n      <p>Users will be unable to perform a payment information import from other browsers into Microsoft Edge.</p>\r\n    </p>\r\n  </p>\r\n</div>",  -            "benchmarkName": "CIS"  -"recommendedValue": [ -                "Equals '0'" -            ], -            "source": [ -                "hkey_local_machine\\software\\policies\\microsoft\\windows\\eventlog\\security\\retention" -            ] -        },  -    ]  -}  +{ + "@odata.context": " https://api-df.securitycenter.microsoft.com/api/$metadata#BaselineConfigurations ", + "value": [ + { + "id": "1.1.8", + "name": "(L1) Ensure 'Allow importing of payment info' is set to 'Disabled'", + "description": "<p xmlns:xhtml=\"http://www.w3.org/1999/xhtml\">This policy setting controls whether users are able to import payment information from another browser into Microsoft Edge as well as whether payment information is imported on first use.</p>", + "category": "Microsoft Edge", + "complianceLevels": [ + "Level 1 (L1) - Corporate/Enterprise Environment (general use)", + "Level 2 (L2) - High Security/Sensitive Data Environment (limited functionality)" + ], + "cce": "", + "rationale": "<p xmlns:xhtml=\"http://www.w3.org/1999/xhtml\">Having payment information automatically imported or allowing users to import payment data from another browser into Microsoft Edge could allow for sensitive data to be imported into Edge.</p>", + "remediation": "<div xmlns:xhtml=\"http://www.w3.org/1999/xhtml\">\r\n <p>\r\n <p>\r\nTo establish the recommended configuration via GP, set the following UI path to <span class=\"inline_block\">Disabled</span></p>\r\n <code class=\"code_block\">Computer Configuration\\Policies\\Administrative Templates\\Microsoft Edge\\Allow importing of payment info\r\n</code>\r\n <p>\r\n <strong>Note:</strong>\r\n This Group Policy path may not exist by default. It is provided by the Group Policy template <span class=\"inline_block\">MSEdge.admx/adml</span>\r\n that can be downloaded from Microsoft <a href=\"https://www.microsoft.com/en-us/edge/business/download\">here</a>\r\n. </p>\r\n <p class=\"bold\">Impact:</p>\r\n <p>\r\n <p>Users will be unable to perform a payment information import from other browsers into Microsoft Edge.</p>\r\n </p>\r\n </p>\r\n</div>", + "benchmarkName": "CIS" +"recommendedValue": [ + "Equals '0'" + ], + "source": [ + "hkey_local_machine\\software\\policies\\microsoft\\windows\\eventlog\\security\\retention" + ] + }, + ] +} ``` ## See also |
| security | Get Security Baselines Assessment Profiles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-security-baselines-assessment-profiles.md | - + # List all security baselines assessment profiles [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]-This API retrieves a list of all security baselines assessment profiles created by the organization.  +This API retrieves a list of all security baselines assessment profiles created by the organization. ### 1.1 Parameters -- Supports OData V4 queries.  -- OData supported operators:  - - $filter on : id,name, operatingSystem, operatingSystemVersion, status, settingsNumber, passedDevices, totalDevices  - - $top with max value of 10,000.  +- Supports OData V4 queries. +- OData supported operators: + - $filter on : id,name, operatingSystem, operatingSystemVersion, status, settingsNumber, passedDevices, totalDevices + - $top with max value of 10,000. - $skip. ### 1.2 HTTP request Authorization|String|Bearer {token}. **Required**. ### 1.5.1 Request example ```http-GET https://api.securitycenter.microsoft.com/api/baselineProfiles  +GET https://api.securitycenter.microsoft.com/api/baselineProfiles ``` ### 1.6.2 Response example ```json-{  -    "@odata.context": "https:// api.securitycenter.microsoft.com/api/$metadata#Collection(microsoft.windowsDefenderATP.api.PublicBaselineProfileDto)",  -    "value":  - [  -        {  -            "id": "02bcbb9d-d197-479e-811e-1cd5a6f9f8fa",  -            "name": "Windows 10 build 1909 CIS profile",  -            "description": "important",  -            "benchmark": "CIS",  -            "version": "1.0.0",  -            "operatingSystem": "Windows 10",  -            "operatingSystemVersion": "1909",  -            "status": true,  -            "complianceLevel": "Level 1 (L1) - Corporate/Enterprise Environment (general use)",  -            "settingsNumber": 51,  -            "createdBy": "user@org.net",  -            "lastUpdatedBy": null,  -            "createdOnTimestampUTC": "0001-01-01T00:00:00Z",  -            "lastUpdateTimestampUTC": "0001-01-01T00:00:00Z",  -            "passedDevices": 0,  -            "totalDevices": 10  -        }  -     ]  -}  +{ + "@odata.context": "https:// api.securitycenter.microsoft.com/api/$metadata#Collection(microsoft.windowsDefenderATP.api.PublicBaselineProfileDto)", + "value": + [ + { + "id": "02bcbb9d-d197-479e-811e-1cd5a6f9f8fa", + "name": "Windows 10 build 1909 CIS profile", + "description": "important", + "benchmark": "CIS", + "version": "1.0.0", + "operatingSystem": "Windows 10", + "operatingSystemVersion": "1909", + "status": true, + "complianceLevel": "Level 1 (L1) - Corporate/Enterprise Environment (general use)", + "settingsNumber": 51, + "createdBy": "user@org.net", + "lastUpdatedBy": null, + "createdOnTimestampUTC": "0001-01-01T00:00:00Z", + "lastUpdateTimestampUTC": "0001-01-01T00:00:00Z", + "passedDevices": 0, + "totalDevices": 10 + } + ] +} ``` ## See also |
| security | Limited Periodic Scanning Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/limited-periodic-scanning-microsoft-defender-antivirus.md | Sliding the switch to **On** will show the standard Microsoft Defender AV option - [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Machine Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/machine-reports.md | For example, to show data about Windows 10 devices with Active sensor health sta 3. Select **Apply**. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Manage Event Based Updates Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-event-based-updates-microsoft-defender-antivirus.md | If you have enabled cloud-delivered protection, Microsoft Defender AV will send > **Allow notifications to disable definitions based reports** enables Microsoft MAPS to disable those definitions known to cause false-positive reports. You must configure your computer to join Microsoft MAPS for this function to work. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Manage Gradual Rollout | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-gradual-rollout.md | To create your own custom gradual rollout process for monthly updates, you can u For details on how to use these tools, see [Create a custom gradual rollout process for Microsoft Defender updates](configure-updates.md). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Manage Outdated Endpoints Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-outdated-endpoints-microsoft-defender-antivirus.md | See the following for more information and allowed parameters: 4. [Deploy the updated policy as usual](/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Manage Protection Update Schedule Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-protection-update-schedule-microsoft-defender-antivirus.md | See the following for more information and allowed parameters: - [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Manage Protection Updates Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-protection-updates-microsoft-defender-antivirus.md | To ensure the best level of protection, Microsoft Update allows for rapid releas > [!NOTE] > Security intelligence updates contain engine updates and are released on a monthly cadence.-Security intelligence updates are also delivered multiple times a day, but this package doesnΓÇÖt contain an engine. +Security intelligence updates are also delivered multiple times a day, but this package doesn't contain an engine. > [!IMPORTANT] Set up a network file share (UNC/mapped drive) to download security intelligence > Do not add the x64 (or x86) folder in the path. The mpcmdrun.exe process adds it automatically. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Manage Updates Baselines Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus.md | For more information, see [Microsoft Defender update for Windows operating syste | [Microsoft Defender for Endpoint update for EDR Sensor](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac) | You can update the EDR sensor (MsSense.exe) that is included in the new Microsoft Defender for Endpoint unified solution package released in 2021. | > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Manage Updates Mobile Devices Vms Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md | You can configure Microsoft Defender Antivirus to only download protection updat This action prevents protection updates from downloading when the PC is on battery power. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Microsoft Defender Antivirus Compatibility | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility.md | The table in this section describes various states you might see with Microsoft | Disabled <br/><br/> or <br/><br/> Uninstalled | When disabled or uninstalled, Microsoft Defender Antivirus is not used as the antivirus app. Files are not scanned and threats are not remediated. <br/><br/> Disabling or uninstalling Microsoft Defender Antivirus is not recommended in general; if possible, keep Microsoft Defender Antivirus in passive mode if you are using a non-Microsoft antimalware/antivirus solution. <br/><br/> In cases where Microsoft Defender Antivirus is disabled automatically, it can be re-enabled automatically if the non-Microsoft antivirus/antimalware product expires or otherwise stops providing real-time protection from viruses, malware, or other threats. The automatic re-enabling of Microsoft Defender Antivirus helps to ensure that antivirus protection is maintained on your endpoints. <br/><br/> You might also use [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), which works with the Microsoft Defender Antivirus engine to periodically check for threats if you are using a non-Microsoft antivirus app. | > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Microsoft Defender Antivirus Windows | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows.md | You'll see the name of your antivirus/antimalware solution on the settings page. It's important to keep Microsoft Defender Antivirus, or any antivirus/antimalware solution, up to date. Microsoft releases regular updates to help ensure that your devices have the latest technology to protect against new malware and attack techniques. To learn more, see [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Microsoft Defender Offline | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-offline.md | See the following for more information: Microsoft Defender Offline scan results will be listed in the [Scan history section of the Windows Security app](microsoft-defender-security-center-antivirus.md). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Network Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/network-protection.md | A user visits a website: ### Network protection: C2 detection and remediation -In its initial form, ransomware is a commodity threat, pre-programmed and focused on limited, specific outcomes (for example, encrypting a computer). However, ransomware has evolved into a sophisticated threat that is human driven, adaptive, and focused on larger scale and more widespread outcomes; like holding an entire organizationΓÇÖs assets or data for ransom. +In its initial form, ransomware is a commodity threat, pre-programmed and focused on limited, specific outcomes (for example, encrypting a computer). However, ransomware has evolved into a sophisticated threat that is human driven, adaptive, and focused on larger scale and more widespread outcomes; like holding an entire organization's assets or data for ransom. Support for Command and Control (C2) is a key part of this ransomware evolution and is what enables these attacks to adapt to the environment they target. Breaking the link to the command-and-control infrastructure means stopping the progression of an attack to its next stage. #### Detecting and remediating CobaltStrike (public preview) -One of the most common post-exploitation frameworks used in human-operated ransomware attacks is CobaltStrike. Threat Intelligence teams across Microsoft track _Tactics, Techniques, and Procedures_ (TTPs) on multiple activity groups that deploy ransomware to identify patterns of behavior that can be used to defend against specific strategies and threat vectors used by malicious actors. These ransomware activity groups all, at some point in the attack life cycle, involve deploying a CobaltStrike Beacon to a victimΓÇÖs computer to enable hands-on keyboard activity. +One of the most common post-exploitation frameworks used in human-operated ransomware attacks is CobaltStrike. Threat Intelligence teams across Microsoft track _Tactics, Techniques, and Procedures_ (TTPs) on multiple activity groups that deploy ransomware to identify patterns of behavior that can be used to defend against specific strategies and threat vectors used by malicious actors. These ransomware activity groups all, at some point in the attack life cycle, involve deploying a CobaltStrike Beacon to a victim's computer to enable hands-on keyboard activity. -CobaltStrike enables customization of multiple aspects of the attack, from the ability to host multiple listeners responding to different protocols, to how the main client-side component (Beacon) should perform code injection and run post exploitation jobs. When Microsoft Defender detects CobaltStrike, it can intelligently find and collect key indicators of compromise (IoC). Once captured, these indicators are shared throughout MicrosoftΓÇÖs product stack for detection and protection purposes. +CobaltStrike enables customization of multiple aspects of the attack, from the ability to host multiple listeners responding to different protocols, to how the main client-side component (Beacon) should perform code injection and run post exploitation jobs. When Microsoft Defender detects CobaltStrike, it can intelligently find and collect key indicators of compromise (IoC). Once captured, these indicators are shared throughout Microsoft's product stack for detection and protection purposes. -Microsoft DefenderΓÇÖs command and control detection isn't limited to CobaltStrike. Microsoft Defender can capture key IoCs of multiple malware families. The indicators are shared across the Microsoft protection stack to protect customers and alert them if there's a compromise. +Microsoft Defender's command and control detection isn't limited to CobaltStrike. Microsoft Defender can capture key IoCs of multiple malware families. The indicators are shared across the Microsoft protection stack to protect customers and alert them if there's a compromise. Blocking command-and-control communication can severely impede a targeted attack, giving defenders time to find the initial entry vectors and close them down before another attempted attack. Blocking command-and-control communication can severely impede a targeted attack ## Smart Screen Unblock -A new feature in Microsoft Defender for Endpoint Indicators enables administrators to allow end users to bypass ΓÇ£WarningsΓÇ¥ generated for some URLs and IPs. Depending on why the URL was blocked, when a Smart Screen block is encountered it may offer administrators the ability to unblock the site for up to 24 hours. In such cases, a Windows Security toast notification will appear, permitting the end-user to **Unblock** the URL or IP for the defined period of time. +A new feature in Microsoft Defender for Endpoint Indicators enables administrators to allow end users to bypass "Warnings" generated for some URLs and IPs. Depending on why the URL was blocked, when a Smart Screen block is encountered it may offer administrators the ability to unblock the site for up to 24 hours. In such cases, a Windows Security toast notification will appear, permitting the end-user to **Unblock** the URL or IP for the defined period of time. > [!div class="mx-imgBorder"] >  Network protection is enabled per device, which is typically done using your man > [!NOTE] > Microsoft Defender Antivirus must be active to enable Network protection. -You can enable Network Protection in **Audit** mode or **Block** mode. If you want to evaluate the impact of enabling Network Protection before blocking IPΓÇÖs or URLs, you can enable it in Audit mode for a period of time to gather data on what would be blocked. Audit mode logs when end users have connected to an address or site that would otherwise have been blocked by network protection. +You can enable Network Protection in **Audit** mode or **Block** mode. If you want to evaluate the impact of enabling Network Protection before blocking IP's or URLs, you can enable it in Audit mode for a period of time to gather data on what would be blocked. Audit mode logs when end users have connected to an address or site that would otherwise have been blocked by network protection. ## Advanced Hunting |
| security | Next Generation Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/next-generation-protection.md | For information on how to configure next-generation protection services, see [Co > Configuration and management is largely the same in Windows Server as in Windows clients. However, there are some differences. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Office 365 Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/office-365-microsoft-defender-antivirus.md | Protection from ransomware is one great reason to put your files in OneDrive. An > [!VIDEO https://www.microsoft.com/videoplayer/embed/70b4d256-46fb-481f-ad9b-921ef5fd7bed] > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Prevent Changes To Security Settings With Tamper Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection.md | Your security operations team can also use hunting queries, such as the followin [View information about tampering attempts](#view-information-about-tampering-attempts). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) Your security operations team can also use hunting queries, such as the followin - [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](/intune/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) - [Get an overview of Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint) - [Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](why-use-microsoft-defender-antivirus.md)+- [Enable troubleshooting mode](enable-troubleshooting-mode.md) +- [Troubleshooting mode scenarios](troubleshooting-mode-scenarios.md) |
| security | Prevent End User Interaction Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/prevent-end-user-interaction-microsoft-defender-antivirus.md | You can prevent users from pausing scans, which can be helpful to ensure schedul 5. Double-click the **Allow users to pause scan** setting and set the option to **Disabled**. Click **OK**. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Report Monitor Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/report-monitor-microsoft-defender-antivirus.md | You can also [monitor malware events using the Malware Assessment solution in Lo For monitoring or determining status with PowerShell, WMI, or Microsoft Azure, see the [(Deployment, management, and reporting options table)](deploy-manage-report-microsoft-defender-antivirus.md#ref2). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Restore Quarantined Files Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/restore-quarantined-files-microsoft-defender-antivirus.md | If Microsoft Defender Antivirus is configured to detect and remediate threats on > Restoring a file from quarantine can also be done using Command Prompt. See [Restore a file from quarantine](/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts#restore-file-from-quarantine). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Review Scan Results Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/review-scan-results-microsoft-defender-antivirus.md | See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](u Use the [**Get** method of the **MSFT_MpThreat** and **MSFT_MpThreatDetection**](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) classes. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Run Scan Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/run-scan-microsoft-defender-antivirus.md | Use the [**Start** method](/previous-versions/windows/desktop/defender/start-msf For more information about which parameters are allowed, see [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Schedule Antivirus Scans Group Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/schedule-antivirus-scans-group-policy.md | For more information, see the [Manage when protection updates should be download | Signature updates | Turn on scan after Security intelligence update | A scan will occur immediately after a new protection update is downloaded | Enabled | > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Schedule Antivirus Scans Powershell | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/schedule-antivirus-scans-powershell.md | Set-MpPreference -ScanScheduleQuickScanTime For more information about how to use PowerShell with Microsoft Defender Antivirus, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender Antivirus cmdlets](/powershell/module/defender/). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Schedule Antivirus Scans Wmi | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/schedule-antivirus-scans-wmi.md | ScanScheduleQuickScanTime For more information and allowed parameters, see [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Schedule Antivirus Scans | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/schedule-antivirus-scans.md | Use the following table to choose a scan type. - If a device is offline for an extended period of time, a full scan can take longer to complete. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Specify Cloud Protection Level Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/specify-cloud-protection-level-microsoft-defender-antivirus.md | Cloud protection works together with Microsoft Defender Antivirus to deliver pro > Are you using Group Policy Objects on premises? See how they translate in the cloud. [Analyze your on-premises group policy objects using Group Policy analytics in Microsoft Endpoint Manager - Preview](/mem/intune/configuration/group-policy-analytics). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Tamperprotection Macos | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tamperprotection-macos.md | Title: Protect macOS security settings with tamper protection + Title: Protect macOS security settings with tamper protection description: Use tamper protection to prevent malicious apps from changing important macOS security settings. keywords: macos, tamper protection, security settings, malware ms.prod: m365-security-# Protect macOS security settings with tamper protection +# Protect macOS security settings with tamper protection [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] ms.technology: mde > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-rbac-abovefoldlink) -Tamper protection in macOS helps prevent unwanted changes to security settings from being made by unauthorized users. Tamper protection helps prevent unauthorized removal of Microsoft Defender for Endpoint on macOS. This capability also helps important security files, processes, and configuration settings from being tampered. +Tamper protection in macOS helps prevent unwanted changes to security settings from being made by unauthorized users. Tamper protection helps prevent unauthorized removal of Microsoft Defender for Endpoint on macOS. This capability also helps important security files, processes, and configuration settings from being tampered. +You can set tamper protection in the following modes: +|Topic|Description| +||| +|Disabled|Tamper protection is completely off (this is the default mode after installation)| +|Audit|Tampering operations are logged, but not blocked| +|Block|Tamper protection is on, tampering operations are blocked| -You can set tamper protection in the following modes:  - +When tamper protection is set to audit or block mode, you can expect the following outcomes: - Topic | Description -:|: -Disabled  | Tamper protection is completely off (this is the default mode after installation)  -Audit  | Tampering operations are logged, but not blocked  -Block  | Tamper protection is on, tampering operations are blocked  +**Audit mode**: -When tamper protection is set to audit or block mode, you can expect the following outcomes: +- Actions to uninstall Defender for Endpoint agent is logged (audited) +- Editing/modification of Defender for Endpoint files are logged (audited) +- Creation of new files under Defender for Endpoint location is logged (audited) +- Deletion of Defender for Endpoint files is logged (audited) +- Renaming of Defender for Endpoint files is logged (audited) +- Commands to stop the agent fail -**Audit mode**  -- Actions to uninstall Defender for Endpoint agent is logged (audited)  -- Editing/modification of Defender for Endpoint files are logged (audited) -- Creation of new files under Defender for Endpoint location is logged (audited) -- Deletion of Defender for Endpoint files is logged (audited) -- Renaming of Defender for Endpoint files is logged (audited) -- Commands to stop the agent fail +**Block mode**: -**Block mode** -- Actions to uninstall Defender for Endpoint agent is blocked  -- Editing/modification of Defender for Endpoint files are blocked -- Creation of new files under Defender for Endpoint location is blocked -- Deletion of Defender for Endpoint files is blocked -- Renaming of Defender for Endpoint files is blocked -- Commands to stop the agent fail +- Actions to uninstall Defender for Endpoint agent is blocked +- Editing/modification of Defender for Endpoint files are blocked +- Creation of new files under Defender for Endpoint location is blocked +- Deletion of Defender for Endpoint files is blocked +- Renaming of Defender for Endpoint files is blocked +- Commands to stop the agent fail -Here is an example of a system message in response to a blocked action:  +Here is an example of a system message in response to a blocked action:  -You can configure the tamper protection mode by providing the mode name as enforcement-level. +You can configure the tamper protection mode by providing the mode name as enforcement-level. -->[!NOTE] ->- The mode change will apply immediately. You don’t need to change the feature flag nor restart Microsoft Defender for Endpoint. ->- If you used JAMF during the initial configuration, then you'll need to update the configuration using JAMF as well. +> [!NOTE] +> +> - The mode change will apply immediately. You don't need to change the feature flag nor restart Microsoft Defender for Endpoint. +> - If you used JAMF during the initial configuration, then you'll need to update the configuration using JAMF as well. ## Before you begin-- Supported macOS versions: Monterey (12), Big Sur (11), Catalina (10.15+) -- Minimum required version for Defender for Endpoint: 101.49.25  +- Supported macOS versions: Monterey (12), Big Sur (11), Catalina (10.15+) +- Minimum required version for Defender for Endpoint: 101.49.25 -**Highly recommended settings:**  +**Highly recommended settings:** 1. System Integrity Protection (SIP) enabled. For more information, see [Disabling and Enabling System Integrity Protection](https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection). 1. Use a Mobile device management (MDM) tool to configure Microsoft Defender for Endpoint. -  - ## Configure tamper protection on macOS devices +There are several ways you can configure tamper protection: -There are several ways you can configure tamper protection:  --- [Manual configuration](#manual-configuration)-- [JAMF](#jamf) -- [Intune](#intune)--  +- [Manual configuration](#manual-configuration) +- [JAMF](#jamf) +- [Intune](#intune) ### Before you begin -Verify that "tamper_protection" is set to "disabled".   +Verify that "tamper_protection" is set to "disabled".  - ### Manual configuration -1. Use the following command:  -- ```  - sudo mdatp config tamper-protection enforcement-level --value block - ``` +1. Use the following command: + ```console + sudo mdatp config tamper-protection enforcement-level --value block + ``` -  +  + > [!NOTE] + > If you use manual configuration to enable tamper protection, you can also disable tamper protection manually at any time. For example, you can revoke Full Disk Access from Defender in System Preferences manually. You must use MDM instead of manual configuration to prevent a local admin from doing that. - >[!NOTE] - > If you use manual configuration to enable tamper protection, you can also disable tamper protection manually at any time. For example, you can revoke Full Disk Access from Defender in System Preferences manually. You must use MDM instead of manual configuration to prevent a local admin from doing that. --2. Verify the result.  +2. Verify the result.  --Notice that the "tamper_protection" is now set to "block".  +Notice that the "tamper_protection" is now set to "block". ### JAMF Configure tamper protection mode in Microsoft Defender for Endpoint [configuration profile](mac-jamfpro-policies.md), by adding the following settings: -- ```xml <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> Configure tamper protection mode in Microsoft Defender for Endpoint [configurati </dict> </plist> ```-  ->[!NOTE] ->If you already have a configuration profile for Microsoft Defender for Endpoint then you need to *add* settings to it. You don’t need to create a second configuration profile.  --  +> [!NOTE] +> If you already have a configuration profile for Microsoft Defender for Endpoint then you need to *add* settings to it. You don't need to create a second configuration profile. ### Intune -Follow the documented Intune profile example to configure tamper protection through Intune. For more information, see [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md).  +Follow the documented Intune profile example to configure tamper protection through Intune. For more information, see [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md). Add the following configuration in your Intune profile: ->[!NOTE] ->For Intune configuration, you can create a new profile configuration file to add the Tamper protection configuration, or you can add these parameters to the existing one. +> [!NOTE] +> For Intune configuration, you can create a new profile configuration file to add the Tamper protection configuration, or you can add these parameters to the existing one. -                  ```xml ?xml version="1.0" encoding="utf-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> Add the following configuration in your Intune profile: </plist> ``` --Check the tamper protection status by running the following command: -  +Check the tamper protection status by running the following command: `mdatp health --field tamper_protection` -  -The result will show "block" if tamper protection is on:  +The result will show "block" if tamper protection is on:  ---You can also run full `mdatp health` and look for the "tamper_protection" in the output:  +You can also run full `mdatp health` and look for the "tamper_protection" in the output:  +## Verify tamper protection preventive capabilities ---## Verify tamper protection preventive capabilities   You can verify that tamper protection is on through various ways.-  ### Verify block mode Tampering alert is raised in the Microsoft 365 Defender portal  -  -  -### Verify block mode and audit modes  +### Verify block mode and audit modes -- Using Advanced hunting, you'll see tampering alerts appear  -- Tampering events can be found in the local device logs: `sudo grep -F '\[{tamperProtection}\]' /Library/Logs/Microsoft/mdatp/microsoft_defender_core.log`+- Using Advanced hunting, you'll see tampering alerts appear +- Tampering events can be found in the local device logs: `sudo grep -F '\[{tamperProtection}\]' /Library/Logs/Microsoft/mdatp/microsoft_defender_core.log`  +### DIY scenarios -  -### DIY scenarios  --- With tamper protection set to "block", attempt different methods to uninstall Defender for Endpoint. For example, drag the app tile into trash or uninstall tamper protection using the command line. -- Try to stop the Defender for Endpoint process (kill). -- Try to delete, rename, modify, move Defender for Endpoint files (similar to what a malicious user would do), for example: +- With tamper protection set to "block", attempt different methods to uninstall Defender for Endpoint. For example, drag the app tile into trash or uninstall tamper protection using the command line. +- Try to stop the Defender for Endpoint process (kill). +- Try to delete, rename, modify, move Defender for Endpoint files (similar to what a malicious user would do), for example: - - /Applications/Microsoft Defender ATP.app/  - - /Library/LaunchDaemons/com.microsoft.fresno.plist  - - /Library/LaunchDaemons/com.microsoft.fresno.uninstall.plist  - - /Library/LaunchAgents/com.microsoft.wdav.tray.plist  - - /Library/Managed Preferences/com.microsoft.wdav.ext.plist  - - /Library/Managed Preferences/mdatp_managed.json  - - /Library/Managed Preferences/com.microsoft.wdav.atp.plist  - - /Library/Managed Preferences/com.microsoft.wdav.atp.offboarding.plist  - - /usr/local/bin/mdatp  + - /Applications/Microsoft Defender ATP.app/ + - /Library/LaunchDaemons/com.microsoft.fresno.plist + - /Library/LaunchDaemons/com.microsoft.fresno.uninstall.plist + - /Library/LaunchAgents/com.microsoft.wdav.tray.plist + - /Library/Managed Preferences/com.microsoft.wdav.ext.plist + - /Library/Managed Preferences/mdatp_managed.json + - /Library/Managed Preferences/com.microsoft.wdav.atp.plist + - /Library/Managed Preferences/com.microsoft.wdav.atp.offboarding.plist + - /usr/local/bin/mdatp -  -## Turning off tamper protection  +## Turning off tamper protection -You can turn off tamper protection using any of the following methods.   +You can turn off tamper protection using any of the following methods. ### Manual configuration Use the following command: -`sudo mdatp config tamper-protection enforcement-level – –value disabled` --  +```console +sudo mdatp config tamper-protection enforcement-level - -value disabled +``` ## JAMF Change the `enforcementLevel` value to "disabled" in your configuration profile, and push it to the machine: - ```console <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> Change the `enforcementLevel` value to "disabled" in your configuration profile, ``` --### Intune +### Intune Add the following configuration in your Intune profile: -``` +```XML <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1"> Add the following configuration in your Intune profile: </plist> ``` -## Troubleshooting configuration issues +## Troubleshooting configuration issues +### Issue: Tamper protection is reported as disabled -### Issue: Tamper protection is reported as disabled  +If running the command `mdatp health` reports that the tamper protection is disabled, even if you enabled it and more than an hour has passed since the onboarding, then you can check if you have the right configuration by running the following command: -If running the command `mdatp health` reports that the tamper protection is disabled, even if you enabled it and more than an hour has passed since the onboarding, then you can check if you have the right configuration by running the following command:  --  ```console-$ sudo grep -F '\[{tamperProtection}\]: Feature state:' /Library/Logs/Microsoftmdatpmicrosoft_defender_core.log \| tail -n 1  +$ sudo grep -F '\[{tamperProtection}\]: Feature state:' /Library/Logs/Microsoftmdatpmicrosoft_defender_core.log \| tail -n 1 -\[85246\]\[2021-12-08 15:45:34.184781 UTC\]\[info\]: \[{tamperProtection}\]: Feature state: enabledmode: "block"  +\[85246\]\[2021-12-08 15:45:34.184781 UTC\]\[info\]: \[{tamperProtection}\]: Feature state: enabledmode: "block" ```-  --The mode must be "block" (or "audit"). If it is not, then you haven’t set the tamper protection mode either through `mdatp config` command or through Intune.  --  +The mode must be "block" (or "audit"). If it is not, then you haven't set the tamper protection mode either through `mdatp config` command or through Intune. |
| security | Troubleshoot Microsoft Defender Antivirus When Migrating | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus-when-migrating.md | Another feature, known as [limited periodic scanning](limited-periodic-scanning- > Limited periodic scanning is not recommended in enterprise environments. The detection, management and reporting capabilities available when running Microsoft Defender Antivirus in this mode are reduced as compared to active mode. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Troubleshoot Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus.md | This is an internal error. It might have triggered when a scan fails to complete </table> > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Troubleshoot Performance Issues | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-performance-issues.md | The command-line tool *wpr.exe* is part of the operating system starting with Wi 8. Include both the file and the folder in your submission to Microsoft support. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Troubleshoot Reporting | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-reporting.md | If the above prerequisites have all been met, you might need to proceed to the n > [Collect diagnostic data for Update Compliance troubleshooting](collect-diagnostic-data.md) > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Troubleshooting Mode Scenarios | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshooting-mode-scenarios.md | + + Title: Troubleshooting mode scenarios in Microsoft Defender for Endpoint +description: Use the Microsoft Defender for Endpoint troubleshooting mode to address various antivirus issues. +keywords: antivirus, troubleshoot, troubleshooting mode, tamper protection, compatibility +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++ - m365-security-compliance ++ms.technology: mde +++# Troubleshooting mode scenarios in Microsoft Defender for Endpoint +++**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037) ++> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) +++Microsoft Defender for Endpoint troubleshooting mode allows you to troubleshoot various Microsoft Defender antivirus features by enabling them from the device and testing different scenarios, even if they're controlled by the organization policy. The troubleshooting mode is disabled by default and requires you to turn it on for a device (and/or group of devices) for a limited time. Note that this is exclusively an Enterprise-only feature, and requires Microsoft 365 Defender access. ++## Scenario 1: Unable to install application ++If you want to install an application but receive an error message that Microsoft Defender Antivirus and tamper protection is on, follow the steps below to troubleshoot the issue. ++1. Request the SOC admin to turn on troubleshooting mode. You'll get a Windows Security notification once the troubleshooting mode starts. ++2. Connect to the device (using Terminal Services for example) with local admin permissions. ++3. Start Process Monitor (ProcMon). See the steps described in [Troubleshoot performance issues related to real-time protection](troubleshoot-performance-issues.md). ++4. Go to **Windows security** > **Threat & virus protection** > **Manage settings** > **Tamper protection** > **Off**. ++5. Launch an elevated PowerShell command prompt, and toggle off RTP. ++ - Run `get-mppreference` to check RTP status. + - Run `setΓÇômppreference` to turn off RTP Run. ++6. Try installing the application. ++## Scenario 2: High CPU usage due to Windows Defender (MsMpEng.exe) ++Sometimes during a scheduled scan, MsMpEng.exe can consume high CPU. ++1. Go to **Task Manager** > **Details** tab to confirm that MsMpEng.exe is the reason behind the high CPU usage. Also check to see if a scheduled scan is currently underway. ++2. Run ProcMon during the CPU spike for around 5 minutes, and then review the ProcMon log for clues. ++3. Once root cause is determined, turn on troubleshooting mode. ++4. Log in to the machine and launch an elevated PowerShell command prompt. ++5. Add process/file/folder/extension exclusions based on ProcMon findings using one of the following commands (the path, extension, and process exclusions mentioned below are examples only): ++ - Set-mppreference -ExclusionPath (for example, C:\DB\DataFiles) + + - Set-mppreference ΓÇôExclusionExtension (for example, .dbx) + + - Set-mppreference ΓÇôExclusionProcess (for example, C:\DB\Bin\Convertdb.exe) ++6. After adding the exclusion, check to see if the CPU usage has dropped. ++For more information on Set-MpPreference cmdlet configuration preferences for Windows Defender scans and updates, see [Set-MpPreference](/powershell/module/defender/set-mppreference). ++## Scenario 3: Application taking longer to perform an action ++When Microsoft Defender Antivirus real-time protection is turned on, application takes a long time to perform basic tasks. To turn off real-time protection and troubleshoot the issue, follow the steps below. ++1. Request SOC admin to turn on troubleshooting mode on the device. ++2. To disable RTP for this scenario, first turn off tamper protection. For more information, see [Protect security settings with tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md). ++3. Once tamper protection is disabled, log in to the device. ++4. Launch an elevated PowerShell command prompt. ++ - Set-mppreference -DisableRealtimeMonitoring $true ++5. After disabling RTP, check to see if the application is slow. ++## Scenario 4: Microsoft Office plugin blocked by Attack Surface Reduction ++Attack Surface Reduction (ASR) is not allowing Microsoft Office plugin to work properly because **Block all Office applications from creating child processes** is set to block mode. ++1. Turn on troubleshooting mode, and log in to the device. ++2. Launch an elevated PowerShell command prompt. ++ - Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Disabled ++3. After disabling the ASR Rule, confirm that the Microsoft Office plugin now works. ++For more information, see [Overview of attack surface reduction](overview-attack-surface-reduction.md). ++## Scenario 5: Domain blocked by Network Protection ++Network Protection is blocking Microsoft domain, preventing users from accessing it. ++1. Turn on troubleshooting mode, and log in to the device. ++2. Launch an elevated PowerShell command prompt. ++ - Set-MpPreference -EnableNetworkProtection Disabled ++3. After disabling Network Protection, check to see if the domain is now allowed. ++For more information, see [Use network protection to help prevent connections to bad sites](network-protection.md). ++## Related topics ++- [Enable troubleshooting mode](enable-troubleshooting-mode.md) +- [Protect security settings with tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) +- [Set-MpPreference](/powershell/module/defender/set-mppreference) +- [Protect your network](network-protection.md) +- [Overview of attack surface reduction](overview-attack-surface-reduction.md) +- [Detect and block potentially unwanted applications](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) +- [Get an overview of Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) +- [Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](why-use-microsoft-defender-antivirus.md) |
| security | Tune Performance Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tune-performance-defender-antivirus.md | Accept wildcard characters: False ## Additional resources -If youΓÇÖre looking for Antivirus-related information for other platforms, see: +If you're looking for Antivirus-related information for other platforms, see: - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) |
| security | Tvm Manage Log4shell Guidance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tvm-manage-Log4shell-guidance.md | ms.technology: m365d - [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -The Log4Shell vulnerability is a remote code execution (RCE) vulnerability found in the Apache Log4j 2 logging library. As Apache Log4j 2 is commonly used by many software applications and online services, it represents a complex and high-risk situation for companies across the globe. Referred to as “Log4Shell” ([CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228), [CVE-2021-45046](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046) ) it introduces a new attack vector that attackers can exploit to extract data and deploy ransomware in an organization. +The Log4Shell vulnerability is a remote code execution (RCE) vulnerability found in the Apache Log4j 2 logging library. As Apache Log4j 2 is commonly used by many software applications and online services, it represents a complex and high-risk situation for companies across the globe. Referred to as "Log4Shell" ([CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228), [CVE-2021-45046](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046) ) it introduces a new attack vector that attackers can exploit to extract data and deploy ransomware in an organization. > [!NOTE]-> Refer to the blogs [Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability and](https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/) [Microsoft Security Response Center](https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/) for guidance and technical information about the vulnerability and product specific mitigation recommendations to protect your organization. +> Refer to the blogs [Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability and](https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/) [Microsoft Security Response Center](https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/) for guidance and technical information about the vulnerability and product specific mitigation recommendations to protect your organization. ## Overview of discovery, monitoring and mitigation capabilities Threat and vulnerability management provides layers of detection to help you dis - determines if a JAR file contains a vulnerable Log4j file by examining JAR files and searching for the following file: \\META-INF\\maven\\org.apache.logging.log4j\\log4j-core\\pom.properties - if this file exists, the Log4j version is read and extracted.- - searches for the JndiLookup.class file inside the JAR file by looking for paths that contain the string “/log4j/core/lookup/JndiLookup.class” - if the JndiLookup.class file exists, threat and vulnerability management determines if this JAR contains a Log4j file with the version defined in pom.properties. + - searches for the JndiLookup.class file inside the JAR file by looking for paths that contain the string "/log4j/core/lookup/JndiLookup.class" - if the JndiLookup.class file exists, threat and vulnerability management determines if this JAR contains a Log4j file with the version defined in pom.properties. - searches for any vulnerable Log4j-core JAR files embedded within a nested-JAR by searching for paths that contain any of these strings: - lib/log4j-core- - WEB-INF/lib/log4j-core- This table describes the search capabilities supported platforms and versions: Use the threat and vulnerability management dashboard to see your current exposure. -1. In the Microsoft 365 Defender portal, go to **Vulnerability management** > **Dashboard** > **Threat awareness:** +1. In the Microsoft 365 Defender portal, go to **Vulnerability management** > **Dashboard** > **Threat awareness:** :::image type="content" source="images/awareness_dashboard.png" alt-text="The threat awareness widget on the vulnerability management dashboard" lightbox="images/awareness_dashboard.png":::-2. Select **View vulnerability details** to see the consolidated view of your organizational exposure. +2. Select **View vulnerability details** to see the consolidated view of your organizational exposure. :::image type="content" source="images/view_vulnerability_details.png" alt-text="The vulnerability details page for CVE-2021-44228 (Log4j)" lightbox="images/view_vulnerability_details.png"::: 3. Choose the relevant tab to see your exposure broken down by: - Exposed devices – onboard The log4Shell vulnerability can be mitigated by preventing JNDI lookups on Log4j 1. Select **View vulnerability details** 2. Select **Mitigation options** -You can choose to apply the mitigation to all exposed devices or select specific onboarded devices. To complete the process and apply the mitigation on devices, select **Create mitigation action**. +You can choose to apply the mitigation to all exposed devices or select specific onboarded devices. To complete the process and apply the mitigation on devices, select **Create mitigation action**. :::image type="content" source="images/mitigation_options.png" alt-text="Mitigation options for CVE-2021-44228" lightbox="images/mitigation_options.png"::: The table below lists the potential mitigation statuses: | Workaround applied | _Windows_: The LOG4J_FORMAT_MSG_NO_LOOKUPS environment variable was observed before latest device reboot. <br/><br/> _Linux + macOS_: All running processes have LOG4J_FORMAT_MSG_NO_LOOKUPS=true in its environment variables. | | Workaround pending reboot | The LOG4J_FORMAT_MSG_NO_LOOKUPS environment variable is set, but no following reboot detected. | | Not applied | _Windows_: The LOG4J_FORMAT_MSG_NO_LOOKUPS environment variable was not observed. <br/><br/> _Linux + macOS_: Not all running processes have LOG4J_FORMAT_MSG_NO_LOOKUPS=true in its environment variables, and mitigation action was not applied on device. |-| Partially mitigated | _Linux + macOS_: Although mitigation action was applied on device, not all running processes have LOG4J_FORMAT_MSG_NO_LOOKUPS=true in its environment variables. | +| Partially mitigated | _Linux + macOS_: Although mitigation action was applied on device, not all running processes have LOG4J_FORMAT_MSG_NO_LOOKUPS=true in its environment variables. | |Not applicable | Devices that have vulnerable files that are not in the version range of the mitigation. |-|Unknown | The mitigation status couldn’t be determined at this time. | +|Unknown | The mitigation status couldn't be determined at this time. | > [!NOTE] > It may take a few hours for the updated mitigation status of a device to be reflected. The change will take effect after the device restarts. Remove the file setenv.LOG4J\_FORMAT\_MSG\_NO\_LOOKUPS.plist from the following folders: - - */Library/LaunchDaemons/* - - */Library/LaunchAgents/* - - */Users/\[username\]/Library/LaunchAgents/ - for all users* +- */Library/LaunchDaemons/* +- */Library/LaunchAgents/* +- */Users/\[username\]/Library/LaunchAgents/ - for all users* The change will take effect after the device restarts. |
| security | Use Group Policy Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/use-group-policy-microsoft-defender-antivirus.md | The following table lists commonly used Group Policy settings that are available |Threats|Specify threats upon which default action should not be taken when detected|[Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md)| > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Use Intune Config Manager Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/use-intune-config-manager-microsoft-defender-antivirus.md | You can use [Microsoft Endpoint Manager](/mem/endpoint-manager-overview) to conf > Need help? See [Manage endpoint security in Microsoft Intune](/mem/intune/protect/endpoint-security). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Use Powershell Cmdlets Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/use-powershell-cmdlets-microsoft-defender-antivirus.md | Get-Help <cmdlet> -Online Omit the `-online` parameter to get locally cached help. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Use Wmi Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/use-wmi-microsoft-defender-antivirus.md | Changes made with WMI will affect local settings on the endpoint where the chang You can [configure which settings can be overridden locally with local policy overrides](configure-local-policy-overrides-microsoft-defender-antivirus.md). > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Why Cloud Protection Should Be On Mdav | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/why-cloud-protection-should-be-on-mdav.md | Now that you have an overview of cloud protection and its role in Microsoft Defe 5. **[Configure the cloud block timeout period](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md)**. Microsoft Defender Antivirus can block suspicious files from running while it queries our cloud protection service. You can configure the amount of time the file will be prevented from running by using Microsoft Endpoint Manager or Group Policy. > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Why Use Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/why-use-microsoft-defender-antivirus.md | Although you can use a non-Microsoft antivirus solution with Microsoft Defender |11|Technical support|By using Microsoft Defender for Endpoint together with Microsoft Defender Antivirus, you have one company to call for technical support. [Troubleshoot service issues](/microsoft-365/security/defender-endpoint/troubleshoot-mdatp)and [review event logs and error codes with Microsoft Defender Antivirus](troubleshoot-microsoft-defender-antivirus.md).| > [!TIP]-> If youΓÇÖre looking for Antivirus related information for other platforms, see: +> If you're looking for Antivirus related information for other platforms, see: > - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) > - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) > - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) |
| security | Defender Vulnerability Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management.md | Watch the following video to learn more about Defender Vulnerability Management. With Defender Vulnerability Management, you can empower your security and IT teams to bridge workflow gaps and prioritize and address critical vulnerabilities and misconfigurations across your organization. Reduce cyber security risk with: -## Asset discovery & inventoryΓÇï +## Asset discovery & inventory -Defender Vulnerability Management built-in and agentless scanners continuously monitor and detect risk in your organization even when devices arenΓÇÖt connected to the corporate network. +Defender Vulnerability Management built-in and agentless scanners continuously monitor and detect risk in your organization even when devices aren't connected to the corporate network. -A single inventory with a real-time consolidated view of your organization's software applications, digital certificates, network shares, and browser extensions helps you discover and assess all your organizationΓÇÖs assets. +A single inventory with a real-time consolidated view of your organization's software applications, digital certificates, network shares, and browser extensions helps you discover and assess all your organization's assets. -View information on extension permissions and associated risk levels, identify certificates before they expire, detect potential vulnerabilities due to weak signature algorithms, and assess misconfigurations in internal network shares.ΓÇï +View information on extension permissions and associated risk levels, identify certificates before they expire, detect potential vulnerabilities due to weak signature algorithms, and assess misconfigurations in internal network shares. ## Vulnerability & configuration assessment -Understand and assess your cyber exposure with advanced vulnerability and configuration assessment toolsΓÇï. +Understand and assess your cyber exposure with advanced vulnerability and configuration assessment tools. - **Security baselines assessment** - Create customizable baseline profiles to measure risk compliance against established benchmarks, such as, Center for Internet Security (CIS) and Security Technical Implementation Guides (STIG). - **Visibility into software and vulnerabilities** - Get a view of the organization's software inventory, and software changes like installations, uninstalls, and patches. - **Network share assessment** - See actionable security recommendations, in the security recommendations page, for network share configurations identified as vulnerable.-- **Threat analytics & event timelinesΓÇï** - Use event timelines, and entity-level vulnerability assessments to understand and prioritize vulnerabilities.+- **Threat analytics & event timelines** - Use event timelines, and entity-level vulnerability assessments to understand and prioritize vulnerabilities. - **Browser extensions** - View a list of the browser extensions installed across different browsers in your organization.-- **Digital certificatesΓÇï** - View a list of certificates installed across your organization in a single central certificate inventory page.+- **Digital certificates** - View a list of certificates installed across your organization in a single central certificate inventory page. ## Risk-based intelligent prioritization -Defender Vulnerability Management leverage MicrosoftΓÇÖs threat intelligence, breach likelihood predictions, business contexts, and device assessments to quickly prioritize the biggest vulnerabilities in your organization. A single view of prioritized recommendations from multiple security feeds, along with critical details including related CVEs and exposed devices helps you quickly remediate the biggest vulnerabilities on your most critical assets. Risk-based intelligent prioritization: +Defender Vulnerability Management leverage Microsoft's threat intelligence, breach likelihood predictions, business contexts, and device assessments to quickly prioritize the biggest vulnerabilities in your organization. A single view of prioritized recommendations from multiple security feeds, along with critical details including related CVEs and exposed devices helps you quickly remediate the biggest vulnerabilities on your most critical assets. Risk-based intelligent prioritization: - **Focuses on emerging threats** - Dynamically aligns the prioritization of security recommendations with vulnerabilities currently being exploited in the wild and emerging threats that pose the highest risk. - **Pinpoints active breaches** - Correlates vulnerability management and EDR insights to prioritize vulnerabilities being exploited in an active breach within the organization. - **Protects high-value assets** - Identifies exposed devices with business-critical applications, confidential data, or high-value users. -## Remediation and tracking ΓÇï +## Remediation and tracking Enable security administrators and IT administrators to collaborate and seamlessly remediate issues with built-in workflows. Enable security administrators and IT administrators to collaborate and seamless ## Navigation pane -<br> --**** - |Area|Description| ||| |[Dashboard](tvm-dashboard-insights.md)|Get a high-level view of the organization exposure score, threat awareness, Microsoft Secure Score for Devices, expiring certificates, device exposure distribution, top security recommendations, top vulnerable software, top remediation activities, and top exposed device data.| |[**Recommendations**](tvm-security-recommendation.md)|See the list of security recommendations and related threat information. When you select an item from the list, a flyout panel opens with vulnerability details, a link to open the software page, and remediation and exception options. You can also open a ticket in Intune if your devices are joined through Azure Active Directory and you've enabled your Intune connections in Defender for Endpoint.| |[**Remediation**](tvm-remediation.md)|See remediation activities you've created and recommendation exceptions.|-|[**Inventories**](tvm-software-inventory.md)|Discover and assess all your organizationΓÇÖs assets in a single view.| +|[**Inventories**](tvm-software-inventory.md)|Discover and assess all your organization's assets in a single view.| |[**Weaknesses**](tvm-weaknesses.md)|See the list of common vulnerabilities and exposures (CVEs) in your organization.| |[**Event timeline**](threat-and-vuln-mgt-event-timeline.md)|View events that may impact your organization's risk.| |[**Baselines assessment**](tvm-security-baselines.md)|Monitor security baseline compliance and identify changes in real-time.| - ## APIs Run vulnerability management related API calls to automate vulnerability management workflows. Learn more from this [Microsoft Tech Community blog post](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/threat-amp-vulnerability-management-apis-are-now-generally/ba-p/1304615). |
| security | Tvm Block Vuln Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-block-vuln-apps.md | ms.technology: mde Remediating vulnerabilities takes time and can be dependent on the responsibilities and resources of the IT team. Security admins can temporarily reduce the risk of a vulnerability by taking immediate action to block all currently known vulnerable versions of an application, until the remediation request is completed. The block option gives IT teams time to patch the application without security admins worrying that the vulnerabilities will be exploited in the meantime. -While taking the remediation steps suggested by a security recommendation, security admins with the proper permissions can perform a mitigation action and block vulnerable versions of an application. File indicators of compromise (IOC)s will be created for each of the executable files that belong to vulnerable versions of that application. Microsoft Defender Antivirus then enforces blocks on the devices that are in the specified scope.   +While taking the remediation steps suggested by a security recommendation, security admins with the proper permissions can perform a mitigation action and block vulnerable versions of an application. File indicators of compromise (IOC)s will be created for each of the executable files that belong to vulnerable versions of that application. Microsoft Defender Antivirus then enforces blocks on the devices that are in the specified scope. ## Block or warn mitigation action The **block action** is intended to block all installed vulnerable versions of t The **warn action** is intended to send a warning to your users when they open vulnerable versions of the application. Users will can choose to bypass the warning and access the application. -For both actions, you can customize the message the users will see. For example, you can encourage them to install the latest version.   +For both actions, you can customize the message the users will see. For example, you can encourage them to install the latest version. -> [!Note] -> The block and warn actions are typically enforced within a couple of minutes but can take up to 3 hours.   +> [!NOTE] +> The block and warn actions are typically enforced within a couple of minutes but can take up to 3 hours. -## Minimum requirements   +## Minimum requirements - **Microsoft Defender Antivirus (active mode)**: The detection of file execution events and blocking requires Microsoft Defender Antivirus to be enabled in active mode. By design, passive mode and EDR in block mode can't detect and block based on file execution. To learn more, see [deploy Microsoft Defender Antivirus](../defender-endpoint/deploy-manage-report-microsoft-defender-antivirus.md).-- **Cloud–delivered protection (enabled)**: For more information, see [Manage cloud–based protection](../defender-endpoint/cloud-protection-microsoft-defender-antivirus.md).  +- **Cloud-delivered protection (enabled)**: For more information, see [Manage cloud-based protection](../defender-endpoint/cloud-protection-microsoft-defender-antivirus.md). - **Allow or block file (on)**: Go to **Settings** > **Advanced features** > **Allow or block file.** To learn more, see [Advanced features](../defender-endpoint/advanced-features.md). -## Version requirements   +## Version requirements - The Antimalware client version must be 4.18.1901.x or later.-- The Engine version must be 1.1.16200.x or later.  -- Supported on Windows 10 devices, version 1809 or later, with the latest windows updates installed.  +- The Engine version must be 1.1.16200.x or later. +- Supported on Windows 10 devices, version 1809 or later, with the latest windows updates installed. -## Permissions   +## Permissions -- If you use [Role-based access control (RBAC)](../defender-endpoint/rbac.md), then you need to have the **Threat and vulnerability management - Application handling** permission assigned.  -- If you haven't turned on RBAC, you must have one of the following Azure AD roles assigned: **security admin** or **global admin**. To learn more about permissions, go to [Basic permissions](../defender-endpoint/basic-permissions.md).  +- If you use [Role-based access control (RBAC)](../defender-endpoint/rbac.md), then you need to have the **Threat and vulnerability management - Application handling** permission assigned. +- If you haven't turned on RBAC, you must have one of the following Azure AD roles assigned: **security admin** or **global admin**. To learn more about permissions, go to [Basic permissions](../defender-endpoint/basic-permissions.md). -## How to block vulnerable applications   +## How to block vulnerable applications 1. Go to **Vulnerability management** > **Recommendations** in the [Microsoft 365 Defender portal](https://security.microsoft.com). 2. Select a security recommendation to see a flyout with more information. For both actions, you can customize the message the users will see. For example, 4. Select whether you want to apply the remediation and mitigation to all device groups or only a few. 5. Select the remediation options on the **Remediation request** page. The remediation options are software update, software uninstall, and attention required. 6. Pick a **Remediation due date** and select **Next**.-7. Under **Mitigation action**, select **Block** or **Warn**. Once you submit a mitigation action, it will be immediately applied.   +7. Under **Mitigation action**, select **Block** or **Warn**. Once you submit a mitigation action, it will be immediately applied. :::image type="content" alt-text="Mitigation action" source="../../media/defender-vulnerability-management/mitigation-action.png" lightbox="../../media/defender-vulnerability-management/mitigation-action.png"::: -8. Review the selections you made and **Submit request**. On the final page you can choose to go directly to the remediation page to view the progress of remediation activities and see the list of blocked applications. +8. Review the selections you made and **Submit request**. On the final page you can choose to go directly to the remediation page to view the progress of remediation activities and see the list of blocked applications. > [!Important]-> Based on the available data, the block action will take effect on endpoints in the organization that have Microsoft Defender Antivirus. Microsoft Defender for Endpoint will make a best attempt effort of blocking the applicable vulnerable application or version from running.   +> Based on the available data, the block action will take effect on endpoints in the organization that have Microsoft Defender Antivirus. Microsoft Defender for Endpoint will make a best attempt effort of blocking the applicable vulnerable application or version from running. If additional vulnerabilities are found on a different version of an application, you'll get a new security recommendation, asking you to update the application, and you can choose to also block this different version. ## When blocking is not supported -If you don't see the mitigation option while requesting a remediation, it's because the ability to block the application is currently not supported. Recommendations that don't include mitigation actions include:   +If you don't see the mitigation option while requesting a remediation, it's because the ability to block the application is currently not supported. Recommendations that don't include mitigation actions include: - Microsoft applications-- Recommendations related to operating systems  -- Recommendations related to apps for MacOS and Linux  -- Apps where Microsoft does not have sufficient information or a high confidence to block  +- Recommendations related to operating systems +- Recommendations related to apps for MacOS and Linux +- Apps where Microsoft does not have sufficient information or a high confidence to block -If you try to block an application and it doesn't work, you may have reached the maximum indicator capacity. If this is the case, you can delete old indicators [Learn more about indicators](../defender-endpoint/manage-indicators.md).   -   -## View remediation activities   +If you try to block an application and it doesn't work, you may have reached the maximum indicator capacity. If this is the case, you can delete old indicators [Learn more about indicators](../defender-endpoint/manage-indicators.md). ++## View remediation activities After you've submitted the request, go to **Vulnerability management** > **Remediation** > **Activities** to see the newly created remediation activity. -Filter by Mitigation type: Block and/or Warn to view all activities pertaining to block or warn actions.   +Filter by Mitigation type: Block and/or Warn to view all activities pertaining to block or warn actions. This is an activity log, and not the current block status of the application. Select the relevant activity to see a flyout panel with details including the remediation description, mitigation description and the device remediation status: :::image type="content" alt-text="Remediation and mitigation details" source="../../media/defender-vulnerability-management/remediation-mitigation-details.png" lightbox="../../media/defender-vulnerability-management/remediation-mitigation-details.png"::: -## View blocked applications   +## View blocked applications Find the list of blocked applications by going to **Remediation** > **Blocked applications** tab: :::image type="content" alt-text="Blocked application" source="../../media/defender-vulnerability-management/blocked-applications.png" lightbox="../../media/defender-vulnerability-management/blocked-applications.png"::: -Select a blocked application to view a flyout with details about the number of vulnerabilities, whether exploits are available, blocked versions, and remediation activities.   +Select a blocked application to view a flyout with details about the number of vulnerabilities, whether exploits are available, blocked versions, and remediation activities. The option to **View details of blocked versions in the Indicator page** brings you to the **Settings > Indicators** page where you can view the file hashes and response actions. -> [!Note] -> If you use the Indicators API with programmatic indicator queries as part of your workflows, be aware that the block action will give additional results.  +> [!NOTE] +> If you use the Indicators API with programmatic indicator queries as part of your workflows, be aware that the block action will give additional results. You can also **Unblock software** or **Open software page**: :::image type="content" alt-text="Blocked application details" source="../../media/defender-vulnerability-management/blocked-application-details.png" lightbox="../../media/defender-vulnerability-management/blocked-application-details.png"::: -## Unblock applications   +## Unblock applications -Select a blocked application to view the option to **Unblock software** in the flyout.   +Select a blocked application to view the option to **Unblock software** in the flyout. After you've unblocked an application, refresh the page to see it removed from the list. It can take up to 3 hours for an application to be unblocked and become accessible to your users again. After you've unblocked an application, refresh the page to see it removed from t When users try to access a blocked application, they'll receive a message informing them that the application has been blocked by their organization. This message is customizable. -For applications where the warn mitigation option was applied, users will receive a message informing them that the application has been blocked by their organization, but the user has the option to bypass the block for subsequent launches, by choosing “Allow”. This allow is only temporary, and the application will be blocked again after a while. +For applications where the warn mitigation option was applied, users will receive a message informing them that the application has been blocked by their organization, but the user has the option to bypass the block for subsequent launches, by choosing "Allow". This allow is only temporary, and the application will be blocked again after a while. -> [!Note] +> [!NOTE] > You may experience instances where the first launch of an application isn't blocked or the notification that the application was blocked doesn't display. This behavior will be fixed in an upcoming release. -## End-user updating blocked applications   +## End-user updating blocked applications -A commonly asked question is how does an end-user update a blocked application? The block is enforced by blocking the executable file. Some applications, such as Firefox, rely on a separate update executable which, will not be blocked by this feature.  In other cases when the application requires the main executable file to update, it is recommended to either implement the block in warn mode (so that the end-user can bypass the block) or the end-user can delete the application (if no vital information is stored on the client) and reinstalls the application. +A commonly asked question is how does an end-user update a blocked application? The block is enforced by blocking the executable file. Some applications, such as Firefox, rely on a separate update executable which, will not be blocked by this feature. In other cases when the application requires the main executable file to update, it is recommended to either implement the block in warn mode (so that the end-user can bypass the block) or the end-user can delete the application (if no vital information is stored on the client) and reinstalls the application. ## Related articles |
| security | Tvm Browser Extensions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-browser-extensions.md | ms.technology: mde A browser extension is a small software application that adds functionality to a web browser. Visibility into the browser extensions installed can help you ensure the safe usage of extensions in your organization. -The **Browser extensions** page displays a list of the browser extensions installed across different browsers in your organization. For each installed extension, you can see the devices it’s installed on and if it’s turned on or off on these devices. The information available will not only help you learn about the installed extensions, but it can help you make decisions on how you would like to manage the extensions. +The **Browser extensions** page displays a list of the browser extensions installed across different browsers in your organization. For each installed extension, you can see the devices it's installed on and if it's turned on or off on these devices. The information available will not only help you learn about the installed extensions, but it can help you make decisions on how you would like to manage the extensions. ## View your browser extensions -1. Go to **Vulnerability management** > **Software inventory** in the [Microsoft 365 Defender portal](https://security.microsoft.com). +1. Go to **Vulnerability management** \> **Software inventory** in the [Microsoft 365 Defender portal](https://security.microsoft.com). 2. Select the **Browser extensions** tab. -The **Browser extensions** page opens with a list of the browser extensions installed across your organization, including details on the extension name, browser, the number of devices the extension is installed on, and the number that have it turned on. +The **Browser extensions** page opens with a list of the browser extensions installed across your organization, including details on the extension name, browser, the number of devices the extension is installed on, and the number that have it turned on. :::image type="content" source="../../media/defender-vulnerability-management/browser_extensions.png" alt-text="Screenshot of the Browser extensions page" lightbox="../../media/defender-vulnerability-management/browser_extensions.png"::: -You can use the Browser filter to view the relevant list of extensions for a particular browser.   +You can use the Browser filter to view the relevant list of extensions for a particular browser. -The **Requested permissions** and **Permissions risk** columns provide more specific information on the number of permissions requested by the extension, and the permissions risk level based on the type of access to devices or sites it requested.   +The **Requested permissions** and **Permissions risk** columns provide more specific information on the number of permissions requested by the extension, and the permissions risk level based on the type of access to devices or sites it requested. > [!Note] > Only extensions that exist in Edge, Chrome, and Firefox on Windows devices, will appear in browser extension list. Where applicable, there will be a link available on this page to access the exte Browser extensions usually need different types of permission to run properly, for example, they may require permission to modify a webpage. -Select the **Permissions** tab, from the browser extension flyout pane, to see information on the permissions the browser extension needs to run, and whether this permission is optional or not.   +Select the **Permissions** tab, from the browser extension flyout pane, to see information on the permissions the browser extension needs to run, and whether this permission is optional or not. :::image type="content" source="../../media/defender-vulnerability-management/browser_extensions_permissions.png" alt-text="Screenshot of the Browser extensions permissions page" lightbox="../../media/defender-vulnerability-management/browser_extensions_permissions.png"::: The permission risk level generated is based on the type of access the permission is requesting. You can use this information to help make an informed decision on whether you want to allow or block this extension. > [!Note]->Risk is subjective, and it’s up to each organization to determine the types of risk they are willing to take on. +>Risk is subjective, and it's up to each organization to determine the types of risk they are willing to take on. Select a permission to see a further flyout with more information. -### View installed devices   +### View installed devices To see the list of the devices the extension is installed on, choose the **Installed devices** tab from the browser extension flyout pane: Select the **Installed versions** tab, from the browser extension flyout pane, t You can also view a list of extensions installed on a device: -1. Select the device from the **Installed devices** tab in the flyout panel and select **Open device page** or select the device directly from the **Device inventory** page. +1. Select the device from the **Installed devices** tab in the flyout panel and select **Open device page** or select the device directly from the **Device inventory** page. 2. Select the **Browser extensions** tab to see a list of extensions installed on that device. :::image type="content" source="../../media/defender-vulnerability-management/browser_extensions_devicepage.png" alt-text="Screenshot of the Browser extensions in the devices page" lightbox="../../media/defender-vulnerability-management/browser_extensions_devicepage.png"::: |
| security | Tvm Certificate Inventory | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-certificate-inventory.md | Certificates can be used in multiple ways, this includes: If there is an issue with a certificate, for example, it has expired or is misconfigured, it could leave your organization vulnerable, cause an outage, and have an impact on day-to-day business operations. -The **Certificate inventory** allows you view a list of the certificates installed across your organization in a single central certificate inventory page. This can help you:   +The **Certificate inventory** allows you view a list of the certificates installed across your organization in a single central certificate inventory page. This can help you: - Identify certificates that are about to expire so you can update them and prevent service disruption-- Detect potential vulnerabilities ​due to the use of weak signature algorithm (e.g. SHA-1-RSA), short key size (e.g. RSA 512bit), or weak signature hash algorithm (e.g. MD5)+- Detect potential vulnerabilities due to the use of weak signature algorithm (e.g. SHA-1-RSA), short key size (e.g. RSA 512bit), or weak signature hash algorithm (e.g. MD5) - Ensure compliance with regulatory guidelines and organizational policy ## View your certificates The **Certificate inventory** allows you view a list of the certificates install 1. Go to **Vulnerability management** > **Software inventory** in the [Microsoft 365 Defender portal](https://security.microsoft.com). 2. Select the **Certificates** tab. -The **Certificate inventory** page opens with a list of the certificates installed across your organization, including details on the expiration date, key size, who issued the certificate, and the number of instances. +The **Certificate inventory** page opens with a list of the certificates installed across your organization, including details on the expiration date, key size, who issued the certificate, and the number of instances. > [!Note] > Only certificates found on Windows devices (in the local machine certificate store) will be displayed in certificate inventory list. The **Certificate inventory** page opens with a list of the certificates ins ## Gain insights into potentially vulnerable certificates -At the top of the page, you can view the number of certificates that have been identified as potentially less secure and introduce risk into your organization. This includes the number of certificates that:   +At the top of the page, you can view the number of certificates that have been identified as potentially less secure and introduce risk into your organization. This includes the number of certificates that: - have already expired - will expire in 60 days or less When you select the certificate that you want to investigate, a flyout panel wil :::image type="content" source="../../media/defender-vulnerability-management/certificate_details.png" alt-text="Screenshot of the certificate details page" lightbox="../../media/defender-vulnerability-management/certificate_details.png"::: -You can select the **Issuing details** tab to see information on who the certificate was issued to and who it was issued by.   +You can select the **Issuing details** tab to see information on who the certificate was issued to and who it was issued by. ### Certificates on devices To see the list of the devices the certificate is installed on, choose the **Ins You can also view a list of certificates installed on a device: -1. Select the device from the **Installed devices** tab in the flyout panel or select the device directly from the **Device inventory** page. +1. Select the device from the **Installed devices** tab in the flyout panel or select the device directly from the **Device inventory** page. 2. Select the **Certificate inventory** tab to see a list of certificates installed on that device. :::image type="content" source="../../media/defender-vulnerability-management/certificate_inventory_page.png" alt-text="Screenshot of the certificate inventory page" lightbox="../../media/defender-vulnerability-management/certificate_inventory_page.png"::: You can also view a list of certificates installed on a device: ## Vulnerability management dashboard widget -See how many certificates have expired or are due to expire in the next 30, 60 or 90 days from the **Expiring certificates** widget available in the vulnerability management dashboard.   +See how many certificates have expired or are due to expire in the next 30, 60 or 90 days from the **Expiring certificates** widget available in the vulnerability management dashboard. Select **View all** to go to the certificate inventory page. -  :::image type="content" source="../../media/defender-vulnerability-management/certificate_dashboard.png" alt-text="Screenshot of the certificate dashboard widget" lightbox="../../media/defender-vulnerability-management/certificate_dashboard.png"::: ## Use advanced hunting |
| security | Tvm Network Share Assessment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-network-share-assessment.md | When vulnerable network share configurations are identified, they're mapped to a - Disallow offline access to shares - Remove shares from the root folder-- Remove share write permission set to ΓÇÿEveryoneΓÇÖ+- Remove share write permission set to 'Everyone' - Set folder enumeration for shares ## Find information about exposed network shares |
| security | Tvm Security Baselines | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-security-baselines.md | In the **Configurations** tab, you can review the list of configurations and ass :::image type="content" alt-text="Configuration tab in the profile page" source="../../media/defender-vulnerability-management/security-baselines-configurations.png" lightbox="../../media/defender-vulnerability-management/security-baselines-configurations.png"::: -By selecting a configuration in the list, you’ll see a flyout with details for the policy setting, including the recommended value (the expected value range for a device to be considered compliant) and the source used to determine the current device settings. +By selecting a configuration in the list, you'll see a flyout with details for the policy setting, including the recommended value (the expected value range for a device to be considered compliant) and the source used to determine the current device settings. :::image type="content" alt-text="Configuration flyout details in the profile page" source="../../media/defender-vulnerability-management/security-baselines-configurations-details.png" lightbox="../../media/defender-vulnerability-management/security-baselines-configurations-details.png"::: The **Devices** tab shows a list of all applicable devices and their compliance In the main **Devices** tab, you can review the list of devices and assess their reported compliance state. -By selecting a device in the list, you’ll see a flyout with additional details.   +By selecting a device in the list, you'll see a flyout with additional details. :::image type="content" alt-text="Devices tab in the profile page" source="../../media/defender-vulnerability-management/security-baselines-device-details.png" lightbox="../../media/defender-vulnerability-management/security-baselines-configurations-details.png"::: Select the **Configuration** tab to view the compliance of this specific device At the top of the device side panel, select **Open device page** to go to the device page in the device inventory. The device page displays the **Baseline compliance** tab that provides granular visibility into the compliance of the device. -By selecting a configuration in the list, you’ll see a flyout with compliance details for the policy setting on this device. +By selecting a configuration in the list, you'll see a flyout with compliance details for the policy setting on this device. ## Use advanced hunting |
| security | Defenderexpertsforhuntingprev | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/defenderexpertsforhuntingprev.md | Defender Experts for Hunting provides targeted attack notifications directly thr >[!IMPORTANT] >Before you apply, make sure to discuss the eligibility requirements for Defender Experts for Hunting with your Microsoft Technical Service provider and account team. The preview is filling up fast and availability is very limited. If we can't get you in, we'll reach out to you soon as Microsoft Defender Experts for Hunting service is ready for general availability. -If you havenΓÇÖt done so yet, you can apply for Defender Experts for Hunting: +If you haven't done so yet, you can apply for Defender Experts for Hunting: -1. Click [**Apply**](https://aka.ms/expandedMTEprev). Only the global administrators can register and complete the application process. If youΓÇÖre not a global administrator, contact your global administrator to fill out the application form. +1. Click [**Apply**](https://aka.ms/expandedMTEprev). Only the global administrators can register and complete the application process. If you're not a global administrator, contact your global administrator to fill out the application form. 2. Enter your **company email ID**. 3. Select **Submit**. You will get a confirmation message that your application has been received. 4. Upon approval, you will receive an email to register. If you havenΓÇÖt done so yet, you can apply for Defender Experts for Hunting: You need to follow these steps to join the preview: -1. In the application acceptance email that youΓÇÖve received, click **Register**. This opens the sign-in dialog box to your Microsoft 365 account. -2. Ask your global administrator to register your company (the link will be provided in the email youΓÇÖll get). Sign in. The **Settings** page opens. +1. In the application acceptance email that you've received, click **Register**. This opens the sign-in dialog box to your Microsoft 365 account. +2. Ask your global administrator to register your company (the link will be provided in the email you'll get). Sign in. The **Settings** page opens. 3. Go to **Settings > Microsoft Defender Experts**. 4. Read the **Microsoft Defender Experts for Hunting preview terms and conditions**. If you have any questions or concerns, contact the Microsoft Defender Experts Team at defenderexpertshelp@microsoft.com. 5. Click **Accept**, to accept the terms and conditions. The Microsoft Defender Experts for Hunting - Experts on Demand menu option in th ## Opt out of preview -In case you change your mind and donΓÇÖt want to continue with the Defender Experts for Hunting preview, you can follow the steps to [cancel a self-service subscription](../../commerce/subscriptions/manage-self-service-purchases-admins.md#cancel-a-self-service-purchase-subscription). +In case you change your mind and don't want to continue with the Defender Experts for Hunting preview, you can follow the steps to [cancel a self-service subscription](../../commerce/subscriptions/manage-self-service-purchases-admins.md#cancel-a-self-service-purchase-subscription). ### Related topics |
| security | Address Compromised Users Quickly | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/address-compromised-users-quickly.md | When a user account is compromised, alerts are triggered. And in some cases, tha > [!IMPORTANT] > You must have appropriate permissions to perform the following tasks. See [Required permissions to use AIR capabilities](office-365-air.md#required-permissions-to-use-air-capabilities). +Watch this short video to learn how you can detect and respond to user compromise in Microsoft Defender for Office 365 using Automated Investigation and Response (AIR) and compromised user alerts. +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWAl83] + ### View and investigate restricted users You have a few options for navigating to a list of restricted users. For example, in the Microsoft 365 Defender portal, you can go to **Email & collaboration** \> **Review** \> **Restricted Users**. The following procedure describes navigation using the **Alerts** dashboard, which is a good way to see various kinds of alerts that might have been triggered. |
| security | Admin Submission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/admin-submission.md | When you submit an email message for analysis, you will get: For other ways to submit email messages, URLs, and attachments to Microsoft, see [Report messages and files to Microsoft](report-junk-email-messages-to-microsoft.md). +Watch this short video to learn how to use admin submissions in Microsoft Defender for Office 365 to submit messages to Microsoft for evaluation. +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWBLPn] + ## What do you need to know before you begin? - You open the Microsoft 365 Defender portal at <https://security.microsoft.com/>. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. |
| security | Attack Simulation Training Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-get-started.md | ms.prod: m365-security If your organization has Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, which includes [Threat Investigation and Response capabilities](office-365-ti.md), you can use Attack simulation training in the Microsoft 365 Defender portal to run realistic attack scenarios in your organization. These simulated attacks can help you identify and find vulnerable users before a real attack impacts your bottom line. Read this article to learn more. +Watch this short video to learn more about Attack simulation training. +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWMhvB] + > [!NOTE] > Attack simulation training replaces the old Attack Simulator v1 experience that was available in the Security & Compliance Center at **Threat management** \> **Attack simulator** or <https://protection.office.com/attacksimulator>. |
| security | Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/defender-for-office-365.md | The following table summarizes what's included in each plan. - If your current subscription doesn't include Microsoft Defender for Office 365 and you want it, [contact sales to start a trial](https://info.microsoft.com/ww-landing-M365SMB-web-contact.html), and find out how Microsoft Defender for Office 365 can work for in your organization. -- Microsoft Defender for Office 365 P2 customers have access to **Microsoft 365 Defender integration** to efficiently detect, review, and respond to incidents and alerts.+- Microsoft Defender for Office 365 P2 customers have access to **Microsoft 365 Defender integration** to efficiently detect, review, and respond to incidents and alerts. ++Watch this short video to learn more about Microsoft Defender for Office 365 P2 capabilities that have moved into the Microsoft 365 Defender portal. +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWRwfx] + ## Configure Microsoft Defender for Office 365 policies |
| security | How Policies And Protections Are Combined | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/how-policies-and-protections-are-combined.md | In general, a policy that's applied to a message is identified in the **X-Forefr There are two major factors that determine which policy is applied to a message: -- **The priority of the email protection type**: This order is not configurable, and is described in the following table:+- **The order of processing for the email protection type**: This order is not configurable, and is described in the following table: - |Priority|Email protection|Category|Where to manage| - ||||| + |Order|Email protection|Category|Where to manage| + |::|||| |1|Malware|CAT:MALW|[Configure anti-malware policies in EOP](configure-anti-malware-policies.md)| |2|Phishing|CAT:PHSH|[Configure anti-spam policies in EOP](configure-your-spam-filter-policies.md)| |3|High confidence spam|CAT:HSPM|[Configure anti-spam policies in EOP](configure-your-spam-filter-policies.md)| There are two major factors that determine which policy is applied to a message: <sup>\*</sup> These features are only available in anti-phishing policies in Microsoft Defender for Office 365. -- **The priority of the policy**: For each type of policy (anti-spam, anti-malware, anti-phishing, etc.), there's a default policy that applies to everyone, but you can create custom policies that apply to specific users. Each custom policy has a priority value that determines the order that the policies are applied in. The default policy is always applied last.+- **The priority of the policy**: For each type of policy (anti-spam, anti-malware, anti-phishing, etc.), there's a default policy that applies to everyone, but you can create custom policies that apply to specific users (recipients). Each custom policy has a priority value that determines the order that the policies are applied in. The default policy is always applied last. > [!IMPORTANT]- > If a user is defined in multiple policies of the same type, only the policy with the highest priority is applied to them. Any remaining policies of that type are not evaluated for the user (including the default policy). + > If a recipient is defined in multiple policies of the same type (anti-spam, anti-phishing, etc.), only the policy with the highest priority is applied to the recipient. Any remaining policies of that type are not evaluated for the recipient (including the default policy). -For example, consider the following anti-phishing policies in Microsoft Defender for Office 365 **that apply to the same users**, and a message that's identified as both user impersonation and spoofing: +For example, consider the following **anti-phishing policies** in Microsoft Defender for Office 365 **that apply to the same users**, and a message that's identified as **both user impersonation and spoofing**: |Policy name|Priority|User impersonation|Anti-spoofing|-||||| +||::|::|::| |Policy A|1|On|Off| |Policy B|2|Off|On| -1. The message is marked and treated as spoof, because spoofing has a higher priority (4) than user impersonation (5). -2. Policy A is applied to the users because it has a higher priority than Policy B. -3. Based on the settings in Policy A, no action is taken on the message, because anti-spoofing is turned off in the policy. -4. Policy processing stops, so Policy B is never applied to the users. +1. The message is identified as spoofing, because spoofing (4) is evaluated before user impersonation (5). +2. Policy A is applied first because it has a higher priority than Policy B. +3. Based on the settings in Policy A, no action is taken on the message because anti-spoofing is turned off. +4. The processing of anti-phishing policies stops for all included recipients, so Policy B is never applied to recipients who are also in Policy A. -Because it's possible that the same users are intentionally or unintentionally included in multiple custom policies of the same type, use the following design guidelines for custom policies: +Because the same users might be intentionally or unintentionally included in multiple policies of the same type, use the following design guidelines for custom policies: - Assign a higher priority to policies that apply to a small number of users, and a lower priority to policies that apply to a large number of users. Remember, the default policy is always applied last. - Configure your higher priority policies to have stricter or more specialized settings than lower priority policies. |
| security | Manage Quarantined Messages And Files | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/manage-quarantined-messages-and-files.md | Admins in organizations with Microsoft Defender for Office 365 can also manage f You view and manage quarantined messages in the Microsoft 365 Defender portal or in PowerShell (Exchange Online PowerShell for Microsoft 365 organizations with mailboxes in Exchange Online; standalone EOP PowerShell for organizations without Exchange Online mailboxes). +Watch this short video to learn how to manage quarantined messages as an administrator. +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWGGPF] + ## What do you need to know before you begin? - To open the Microsoft 365 Defender portal, go to <https://security.microsoft.com>. To go directly to the **Quarantine** page, use <https://security.microsoft.com/quarantine>. |
| security | Mdo Sec Ops Manage Incidents And Alerts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-sec-ops-manage-incidents-and-alerts.md | An [incident](/microsoft-365/security/defender/incidents-overview) in Microsoft Alerts are created when malicious or suspicious activity affects an entity (for example, email, users, or mailboxes). Alerts provide valuable insights about in-progress or completed attacks. However, an ongoing attack can affect multiple entities, which results in multiple alerts from different sources. Some built-in alerts will automatically trigger AIR playbooks. These playbooks do a series of investigation steps to look for other impacted entities or suspicious activity. +Watch this short video on how to manage Microsoft Defender for Office 365 alerts in Microsoft 365 Defender. +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWGrL2] + Defender for Office 365 alerts, investigations, and their data are automatically correlated. When a relationship is determined, an incident is created by the system to give security teams visibility for the entire attack. We strongly recommend that SecOps teams manage incidents and alerts from Defender for Office 365 in the Incidents queue at <https://security.microsoft.com/incidents-queue>. This approach has the following benefits: The most effective way to take action is to use the built-in integration with In - You take actions on email from a single place. You take action on email based on the result of a manual investigation or hunting activity. [Threat Explorer](threat-explorer.md) allows security team members to take action on any email messages that might still exist in cloud mailboxes. They can take action on intra-org messages that were sent between users in your organization. Threat Explorer data is available for the last 30 days.++Watch this short video to learn how Microsoft 365 Defender combines alerts from various detection sources, like Defender for Office 365, into incidents. +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWGpcs] |
| security | Remove Blocked Connectors | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/remove-blocked-connectors.md | ms.prod: m365-security - [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) - [Microsoft 365 Defender](../defender/microsoft-365-defender.md) -If an inbound connector is detected as potentially compromised, it is restricted from sending any relaying email. The connector is then added to the **Restricted entities** page in the Microsoft 365 Defender portal. When the connector is used to send email, the message is returned in a non-delivery report (also known as an NDR or bounced message) with the error code 550;5.7.711 and the following text: +If an inbound connector is detected as potentially compromised, it is restricted from sending any relaying email. The connector is then added to the **Restricted entities** page in the Microsoft 365 Defender portal. When the connector is used to send email, the message is returned in a non-delivery report (also known as an NDR or bounced message) with the error code 550;5.7.711 and the following text: -> Your message couldn’t be delivered. The most common reason for this is that your organization’s email connector is suspected of sending spam or phish and it’s no -> longer allowed to send email. Contact your email admin for assistance. -> Remote Server returned '550;5.7.711 Access denied, bad inbound connector. AS(2204).' +> Your message couldn't be delivered. The most common reason for this is that your organization's email connector is suspected of sending spam or phish and it's no +> longer allowed to send email. Contact your email admin for assistance. +> Remote Server returned '550;5.7.711 Access denied, bad inbound connector. AS(2204).' -Admins can remove connectors from the Restricted entities page in Microsoft 365 Defender or in Exchange Online PowerShell. +Admins can remove connectors from the Restricted entities page in Microsoft 365 Defender or in Exchange Online PowerShell. ## Learn more on restricted entities A restricted entity is an entity that has been blocked from sending email because either it has been potentially compromised, or it has exceeded sending limit. -There are 2 types of restricted entities: +There are 2 types of restricted entities: -- **Restricted user**: For more information about why a user can be restricted and how to handle restricted users, see [Remove blocked users from the Restricted entities portal](removing-user-from-restricted-users-portal-after-spam.md). +- **Restricted user**: For more information about why a user can be restricted and how to handle restricted users, see [Remove blocked users from the Restricted entities portal](removing-user-from-restricted-users-portal-after-spam.md). -- **Restricted connector**: Learn about why a connector can be restricted and how to handle restricted connectors (this article). +- **Restricted connector**: Learn about why a connector can be restricted and how to handle restricted connectors (this article). ## What do you need to know before you begin? |
| security | Report False Positives And False Negatives | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/report-false-positives-and-false-negatives.md | In Microsoft 365 organizations with mailboxes in Exchange Online or on-premises - For more information about reporting messages to Microsoft, see [Report messages and files to Microsoft](report-junk-email-messages-to-microsoft.md). +Watch this short video to learn how you can use Microsoft Defender for Office 365 to easily investigate user submissions to determine the contents of a message, and respond to the submission by applying the appropriate remediation action. +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWBHof] + ### Turn off the built-in reporting experience We don't recommend the built-in reporting experience in Outlook because it can't use the [user submission policy](./user-submission.md). We recommend using the Report Message add-in or the Report Phishing add-in instead. |
| security | Respond Compromised Connector | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/respond-compromised-connector.md | If you have [Microsoft Defender for Office 365 plan 2](defender-for-office-365.m 3. Identify: - - If **Sender IP** matches with your organizationΓÇÖs on-prem IP address. + - If **Sender IP** matches with your organization's on-prem IP address. - If a significant number of emails were recently sent to the **Junk** folder. This is a good indicator of a compromised connector being used to send spam. |
| security | Threat Hunting In Threat Explorer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/threat-hunting-in-threat-explorer.md | With these tools, you can: For more information, see [Email security with Threat Explorer](email-security-in-microsoft-defender.md). +Watch this short video to learn how to hunt and investigate email and collaboration-based threats using Microsoft Defender for Office 365. +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWyPRU] + ## Threat Explorer walk-through In Microsoft Defender for Office 365, there are two subscription plansΓÇöPlan 1 and Plan 2. Manually operated Threat hunting tools exist in both plans, under different names and with different capabilities. |
| security | Try Microsoft Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/try-microsoft-defender-for-office-365.md | The unified **Trials** portal in the Microsoft 365 Defender portal provides a si You're invited to start your trial in various Defender for Office 365 feature locations in the Microsoft 365 Defender portal at <https://security.microsoft.com>. The centralized location to start your trial is on the **Trials** page at <https://security.microsoft.com/atpEvaluation>. +Watch this short video to learn more about how you can get more done in less time with Microsoft Defender for Office 365. +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWMmIe] + The rest of this article explains the difference between audit mode blocking mode, how to configure evaluations, and other details. For a companion guide for how to use your trial, see [Trial playbook: Microsoft Defender for Office 365](trial-playbook-defender-for-office-365.md). |
| security | View Email Security Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/view-email-security-reports.md | A variety of reports are available in the Microsoft 365 Defender portal at <http > > Reports that are related to mail flow are now in the Exchange admin center. For more information about these reports, see [Mail flow reports in the new Exchange admin center](/exchange/monitoring/mail-flow-reports/mail-flow-reports). +Watch this short video to learn how you can use reports to understand the effectiveness of Defender for Office 365 in your organization. +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWBkxB] + ## Email security report changes in the Microsoft 365 Defender portal The Exchange Online Protection (EOP) and Microsoft Defender for Office 365 reports in the Microsoft 365 Defender portal that have been replaced, moved, or deprecated are described in the following table. |
| solutions | Tenant Management Device Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/tenant-management-device-management.md | Here is an example of the validation and management of users, their devices, and To help you secure and protect your organization's resources, Microsoft 365 for enterprise includes features to help manage devices and their access to apps. There are two options for device management: - Microsoft Intune, which is a comprehensive device and app management solution for enterprises.-- Basic Mobility and Security, which is a subset of Intune services included with all Microsoft 365 products for managing devices in your organization. For more information, see [Capabilities of Basic Mobility and Security](../admin/basic-mobility-security/capabilities.md).+- Basic Mobility and Security, which is a subset of Intune services included with all Microsoft 365 products for managing devices in your organization. For more information, see [Capabilities of Basic Mobility and Security](../admin/basic-mobility-security/capabilities.md). If you have Microsoft 365 E3 or E5, you should use Intune. In this illustration, the tenant has: On an ongoing basis, you might need to: - Manage device enrollment.-- Revise your settings and policies for additional apps, devices, and security requirements.+- Revise your settings and policies for additional apps, devices, and security requirements. |