| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| business-premium | Secure Your Business Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/secure-your-business-data.md | audience: Admin Previously updated : 05/09/2023 Last updated : 05/15/2023 ms.localizationpriority: medium - highpri description: "Learn best practices to protect your business from ransomware, phi > > If you're a Microsoft partner, see [Resources for Microsoft partners working with small and medium-sized businesses](../security/defender-business/mdb-partners.md). -This article lists the top 10 ways to secure your business data with Microsoft 365 for business. --Microsoft 365 Business Basic, Standard, and Premium include antiphishing, antispam, and antimalware protection. Microsoft 365 Business Premium includes even more security capabilities, such as advanced threat protection for devices (also referred to as endpoints), email, and collaboration, and information protection. --For more information about what each plan includes, see [Microsoft 365 User Subscription Suites for Small and Medium-sized Businesses](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWR6bM). - ## Top 10 ways to secure your business data +Microsoft 365 Business Basic, Standard, and Premium include antiphishing, antispam, and antimalware protection. Microsoft 365 Business Premium includes even more security capabilities, such as advanced threat protection for devices (also referred to as endpoints), email, and collaboration, and information protection. For more information about what each plan includes, see [Microsoft 365 User Subscription Suites for Small and Medium-sized Businesses](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWR6bM). -1. [Use multi-factor authentication](#1-use-multi-factor-authentication). -2. [Protect your administrator accounts](#2-protect-your-administrator-accounts). -3. [Use preset security policies](#3-use-preset-security-policies). -4. [Protect all devices](#4-protect-all-devices). -5. [Train everyone on email best practices](#5-train-everyone-on-email-best-practices). -6. [Use Microsoft Teams for collaboration and sharing](#6-use-microsoft-teams-for-collaboration-and-sharing). -7. [Set sharing settings for SharePoint and OneDrive files and folders](#7-set-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). -8. [Use Microsoft 365 Apps on devices](#8-use-microsoft-365-apps-on-devices). -9. [Manage calendar sharing for your business](#9-manage-calendar-sharing-for-your-business). -10. [Maintain your environment](#10-maintain-your-environment). +The following table summarizes recommendations by subscription for securing your business data: -The following sections describe these methods in more detail and include links to additional information. +| Step | Recommendations | +||| +| [1. Use multi-factor authentication](#1-use-multi-factor-authentication). <br/><br/>*See [What MFA is and why it matters](#what-mfa-is-and-why-it-matters).* | Microsoft 365 Business Basic or Standard: [Use security defaults](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults#enabling-security-defaults).<br/><br/>Microsoft 365 Business Premium: [Use either security defaults or Conditional Access](m365bp-turn-on-mfa.md). | +| [2. Protect your administrator accounts](#2-protect-your-administrator-accounts).<br/><br/>*See [Why you should protect admin accounts](#why-you-should-protect-admin-accounts).* | Microsoft 365 Business Basic, Standard, or Premium: [Assign admin roles](/microsoft-365/admin/add-users/assign-admin-roles). | +| [3. Use preset security policies](#3-use-preset-security-policies).<br/><br/>*See [How preset security policies help](#how-preset-security-policies-help).* | Microsoft 365 Business Basic, Standard, or Premium: [Assign Standard or Strict preset security policies to users](/microsoft-365/security/office-365-security/preset-security-policies#use-the-microsoft-365-defender-portal-to-assign-standard-and-strict-preset-security-policies-to-users). | +| [4. Protect all devices](#4-protect-all-devices).<br/><br/>*See [Why and how to protect devices](#why-and-how-to-protect-devices).* | Microsoft 365 Business Basic: [Turn on MFA](m365bp-turn-on-mfa.md) (for basic protection).<br/><br/>Microsoft 365 Business Standard:<br/>1. [Turn on MFA](m365bp-turn-on-mfa.md).<br/>2. [Install Microsoft 365 Apps on devices](m365bp-users-install-m365-apps.md).<br/><br/>Microsoft 365 Business Premium:<br/>1. [Turn on MFA](m365bp-turn-on-mfa.md). <br/>2. [Install Microsoft 365 Apps on devices](m365bp-users-install-m365-apps.md).<br/>3. [Secure both managed and unmanaged devices](m365bp-managed-unmanaged-devices.md). | +| [5. Train everyone on email best practices](#5-train-everyone-on-email-best-practices).<br/><br/>*See [Why and how to protect email content](#why-and-how-to-protect-email-content).* | Microsoft 365 Basic, Standard, or Premium: <br/>1. Follow the guidance in [Protect against threats](/microsoft-365/security/office-365-security/protect-against-threats). <br/>2. Share [Protect yourself against phishing and other attacks](m365bp-avoid-phishing-and-attacks.md) with everyone. | +| [6. Use Microsoft Teams for collaboration and sharing](#6-use-microsoft-teams-for-collaboration-and-sharing).<br/><br/>*See [How to collaborate and share more securely](#how-to-collaborate-and-share-more-securely).* | Microsoft 365 Business Basic or Standard: [Use Microsoft Teams for collaboration and sharing](create-teams-for-collaboration.md). <br/><br/>Microsoft 365 Business Premium: <br/>1. [Use Microsoft Teams for meetings and information sharing](create-teams-for-collaboration.md). <br/>2. [Use Safe Links & Safe Attachments with Microsoft Teams](/microsoft-365/security/office-365-security/mdo-support-teams-about). <br/>3. [Use sensitivity labels with meetings](/microsoft-365/compliance/sensitivity-labels-meetings) to protect calendar items, Microsoft Teams meetings, and chat. <br/>4. [Use the default DLP policy in Microsoft Teams](/microsoft-365/compliance/dlp-teams-default-policy). | +| [7. Set sharing settings for SharePoint and OneDrive files and folders](#7-set-sharing-settings-for-sharepoint-and-onedrive-files-and-folders).<br/><br/>*See [Why and how to adjust sharing settings in SharePoint and OneDrive](#why-and-how-to-adjust-sharing-settings-for-files-and-folders-in-sharepoint-and-onedrive).* | Microsoft 365 Business Basic or Standard: <br/>1. Use SharePoint and OneDrive for storing and sharing files.<br/>2. [Set sharing settings for SharePoint and OneDrive](m365bp-protect-against-malware-cyberthreats.md#3-adjust-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). <br/><br/>Microsoft 365 Business Premium: <br/>1. Use SharePoint and OneDrive for storing and sharing files. <br/>2. [Set sharing settings for SharePoint and OneDrive](m365bp-protect-against-malware-cyberthreats.md#3-adjust-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). <br/>3. Use [Safe Links](/microsoft-365/security/office-365-security/safe-links-about) and [Safe Attachments](/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-about) with SharePoint and OneDrive. <br/>4. Use [sensitivity labels](/microsoft-365/compliance/get-started-with-sensitivity-labels) and [DLP](/microsoft-365/compliance/get-started-with-the-default-dlp-policy). | +| [8. Use Microsoft 365 Apps on devices](#8-use-microsoft-365-apps-on-devices).<br/><br/>*See [Why users should use Microsoft 365 Apps](#why-users-should-use-microsoft-365-apps).* | Microsoft 365 Business Basic: Use Outlook and Web/mobile versions of Microsoft 365 Apps. <br/><br/>Microsoft 365 Business Standard or Premium: <br/>1. [Install Microsoft 365 Apps on all devices](m365bp-users-install-m365-apps.md). <br/>2. Share the [Employee quick setup guide with users](https://support.microsoft.com/office/7f34c318-e772-46a5-8c0a-ab86661542d1). | +| [9. Manage calendar sharing for your business](#9-manage-calendar-sharing-for-your-business).<br/><br/>*See [How to prevent calendar oversharing](#how-to-prevent-calendar-oversharing).* | Microsoft 365 Business Basic or Standard: Use Outlook and Exchange Online for email and calendars.<br/><br/>Microsoft 365 Business Premium:<br/>1. Use Outlook and Exchange Online for email and calendars.<br/>2. [Get started using your default DLP policy](/microsoft-365/compliance/get-started-with-the-default-dlp-policy). | +| [10. Maintain your environment](#10-maintain-your-environment).<br/><br/>*See [Why maintenance and operations matter](#why-maintenance-and-operations-matter).* | Microsoft 365 Basic or Standard: Use the [Microsoft 365 admin center](https://admin.microsoft.com) to view subscription information, updates, and other settings. <br/><br/>Microsoft 365 Business Premium: <br/>1. Use the [Microsoft 365 admin center](https://admin.microsoft.com) to view subscription information, updates, and other settings. <br/>2. Use the [Microsoft 365 admin center](https://admin.microsoft.com) or the [Microsoft Entra portal](https://entra.microsoft.com) for managing user accounts.<br/>3. Use the [Microsoft 365 Defender portal](https://security.microsoft.com) and the [Microsoft 365 Purview compliance portal](https://compliance.microsoft.com/) for viewing and managing security & compliance capabilities. If preferred, you can use the [Intune admin center](https://intune.microsoft.com) to view or manage devices. | ++The following sections describe each method in more detail, including why and how to implement our recommendations in your environment. ## 1. Use multi-factor authentication +| Subscription | Recommendation | +||| +| [Microsoft 365 Business Premium](index.md) | [Use either security defaults or Conditional Access](m365bp-turn-on-mfa.md). | +| [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md)<br/>[Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | [Use security defaults](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults#enabling-security-defaults). | ++### What MFA is and why it matters + [Multi-factor authentication](../admin/security-and-compliance/multi-factor-authentication-microsoft-365.md) (MFA), also known as two-step verification, requires people to use a code or authentication app on their phone to sign into Microsoft 365, and is a critical first step to protecting your business data. Using MFA can prevent bad actors from taking over your account if they know your password. To help simplify the process of enabling MFA, [security defaults in Azure Active Directory (Azure AD)](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults) are available in Microsoft 365 Business Basic, Standard, and Premium. -Microsoft 365 Business Premium also includes [Azure AD Premium P1](/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses) for advanced administration. It enables you to set up and configure [Conditional Access](/azure/active-directory/conditional-access/overview) policies instead of security defaults, for more stringent requirements. +Microsoft 365 Business Premium also includes [Azure AD Premium P1](/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses) for advanced administration. It enables you to set up and configure [Conditional Access](/azure/active-directory/conditional-access/overview) policies instead of security defaults, for more stringent requirements. See [Turn on multi-factor authentication](m365bp-turn-on-mfa.md). -See [Turn on multi-factor authentication](m365bp-turn-on-mfa.md). +## 2. Protect your administrator accounts | Subscription | Recommendation | |||-| [Microsoft 365 Business Premium](index.md) | [Use either security defaults or Conditional Access](m365bp-turn-on-mfa.md). | -| [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md)<br/>[Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | [Use security defaults](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults#enabling-security-defaults). | --## 2. Protect your administrator accounts +| [Microsoft 365 Business Premium](index.md) <br/>[Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md) <br/>[Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | [Assign admin roles](/microsoft-365/admin/add-users/assign-admin-roles). | -Administrator accounts (also called admins) have elevated privileges, making these accounts more susceptible to cyberattacks. Make sure to set up and manage the right number of admin and user accounts for your business. +### Why you should protect admin accounts -We also recommend adhering to the information security principle of least privilege, which means that users and applications should be granted access only to the data and operations they require to perform their jobs. +Administrator accounts (also called admins) have elevated privileges, making these accounts more susceptible to cyberattacks. Make sure to set up and manage the right number of admin and user accounts for your business. We also recommend adhering to the information security principle of least privilege, which means that users and applications should be granted access only to the data and operations they require to perform their jobs. -Microsoft 365 Business Basic, Standard, and Premium include the [Microsoft 365 admin center](https://admin.microsoft.com) and the [Azure AD portal](https://entra.microsoft.com) to set up and manage your admin accounts. +Microsoft 365 Business Basic, Standard, and Premium include the [Microsoft 365 admin center](https://admin.microsoft.com) and the [Microsoft Entra portal](https://entra.microsoft.com) to set up and manage your admin accounts. See [Protect your administrator accounts](m365bp-protect-admin-accounts.md). -See [Protect your administrator accounts](m365bp-protect-admin-accounts.md). +## 3. Use preset security policies | Subscription | Recommendation | |||-| [Microsoft 365 Business Premium](index.md) <br/>[Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md) <br/>[Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | [Assign admin roles](/microsoft-365/admin/add-users/assign-admin-roles). | +| [Microsoft 365 Business Premium](index.md)<br/>[Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md)<br/>[Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | [Assign Standard or Strict preset security policies to users](/microsoft-365/security/office-365-security/preset-security-policies#use-the-microsoft-365-defender-portal-to-assign-standard-and-strict-preset-security-policies-to-users). | -## 3. Use preset security policies +### How preset security policies help -[Preset security policies](/microsoft-365/security/office-365-security/preset-security-policies) save time by applying recommended spam, anti-malware, and anti-phishing policies to users all at once. +[Preset security policies](/microsoft-365/security/office-365-security/preset-security-policies) save time by applying recommended spam, anti-malware, and anti-phishing policies to users all at once. Preset security policies take the guesswork out of implementing protection for email and collaboration content. Microsoft 365 Business Basic, Standard, and Premium include [Exchange Online Protection](../security/office-365-security/eop-about.md) (EOP). It includes preset security policies for anti-spam, anti-malware, and anti-phishing. See the following articles: - [Policies in preset security policies](../security/office-365-security/preset-security-policies.md#policies-in-preset-security-policies) - [Protect against malware and other cyberthreats](m365bp-protect-against-malware-cyberthreats.md) -| Subscription | Recommendation | +## 4. Protect all devices ++| Subscription | Recommendations | |||-| [Microsoft 365 Business Premium](index.md)<br/>[Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md)<br/>[Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | [Assign Standard or Strict preset security policies to users](/microsoft-365/security/office-365-security/preset-security-policies#use-the-microsoft-365-defender-portal-to-assign-standard-and-strict-preset-security-policies-to-users). | +| [Microsoft 365 Business Premium](index.md) | 1. [Turn on MFA](m365bp-turn-on-mfa.md).<br/>2. [Install Microsoft 365 Apps on devices](m365bp-users-install-m365-apps.md).<br/>3. [Secure managed and unmanaged devices](m365bp-managed-unmanaged-devices.md). | +| [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md) | 1. [Turn on MFA](m365bp-turn-on-mfa.md).<br/>2. [Install Microsoft 365 Apps on devices](m365bp-users-install-m365-apps.md). | +| [Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | [Turn on MFA](m365bp-turn-on-mfa.md). | -## 4. Protect all devices +### Why and how to protect devices Every device is a possible attack avenue into your network and must be configured properly, even devices that are personally owned but used for work. Your security team and all employees can all take steps to protect devices. For example, all users can use MFA on their devices. See the following articles: - [Set up unmanaged (BYOD) devices](m365bp-set-up-unmanaged-devices.md) - [Set up and secure managed devices](m365bp-protect-managed-devices.md) +## 5. Train everyone on email best practices + | Subscription | Recommendations | |||-| [Microsoft 365 Business Premium](index.md) | [Turn on MFA](m365bp-turn-on-mfa.md).<br/>[Install Microsoft 365 Apps on devices](m365bp-users-install-m365-apps.md).<br/>[Secure managed and unmanaged devices](m365bp-managed-unmanaged-devices.md). | -| [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md) | [Turn on MFA](m365bp-turn-on-mfa.md).<br/>[Install Microsoft 365 Apps on devices](m365bp-users-install-m365-apps.md).<br/>(*Defender for Business can be added on*) | -| [Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | [Turn on MFA](m365bp-turn-on-mfa.md).<br/>(*Defender for Business can be added on*) | +| [Microsoft 365 Business Premium](index.md)<br/>[Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md) <br/>[Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | 1. Follow the guidance in [Protect against threats](/microsoft-365/security/office-365-security/protect-against-threats).<br/>2. Share [Protect yourself against phishing and other attacks](m365bp-avoid-phishing-and-attacks.md) with everyone. | -## 5. Train everyone on email best practices +### Why and how to protect email content Email can contain malicious attacks cloaked as harmless communications. Email systems are especially vulnerable, because email is handled by everyone in the organization, and safety relies on humans making consistently good decisions with those communications. See the following articles: - [Safe Links](/microsoft-365/security/office-365-security/safe-links-about) - [Protect against threats](../security/office-365-security/protect-against-threats.md) +## 6. Use Microsoft Teams for collaboration and sharing + | Subscription | Recommendations | |||-| [Microsoft 365 Business Premium](index.md)<br/>[Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md) <br/>[Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | Follow the guidance in [Protect against threats](/microsoft-365/security/office-365-security/protect-against-threats).<br/>Share [Protect yourself against phishing and other attacks](m365bp-avoid-phishing-and-attacks.md) with everyone. | +| [Microsoft 365 Business Premium](index.md) | 1. [Use Microsoft Teams for meetings and information sharing](create-teams-for-collaboration.md). <br/>2. [Use Safe Links & Safe Attachments with Microsoft Teams](/microsoft-365/security/office-365-security/mdo-support-teams-about). <br/>3. [Use sensitivity labels with meetings](/microsoft-365/compliance/sensitivity-labels-meetings) to protect calendar items, Microsoft Teams meetings, and chat. <br/>4. [Use the default DLP policy in Microsoft Teams](/microsoft-365/compliance/dlp-teams-default-policy). | +| [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md)<br/>[Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | [Use Microsoft Teams](create-teams-for-collaboration.md). | -## 6. Use Microsoft Teams for collaboration and sharing +### How to collaborate and share more securely The best way to collaborate and share securely is to use Microsoft Teams. With Microsoft Teams, all your files and communications are in a protected environment and aren't being stored in unsafe ways outside of it. See the following articles: - [Data Loss Prevention (DLP) in Microsoft Teams](/microsoft-365/compliance/dlp-teams-default-policy) - [Use sensitivity labels to protect calendar items, Teams meetings, and chat](/microsoft-365/compliance/sensitivity-labels-meetings) ++## 7. Set sharing settings for SharePoint and OneDrive files and folders + | Subscription | Recommendations | |||-| [Microsoft 365 Business Premium](index.md) | Use Microsoft Teams for meetings and information sharing. <br/>Use [Safe Links & Safe Attachments](/microsoft-365/security/office-365-security/mdo-support-teams-about) with Microsoft Teams. <br/>Use [sensitivity labels](/microsoft-365/compliance/sensitivity-labels-meetings) to protect calendar items, Microsoft Teams meetings, and chat. <br/>Use the default [DLP policy](/microsoft-365/compliance/dlp-teams-default-policy) in Microsoft Teams. | -| [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md)<br/>[Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | Use Microsoft Teams.<br/>(*Defender for Office 365 can be added on*) | +| [Microsoft 365 Business Premium](index.md) | 1. Use SharePoint and OneDrive for storing and sharing files. <br/>2. [Set sharing settings for SharePoint and OneDrive](m365bp-protect-against-malware-cyberthreats.md#3-adjust-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). <br/>3. Use [Safe Links](/microsoft-365/security/office-365-security/safe-links-about) and [Safe Attachments](/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-about) with SharePoint and OneDrive. <br/>4. Use [sensitivity labels](/microsoft-365/compliance/get-started-with-sensitivity-labels) and [DLP](/microsoft-365/compliance/get-started-with-the-default-dlp-policy). | +| [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md) <br/> [Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) |1. Use SharePoint and OneDrive for storing and sharing files.<br/>2. [Set sharing settings for SharePoint and OneDrive](m365bp-protect-against-malware-cyberthreats.md#3-adjust-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). | -## 7. Set sharing settings for SharePoint and OneDrive files and folders +### Why and how to adjust sharing settings for files and folders in SharePoint and OneDrive Your default sharing levels for SharePoint and OneDrive might be set to a more permissive level than you should use. We recommend reviewing and if necessary, changing the default settings to better protect your business. Grant people only the access they need to do their jobs. See the following resources: - [Adjust sharing settings for SharePoint and OneDrive files and folders](m365bp-protect-against-malware-cyberthreats.md#3-adjust-sharing-settings-for-sharepoint-and-onedrive-files-and-folders) - [Sensitivity labels for Office files in SharePoint and OneDrive](/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files) +## 8. Use Microsoft 365 Apps on devices + | Subscription | Recommendations | |||-| [Microsoft 365 Business Premium](index.md) | Use SharePoint and OneDrive for storing and sharing files. <br/>[Set sharing settings for SharePoint and OneDrive](m365bp-protect-against-malware-cyberthreats.md#3-adjust-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). <br/>Use [Safe Links](/microsoft-365/security/office-365-security/safe-links-about) and [Safe Attachments](/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-about) with SharePoint and OneDrive. <br/>Use [sensitivity labels](/microsoft-365/compliance/get-started-with-sensitivity-labels) and [DLP](/microsoft-365/compliance/get-started-with-the-default-dlp-policy). | -| [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md) <br/> [Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | Use SharePoint and OneDrive.<br/>(*Defender for Office 365 can be added on*) | +| [Microsoft 365 Business Premium](index.md)<br/> [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md) | 1. [Install Microsoft 365 Apps on all devices](m365bp-users-install-m365-apps.md). <br/>2. Share the [Employee quick setup guide with users](https://support.microsoft.com/office/7f34c318-e772-46a5-8c0a-ab86661542d1). | +| [Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | Use Outlook and Web/mobile versions of Microsoft 365 Apps. | -## 8. Use Microsoft 365 Apps on devices +### Why users should use Microsoft 365 Apps Outlook and Microsoft 365 Apps (also referred to as Office apps) enable people to work productively and more securely across devices. Start a document on one device, and pick it up later on another device. Instead of sending files as email attachments, you can share links to documents that are stored in SharePoint or OneDrive. See the following articles: - [How Safe Links works in Microsoft 365 Apps](/microsoft-365/security/office-365-security/safe-links-about#how-safe-links-works-in-office-apps) - [Sensitivity bar in Microsoft 365 Apps](/microsoft-365/compliance/sensitivity-labels-office-apps#sensitivity-bar) +## 9. Manage calendar sharing for your business + | Subscription | Recommendations | |||-| [Microsoft 365 Business Premium](index.md)<br/> [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md) | [Install Microsoft 365 Apps on all devices](m365bp-users-install-m365-apps.md). <br/>Share the [Employee quick setup guide with users](https://support.microsoft.com/office/7f34c318-e772-46a5-8c0a-ab86661542d1). | -| [Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | Use Outlook and Web/mobile versions of Microsoft 365 Apps. | +| [Microsoft 365 Business Premium](index.md) | 1. Use Outlook and Exchange Online for email and calendars.<br/>2. [Get started using your default DLP policy](/microsoft-365/compliance/get-started-with-the-default-dlp-policy). | +| [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md)<br/>[Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | Use Outlook and Exchange Online for email and calendars. | -## 9. Manage calendar sharing for your business +### How to prevent calendar oversharing -You can help people in your organization share their calendars appropriately for better collaboration. You can manage what level of detail they can share, such as by limiting the details that are shared to free/busy times only. +You can help people in your organization share their calendars appropriately for better collaboration. You can manage what level of detail they can share, such as by limiting the details that are shared to free/busy times only, so that users don't accidentally overshare important information. Microsoft 365 Business Basic, Standard, and Premium include Outlook and Exchange Online. See the following articles: - [Manage calendar sharing](m365bp-protect-against-malware-cyberthreats.md#5-manage-calendar-sharing) - [Get started with the default DLP policy](/microsoft-365/compliance/get-started-with-the-default-dlp-policy) +## 10. Maintain your environment + | Subscription | Recommendations | |||-| [Microsoft 365 Business Premium](index.md) | Use Outlook and Exchange Online for email and calendars.<br/>[Get started using your default DLP policy](/microsoft-365/compliance/get-started-with-the-default-dlp-policy). | -| [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md)<br/>[Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | Use Outlook and Exchange Online for email and calendars. | +| [Microsoft 365 Business Premium](index.md) | 1. Use the [Microsoft 365 admin center](https://admin.microsoft.com) to view subscription information, updates, and other settings. <br/>2. Use the [Microsoft 365 admin center](https://admin.microsoft.com) or the [Microsoft Entra portal](https://entra.microsoft.com) for managing user accounts.<br/>3. Use the [Microsoft 365 Defender portal](https://security.microsoft.com) and the [Microsoft 365 Purview compliance portal](https://compliance.microsoft.com/) for viewing and managing security & compliance capabilities. If preferred, you can use the [Intune admin center](https://intune.microsoft.com) to view or manage devices. | +| [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md)<br/> [Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | Use the [Microsoft 365 admin center](https://admin.microsoft.com) to view subscription information, updates, and other settings. If preferred, you can use the [Microsoft Entra portal](https://entra.microsoft.com) to manage user accounts. | -## 10. Maintain your environment +### Why maintenance and operations matter After your initial setup and configuration of Microsoft 365 for business is complete, your organization needs a maintenance and operations plan. As employees come and go, you'll need to add or remove users, reset passwords, and maybe even reset devices to factory settings. You'll also want to make sure people have only the access they need to do their jobs. -Microsoft 365 Business Basic, Standard, and Premium include the [Microsoft 365 admin center](https://admin.microsoft.com) and the [Azure AD portal](https://entra.microsoft.com) for managing user accounts. +Microsoft 365 Business Basic, Standard, and Premium include the [Microsoft 365 admin center](https://admin.microsoft.com) and the [Microsoft Entra portal](https://entra.microsoft.com) for managing user accounts. Microsoft 365 Business Premium also includes advanced security and compliance capabilities. You can use the [Microsoft 365 Defender portal](https://security.microsoft.com) or the [Microsoft 365 Purview compliance portal](https://compliance.microsoft.com/) for viewing and managing security & compliance capabilities. See the following articles: - [Security incident management in Microsoft 365 Business Premium](m365bp-security-incident-management.md) - [Microsoft 365 Business Premium security operations guide](m365bp-security-operations-guide.md) -| Subscription | Recommendations | -||| -| [Microsoft 365 Business Premium](index.md) | Use the [Microsoft 365 admin center](https://admin.microsoft.com) or the [Azure AD portal](https://entra.microsoft.com) for managing user accounts.<br/>Use the [Microsoft 365 Defender portal](https://security.microsoft.com) and the [Microsoft 365 Purview compliance portal](https://compliance.microsoft.com/) for viewing and managing security & compliance capabilities. <br/>If preferred, you can use the [Intune admin center](https://intune.microsoft.com) to view or manage devices. | -| [Microsoft 365 Business Standard](../admin/setup/setup-business-standard.md)<br/> [Microsoft 365 Business Basic](../admin/setup/setup-business-basic.md) | Use the [Microsoft 365 admin center](https://admin.microsoft.com) or the [Azure AD portal](https://entra.microsoft.com) to view or manage user accounts. | - ## See also - For more information about what each plan includes, see [Reimagine productivity with Microsoft 365 and Microsoft Teams](https://www.microsoft.com/en-us/microsoft-365/business/compare-all-microsoft-365-business-products-b?ef_id=8c2a86ec9ea514a008c6e419e036519c:G:s&OCID=AIDcmmwf9kwzdj_SEM_8c2a86ec9ea514a008c6e419e036519c:G:s&lnkd=Bing_O365SMB_Brand&msclkid=8c2a86ec9ea514a008c6e419e036519c) and the [Microsoft 365 User Subscription Suites for Small and Medium-sized Businesses](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWR6bM). |
| commerce | Volume Licensing Invoices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/volume-licensing-invoices.md | This new invoice format is a phased implementation and will roll out to VL custo ## Before you begin -To access VL invoices in the Microsoft 365 admin center, you must satisfy all three of the following conditions: +To access VL invoices in the Microsoft 365 admin center, you must satisfy the following conditions: 1. You must be the **Bill To contact** for the corresponding contracts. 2. You must be a Volume Licensing Service Center (VLSC) user.-3. You must be a Global or Billing admin or have a non-admin Microsoft Azure Active Directory (Azure AD) role. ## View or download your bill |
| compliance | Dlp Configure Endpoint Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-configure-endpoint-settings.md | DLP can copy items that match policies on devices to an [Azure storage account]( - For more information on this feature, see [Learn about collecting files that match data loss prevention policies from devices](dlp-copy-matched-items-learn.md) - For more information on how to configure this feature, see [Get started with collecting files that match data loss prevention policies from devices](dlp-copy-matched-items-get-started.md) -### Network share coverage and exclusions +### Network share coverage and exclusions (preview) > [!IMPORTANT] > To use **Network share coverage and exclusions** devices must have these updates applied: |
| compliance | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md | Whether it be adding new solutions to the [Microsoft Purview compliance portal]( - [Endpoint DLP Aggregated most restrictive actions applied to endpoints](dlp-policy-reference.md#for-endpoints) - [Just in time protection for endpoints and network shares](endpoint-dlp-learn-about.md#just-in-time-protection-preview) - [Display of conditions matched when an item matches a policy](dlp-configure-view-alerts-policies.md#other-matched-conditions)- - [Endpoint DLP policies can be applied to network shares](dlp-configure-endpoint-settings.md#network-share-coverage-and-exclusions) + - [Endpoint DLP policies can be applied to network shares](dlp-configure-endpoint-settings.md#network-share-coverage-and-exclusions-preview) - Support for [endpoint DLP policies in Azure virtual desktop, Citrix Virtual Apps and Desktops 7, Amazon virtual workspaces and Hyper-v environments](endpoint-dlp-getting-started.md#endpoint-dlp-support-for-virtualized-environments-preview) - [Show policy tips as an oversharing popup](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup-preview) |
| enterprise | M365 Dr Workload Spo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/m365-dr-workload-spo.md | As part of the migration, the _Primary Provisioned Geography_ will change and al ## **Multi-Geo Capabilities in SharePoint Online / OneDrive for Business** -Multi-Geo capabilities in OneDrive and SharePoint Online enable control of shared resources like SharePoint team sites and Microsoft 365 Group mailboxes stored at rest in a specified _Macro Region Geography_ or _Local Region Geography_. +Multi-Geo capabilities in OneDrive and SharePoint Online enable control of shared resources like SharePoint team sites and Microsoft 365 group mailboxes stored at rest in a specified _Macro Region Geography_ or _Local Region Geography_. Each user, Group mailbox, and SharePoint site have a Preferred Data Location (PDL) which denotes the _Macro Region Geography_ or _Local Region Geography_ (location where related data is to be stored. Users' personal data (Exchange mailbox and OneDrive) along with any Microsoft 365 Groups or SharePoint sites that they create can be stored in the specified _Macro Region Geography_ or _Local Region Geographies_ location to meet data residency requirements. You can specify different administrators for each _Macro Region Geography_ or _Local Region Geographies_ location. Power Apps need to be recreated in the destination location. SharePoint uses Azure Blob Storage for its content, while the metadata associated with sites and its files is stored within SharePoint. After the site is moved from its source _Geography_ location to its destination _Geography_ location, the service will also move its associated Blob Storage. Blob Storage moves complete in approximately 40 days. This will not have any impact to users interaction with the data. -You can check the Blob Storage move status using the [Get-SPOCrossGeoMoveReport](/powershell/module/sharepoint-online/get-spocrossgeomovereport) cmdlet. **** ### **Enabling SharePoint Multi-Geo in your _Satellite Geography_ location** This article is for Global or SharePoint administrators who have created a Multi >[!NOTE] >If you have added a new _Geography_ location **after March 27th, 2019**, you do not need to perform these instructions, as your new _Geography_ location will already be enabled for OneDrive and SharePoint Multi-Geo. -These instructions will allow you to enable SharePoint in your _Satellite Geography_ location, so your Multi-Geo satellite users can take advantage of both OneDrive and SharePoint Multi-Geo capabilities in O365. +These instructions will allow you to enable SharePoint in your _Satellite Geography_ location, so your Multi-Geo satellite users can take advantage of both OneDrive and SharePoint Multi-Geo capabilities in Microsoft 365. >[!IMPORTANT] >Please note that this is a one way enablement. Once you set SPO mode, you will not be able to revert your _Tenant_ to OneDrive only Multi-Geo mode without an escalation with support. To set a _Geography_ location into SPO mode, connect to the _Geography_ location ## How can I determine customer data location? -You can find the actual data location in _Tenant_ Admin Center. As a _Tenant_ administrator you can find the actual data location, for committed data, by navigating to Admin->Settings->Org Settings->Organization Profile->Data Location. If you do not have a _Tenant_ created, you can have a _Tenant_ created when signing up for a M365 trial. +You can find the actual data location in _Tenant_ Admin Center. As a _Tenant_ administrator you can find the actual data location, for committed data, by navigating to Admin->Settings->Org Settings->Organization Profile->Data Location. If you do not have a _Tenant_ created, you can have a _Tenant_ created when signing up for a Microsoft 365 trial. |
| security | Attack Surface Reduction Rules Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference.md | Dependencies: Microsoft Defender Antivirus ### Block all Office applications from creating child processes -This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access. +This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access. This rule also blocks execution of untrusted files that may have been saved by Office macros that are allowed to run in Office files. Creating malicious child processes is a common malware strategy. Malware that abuses Office as a vector often runs VBA macros and exploit code to download and attempt to run more payloads. However, some legitimate line-of-business applications might also generate child processes for benign purposes; such as spawning a command prompt or using PowerShell to configure registry settings. |
| security | Configure Conditional Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-conditional-access.md | Take the following steps to enable Conditional Access: 6. Select **Enable policy**, and then **Create** to save your changes. > [!NOTE]-> You can use the Microsoft Defender for Endpoint app along with the Approved Client app and Compliant Device (Require device to be marked as compliant) controls in Azure AD Conditional Access policies. There's no exclusion required for the Microsoft Defender for Endpoint app while setting up Conditional Access. Although Microsoft Defender for Endpoint on Android & iOS (App ID - dd47d17a-3194-4d86-bfd5-c6ae6f5651e3) isn't an approved app, it is able to report device security posture in both these grant permissions. This permission enables the flow for compliance information to Conditional Access. +> You can use the Microsoft Defender for Endpoint app along with the Approved Client app and Compliant Device (Require device to be marked as compliant) controls in Azure AD Conditional Access policies. There's no exclusion required for the Microsoft Defender for Endpoint app while setting up Conditional Access. Although Microsoft Defender for Endpoint on Android & iOS (App ID - dd47d17a-3194-4d86-bfd5-c6ae6f5651e3) isn't an approved app, it is able to report device security posture in both these grant permissions. However, internally Defender requests **MSGraph/User.read** scope and **Intune Tunnel** scope (in case of Defender+Tunnel scenarios). So these scopes must be excluded*. To exclude MSGraph/User.read scope, any one cloud app can be excluded. To exclude Tunnel scope, you need to exclude ΓÇÿMicrosoft Tunnel GatewayΓÇÖ.These permission and exclusions enables the flow for compliance information to Conditional Access. ++*Please note that applying a Conditional Access policy to All Cloud Apps could inadvertently block user access in some cases, so itΓÇÖs not recommended. Read more about [Conditional Access policies on Cloud Apps](/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps#all-cloud-apps) For more information, see [Enforce compliance for Microsoft Defender for Endpoint with Conditional Access in Intune](/intune/advanced-threat-protection). |
| security | Data Collection Analyzer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/data-collection-analyzer.md | Run '**MDEClientAnalyzer.cmd /?**' to see the list of available parameters and t > [!NOTE]-> The following parameters also collect screenshots during the log capture: -> -> -l, -h, -c, -i, -a, -v, and -t +> You can use '-g' flag to validate URLs for a specific datacenter region even without being onboarded to that region<br> +> For example:<br> +> 'MDEClientAnalyzer.cmd -g EU' will force the analyzer to test cloud URLs in Europe region. **-h** - Calls into [Windows Performance Recorder](/windows-hardware/test/wpt/wpr-command-line-options) to collect a verbose general performance trace in addition to the standard log set. |
| security | Ios Configure Features | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-configure-features.md | Microsoft Defender for Endpoint on iOS along with Microsoft Intune and Azure Act For more information about how to set up Conditional Access with Defender for Endpoint on iOS, see [Defender for Endpoint and Intune](/mem/intune/protect/advanced-threat-protection). -### Jailbreak detection by Microsoft Defender for Endpoint --Microsoft Defender for Endpoint has the capability of detecting unmanaged and managed devices that are jailbroken. If a device is detected to be jailbroken, a **High**-risk alert will be reported to the Microsoft 365 Defender portal and if Conditional Access is set up based on device risk score, then the device will be blocked from accessing corporate data. - ## Web Protection and VPN By default, Defender for Endpoint on iOS includes and enables the web protection feature. [Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. Note that Anti-phishing and custom indicators (URL and Domain) are supported as part of Web Protection. IP based custom indicators are currently not supported on iOS. Web Content Filtering is currently not supported on mobile platforms (Android and iOS). While enabled by default, there might be some cases that require you to disable 2. Click or tap the "i" button for Microsoft Defender for Endpoint. -3. Toggle off **Connect On Demand** to disable VPN. +3. Toggle off **Connect On Demand** to disable VPN. :::image type="content" source="images/ios-vpn-config.png" alt-text="The toggle button for the VPN config Connect on demand option" lightbox="images/ios-vpn-config.png"::: Apple iOS does not support multiple device-wide VPNs to be active simultaneously ## Configure Microsoft Defender for Endpoint risk signal in app protection policy (MAM) -Microsoft Defender for Endpoint can be configured to send threat signals to be used in App Protection Policies (APP, also known as MAM) on iOS/iPadOS. With this capability, you can use Microsoft Defender for Endpoint to protect access to corporate data from unenrolled devices as well. --The steps to set up app protection policies with Microsoft Defender for Endpoint are below: --1. Set up the connection from your Microsoft Intune tenant to Microsoft Defender for Endpoint. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Tenant Administration** \> **Connectors and tokens** \> **Microsoft Defender for Endpoint** (under Cross platform) or **Endpoint Security** \> **Microsoft Defender for Endpoint** (under Setup) and turn on the toggles under **App Protection Policy Settings for iOS**. --2. Select **Save**. You should see **Connection status** is now set to **Enabled**. --3. Create app protection policy. After your Microsoft Defender for Endpoint connector setup is complete, navigate to **Apps** \> **App protection policies** (under Policy) to create a new policy or update an existing one. +Microsoft Defender for Endpoint on iOS enables the App Protection Policy scenario. End-users can install the latest version of the app directly from the Apple app store. Ensure the device is registered to Authenticator with the same account being used to onboard in Defender for successful MAM registration. -4. Select the platform, **Apps, Data protection, Access requirements** settings that your organization requires for your policy. --5. Under **Conditional launch** \> **Device conditions**, you will find the setting **Max allowed device threat level**. This will need to be configured to either Low, Medium, High, or Secured. The actions available to you will be **Block access** or **Wipe data**. You may see an informational dialog to make sure you have your connector set up prior to this setting take effect. If your connector is already set up, you may ignore this dialog. +Microsoft Defender for Endpoint can be configured to send threat signals to be used in App Protection Policies (APP, also known as MAM) on iOS/iPadOS. With this capability, you can use Microsoft Defender for Endpoint to protect access to corporate data from unenrolled devices as well. -6. Finish with assignments and save your policy. +Follow the steps in the link below to set up app protection policies with Microsoft Defender for Endpoint [Configure Defender risk signals in app protection policy (MAM)](ios-install-unmanaged.md) For more details on MAM or app protection policy, see [iOS app protection policy settings](/mem/intune/apps/app-protection-policy-settings-ios). -### Deploying Microsoft Defender for Endpoint for MAM or on unenrolled devices --Microsoft Defender for Endpoint on iOS enables the App Protection Policy scenario and is available in the Apple app store. End-users should install the latest version of the app directly from the Apple app store. - ## Privacy Controls Microsoft Defender for Endpoint on iOS enables Privacy Controls for both the Admins and the End Users. This includes the controls for enrolled (MDM) as well as unenrolled (MAM) devices. Microsoft Defender for Endpoint on iOS enables **Optional Permissions** in the o > [!NOTE] > **Optional Permission** is different from **Disable Web Protection**. Optional VPN Permission only helps to skip the permission during onboarding but its available for the end user to later review and enable it. While **Disable Web Protection** allows users to onboard the Defender for Endpoint app without the Web Protection. It cannot be enabled later. -## Configure compliance policy against jailbroken devices +## Jailbreak detection ++Microsoft Defender for Endpoint has the capability of detecting unmanaged and managed devices that are jailbroken. These jailbreak checks are done periodically. If a device is detected to be jailbroken, ++1. A **High**-risk alert will be reported to the Microsoft 365 Defender portal. If device Compliance and Conditional Access is set up based on device risk score, then the device will be blocked from accessing corporate data. +1. User data on app will be cleared. When user opens the app after jailbreaking the VPN profile also will be deleted and no web protection will be offered. ++### Configure compliance policy against jailbroken devices To protect corporate data from being accessed on jailbroken iOS devices, we recommend that you set up the following compliance policy on Intune. Defender for Endpoint on iOS enables admins to configure custom indicators on iO ## Configure vulnerability assessment of apps +Reducing cyber risk requires comprehensive risk-based vulnerability management to identify, assess, remediate, and track all your biggest vulnerabilities across your most critical assets, all in a single solution. Visit this [page](next-gen-threat-and-vuln-mgt.md) to learn more about Microsoft Defender Vulnerability Management in Microsoft Defender for Endpoint. + Defender for Endpoint on iOS supports vulnerability assessments of apps only for enrolled (MDM) devices. Admins can use the following steps to configure the vulnerability assessment of apps. ### On a Supervised Device Defender for Endpoint on iOS supports vulnerability assessments of apps only for :::image type="content" source="images/tvm-app-sync-toggle.png" alt-text="App sync toggleSup" lightbox="images/tvm-app-sync-toggle.png"::: > [!NOTE]-> To get the list of all the apps including unmanaged apps, the admin has to enable **Send full application inventory data on personally owned iOS/iPadOS devices** in the Intune Admin Portal for the supervised devices marked as "Personal". +> To get the list of all the apps including unmanaged apps, the admin has to enable **Send full application inventory data on personally owned iOS/iPadOS devices** in the Intune Admin Portal for the supervised devices marked as "Personal". > For the supervised devices marked as "Corporate" in the Intune Admin Portal, the admin need not enable **Send full application inventory data on personally owned iOS/iPadOS devices**. ### On an Unsupervised Device Defender for Endpoint on iOS supports vulnerability assessments of apps only for - Privacy approval screen will come only for unsupervised devices. - Only if end-user approves the privacy, the app information will be sent to the Defender for Endpoint console. - :::image type="content" source="images/tvm-user-privacy.png" alt-text="TVM Privacy" lightbox="images/tvm-user-privacy.png"::: + :::image type="content" source="images/tvm-user-privacy2.png" alt-text="Screenshot of the end user privacy screen." lightbox="images/tvm-user-privacy2.png"::: Once the client versions are deployed to target iOS devices, the processing will start. Vulnerabilities found on those devices will start showing up in the Defender Vulnerability Management dashboard. The processing might take few hours (max 24 hours) to complete. Especially for the entire list of apps to show up in the software inventory. +> [!NOTE] +> If you’re using SSL inspection solution within your iOS device, please allow list these domain names **securitycenter.windows.com** (in commercial environment) and **securitycenter.windows.us** (in GCC environment) for TVM feature to work. ++## Disable sign out ++Defender for Endpoint on iOS supports deployment without sign out button in the app to prevent users from signing out of the Defender app. This is important to prevent users from tampering the device. ++This configuration is available for both the enrolled (MDM) devices as well as unenrolled (MAM) devices. Admins can use the following steps to configure the Disable sign out ++### Configure Disable sign out ++**For enrolled devices(MDM)** ++1. In the Microsoft Intune admin center, navigate to Apps > App configuration policies > Add > Managed devices. +1. Give the policy a name, select Platform > iOS/iPadOS +1. Select Microsoft Defender for Endpoint as the target app. +1. In Settings page, select Use configuration designer and add **DisableSignOut** as the key and value type as **String**. +1. By default, DisableSignOut = false. +1. Admin needs to make **DisableSignOut = true** to disable the sign-out button in the app. Users will not see the sign out button once the policy is pushed. +1. Click Next and assign this policy to targeted devices/users. ++**For unenrolled devices(MAM)** ++1. In the Microsoft Intune admin center, navigate to Apps > App configuration policies > Add > Managed apps. +1. Give the policy a name. +1. Under the Select Public Apps, choose Microsoft Defender for Endpoint as the target app. +1. In Settings page, add **DisableSignOut** as the key and value as **true**, under the General Configuration Settings. +1. By default, DisableSignOut = false. +1. Admin needs to make **DisableSignOut = true** to disable the sign-out button in the app. Users will not see the sign out button once the policy is pushed. +1. Click Next and assign this policy to targeted devices/users. + ## Configure option to send in-app feedback Customers now have the option to configure the ability to send feedback data to Microsoft within the Defender for Endpoint app. Feedback data helps Microsoft improve products and troubleshoot issues. |
| security | Ios Install Unmanaged | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-install-unmanaged.md | End users also need to take steps to install Microsoft Defender for Endpoint on ### Pre-requisites -1. **Verify that the connector is enabled**. <br> On the [unified security console](https://security.microsoft.com), go to **Settings** > **Endpoints** > **Advanced Features** and ensure that **Microsoft Intune connection** is enabled. +1. **Verify that the Intune connector is enabled in Security portal**. <br> On the [unified security console](https://security.microsoft.com), go to **Settings** > **Endpoints** > **Advanced Features** and ensure that **Microsoft Intune connection** is enabled. :::image type="content" source="images/enable-intune-connection.png" alt-text="The Defender for Endpoint - Intune connector" lightbox="images/enable-intune-connection.png"::: - -2. **Verify that the connector is enabled on the Intune portal**. <br> In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Endpoint Security** > **Microsoft Defender for Endpoint** and ensure that the Connection status is enabled. +2. **Verify that the APP connector is enabled in Intune portal**. <br> In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Endpoint Security** > **Microsoft Defender for Endpoint** and ensure that the Connection status is enabled. :::image type="content" source="images/app-settings.png" alt-text="The application settings" lightbox="images/app-settings.png"::: ### Create an app protection policy- + Block access or wipe data of a managed app based on Microsoft Defender for Endpoint risk signals by creating an app protection policy. Microsoft Defender for Endpoint can be configured to send threat signals to be used in app protection policies (APP, also known as MAM). With this capability, you can use Microsoft Defender for Endpoint to protect managed apps. Because mobile app management doesn't require device management, you can protect :::image type="content" source="images/managed-app.png" alt-text="The Microsoft Outlook menu item on the left navigation pane" lightbox="images/managed-app.png"::: + Select the **Platform, Apps, Data protection, Access requirements** settings that your organization requires for your policy. - 3. Set sign-in security requirements for your protection policy. <br> -Select **Setting > Max allowed device threat level** in **Device Conditions** and enter a value. Then select **Action: "Block Access"**. Microsoft Defender for Endpoint on iOS shares this Device Threat Level. + 3.Set sign-in security requirements for your protection policy. <br> +Select **Setting > Max allowed device threat level** in **Conditional Launch > Device Conditions** and enter a value. This will need to be configured to either Low, Medium, High, or Secured. The actions available to you will be **Block access** or **Wipe data**. Select **Action: "Block Access"**. Microsoft Defender for Endpoint on iOS shares this Device Threat Level. - :::image type="content" source="images/conditional-launch.png" alt-text="The Device conditions pane" lightbox="images/conditional-launch.png"::: -4. Assign user groups for whom the policy needs to be applied.<br> +4.Assign user groups for whom the policy needs to be applied.<br> Select **Included groups**. Then add the relevant groups. - For more information on MAM or app protection policy, see [iOS app protection policy settings](/mem/intune/apps/app-protection-policy-settings-ios). ## Deploy Microsoft Defender for Endpoint for MAM or on unenrolled devices For more information on MAM or app protection policy, see [iOS app protection po Microsoft Defender for Endpoint on iOS enables the app protection policy scenario and is available in the Apple app store. When app protection policies are configured for apps to include device risk signals from Microsoft Defender for Endpoint, users will be redirected to install Microsoft Defender for Endpoint when using such apps. Alternately, users can also install the latest version of the app directly from the Apple app store.++Ensure the device is registered to Authenticator with the same account being used to onboard in Defender for successful MAM registration. |
| security | Ios Install | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-install.md | Admins can configure auto-setup of VPN profile. This will automatically set up t 2. Tap the Defender for Endpoint app icon (MSDefender) and follow the on-screen instructions to complete the onboarding steps. The details include end-user acceptance of iOS permissions required by Defender for Endpoint on iOS. +> [!NOTE] +> Skip this step if you configure zero touch (silent) onboarding. Manually launching application is not necessary if zero touch (silent) onboarding is configured. + 3. Upon successful onboarding, the device will start showing up on the Devices list in the Microsoft 365 Defender portal. :::image type="content" source="images/device-inventory-screen.png" alt-text="The Device inventory page." lightbox="images/device-inventory-screen.png"::: |
| security | Mac Whatsnew | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-whatsnew.md | Apple has fixed an issue on macOS [Ventura upgrade](<https://developer.apple.com Microsoft Defender for Endpoint no longer supports macOS Catalina (10.15) as Apple ended support for Catalina (10.15) in December 2022. </br> +### May-2023 (Build: 101.98.70 | Release version: 20.123022.19870.0) ++| Build: | **101.98.70** | +|--|--| +| Release version: | **20.123022.19870.0** | +| Engine version: | **1.1.20300.4** | +| Signature version: | **1.389.1396.0** | ++##### What's new ++- Bug and performance fixes + ### Mar-2023 (Build: 101.98.30 | Release version: 20.123012.19830.0) | Build: | **101.98.30** | |
| security | Mtd | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mtd.md | This helps reduce potential issues that could arise while rolling out the servic - Alerts appear in dashboard: Verify that alerts for above detection tests appear on the [security console](https://security.microsoft.com). +Need help in deploying or configuring Defender for Endpoint on Android & iOS? If you have at least 150 licenses for the product, use your [FastTrack benefits](/microsoft-365/fasttrack/introduction). Learn more about FastTrack at [Microsoft FastTrack](https://fasttrack.microsoft.com/). + ## Configure - [Configure Android features](android-configure.md) |
| security | User Roles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/user-roles.md | The following steps guide you on how to create roles in Microsoft 365 Defender. > [!NOTE] > This setting is only available in the Microsoft Defender for Endpoint administrator (default) role. -- **Manage security settings in Security Center** - Configure alert suppression settings, manage folder exclusions for automation, onboard and offboard devices, manage email notifications, and manage evaluation lab+- **Manage security settings in Security Center** - Configure alert suppression settings, manage folder exclusions for automation, onboard and offboard devices, manage email notifications, manage evaluation lab, and manage allowed/blocked lists for indicators - **Live response capabilities** - **Basic** commands: |
| security | Automatic Attack Disruption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/automatic-attack-disruption.md | The Microsoft 365 Defender incident page will reflect the automatic attack disru The Microsoft 365 Defender user experience now includes additional visual cues to ensure visibility of these automatic actions. You will find them across the following experiences: -In the incident queue: +1. In the incident queue: -- A tag titled *Attack Disruption* appears next to affected incidents+ - A tag titled *Attack Disruption* appears next to affected incidents -On the incident page: +2. On the incident page: -- A tag titled *Attack Disruption*-- A yellow banner at the top of the page that highlights the automatic action taken-- The current asset status is shown in the incident graph if an action is done on an asset, e.g., account disabled or device contained+ - A tag titled *Attack Disruption* + - A yellow banner at the top of the page that highlights the automatic action taken + - The current asset status is shown in the incident graph if an action is done on an asset, e.g., account disabled or device contained ++3. Via API: ++ An **(attack disruption)** string is added to the end of the titles of incidents with high confidence likely to be automatically disrupted. For example: ++ *BEC financial fraud attack launched from a compromised account (attack disruption)* For more information, see [view attack disruption details and results](autoad-results.md). |
| security | Incidents Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/incidents-overview.md | You can view the entity details directly from the graph and act on them with res The additional tabs for an incident are: +- Attack story ++ The full story of the attack, including all the alerts, assets, and remediation actions taken. + - Alerts All the alerts related to the incident and their information. |
| security | Portals | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/portals.md | While these portals are not specifically for managing security, they support var | Portal name | Description | Link | ||||+| Entra portal | Access and administer the [Microsoft Entra](/entra) family to protect your business with decentralized identity, identity protection, governance, and more, in a multi-cloud environment | [entra.microsoft.com](https://entra.microsoft.com/) | | Azure portal | View and manage all your [Azure resources](/azure/azure-resource-manager/management/overview) | [portal.azure.com](https://portal.azure.com/) | | Azure Active Directory portal | View and manage [Azure Active Directory](/azure/active-directory/fundamentals/active-directory-whatis) | [aad.portal.azure.com](https://aad.portal.azure.com/) | | Microsoft Purview compliance portal | Manage data handling policies and ensure [compliance with regulations](/compliance/regulatory/offering-home) | [compliance.microsoft.com](https://compliance.microsoft.com/) | |
| syntex | Syntex Azure Billing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-azure-billing.md | Title: Configure Microsoft Syntex for pay-as-you-go billing in Azure + Title: Configure Microsoft Syntex for pay-as-you-go billing Previously updated : 10/07/2022 Last updated : 05/15/2023 audience: admin ms.localizationpriority: medium description: Learn about how to set up pay-as-you-go Azure billing for Microsoft Syntex and how to monitor your usage. -# Configure Microsoft Syntex for pay-as-you-go billing in Azure +# Configure Microsoft Syntex for pay-as-you-go billing -Some Microsoft Syntex features are billed on a pay-as-you-go basis. These features use an Azure subscription for billing and track usage and cost with Azure meters. Read the [Microsoft Syntex pay-as-you-go terms of service](/legal/microsoft-365/microsoft-syntex-pay-as-you-go-terms) before you configure pay-as-you-go. +Some Microsoft Syntex features are billed on a pay-as-you-go basis. These features use an Azure subscription for billing and track usage and cost with a Syntex meter. Read the [Microsoft Syntex pay-as-you-go terms of service](/legal/microsoft-365/microsoft-syntex-pay-as-you-go-terms) before you configure pay-as-you-go. For a list of Microsoft Syntex features that use pay-as-you-go, see [Licensing for Microsoft Syntex](syntex-licensing.md) To configure Microsoft Syntex billing If you need to change or disconnect your Azure subscription, you can select **Manage billing** on the **Use content AI with Microsoft Syntex**. -If you have not previously configured Microsoft Syntex, read [Set up Microsoft Syntex](set-up-content-understanding.md) to learn how. - ## Monitor your Microsoft Syntex pay-as-you-go usage You can monitor your Microsoft Syntex pay-as-you-go usage in Azure Cost Management. You must have at least *read* access to the resource group that you specified for Microsoft Syntex. Note that usage information may take up to 24 hours to appear in Cost Management. |