| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Give Mailbox Permissions To Another User | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/give-mailbox-permissions-to-another-user.md | There are a few different ways you can access a mailbox once you've been given a ::: moniker-end +> [!NOTE] +> The **Send As** and **Send on Behalf** permissions do not work in Outlook Desktop client with the *HiddenFromAddressListsEnabled* parameter on the mailbox set to **True**, since they require the mailbox to be visible in Outlook via the Global Address List. ## Related content |
| admin | Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/overview.md | You can manage and secure mobile devices when they're connected to your Microsof ## What types of devices can you manage? -You can use Basic Mobility and Security to manage many types of mobile devices like Windows Phone, Android, iPhone, and iPad. To manage mobile devices used by people in your organization, each person must have an applicable Microsoft 365 license and their device must be enrolled in Basic Mobility and Security. +You can use Basic Mobility and Security to manage many types of mobile devices like Android, iPhone, and iPad. To manage mobile devices used by people in your organization, each person must have an applicable Microsoft 365 license and their device must be enrolled in Basic Mobility and Security. To see what Basic Mobility and Security supports for each type of device, see [Capabilities of Basic Mobility and Security](capabilities.md). Here's a summary of the steps: **Step 1:** Activate Basic Mobility and Security by following steps in the [Set up Basic Mobility and Security](set-up.md). -**Step 2:** Set up Basic Mobility and Security by, for example, creating an APNs certificate to manage iOS devices and adding a Domain Name System (DNS) record for your domain to support Windows phones. +**Step 2:** Set up Basic Mobility and Security by, for example, creating an APNs certificate to manage iOS devices and adding a Domain Name System (DNS) record for your domain. **Step 3:** Create device policies and apply them to groups of users. When you do this, your users get an enrollment message on their device, and when they've completed enrollment, their devices are restricted by the policies you've set up for them. For more info, see [Enroll your mobile device using Basic Mobility and Security](enroll-your-mobile-device.md). If you just need mobile app management (MAM), perhaps for people updating work p [Set up Basic Mobility and Security](set-up.md) (article)\ [Enroll your mobile device using Basic Mobility and Security](enroll-your-mobile-device.md) (article)\ [Manage devices enrolled in Mobile Device Management for Microsoft 365](manage-enrolled-devices.md) (article)\-[Get details about devices managed by Basic Mobility and Security](get-details-about-managed-devices.md) (article) +[Get details about devices managed by Basic Mobility and Security](get-details-about-managed-devices.md) (article) |
| admin | Get Help Support | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/get-help-support.md | Save time by starting your service request online. We'll help you find a solutio ## Phone support -Billing support is provided in English from 9 AM-5 PM (9 AM-6 PM in Australia), Monday-Friday.\ -Technical support is provided in English 24 hours a day, 7 days a week.\ +Use the drop-down menu below to find the number for your country or region. +++Billing support and Technical support hours (and languages) are listed on each country's page selected from the drop-down. + Admins, have your account details ready when you call. > [!NOTE] Admins, have your account details ready when you call. - **In the United Kingdom, call 0800 032 6417.** -If your support phone number isn't listed above, use the drop-down menu below to find the number for your country or region. -- ## Small business support with Business Assist Get the most out of your subscription with expert advice from small business specialists. |
| admin | Centralized Deployment Of Add Ins | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/centralized-deployment-of-add-ins.md | When the tool finishes running, it produces an output file in comma-separated (. - Office Activated - If they have activated Office - Supported Mailbox - If they are on an OAuth-enabled mailbox +Should your Microsoft 365 reports show anonymous user names instead of actual user names, fix this issue by changing the reports setting in Microsoft 365 admin center. For detailed steps, see [Microsoft 365 reports show anonymous user names instead of actual user names](/office365/troubleshoot/miscellaneous/reports-show-anonymous-user-name). + > [!NOTE] > Multifactor authentication is not supported when using the Central Deployment PowerShell module. The module only works with Basic authentication. |
| admin | Remove Licenses From Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/remove-licenses-from-users.md | When you use the **Active users** page to unassign licenses, you unassign produc ## What happens to a user's data when you remove their license? -- When a license is removed from a user, Exchange online data that is associated with that account is held for 30 days. After the 30-day grace period, the data is deleted and can't be recovered.+- When a license is removed from a user, Exchange Online data that is associated with that account is held for 30 days. After the 30-day grace period, the data is deleted and can't be recovered. However, it is linked to the retention policy, and the content that matches retention labels is retained for discovery. - Files saved in OneDrive for Business aren't deleted unless the user is deleted from the Microsoft 365 admin center or is removed through Active Directory synchronization. For more information, see [OneDrive retention and deletion](/onedrive/retention-and-deletion). - When the license is removed, the user's mailbox is no longer searchable by using an eDiscovery tool such as Content Search or eDiscovery (Premium). For more information, see "Searching disconnected or de-licensed mailboxes" in [Content Search in Microsoft 365](../../compliance/content-search.md). - If you have an Enterprise subscription, like Office 365 Enterprise E3, Exchange Online lets you preserve the mailbox data of a deleted user account by using [inactive mailboxes](../../compliance/inactive-mailboxes-in-office-365.md). For more information, see [Create and manage inactive mailboxes in Exchange Online](../../compliance/create-and-manage-inactive-mailboxes.md). |
| admin | Share Calendars With External Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/share-calendars-with-external-users.md | You can enable calendar sharing for all users in your organization in the Micros ## Enable calendar sharing using the Microsoft 365 admin center -1. In the admin center, go to **Settings** \> **Org settings**, and on the <a href="https://go.microsoft.com/fwlink/p/?linkid=2053743" target="_blank">**Services** tab</a>, select **Calendar**. +1. Sign in as a **Global Administator** to the admin center, go to **Settings** \> **Org settings**, and on the <a href="https://go.microsoft.com/fwlink/p/?linkid=2053743" target="_blank">**Services** tab</a>, select **Calendar**. 3. On the **Calendar** page, choose whether you want to let users share their calendars with people outside of your organization who have Microsoft 365 or Exchange. Choose whether you want to allow anonymous users (users without credentials) to access calendars via an email invitation. Instant syncing for sharing outside your tenant isn't supported currently. While ## Invite people to access calendars -Once sharing is enabled, calendar owners can extend invitations to specific users. For instructions, see [Sharing your calendar in Outlook Web App](https://support.microsoft.com/office/7ecef8ae-139c-40d9-bae2-a23977ee58d5). +Once sharing is enabled, calendar owners can extend invitations to specific users. ++1. Open [Outlook on the Web](https://outlook.office365.com). ++2. At the top of the page, select the app launcher and select **Calendar**. By default, your primary calendar is called "Calendar". If you created other calendars, you can select one of them to share instead. You cannot share calendars owned by other people. ++3. Enter the name or email address of the person with whom you want to share your calendar in the **Send a sharing invitation in email** box. ++4. Choose how much information you want this person to see: ++ - **Can view when I'm busy** lets the person see when you are busy but does not include details such as the event location. ++ - **Can view titles and locations** lets the person see when you are busy as well as the title and location of events. ++ - **Can view all details** lets the person see all the details of your events. ++ - **Can edit** lets the person see all details of your events and edit your calendar (only available when sharing with people in your organization). ++5. Select **Share**. ## Related content |
| admin | Test And Deploy Microsoft 365 Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/test-and-deploy-microsoft-365-apps.md | You can manage testing and deployment of purchased and licensed Microsoft 365 Ap You can find, test, and fully deploy published apps that don't already appear in the list on the Integrated apps page. By purchasing and licensing the apps from the admin center, you can add Microsoft and Microsoft partner apps to your list from a single location. -1. In the admin center, in the left nav, choose **Settings**, and then choose <a href="https://go.microsoft.com/fwlink/p/?linkid=2125823" target="_blank">**Integrated apps**</a>. +1. In the admin center, in the left nav, choose **Settings**, and then choose <a href="https://admin.microsoft.com/adminportal/home?#/Settings/IntegratedApps" target="_blank">**Integrated apps**</a>. 2. Select **Get apps** to get a view of the apps. |
| admin | Password Policy Recommendations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/password-policy-recommendations.md | Good password practices fall into a few broad categories: The primary goal of a more secure password system is password diversity. You want your password policy to contain lots of different and hard to guess passwords. Here are a few recommendations for keeping your organization as secure as possible. -- Maintain an 8-character minimum length requirement+- Maintain a 14-character minimum length requirement - Don't require character composition requirements. For example, \*&(^%$ |
| admin | Multi Factor Authentication Microsoft 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/security-and-compliance/multi-factor-authentication-microsoft-365.md | In the Azure portal, you can: - Enable and disable security defaults - Configure Conditional Access policies -In the Microsoft 365 admin center, you can configure per-user and service <a href="https://go.microsoft.com/fwlink/p/?linkid=2169174" target="_blank">MFA settings</a>. +In the Microsoft 365 admin center, you can configure per-user and service <a href="https://go.microsoft.com/fwlink/?LinkId=279980" target="_blank">MFA settings</a>. ## Next steps In the Microsoft 365 admin center, you can configure per-user and service <a hre ## Related content [Turn on multifactor authentication](set-up-multi-factor-authentication.md) (video)\-[Turn on multifactor authentication for your phone](https://support.microsoft.com/office/ace1d096-61e5-449b-a875-58eb3d74de14) (video) +[Turn on multifactor authentication for your phone](https://support.microsoft.com/office/ace1d096-61e5-449b-a875-58eb3d74de14) (video) |
| bookings | Bookings In Outlook | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/bookings/bookings-in-outlook.md | Use the **Get-OrganizationConfig** and **Set-OrganizationConfig** commands to fi ```PowerShell Set-OrganizationConfig -EwsApplicationAccessPolicy EnforceBlockList -EwsBlockList @{Add="MicrosoftOWSPersonalBookings"} ```+ + > [!NOTE] + > The EwsApplicationAccessPolicy parameter defines which applications other than Entourage, Outlook, and Outlook for Mac can access EWS. ### Turn Bookings in Outlook off or on for individual users Use the **Get-CASMailbox** and **Set-CASMailbox** commands to check user status and turn Bookings in Outlook on or off for individual users in your organization. -1. Check individualΓÇÖs EwsApplicationAccessPolicy by running the following command: +1. Check the individualΓÇÖs EWS control access by running the following command: ```PowerShell Get-CASMailbox -Identity adam@contoso.com | Format-List EwsEnabled |
| commerce | Add Storage Space | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/add-storage-space.md | Office 365 Extra File Storage is available for the following subscriptions: - Microsoft 365 E3 - Microsoft 365 E5 - Microsoft 365 F1+- Microsoft 365 F3 > [!NOTE] > Office 365 Extra File Storage is also available for GCC, GCC High, and DOD plans. |
| commerce | Manage License Requests | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/manage-license-requests.md | When you return to the **Requests** list, you see the message **YouΓÇÖre using y [Assign licenses to users](../../admin/manage/assign-licenses-to-users.md) (article)\ [Move users to a different subscription](../subscriptions/move-users-different-subscription.md) (article)\-[Buy or remove subscription licenses](buy-licenses.md) (article) +[Buy or remove subscription licenses](buy-licenses.md) (article)\ +[Self-service purchase FAQ](../subscriptions/self-service-purchase-faq.yml) |
| commerce | Subscriptions And Licenses | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/licenses/subscriptions-and-licenses.md | Last updated 05/12/2022 # Understand subscriptions and licenses in Microsoft 365 for business -When you buy a subscription to Microsoft 365 for business, you sign up for a set of apps and services that you pay for on either a monthly or an annual basis. The applications and services that you receive as part of your subscription depend on which product you purchased, such as Microsoft 365 Apps for business or Microsoft 365 Business Standard. You can see what comes with each product on the [Microsoft 365 for small and medium-sized businesses](https://products.office.com/compare-all-microsoft-office-products?&activetab=tab:primaryr1) page. +When you buy a subscription to Microsoft 365 for business, you sign up for a set of apps and services that you pay for on either a monthly or an annual basis. The applications and services that you receive as part of your subscription depend on which product you purchased, such as Microsoft 365 Apps for business or Microsoft 365 Business Standard. You can see what comes with each product on the [Microsoft 365 for small and medium-sized businesses](https://www.microsoft.com/microsoft-365/business/compare-all-microsoft-365-business-products) page. When you buy a subscription, you specify the number of licenses that you need, based on how many people you have in your organization. After you buy a subscription, you create accounts for people in your organization, and then assign a license to each person. As your organizational needs change, you can buy more licenses to accommodate new people, or reassign licenses to other users when someone leaves your organization. The following table lists what automatically happens when you assign a license t |If the subscription has this service|This automatically happens| |:--|:--|-|Exchange Online|A mailbox is created for that person. <br/> To learn about the SLA for this task to be completed, see ["Setting up..." messages in the Microsoft 365 admin center](https://support.microsoft.com/help/2635238/setting-up-messages-in-the-office-365-admin-center). | -|SharePoint Online|Edit permissions to the default SharePoint Online team site are assigned to that person.| -|Skype for Business Online|The person has access to the features associated with the license.| -|Microsoft 365 Apps for enterprise and Microsoft 365 Apps for business|The person can download Office apps on up to five Macs or PCs, five tablets, and five smartphones.| +|Exchange Online <br/> |A mailbox is created for that person. <br/> To learn about the SLA for this task to be completed, see ["Setting up..." messages in the Microsoft 365 admin center](https://support.microsoft.com/help/2635238/setting-up-messages-in-the-office-365-admin-center). | +|SharePoint Online <br/> |Edit permissions to the default SharePoint Online team site are assigned to that person. <br/> | +|Microsoft Teams <br/> |The person has access to the features associated with the license. <br/> | +|Microsoft 365 Apps for enterprise and Microsoft 365 Apps for business <br/> |The person can download Office apps on up to five Macs or PCs, five tablets, and five smartphones. <br/> | ## Understand licenses for non-user mailboxes |
| commerce | Allowselfservicepurchase Powershell | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/allowselfservicepurchase-powershell.md | search.appverid: - MET150 description: "Learn how to use the AllowSelfServicePurchase PowerShell cmdlet to turn self-service purchase on or off." Previously updated : 12/15/2021 Last updated : 4/7/2022 # Use AllowSelfServicePurchase for the MSCommerce PowerShell module The following table lists the available products and their **ProductId**. | Product | ProductId | |--|--|-| Power Apps per user | CFQ7TTC0KP0P | +| Power Apps per user | CFQ7TTC0LH2H | | Power Automate per user | CFQ7TTC0KP0N | | Power Automate RPA | CFQ7TTC0KXG6 | | Power BI Premium (standalone) | CFQ7TTC0KXG7 | Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId CFQ ## Example script to disable AllowSelfServicePurchase -The following example walks you through how to import the **MSCommerce** module, sign in with your account, get the **ProductId** for Power Automate, and then disable **AllowSelfServicePurchase** for that product. +The following example walks you through how to import the **MSCommerce** module, sign in with your account, get the **ProductId** for Power Automate per user, and then disable **AllowSelfServicePurchase** for that product. ```powershell Import-Module -Name MSCommerce Connect-MSCommerce #sign-in with your global or billing administrator account when prompted-$product = Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | where {$_.ProductName -match 'Power Automate'} +$product = Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | where {$_.ProductName -match 'Power Automate per user'} Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $product.ProductID -Enabled $false ``` |
| commerce | Move Users Different Subscription | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/move-users-different-subscription.md | Last updated 05/12/2022 # Move users to a different subscription -If you have more than one subscription, have users with a license for one subscription, but want to move them to another subscription, you can replace their existing license with a different one. +If you have more than one product, have users with a license for one product, but want to move them to another product, you can replace their existing license with a different one. ## Before you begin You must be a Global, License, or User admin to assign licenses. For more inform ::: moniker-end -2. Select the circles next to the names of the users that you want to replace existing licenses for. +2. Select the checkboxes next to the names of the users that you want to replace existing licenses for. 3. At the top, select **Manage product licenses**. |
| commerce | Upgrade To Different Plan | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/upgrade-to-different-plan.md | When you use the **Upgrade** tab, you're led through the process of buying a new 1. In the Admin center, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page. 2. Select the subscription that you want to upgrade.-3. On the subscription details page, select **Upgrade**. +3. On the subscription details page, under **Product details and upgrades**, select **View upgrades recommended for your org**. 4. Find the plan to which you want to upgrade, then select the **Upgrade** button. 5. Enter the number of licenses that you need, choose whether to pay each month or for the whole year, then select **Go to checkout**. > [!NOTE] |
| compliance | Customer Key Set Up | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/customer-key-set-up.md | To submit an offer to activate Customer Key, complete these steps: 2. Once you're logged in, select the appropriate domain. -3. For the selected domain, choose **Request services** from the top navigation bar, and review the list of available offers. +3. For the selected domain, choose **Deploy** from the top navigation bar, and review the list of available offers. 4. Choose the information card for the offer that applies to you: |
| compliance | Dlp Policy Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-policy-reference.md | For example, content like an Excel workbook on a OneDrive for Business site that  -> [!NOTE] -> Notification emails are sent unprotected. +> [!IMPORTANT] +> - Notification emails are sent unprotected. +> - Email notifications are only supported for the Microsoft 365 services. You can also give people the option to [override the policy](#user-overrides), so that they're not blocked if they have a valid business need or if the policy is detecting a false positive. |
| compliance | Encryption Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/encryption-sensitivity-labels.md | Encrypting your most sensitive documents and emails helps to ensure that only au - When authorized users open encrypted documents in their Office apps, they see the label name and description in a yellow message bar at the top of their app. When the encryption permissions extend to people outside your organization, carefully review the label names and descriptions that will be visible in this message bar when the document is opened. - For multiple users to edit an encrypted file at the same time, they must all be using Office for the web or you've [enabled co-authoring for files encrypted with sensitivity labels](sensitivity-labels-coauthoring.md) and all users have [Office apps that support this feature](sensitivity-labels-coauthoring.md#prerequisites). If this isn't the case, and the file is already open:-+ - In Office apps (Windows, Mac, Android, and iOS), users see a **File In Use** message with the name of the person who has checked out the file. They can then view a read-only copy or save and edit a copy of the file, and receive notification when the file is available. - In Office for the web, users see an error message that they can't edit the document with other people. They can then select **Open in Reading View**. -- The [AutoSave](https://support.office.com/article/what-is-autosave-6d6bd723-ebfd-4e40-b5f6-ae6e8088f7a5) functionality in Office apps for iOS and Android is disabled for encrypted files. This functionality is also disabled for encrypted files on Windows and Mac if you haven't [enabled co-authoring for files encrypted with sensitivity labels](sensitivity-labels-coauthoring.md). Users see a message that the file has restricted permissions that must be removed before AutoSave can be turned on.+- The [AutoSave](https://support.office.com/article/what-is-autosave-6d6bd723-ebfd-4e40-b5f6-ae6e8088f7a5) functionality in Office apps is disabled for encrypted files if you haven't [enabled co-authoring for files encrypted with sensitivity labels](sensitivity-labels-coauthoring.md). Users see a message that the file has restricted permissions that must be removed before AutoSave can be turned on. ++- Office for Windows supports labels that apply encryption when users aren't connected to the internet. But for the other platforms (macOS, iOS, Android), users must be online to apply these labels in Office apps. The Azure Information Protection unified labeling client must also be online to apply these labels in File Explorer and PowerShell. Users don't have to be online to open encrypted content. For more information about offline access, see the [Rights Management use license for offline access ](#rights-management-use-license-for-offline-access) section. - Encrypted files might take longer to open in Office apps (Windows, Mac, Android, and iOS). |
| compliance | How Smtp Dane Works | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/how-smtp-dane-works.md | description: "Learn how SMTP DNS-based Authentication of Named Entities (DANE) w [!include[Purview banner](../includes/purview-rebrand-banner.md)] -The SMTP protocol is the main protocol used to transfer messages between mail servers and is, by default, not secure. The Transport Layer Security (TLS) protocol was introduced years ago to support encrypted transmission of messages over SMTP. ItΓÇÖs commonly used opportunistically rather than as a requirement, leaving much email traffic in clear text, vulnerable to interception by nefarious actors. Furthermore, SMTP determines the IP addresses of destination servers through the public DNS infrastructure, which is susceptible to spoofing and Man-in-the-Middle (MITM) attacks. This has led to many new standards being created to increase security for sending and receiving email, one of those is DNS-based Authentication of Named Entities (DANE). - -DANE for SMTP [RFC 7672](https://tools.ietf.org/html/rfc7672) uses the presence of a Transport Layer Security Authentication (TLSA) record in a domain's DNS record set to signal a domain and its mail server(s) support DANE. If there is no TLSA record present, DNS resolution for mail flow will work as usual without any DANE checks being attempted. The TLSA record securely signals TLS support and publishes the DANE policy for the domain. So, sending mail servers can successfully authenticate legitimate receiving mail servers using SMTP DANE. This makes it resistant to downgrade and MITM attacks. DANE has direct dependencies on DNSSEC, which works by digitally signing records for DNS lookups using public key cryptography. DNSSEC checks occur on recursive DNS resolvers, the DNS servers that make DNS queries for clients. DNSSEC ensures that DNS records arenΓÇÖt tampered with and are authentic. +The SMTP protocol is the main protocol used to transfer messages between mail servers and is, by default, not secure. The Transport Layer Security (TLS) protocol was introduced years ago to support encrypted transmission of messages over SMTP. ItΓÇÖs commonly used opportunistically rather than as a requirement, leaving much email traffic in clear text, vulnerable to interception by nefarious actors. Furthermore, SMTP determines the IP addresses of destination servers through the public DNS infrastructure, which is susceptible to spoofing and Man-in-the-Middle (MITM) attacks. This has led to many new standards being created to increase security for sending and receiving email, one of those is DNS-based Authentication of Named Entities (DANE). DANE for SMTP [RFC 7672](https://tools.ietf.org/html/rfc7672) uses the presence of a Transport Layer Security Authentication (TLSA) record in a domain's DNS record set to signal a domain and its mail server(s) support DANE. If there is no TLSA record present, DNS resolution for mail flow will work as usual without any DANE checks being attempted. The TLSA record securely signals TLS support and publishes the DANE policy for the domain. So, sending mail servers can successfully authenticate legitimate receiving mail servers using SMTP DANE. This makes it resistant to downgrade and MITM attacks. DANE has direct dependencies on DNSSEC, which works by digitally signing records for DNS lookups using public key cryptography. DNSSEC checks occur on recursive DNS resolvers, the DNS servers that make DNS queries for clients. DNSSEC ensures that DNS records aren't tampered with and are authentic. |
| compliance | Prepare Tls 1.2 In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/prepare-tls-1.2-in-office-365.md | The [Microsoft TLS 1.0 implementation](https://support.microsoft.com/help/311733 For information about how to remove TLS 1.0 and 1.1 dependencies, see the following white paper: [Solving the TLS 1.0 problem](https://www.microsoft.com/download/details.aspx?id=55266). -After you upgrade to TLS 1.2, make sure that the cipher suites you're using are supported by Azure Front Door. Microsoft 365 and Azure Front Door have slight differences in cipher suite support. For details, see [What are the current cipher suites supported by Azure Front Door?](/azure/frontdoor/front-door-faq#what-are-the-current-cipher-suites-supported-by-azure-front-door-). +After you upgrade to TLS 1.2, make sure that the cipher suites you're using are supported by Azure Front Door. Microsoft 365 and Azure Front Door have slight differences in cipher suite support. For details, see [What are the current cipher suites supported by Azure Front Door?](/azure/frontdoor/concept-end-to-end-tls#supported-cipher-suites). ## More information |
| compliance | Sensitivity Labels Aip | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-aip.md | Some features are only supported by built-in labeling for Office apps, and won't - Access to intelligent classification services that include [trainable classifiers](classifier-learn-about.md), [exact data match (EDM)](sit-learn-about-exact-data-match-based-sits.md), and [named entities](named-entities-learn.md) - Detection of sensitive information as users type - In Word, users can review and remove the identified sensitive content+- [PDF support](sensitivity-labels-office-apps.md#pdf-support) - For labels that let users assign permissions, different permissions (Read or Change) can be granted to users or groups - Encrypt-Only for emails - Visibility of labels on the status bar |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | The numbers listed are the minimum Office application versions required for each |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Support co-authoring and AutoSave](sensitivity-labels-coauthoring.md) for labeled and encrypted documents | Current Channel: 2107+ <br /><br> Monthly Enterprise Channel: 2107+ <br /><br> Semi-Annual Enterprise Channel: 2202+ | 16.51+ | Preview: 2.58+ when you [opt-in](sensitivity-labels-coauthoring.md#opt-in-to-the-preview-of-co-authoring-for-ios-and-android) | Preview: 16.0.14931+ when you [opt-in](sensitivity-labels-coauthoring.md#opt-in-to-the-preview-of-co-authoring-for-ios-and-android) | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |+|[PDF support](#pdf-support)| Preview: Rolling out to [Beta Channel](https://office.com/insider) | Under review | Under review | Under review | Under review | ### Sensitivity label capabilities in Outlook The numbers listed are the minimum Office application versions required for each |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ <sup>\*</sup> | Under review | Under review | Yes | |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | Yes | |[Different settings for default label and mandatory labeling](#outlook-specific-options-for-default-label-and-mandatory-labeling) | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes |+|[PDF support](#pdf-support) | Under review| Under review | Under review | Under review | Under review | | **Footnotes:** Additional information for built-in labeling: - When mandatory labeling is in effect, users can't remove sensitivity labels from documents, but can change an existing label. +- When mandatory labeling is in effect, the print to PDF option will be unavailable when a document is labeled or encrypted. For more information, see the [PDF support](#pdf-support) section on this page. + For guidance about when to use this setting, see the information about [policy settings](sensitivity-labels.md#what-label-policies-can-do). > [!NOTE] When the Outlook app doesn't support turning off mandatory labeling: If you sele > > Your chosen values for these PowerShell settings are reflected in the label policy configuration in the Microsoft Purview compliance portal, and they automatically work for Outlook apps that support these settings. The other PowerShell advanced settings remain supported for the Azure Information Protection unified labeling client only. +## PDF support ++For built-in labeling, use the tables in the [capabilities](#support-for-sensitivity-label-capabilities-in-apps) section on this page to identify minimum versions supported. The Azure Information Protection unified labeling client doesn't support PDF in Office apps. ++Word, Excel, and PowerPoint support the following methods to convert an Office document into a PDF document: ++- File > Save As > PDF +- File > Export > PDF +- Share > Send a Copy > PDF ++When the PDF is created, it inherits the label with any content markings and encryption. Encrypted PDFs can be opened with Microsoft Edge on Windows or Mac. For more information, and alternative readers, see [Which PDF readers are supported for protected PDFs?](/azure/information-protection/rms-client/protected-pdf-readers#viewing-protected-pdfs-in-microsoft-edge-on-windows-or-mac) +++PDF scenarios not supported: ++- Print to PDF + + If users select this option, they are warned that the document will lose the protection of the label, and encryption (if applied), and must confirm to continue. If your sensitivity label policy requires justification to remove a label or lower its classification, they see this prompt. + + Because this option removes the sensitivity label, this option won't be available to users if you're using mandatory labeling. This configuration refers to the sensitivity label policy setting that requires users to apply a label to their emails and documents. ++- PDF/A format and encryption + + This PDF format designed for long-term archiving isn't supported when the label applies encrytion and will prevent users from converting Office documents to PDF. + +- Password protection and encryption + + The option **File** > **Info** > **Protect Document** > **Encrypt with Password** isn't supported when the document's label applies encryption. In this scenario, the encrypt with password option becomes unavailable for users. ++For more information about this capability, see the announcement [Apply sensitivity labels to PDFs created with Office apps](https://insider.office.com/blog/apply-sensitivity-labels-to-pdfs-created-with-office-apps). ++ ## Auditing labeling activities For information about the auditing events that are generated by sensitivity label activities, see the [Sensitivity label activities](search-the-audit-log-in-security-and-compliance.md#sensitivity-label-activities) section from [Search the audit log in the Microsoft Purview compliance portal](search-the-audit-log-in-security-and-compliance.md). |
| compliance | Set Up Irm In Sp Admin Center | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/set-up-irm-in-sp-admin-center.md | When site owners enable IRM for a list or library, they can protect any supporte When people download files in an IRM-enabled list or library, the files are encrypted so that only authorized people can view them. Each rights-managed file also contains an issuance license that imposes restrictions on the people who view the file. Typical restrictions include making a file read-only, disabling the copying of text, preventing people from saving a local copy, and preventing people from printing the file. Client programs that can read IRM-supported file types use the issuance license within the rights-managed file to enforce these restrictions. This is how a rights-managed file retains its protection even after it is downloaded. To enable IRM on a list or library, see [Apply Information Rights Management to a list or library](apply-irm-to-a-list-or-library.md). -You cannot create or edit documents in an IRM-enabled library using Office in a browser. Instead, one person at a time can download and edit IRM-encrypted files. Use check-in and check-out to manage *co-authoring* , or authoring across multiple users. +You cannot create or edit documents in an IRM-enabled library using Office in a browser. Instead, one person at a time can download and edit IRM-encrypted files. Use check-in and check-out to manage *co-authoring*, or authoring across multiple users. -When you download a PDF file from an IRM-protected library, Microsoft 365 creates a protected PDF file. The file's extension won't change, but the file is protected. To view this file you'll need the Azure Information Protection viewer, the full Azure Information Protection client, or another application that supports viewing protected PDF files. +When you download a PDF file from an IRM-protected library, Microsoft 365 creates a protected PDF file. The file's extension won't change, but the file is protected. To view this file you'll need the Azure Information Protection viewer, the full Azure Information Protection client, or another application that supports viewing protected PDF files. For more information, see [PDF readers supported for protected PDFs](protected-pdf-readers.md) SharePoint Online supports encryption of the following file types: |
| compliance | Set Up New Message Encryption Capabilities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/set-up-new-message-encryption-capabilities.md | You can verify that your Microsoft 365 tenant is properly configured to use Micr - The default template names may be different from those displayed above. See [Configuring and managing templates for Azure Information Protection](/azure/information-protection/configure-policy-templates) for more. -4. Run the Remove-PSSession cmdlet to disconnect from the Rights Management service. +4. If the test fails with an error message **Failed to acquire RMS templates**, execute the following commands and run the Test-IRMConfiguration cmdlet to verify that it passes. ++ ```powershell + $RMSConfig = Get-AadrmConfiguration + $LicenseUri = $RMSConfig.LicensingIntranetDistributionPointUrl + Set-IRMConfiguration -LicensingLocation $LicenseUri + Set-IRMConfiguration -InternalLicensingEnabled $true + ``` +5. Run the Remove-PSSession cmdlet to disconnect from the Rights Management service. ```powershell Remove-PSSession $session |
| enterprise | Setup Guides For Microsoft 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/setup-guides-for-microsoft-365.md | For organizations using Configuration Manager, you can use the [Deploy and updat ### Intune Configuration Manager co-management setup guide Use the [Intune Configuration Manager co-management setup guide](https://aka.ms/comanagementsetup) to set up existing Configuration Manager client devices and new internet-based devices that your org wants to co-manage with both Microsoft Intune and Configuration Manager. Co-management allows you to manage Windows 10 devices and adds new functionality to your org's devices, while receiving the benefits of both solutions.++#### School Data Sync rollover setup guide ++The [SDS Rollover setup guide](https://aka.ms/sdsrolloversetupguide) provides the steps to help your organization sync student information data to Azure Active Directory and Office 365. This guide streamlines the term lifecycle management process by creating Office 365 Groups for Exchange Online and SharePoint Online, class teams for Microsoft Teams and OneNote, as well as Intune for Education, and rostering and single sign-on integration for third-party apps. YouΓÇÖll perform end-of-year closeout, tenant clean up and archive, new school year preparation, and new school year launch. Then you can create new profiles using the sync deployment method that suits your organization. |
| security | Attack Surface Reduction Rules Deployment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment.md | During your initial preparation, it's vital that you understand the capabilities >[!IMPORTANT] >This guide provides images and examples to help you decide how to configure ASR rules; these images and examples might not reflect the best configuration options for your environment. -Before you start, review [Overview of attack surface reduction](overview-attack-surface-reduction.md), and [Demystifying attack surface reduction rules - Part 1](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/demystifying-attack-surface-reduction-rules-part-1/ba-p/1306420) for foundational information. To understand the areas of coverage and potential impact, familiarize yourself with the current set of ASR rules; see [Attack surface reduction rules reference](attack-surface-reduction-rules-reference.md). While you are familiarizing yourself with the ASR rules set, take note of the per-rule GUID mappings; see: [ASR rules and GUIDs matrix](attack-surface-reduction-rules-reference.md#asr-rules-and-guids-matrix). +Before you start, review [Overview of attack surface reduction](overview-attack-surface-reduction.md), and [Demystifying attack surface reduction rules - Part 1](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/demystifying-attack-surface-reduction-rules-part-1/ba-p/1306420) for foundational information. To understand the areas of coverage and potential impact, familiarize yourself with the current set of ASR rules; see [Attack surface reduction rules reference](attack-surface-reduction-rules-reference.md). While you are familiarizing yourself with the ASR rules set, take note of the per-rule GUID mappings; see: [ASR rule to GUID matrix](attack-surface-reduction-rules-reference.md#asr-rule-to-guid-matrix). ASR rules are only one capability of the attack surface reduction capabilities within Microsoft Defender for Endpoint. This document will go into more detail on deploying ASR rules effectively to stop advanced threats like human-operated ransomware and other threats. |
| security | Attack Surface Reduction Rules Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference.md | Last updated 02/04/2022 **Applies to:** -- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/?linkid=2154037)+- [Microsoft Microsoft 365 Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) - Microsoft Defender Antivirus This article provides information about attack reduction rules: - [Supported operating system versions](#supported-operating-systems) - [Supported configuration management systems](#supported-configuration-management-systems) - [Per-rule alert and notification details](#per-rule-alert-and-notification-details)-- [ASR rules and GUIDs matrix](#asr-rules-and-guids-matrix)+- [ASR rule to GUID matrix](#asr-rule-to-guid-matrix) - [ASR rule modes](#asr-rule-modes) - [Per-rule-descriptions](#per-rule-descriptions)- - Rule descriptions - - Configuration management system rule names ## Supported operating systems The following table lists the supported operating systems for rules that are currently released to general availability. The rules are listed alphabetical order in this table. -> [!Note] +> [!NOTE] > > Unless otherwise indicated, the minimum Windows 10 build is version 1709 (RS3, build 16299) or later; the minimum Windows Server build is version is 1809 or later. > The following table lists the supported operating systems for rules that are cur | Rule name| Windows 11 <br>and<br> Windows 10 | Windows Server <br> 2022 <br>and<br> Windows Server <br> 2019 | Windows Server | Windows Server <br> 2016 <sup>[[1, 2](#fn1)]<sup></sup> | Windows Server <br> 2012 R2 <sup>[[1, 2](#fn1)]<sup></sup> | |:|::|::|::|::|::|-| [Block abuse of exploited vulnerable signed drivers](#block-abuse-of-exploited-vulnerable-signed-drivers) | Y | Y | Y <br> version 1803 (Semi-Annual Channel) or later | Y | Y | +| [Block abuse of exploited vulnerable signed drivers](#block-abuse-of-exploited-vulnerable-signed-drivers) | Y | Y | Y <br> version 1803 (Semi-Annual Enterprise Channel) or later | Y | Y | | [Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | Y <br> version 1809 or later <sup>[[3](#fn1)]<sup></sup> | Y | Y | Y | Y | | [Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | Y | Y | Y | Y | Y | | [Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | Y <br> version 1803 or later <sup>[[3](#fn1)]<sup></sup> | Y | Y | Y | Y | Links to information about configuration management system versions referenced i ## Per rule alert and notification details -Toast notifications are generated for all rules in Block mode. Rules in any other mode will not generate toast notifications +Toast notifications are generated for all rules in Block mode. Rules in any other mode won't generate toast notifications For rules with the "Rule State" specified: -- ASR rules with \<ASR Rule, Rule State\> combinations are used to surface alerts (toast notifications) on Microsoft Defender for Endpoint only for devices at high-cloud block level. Devices not at high cloud block level will not generate alerts for any <ASR Rule, Rule State> combinations+- ASR rules with \<ASR Rule, Rule State\> combinations are used to surface alerts (toast notifications) on Microsoft Defender for Endpoint only for devices at high-cloud block level. Devices not at high cloud block level won't generate alerts for any <ASR Rule, Rule State> combinations - EDR alerts are generated for ASR rules in the specified states, but only for devices at high cloud block level. | Rule name: | Rule state: | Generates alerts in EDR? <br> (Yes \| No) | Generates toast notifications? <br> (Yes \| No) | For rules with the "Rule State" specified: |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | | N | Y | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | Audit \| Block | Y \| Y <br> Requires device at high-cloud block level | N \| Y <br> Requires device at high-cloud block level | -## ASR rules and GUIDs matrix +## ASR rule to GUID matrix | Rule Name | Rule GUID | |:--|:--| For rules with the "Rule State" specified: ## ASR rule modes -- **Not configured** or **Disable**: This is the state in which the ASR rule has not been enabled or has been disabled. The code for this state = 0.-- **Block**: This is the state in which the ASR rule is enabled. The code for this state is 1.-- **Audit**: This is the state in which the ASR rule is evaluated for its impactive behavior toward the organization or environment in which it is deployed. The code for this state is 2.-- **Warn** This is the state in which the ASR rule is enabled and presents a notification to the end-user, but permits the end-user to bypass the block. The code for this state is 6.+- **Not configured** or **Disable**: The state in which the ASR rule hasn't been enabled or has been disabled. The code for this state = 0. +- **Block**: The state in which the ASR rule is enabled. The code for this state is 1. +- **Audit**: The state in which the ASR rule is evaluated for the effect it would have on the organization or environment if enabled (set to block or warn). The code for this state is 2. +- **Warn** The state in which the ASR rule is enabled and presents a notification to the end-user, but permits the end-user to bypass the block. The code for this state is 6. _Warn mode_ is a block-mode type that alerts users about potentially risky actions. Users can choose to bypass the block warning message and allow the underlying action. Users can select **OK** to enforce the block, or select the bypass option - **Unblock** - through the end-user pop-up toast notification that is generated at the time of the block. After the warning is unblocked, the operation is allowed until the next time the warning message occurs, at which time the end-user will need to reperform the action. -If the allow button is clicked, the block will be suppressed for 24 hours. After 24 hours, the end-user will need to allow the block again. The warn mode for ASR rules is only supported for RS5+ (1809+) devices. If bypass is assigned to ASR rules on devices with older versions, the rule will be in blocked mode. +When the allow button is clicked, the block will be suppressed for 24 hours. After 24 hours, the end-user will need to allow the block again. The warn mode for ASR rules is only supported for RS5+ (1809+) devices. If bypass is assigned to ASR rules on devices with older versions, the rule will be in blocked mode. -You can also set a rule in warn mode via PowerShell by simply specifying the AttackSurfaceReductionRules_Actions as "Warn". For example: +You can also set a rule in warn mode via PowerShell by specifying the AttackSurfaceReductionRules_Actions as "Warn". For example: ```powershell -command "& {&'Add-MpPreference' -AttackSurfaceReductionRules_Ids 56a863a9-875e-4185-98a7-b882c64b5ce5 -AttackSurfaceReductionRules_Actions Warn"} You can also set a rule in warn mode via PowerShell by simply specifying the Att This rule prevents an application from writing a vulnerable signed driver to disk. In-the-wild, vulnerable signed drivers can be exploited by local applications \- _that have sufficient privileges_ \- to gain access to the kernel. Vulnerable signed drivers enable attackers to disable or circumvent security solutions, eventually leading to system compromise. -The **Block abuse of exploited vulnerable signed drivers** rule does not block a driver already existing on the system from being loaded. +The **Block abuse of exploited vulnerable signed drivers** rule doesn't block a driver already existing on the system from being loaded. > [!NOTE] > Dependencies: none provided by engineering This rule prevents attacks by blocking Adobe Reader from creating processes. -Through social engineering or exploits, malware can download and launch payloads, and break out of Adobe Reader. By blocking child processes from being generated by Adobe Reader, malware attempting to use it as a vector are prevented from spreading. +Malware can download and launch payloads and break out of Adobe Reader through social engineering or exploits. By blocking child processes from being generated by Adobe Reader, malware attempting to use Adobe Reader as an attack vector are prevented from spreading. Intune name: `Process creation from Adobe Reader (beta)` Dependencies: MDAV This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS). -LSASS authenticates users who sign in on a Windows computer. Microsoft Defender Credential Guard in Windows normally prevents attempts to extract credentials from LSASS. However, some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use hack tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. +LSASS authenticates users who sign in on a Windows computer. Microsoft Defender Credential Guard in Windows normally prevents attempts to extract credentials from LSASS. Some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. > [!NOTE] > In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that simply enumerates LSASS, but has no real impact in functionality, there is no need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat. This rule detects suspicious properties within an obfuscated script. > [!IMPORTANT] > PowerShell scripts have been temporarily excluded from the "Block execution of potentially obfuscated scripts" rule due to the large-scale FP issues faced in the past. -Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. Malware authors also use obfuscation to make malicious code harder to read, which prevents close scrutiny by humans and security software. +Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. Malware authors also use obfuscation to make malicious code harder to read, which hampers close scrutiny by humans and security software. > [!IMPORTANT] > Due to the high number of false positives, this rule does not currently detect PowerShell scripts; this is a temporary solution. The rule will be updated and start redetecting PowerShell scripts soon. Dependencies: MDAV, RPC ### Block process creations originating from PSExec and WMI commands -This rule blocks processes created through [PsExec](/sysinternals/downloads/psexec) and [WMI](/windows/win32/wmisdk/about-wmi) from running. Both PsExec and WMI can remotely execute code, so there is a risk of malware abusing this functionality for command and control purposes, or to spread an infection throughout an organization's network. +This rule blocks processes created through [PsExec](/sysinternals/downloads/psexec) and [WMI](/windows/win32/wmisdk/about-wmi) from running. Both PsExec and WMI can remotely execute code. There's a risk of malware abusing functionality of PsExec and WMI for command and control purposes, or to spread an infection throughout an organization's network. > [!WARNING] > Only use this rule if you're managing your devices with [Intune](/intune) or another MDM solution. This rule is incompatible with management through [Microsoft Endpoint Configuration Manager](/configmgr) because this rule blocks WMI commands the Configuration Manager client uses to function correctly. Dependencies: MDAV With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards. Blocked file types include executable files (such as .exe, .dll, or .scr) +> [!IMPORTANT] +> Files copied from the USB to the disk drive will be blocked by this rule if and when it's about to be executed on the disk drive. + Intune name: `Untrusted and unsigned processes that run from USB` Configuration Manager name: `Block untrusted and unsigned processes that run from USB` Dependencies: MDAV, AMSI ### Use advanced protection against ransomware -This rule provides an extra layer of protection against ransomware. It uses both client and cloud heuristics to determine whether a file resembles ransomware. This rule does not block files that have one or more of the following characteristics: +This rule provides an extra layer of protection against ransomware. It uses both client and cloud heuristics to determine whether a file resembles ransomware. This rule doesn't block files that have one or more of the following characteristics: - The file has already been found to be unharmful in the Microsoft cloud. - The file is a valid signed file. |
| security | Device Control Removable Storage Access Control | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control.md | You can use the following properties to create a removable storage group: |Property Name|Description|Options| ||||-|**Group Id**|GUID, a unique ID, represents the group and will be used in the policy as GroupId|| -|**DescriptorIdList**|List the device properties you want to use to cover in the group. For each device property, see [Device Properties](device-control-removable-storage-protection.md) for more detail. All properties are case sensitive. |**PrimaryId**: `RemovableMediaDevices`, `CdRomDevices`, `WpdDevices`<br>**BusId**: For example, USB, SCSI<br>**DeviceId**<br>**HardwareId**<br>**InstancePathId**: InstancePathId is a string that uniquely identifies the device in the system, for example, `USBSTOR\DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07\8735B611&0`. The number at the end (for example &0) represents the available slot and may change from device to device. For best results, use a wildcard at the end. For example, `USBSTOR\DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07\8735B611*`.<br>**FriendlyNameId**<br>**SerialNumberId**<br>**VID**<br>**PID**<br>**VID_PID**<br>`0751_55E0`: match this exact VID/PID pair<br>`_55E0`: match any media with PID=55E0 <br>`0751_`: match any media with VID=0751| -|**MatchType**|When there are multiple device properties being used in the `DescriptorIDList`, MatchType defines the relationship.|**MatchAll**: Any attributes under the `DescriptorIdList` will be **And** relationship; for example, if administrator puts `DeviceID` and `InstancePathID`, for every connected USB, system will check to see whether the USB meets both values. <br> **MatchAny**: The attributes under the DescriptorIdList will be **Or** relationship; for example, if administrator puts `DeviceID` and `InstancePathID`, for every connected USB, system will do the enforcement as long as the USB has either an identical **DeviceID** or **InstanceID** value. | +|**GroupId**|GUID, a unique ID, represents the group and will be used in the policy.|| +|**DescriptorIdList**|List the device properties you want to use to cover in the group. For each device property, see [Device Properties](device-control-removable-storage-protection.md) for more detail. All properties are case sensitive. |**PrimaryId**: `RemovableMediaDevices`, `CdRomDevices`, `WpdDevices`<p>**BusId**: For example, USB, SCSI<p>**DeviceId**<p>**HardwareId**<p>**InstancePathId**: InstancePathId is a string that uniquely identifies the device in the system, for example, `USBSTOR\DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07\8735B611&0`. The number at the end (for example &0) represents the available slot and may change from device to device. For best results, use a wildcard at the end. For example, `USBSTOR\DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07\8735B611*`.<p>**FriendlyNameId**<p>**SerialNumberId**<p>**VID**<p>**PID**<p>**VID_PID**<p>`0751_55E0`: match this exact VID/PID pair<p>`_55E0`: match any media with PID=55E0 <p>`0751_`: match any media with VID=0751| +|**MatchType**|When there are multiple device properties being used in the `DescriptorIDList`, MatchType defines the relationship.|**MatchAll**: Any attributes under the `DescriptorIdList` will be **And** relationship; for example, if administrator puts `DeviceID` and `InstancePathID`, for every connected USB, system will check to see whether the USB meets both values. <p> **MatchAny**: The attributes under the DescriptorIdList will be **Or** relationship; for example, if administrator puts `DeviceID` and `InstancePathID`, for every connected USB, system will do the enforcement as long as the USB has either an identical **DeviceID** or **InstanceID** value.| ### Access Control Policy You can use the following properties to create the access control policy: |
| security | Enable Attack Surface Reduction | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction.md | The following procedures for enabling ASR rules include instructions for how to 4. Select **OK** on the three configuration panes. Then select **Create** if you're creating a new endpoint protection file or **Save** if you're editing an existing one. -#### Endpoint security policy** +#### Endpoint security policy 1. Select **Endpoint Security** \> **Attack surface reduction**. Choose an existing ASR rule or create a new one. To create a new one, select **Create Policy** and enter information for this profile. For **Profile type**, select **Attack surface reduction rules**. If you've chosen an existing profile, select **Properties** and then select **Settings**. |
| security | Enable Troubleshooting Mode | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-troubleshooting-mode.md | search in (DeviceEvents) ActionType == "AntivirusTroubleshootModeEvent" | extend _tsmodeproperties = parse_json(AdditionalFields) | where Timestamp > ago(3h)-| where _tsmodeproperties.TroubleshootingStateChangeReason == "Troubleshooting mode started" +| where _tsmodeproperties.TroubleshootingStateChangeReason contains "started" |summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId ``` search in (DeviceEvents) ActionType == "AntivirusTroubleshootModeEvent" | extend _tsmodeproperties = parse_json(AdditionalFields) | where Timestamp > ago(30d) // choose the date range you want-| where _tsmodeproperties.TroubleshootingStateChangeReason == "Troubleshooting mode started" +| where _tsmodeproperties.TroubleshootingStateChangeReason contains "started" | summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId | sort by count_ ``` ActionType == "AntivirusTroubleshootModeEvent" | extend _tsmodeproperties = parse_json(AdditionalFields) | where Timestamp > ago(2d) //beginning of time range | where Timestamp < ago(1d) //end of time range-| where _tsmodeproperties.TroubleshootingStateChangeReason == "Troubleshooting mode started" +| where _tsmodeproperties.TroubleshootingStateChangeReason contains "started" | summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() | where count_ > 5 // choose your max # of TS mode instances for your time range ``` |
| security | Ios Troubleshoot | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-troubleshoot.md | ms.technology: mde This topic provides troubleshooting information to help you address issues that may arise as you use Microsoft Defender for Endpoint on iOS. -- > [!NOTE] > Defender for Endpoint on iOS would use a VPN in order to provide the Web Protection feature. This is not a regular VPN and is a local/self-looping VPN that does not take traffic outside the device. ## Apps don't work when VPN is turned on-There are some apps that stop functioning when an active VPN is detected. You can disable the VPN during the time you are using such apps. +There are some apps that stop functioning when an active VPN is detected. You can disable the VPN during the time you're using such apps. -By default, Defender for Endpoint on iOS includes and enables the web protection feature. [Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. Defender for Endpoint on iOS uses a VPN in order to provide this protection. Note that this is a local VPN and unlike traditional VPN, network traffic is not sent outside the device. +By default, Defender for Endpoint on iOS includes and enables the web protection feature. [Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. Defender for Endpoint on iOS uses a VPN in order to provide this protection. Note that this is a local VPN and unlike traditional VPN, network traffic isn't sent outside the device. -While enabled by default, there might be some cases that require you to disable VPN. For example, you want to run some apps that do not work when a VPN is configured. In such cases, you can choose to disable the VPN directly from the Defender for Endpoint app or using the following steps: +While enabled by default, there might be some cases that require you to disable VPN. For example, you want to run some apps that don't work when a VPN is configured. In such cases, you can choose to disable the VPN directly from the Defender for Endpoint app or using the following steps: 1. On your iOS device, open the **Settings** app, click or tap **General** and then **VPN**. 1. Click or tap the "i" button for Microsoft Defender for Endpoint. While enabled by default, there might be some cases that require you to disable ## Coexistence with multiple VPN profiles -Apple iOS does not support multiple **device-wide** VPNs to be active simultaneously. While multiple VPN profiles can exist on the device, only one VPN can be active at a time. If you need to use another VPN on the device, you can disable Defender for Endpoint VPN while you are using the other VPN. +Apple iOS doesn't support multiple **device-wide** VPNs to be active simultaneously. While multiple VPN profiles can exist on the device, only one VPN can be active at a time. If you need to use another VPN on the device, you can disable Defender for Endpoint VPN while you're using the other VPN. ## Battery consumption -In order to provide you all-time protection from web-based threats, Microsoft Defender for Endpoint needs to run in the background at all times. This might lead to a minor increase in overall battery consumption of your device. In case you are seeing significant battery drain, please [send us feedback](ios-troubleshoot.md#send-in-app-feedback) and we will investigate. +In order to provide you all-time protection from web-based threats, Microsoft Defender for Endpoint needs to run in the background at all times. This might lead to a minor increase in overall battery consumption of your device. In case you're seeing significant battery drain, please [send us feedback](ios-troubleshoot.md#send-in-app-feedback) and we'll investigate. Also, in the Settings app, iOS only shows battery usage of apps that are visible to the user for a specific duration of time. The battery usage by apps shown on the screen is only for that time duration and is computed by iOS based on a multitude of factors including CPU and Network usage. Microsoft Defender for Endpoint uses a local/loop-back VPN in the background to check web traffic for any malicious websites or connections. Network packets from any app go through this check and that causes the battery usage of Microsoft Defender for Endpoint to be computed inaccurately. The actual battery consumption of Microsoft Defender for Endpoint is lesser than what is shown on the Battery Settings page on the device. Note that the VPN used is a local VPN and unlike a traditional VPN, network traf ## Data usage -Microsoft Defender for Endpoint uses a local/loopback VPN to check web traffic for any malicious websites or connections. Due to this reason, Microsoft Defender for Endpoint data usage can be inaccurately accounted for. We have also observed that if the device is on cellular network only, the data usage reported by service provider is very close to the actual consumption whereas in the Settings app, Apple shows about 1.5x to 2x of actual data consumed. +Microsoft Defender for Endpoint uses a local/loopback VPN to check web traffic for any malicious websites or connections. Due to this reason, Microsoft Defender for Endpoint data usage can be inaccurately accounted for. We have also observed that if the device is on cellular network only, the data usage reported by service provider is very close to the actual consumption whereas in the Settings app, the numbers can be inaccurate. -We have similar observations with other VPN services as well and have reported this to Apple. +We have similar observations with other VPN services as well. In addition, it is critical for Microsoft Defender for Endpoint to be up to date with our backend services to provide better protection. In addition, a notification is shown on the iOS device. Tapping on the notificat > [!div class="mx-imgBorder"] > :::image type="content" source="images/ios-phish-alert.png" alt-text="The site reported as unsafe notification" lightbox="images/ios-phish-alert.png"::: -## Device not seen on the Defender for Endpoint console after onboarding. +## Device not seen on the Defender for Endpoint console after onboarding After onboarding, it takes few hours for device to show up in the Device inventory in the Defender for Endpoint security console. Also, ensure that device is registered correctly with Azure Active Directory and device has internet connectivity. For successful onboarding, the device has to be registered via Microsoft Authenticator or Intune Company Portal and the user needs to sign-in using the same account with which device is registered with Azure AD. If you observe issues when the app is updated through the app store (either auto If a user faces an issue which is not already addressed in the above sections or is unable to resolve using the listed steps, the user can provide in-app feedback along with diagnostic data. Our team will then investigate the logs to provide the right solution. Users can use the following steps to send feedback: - - Open MSDefender app on the iOS/iPadOS device. - - Tap on Menu (profile icon) on the top-left corner. - - Tap **Send Feedback**. - - Choose from the given options. To report an issue, select **I don't like something**. - - Provide details of the issue that you are facing and check **Send diagnostic data**. We recommend that you include your email address so that the team can contact you for a solution or a follow-up. - - Tap **Submit** to successfully send the feedback. +- Open MSDefender app on the iOS/iPadOS device. +- Tap on Menu (profile icon) on the top-left corner. +- Tap **Send Feedback**. +- Choose from the given options. To report an issue, select **I don't like something**. +- Provide details of the issue that you are facing and check **Send diagnostic data**. We recommend that you include your email address so that the team can contact you for a solution or a follow-up. +- Tap **Submit** to successfully send the feedback. |
| security | Linux Install With Puppet | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-install-with-puppet.md | $version = undef ){ case $::osfamily { 'Debian' : {+ $release = $channel ? { + 'prod' => $facts['os']['distro']['codename'] + default => $channel + } apt::source { 'microsoftpackages' : location => "https://packages.microsoft.com/${distro}/${version}/prod",- release => $channel, + release => $release, repos => 'main', key => { 'id' => 'BC528686B50D79E339D3721CEB3E94ADBE1229CF', |
| security | Mac Install With Intune | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-install-with-intune.md | This profile is needed for macOS 10.15 (Catalina) or older. It will be ignored o 1. Set **Team identifier** to **UBF8T346G9** and click **Next**. > [!div class="mx-imgBorder"]- > :::image type="content" source="images/mac-system-extension-intune2.png" alt-text="The Kernel settings of the system's extension" lightbox="images/mac-system-extension-intune2.png"::: + > :::image type="content" source="images/mac-kernel-extension-intune2.png" alt-text="Allowed team identifiers for Kernel extensions." lightbox="images/mac-kernel-extension-intune2.png"::: 1. In the **Assignments** tab, assign this profile to **All Users & All devices**. 1. Review and create this configuration profile. |
| security | Microsoft Defender Endpoint Android | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-android.md | This topic describes how to install, configure, update, and use Defender for End ### Prerequisites - **For end users**:- - Microsoft Defender for Endpoint license assigned to the end user(s) of the app. See [Microsoft Defender for Endpoint licensing requirements](/microsoft-365/security/defender-endpoint/minimum-requirements#licensing-requirements). - - Intune license is needed before onboarding Android devices. + - The end user must be assigned a Microsoft Intune license. For more information on how to assign licenses, see [Assign licenses to users](/azure/active-directory/users-groups-roles/licensing-groups-assign). + - The users of the app must be assigned a Microsoft Defender for Endpoint license. For more information on how to assign licenses, see [Microsoft Defender for Endpoint licensing requirements](/microsoft-365/security/defender-endpoint/minimum-requirements#licensing-requirements). - Intune Company Portal app can be downloaded from [Google Play](https://play.google.com/store/apps/details?id=com.microsoft.windowsintune.companyportal) and is available on the Android device.- - Additionally, device(s) can be [enrolled](/mem/intune/user-help/enroll-device-android-company-portal) via the Intune Company Portal app to enforce Intune device compliance policies. This requires the end user to be assigned a Microsoft Intune license. - - For more information on how to assign licenses, see [Assign licenses to users](/azure/active-directory/users-groups-roles/licensing-groups-assign). + - Additionally, device(s) can be [enrolled](/mem/intune/user-help/enroll-device-android-company-portal) via the Intune Company Portal app to enforce Intune device compliance policies. -- **For Administrators**+- **For Administrators**: - Access to the Microsoft 365 Defender portal.- - Access [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) to - - Deploy the app to enrolled user groups in your organization. - - Configure Microsoft Defender for Endpoint risk signals in app protection policy. + - Access [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) to: + - Deploy the app to enrolled user groups in your organization. + - Configure Microsoft Defender for Endpoint risk signals in app protection policy. > [!NOTE]+ > > - Microsoft Defender for Endpoint now extends protection to an organization's data within a managed application (MAM) for devices that are not enrolled using mobile device management (MDM), but are using Intune to manage mobile applications. It also extends this support to customers who use other enterprise mobility management solutions, while still using Intune for [mobile application management (MAM)](/mem/intune/apps/mam-faq). > - In addition, Microsoft Defender for Endpoint already supports devices that are enrolled using Intune mobile device management (MDM). - ### Network Requirements - For Microsoft Defender for Endpoint on Android to function when connected to a network the firewall/proxy will need to be configured to [enable access to Microsoft Defender for Endpoint service URLs](configure-proxy-internet.md#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server). |
| security | Onboard Windows Multi Session Device | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/onboard-windows-multi-session-device.md | Title: "Onboard Windows multi-session devices in Azure Virtual Desktop" description: "Read more in this article about Onboarding Windows multi-session devices in Azure Virtual Desktop" -keywords: Azure Virtual Desktop, WVD, microsoft defender, endpoint, onboard +keywords: Azure Virtual Desktop, AVD, microsoft defender, endpoint, onboard ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library Familiarize yourself with the [considerations for non-persistent VDI](/microsoft > - Single entry for each virtual desktop > - Multiple entries for each virtual desktop -Microsoft recommends onboarding Azure Virtual Desktop as a single entry per virtual desktop. This ensures that the investigation experience in the Microsoft Defender for Endpoint portal is in the context of one device based on the machine name. Organizations that frequently delete and redeploy WVD hosts should strongly consider using this method as it prevents multiple objects for the same machine from being created in the Microsoft Defender for Endpoint portal. This can lead to confusion when investigating incidents. For test or non-volatile environments, you may opt to choose differently. +Microsoft recommends onboarding Azure Virtual Desktop as a single entry per virtual desktop. This ensures that the investigation experience in the Microsoft Defender for Endpoint portal is in the context of one device based on the machine name. Organizations that frequently delete and redeploy AVD hosts should strongly consider using this method as it prevents multiple objects for the same machine from being created in the Microsoft Defender for Endpoint portal. This can lead to confusion when investigating incidents. For test or non-volatile environments, you may opt to choose differently. -Microsoft recommends adding the Microsoft Defender for Endpoint onboarding script to the WVD golden image. This way, you can be sure that this onboarding script runs immediately at first boot. It's executed as a startup script at first boot on all the WVD machines that are provisioned from the WVD golden image. However, if you're using one of the gallery images without modification, place the script in a shared location and call it from either local or domain group policy. +Microsoft recommends adding the Microsoft Defender for Endpoint onboarding script to the AVD golden image. This way, you can be sure that this onboarding script runs immediately at first boot. It's executed as a startup script at first boot on all the AVD machines that are provisioned from the AVD golden image. However, if you're using one of the gallery images without modification, place the script in a shared location and call it from either local or domain group policy. > [!NOTE]-> The placement and configuration of the VDI onboarding startup script on the WVD golden image configures it as a startup script that runs when the WVD starts. It's **not** recommended to onboard the actual WVD golden image. Another consideration is the method used to run the script. It should run as early in the startup/provisioning process as possible to reduce the time between the machine being available to receive sessions and the device onboarding to the service. Below scenarios 1 and 2 take this into account. +> The placement and configuration of the VDI onboarding startup script on the AVD golden image configures it as a startup script that runs when the AVD starts. It's **not** recommended to onboard the actual AVD golden image. Another consideration is the method used to run the script. It should run as early in the startup/provisioning process as possible to reduce the time between the machine being available to receive sessions and the device onboarding to the service. Below scenarios 1 and 2 take this into account. ### Scenarios -There are several ways to onboard a WVD host machine: +There are several ways to onboard an AVD host machine: - Run the script in the golden image (or from a shared location) during startup. - Use a management tool to run the script. For more information, see [Onboard Windows devices using Configuration Manager]( #### Tagging your machines when building your golden image -As part of your onboarding, you may want to consider setting a machine tag to can differentiate WVD machines more easily in the Microsoft Security Center. For more information, see +As part of your onboarding, you may want to consider setting a machine tag to differentiate AVD machines more easily in the Microsoft Security Center. For more information, see [Add device tags by setting a registry key value](machine-tags.md#add-device-tags-by-setting-a-registry-key-value). #### Other recommended configuration settings |
| security | Respond Machine Alerts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/respond-machine-alerts.md | Depending on the severity of the attack and the sensitivity of the device, you m > [!IMPORTANT] > - Isolating devices from the network is not currently supported for devices running macOS or Linux. Use live response to run the action. For more information on live response, see [Investigate entities on devices using live response](live-response.md).-> - Full isolation is available for devices on Windows 10, version 1703, Windows 11, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, and Windows Server 2022. -> - Selective isolation is available for devices on Windows 10, version 1709 or later, and Windows 11. +> - Full isolation is available for devices running Windows 11, Windows 10, version 1703 or later, Windows Server 2022, Windows Server 2019, and Windows Server 2016. +> - Selective isolation is available for devices running Windows 10, version 1709 or later, and Windows 11. > - When isolating a device, only certain processes and destinations are allowed. Therefore, devices that are behind a full VPN tunnel won't be able to reach the Microsoft Defender for Endpoint cloud service after the device is isolated. We recommend using a split-tunneling VPN for Microsoft Defender for Endpoint and Microsoft Defender Antivirus cloud-based protection-related traffic. This device isolation feature disconnects the compromised device from the network while retaining connectivity to the Defender for Endpoint service, which continues to monitor the device. |
| security | Troubleshooting Mode Scenarios | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshooting-mode-scenarios.md | ms.localizationpriority: medium audience: ITPro - - m365-security-compliance +- m365-security-compliance ms.technology: mde ms.technology: mde > [!IMPORTANT] > Some information relates to pre-released products which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -Microsoft Defender for Endpoint troubleshooting mode allows you to troubleshoot various Microsoft Defender antivirus features by enabling them from the device and testing different scenarios, even if they're controlled by the organization policy. The troubleshooting mode is disabled by default and requires you to turn it on for a device (and/or group of devices) for a limited time. Note that this is exclusively an Enterprise-only feature, and requires Microsoft 365 Defender access. +Microsoft Defender for Endpoint troubleshooting mode allows you to troubleshoot various Microsoft Defender Antivirus features by enabling them from the device and testing different scenarios, even if they're controlled by the organization policy. The troubleshooting mode is disabled by default and requires you to turn it on for a device (and/or group of devices) for a limited time. Note that this is exclusively an enterprise-only feature, and requires Microsoft 365 Defender access. ## Scenario 1: Unable to install application If you want to install an application but receive an error message that Microsoft Defender Antivirus and tamper protection is on, follow the steps below to troubleshoot the issue. -1. Request the SOC admin to turn on troubleshooting mode. You'll get a Windows Security notification once the troubleshooting mode starts. +1. Request the security admin to turn on troubleshooting mode. You'll get a Windows Security notification once the troubleshooting mode starts. 2. Connect to the device (using Terminal Services for example) with local admin permissions. If you want to install an application but receive an error message that Microsof 5. Launch an elevated PowerShell command prompt, and toggle off RTP. - - Run `get-mppreference` to check RTP status. - - Run `setΓÇômppreference` to turn off RTP Run. + - Run `Get-MpComputerStatus` to check the RealTimeProtection status. + - Run `Set-mppreference -DisableRealtimeMonitoring $true` to turn off RTP. + - Run `Get-MpComputerStatus` again to verify to RealTimeProtection status. 6. Try installing the application. Sometimes during a scheduled scan, MsMpEng.exe can consume high CPU. 5. Add process/file/folder/extension exclusions based on ProcMon findings using one of the following commands (the path, extension, and process exclusions mentioned below are examples only): - - Set-mppreference -ExclusionPath (for example, C:\DB\DataFiles) + - `Set-mppreference -ExclusionPath` (for example, C:\DB\DataFiles) - - Set-mppreference ΓÇôExclusionExtension (for example, .dbx) + - `Set-mppreference ΓÇôExclusionExtension` (for example, .dbx) - - Set-mppreference ΓÇôExclusionProcess (for example, C:\DB\Bin\Convertdb.exe) + - `Set-mppreference ΓÇôExclusionProcess` (for example, C:\DB\Bin\Convertdb.exe) 6. After adding the exclusion, check to see if the CPU usage has dropped. For more information on Set-MpPreference cmdlet configuration preferences for Wi When Microsoft Defender Antivirus real-time protection is turned on, application takes a long time to perform basic tasks. To turn off real-time protection and troubleshoot the issue, follow the steps below. -1. Request SOC admin to turn on troubleshooting mode on the device. +1. Request security admin to turn on troubleshooting mode on the device. 2. To disable RTP for this scenario, first turn off tamper protection. For more information, see [Protect security settings with tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md). When Microsoft Defender Antivirus real-time protection is turned on, application 4. Launch an elevated PowerShell command prompt. - - Set-mppreference -DisableRealtimeMonitoring $true + - `Set-mppreference -DisableRealtimeMonitoring $true` 5. After disabling RTP, check to see if the application is slow. Attack Surface Reduction (ASR) is not allowing Microsoft Office plugin to work p 2. Launch an elevated PowerShell command prompt. - - Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Disabled + - `Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Disabled` 3. After disabling the ASR Rule, confirm that the Microsoft Office plugin now works. Network Protection is blocking Microsoft domain, preventing users from accessing 2. Launch an elevated PowerShell command prompt. - - Set-MpPreference -EnableNetworkProtection Disabled + - `Set-MpPreference -EnableNetworkProtection Disabled` 3. After disabling Network Protection, check to see if the domain is now allowed. For more information, see [Use network protection to help prevent connections to - [Overview of attack surface reduction](overview-attack-surface-reduction.md) - [Detect and block potentially unwanted applications](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) - [Get an overview of Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/)-- [Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](why-use-microsoft-defender-antivirus.md)+- [Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](why-use-microsoft-defender-antivirus.md) |
| security | Tvm Remediation | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-remediation.md | ms.technology: mde > > Already have Microsoft Defender for Endpoint P2? [Sign up for a free trial of the Defender Vulnerability Management Add-on.](https://signup.microsoft.com/get-started/signup?products=5908ecaa-b8a7-4a04-b6c0-d44fd934b6f2) -Watch this short video to learn how threat and vulnerability management discovers vulnerabilities and misconfigurations on your endpoints and provides actionable insights that help you quickly remediate threats and vulnerabilities in your environment. +Watch this short video to learn how threat and vulnerability management discovers vulnerabilities and misconfigurations on your endpoints and provides actionable insights that help you quickly remediate threats and vulnerabilities in your environment. + > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4qLVs] ## Request remediation Vulnerability management capabilities bridges the gap between Security and IT ad ### Enable Microsoft Intune connection -To use this capability, enable your Microsoft Intune connections. In the Microsoft 365 Defender portal, navigate to **Settings** \> **General** \> **Advanced features**. Scroll down and look for **Microsoft Intune connection**. By default, the toggle is turned off. Turn your **Microsoft Intune connection** toggle **On**. +To use this capability, enable your Microsoft Intune connections. In the Microsoft 365 Defender portal, navigate to **Settings** \> **Endpoints** \> **General** \> **Advanced features**. Scroll down and look for **Microsoft Intune connection**. By default, the toggle is turned off. Turn your **Microsoft Intune connection** toggle **On**. **Note**: If you have the Intune connection enabled, you get an option to create an Intune security task when creating a remediation request. This option does not appear if the connection is not set. |
| security | Phishing Trends | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/intelligence/phishing-trends.md | Business email compromise (BEC) is a sophisticated scam that targets businesses ## More information about phishing attacks -For information on the latest phishing attacks, techniques, and trends, you can read these entries on the [Microsoft Security blog](https://www.microsoft.com/security/blog): +For information on the latest phishing attacks, techniques, and trends, you can read these entries on the [Microsoft Security blog](https://www.microsoft.com/security/blog/): - [Phishers unleash simple but effective social engineering techniques using PDF attachments](https://cloudblogs.microsoft.com/microsoftsecure/2017/01/26/phishers-unleash-simple-but-effective-social-engineering-techniques-using-pdf-attachments/?source=mmpc) - [Tax themed phishing and malware attacks proliferate during the tax filing season](https://cloudblogs.microsoft.com/microsoftsecure/2017/03/20/tax-themed-phishing-and-malware-attacks-proliferate-during-the-tax-filing-season/?source=mmpc) |
| security | Admin Submission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/admin-submission.md | The reported message will be marked as a false positive or a false negative. An > [!NOTE] > If malware filtering has replaced the message attachments with the Malware Alert Text.txt file, you need to submit the original message from quarantine that contains the original attachments. For more information on quarantine and how to release messages with malware false positives, see [Manage quarantined messages and files as an admin](manage-quarantined-messages-and-files.md). -## View email admin submissions to Microsoft +## View admin submissions to Microsoft 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. -2. On the **Submissions** page, verify that the **Emails** tab is selected. +2. On the **Submissions** page, verify that the **Emails**, **URL**, or **Email attachment** tab is selected. - You can sort the entries by clicking on an available column header. Click **Customize columns** to show a maximum of seven columns. The default values are marked with an asterisk (<sup>\*</sup>): - **Submission name**<sup>\*</sup> On the **User reported messages** tab, select a message in the list, click **Sub > [!div class="mx-imgBorder"] > :::image type="content" source="../../media/admin-submission-main-action-button.png" alt-text="The New options on the Action button" lightbox="../../media/admin-submission-main-action-button.png":::--If the message is reported to Microsoft, the **Converted to admin submission** value turns from **no** to **yes**. You can directly access the admin submission by clicking **View the converted admin submission** from the overflow menu inside the submission flyout of the respective user reported message. --> [!div class="mx-imgBorder"] -> :::image type="content" source="../../media/view-converted-admin-submission.png" alt-text="Option to view created admin submission from user reported message" lightbox="../../media/view-converted-admin-submission.png"::: |
| security | Email Validation And Authentication | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-validation-and-authentication.md | For external domains, the spoofed user is the domain in the From address, while - The source IP address (divided up into /24 CIDR ranges) - The organizational domain of the reverse DNS (PTR) record.-- A verified DKIM domain. ### Create an allow entry for the sender/recipient pair |
| security | Learn About Spoof Intelligence | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/learn-about-spoof-intelligence.md | On the **Spoof intelligence insight** page that appears after you click **View s - **Sending infrastructure**: Also known as the _infrastructure_. The sending infrastructure will be one of the following values: - The domain found in a reverse DNS lookup (PTR record) of the source email server's IP address. - If the source IP address has no PTR record, then the sending infrastructure is identified as \<source IP\>/24 (for example, 192.168.100.100/24).- - A verified DKIM domain. - **Message count**: The number of messages from the combination of the spoofed domain _and_ the sending infrastructure to your organization within the last 7 days. - **Last seen**: The last date when a message was received from the sending infrastructure that contains the spoofed domain. - **Spoof type**: One of the following values: |
| security | Connect Microsoft Defender For Office 365 To Microsoft Sentinel | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/connect-microsoft-defender-for-office-365-to-microsoft-sentinel.md | Take advantage of rich security information events management (SIEM) combined wi > The Microsoft 365 Defender connector is currently in **PREVIEW**. See the Supplemental Terms of Use for Microsoft Azure Previews for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.> ## What you will need-- Microsoft Defender for Office 365 Plan 2 or higher.+- Microsoft Defender for Office 365 Plan 2 or higher. (Included in E5 plans) - Microsoft Sentinel [Quickstart guide](/azure/sentinel/quickstart-onboard). - Sufficient permissions (Security Administrator in M365 & Read / Write permissions in Sentinel). |
| security | Ensuring You Always Have The Optimal Security Controls With Preset Security Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/ensuring-you-always-have-the-optimal-security-controls-with-preset-security-policies.md | Preset security policies allow you to select a security profile of either Standa As new controls are added or if the best practice setting for a security control changes with the evolving threat landscape, Microsoft will automatically update security control settings for users assigned to a Standard or Strict preset security policy. By using Security Preset policies, you will always have MicrosoftΓÇÖs recommended, best practice configuration for your users. ## What you will need-- Microsoft Defender for Office 365 Plan 1+- Microsoft Defender for Office 365 Plan 1 or higher (Included in E5) - Sufficient permissions (Security Administrator role) - 5 minutes to perform the steps below. |
| security | How To Configure Quarantine Permissions With Quarantine Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/how-to-configure-quarantine-permissions-with-quarantine-policies.md | Providing security admins and users with a very simple way to manage false posit ## Creating Custom quarantine policies with Request release flow -Our custom polices give admins the ability to decide what items their users can triage in the ***False positive*** folder with an extended ability of allowing the user to request the *release* of those items from the folder. +Our custom policies give admins the ability to decide what items their users can triage in the ***False positive*** folder with an extended ability of allowing the user to request the *release* of those items from the folder. 1. Decide what verdicts category (bulk, spam, phish, high confidence phish, or malware) of items you want your user to triage and not triage. 1. For those categories that you donΓÇÖt want the users to triage, assign the items to the **AdminOnlyPolicy**. As for the category you want users to triage with limited access, you can *create a custom policy* with a request release access and assign users to that category. Our custom polices give admins the ability to decide what items their users can > [!IMPORTANT] > For more information on how granular custom policies can be created, see [Quarantine policies - Office 365 | Microsoft Docs](../../office-365-security/quarantine-policies.md). -## Assigning quarantine polices and enabling notification with organization branding +## Assigning quarantine policies and enabling notification with organization branding -Once it has been decided the categories of items users can triage or not-triage, and created the corresponding quarantine polices, admins should to assign these policies to the respective users and enable notifications. +Once it has been decided the categories of items users can triage or not-triage, and created the corresponding quarantine policies, admins should to assign these policies to the respective users and enable notifications. 1. Identify the users, groups, or domains that you would like to include in the *full access* category vs. the *limited access* category, versus the *Admin-Only* category. 1. Sign in to the [Microsoft Security portal](https://security.microsoft.com). |
| security | How To Handle False Negatives In Microsoft Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-negatives-in-microsoft-defender-for-office-365.md | Defender for Office 365 can help you understand why emails are getting delivered ## What you'll need -- Microsoft Defender for Office 365 Plan 1 and 2 (included as part of E3, E5). EOP customers can also leverage this.+- Microsoft Defender for Office 365 Plan 1 and 2 (included as part of E5). Exchange Online customers can also leverage this. - Sufficient permissions (Security Administrator role). - 5-10 minutes to perform the steps below. ## Handling malicious emails in the Inbox folder of end users 1. Ask end users to report the email as **phishing** or **junk** using Microsoft Message Add-in or Microsoft Phish add-in or the Outlook buttons.-2. End users can also add the sender to the [block senders list](https://support.microsoft.com/en-us/office/block-a-mail-sender-b29fd867-cac9-40d8-aed1-659e06a706e4#:~:text=1%20On%20the%20Home%20tab%2C%20in%20the%20Delete,4%20Click%20OK%20in%20both%20open%20dialog%20boxes..) in Outlook to prevent emails from this sender's mail from arrive at Inboxes. +2. End users can also add the sender to the [block senders list](https://support.microsoft.com/en-us/office/block-a-mail-sender-b29fd867-cac9-40d8-aed1-659e06a706e4#:~:text=1%20On%20the%20Home%20tab%2C%20in%20the%20Delete,4%20Click%20OK%20in%20both%20open%20dialog%20boxes..) in Outlook to prevent emails from this sender being delivered to their inbox. 3. Admins can triage the user reported messages from [user reported content](/microsoft-365/security/office-365-security/admin-submission?view=o365-worldwide#view-user-submissions-to-microsoft) portal. 4. From those reported messages, admins can **submit to** [Microsoft for analysis](/microsoft-365/security/office-365-security/admin-submission?view=o365-worldwide#notify-users-from-within-the-portal) to learn why that email was allowed in the first place. 5. If needed, while submitting to Microsoft for analysis, admins can create a [block for the sender](/microsoft-365/security/office-365-security/manage-tenant-blocks?view=o365-worldwide) to mitigate the problem. Defender for Office 365 can help you understand why emails are getting delivered ## Handling malicious emails landing in the quarantine folder of admins 1. Admins can view the quarantined emails (including the ones asking permission to request release) from the [review page](/microsoft-365/security/office-365-security/manage-quarantined-messages-and-files?view=o365-worldwide).-2. Admins can submit any malicious, or suspect messages to Microsoft for analysis, and create a block to mitigate the situation while waiting for verdict. +2. Admins can submit any malicious, or suspicous messages to Microsoft for analysis, and create a block to mitigate the situation while waiting for verdict. 3. Once the results for submissions are available, read the verdict to learn why the emails were allowed, and how your tenant setup could be improved to prevent similar situations from happening in the future. |
| security | How To Handle False Positives In Microsoft Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-positives-in-microsoft-defender-for-office-365.md | Microsoft Defender for Office 365 helps deal with important legitimate business ## What you'll need -- Microsoft Defender for Office 365 Plan 1 or 2 (included as part of E3, E5). EOP customers can also leverage this feature.+- Microsoft Defender for Office 365 Plan 1 or 2 (included as part of E5). Exchange Online customers can also leverage this feature. - Sufficient permissions (Security Administrator role). - 5-10 minutes to perform the steps below. Microsoft Defender for Office 365 helps deal with important legitimate business 1. An end user receives an [email digest](/microsoft-365/security/office-365-security/use-spam-notifications-to-release-and-report-quarantined-messages?view=o365-worldwide) about quarantined messages as per the settings enabled by security admins. 2. End users can preview the messages in quarantine, block the sender, release the messages, submit those messages to Microsoft for analysis, and request release of those emails from admins. -## Handling legitimate emails emails in quarantine folder of an admin +## Handling legitimate emails in quarantine folder of an admin 1. Admins can view the quarantined emails (including the ones asking permission to request release) from the [review page](/microsoft-365/security/office-365-security/manage-quarantined-messages-and-files?view=o365-worldwide). 2. Admins can release the message from quarantine while submitting it to Microsoft for analysis, and create an allow to mitigate the situation.-3. Once the results for submissions are available, admins should read the verdict to understand why emails were blocked, and how the tenant setup could be improved to prevent similar situations from happening in the future. +3. Once the results for submissions are available, admins should read the verdict to understand why emails were blocked, and how the tenant setup could be improved to prevent similar situations from happening in the future. |
| security | How To Prioritize And Manage Automated Investigations And Response Air | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/how-to-prioritize-and-manage-automated-investigations-and-response-air.md | As automated investigations on *Email & collaboration* content results in verdic ## What youΓÇÖll need -- Microsoft Defender for Office 365 Plan 2 or higher+- Microsoft Defender for Office 365 Plan 2 or higher (Included with E5) - Sufficient permissions (Security reader, security operations, or security administrator, plus [Search and purge](../permissions-microsoft-365-security-center.md) role) ## Steps to analyze and approve AIR actions directly from the Action Center As automated investigations on *Email & collaboration* content results in verdic 1. Navigate to the [Microsoft 365 Defender portal](https://security.microsoft.com) and sign in. 2. In the left-hand navigation pane, expand **Action & submissions** then click **Action Center**. 3. When the Action Center loads press the **History** tab.-4. View the history of AIR, including decisions made, source of action, and admin who made the decision,if appropriate. +4. View the history of AIR, including decisions made, source of action, and admin who made the decision, if appropriate. ## More Information [View the results of an automated investigation in Microsoft 365 - Office 365 | Microsoft Docs](../air-view-investigation-results.md) -[Learn about approving and rejecting pending actions from the Investigation page](../air-review-approve-pending-completed-actions.md) +[Learn about approving and rejecting pending actions from the Investigation page](../air-review-approve-pending-completed-actions.md) |
| security | Optimize And Correct Security Policies With Configuration Analyzer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/optimize-and-correct-security-policies-with-configuration-analyzer.md | ms.technology: mdo Configuration analyzer is a central location and single pane of glass for administering and viewing the email security policies you have configured in your tenant. You can perform a side-to-side comparison of your settings to our Standard and Strict recommended settings, apply recommendations and view historical changes that affected your posture. ## What youΓÇÖll need-- Microsoft Defender for Office 365 Plan 1+- Exchange Online Protection - Sufficient permissions (Security Administrator role) - 5 minutes to perform the steps below. |
| security | Protect Your C Suite With Priority Account Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/protect-your-c-suite-with-priority-account-protection.md | To learn what priority account tags are see [Manage and monitor priority account [Review the differentiated protection for users tagged as priority accounts](../../office-365-security/configure-review-priority-account.md). ## PowerShell configuration-If you want to achieve these steps via PowerShell, you can do this using the following cmdlets: +If you want to achieve these steps via [PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), you can do this using the following cmdlets: 1. View a list of priority accounts: **Get-User -IsVIP | select Identity** 1. Add user to list of priority accounts: **Set-User -VIP:$true -Identity \<Identity\>** 1. Remove user from list of priority accounts: **Set-User -VIP:$false -Identity \<Identity\>** |
| security | Search For Emails And Remediate Threats | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/search-for-emails-and-remediate-threats.md | ms.technology: mdo Email remediation is an already existing feature that helps admins act on emails that are threats. ## What youΓÇÖll need-- Microsoft Defender for Office 365 Plan 2+- Microsoft Defender for Office 365 Plan 2 (Included in E5 plans) - Sufficient permissions (be sure to grant the account [Search and Purge](https://sip.security.microsoft.com/securitypermissions) role) ## Create and track the remediation |
| security | Stay Informed With Message Center | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/stay-informed-with-message-center.md | The message center is where you can learn about official service announcements a [Video](https://www.microsoft.com/en-us/videoplayer/embed/RE4C7Ne) ## Learn More-[Track new and changed features in the Microsoft 365 Message center](https://docs.microsoft.com/microsoft-365/admin/manage/message-center) +[Track new and changed features in the Microsoft 365 Message center](../../../admin/manage/message-center.md) [Track your message center tasks in Planner](/office365/planner/track-message-center-tasks-planner) |
| security | Tenant Allow Block List | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-allow-block-list.md | A domain pair for a spoofed sender in the Tenant Allow/Block List uses the follo - **Sending infrastructure**: This value indicates the source of messages from the spoofed user. Valid values include: - The domain found in a reverse DNS lookup (PTR record) of the source email server's IP address (for example, fabrikam.com). - If the source IP address has no PTR record, then the sending infrastructure is identified as \<source IP\>/24 (for example, 192.168.100.100/24).- - A verified DKIM domain. Here are some examples of valid domain pairs to identify spoofed senders: |
| security | Walkthrough Spoof Intelligence Insight | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/walkthrough-spoof-intelligence-insight.md | To configure allowed and blocked senders in spoof intelligence, follow these ste ``` 2. Edit the CSV file to add or modify the following values:- - **Sender** (domain in source server's PTR record, IP/24 address, or verified DKIM domain) + - **Sender** (domain in source server's PTR record or IP/24 address) - **SpoofedUser**: One of the following values: - The internal user's email address. - The external user's email domain. |
| security | Whats New In Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/whats-new-in-defender-for-office-365.md | This article lists new features in the latest release of Microsoft Defender for Learn more by watching [this video](https://www.youtube.com/watch?v=Tdz6KfruDGo&list=PL3ZTgFEc7LystRja2GnDeUFqk44k7-KXf&index=3). -> [!TIP] -> Don't have Microsoft Defender for Office 365 yet? [Contact sales to start a trial](https://info.microsoft.com/ww-landing-M365SMB-web-contact.html). - For more information on what's new with other Microsoft Defender security products, see: - [What's new in Microsoft 365 Defender](../defender/whats-new.md) For more information on what's new with other Microsoft Defender security produc - [What's new in Microsoft Defender for Identity](/defender-for-identity/whats-new) - [What's new in Microsoft Cloud App Security](/cloud-app-security/release-notes) + ## June 2022 - [simplifying the quarantine experience part Two in Microsoft 365 Defender for office 365](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/simplifying-the-quarantine-experience-part-two/ba-p/3354687): simplifying the quarantine experience part Two with Microsoft Defender for Office 365. |
| test-base | Createaccount | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/test-base/createaccount.md | To create a **Test Base** account, perform the steps that follow. 1. On the home page of the [Azure portal](https://ms.portal.azure.com/#home), search the **Test Base for Microsoft 365** in the Azure marketplace to display the controls for creating a **Test Base** account. - [  ](Media/creatingaccount01-search.png#lightbox) + > [!div class="mx-imgBorder"] + > [  ](Media/creatingaccount01-search.png#lightbox) 2. In the controls field of the **Test Base for Microsoft 365** page, select the **Create** button as that follows to open the **Create Test Base Account** page. - [  ](Media/creatingaccount02-testbase.png#lightbox) + > [!div class="mx-imgBorder"] + > [  ](Media/creatingaccount02-testbase.png#lightbox) 3. On the **Create Test Base Account** page, add your information to the following required input fields on the **Create Test Base Account** page: To create a **Test Base** account, perform the steps that follow. > [!NOTE] > You must provide input for all required fields (*). - [  ](Media/creatingaccount03-basics.png#lightbox) + > [!div class="mx-imgBorder"] + > [  ](Media/creatingaccount03-basics.png#lightbox) > [!NOTE] > As of April 2022, **Test Base** supports the **Standard** pricing tier only. The **Pricing tier** determines the resource and hourly service cost that is charged to your Azure subscription. -  + > [!div class="mx-imgBorder"] + >  4. Read the **Terms of Use**. If the terms are acceptable, select the checkbox to confirm that you have read and accept the terms of use. -  + > [!div class="mx-imgBorder"] + >  5. In the lower sector of the **Create Test Base Account** page, select **Review + create** to validate the input data you specified. If the validation process succeeds, you can review your input data configuration in the **Create Test Base Account** page. - [  ](Media/creatingaccount06-review.png#lightbox) + > [!div class="mx-imgBorder"] + > [  ](Media/creatingaccount06-review.png#lightbox) 6. Select the **Create** button that is shown in the lower sector of the previous **Create Test Base Account** page. -  + > [!div class="mx-imgBorder"] + >  7. On your user **Deployment** page, select **Go to resource** to open your new **Test Base** account Overview page and begin your exploration, configuration, and journey of **Test Base**. - [  ](Media/creatingaccount08-complete.png#lightbox) + > [!div class="mx-imgBorder"] + > [  ](Media/creatingaccount08-complete.png#lightbox) |