| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Activity Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/activity-reports/activity-reports.md | Depending on your subscription, here are the available reports in all environmen |[OneDrive for Business usage](onedrive-for-business-usage-ww.md)|Yes|Yes|Yes|Yes|Yes| |[SharePoint site usage](sharepoint-site-usage-ww.md)|Yes|Yes|Yes|Yes|Yes| |[SharePoint activity](sharepoint-activity-ww.md)|Yes|Yes|Yes|Yes|Yes|-|[Microsoft Teams user activity](microsoft-teams-user-activity-preview.md)|Yes|Yes|Yes|Yes|N/A<sup>1</sup>| -|[Microsoft Teams device usage](microsoft-teams-device-usage-preview.md)|Yes|Yes|Yes|Yes|N/A<sup>1</sup>| -|[Microsoft Teams team activity](microsoft-teams-usage-activity.md)|Yes|Yes|Yes|Yes|N/A<sup>1</sup>| +|[Microsoft Teams user activity](microsoft-teams-user-activity-preview.md)|Yes|Yes|Yes|Yes|Yes| +|[Microsoft Teams device usage](microsoft-teams-device-usage-preview.md)|Yes|Yes|Yes|Yes|Yes| +|[Microsoft Teams team activity](microsoft-teams-usage-activity.md)|Yes|Yes|Yes|Yes|Yes| |[Yammer activity](yammer-activity-report-ww.md)|Yes|Yes|N/A<sup>2</sup>|N/A<sup>2</sup>|N/A<sup>2</sup>| |[Yammer device usage](yammer-device-usage-report-ww.md)|Yes|Yes|N/A<sup>2</sup>|N/A<sup>2</sup>|N/A<sup>2</sup>| |[Yammer groups activity report](yammer-groups-activity-report-ww.md)|Yes|Yes|N/A<sup>2</sup>|N/A<sup>2</sup>|N/A<sup>2</sup>| |
| admin | Configure A Shared Mailbox | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/email/configure-a-shared-mailbox.md | After you have [created a shared mailbox](create-a-shared-mailbox.md), you'll wa ## Change the name or email alias of a shared mailbox, or change the primary email address -1. In the admin center, go to the **Groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a> page. +1. In the admin center, go to **Teams & groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a>. -2. Select the shared mailbox you want to edit, and then select **Edit** next to **Name, Email, Email aliases**. +2. Select the shared mailbox you want to edit, and then select either **Edit name** or **Edit email addresses**. -3. Enter a new name, or add another alias. If you want to change the primary email address, your mailbox must have more than one email alias. +3. Enter a new name for the shared mailbox, or add another email alias. If you want to change the primary email address, your mailbox must have more than one email alias. 4. Select **Save**. After you have [created a shared mailbox](create-a-shared-mailbox.md), you'll wa You do not need to assign a license to the shared mailbox in order to forward email that's sent to it. You can forward the messages to any valid email address or distribution list. -1. In the admin center, go to the **Groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a> page. +1. In the admin center, go to **Teams & groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a>. 2. Select the shared mailbox you want to edit, then select **Email forwarding** \> **Edit**. You do not need to assign a license to the shared mailbox in order to forward em ## Send automatic replies from a shared mailbox -1. In the admin center, go to the **Groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a> page. +1. In the admin center, go to **Teams & groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a>. 2. Select the shared mailbox you want to edit, then select **Automatic replies** \> **Edit**. If you want to allow everyone to see the Sent email, in the admin center, edit t ## Choose the apps that a shared mailbox can use to access Microsoft email -1. In the admin center, go to the **Groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a> page. +1. In the admin center, go to **Teams & groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a>. 2. Select the shared mailbox you want to edit, then select **Email apps** \> **Edit**. If you want to allow everyone to see the Sent email, in the admin center, edit t To learn more about litigation hold, see [Create a Litigation Hold](../../compliance/ediscovery-create-a-litigation-hold.md). -1. In the admin center, go to the **Groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a> page. +1. In the admin center, go to **Teams & groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a>. 2. Select the shared mailbox you want to edit, then select **Litigation hold** \> **Edit**. To learn more about litigation hold, see [Create a Litigation Hold](../../compli ## Add or remove members -1. In the admin center, go to the **Groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a> page. +1. In the admin center, go to **Teams & groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a>. 2. Select the shared mailbox you want to edit, then select **Members** \> **Edit**. To learn more about litigation hold, see [Create a Litigation Hold](../../compli ## Add or remove permissions of members -1. In the admin center, go to the **Groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a> page. +1. In the admin center, go to **Teams & groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a>. 2. Select the shared mailbox you want to edit, then select **Members** \> **Customize permissions**. To learn more about litigation hold, see [Create a Litigation Hold](../../compli If you choose not to show the shared mailbox in the global address list, the mailbox won't appear in your organization's address list, but it will still receive email sent to it. -1. In the admin center, go to the **Groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a> page. +1. In the admin center, go to **Teams & groups** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2066847" target="_blank">Shared mailboxes</a>. 2. Select the shared mailbox you want to edit, then select **Show in global address list** \> **Edit**. |
| admin | Release Options In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/release-options-in-office-365.md | A good practice is to leave the majority of users in **Standard release** and IT With this option, you and your users can be the first to see the latest updates and help shape the product by providing early feedback. You can choose to have individuals or the entire organization receive updates early. > [!IMPORTANT]-> Large or complex updates may take longer than others so that no users are adversely affected. There is no guarantee on the exact timeline of a release. Targeted release is now available for customers with either the Office 365 GCC plan or the Office 365 GCC High plan and DoD plan for the following +> Large or complex updates may take longer than others so that no users are adversely affected. There is no guarantee on the exact timeline of a release. Targeted release is now available for customers with either the Office 365 GCC plan or the Office 365 GCC High plan and DoD plan for the following ### Targeted release for entire organization |
| admin | Room And Equipment Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/room-and-equipment-mailboxes.md | f1.keywords: Previously updated : 02/18/2020 Last updated : 06/09/2023 audience: Admin To use room or equipment mailboxes, open Outlook from your computer or sign in t 1. Open **Outlook** on your computer. -2. On the **Home** tab, choose **New Items** \> **Meeting**. +2. On the **Home** tab, choose **New event**.  To set up a room or equipment mailbox, go to the <a href="https://go.microsoft.c 1. In the admin center, go to the **Resources** \> [Rooms & equipment](https://go.microsoft.com/fwlink/p/?linkid=2067334) page. -2. Select **Add**. +2. Select **+ Add resource**. 3. Fill out the room or equipment fields: To set up a room or equipment mailbox, go to the <a href="https://go.microsoft.c - **Phone number**: the number of the room itself. This is different from the meeting phone number generated when using Microsoft Teams. -4. Select **Add**. - -5. Select the room or equipment mailbox you created to see or edit the details. - -6. If you made changes, select **Save** and then **Close**. +4. Select **Save**. > [!Note] > To keep your room and equipment mailboxes secure, block sign-in to these mailboxes. For more information, see [Block sign-in for the shared mailbox account](/office365/admin/email/create-a-shared-mailbox#block-sign-in-for-the-shared-mailbox-account). |
| admin | Create Signatures And Disclaimers | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/setup/create-signatures-and-disclaimers.md | f1.keywords: Previously updated : 02/19/2020 Last updated : 06/09/2023 audience: Admin Check out [Microsoft 365 small business help](https://go.microsoft.com/fwlink/?l You can manage email signatures by adding an email signature, legal disclaimer, or disclosure statement to the email messages that enter or leave your organization. You can set it up to apply to all incoming and outgoing messages as shown below. Or you can apply it to certain messages like those containing specific words or text patterns. -## Watch: Create a company-wide email signature - +## Create a signature that applies to all messages + Check out this video and others on our [YouTube channel](https://go.microsoft.com/fwlink/?linkid=2198031). > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE1IEWf] 1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>, select **Exchange**. 1. Select **Mail flow**.-1. Select **Add +**, and then select **Apply disclaimers**. +1. Select **Rules**. +1. Select **Add a rule +**, and then select **Apply disclaimers**. 1. On the **New rule** page, complete the steps. If you found this video helpful, check out the [complete training series for small businesses and those new to Microsoft 365](../../business-video/index.yml). -## Create a signature that applies to all messages - > [!TIP] > Organization-wide signatures are called "disclaimers," regardless of what they include. For example, they can just be a signature, or also include your address, legal disclaimer, or other information you want. Go to the admin center at <a href="https://go.microsoft.com/fwlink/p/?linkid=850 ::: moniker-end 1. Select the app launcher , and then select **Admin**.- - Can't find the app you're looking for? From the app launcher, select **All apps** to see an alphabetical list of the apps available to you. From there, you can search for a specific app. - -2. Select **Admin centers**, and then choose **Exchange**. - -3. Under Mail flow, select **Rules**. - -4. Select the **+** (Add) icon and choose **Apply disclaimers**. - -5. Give the rule a name. - -6. Under **Apply this rule**, select **[Apply to all messages]**. - - > [!TIP] - > [Learn more](/Exchange/policy-and-compliance/mail-flow-rules/signatures#Scoping) about applying conditions if you don't want the disclaimer applied to all messages. (This scoping article is for Exchange Server, but it also applies to Microsoft 365.) ++1. Select **Admin centers**, and then choose **Exchange**. ++1. Under Mail flow, select **Rules**. ++1. Select the **+** (Add) icon and choose **Apply disclaimers**. ++1. Give the rule a name. ++1. Under **Apply this rule**, select **[Apply to all messages]**. -7. Under Do the following, leave **Append the disclaimer** selected. - -8. Select **Enter text** and type your disclaimer. - - > [!TIP] - > [Learn more](/Exchange/policy-and-compliance/mail-flow-rules/signatures#FormatDisclaimer) about formatting disclaimers. (This formatting article is for Exchange Server, but it also applies to Microsoft 365.) +1. Under Do the following, leave **Append the disclaimer** selected. -9. Select **Select one** and choose **Wrap** as a fallback option. Then **OK**. This means that if the disclaimer can't be added because of encryption or another mail setting, it will be wrapped in a message envelope. - -10. Leave **Audit this rule with severity level** selected. Then choose **Low**, **Medium**, or **High** to be used in the message log. - -11. Choose **Enforce** to turn on the disclaimer immediately, unless you want to test it first. - -12. Choose **More options** to include additional conditions or exceptions. - -13. Choose **Save** when finished. +1. Select **Enter text**, type your disclaimer, and then select **Save**. ++1. Select **Select one**, choose **Wrap** as a fallback option, and then select **Save**. This means that if the disclaimer can't be added because of encryption or another mail setting, it will be wrapped in a message envelope. ++1. Under **Except if**, choose whether you want exceptions for sender, recipient, attachment and more and follow those steps. ++1. Choose **Next**. ++1. Under **Rule mode**, choose **Enforce** to turn on the disclaimer immediately, otherwise, choose **Test with Policy Tips** or **Test without Policy Tips**. ++1. Choose a Severity level. ++1. Choose **Activate this rule on** and specify a date. ++1. Choose **Deactivate this rule on** and specify a date. ++1. Choose **Stop processing more rules** if you only want this signature rule to run. ++1. Choose **Defer the message** if rule processing doesnΓÇÖt complete if you want this experience. ## Limitations of organization wide signatures |
| commerce | Cancel Your Subscription | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/cancel-your-subscription.md | This article only applies to canceling **Dynamics 365**, **Intune**, **Power Pla > [!WARNING] > Before you cancel a subscription, make sure your users [save their data](#save-your-data). -**In this article:** --[Before you begin](#before-you-begin)\ -[What's the easiest way to cancel?](#whats-the-easiest-way-to-cancel)\ -[How do I cancel my free trial?](#how-do-i-cancel-my-free-trial)\ -[What if I bought my subscription through a partner?](#what-if-i-bought-my-subscription-through-a-partner)\ -[Determine your cancellation options](#determine-your-cancellation-options)\ -[Steps to cancel your subscription](#steps-to-cancel-your-subscription)\ -[Save your data](#save-your-data)\ -[Next steps](#next-steps)\ -[Related content](#related-content) - ## Before you begin - You must be a Global or Billing admin to do the tasks in this article. For more information, see [About admin roles](../../admin/add-users/about-admin-roles.md). |
| commerce | Move Users Different Subscription | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/move-users-different-subscription.md | Before being switched to a different subscription, users can [download files and ### Save Yammer information -Admins can export all messages, notes, files, topics, users, and groups to a .zip file. For more information, see [Export data from Yammer Enterprise](/yammer/manage-security-and-compliance/export-yammer-enterprise-data). Developers can use the [Yammer API](https://go.microsoft.com/fwlink/p/?linkid=842495) to do this, as well. +Admins can export all messages, notes, files, topics, users, and groups to a .zip file. For more information, see [Export data from Yammer Enterprise](/yammer/manage-security-and-compliance/export-yammer-enterprise-data). ### How to save SharePoint information |
| compliance | Apply Sensitivity Label Automatically | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/apply-sensitivity-label-automatically.md | There are two different methods for automatically applying a sensitivity label t - These files can be auto-labeled at rest before or after the auto-labeling policies are created. Files can't be auto-labeled if they're part of an open session (the file is open). - Currently, attachments to list items aren't supported and won't be auto-labeled. - Maximum of 25,000 automatically labeled files in your tenant per day.- - Maximum of 100 auto-labeling policies per tenant, each targeting up to 100 sites (SharePoint or OneDrive) when they're specified individually. You can also specify all sites, and this configuration is exempt from the 100 sites maximum. + - Maximum of 100 auto-labeling policies per tenant, each targeting up to 100 locations (SharePoint sites or OneDrive individual users or groups) when you specify specific locations by using the **Included** or **Excluded** options. If you keep the default configuration of **All**, this configuration is exempt from the 100 locations maximum. - Existing values for modified, modified by, and the date aren't changed as a result of auto-labeling policiesΓÇöfor both simulation mode and when labels are applied. - When the label applies encryption, the [Rights Management issuer and Rights Management owner](/azure/information-protection/configure-usage-rights#rights-management-issuer-and-rights-management-owner) is the account that last modified the file. Finally, you can use simulation mode to provide an approximation of the time nee 4. For the page **Name your auto-labeling policy**: Provide a unique name, and optionally a description to help identify the automatically applied label, locations, and conditions that identify the content to label. -5. For the page **Assign admin units**: This configuration is currently in preview. If your organization is using [administrative units in Azure Active Directory](/azure/active-directory/roles/administrative-units), an auto-labeling policy for just Exchange can be automatically restricted to specific users by selecting administrative units. If your account has been [assigned administrative units](microsoft-365-compliance-center-permissions.md#administrative-units-preview), you must select one or more administrative units. +5. For the page **Assign admin units**: This configuration is currently in preview. If your organization is using [administrative units in Azure Active Directory](/azure/active-directory/roles/administrative-units), auto-labeling policies for Exchange and OneDrive can be automatically restricted to specific users by selecting administrative units. If your account has been [assigned administrative units](microsoft-365-compliance-center-permissions.md#administrative-units-preview), you must select one or more administrative units. If you don't want to restrict the policy by using administrative units, or your organization hasn't configured administrative units, keep the default of **Full directory**. + > [!NOTE] + > If you are editing an existing policy and change the administrative units, you must now reconfigure the locations in the next step. + 6. For the page **Choose locations where you want to apply the label**: Select and specify locations for Exchange, SharePoint, and OneDrive. If you don't want to keep the default of **All** included for your chosen locations, select the link to choose specific instances to include, or select the link to choose specific instances to exclude. Then select **Next**.  > [!NOTE] > For organizations that are using administrative units:- > - > - If you selected the option to use administrative units in the previous step, the locations for SharePoint sites and OneDrive accounts become unavailable. Only auto-labeling policies exclusingly for Exchange support administrative units. - > - When you use the **Included** or **Excluded** options, you will see and can select only users from the administrative units selected in the previous step. + > - If you selected the option to use administrative units in the previous step, the location for SharePoint sites becomes unavailable. Only auto-labeling policies for Exchange and OneDrive support administrative units. + > - When you use the **Included** or **Excluded** options, you will see and can select only users from the administrative units selected in the previous step. If you use the **Included** or **Excluded** options: Finally, you can use simulation mode to provide an approximation of the time nee - If you change the default of **All** included and instead, choose specific users or groups, email sent from outside your organization will be exempt from the policy. - If you keep the default of **All** included but specify users or groups to exclude, email that these excluded users send will be exempt from the policy, but not email that they receive. - - For OneDrive accounts, see [Get a list of all user OneDrive URLs in your organization](/onedrive/list-onedrive-urls) to help you specify individual OneDrive accounts to include or exclude. + - Rolling out: For the OneDrive location, you must specify users or groups. Previously, you had to specify sites by URLs. Any existing OneDrive URL sites in auto-labeling policies will continue to work but before you can specify new OneDrive locations, or for restricted admins, you must first delete any existing site URLs. Groups supported: distribution groups, Microsoft 365 groups, mail-enabled security groups, and security groups. 7. For the **Set up common or advanced rules** page: Keep the default of **Common rules** to define rules that identify content to label across all your selected locations. If you need different rules per location, including more options for Exchange, select **Advanced rules**. Then select **Next**. You can also see the results of your auto-labeling policy by using [content expl - **Content Explorer List Viewer** role group lets you see a file's label but not the file's contents. - **Content Explorer Content Viewer** role group, and **Information Protection** and **Information Protection Investigators** role groups let you see the file's contents. +However currently, restricted admins won't be able to see labeling activities for OneDrive in activity explorer. + > [!TIP] > You can also use content explorer to identify locations that have documents with sensitive information, but are unlabeled. Using this information, consider adding these locations to your auto-labeling policy, and include the identified sensitive information types as rules. |
| compliance | Audit Log Activities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/audit-log-activities.md | f1.keywords: Previously updated : 05/11/2023 Last updated : 06/12/2023 audience: Admin The following table lists the activities in Microsoft To Do that are logged in t |TaskList updated|TaskListUpdated |A task list was updated.| |User invited|UserInvited|Invited user to a folder.| -## Microsoft Workplace Analytics activities +## Microsoft Viva Insights activities -Workplace Analytics provides insight into how groups collaborate across your organization. The following table lists activities performed by users that are assigned the Administrator role or the Analyst roles in Workplace Analytics. Users assigned the Analyst role have full access to all service features and use the product to do analysis. Users assigned the Administrator role can configure privacy settings and system defaults, and can prepare, upload, and verify organizational data in Workplace Analytics. For more information, see [Workplace Analytics](/workplace-analytics/index-orig). +Viva Insights provides insight into how groups collaborate across your organization. The following table lists activities performed by users that are assigned the Administrator role or the Analyst roles in Viva Insights. Users assigned the Analyst role have full access to all service features and use the product to do analysis. Users assigned the Administrator role can configure privacy settings and system defaults, and can prepare, upload, and verify organizational data in Viva Insights. For more information, see [Introducing Microsoft Viva Insights](/viva/insights/introduction). |Friendly name|Operation|Description| |:--|:--|:--| Workplace Analytics provides insight into how groups collaborate across your org |Viewed Explore|ViewedExplore|Analyst viewed visualizations in one or more Explore page tabs.| > [!NOTE]-> <sup>*</sup>These are Azure Active Directory sign in and sign off activities. These activities are logged even if you don't have Workplace Analytics turned on in your organization. For more information about user sign in activities, see [Sign-in logs in Azure Active Directory](/azure/active-directory/reports-monitoring/concept-sign-ins). +> <sup>*</sup>An Azure Active Directory sign in and sign off activity event is created when a user signs in. This activity is logged even if you don't have Viva Insights turned on in your organization. For more information about user sign in activities, see [Sign-in logs in Azure Active Directory](/azure/active-directory/reports-monitoring/concept-sign-ins). -## MyAnalytics activities +## Personal insights activities -The following table lists the activities in MyAnalytics that are logged in the Microsoft 365 audit log. For more information about MyAnalytics, see [MyAnalytics for admins](/workplace-analytics/myanalytics/overview/mya-for-admins). +The following table lists the activities in personal insights that are logged in the Microsoft 365 audit log. For more information about personal insights, see [Admin guide for personal insights](/viva/insights/personal/Overview/mya-for-admins). |Friendly name|Operation|Description| |:--|:--|:--|-|Updated organization MyAnalytics settings|UpdatedOrganizationMyAnalyticsSettings|Admin updates organization-level settings for MyAnalytics. | -|Updated user MyAnalytics settings|UpdatedUserMyAnalyticsSettings|Admin updates user settings for MyAnalytics.| +|Updated organization MyAnalytics settings|UpdatedOrganizationMyAnalyticsSettings|Admin updates organization-level settings for personal insights. | +|Updated user MyAnalytics settings|UpdatedUserMyAnalyticsSettings|Admin updates user settings for personal insights.| ## Power BI activities |
| compliance | Audit Log Search | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/audit-log-search.md | f1.keywords: Previously updated : 05/11/2023 Last updated : 06/12/2023 audience: Admin Why a unified audit log? Because you can search the audit log for activities per |Stream|MicrosoftStream| |SystemSync|DataShareCreated, DataShareDeleted, GenerateCopyOfLakeData, DownloadCopyOfLakeData| |Threat Intelligence|ThreatIntelligence, ThreatIntelligenceUrl, ThreatFinder, ThreatIntelligenceAtpContent|-|Viva Goals|Viva Goals| -|Workplace Analytics|WorkplaceAnalytics| +|Viva Goals|VivaGoals| +|Viva Insights|VivaInsights| |Yammer|Yammer| For more information about the operations that are audited in each of the services listed in the previous table, see the [Audit log activities](audit-log-activities.md) article. |
| compliance | Communication Compliance Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-policies.md | The following table explains more about each condition. | **Content matches any of these classifiers** | Apply to the policy when any classifiers are included or excluded in a message. Some classifiers are pre-defined in your organization, and custom classifiers must be configured separately before they're available for this condition. Only one classifier can be defined as a condition in a policy. For more information about configuring classifiers, see [Learn about trainable classifiers](/microsoft-365/compliance/classifier-learn-about). | | **Content contains any of these sensitive info types** | Apply to the policy when any sensitive information types are included or excluded in a message. Some classifiers are pre-defined in your tenant, and custom classifiers can be configured separately or as part of the condition assignment process. Each sensitive information type you choose is applied separately and only one of these sensitive information types must apply for the policy to apply to the message. For more information about custom sensitive information types, see [Learn about sensitive information types](/microsoft-365/compliance/sensitive-information-type-learn-about). | | **Message is received from any of these domains** <br><br> **Message is not received from any of these domains** | Apply the policy to include or exclude specific domains in received messages. Enter each domain and separate multiple domains with a comma. Do not include spaces between items separated by a comma. Each domain entered is applied separately, only one domain must apply for the policy to apply to the message. If you want to use **Message is received from any of these domains** to look for messages from specific emails address you need to combine this with another condition like **Message contains any of these words** or **Content matches any of these classifiers** or you might get unexpected results. <br><br> If you want to scan all email from a specific domain, but want to exclude messages that don't need review (newsletters, announcements, and so on), you must configure a **Message is not received from any of these domains** condition that excludes the email address (example newsletter@contoso.com). |-| **Message is sent to any of these domains** <br><br> **Message is not sent to any of these domains** | Apply the policy to include or exclude specific domains in sent messages. Enter each domain and separate multiple domains with a comma. Do not include spaces between items separated by a comma. Each domain is applied separately, only one domain must apply for the policy to apply to the message. <br><br> If you want to exclude all emails sent to two specific domains, you'd configure the **Message is not sent to any of these domains** condition with the two domains (example 'contoso.com,wingtiptoys.com'). | +| **Message is sent to any of these domains** <br><br> **Message is not sent to any of these domains** | Apply the policy to include or exclude specific domains in sent messages.<br><br> Make sure to use the following syntax when entering conditional text: <br><br>-Enter each domain and separate multiple domains with a comma.<br> -Do not include spaces between items separated by a comma.<br> -Remove all leading and trailing spaces.<br><br>Each domain is applied separately; only one domain must apply for the policy to apply to the message. <br><br> If you want to exclude all emails sent to two specific domains, configure the **Message is not sent to any of these domains** condition with the two domains (example 'contoso.com,wingtiptoys.com'). | | **Message is classified with any of these labels** <br><br> **Message is not classified with any of these labels** | To apply the policy when certain retention labels are included or excluded in a message. Retention labels must be configured separately and configured labels are chosen as part of this condition. Each label you choose is applied separately (only one of these labels must apply for the policy to apply to the message). For more information about retention labels, see [Learn about retention policies and retention labels](/microsoft-365/compliance/retention).| | **Message contains any of these words** <br><br> **Message contains none of these words** | To apply the policy when certain words or phrases are included or excluded in a message.<br><br> Make sure to use the following syntax when entering conditional text: <br><br>- Remove all leading and trailing spaces.<br>- Add quotation marks before and after each keyword or key phrase.<br>- Separate each keyword or key phrase with a comma.<br>- Do not include spaces between items separated by a comma. <br><br>**Example:** "banker","insider trading","confidential 123"<br><br>Each word or phrase you enter is applied separately (only one word must apply for the policy to apply to the message). For more information about entering words or phrases, see the next section [Matching words and phrases to emails or attachments](#matching-words-and-phrases-to-emails-or-attachments).| | **Attachment contains any of these words** <br><br> **Attachment contains none of these words** | To apply the policy when certain words or phrases are included or excluded in a message attachment (such as a Word document).<br><br>Make sure to use the following syntax when entering conditional text: <br><br>- Remove all leading and trailing spaces.<br>- Add quotation marks before and after each keyword or key phrase.<br>- Separate each keyword or key phrase with a comma.<br>- Do not include spaces between items separated by a comma. <br><br>**Example:** "banker","insider trading","confidential 123"<br><br>Each word or phrase you enter is applied separately (only one word must apply for the policy to apply to the attachment). For more information about entering words or phrases, see the next section [Matching words and phrases to emails or attachments](#matching-words-and-phrases-to-emails-or-attachments).| |
| compliance | Create Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-sensitivity-labels.md | f1.keywords: Previously updated : 05/12/2023 Last updated : 06/10/2023 audience: Admin The global admin for your organization has full permissions to create and manage > [!NOTE] > By default, tenants don't have any labels and you must create them. The labels in the example picture show default labels that were [migrated from Azure Information Protection](/azure/information-protection/configure-policy-migrate-labels). -3. On the **Define the scope for this label** page, the options selected determine the label's scope for the settings that you can configure and where they will be visible when they're published: +3. On the **Define the scope for this label** page, the options selected determine the label's scope for the settings that you can configure and where they'll be visible when they're published: :::image type="content" source="../media/sensitivity-labels-scopes.png" alt-text="Scopes for sensitivity labels." The global admin for your organization has full permissions to create and manage For more information about the label settings, see [What sensitivity labels can do](sensitivity-labels.md#what-sensitivity-labels-can-do) from the overview information and use the help in the UI for individual settings. -5. Repeat these steps to create more labels. However, if you want to create a sublabel, first select the parent label and select **...** for **More actions**, and then select **Add sub label**. +5. Repeat these steps to create more labels. However, if you want to create a sublabel, first select the parent label and select **...** for **Actions**, and then select **Create sublabel**. -6. When you've created all the labels you need, review their order and if necessary, move them up or down. To change the order of a label, select **...** for **More actions**, and then select **Move up** or **Move down**. For more information, see [Label priority (order matters)](sensitivity-labels.md#label-priority-order-matters) from the overview information. +6. When you've created all the labels you need, review their order and if necessary, move them up or down. To change the order of a label, select **...** for **Actions**, and then select one of the reordering options, such as **Move up** or **Move down**. For more information, see [Label priority (order matters)](sensitivity-labels.md#label-priority-order-matters) from the overview information. To edit an existing label, select it, and then select the **Edit label** button: To check your label's configuration, including advanced settings, use the follow 7. Repeat these steps if you need different policy settings for different users or scopes. For example, you want additional labels for a group of users, or a different default label for a subset of users. Or, if you have configured labels to have different scopes. -7. If you create more than one label policy that might result in a conflict for a user, review the policy order and if necessary, move them up or down. To change the order of a label policy, select **...** for **More actions**, and then select **Move up** or **Move down**. For more information, see [Label policy priority (order matters)](sensitivity-labels.md#label-policy-priority-order-matters) from the overview information. +7. If you create more than one label policy that might result in a conflict for a user, review the policy order and if necessary, move them up or down. To change the order of a label policy, select **...** for **Actions**, and then select one of the reordering options. For more information, see [Label policy priority (order matters)](sensitivity-labels.md#label-policy-priority-order-matters) from the overview information. Completing the **Create policy** configuration automatically publishes the label policy. To make changes to a published policy, simply edit it. There's no specific publish or republish action for you to select. You can also use [Remove-Label](/powershell/module/exchange/remove-label) and [R ## Removing and deleting labels -In a production environment, it's unlikely that you will need to remove sensitivity labels from a label policy, or delete sensitivity labels. It's more likely that you might need to do one or either of these actions during an initial testing phase. Make sure you understand what happens when you do either of these actions. +In a production environment, it's unlikely that you'll need to remove sensitivity labels from a label policy, or delete sensitivity labels. It's more likely that you might need to do one or either of these actions during an initial testing phase. Make sure you understand what happens when you do either of these actions. -Removing a label from a label policy is less risky than deleting it, and can always be added back later if needed. You won't be able to delete a label if it's still in a label policy. +Removing a label from a label policy is less risky than deleting it, and can always be added back later if needed. You can't delete a label if it's still in a label policy. When you remove a label from a label policy so that the label is no longer published to the originally specified users, the next time the label policy is refreshed, users no longer see that label to select in their Office apps. If that label is already applied, the label isn't removed from the content or container. For example, users who are using built-in labeling in desktop apps for Word, Excel, and PowerPoint, still see the applied label name on the status bar. An applied container label continues to protect the Teams or SharePoint site. In comparison, when you delete a label: -- If the label applied encryption, the underlying protection template is archived so that previously protected content can still be opened. Because of this archived protection template, you won't be able to create a new label with the same name. Although it's possible to delete a protection template by using [PowerShell](/powershell/module/aipservice/remove-aipservicetemplate), don't do this unless you're sure you don't need to open content that was encrypted with the archived template.+- If the label applied encryption, the underlying protection template is archived so that previously protected content can still be opened. Because of this archived protection template, you can't create a new label with the same name. Although it's possible to delete a protection template by using [PowerShell](/powershell/module/aipservice/remove-aipservicetemplate), don't do this unless you're sure you don't need to open content that was encrypted with the archived template. - For documents stored in SharePoint or OneDrive and you've [enabled sensitivity labels for Office files](sensitivity-labels-sharepoint-onedrive-files.md): When you open the document in Office for the web, you won't see the label applied in the app, and the label name no longer displays in the **Sensitivity** column in SharePoint. If the deleted label applied encryption and the services can process the encrypted contents, the encryption is removed. Egress actions from these services result in the same outcome. For example, download, copy to, move to, and open with an Office desktop or mobile app. Although the label information remains in the file's metadata, apps can no longer map the label ID to a display name, so users will assume a file isn't labeled. As with all label changes, removing a sensitivity label from a label policy or d ## Next steps -To configure and use your sensitivity labels for specific scenarios, use the following articles: +To configure and use your sensitivity labels for specific scenarios, you might find the following articles helpful: - [Restrict access to content by using encryption in sensitivity labels](encryption-sensitivity-labels.md) |
| compliance | Dlp Learn About Dlp | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-learn-about-dlp.md | You have flexibility in how you create and configure your DLP policies. You can 3. **Choose where you want to monitor** - You pick one or more locations that you want DLP to monitor for sensitive information. You can monitor: -location | include/exclude by| -||| -|Exchange email| distribution groups| -|SharePoint sites |sites | -|OneDrive accounts |accounts or distribution groups | -|Teams chat and channel messages |account or distribution group | -|Windows 10, Windows 11, and macOS (three latest released versions) devices |user or group | -|Microsoft Cloud App Security |instance | -|On-premises repositories| repository file path| -|Power BI (preview)| workspaces| + |location | include/exclude by| + ||| + |Exchange email| distribution groups| + |SharePoint sites |sites | + |OneDrive accounts |accounts or distribution groups | + |Teams chat and channel messages |account or distribution group | + |Windows 10, Windows 11, and macOS (three latest released versions) devices |user or group | + |Microsoft Cloud App Security |instance | + |On-premises repositories| repository file path| + |Power BI (preview)| workspaces| 4. **Choose the conditions that must be matched for a policy to be applied to an item** - You can accept preconfigured conditions or define custom conditions. Some examples are: -- item contains a specified kind of sensitive information that is being used in a certain context. For example, 95 social security numbers being emailed to recipient outside your org.-- item has a specified sensitivity label-- item with sensitive information is shared either internally or externally+ - item contains a specified kind of sensitive information that is being used in a certain context. For example, 95 social security numbers being emailed to recipient outside your org. + - item has a specified sensitivity label + - item with sensitive information is shared either internally or externally 5. **Choose the action to take when the policy conditions are met** - The actions depend on the location where the activity is happening. Some examples are: -- SharePoint/Exchange/OneDrive: Block people who are outside your organization from accessing the content. Show the user a tip and send them an email notification that they're taking an action that is prohibited by the DLP policy.-- Teams Chat and Channel: Block sensitive information from being shared in the chat or channel-- Windows 10, Windows 11, and macOS (three latest released versions) Devices: Audit or restrict copying a sensitive item to a removeable USB device-- Office Apps: Show a popup notifying the user that they're engaging in a risky behavior and block or block but allow override.-- On-premises file shares: move the file from where it's stored to a quarantine folder+ - SharePoint/Exchange/OneDrive: Block people who are outside your organization from accessing the content. Show the user a tip and send them an email notification that they're taking an action that is prohibited by the DLP policy. + - Teams Chat and Channel: Block sensitive information from being shared in the chat or channel + - Windows 10, Windows 11, and macOS (three latest released versions) Devices: Audit or restrict copying a sensitive item to a removeable USB device + - Office Apps: Show a popup notifying the user that they're engaging in a risky behavior and block or block but allow override. + - On-premises file shares: move the file from where it's stored to a quarantine folder -> [!NOTE] -> The conditions and the actions to take are defined in an object called a Rule. + > [!NOTE] + > The conditions and the actions to take are defined in an object called a Rule. ## Create and deploy a DLP policy After the policy's synced to the right locations, it starts to evaluate content DLP reports a vast amount of information into Microsoft Purview from monitoring, policy matches and actions, and user activities. You'll need to consume and act on that information to tune your policies and triage actions taken on sensitive items. The telemetry goes into the [Microsoft Purview compliance portal Audit Logs](audit-log-search.md#search-the-audit-log-in-the-compliance-portal) first, is processed, and makes its way to different reporting tools. Each reporting tool has a different purpose. +### High volume of sensitive info shared or save externally ++*This feature is in preview* ++Microsoft 365 provides you with visibility into risky user activities outside of DLP policies. The **High volume of sensitive info shared or saved externally (preview)** card on the DLP homepage shows a count of sensitive items that users have: ++- uploaded to the suspicious domains +- accessed with a suspicious application +- copied to a removable drive ++Microsoft 365 scans the audit logs for risky activities and runs them through a correlation engine to find activities that are occurring at a high volume. No DLP policies are required. ++To get more details on the items that users are copying or moving outside of your organization (called egress activities, or exfiltration), select the **Learn more** link on the card to open a details pane. You can investigate incidents for Microsoft Purview Data Loss Prevention (DLP) from the Microsoft 365 Defender portal **Incidents & alerts** > **Incidents**. See [Investigate data loss incidents with Microsoft 365 Defender](../security/defender/investigate-dlp.md) and [Investigate alerts in Microsoft 365 Defender](../security/defender/investigate-alerts.md). + ### DLP Alerts Dashboard When DLP takes an action on a sensitive item, you can be notified of that action via a configurable alert. Rather than having these alerts pile up in a mailbox for you to sift through, the compliance portal makes them available in the [DLP Alerts Management Dashboard](dlp-configure-view-alerts-policies.md). Use the DLP Alerts dashboard to configure alerts, review them, triage them and track resolution of DLP Alerts. Here's an example of alerts generated by policy matches and activities from Windows 10 devices. |
| compliance | Dlp Owa Policy Tips | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-owa-policy-tips.md | Yes. - Message importance is - Any email attachment's content could not be scanned (DocIsUnsupported) - Document property is+- Content is not labeled ## Actions that support policy tips in Outlook on the Web Yes. ## Sensitive information types that support policy tips in Outlook on the Web -These preconfigured sensitive informaiton types (SIT) support policy tips in Outlook on the Web. +These preconfigured sensitive information types (SIT) support policy tips in Outlook on the Web. - [ABA routing number](sit-defn-aba-routing.md) - [Argentina national identity (DNI) number](sit-defn-argentina-national-identity-numbers.md) Yes. Custom sensitive information types that use REGEX, functions, keyword lists and keyword dictionaries support policy tips in Outlook on the Web. For more details, see [Create custom sensitive information types in the compliance portal](create-a-custom-sensitive-information-type.md) and [Create a custom sensitive information type using PowerShell](create-a-custom-sensitive-information-type-in-scc-powershell.md). -## Sensitivity labels that support policy tips in Outlook on the Web +## Sensitivity labels support for policy tips in Outlook on the Web No. -## Retention labels that support policy tips in Outlook on the Web +## Retention labels support for policy tips in Outlook on the Web No. -## Trainable classifiers that support policy tips in Outlook on the Web +## Trainable classifiers support for policy tips in Outlook on the Web No. |
| compliance | Dlp Policy Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-policy-reference.md | To learn more about user notification and policy tip configuration and use, incl #### Policy tip references -Details on support for policy tips and notfications for different apps can be found here: +Details on support for policy tips and notifications for different apps can be found here: - [Data loss prevention policy tip reference for Outlook on the Web](dlp-owa-policy-tips.md) |
| compliance | Ediscovery Review Set Search | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery-review-set-search.md | In a review set, there are five default filters that are pre-loaded in the revie Select each filter to expand it and assign a value. Select outside the filter to automatically apply the filter to the review set. > [!NOTE]-> A review set displays a maximum of 1,000 items per page. Use default or custom filters to adjust the displayed items as needed. +> A review set displays a maximum of 1,000 items per page and up to 10 pages (for a total of 10,000 items displayed per review set). Use default or custom filters to adjust the displayed items as needed. ## Add or remove filters |
| compliance | Enable Archive Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/enable-archive-mailboxes.md | f1.keywords: Previously updated : 09/12/2019+ Last updated : 06/12/2023 audience: Admin f1_keywords: |
| compliance | Enable Autoexpanding Archiving | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/enable-autoexpanding-archiving.md | Title: "Enable auto-expanding archiving" + Title: "Enable autoexpanding archiving" f1.keywords: - NOCSH Previously updated : 09/12/2019+ Last updated : 06/12/2023 audience: Admin search.appverid: - MOE150 - MET150 ms.assetid: e2a789f2-9962-4960-9fd4-a00aa063559e-description: "For administrators: Learn how to enable auto-expanding archiving, which provides your users with additional storage for their Exchange Online mailboxes. You can enable auto-expanding archiving for your entire organization or just for specific users." +description: "For administrators: Learn how to enable autoexpanding archiving, which provides your users with additional storage for their Exchange Online mailboxes. You can enable autoexpanding archiving for your entire organization or just for specific users." -# Enable auto-expanding archiving +# Enable autoexpanding archiving >*[Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance).* -You can use the Exchange Online auto-expanding archiving feature to enable additional storage space for archive mailboxes. When auto-expanding archiving is turned on, additional storage space is automatically added to a user's archive mailbox until it reaches the storage limit of 1.5 TB. You can turn on auto-expanding archiving for everyone in your organization or just for specific users. For more information about auto-expanding archiving, see [Learn about auto-expanding archiving](autoexpanding-archiving.md). +You can use the Exchange Online autoexpanding archiving feature to enable additional storage space for archive mailboxes. When autoexpanding archiving is turned on, additional storage space is automatically added to a user's archive mailbox until it reaches the storage limit of 1.5 TB. You can turn on autoexpanding archiving for everyone in your organization or just for specific users. For more information about autoexpanding archiving, see [Learn about autoexpanding archiving](autoexpanding-archiving.md). [!INCLUDE [purview-preview](../includes/purview-preview.md)] -## Before you enable auto-expanding archiving +## Before you enable autoexpanding archiving - Understand the following restrictions: - - After you turn on auto-expanding archiving for your organization or for a specific user, it can't be turned off. Administrators also can't adjust the storage quota for auto-expanding archiving. + - After you turn on autoexpanding archiving for your organization or for a specific user, it can't be turned off. Administrators also can't adjust the storage quota for autoexpanding archiving. - - Auto-expanding archiving prevents you from recovering or restoring an [inactive mailbox](inactive-mailboxes-in-office-365.md#what-are-inactive-mailboxes). That means if you enable auto-expanding archiving for a mailbox and the mailbox is made inactive at a later date, you won't be able to [recover the inactive mailbox](recover-an-inactive-mailbox.md) (by converting it to an active mailbox) or [restore it](restore-an-inactive-mailbox.md) (by merging the contents to an existing mailbox). + - Autoexpanding archiving prevents you from recovering or restoring an [inactive mailbox](inactive-mailboxes-in-office-365.md#what-are-inactive-mailboxes). That means if you enable autoexpanding archiving for a mailbox and the mailbox is made inactive at a later date, you won't be able to [recover the inactive mailbox](recover-an-inactive-mailbox.md) (by converting it to an active mailbox) or [restore it](restore-an-inactive-mailbox.md) (by merging the contents to an existing mailbox). - If auto-expanding archiving is enabled on an inactive mailbox, the only way to recover data is by using the Content search tool in the Microsoft Purview compliance portal to export the data from the mailbox and import to another mailbox. For more information, see the [Inactive mailboxes and auto-expanding archives](inactive-mailboxes-in-office-365.md#inactive-mailboxes-and-auto-expanding-archives). + If autoexpanding archiving is enabled on an inactive mailbox, the only way to recover data is by using the Content search tool in the Microsoft Purview compliance portal to export the data from the mailbox and import to another mailbox. For more information, see the [Inactive mailboxes and autoexpanding archives](inactive-mailboxes-in-office-365.md#inactive-mailboxes-and-auto-expanding-archives). -- You must be a global administrator in your organization or a member of the Organization Management role group in your Exchange Online organization to enable auto-expanding archiving. Alternately, you have to be a member of a role group that's assigned the Mail Recipients role to enable auto-expanding archiving for specific users.+- You must be a global administrator in your organization or a member of the Organization Management role group in your Exchange Online organization to enable autoexpanding archiving. Alternately, you have to be a member of a role group that's assigned the Mail Recipients role to enable autoexpanding archiving for specific users. -- A user's mailbox must already be [enabled for archive](enable-archive-mailboxes.md) before you can enable auto-expanding archiving.+- A user's mailbox must already be [enabled for archive](enable-archive-mailboxes.md) before you can enable autoexpanding archiving. -- After you turn on auto-expanding archiving, an archive mailbox is converted to an auto-expanding archive when the archive mailbox (including the Recoverable Items folder) reaches 90 GB. It can take up to 30 days for the additional storage space to be provisioned.+- After you turn on autoexpanding archiving, an archive mailbox is converted to an autoexpanding archive when the archive mailbox (including the Recoverable Items folder) reaches 90 GB. It can take up to 30 days for the additional storage space to be provisioned. -- Auto-expanding archiving also supports shared mailboxes.+- Autoexpanding archiving also supports shared mailboxes. -- You can't use the Exchange admin center or the Microsoft Purview compliance portal to enable auto-expanding archiving. You must use Exchange Online PowerShell.+- You can't use the Exchange admin center or the Microsoft Purview compliance portal to enable autoexpanding archiving. You must use Exchange Online PowerShell. -## Enable auto-expanding archiving for your entire organization +## Enable autoexpanding archiving for your entire organization -You can enable auto-expanding archiving for your entire organization. After you turn it on, auto-expanding archiving will be enabled for existing user mailboxes and for new user mailboxes that are created. When you create user mailboxes, be sure to enable the user's main archive mailbox so the auto-expanding archiving feature works for the new user mailbox. +You can enable autoexpanding archiving for your entire organization. After you turn it on, autoexpanding archiving will be enabled for existing user mailboxes and for new user mailboxes that are created. When you create user mailboxes, be sure to enable the user's main archive mailbox so the autoexpanding archiving feature works for the new user mailbox. 1. [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) -2. Run the following command in Exchange Online PowerShell to enable auto-expanding archiving for your entire organization. +2. Run the following command in Exchange Online PowerShell to enable autoexpanding archiving for your entire organization. ```powershell Set-OrganizationConfig -AutoExpandingArchive ``` -## Enable auto-expanding archiving for specific users +## Enable autoexpanding archiving for specific users -Instead of enabling auto-expanding archiving for every user in your organization, you can enable it only for specific users. You might do this because only some users might have a need for a large archive storage capacity. +Instead of enabling autoexpanding archiving for every user in your organization, you can enable it only for specific users. You might do this because only some users might have a need for a large archive storage capacity. -When you enable auto-expanding archiving for a specific user and the user's mailbox in on hold or assigned to a retention policy, the following two configurations changes are made: +When you enable autoexpanding archiving for a specific user and the user's mailbox in on hold or assigned to a retention policy, the following two configurations changes are made: - The storage quota for the user's primary archive mailbox is increased by 10 GB (from 100 GB to 110 GB). The archive warning quota is also increased by 10 GB (from 90 GB to 100 GB). - The storage quota for the Recoverable Items folder in the user's primary mailbox is increased by 10 GB (also from 100 GB to 110 GB). The Recoverable Items warning quota is also increased by 10 GB (from 90 GB to 100 GB). These changes are applicable only if the mailbox in on hold or assigned to a retention policy. -This additional space is added to prevent any storage issues that may occur before the auto-expanding archive is provisioned. Additional storage space *is not* added when you enable auto-expanding archiving for your entire organization, as described in the previous section. +This additional space is added to prevent any storage issues that may occur before the autoexpanding archive is provisioned. Additional storage space *is not* added when you enable autoexpanding archiving for your entire organization, as described in the previous section. 1. [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) -2. Run the following command in Exchange Online PowerShell to enable auto-expanding archiving for a specific user. As previously explained, the user's archive mailbox (main archive) must be enabled before you can turn on auto-expanding archiving for that user. +2. Run the following command in Exchange Online PowerShell to enable autoexpanding archiving for a specific user. As previously explained, the user's archive mailbox (main archive) must be enabled before you can turn on autoexpanding archiving for that user. ```powershell Enable-Mailbox <user mailbox> -AutoExpandingArchive ``` > [!IMPORTANT]-> In an Exchange hybrid deployment, you can't use the **Enable-Mailbox -AutoExpandingArchive** command to enable auto-expanding archiving for a specific user whose primary mailbox is on-premises and whose archive mailbox is cloud-based. To enable auto-expanding archiving for cloud-based archive mailboxes in an Exchange hybrid deployment, you have to run the **Set-OrganizationConfig -AutoExpandingArchive** command in Exchange Online PowerShell to enable auto-expanding archiving for the entire organization. If a user's primary and archive mailboxes are both cloud-based, then you can use the **Enable-Mailbox -AutoExpandingArchive** command to enable auto-expanding archiving for that specific user. +> In an Exchange hybrid deployment, you can't use the **Enable-Mailbox -AutoExpandingArchive** command to enable autoexpanding archiving for a specific user whose primary mailbox is on-premises and whose archive mailbox is cloud-based. To enable autoexpanding archiving for cloud-based archive mailboxes in an Exchange hybrid deployment, you have to run the **Set-OrganizationConfig -AutoExpandingArchive** command in Exchange Online PowerShell to enable autoexpanding archiving for the entire organization. If a user's primary and archive mailboxes are both cloud-based, then you can use the **Enable-Mailbox -AutoExpandingArchive** command to enable autoexpanding archiving for that specific user. -## Verify that auto-expanding archiving is enabled +## Verify that autoexpanding archiving is enabled -To verify that auto-expanding archiving is enabled for your organization, run the following command in Exchange Online PowerShell. +To verify that autoexpanding archiving is enabled for your organization, run the following command in Exchange Online PowerShell. ```powershell Get-OrganizationConfig | FL AutoExpandingArchiveEnabled ``` -A value of `True` indicates that auto-expanding archiving is enabled for the organization. +A value of `True` indicates that autoexpanding archiving is enabled for the organization. -To verify that auto-expanding archiving is enabled for a specific user, run the following command in Exchange Online PowerShell. +To verify that autoexpanding archiving is enabled for a specific user, run the following command in Exchange Online PowerShell. ```powershell Get-Mailbox <user mailbox> | FL AutoExpandingArchiveEnabled ``` -A value of `True` indicates that auto-expanding archiving is enabled for the user. +A value of `True` indicates that autoexpanding archiving is enabled for the user. -To determine if auto-expanding archiving is enabled for inactive mailboxes, run the following command in Exchange Online PowerShell. +To determine if autoexpanding archiving is enabled for inactive mailboxes, run the following command in Exchange Online PowerShell. ```powershell Get-Mailbox -InactiveMailboxOnly | FL UserPrincipalName,AutoExpandingArchiveEnabled ``` -A value of `True` indicates that auto-expanding archiving is enabled for the inactive mailbox. A value of `False` indicates that auto-expanding archiving isn't enabled. +A value of `True` indicates that autoexpanding archiving is enabled for the inactive mailbox. A value of `False` indicates that autoexpanding archiving isn't enabled. -Keep the following things in mind after you enable auto-expanding archiving: +Keep the following things in mind after you enable autoexpanding archiving: -- If you run the **Set-OrganizationConfig -AutoExpandingArchive** command to enable auto-expanding archiving for your organization, you don't have to run the **Enable-Mailbox -AutoExpandingArchive** on individual mailboxes. Running the **Set-OrganizationConfig** cmdlet to enable auto-expanding archiving for your organization doesn't change the *AutoExpandingArchiveEnabled* property on user mailboxes to `True`.+- If you run the **Set-OrganizationConfig -AutoExpandingArchive** command to enable autoexpanding archiving for your organization, you don't have to run the **Enable-Mailbox -AutoExpandingArchive** on individual mailboxes. Running the **Set-OrganizationConfig** cmdlet to enable autoexpanding archiving for your organization doesn't change the *AutoExpandingArchiveEnabled* property on user mailboxes to `True`. -- Similarly, the values for the *ArchiveQuota* and *ArchiveWarningQuota* mailbox properties aren't changed when you enable auto-expanding archiving. In fact, when you enable auto-expanding archiving for a user mailbox and the *AutoExpandingArchiveEnabled* property is set to `True`, the *ArchiveQuota* and *ArchiveWarningQuota* properties are ignored. Here's an example of these mailbox properties after auto-expanding archiving is enabled for a user's mailbox. +- Similarly, the values for the *ArchiveQuota* and *ArchiveWarningQuota* mailbox properties aren't changed when you enable autoexpanding archiving. In fact, when you enable autoexpanding archiving for a user mailbox and the *AutoExpandingArchiveEnabled* property is set to `True`, the *ArchiveQuota* and *ArchiveWarningQuota* properties are ignored. Here's an example of these mailbox properties after autoexpanding archiving is enabled for a user's mailbox. -  +  ## More information Keep the following things in mind after you enable auto-expanding archiving: Get-Mailbox -Filter {ArchiveStatus -Eq "None" -AND RecipientTypeDetails -eq "UserMailbox"} | Enable-Mailbox -Archive ``` -- Auto-expanding archiving is supported for cloud-based archive mailboxes in an Exchange hybrid deployment for users who have an on-premises primary mailbox. However, after auto-expanding archiving is enabled for a cloud-based archive mailbox, you can't off-board that archive mailbox back to the on-premises Exchange organization. Auto-expanding archiving isn't supported for on-premises mailboxes in any version of Exchange Server.+- Autoexpanding archiving is supported for cloud-based archive mailboxes in an Exchange hybrid deployment for users who have an on-premises primary mailbox. However, after autoexpanding archiving is enabled for a cloud-based archive mailbox, you can't off-board that archive mailbox back to the on-premises Exchange organization. Autoexpanding archiving isn't supported for on-premises mailboxes in any version of Exchange Server. -- For a list of Outlook clients that users can use to access items in the additional storage area in their archive mailbox, see the "Outlook requirements for accessing items in an auto-expanded archive" section in [Learn about auto-expanding archiving](autoexpanding-archiving.md#outlook-requirements-for-accessing-items-in-an-auto-expanded-archive).+- For a list of Outlook clients that users can use to access items in the additional storage area in their archive mailbox, see the "Outlook requirements for accessing items in an auto-expanded archive" section in [Learn about autoexpanding archiving](autoexpanding-archiving.md#outlook-requirements-for-accessing-items-in-an-auto-expanded-archive). -- As previously explained, 10 GB is added to the storage quota of the user's primary archive mailbox (and to the Recoverable Items folder if the mailbox is on hold) when you run the **Enable-Mailbox -AutoExpandingArchive** command. This provides additional storage until the auto-expanded storage space is provisioned (which can take up to 30 days). This additional storage space isn't added when you run the **Set-OrganizationConfig -AutoExpandingArchive** to enable auto-expanding archiving for all mailboxes in your organization. If you enabled auto-expanding archiving for the entire organization, but need to add the additional 10 GB of storage space for a specific user, you can run the **Enable-Mailbox -AutoExpandingArchive** command on that mailbox. You will receive an error saying that auto-expanding archiving has already been enabled, but the additional storage space will be added to the mailbox.+- As previously explained, 10 GB is added to the storage quota of the user's primary archive mailbox (and to the Recoverable Items folder if the mailbox is on hold) when you run the **Enable-Mailbox -AutoExpandingArchive** command. This provides additional storage until the auto-expanded storage space is provisioned (which can take up to 30 days). This additional storage space isn't added when you run the **Set-OrganizationConfig -AutoExpandingArchive** to enable autoexpanding archiving for all mailboxes in your organization. If you enabled autoexpanding archiving for the entire organization, but need to add the additional 10 GB of storage space for a specific user, you can run the **Enable-Mailbox -AutoExpandingArchive** command on that mailbox. You will receive an error saying that autoexpanding archiving has already been enabled, but the additional storage space will be added to the mailbox. > [!IMPORTANT]-> Auto-expanding archiving is supported only for mailboxes used by individual users or for shared mailboxes with a growth rate that doesn't exceed 1 GB per day. Using journaling, transport rules, or auto-forwarding rules to copy messages to an archive mailbox for the purposes of archiving is not permitted. A user's archive mailbox is intended for just that user. Microsoft reserves the right to deny additional archiving in instances where a user's archive mailbox is used to store archive data for other users or in other cases of inappropriate use. +> Autoexpanding archiving is supported only for mailboxes used by individual users or for shared mailboxes with a growth rate that doesn't exceed 1 GB per day. Using journaling, transport rules, or auto-forwarding rules to copy messages to an archive mailbox for the purposes of archiving is not permitted. A user's archive mailbox is intended for just that user. Microsoft reserves the right to deny additional archiving in instances where a user's archive mailbox is used to store archive data for other users or in other cases of inappropriate use. ## Next steps |
| compliance | Encryption Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/encryption-sensitivity-labels.md | f1.keywords: Previously updated : 06/06/2023 Last updated : 06/10/2023 audience: Admin Before you can use encryption, you might need to do some configuration tasks. Wh 4. On the **Encryption** page, select one of the following options: - - **Remove encryption if the file or email is encrypted**: When you select this option, applying the label will remove existing encryption, even if it was applied independently from a sensitivity label. + - **Remove encryption if the file or email is encrypted**: When you select this option, applying the label removes existing encryption, even if it was applied independently from a sensitivity label. It's important to understand that this setting can result in a sensitivity label that users might not be able to apply when they don't have sufficient permissions to remove the existing encryption. For more information about this scenario, see the [What happens to existing encryption when a label's applied](#what-happens-to-existing-encryption-when-a-labels-applied) section. Configuring the user-assigned permissions: ### Outlook restrictions -In Outlook, when a user applies a sensitivity label that lets them assign permissions to a message, you can choose the **Do Not Forward option** or **Encrypt-Only**. The user will see the label name and description at the top of the message, which indicates the content's being protected. Unlike Word, PowerPoint, and Excel (see the [next section](#word-powerpoint-and-excel-permissions)), users aren't prompted to select specific permissions. +In Outlook, when a user applies a sensitivity label that lets them assign permissions to a message, you can choose the **Do Not Forward option** or **Encrypt-Only**. The user will see the label name and description at the top of the message, which indicates the content's being protected. Unlike Word, PowerPoint, and Excel (see the [next section](#word-powerpoint-and-excel-permissions)), users aren't prompted to select specific permissions. For this configuration, the administrator controls the permissions, but not who has access.  Unencrypted Office documents that are attached to the email or meeting invite au ### Word, PowerPoint, and Excel permissions -In Word, PowerPoint, and Excel, when a user applies a sensitivity label that lets them assign permissions to a document, the user is prompted to specify their choice of users and permissions for the encryption. --For example, with the Azure Information Protection unified labeling client, unless [co-authoring is enabled](sensitivity-labels-coauthoring.md), users can: --- Select a permission level, such as Viewer (which assigns View Only permission) or Co-Author (which assigns View, Edit, Copy, and Print permissions).-- Select users, groups, or organizations. This can include people both inside or outside your organizations.-- Set an expiration date, after which the selected users can't access the content. For more information, see the above section [Rights Management use license for offline access](#rights-management-use-license-for-offline-access).-- --For built-in labeling, and for the Azure Information Protection unified labeling client when [co-authoring is enabled](sensitivity-labels-coauthoring.md), users see the same dialog box as if they selected the following options: --- Windows: **File** tab > **Info** > **Protect Document** > **Restrict Access** > **Restricted Access**--- macOS: **Review** tab > **Protection** > **Permissions** > **Restricted Access**--> [!TIP] -> If users were familiar with configuring custom permissions with the Azure Information Protection unified labeling client before [co-authoring was enabled](sensitivity-labels-coauthoring.md), you might find it helpful to review the mapping of permission levels to individual usage rights: [Rights included in permissions levels](/azure/information-protection/configure-usage-rights#rights-included-in-permissions-levels). +In Word, PowerPoint, and Excel, when a user applies a sensitivity label that lets them assign permissions to a document, the user is prompted to specify their choice of users and permissions for the encryption. For this configuration, the user and not the administrator controls both who can access the document, and what permissions they have. #### Support for organization-wide custom permissions -Now available for built-in labeling in Windows, users can specify a domain name that will apply to all users in an organization that owns the domain and it is in Azure Active Directory. To identify the minimum versions that support this setting, use the [capabilities table](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-word-excel-and-powerpoint) and the row **Let users assign permissions:- Prompt users for custom permissions (users, groups, and organizations)**. +For built-in labeling in Windows, users can additionally specify a domain name when they're prompted to specify their choice of users and permissions. When a domain name is entered, the permissions will apply to all users in an organization that owns the domain and it is in Azure Active Directory. To identify the minimum versions that support this setting, use the [capabilities table](sensitivity-labels-versions.md#sensitivity-label-capabilities-in-word-excel-and-powerpoint) and the row **Let users assign permissions:- Prompt users for custom permissions (users, groups, and organizations)**. This capability provides [parity with the Azure Information Protection unified labeling client](sensitivity-labels-aip.md#feature-parity-for-built-in-labeling-and-the-aip-add-in-for-office-apps): |
| compliance | Get Started With Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/get-started-with-sensitivity-labels.md | f1.keywords: Previously updated : 02/13/2020 Last updated : 06/08/2023 audience: Admin These permissions are required only to create and configure sensitivity labels a ## Support for administrative units -Now rolling out in preview, sensitivity labels support [administrative units that have been configured in Azure Active Directory](/azure/active-directory/roles/administrative-units): +Now in preview, sensitivity labels support [administrative units that have been configured in Azure Active Directory](/azure/active-directory/roles/administrative-units): - You can assign administrative units to members of role groups that are used with Microsoft Purview Information Protection. Edit these role groups and select individual members, and then the **Assign admin units** option to select administrative units from Azure Active Directory. These administrators are now restricted to managing just the users in those administrative units. -- You can define the initial scope of sensitivity label policies and auto-labeling policies for Exchange when you create or edit these policies. When you select administrative units, only the users in those administrative units will be eligible for the policy.+- You can define the initial scope of sensitivity label policies and auto-labeling policies when you create or edit these policies. When you select administrative units, only the users in those administrative units will be eligible for the policy. > [!IMPORTANT]-> Don't select administrative units for an auto-labeling policy that you want to apply to documents in SharePoint or OneDrive. Because administrative units support only users and groups, if you configure an auto-labeling policy to use administrative units, you won't be able to select the options for SharePoint and OneDrive. +> Don't select administrative units for an auto-labeling policy that you want to apply to documents in SharePoint. Because administrative units support only users and groups, if you configure an auto-labeling policy to use administrative units, you won't be able to select the SharePoint location. For more information about how Microsoft Purview supports administrative units, see [Administrative units](microsoft-365-compliance-center-permissions.md#administrative-units-preview). |
| compliance | Information Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/information-protection.md | f1.keywords: Previously updated : 06/01/2023 Last updated : 06/12/2023 audience: Admin To help prevent accidental oversharing of sensitive information, use the followi |Capability|What problems does it solve?|Get started| |:|:|:|-|[Microsoft Purview Data Loss Prevention](dlp-learn-about-dlp.md)| Helps prevent unintentional sharing of sensitive items. | [Get started with the default DLP policy](get-started-with-the-default-dlp-policy.md)| +|[Microsoft Purview Data Loss Prevention](dlp-learn-about-dlp.md)| Helps prevent unintentional sharing of sensitive items. | [Learn about data loss prevention](dlp-learn-about-dlp.md)| |[Endpoint data loss prevention](endpoint-dlp-learn-about.md)| Extends DLP capabilities to items that are used and shared on Windows 10 computers. | [Get started with Endpoint data loss prevention](endpoint-dlp-getting-started.md)|-|[Microsoft Compliance Extension](dlp-chrome-learn-about.md) | Extends DLP capabilities to the Chrome browser | [Get started with the Microsoft Compliance Extension](dlp-chrome-get-started.md)| -|[Microsoft Purview data loss prevention on-premises scanner (preview)](dlp-on-premises-scanner-learn.md)|Extends DLP monitoring of file activities and protective actions for those files to on-premises file shares and SharePoint folders and document libraries.|[Get started with Microsoft Purview data loss prevention on-premises scanner (preview)](dlp-on-premises-scanner-get-started.md)| -|[Protect sensitive information in Microsoft Teams chat and channel messages](dlp-microsoft-teams.md) | Extends some DLP functionality to Teams chat and channel messages | [Learn about the default data loss prevention policy in Microsoft Teams (preview)](dlp-teams-default-policy.md)| +|[Microsoft Purview extension for Chrome](dlp-chrome-learn-about.md) | Extends DLP capabilities to the Chrome browser | [Get started with the Microsoft Purview extension for Chrome](dlp-chrome-get-started.md)| +|[Learn about the Microsoft Purview extension for Firefox](dlp-firefox-extension-learn.md)|Extends DLP capabilities to the Firefox browser|[Get startd with the Microsoft Purview extension for Firefox](dlp-firefox-extension-get-started.md) +|[Microsoft Purview data loss prevention on-premises repositories](dlp-on-premises-scanner-learn.md)|Extends DLP monitoring of file activities and protective actions for those files to on-premises file shares and SharePoint folders and document libraries.|[Get started with Microsoft Purview data loss prevention on-premises repositories](dlp-on-premises-scanner-get-started.md)| +|[Protect sensitive information in Microsoft Teams chat and channel messages](dlp-microsoft-teams.md) | Extends some DLP functionality to Teams chat and channel messages | [Learn about the default data loss prevention policy in Microsoft Teams](dlp-teams-default-policy.md)| ## Licensing requirements |
| compliance | Insider Risk Management Activities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-activities.md | To filter alerts on the **Alerts dashboard**, select the **Filter** control. You ## Search alerts on the Alert dashboard -To search the alert name for a specific word, select the **Search** control and type the word to search. The search results display any policy alert containing the word defined in the search. +Use the **Search** control to search for an Alert ID or search for a specific word in the alert name. The search results display any policy alert containing the Alert ID or a word defined in the search. ## Dismiss multiple alerts (preview) |
| compliance | Insider Risk Management Cases | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-cases.md | The insider risk management **Cases dashboard** allows you to view and act on ca The case queue lists all active and closed cases for your organization, in addition to the current status of the following case attributes: +- **Case ID**: The ID of the case. - **Case name**: The name of the case, defined when an alert is confirmed and the case is created. - **Status**: The status of the case, either *Active* or *Closed*. - **User**: The user for the case. If anonymization for usernames is enabled, anonymized information is displayed. The case queue lists all active and closed cases for your organization, in addit  -Use the **Search** control to search case names for specific text and use the case filter to sort cases by the following attributes: +Use the **Search** control to search for a Case ID or to search for specific text in case names. Use the case filter to sort cases by the following attributes: - Status - Time case opened, start date, and end date Selecting a case opens the case management tools and allows analysts and investi The **Case overview** tab summarizes the case details for risk analysts and investigators. It includes the following information in the **About this case** area +- **Case ID**: The ID of the case. - **Status**: The current status of the case, either Active or Closed. - **Case created on**: The date and time the case was created. - **User's risk score**: The current calculated risk level of the user for the case. This score is calculated every 24 hours and uses alert risk scores from all active alerts associated to the user. When *User is detected as a potential high impact user* or *User is a member of a priority user group* risk booster is enabled as **Risk score boosters** in the **Policy indicators** section of the **Insider risk management settings** page, the **User details** page includes detailed information about the user's calculated risk level. The **Case overview** tab also includes an **Alerts** section that includes the The **Alerts** tab summarizes the current alerts included in the case. New alerts may be added to an existing case and they'll be added to the **Alert** queue as they're assigned. The following alert attributes are listed in the queue: +- Alert +- Alert ID - Status - Severity - Time detected Select an alert from the queue to display the **Alert detail** page. -Use the search control to search alert names for specific text and use the alert filter to sort cases by the following attributes: +Use the search control to search for an Alert ID or to search for specific text in alert names. Use the alert filter to sort cases by the following attributes: - Status - Severity |
| compliance | Insider Risk Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management.md | You can select from the following policy templates to quickly get started with i Alerts are automatically generated by risk indicators that match policy conditions and are displayed in the [Alerts dashboard](insider-risk-management-activities.md#alert-dashboard). This dashboard enables a quick view of all alerts needing review, open alerts over time, and alert statistics for your organization. All policy alerts are displayed with the following information to help you quickly identify the status of existing alerts and new alerts that need action: +- ID +- Users +- Alert - Status-- Severity+- Alert severity - Time detected - Case - Case status+- Risk factors  |
| compliance | Ocr Learn About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ocr-learn-about.md | Because it's an optional feature, your Global admin must set up pay-as-you-go bi The charge for using OCR is $1.00 for every 1,000 items scanned. Each image scanned counts as one transaction. This means that stand-alone images (JPEG, JPG, PNG, BMP, or TIFF) each count as a single transaction. It also means that *each page* in a PDF file is charged separately. For example, if there are 10 pages in a PDF file, an OCR scan of the PDF file counts as 10 separate scans. +> [!NOTE] +> To reduce your OCR costs, charges for scanning each unique image are incurred only once. +> +> Small images, such as logos and signatures that are sent in email via Microsoft Exchange are scanned and billed only once per unique image across all users of the tenant. For all subsequent instances, the results of the previous scan will be reused. +> +>Additionally, each scanned image can be used in any number of policies across data loss prevention, insider risk management, auto-labeling, and records management at no additional charge. + [!INCLUDE [dlp-pdf-adobe-requirements](../includes/dlp-pdf-adobe-requirements.md)] |
| compliance | Retention | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention.md | f1.keywords: Previously updated : 06/05/2023 Last updated : 06/08/2023 audience: Admin As with sensitivity labels, an item such as an email or document can have only a - [Outlook rules](create-apply-retention-labels.md#automatically-applying-a-retention-label-to-email-by-using-rules) - [Power Automate compliance action](/power-automate/overview-cloud) of **Apply a retention label on the item** -If there are multiple auto-apply retention label policies that could apply a retention label, and the content meets the conditions of multiple policies, the retention label for the oldest auto-apply retention label policy (by date created) is selected. +If there are multiple auto-apply retention label policies that could apply a retention label, and the content meets the conditions of more than one of these policies, you can't control which retention label will be selected. However, in some cases, the retention label for the oldest auto-apply retention label policy (by date created) is selected. This happens only when the matching policies don't include multiple instances of the same type of condition (sensitive information types, specific keywords or searchable properties, or trainable classifiers). For standard retention labels (they don't mark items as a [record or regulatory record](records-management.md#records)): |
| compliance | Sensitivity Labels Default Sharing Link | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-default-sharing-link.md | f1.keywords: Previously updated : 01/20/2022 Last updated : 06/10/2023 audience: Admin |
| compliance | Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels.md | f1.keywords: Previously updated : 05/12/2023 Last updated : 06/10/2023 audience: Admin For these pages that have unavailable options, select **Next** to continue. Or, When you create your sensitivity labels in the Microsoft Purview compliance portal, they appear in a list on the **Information Protection** \> **Labels** page. In this list, the order of the labels is important because it reflects their priority. You want your most restrictive sensitivity label, such as Highly Confidential, to appear at the **bottom** of the list, and your least restrictive sensitivity label, such as Public, to appear at the **top**. -You can apply just one sensitivity label to an item such as a document, email, or container. If you set an option that requires your users to provide a justification for changing a label to a lower classification, the order of this list identifies the lower classifications. However, this option doesn't apply to sublabels that share the priority of their parent label. +You can apply just one sensitivity label to an item such as a document, email, or container. If you set an option that requires your users to provide a justification for changing a label to a lower sensitivity, the order of this list identifies the lower sensitivity. However, this option doesn't apply to sublabels that share the priority of their parent label. The ordering of sublabels is used with [automatic labeling](apply-sensitivity-label-automatically.md), though. When you configure auto-labeling policies, multiple matches can result for more than one label. Then, the last sensitive label is selected, and then if applicable, the last sublabel. When you configure sublabels themselves (rather than auto-labeling policies) for automatic or recommended labeling, the behavior is a little different when sublabels share the same parent label. For example, a sublabel configured for automatic labeling is preferred over a sublabel configured for recommended labeling. For more information, see [How multiple conditions are evaluated when they apply to more than one label](apply-sensitivity-label-automatically.md#how-multiple-conditions-are-evaluated-when-they-apply-to-more-than-one-label). The ordering of sublabels is also used with [label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments). - +When you select a sensitivity label, you can reorder it by using the options to move it to the top or bottom of the list if it's not a sublabel, move it up or down by one label, or directly assign a number. + ### Sublabels (grouping labels) -With sublabels, you can group one or more labels below a parent label that a user sees in an Office app. For example, under Confidential, your organization might use several different labels for specific types of that classification. In this example, the parent label Confidential is simply a text label with no protection settings, and because it has sublabels, it can't be applied to content. Instead, users must choose Confidential to view the sublabels, and then they can choose a sublabel to apply to content. +With sublabels, you can group one or more labels below a parent label that a user sees in an Office app. For example, under Confidential, your organization might use several different labels for specific types of that sensitivity. In this example, the parent label Confidential is simply a text label with no protection settings, and because it has sublabels, it can't be applied to content. Instead, users must choose Confidential to view the sublabels, and then they can choose a sublabel to apply to content. Sublabels are simply a way to present labels to users in logical groups. Sublabels don't inherit any settings from their parent label, except for their label color. When you publish a sublabel for a user, that user can then apply that sublabel to content and containers, but can't apply just the parent label. Example of how sublabels display for users: ### Editing or deleting a sensitivity label -If you delete a sensitivity label from the admin portal, the label is not automatically removed from content, and any protection settings continue to be enforced on content that had that label applied. +If you delete a sensitivity label from the admin portal, the label is't automatically removed from content, and any protection settings continue to be enforced on content that had that label applied. If you edit a sensitivity label, the version of the label that was applied to content is what's enforced on that content. Similarly for users in the legal department, who are assigned the third policy w ## Sensitivity labels and Azure Information Protection -The sensitivity labels that are built into Microsoft 365 Apps on Windows, macOS, iOS, and Android look and behave very similarly across these devices to provide users with a consistent labeling experience. However, on Windows computers, you can also use the [Azure Information Protection (AIP) client](/azure/information-protection/rms-client/aip-clientv2). The AIP Office add-in component from this client is now in [maintenance mode](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/azure-information-protection-and-the-information-protection/ba-p/3671070) and will be [retired April 2024](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/retirement-notification-for-the-azure-information-protection/ba-p/3791908). When the AIP client is installed, it is no longer the default labeling client for the latest Office apps. +The sensitivity labels that are built into Microsoft 365 Apps on Windows, macOS, iOS, and Android look and behave very similarly across these devices to provide users with a consistent labeling experience. However, on Windows computers, you can also use the [Azure Information Protection (AIP) client](/azure/information-protection/rms-client/aip-clientv2). The AIP Office add-in component from this client is now in [maintenance mode](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/azure-information-protection-and-the-information-protection/ba-p/3671070) and will be [retired April 2024](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/retirement-notification-for-the-azure-information-protection/ba-p/3791908). When the AIP client is installed, it's no longer the default labeling client for the latest Office apps. If you're using the AIP add-in for labeling in Office apps, we recommend you move to built-in labeling. For more information, see [Migrate the Azure Information Protection (AIP) add-in to built-in labeling for Office apps](sensitivity-labels-aip.md). |
| compliance | Set Up An Archive And Deletion Policy For Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/set-up-an-archive-and-deletion-policy-for-mailboxes.md | f1.keywords: Previously updated : 09/12/2019+ Last updated : 06/12/2023 audience: Admin |
| compliance | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md | f1.keywords: Previously updated : 06/07/2023 Last updated : 06/08/2023 audience: Admin Whether it be adding new solutions to the [Microsoft Purview compliance portal]( ## June 2023 +### Data loss prevention ++- **General availability (GA)**: Oversharing Popup for Outlook Win 32. [Scenario 2 Show policy tip as oversharing popup](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup) and [Business justification X-Header](dlp-policy-reference.md#business-justification-x-header). + ### Sensitivity labels - **General availability (GA)**: Now rolling out, Outlook for Android and Outlook for iOS support a setting for mandatory labeling that you can configure with Microsoft Intune to [prompt users to select a sensitivity label when they first compose an email](sensitivity-labels-office-apps.md#for-outlook-mobile-change-when-users-are-prompted-for-a-label) instead of when they send it.+- **In preview**: Now rolling out, OneDrive locations for [auto-labeling policies](apply-sensitivity-label-automatically.md#how-to-configure-auto-labeling-policies-for-sharepoint-onedrive-and-exchange) are changing from sites specified by URLs to users and groups. This change of configuration means that [administrative units](microsoft-365-compliance-center-permissions.md#administrative-units-preview) are now supported for OneDrive auto-labeling policies. Any existing OneDrive sites specified in auto-labeling policies as site URLs will continue to work but before you can add more OneDrive locations, or for restricted admins, you must first delete any existing OneDrive sites specified as URLs. Groups supported: distribution groups, Microsoft 365 groups, mail-enabled security groups, and security groups. - **Removal of limitations for Teams when using sensitivity labels**: Several previous limitations are removed for [Teams protected meetings](sensitivity-labels-meetings.md), which include Safari and Firefox support to prevent copy chat, support for virtual desktop infrastructure (VDI), policy settings for justification for changing a label, mandatory labeling, and a help link to a custom help page, and more methods are now supported to prevent copying chat. -### Data loss prevention --- **General availability (GA)**: Oversharing Popup for Outlook Win 32. [Scenario 2 Show policy tip as oversharing popup](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup) and [Business justification X-Header](dlp-policy-reference.md#business-justification-x-header).- ## May 2023 ### Compliance Manager Whether it be adding new solutions to the [Microsoft Purview compliance portal]( - **General availability (GA)**: For labeling built into Windows, macOS, iOS, and Android, auditing actions for sensitivity labels include encryption details such as a change in the encryption status and settings, and the Rights Management owner. - **In preview**: The ability to [scope labels to files and emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails), so that, for example, a sensitivity label is visible to users in Outlook but not in Word, Excel, or PowerPoint. This configuration can be used as a parity feature for the AIP add-in, which could be disabled per app. - **In preview**: As a parity feature for the AIP add-in, built-in labeling for Windows supports [label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments).+- **In preview**: Prevent [oversharing of labeled emails as a DLP policy tip](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup). This DLP policy configuration is an equivalent for the AIP add-in with PowerShell advanced settings that implement pop-up messages in Outlook that warn, justify, or block emails being sent. - **In preview**: Preview versions of Outlook for Mac now support [label colors](sensitivity-labels-office-apps.md#label-colors) but don't yet support the sensitivity bar. - **In preview**: For mandatory labeling, Outlook for Android in the Beta Channel supports a setting that you can configure with Microsoft Intune to [prompt users to select a sensitivity label when they first compose an email](sensitivity-labels-office-apps.md#for-outlook-mobile-change-when-users-are-prompted-for-a-label) instead of when they send it. - **In preview**: Now rolling out in preview to SharePoint and Teams, users can select and change a sensitivity label from the details pane from these apps when [sensitivity labels are enabled for Office files in SharePoint and OneDrive](sensitivity-labels-sharepoint-onedrive-files.md). Whether it be adding new solutions to the [Microsoft Purview compliance portal]( - **Rolling out in preview**: As a parity feature for the AIP add-in, built-in labeling for Windows supports the configuration of a [default sublabel for a parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label). - **Rolling out in preview**: Word, Excel, and PowerPoint in Office for Mac also supports the [sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) and [label colors](sensitivity-labels-office-apps.md#label-colors).-- The earliest version for the AIP add-in to be [disabled by default in Office apps](sensitivity-labels-aip.md#how-to-disable-the-aip-add-in-to-use-built-in-labeling-for-office-apps) for the Current Channel and Monthly Enterprise Channel is now version 2302. The minimum version for the Semi-Annual Channel hasn't changed.--## December 2022 --### Communication compliance --- New [transparency note](/microsoft-365/compliance/communication-compliance-solution-overview) to convey the purpose and intended uses of machine learning in policy templates that use classifiers for business conduct and regulatory compliance.-- Changed the [time zone from local time zone to Coordinated Universal Time (UTC)](/microsoft-365/compliance/communication-compliance-policies) for policy activity detection, user-reported messages, and filters for reports.-- Updated table for [built-in trainable and global classifiers](/microsoft-365/compliance/communication-compliance-policies) to increase visibility for details specific to pre-trained classifiers. Includes updated word count requirements for messages in English and non-English languages.--### Compliance Manager --- Assessment templates that belong to the same regulation family now count as one template. The [definition of **included templates**](compliance-manager-templates-list.md#included-regulations) has been updated to align with [template licensing changes starting December 2022](compliance-manager-faq.yml#what-changed-with-template-licensing-in-december-2022-).-- Improvement actions now provide greater visibility into related controls and assessments. Improvement action details pages have a new [**Related controls** tab](compliance-manager-improvement-actions.md#improvement-actions-details-page), and the **Summary** section has a clickable **Assessments** number that, when selected, lists all the assessments related to that action.--### Data lifecycle management and records management --- Disposition review no longer has a maximum of 1,000,000 items per label pending or reviewed. This limitation is removed from [Limits for retention policies and retention label policies](retention-limits.md).--### Insider risk management --- [Examples of file paths](/microsoft-365/compliance/insider-risk-management-settings) to denote specific and wildcard folders and sub-folders to be excluded.--### Microsoft Priva --- [Tags for reviewing data in a subject rights request](/privacy/priva/subject-rights-requests-data-review#apply-tags) provide greater flexibility. There are now two default tags and 21 custom tags that can be named and defined by an organization. Tags can now be applied to, or removed from, multiple content items at once.-- The maximum file size for [file import during data review](/privacy/priva/subject-rights-requests-data-review#import-additional-files) for a subject rights request has increased to 500 MB.-- Instructions for working with the [action execution log report](/privacy/priva/subject-rights-requests-delete#action-execution-log-report) for a delete request have been updated; including a clarification that its retention period is the same as all other subject rights request reports.--### Sensitivity labels --- **General availability (GA)**: S/MIME support for Windows is now available in the Office Current Channel, providing parity with the AIP add-in. For more information, see [Apply S/MIME protection](sensitivity-labels-office-apps.md#configure-a-label-to-apply-smime-protection-in-outlook).-- **Rolling out in preview**: Protected meetings by [labeling calendar invites and responses, Teams meetings, and chat](sensitivity-labels-meetings.md).--## November 2022 --### Audit --- [Audit New Search](/microsoft-365/compliance/audit-new-search) - the new export limit is now up to a maximum of 500K (500,000 rows) for a single export.-- [Search the audit sign in the compliance portal](/microsoft-365/compliance/audit-log-search) - clarified table for retention policies and labels.--### Communication compliance --- [Messages in alerts](/microsoft-365/compliance/communication-compliance-investigate-remediate) now include a sentiment evaluation to help investigators quickly prioritize potentially riskier messages to address first.-- [Automatically detects if text is in a different language](/microsoft-365/compliance/communication-compliance-investigate-remediate) than the user's current system setting and displays alert message text accordingly. -- [Threat, Harassment, and Profanity classifiers](/microsoft-365/compliance/communication-compliance-policies) in the English language now inspects and evaluates messages with a word count of three or greater.--### Compliance Manager --- New [role-based access to assessments](compliance-manager-setup.md#role-based-access-to-assessments-and-regulations) allows you to assign users roles for viewing and managing individual assessments.-- [Working with improvement actions](compliance-manager-improvement-actions.md#assign-improvement-action-to-assessor-for-completion) - clarified that users need a **Compliance Manager Assessor** role in order to edit improvement action testing notes, and that roles can now be assigned for individual assessments.--### eDiscovery --- [Limits in eDiscovery (Premium)](/microsoft-365/compliance/limits-ediscovery20) - new section for review set viewer limits, the maximum number of items displayed per page in a review set is now 10,000.-- [Decryption in Microsoft Purview eDiscovery tools](/microsoft-365/compliance/ediscovery-decryption) - clarified how items labeled within SharePoint Online are decrypted with eDiscovery tools.-- [Conduct an eDiscovery investigation of content in Microsoft Teams](/microsoftteams/ediscovery-investigation) - expanded reactions in Microsoft Teams chats are now supported in eDiscovery (Premium).-- [Create an eDiscovery hold](/microsoft-365/compliance/create-ediscovery-holds) - clarified how eDiscovery holds are handled when a user's OneDrive URL changes.-- [Export documents from a review set in eDiscovery (Premium)](/microsoft-365/compliance/export-documents-from-review-set) - clarified how eDiscovery includes the parent email in the PST files if defined by the "Group" option in the review set.--### Insider risk management --- [Sensitive info types](/microsoft-365/compliance/insider-risk-management-settings) now has a limit of 500 types that you can exclude. The previous limit was 100 sensitive info types.-- Admins can now enable [potential high-impact user](/microsoft-365/compliance/insider-risk-management-settings) and [cumulative exfiltration activities](/microsoft-365/compliance/insider-risk-management-configure) score boosters in policy settings.-- New [risky browser indicators](/microsoft-365/compliance/insider-risk-management-settings) available for detecting user browsing activity related to websites that are considered malicious or risky and pose potential insider risk that may lead to a security or compliance incident.--### Microsoft Priva --- **In preview**: Delete requests are now supported by Subject Rights Requests.- - [Create and manage a delete request (preview)](/privacy/priva/subject-rights-requests-delete) - details the process for setting up a delete type of request, collaborating on a review process to approve the deletion, and initiating a workflow to carry out the deletion. - - [Set user permissions and assign roles](/privacy/priva/priva-permissions) - lists the new role of **Subject Rights Requests Approver** for delete request approvers. - - [Review data for a subject rights request](/privacy/priva/subject-rights-requests-data-review) - clarifies that adding the **delete** data review tag doesn't mark the item for deletion in the new delete request type. - - [Create a request and define search settings](/privacy/priva/subject-rights-requests-create) - adds **Delete (preview)** as a request type. --### On-premises scanner --- **General availability (GA)**: Configuration for the Microsoft Purview Information Protection scanner (formerly named Azure Information Protection unified labeling scanner) in the Microsoft Purview compliance portal. For more information, see [Configure & install the information protection scanner](deploy-scanner-configure-install.md).--### Sensitivity labels --- **General availability (GA)**: Trainable classifiers for [auto-labeling policies](apply-sensitivity-label-automatically.md#how-to-configure-auto-labeling-policies-for-sharepoint-onedrive-and-exchange). Trainable classifiers are now available for both auto-labeling for Office apps that use label settings (known as client-side auto-labeling) and auto-labeling policies (known as service-side auto-labeling). As a result, trainable classifiers are removed from the [comparison table](apply-sensitivity-label-automatically.md#compare-auto-labeling-for-office-apps-with-auto-labeling-policies) that lists only the differences between the two auto-labeling methods.--- The automated email that has the subject **Incompatible sensitivity label detected** for when there's a [labeling mismatch for a site](sensitivity-labels-teams-groups-sites.md#auditing-sensitivity-label-activities) now contains a link to an internal troubleshooting guide that you must specify as a URL with the *LabelMismatchEmailHelpLink* parameter from Set-SPOTenant.--- If you need to, you can now [disable co-authoring for your tenant by using PowerShell](sensitivity-labels-coauthoring.md#if-you-need-to-disable-this-feature).--## October 2022 --### Audit --- [Audit New Search](/microsoft-365/compliance/audit-new-search) - users can now run 10 concurrent audit search jobs with a max of one unfiltered search job, and review the progress %, result number, and job status in the UI. Historical search jobs results are now stored for 30 days and can be accessed after completion.)--### Communication compliance --- **In preview**: New communication compliance [integration with insider risk management](/microsoft-365/compliance/communication-compliance#integration-with-insider-risk-management-preview). Communication compliance can now provide risk signals detected in messages to insider risk management policies. Risky users detected in messages by the communication compliance policy act as a triggering event to bring users into scope for the insider risk management policies.--### Data loss prevention --- **In preview**: Multiple updates for authorization groups in [Configure endpoint DLP settings](/microsoft-365/compliance/dlp-configure-endpoint-settings) and [Using Endpoint data loss prevention](/microsoft-365/compliance/endpoint-dlp-using).- - [Printer groups](/microsoft-365/compliance/dlp-configure-endpoint-settings#printer-groups-preview) - - [Removable USB storage device groups](/microsoft-365/compliance/dlp-configure-endpoint-settings#removable-storage-device-groups-preview) - - [Network share paths](/microsoft-365/compliance/dlp-configure-endpoint-settings#network-share-groups-preview) - - [Website groups](/microsoft-365/compliance/endpoint-dlp-using#scenario-4-avoid-looping-dlp-notifications-from-cloud-synchronization-apps-with-auto-quarantine-preview) - - [VPN network location groups](/microsoft-365/compliance/dlp-configure-endpoint-settings#vpn-settings-preview) - - [Sensitive service domains](/microsoft-365/compliance/dlp-configure-endpoint-settings#sensitive-service-domains) -- **In preview**: Policies can use grouping of conditions, nesting of groups and the use of boolean operators (AND/OR/NOT) between them.- - [Complex rule design](/microsoft-365/compliance/dlp-policy-design#complex-rule-design-preview) - - [Use trainable classifiers as conditions in DLP policies](/microsoft-365/compliance/dlp-policy-reference#location-support-for-how-content-can-be-defined) -- **In preview**: For endpoints, support for detecting sensitive items that are password protected or encrypted.- - [Conditions that devices support](/microsoft-365/compliance/dlp-policy-reference#conditions-devices-supports) -- **Generally available**: [100 new files types that can be scanned](/exchange/security-and-compliance/mail-flow-rules/inspect-message-attachments#supported-file-types-for-mail-flow-rule-content-inspection)--### eDiscovery --- [Limits for Content search and eDiscovery (Standard)](/microsoft-365/compliance/limits-for-content-search) - clarified how eDiscovery jobs are counted towards limits.-- [Export documents from a review set in eDiscovery (Premium)](/microsoft-365/compliance/export-documents-from-review-set) - removed conversation PDF support per feature and UI updates.-- [Assign eDiscovery permissions in the compliance portal](/microsoft-365/compliance/ediscovery-assign-permissions) - added content to support new Manage review set tags role.-- [New-ComplianceSecurityFilter](/powershell/module/exchange/new-compliancesecurityfilter) - now support only 'all' parameters, removed non-supported example scenarios.-- [Keyword queries and search conditions for eDiscovery](/microsoft-365/compliance/keyword-queries-and-search-conditions) - clarified the supported FolderId 48-character format indexed for search.--### Insider risk management --- **In preview**: Insider risk management introduces [forensic evidence](/microsoft-365/compliance/insider-risk-management-forensic-evidence), which enables customizable visual activity capturing across devices to help your organization better mitigate, understand, and respond to potential data risks like unauthorized data exfiltration of sensitive data.-- **In preview**: Insider risk management [integration with communication compliance](/microsoft-365/compliance/communication-compliance#integration-with-insider-risk-management-preview) when using the *Data leaks by risky users* or *Security policy violations by risky users* policy templates. Communication compliance can now provide risk signals detected in messages to insider risk management policies.-- **In preview**: New [inline alert customization](/microsoft-365/compliance/insider-risk-management-settings#inline-alert-customization-preview) allows analysts and investigators to quickly edit policies when reviewing alerts.-- New [priority content scoring updates](/microsoft-365/compliance/insider-risk-management-policies#prioritize-content-in-policies) that allow you to choose whether to assign risk scores to all activities detected by a policy or only activities that include priority content.-- Security teams are now able to [customize a security trigger](/microsoft-365/compliance/insider-risk-management-policy-templates#policy-templates) in the 'data leaks' policy to surface when a user performs a sequence, enabling them to respond to user actions that might be considered riskier.-- New updates now allow security teams to create [policies with sequences](/microsoft-365/compliance/insider-risk-management-policies#sequence-detection-preview) without any other required underlying policy indicator selections.--### Data lifecycle management and records management --- **General availability (GA)**: [Relabeling at the end of the retention period](retention-settings.md#relabeling-at-the-end-of-the-retention-period).-- **General availability (GA)**: [Starting a record unlocked](declare-records.md#configuring-retention-labels-to-declare-records).-- **General availability (GA)**: Users can now apply published retention labels to files [directly in Teams](create-apply-retention-labels.md#applying-retention-labels-using-microsoft-365-groups).-- New retention support statements: Retention policies for Teams support the [chat with myself](https://support.microsoft.com/office/start-a-chat-in-teams-0c71b32b-c050-4930-a887-5afbe742b3d8?storagetype=live#bkmk_chatwithself) feature, [video clips](https://support.microsoft.com/office/record-a-video-clip-in-teams-0c57dae5-2974-4214-9c46-7a2136386f1c), and call data records, which are system-generated messages that contain [metadata for meetings and calls](/MicrosoftTeams/ediscovery-investigation#teams-metadata). Retention policies for Yammer support [storyline posts](https://support.microsoft.com/office/overview-of-storyline-for-yammer-and-viva-engage-530e4e66-9f1c-4be1-b371-08ea40dc4b69).-- Improved in-product experience if retention policies have errors: You'll now see a detailed description of the error in the details pane, with in-product actions to take that can resolve the problem. For example, remove invalid locations and resynchronize the policy.--### Microsoft Priva --- **In preview**: [Data transfer policies](/privacy/priva/risk-management-policy-data-transfer) in Privacy Risk Management now offers additional flexible boundary conditions: detecting transfers based on users' Azure Active Directory attributes, transfers between users in different Microsoft 365 groups, and transfers between SharePoint sites.--### On-premises scanner --- **In preview**: The Azure Information Protection (AIP) on-premises scanner is being renamed **Microsoft Purview Information Protection scanner** and [configuration is moving to the Microsoft Purview compliance portal](/information-protection/deploy-aip-scanner-configure-install).--### Sensitivity labels --- Call to action: [Migration guidance](sensitivity-labels-aip.md) to help you move from the AIP add-in for Office apps, with a [migration playbook](https://microsoft.github.io/ComplianceCxE/playbooks/AIP2MIPPlaybook) from our Customer Experience Engineering (CxE) team-- **General availability (GA)**: Authentication contexts for label [groups and site settings](sensitivity-labels-teams-groups-sites.md#how-to-configure-groups-and-site-settings) that work with Azure AD Conditional Access policies to enforce more stringent access conditions to a site.-- **General availability (GA)**: [Site sharing permissions by using PowerShell](sensitivity-labels-teams-groups-sites.md#configure-site-sharing-permissions-by-using-powershell-advanced-settings).-- **General availability (GA)**: [Preventing copy to clipboard is honored for labeled and encrypted files in SharePoint and OneDrive](sensitivity-labels-sharepoint-onedrive-files.md#limitations), with some exceptions for relabeling scenarios.-- **In preview**: The AIP add-in for Office apps is [disabled by default](sensitivity-labels-aip.md#how-to-disable-the-aip-add-in-to-use-built-in-labeling-for-office-apps) and requires a new setting to override this default.-- Support statement: [Files types supported for SharePoint and OneDrive](sensitivity-labels-sharepoint-onedrive-files.md#supported-file-types), after enabling sensitivity labels for these services.-- New [prerequisite for co-authoring](sensitivity-labels-coauthoring.md#prerequisites) and the Azure Information Protection unified labeling client and scanner: It's not supported to use Double Key Encryption in the same tenant as the co-authoring feature.--### Trainable classifiers --- **In preview** 20 + new trainable classifiers and a standalone trainable classifier definitions article.- - [Trainable classifiers definitions](/microsoft-365/compliance/classifier-tc-definitions.md) --## September 2022 --### Communication compliance --- [Get started with communication compliance](/microsoft-365/compliance/communication-compliance-configure): New updates for recommended actions and accelerated onboarding. Recommended actions can help your organization quickly get started with communication compliance.-- [Investigate and remediate communication compliance alerts](/microsoft-365/compliance/communication-compliance-investigate-remediate): New update for keyword highlighting support for plain text view. Keyword highlighting, which is currently available for English language only, can help direct you to the area of interest in long messages and attachments.-- [Use communication compliance reports and audits](/microsoft-365/compliance/communication-compliance-reports-audits): Clarifications on permissions needed to view and manage communication compliance reports. To view and manage reports, users must be assigned to the *Communication Compliance Viewers* role group.- -### Compliance Manager --- [Compliance Manager templates list](/microsoft-365/compliance/compliance-manager-templates-list): New template added for Australian Information Security Registered Assessor Program (IRAP) with ISM Version 3.5 - Official).--### Data Classification --- [Increase classifier accuracy (preview)](data-classification-increase-accuracy.md) - This article shows you how to confirm whether items matched by a classifier are true positive (a Match) or a false positive (Not a match) and provide Match, or Not a match feedback. You can use that feedback to tune your classifiers to increase accuracy. You can also send redacted versions of the document and the Match, Not a Match feedback to Microsoft if you want to help increase the accuracy of the classifiers that Microsoft provides.--### Data lifecycle management and records management --- **In preview**: Retention labels now support running a Power Automate flow at the end of the retention period to support custom actions and integration with other solutions. For more information, see [Customize what happens at the end of the retention period](retention-label-flow.md).-- For records management items undergoing disposition review, when you select that item in the Disposition area of the compliance portal, a new Progress column displays the item's status. That status can be "Approved for deletion, 'Awaiting deletion from SharePoint/OneDrive' or 'Awaiting deletion from Exchange', or "Permanently Deleted". When an item is approved for permanent deletion as part of the disposition review process, that deletion can take up to 15 days to complete and this new column helps you to track its progress.-- The configuration to [enable a mailbox for archiving](enable-archive-mailboxes.md) is moving to the new Exchange admin center (EAC) and instructions have been updated accordingly.-- Currently, trainable classifiers for auto-apply retention labels aren't supported with adaptive scopes. As a workaround, use static scopes for this configuration combination.-- Instructions to [Customize an archive and deletion policy for mailboxes](set-up-an-archive-and-deletion-policy-for-mailboxes.md) are updated to include only retention tags that have an outcome that can't be achieved with Microsoft 365 retention.--### Data loss prevention --- [Design a data loss prevention policy complex rule design](dlp-policy-design.md#complex-rule-design) - The DLP rule builder supports boolean logic (AND, OR, NOT) and nested groups. New video and content added that walks you through this new functionality.--### Sensitivity labels -- [PDF support](sensitivity-labels-office-apps.md#pdf-support) in Word, Excel, and PowerPoint is now available to Windows Current Channel and Monthly Enterprise Channel.-- Default label for existing documents is now fully rolled out to Mac and Windows in Current Channel and Monthly Enterprise Channel, providing parity with the AIP add-in.-- **In preview**: The new [sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) and support for [label colors](sensitivity-labels-office-apps.md#label-colors) in Office apps, providing parity with the AIP add-in with additional functionality.-- **In preview**: [S/MIME support](sensitivity-labels-office-apps.md#configure-a-label-to-apply-smime-protection-in-outlook) for Windows, providing parity with the AIP add-in. Support for Mac and mobile is now fully rolled out.-- **In preview**: Trainable classifiers for auto-labeling policies (all workloads).--### Trainable classifiers --- [Trainable classifiers definitions](classifier-tc-definitions.md) - more than 20 new classifiers have been added, so the definitions for all trainable classifiers have been broken out into this new article.+- The earliest version for the AIP add-in to be [disabled by default in Office apps](sensitivity-labels-aip.md#how-to-disable-the-aip-add-in-to-use-built-in-labeling-for-office-apps) for the Current Channel and Monthly Enterprise Channel is now version 2302. The minimum version for the Semi-Annual Channel hasn't changed. |
| enterprise | M365 Dr Workload Other | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/m365-dr-workload-other.md | Please refer to [Azure Active Directory Data Locations](https://aka.ms/aaddatama Tenants in EU member Countries maintain data in Macro Region Geography 1 ΓÇô EMEA. All other tenants have customer data stored in the United States, except Australia. For customers in Australia, Microsoft Forms customer data will be stored at rest in Australia for all new tenants using Forms and existing tenants that have not previously used Forms. ### Intune-Refer to endpoint.microsoft.com, Tenant Administration | Tenant Status for existing tenants. If you do not have an existing tenant, create a trial tenant and provision Intune. --- Microsoft will not store Intune customer data at rest outside the stated geo, except if:+Refer to endpoint.microsoft.com, Tenant Administration | Tenant Status for existing tenants. If you do not have an existing tenant, create a trial tenant and provision Intune. Microsoft will not store Intune customer data at rest outside the stated geo, except if: - It is necessary for Microsoft to provide customer support, troubleshoot the service, or comply with legal requirements. - The customer configures an account to enable such storage of customer data, including through the use of the following: - Features that are designed to operate globally, such as Content Delivery Network (CDN), which provides a global caching service and stores customer data at edge locations around the world.++- If you are using the Remote Help feature, the Helper and Sharer's information may be sent outside of the stated Geo for 48 hours. - For Azure Active Directory: Please refer to [Azure Active Directory Data Locations](https://aka.ms/aaddatamap). - Preview, beta, or other prerelease services, which typically store customer data in the United States but may store it globally. Regardless, Microsoft does not control or limit the Geo from which customers or their end users may access customer data. Similarly, where customer data in other services is subsequently integrated into Intune, the originating customer data will continue to be stored subject to the other service's own Geo commitments (if any); only the copy of the customer data integrated into Intune will be stored in the stated Geo for Intune. |
| enterprise | Microsoft 365 Apps Monitoring | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/microsoft-365-apps-monitoring.md | Title: "Microsoft 365 Apps monitoring" Previously updated : 03/25/2022 Last updated : 03/25/2023 audience: Admin |
| enterprise | Microsoft 365 Teams Monitoring | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/microsoft-365-teams-monitoring.md | Title: "Microsoft 365 Teams monitoring" Previously updated : 03/25/2022 Last updated : 03/25/2023 audience: Admin |
| enterprise | O365 Data Locations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/o365-data-locations.md | description: "Determine where your Microsoft 365 customer data is stored worldwi # Where your Microsoft 365 customer data is stored ->[!NOTE] ->The **Poland** local data center region launched on April 26, 2023. If your organization requires the migration of your Microsoft 365 customer data to Poland, and a data residency commitments for Poland, please refer to [Advanced Data Residency](advanced-data-residency.md) for more information. -->[!NOTE] -> For tenants in Australia, Brazil, Canada, France, Germany, India, Japan, Qatar, South Korea, Norway, South Africa, Sweden, Switzerland, United Arab Emirates, and the United Kingdom), additional workloads are available for data residency commitments. Refer to [Advanced Data Residency](advanced-data-residency.md) for more information. +> [!NOTE] +> The **Poland** local data center region launched on April 26, 2023. If your organization requires the migration of your Microsoft 365 customer data to Poland, and a data residency commitments for Poland, please refer to [Advanced Data Residency](advanced-data-residency.md) for more information. +> [!NOTE] +> For tenants in Australia, Brazil, Canada, France, Germany, India, Japan, Qatar, South Korea, Norway, South Africa, Sweden, Switzerland, United Arab Emirates, and the United Kingdom, additional workloads are available for data residency commitments. Refer to [Advanced Data Residency](advanced-data-residency.md) for more information. See the following links to understand how you can determine current workload data location. -- Exchange Online [Data Location](m365-dr-workload-exo#how-can-i-determine-customer-data-location)+- Exchange Online [Data Location](m365-dr-workload-exo.md#how-can-i-determine-customer-data-location) - SharePoint Online (ODSP) and OneDrive for Business [Data Location](m365-dr-workload-spo.md#how-can-i-determine-customer-data-location) - Microsoft Teams [Data Location](m365-dr-workload-teams.md#how-can-i-determine-customer-data-location) - Microsoft Defender for Office (MDO P1) [Data Location](m365-dr-workload-mdo-p1.md#how-can-i-determine-customer-data-location) |
| includes | Microsoft 365 Content Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-365-content-updates.md | +## Week of June 05, 2023 +++| Published On |Topic title | Change | +|||--| +| 6/5/2023 | [Set preferences for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-preferences?view=o365-worldwide) | modified | +| 6/5/2023 | Mail flow map | removed | +| 6/6/2023 | [Understanding deployment insights in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-deployment-insights-overview?view=o365-worldwide) | modified | +| 6/6/2023 | [Submit files in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/admin-submissions-mde?view=o365-worldwide) | modified | +| 6/6/2023 | [Get baseline profile configurations](/microsoft-365/security/defender-endpoint/get-security-baselines-assessment-configurations?view=o365-worldwide) | modified | +| 6/6/2023 | [Microsoft Defender Antivirus security intelligence and product updates](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates?view=o365-worldwide) | modified | +| 6/6/2023 | [Advanced Hunting API](/microsoft-365/security/defender-endpoint/run-advanced-query-api?view=o365-worldwide) | modified | +| 6/6/2023 | [Microsoft 365 Defender advanced hunting API](/microsoft-365/security/defender/api-advanced-hunting?view=o365-worldwide) | modified | +| 6/6/2023 | [Manage incidents and alerts from Defender for Office 365 in Microsoft 365 Defender](/microsoft-365/security/office-365-security/mdo-sec-ops-manage-incidents-and-alerts?view=o365-worldwide) | modified | +| 6/6/2023 | [View email security reports](/microsoft-365/security/office-365-security/reports-email-security?view=o365-worldwide) | modified | +| 6/6/2023 | [Admin review for user reported messages](/microsoft-365/security/office-365-security/submissions-admin-review-user-reported-messages?view=o365-worldwide) | modified | +| 6/6/2023 | [Manage submissions](/microsoft-365/security/office-365-security/submissions-admin?view=o365-worldwide) | modified | +| 6/6/2023 | [Errors during admin submissions](/microsoft-365/security/office-365-security/submissions-error-messages?view=o365-worldwide) | modified | +| 6/6/2023 | [Report phishing and suspicious emails in Outlook for admins](/microsoft-365/security/office-365-security/submissions-outlook-report-messages?view=o365-worldwide) | modified | +| 6/6/2023 | [Report spam, non-spam, phishing, suspicious emails and files to Microsoft](/microsoft-365/security/office-365-security/submissions-report-messages-files-to-microsoft?view=o365-worldwide) | modified | +| 6/6/2023 | [Submit malware and good files to Microsoft for analysis](/microsoft-365/security/office-365-security/submissions-submit-files-to-microsoft?view=o365-worldwide) | modified | +| 6/6/2023 | [User reported message settings in Teams](/microsoft-365/security/office-365-security/submissions-teams?view=o365-worldwide) | modified | +| 6/6/2023 | [User reported settings](/microsoft-365/security/office-365-security/submissions-user-reported-messages-custom-mailbox?view=o365-worldwide) | modified | +| 6/6/2023 | [Manage allows and blocks in the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-about?view=o365-worldwide) | modified | +| 6/6/2023 | [Manage library settings in Microsoft Syntex](/microsoft-365/syntex/manage-library-settings) | added | +| 6/6/2023 | [Set up Basic Mobility and Security](/microsoft-365/admin/basic-mobility-security/set-up?view=o365-worldwide) | modified | +| 6/6/2023 | [Configure remediation for Microsoft Defender Antivirus detections](/microsoft-365/security/defender-endpoint/configure-remediation-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 6/6/2023 | [Protect Dev Drive using performance mode](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-antivirus-performance-mode?view=o365-worldwide) | modified | +| 6/6/2023 | [Protect security settings with tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide) | modified | +| 6/6/2023 | [Overview of Microsoft Syntex](/microsoft-365/syntex/syntex-overview) | modified | +| 6/7/2023 | [Use sensitivity labels to protect calendar items, Teams meetings, and chat](/microsoft-365/compliance/sensitivity-labels-meetings?view=o365-worldwide) | modified | +| 6/7/2023 | [How to search the audit logs for actions performed by Defender Experts](/microsoft-365/security/defender/auditing?view=o365-worldwide) | modified | +| 6/7/2023 | [Before you begin using Defender Experts for XDR](/microsoft-365/security/defender/before-you-begin-xdr?view=o365-worldwide) | modified | +| 6/7/2023 | [Get started with Microsoft Defender Experts for XDR](/microsoft-365/security/defender/get-started-xdr?view=o365-worldwide) | modified | +| 6/7/2023 | [How to use the Microsoft Defender Experts for XDR service](/microsoft-365/security/defender/start-using-mdex-xdr?view=o365-worldwide) | modified | +| 6/7/2023 | [Accessibility mode in Microsoft Syntex](/microsoft-365/syntex/accessibility-mode) | modified | +| 6/7/2023 | [Discover other trained models in Microsoft Syntex](/microsoft-365/syntex/discover-other-trained-models) | modified | +| 6/7/2023 | [Overview of unstructured document processing in Microsoft Syntex](/microsoft-365/syntex/document-understanding-overview) | modified | +| 6/7/2023 | [Get started with the Microsoft Purview extension for Chrome](/microsoft-365/compliance/dlp-chrome-get-started?view=o365-worldwide) | modified | +| 6/7/2023 | [Learn about the Microsoft Purview extension for Chrome](/microsoft-365/compliance/dlp-chrome-learn-about?view=o365-worldwide) | modified | +| 6/7/2023 | [Get started with the Microsoft Purview extension for Firefox](/microsoft-365/compliance/dlp-firefox-extension-get-started?view=o365-worldwide) | modified | +| 6/7/2023 | [Learn about the Microsoft Purview extension for Firefox](/microsoft-365/compliance/dlp-firefox-extension-learn?view=o365-worldwide) | modified | +| 6/7/2023 | [Microsoft 365 data locations](/microsoft-365/enterprise/o365-data-locations?view=o365-worldwide) | modified | +| 6/7/2023 | [Microsoft Defender Antivirus compatibility with other security products](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility?view=o365-worldwide) | modified | +| 6/7/2023 | [Create and deploy a data loss prevention policy](/microsoft-365/compliance/dlp-create-deploy-policy?view=o365-worldwide) | modified | +| 6/7/2023 | [What's new in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/defender-for-office-365-whats-new?view=o365-worldwide) | modified | +| 6/7/2023 | [Manage quarantined messages and files as an admin](/microsoft-365/security/office-365-security/quarantine-admin-manage-messages-files?view=o365-worldwide) | modified | +| 6/7/2023 | [Manage submissions](/microsoft-365/security/office-365-security/submissions-admin?view=o365-worldwide) | modified | +| 6/7/2023 | [Allow or block email using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure?view=o365-worldwide) | modified | +| 6/7/2023 | [Allow or block files using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-files-configure?view=o365-worldwide) | modified | +| 6/7/2023 | [Allow or block URLs using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-urls-configure?view=o365-worldwide) | modified | +| 6/7/2023 | [Try and evaluate Defender for Office 365](/microsoft-365/security/office-365-security/try-microsoft-defender-for-office-365?view=o365-worldwide) | modified | +| 6/8/2023 | [Room and equipment mailboxes](/microsoft-365/admin/manage/room-and-equipment-mailboxes?view=o365-worldwide) | modified | +| 6/8/2023 | [Create organization-wide signatures and disclaimers](/microsoft-365/admin/setup/create-signatures-and-disclaimers?view=o365-worldwide) | modified | +| 6/8/2023 | [Troubleshoot license issues for Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-support-license?view=o365-worldwide) | modified | +| 6/8/2023 | [Automatically apply a sensitivity label in Microsoft 365](/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) | modified | +| 6/8/2023 | [What's new in Microsoft Purview risk and compliance solutions](/microsoft-365/compliance/whats-new?view=o365-worldwide) | modified | +| 6/9/2023 | [Cancel your Microsoft business subscription](/microsoft-365/commerce/subscriptions/cancel-your-subscription?view=o365-worldwide) | modified | +| 6/9/2023 | [Learn about data loss prevention](/microsoft-365/compliance/dlp-learn-about-dlp?view=o365-worldwide) | modified | +| 6/9/2023 | [Microsoft 365 data locations](/microsoft-365/enterprise/o365-data-locations?view=o365-worldwide) | modified | +| 6/9/2023 | [Overview of Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-overview?view=o365-worldwide) | modified | +| 6/9/2023 | [Delete a model in Microsoft Syntex](/microsoft-365/syntex/delete-a-model) | modified | +| 6/9/2023 | [Configure shared mailbox settings](/microsoft-365/admin/email/configure-a-shared-mailbox?view=o365-worldwide) | modified | +| 6/9/2023 | [What's new in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-whats-new?view=o365-worldwide) | modified | +| 6/9/2023 | [Address compromised user accounts with automated investigation and response](/microsoft-365/security/office-365-security/address-compromised-users-quickly?view=o365-worldwide) | modified | +| 6/9/2023 | [Configure anti-malware policies](/microsoft-365/security/office-365-security/anti-malware-policies-configure?view=o365-worldwide) | modified | +| 6/9/2023 | [Anti-malware protection](/microsoft-365/security/office-365-security/anti-malware-protection-about?view=o365-worldwide) | modified | +| 6/9/2023 | [How EOP validates the From address to prevent phishing](/microsoft-365/security/office-365-security/anti-phishing-from-email-address-validation?view=o365-worldwide) | modified | +| 6/9/2023 | [Anti-phishing policies](/microsoft-365/security/office-365-security/anti-phishing-policies-about?view=o365-worldwide) | modified | +| 6/9/2023 | [Anti-phishing protection](/microsoft-365/security/office-365-security/anti-phishing-protection-about?view=o365-worldwide) | modified | +| 6/9/2023 | [Anti-spoofing protection](/microsoft-365/security/office-365-security/anti-phishing-protection-spoofing-about?view=o365-worldwide) | modified | +| 6/9/2023 | [Tune anti-phishing protection](/microsoft-365/security/office-365-security/anti-phishing-protection-tuning?view=o365-worldwide) | modified | +| 6/9/2023 | [Backscatter in EOP](/microsoft-365/security/office-365-security/anti-spam-backscatter-about?view=o365-worldwide) | modified | +| 6/9/2023 | [Bulk complaint level values](/microsoft-365/security/office-365-security/anti-spam-bulk-complaint-level-bcl-about?view=o365-worldwide) | modified | +| 6/9/2023 | [ASF settings in EOP](/microsoft-365/security/office-365-security/anti-spam-policies-asf-settings-about?view=o365-worldwide) | modified | +| 6/9/2023 | [Configure spam filter policies](/microsoft-365/security/office-365-security/anti-spam-policies-configure?view=o365-worldwide) | modified | +| 6/9/2023 | [Anti-spam protection](/microsoft-365/security/office-365-security/anti-spam-protection-about?view=o365-worldwide) | modified | +| 6/9/2023 | [Spam confidence level](/microsoft-365/security/office-365-security/anti-spam-spam-confidence-level-scl-about?view=o365-worldwide) | modified | +| 6/9/2023 | [What's the difference between junk email and bulk email?](/microsoft-365/security/office-365-security/anti-spam-spam-vs-bulk-about?view=o365-worldwide) | modified | +| 6/9/2023 | [Spoof intelligence insight](/microsoft-365/security/office-365-security/anti-spoofing-spoof-intelligence?view=o365-worldwide) | modified | +| 6/9/2023 | [Allow or block email using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure?view=o365-worldwide) | modified | ++ ## Week of May 29, 2023 | 5/12/2023 | [Create and publish sensitivity labels](/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) | modified | | 5/12/2023 | [Impersonation insight](/microsoft-365/security/office-365-security/anti-phishing-mdo-impersonation-insight?view=o365-worldwide) | modified | | 5/12/2023 | [Configure anti-phishing policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure?view=o365-worldwide) | modified |---## Week of May 01, 2023 ---| Published On |Topic title | Change | -|||--| -| 5/1/2023 | [Microsoft 365 Multi-Geo](/microsoft-365/enterprise/microsoft-365-multi-geo?view=o365-worldwide) | modified | -| 5/1/2023 | [Plan for Microsoft 365 Multi-Geo](/microsoft-365/enterprise/plan-for-multi-geo?view=o365-worldwide) | modified | -| 5/1/2023 | [Microsoft Defender for Cloud Apps in Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-center-defender-cloud-apps?view=o365-worldwide) | modified | -| 5/1/2023 | [Redirecting accounts from Microsoft Defender for Cloud Apps to Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-mda-redirection?view=o365-worldwide) | modified | -| 5/1/2023 | [Configure anti-phishing policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure?view=o365-worldwide) | modified | -| 5/1/2023 | [Use DMARC to validate email, setup steps](/microsoft-365/security/office-365-security/email-authentication-dmarc-configure?view=o365-worldwide) | modified | -| 5/1/2023 | [Manage jobs in eDiscovery (Premium)](/microsoft-365/compliance/ediscovery-managing-jobs?view=o365-worldwide) | modified | -| 5/1/2023 | Supported Microsoft Defender for Endpoint response APIs | removed | -| 5/1/2023 | [Microsoft Teams and Microsoft Purview Communication Compliance](/microsoft-365/compliance/communication-compliance-teams?view=o365-worldwide) | added | -| 5/1/2023 | [Install Microsoft 365 Apps on all devices in Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-install-office-apps?view=o365-worldwide) | modified | -| 5/1/2023 | [Top 10 ways to secure your business data with Microsoft 365 for business](/microsoft-365/business-premium/secure-your-business-data?view=o365-worldwide) | modified | -| 5/1/2023 | [Set up and configure Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-setup-configuration?view=o365-worldwide) | modified | -| 5/2/2023 | [Manage insider risk management forensic evidence](/microsoft-365/compliance/insider-risk-management-forensic-evidence-manage?view=o365-worldwide) | modified | -| 5/2/2023 | [Mailbox utilization service alerts](/microsoft-365/enterprise/microsoft-365-mailbox-utilization-service-alerts?view=o365-worldwide) | modified | -| 5/2/2023 | [Configure anti-phishing policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure?view=o365-worldwide) | modified | -| 5/2/2023 | [Configure and review priority accounts in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/priority-accounts-turn-on-priority-account-protection?view=o365-worldwide) | modified | -| 5/2/2023 | [Create and manage communication compliance policies](/microsoft-365/compliance/communication-compliance-policies?view=o365-worldwide) | modified | -| 5/2/2023 | [Why choose Microsoft 365 Business Premium? Productivity and security](/microsoft-365/business-premium/why-choose-microsoft-365-business-premium?view=o365-worldwide) | renamed | -| 5/2/2023 | [Top 10 ways to secure your business data with Microsoft 365 for business](/microsoft-365/business-premium/secure-your-business-data?view=o365-worldwide) | modified | -| 5/2/2023 | [Microsoft 365 Business Premium resources # < 60 chars](/microsoft-365/business/index?view=o365-worldwide) | modified | -| 5/2/2023 | [Anti-phishing policies](/microsoft-365/security/office-365-security/anti-phishing-policies-about?view=o365-worldwide) | modified | -| 5/2/2023 | [Multi-factor authentication for users](/microsoft-365/business-premium/m365bp-mfa-for-users?view=o365-worldwide) | renamed | -| 5/2/2023 | [Secure managed devices with Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-protect-managed-devices?view=o365-worldwide) | renamed | -| 5/2/2023 | [Install Microsoft 365 Apps on your devices with Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-users-install-m365-apps?view=o365-worldwide) | renamed | -| 5/2/2023 | [Protect unmanaged computers with Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-users-protect-unmanaged-devices?view=o365-worldwide) | renamed | -| 5/2/2023 | [Set up information protection capabilities in Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-set-up-compliance?view=o365-worldwide) | modified | -| 5/2/2023 | [Set up GDAP for your customers](/microsoft-365/lighthouse/m365-lighthouse-setup-gdap?view=o365-worldwide) | modified | -| 5/2/2023 | [Troubleshoot error messages and problems in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-troubleshoot?view=o365-worldwide) | modified | -| 5/2/2023 | [Microsoft Defender Antivirus security intelligence and product updates](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates?view=o365-worldwide) | modified | -| 5/2/2023 | [Microsoft Defender Antivirus updates - Previous versions for technical upgrade support](/microsoft-365/security/defender-endpoint/msda-updates-previous-versions-technical-upgrade-support?view=o365-worldwide) | modified | -| 5/2/2023 | [What's new in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/defender-for-office-365-whats-new?view=o365-worldwide) | modified | -| 5/3/2023 | [Advanced indexing of custodian and non-custodial data sources](/microsoft-365/compliance/ediscovery-indexing-custodian-data?view=o365-worldwide) | modified | -| 5/3/2023 | Use the Frontline Worker onboarding wizard to get your frontline workforce up and running | removed | -| 5/3/2023 | [Start with a pilot deployment of Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-pilot?view=o365-worldwide) | modified | -| 5/3/2023 | [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-worldwide) | modified | -| 5/3/2023 | [Complete Safe Links overview for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/safe-links-about?view=o365-worldwide) | modified | -| 5/3/2023 | Configure global settings for Safe Links settings in Defender for Office 365 | removed | -| 5/4/2023 | [Configure cloud settings for use with Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-cloud-settings?view=o365-worldwide) | added | -| 5/4/2023 | [Glossary of terms for Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-glossary?view=o365-worldwide) | added | -| 5/4/2023 | [Multicloud support in Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-multicloud?view=o365-worldwide) | added | -| 5/4/2023 | [Build and manage assessments in Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-assessments?view=o365-worldwide) | modified | -| 5/4/2023 | [Microsoft Purview Compliance Manager FAQ](/microsoft-365/compliance/compliance-manager-faq?view=o365-worldwide) | modified | -| 5/4/2023 | [Working with improvement actions in Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-improvement-actions?view=o365-worldwide) | modified | -| 5/4/2023 | [Get started with Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-setup?view=o365-worldwide) | modified | -| 5/4/2023 | [Microsoft Purview Compliance Manager regulations list](/microsoft-365/compliance/compliance-manager-templates-list?view=o365-worldwide) | modified | -| 5/4/2023 | [Learn about regulations in Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-templates?view=o365-worldwide) | modified | -| 5/4/2023 | [Update improvement actions and bring compliance data into Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-update-actions?view=o365-worldwide) | modified | -| 5/4/2023 | [What's new in Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager-whats-new?view=o365-worldwide) | modified | -| 5/4/2023 | [Microsoft Purview Compliance Manager](/microsoft-365/compliance/compliance-manager?view=o365-worldwide) | modified | -| 5/4/2023 | [Compliance score calculation](/microsoft-365/compliance/compliance-score-calculation?view=o365-worldwide) | modified | -| 5/4/2023 | [Set up or edit your controlled folder access policy in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-controlled-folder-access?view=o365-worldwide) | added | -| 5/4/2023 | [Review or edit your next-generation protection policies Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-next-generation-protection?view=o365-worldwide) | renamed | -| 5/4/2023 | [Review and edit settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-portal-advanced-feature-settings?view=o365-worldwide) | added | -| 5/4/2023 | [Set up web content filtering in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-web-content-filtering?view=o365-worldwide) | added | -| 5/4/2023 | [OneDrive Cross-tenant OneDrive migration FAQs](/microsoft-365/enterprise/cross-tenant-onedrive-migration-faqs?view=o365-worldwide) | modified | -| 5/4/2023 | [Enable your attack surface reduction rules in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-asr?view=o365-worldwide) | modified | -| 5/4/2023 | [Set up, review, and edit your security policies and settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-configure-security-settings?view=o365-worldwide) | modified | -| 5/4/2023 | Manage custom rules for firewall policies in Microsoft Defender for Business | removed | -| 5/4/2023 | [Firewall in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-firewall?view=o365-worldwide) | modified | -| 5/4/2023 | [Mobile threat defense capabilities in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-mtd?view=o365-worldwide) | modified | -| 5/4/2023 | [Microsoft Defender for Business trial user guide](/microsoft-365/security/defender-business/trial-playbook-defender-business?view=o365-worldwide) | modified | -| 5/5/2023 | [Top 10 ways to secure your business data with Microsoft 365 for business](/microsoft-365/business-premium/secure-your-business-data?view=o365-worldwide) | modified | -| 5/5/2023 | [Onboard and offboard macOS devices into Microsoft Purview solutions using Microsoft Intune](/microsoft-365/compliance/device-onboarding-offboarding-macos-intune?view=o365-worldwide) | modified | -| 5/5/2023 | [Get started with insider risk management settings](/microsoft-365/compliance/insider-risk-management-settings?view=o365-worldwide) | modified | -| 5/5/2023 | [Cross-tenant SharePoint site migration overview (preview)](/microsoft-365/enterprise/cross-tenant-sharepoint-migration?view=o365-worldwide) | modified | -| 5/5/2023 | [Manage quarantined messages and files as an admin](/microsoft-365/security/office-365-security/quarantine-admin-manage-messages-files?view=o365-worldwide) | modified | -| 5/5/2023 | [Audit log activities](/microsoft-365/compliance/audit-log-activities?view=o365-worldwide) | modified | -| 5/5/2023 | [Get started with Activity explorer](/microsoft-365/compliance/data-classification-activity-explorer?view=o365-worldwide) | modified | -| 5/5/2023 | [Increase Classifier Accuracy](/microsoft-365/compliance/data-classification-increase-accuracy?view=o365-worldwide) | modified | -| 5/5/2023 | [Microsoft Defender for Office 365 email entity page](/microsoft-365/security/office-365-security/mdo-email-entity-page?view=o365-worldwide) | modified | -| 5/5/2023 | [Understanding deployment insights in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-deployment-insights-overview?view=o365-worldwide) | added | -| 5/5/2023 | [Manage tenants using insights in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-manage-tenants-using-deployment-insights?view=o365-worldwide) | added | -| 5/5/2023 | [Manage insider risk management forensic evidence](/microsoft-365/compliance/insider-risk-management-forensic-evidence-manage?view=o365-worldwide) | modified | -| 5/5/2023 | [Use PowerShell to connect Shifts to Blue Yonder Workforce Management](/microsoft-365/frontline/shifts-connector-blue-yonder-powershell-setup?view=o365-worldwide) | modified | -| 5/5/2023 | [Use PowerShell to connect Shifts to UKG Dimensions](/microsoft-365/frontline/shifts-connector-ukg-powershell-setup?view=o365-worldwide) | modified | -| 5/5/2023 | [Use the Shifts connector wizard to connect Shifts to UKG Dimensions (Preview)](/microsoft-365/frontline/shifts-connector-wizard-ukg?view=o365-worldwide) | modified | -| 5/5/2023 | [Use the Shifts connector wizard to connect Shifts to Blue Yonder Workforce Management (Preview)](/microsoft-365/frontline/shifts-connector-wizard?view=o365-worldwide) | modified | -| 5/5/2023 | [View task details in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-view-task-details?view=o365-worldwide) | modified | -| 5/5/2023 | [Set up, review, and edit your security policies and settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-configure-security-settings?view=o365-worldwide) | modified | -| 5/5/2023 | [Understand policy order in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-policy-order?view=o365-worldwide) | modified | -| 5/5/2023 | [View or edit policies in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-view-edit-create-policies?view=o365-worldwide) | modified | -| 5/5/2023 | [Manage tamper protection for your organization using Microsoft Intune](/microsoft-365/security/defender-endpoint/manage-tamper-protection-intune?view=o365-worldwide) | modified | -| 5/5/2023 | [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](/microsoft-365/security/office-365-security/skip-filtering-phishing-simulations-sec-ops-mailboxes?view=o365-worldwide) | modified | |
| lighthouse | M365 Lighthouse Configure Portal Security | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-configure-portal-security.md | |
| lighthouse | M365 Lighthouse Delegated Access Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-delegated-access-overview.md | -description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn how to manage your tenants delegated access." +description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn how to manage your tenants' delegated access." # Overview of Delegated Access in Microsoft 365 Lighthouse -Microsoft 365 Lighthouse provides delegated relationship insights across all your customer tenants in a single view. You can track your transition away from Delegated Administrative Privileges (DAP) and ensure your Granular Delegated Administrative Privileges (GDAP) relationships are set up as intended. Data is available for any customer tenant in Lighthouse, regardless of the customersΓÇÖ licensing, user count, or geographic region. To access these insights, select **Permissions > Delegated access** in the left navigation pane in Lighthouse. You must hold the Admin agent role in Partner Center. +Microsoft 365 Lighthouse provides delegated relationship insights across all your customer tenants in a single view. You can track your transition away from Delegated Administrative Privileges (DAP) and ensure your Granular Delegated Administrative Privileges (GDAP) relationships are set up as intended. Data is available for any customer tenant in Lighthouse, regardless of the customers' licensing, user count, or geographic region. To access these insights, select **Permissions** > **Delegated access** in the left navigation pane in Lighthouse. You must hold the Admin agent role in Partner Center. ## Delegated access page -From this page, you can see the status of all your customersΓÇÖ delegated relationships at a glance, including whether GDAP is set up, if a GDAP template has been assigned, and the next upcoming GDAP relationship expiration date for a customer tenant. In this sortable view by tenant, you can filter by the following information: +From this page, you can see the status of all your customers' delegated relationships at a glance, including whether GDAP is set up, if a GDAP template has been assigned, and the next upcoming GDAP relationship expiration date for a customer tenant. In this sortable view by tenant, you can filter by the following information: - **Delegated access:** The type of delegated relationships established with a customer tenant. For example, GDAP, GDAP & DAP, DAP, or None. -- **GDAP template:** Created by your organization through Lighthouse, GDAP templates define the service tiers, Azure Active Directory (AAD) roles used to deploy GDAP to your tenants. To learn more about GDAP templates, see Set up GDAP for your customers.+- **GDAP template:** Created by your organization through Lighthouse, GDAP templates define the service tiers, Azure Active Directory (AAD) roles used to deploy GDAP to your tenants. To learn more about GDAP templates, see [Set up GDAP for your customers](m365-lighthouse-setup-gdap.md). - **Security groups:** Assigned to GDAP relationships, security groups contain the users in your organization with delegated access to a customer tenant. - **Pending GDAP relationships:** Indicates that a GDAP relationship has been set up but has yet to be approved by the customer tenant. |
| lighthouse | M365 Lighthouse Deploy Standard Tenant Configurations Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-deploy-standard-tenant-configurations-overview.md | description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthous Microsoft 365 Lighthouse baselines provide a repeatable and scalable way for you to manage Microsoft 365 security settings across multiple customer tenants. Baselines provide standard tenant configurations that deploy core security policies and compliance standards that keep your tenants' users, devices, and data secure and healthy. -To view the Microsoft 365 Lighthouse default baseline that applies to all tenants, select **Deployment > Baselines** in the left navigation pane in Lighthouse. +To view the Microsoft 365 Lighthouse default baseline that applies to all tenants, select **Deployment** > **Baselines** in the left navigation pane in Lighthouse. ## Watch: Deploy baselines |
| lighthouse | M365 Lighthouse Manage Inactive Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-manage-inactive-users.md | Lighthouse uses sign-in activity to detect inactive users accounts. The **Inacti ## Review inactive users -1. In the left navigation pane in Lighthouse, select **Users** > **Account management > Inactive users**. +1. In the left navigation pane in Lighthouse, select **Users** > **Account management** > **Inactive users**. 2. On the **Inactive Users** tab, set filters to the desired result. Lighthouse uses sign-in activity to detect inactive users accounts. The **Inacti 4. Select any user to open the user details pane and see more information about the account. -5. Once youΓÇÖve determined that a user account is no longer needed, you can delete or block the account. At the minimum, you should block the user account to reduce security risks. From the user details pane, select **Block sign-in** or **Delete user**. +5. Once you've determined that a user account is no longer needed, you can delete or block the account. At the minimum, you should block the user account to reduce security risks. From the user details pane, select **Block sign-in** or **Delete user**. ## Block sign-in for multiple user accounts -1. In the left navigation pane in Lighthouse, select **Users** > **Account management >** **Inactive users**. +1. In the left navigation pane in Lighthouse, select **Users** > **Account management** > **Inactive users**. 2. On the **Inactive users** tab, expand any tenant in the list to see a list of inactive users within the tenant, select the users you want to block, and then select **Block sign-in**. |
| lighthouse | M365 Lighthouse Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-overview.md | Lighthouse helps MSPs secure and manage Microsoft 365 services and connected end > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE5e61O] -> [!NOTE] +> [!NOTE] > For more information on how to sign up, see [Sign up for Microsoft 365 Lighthouse](m365-lighthouse-sign-up.md). ## Related content -[Sign up for Microsoft 365 Lighthouse](m365-lighthouse-sign-up.md) (article) -[Overview of the Tenants page in Microsoft 365 Lighthouse](m365-lighthouse-tenants-page-overview.md) (article) -[Overview of the Device compliance page in Microsoft 365 Lighthouse](m365-lighthouse-device-compliance-page-overview.md) (article) -[Microsoft 365 Lighthouse FAQ](m365-lighthouse-faq.yml) (article) +[Sign up for Microsoft 365 Lighthouse](m365-lighthouse-sign-up.md) (article)\ +[Overview of the Tenants page in Microsoft 365 Lighthouse](m365-lighthouse-tenants-page-overview.md) (article)\ +[Overview of the Device compliance page in Microsoft 365 Lighthouse](m365-lighthouse-device-compliance-page-overview.md) (article)\ +[Microsoft 365 Lighthouse FAQ](m365-lighthouse-faq.yml) (article)\ [Microsoft Defender for Business](../security/defender-business/index.yml) (link page) |
| lighthouse | M365 Lighthouse Requirements | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-requirements.md | |
| lighthouse | M365 Lighthouse Setup Gdap | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-setup-gdap.md | Title: "Set up GDAP for your customers" + Title: "Set up GDAP for your customers in Microsoft 365 Lighthouse" f1.keywords: CSH Previously updated : 05/2/2023 Last updated : 06/09/2023 audience: Admin search.appverid: MET150 description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn how to set up granular delegated admin privileges (GDAP) for your customers." -# Set up GDAP for your customers +# Set up GDAP for your customers in Microsoft 365 Lighthouse You can now set up all your customers with granular delegated admin privileges (GDAP) through Microsoft 365 Lighthouse, regardless of their licenses or size. By setting up your organization with GDAP for the customer tenants you manage, users in your organization have the permissions necessary to do their work while keeping customer tenants secure. Lighthouse lets you quickly transition your organization to GDAP and begin the journey to least-privilege for your delegated access to customers. |
| lighthouse | M365 Lighthouse Sign Up | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-sign-up.md | This article provides instructions for how to sign up for Microsoft 365 Lighthou > [!NOTE] > Lighthouse requires one license for the partner tenant only. No additional per-user licenses are required for the partner, and no Lighthouse licenses are required in any customer tenant. - To verify that Lighthouse was successfully added to your tenant, look for Microsoft 365 Lighthouse under **Billing > Your products** in the Microsoft 365 admin center. + To verify that Lighthouse was successfully added to your tenant, look for Microsoft 365 Lighthouse under **Billing** > **Your products** in the Microsoft 365 admin center. 5. If you aren't redirected to the Lighthouse portal, go to <a href="https://go.microsoft.com/fwlink/p/?linkid=2168110" target="_blank">https://lighthouse.microsoft.com</a>. |
| lighthouse | M365 Lighthouse View Manage Risky Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-view-manage-risky-users.md | |
| lighthouse | M365 Lighthouse Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-whats-new.md | We're continuously adding new features to [Microsoft 365 Lighthouse](m365-lighth > [!NOTE] > Some features get rolled out at different speeds to our customers. If you aren't seeing a feature yet, you should see it soon. +## May 2023 ++### GDAP Setup now checks for required roles ++We've updated GDAP Setup in Microsoft 365 Lighthouse to check whether you have the required roles before getting started. If you don't have the required roles, a message will alert you. ++To access GDAP Setup in Lighthouse, go to the **GDAP Setup** card on the **Home** page, and then select **Set up GDAP**. ++To learn more, see [Set up GDAP for your customers in Microsoft 365 Lighthouse](m365-lighthouse-setup-gdap.md). + ## April 2023 ### Configuration drift reporting |
| security | Linux Whatsnew | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-whatsnew.md | This article is updated frequently to let you know what's new in the latest rele - [What's new in Defender for Endpoint on macOS](mac-whatsnew.md) - [What's new in Defender for Endpoint on iOS](ios-whatsnew.md) +<details> + <summary> June-2023 (Build: 101.98.89 | Release version: 30.123042.19889.0)</summary> ++## June-2023 Build: 101.98.89 | Release version: 30.123042.19889.0 ++ Released: **June 12,2023**<br/> + Published: **June 12, 2023**<br/> + Build: **101.98.89**<br/> + Release version: **30.123042.19889.0**<br/> + Engine version: **1.1.20100.7**<br/> + Signature version: **1.385.1648.0**<br/> ++**What's new** ++- There are multiple fixes and new changes in this release + - Improved Network Protection Proxy handling. + - In Passive mode, Defender for Endpoint no longer scans when Definition update happens. + - Device will continue to be protected even after Defender for Endpoint agent has expired. It is still recommended to upgrade the Defender for Endpoint Linux agent to the latest available version to receive bug fixes, features and performance improvements. + - Removed semanage package dependency. + - Engine Update to 1.1.20100.7 and Signatures Ver: 1.385.1648.0. + - Bug fixes. ++**Known issues** ++- While upgrading from mdatp version 101.75.43 or 101.78.13, you may encounter a kernel hang. Run the following commands before attempting to upgrade to version 101.98.05. More information about the underlying issue can be found at [System hang due to blocked tasks in fanotify code](https://access.redhat.com/solutions/2838901). ++There are two ways to mitigate this upgrade issue: ++1. Use your package manager to uninstall the 101.75.43 or 101.78.13 mdatp version. ++Example: +```bash +sudo apt purge mdatp +sudo apt-get install mdatp +``` ++2. As an alternative you can follow the instructions to [uninstall](/microsoft-365/security/defender-endpoint/linux-resources#uninstall), then [install](/microsoft-365/security/defender-endpoint/linux-install-manually#application-installation) the latest version of the package. ++If you don't want to uninstall mdatp you can disable rtp and mdatp in sequence before upgrading. +Some customers (<1%) experience issues with this method. ++ ```bash +sudo mdatp config real-time-protection --value=disabled +sudo systemctl disable mdatp +``` +</details> + <details> <summary> May-2023 (Build: 101.98.64 | Release version: 30.123032.19864.0)</summary> |
| security | Mac Support License | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-support-license.md | Last updated 12/18/2020 ## No license found -While you are going through [Microsoft Defender for Endpoint on macOS](microsoft-defender-endpoint-mac.md) and [Manual deployment](mac-install-manually.md) testing or a Proof Of Concept (PoC), you might get the following error: +While deploying [Microsoft Defender for Endpoint on macOS](microsoft-defender-endpoint-mac.md), an error message with an **X** on top of the Microsoft Defender for Endpoint on macOS shield may appear. +Click the **X** symbol and an **Action Needed** prompt should pop up. Clicking the **Action Needed** prompt will bring up the following licensing error message: ++ ### Message: No license found Looks like your organization does not have a license for Microsoft 365 Enterpris Contact your administrator for help. ++Or if you type "mdatp health" in the terminal without the double quotes, you might see the following warning: +### Message: +ATTENTION: No license found. Contact your administrator for help.\ +healthy: false\ +health_issues: [ΓÇ£missing licenseΓÇ¥]\ +licensed: false + ### Cause: -You deployed and/or installed the Microsoft Defender for Endpoint on macOS package ("Download installation package"), but you might not have run the configuration script ("Download onboarding package"), or you have not assigned a license to the user. +You deployed and/or installed the Microsoft Defender for Endpoint on macOS package ("Download installation package"), but might not have run the configuration script ("Download onboarding package") that contains the license settings. -You can also encounter this error when the Microsoft Defender for Endpoint on macOS agent isn't up to date. -### Solution: +You can also encounter this error when the Microsoft Defender for Endpoint on macOS agent isn't up to date or if you have not assigned a license to the user. -Follow the MicrosoftDefenderATPOnboardingMacOs.py instructions documented here: -[Client configuration](mac-install-manually.md#client-configuration). -For scenarios where Microsoft Defender for Endpoint on macOS isn't up to date, you'll need to update the agent. ++### Solution: +Depending on the deployment management tool used, please follow the instructions to onboard the package (register the license) as documented here: ++|Management|Onboarding instructions (License deployment instructions)| +|-|-| +|Intune|[Onboarding blob](/microsoft-365/security/defender-endpoint/mac-install-with-intune?view=o365-worldwide#onboarding-blob&preserve-view=true)| +|JamF|[Onboarding package](/microsoft-365/security/defender-endpoint/mac-jamfpro-policies?view=o365-worldwide#step-1-get-the-microsoft-defender-for-endpoint-onboarding-package&preserve-view=true)| +|Other MDM|[License settings](/microsoft-365/security/defender-endpoint/mac-install-with-other-mdm?view=o365-worldwide#license-settings&preserve-view=true)| +|Manual installation| Go thru [Download onboarding package](/microsoft-365/security/defender-endpoint/mac-install-manually?view=o365-worldwide#download-installation-and-onboarding-packages&preserve-view=true) and go thru the registration of the license according to [client-configuration](/microsoft-365/security/defender-endpoint/mac-install-manually?view=o365-worldwide#client-configuration&preserve-view=true)| ++>[!TIP] +> If the onboarding package runs correctly, the licensing information will be located in `/Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist`. ++For scenarios where Microsoft Defender for Endpoint on macOS isn't up to date, you'll need to [update](/microsoft-365/security/defender-endpoint/mac-updates?view=o365-worldwide&preserve-view=true) the agent. ++To assign a license to the end-user, do the following: +1. In the Microsoft 365 Defender portal (security.microsoft.com), click on **Settings -> Endpoints -> Licenses**. +1. Select your license. +1. Click **Assign licenses**. +1. Enter the name and email address of the person being assigned. +1. Check the box for "Microsoft Defender for Endpoint" and click **Assign**. ++If the licensing issues have been resolved, when you run "mdatp health," you should see the following results:\ +healthy: true\ +health_issues: []\ +licensed: true ## Sign in with your Microsoft account |
| security | Microsoft Defender Antivirus Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates.md | Title: Microsoft Defender Antivirus security intelligence and product updates description: Manage how Microsoft Defender Antivirus receives protection and product updates. ms.localizationpriority: high Previously updated : 06/06/2023 Last updated : 06/12/2023 audience: ITPro All our updates contain - Serviceability improvements - Integration improvements (Cloud, [Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-defender)) -### May-2023 (Platform: 4.18.23050.3| Engine: 1.1.23050.2) +### May-2023 *UPDATE* (Platform: 4.18.23050.5 | Engine: 1.1.23050.2) ++*Microsoft has released a platform update (**4.18.23050.5**) for the May 2023 release.* ++- Security intelligence update version: **1.391.860.0** +- Released: **June 12, 2023** +- Platform: **4.18.23050.5** +- Engine: **1.1.23050.2** +- Support phase: **Security and Critical Updates** +ΓÇ» +### What's new ++- Fixed issue that could lead to resolution of incorrect service endpoint + +### Known Issues ++- None ++### May-2023 (Platform: 4.18.23050.3 | Engine: 1.1.23050.2) - Security intelligence update version: **1.391.64.0** - Released: **May 31, 2023** All our updates contain ### Known Issues -- None+- Potential issue that could lead to resolution of incorrect service endpoint ### April-2023 (Platform: 4.18.2304.8 | Engine: 1.1.20300.3) |
| security | Monthly Security Summary Report | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/monthly-security-summary-report.md | + + Title: Monthly security summary reporting in Microsoft Defender for Endpoint +description: Use the monthly security summary to see threats detected and prevented, current status from Microsoft Secure Score, and recommended actions. +keywords: month report, security summary, managed devices, secure score, incidents +search.product: eADQiWindows 10XVcnh +search.appverid: met150 ++ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++localization_priority: Normal Last updated : 06/12/2023++audience: ITPro ++- m365-security +- tier2 ++++++# Monthly security summary report in Microsoft Defender for Endpoint ++**Applies to:** ++- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037) +- [Microsoft Defender for Business](../defender-business/mdb-overview.md) ++> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) +++The report helps organizations get a visual summary of key findings and overall preventative actions taken to enhance the organization's overall security posture completed in the last month. It helps you identify areas of strength and improvement, track your progress over time, and prioritize your actions based on risk and impact. ++To access this report, in the navigation pane, choose **Reports > Endpoints > Monthly Security Summary**. The monthly security summary report contains the following sections: ++- [Microsoft Secure Score](#microsoft-secure-score) +- [Secure score compared to other organizations](#secure-score-compared-to-other-organizations) +- [Devices onboarded](#devices-onboarded) +- [Protection against threats](#protection-against-threats) +- [Web content monitoring and filtering](#web-content-monitoring-and-filtering) +- [Suspicious or malicious activities](#suspicious-or-malicious-activities) +++You can generate a PDF report of the summary, by selecting **Generate PDF report**. The generated report is a summary of the last 30 days. ++## Microsoft Secure score +Microsoft Secure Score is a measurement of an organization's security posture and how well you have implemented security best practices and recommendations across the devices in your organization. The secure score card shows how the overall cybersecurity strength of an organization has improved in the past month and how it compares to other companies with similar number of managed devices. ++## Secure score compared to other organizations +This score is an evaluation of an organization's security score in relation to organizations of a similar size. It's a way to benchmark an organization's performance in implementing security measures compared to other organizations of an equivalent size. +++## Devices onboarded +The devices card provides information on the number of devices that were onboarded in the last month as well as devices still not onboarded. Onboarding devices are essential for enabling protection and detection capabilities. ++## Protection against threats +This card shows how effective your defenses are against common attack vectors such as phishing and ransomware. A higher number indicates better defense in place against phishing and ransomware. The report shows how many threats were blocked or mitigated in the last month and how your protection level has increased. ++## Web content monitoring and filtering +Shows the number of malicious URLs that were blocked by Microsoft Defender for Endpoint in the last month. The report also shows the categories of URLs that were blocked and the number of clicks for each category. ++## Suspicious or malicious activities +Track how many incidents and alerts were resolved in the past month using the incidents card. The card also shows all active incidents and alerts that require attention. You'll also be able to see a list of the top 10 severe incidents, their status, number of alerts, and the impacted devices and users. +++ |
| security | Run Analyzer Macos Linux | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/run-analyzer-macos-linux.md | If using a terminal download using the command: 2. Verify the download > [!NOTE]- > The current SHA256 hash of 'XMDEClientAnalyzerBinary.zip' that is downloaded from the above link is: 'E812F96A7735C746129ACD66468E2C524CB016359780AFB8CF972D281C2A2B81' + > The current SHA256 hash of 'XMDEClientAnalyzerBinary.zip' that is downloaded from the above link is: 'C94E3D630730E5A2B605FD295BD81D93997888F4CB2B2694076FCFDE85876C13' ```console- echo 'E812F96A7735C746129ACD66468E2C524CB016359780AFB8CF972D281C2A2B81 XMDEClientAnalyzerBinary.zip' | sha256sum -c + echo 'C94E3D630730E5A2B605FD295BD81D93997888F4CB2B2694076FCFDE85876C13 XMDEClientAnalyzerBinary.zip' | sha256sum -c ``` 3. Extract the contents of <i>XMDEClientAnalyzerBinary.zip</i> on the machine. When using a terminal, unzip the file using one of the following commands based 2. Verify the download ```console- echo '01AC21ED1963E5BFA9926300029B7BC57826ED3904DE774458CD8CF7C872E896 XMDEClientAnalyzer.zip' | sha256sum -c + echo '1A8004C89E8B75FF892AAC66F1B1D07F3C7030720070A1A1E677A099A9ADC32E XMDEClientAnalyzer.zip' | sha256sum -c ``` 3. Extract the contents of XMDEClientAnalyzer.zip on the machine.\ Add exclusions for audit-d monitoring. > This functionality exists for Linux only ```console--h, --help show this help message and exit--e <executable>, --exe <executable>- exclude by executable name, i.e: bash --p <process id>, --pid <process id>- exclude by process id, i.e: 911 --d <directory>, --dir <directory>- exclude by target path, i.e: /var/foo/bar --x <executable> <directory>, --exe_dir \<executable\> <directory>- exclude by executable path and target path, i.e: - /bin/bash /var/foo/bar --q <q_size>, --queue <q_size>- set dispatcher q_depth size --r, --remove remove exclusion file--s, --stat get statistics about common executables--l, --list list auditd rules+ -h, --help show this help message and exit + -e <executable>, --exe <executable> + exclude by executable name, i.e: bash + -p <process id>, --pid <process id> + exclude by process id, i.e: 911 + -d <directory>, --dir <directory> + exclude by target path, i.e: /var/foo/bar + -x <executable> <directory>, --exe_dir <executable> <directory> + exclude by executable path and target path, i.e: /bin/bash /var/foo/bar + -q <q_size>, --queue <q_size> + set dispatcher q_depth size + -r, --remove remove exclusion file + -s, --stat get statistics about common executables + -l, --list list auditd rules + -o, --override Override the existing auditd exclusion rules file for mdatp + -c <syscall number>, --syscall <syscall number> + exclude all process of the given syscall ``` Usage example `sudo ./MDESupportTool exclude -d /var/foo/bar` |
| security | Custom Detection Rules | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/custom-detection-rules.md | When you save a new rule, it runs and checks for matches from the past 30 days o - **Every 12 hours**ΓÇöruns every 12 hours, checking data from the past 48 hours - **Every 3 hours**ΓÇöruns every 3 hours, checking data from the past 12 hours - **Every hour**ΓÇöruns hourly, checking data from the past 4 hours-- **Continuous (NRT)**ΓÇöruns continuously, checking data from events as they are collected and processed in near real-time+- **Continuous (NRT)**ΓÇöruns continuously, checking data from events as they are collected and processed in near real-time (NRT), see [Continuous (NRT) frequency](custom-detection-rules.md#continuous-nrt-frequency) ->[!NOTE] ->If you choose the continuous frequency, make sure that the query references one table only and uses an operator from the [list of supported KQL operators](/azure/azure-monitor/essentials/data-collection-transformations-structure#supported-kql-features). You cannot use unions or joins. The `externaldata` operator is not supported. +> [!TIP] +> Match the time filters in your query with the lookback duration. Results outside of the lookback duration are ignored. When you edit a rule, it will run with the applied changes in the next run time scheduled according to the frequency you set. The rule frequency is based on the event timestamp and not the ingestion time. -> [!TIP] -> Match the time filters in your query with the lookback duration. Results outside of the lookback duration are ignored. -Select the frequency that matches how closely you want to monitor detections. Consider your organization's capacity to respond to the alerts. +##### Continuous (NRT) frequency ++Setting a custom detection to run in Continuous (NRT) frequency allows you to increase your organization's ability to identify threats faster. -##### Tables that support Continuous (NRT) frequency +> [!NOTE] +> Using the Continuous (NRT) frequency has minimal to no impact to your resource usage and should thus be considered for any qualified custom detection rule in your organization. ++###### Queries you can run continuously ++You can run a query continuously as long as: +- The query references one table only. +- The query uses an operator from the list of supported KQL operators. **[Supported KQL features](/azure/azure-monitor/essentials/data-collection-transformations-structure#supported-kql-features)** +- The query does not use joins, unions, or the `externaldata` operator. ++###### Tables that support Continuous (NRT) frequency Near real-time detections are supported for the following tables: Near real-time detections are supported for the following tables: > [!NOTE] > Only columns that are generally available can support **Continuous (NRT)** frequency. ++ ### 3. Choose the impacted entities Identify the columns in your query results where you expect to find the main affected or impacted entity. For example, a query might return sender (`SenderFromAddress` or `SenderMailFromAddress`) and recipient (`RecipientEmailAddress`) addresses. Identifying which of these columns represent the main impacted entity helps the service aggregate relevant alerts, correlate incidents, and target response actions. |
| security | Address Compromised Users Quickly | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/address-compromised-users-quickly.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Address compromised user accounts with automated investigation and response [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- [Microsoft Defender for Office 365 Plan 2](defender-for-office-365.md#whats-the-difference-between-microsoft-defender-for-office-365-plan-1-and-plan-2) includes powerful [automated investigation and response](air-about.md) (AIR) capabilities. Such capabilities can save your security operations team a lot of time and effort dealing with threats. This article describes one of the facets of the AIR capabilities, the compromised user security playbook. The compromised user security playbook enables your organization's security team to: |
| security | Air About Office | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-about-office.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # How automated investigation and response works in Microsoft Defender for Office 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- As security alerts are triggered, it's up to your security operations team to look into those alerts and take steps to protect your organization. Sometimes, security operations teams can feel overwhelmed by the volume of alerts that are triggered. Automated investigation and response (AIR) capabilities in Microsoft Defender for Office 365 can help. AIR enables your security operations team to operate more efficiently and effectively. AIR capabilities include automated investigation processes in response to well-known threats that exist today. Appropriate remediation actions await approval, enabling your security operations team to respond to detected threats. |
| security | Air About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-about.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Automated investigation and response (AIR) in Microsoft Defender for Office 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- [Microsoft Defender for Office 365](defender-for-office-365.md) includes powerful automated investigation and response (AIR) capabilities that can save your security operations team time and effort. As alerts are triggered, it's up to your security operations team to review, prioritize, and respond to those alerts. Keeping up with the volume of incoming alerts can be overwhelming. Automating some of those tasks can help. AIR enables your security operations team to operate more efficiently and effectively. AIR capabilities include automated investigation processes in response to well-known threats that exist today. Appropriate remediation actions await approval, enabling your security operations team to respond effectively to detected threats. With AIR, your security operations team can focus on higher-priority tasks without losing sight of important alerts that are triggered. |
| security | Air Custom Reporting | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-custom-reporting.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Custom or third-party reporting solutions for Microsoft Defender for Office 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- With [Microsoft Defender for Office 365](defender-for-office-365.md), you get [detailed information about automated investigations](air-view-investigation-results.md). However, some organizations also use a custom or third-party reporting solution. If your organization wants to integrate information about [automated investigations](air-about.md) with such a solution, you can use the Office 365 Management Activity API. With [Microsoft Defender for Office 365](defender-for-office-365.md), you get [detailed information about automated investigations](air-view-investigation-results.md). However, some organizations also use a custom or third-party reporting solution. If your organization wants to integrate information about automated investigations with such a solution, you can use the Office 365 Management Activity API. |
| security | Air Remediation Actions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-remediation-actions.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Remediation actions in Microsoft Defender for Office 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- ## Remediation actions Threat protection features in [Microsoft Defender for Office 365](defender-for-office-365.md) include certain remediation actions. Such remediation actions can include: |
| security | Air Report False Positives Negatives | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-report-false-positives-negatives.md | f1.keywords: Previously updated : 1/31/2023 Last updated : 06/09/2023 ms.localizationpriority: medium audience: ITPro+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # How to report false positives/negatives in automated investigation and response capabilities [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- If [automated investigation and response (AIR) capabilities in Office 365](air-about-office.md) missed or wrongly detected something, there are steps your security operations team can take to fix it. Such actions include: - [Reporting a false positive/negative to Microsoft](#report-a-false-positivenegative-to-microsoft-for-analysis); |
| security | Air Review Approve Pending Completed Actions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-review-approve-pending-completed-actions.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> # Review and manage remediation actions in Office 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)- As automated investigations on email & collaboration content result in verdicts, such as *Malicious* or *Suspicious*, certain remediation actions are created. In Microsoft Defender for Office 365, remediation actions can include: - Soft deleting email messages or clusters |
| security | Air View Investigation Results | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-view-investigation-results.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> # Details and results of an automated investigation in Microsoft 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)- When an [automated investigation](air-about.md) occurs in [Microsoft Defender for Office 365](defender-for-office-365.md), details about that investigation are available during and after the automated investigation process. If you have the necessary permissions, you can view those details in the Microsoft 365 Defender portal. Investigation details provide you with up-to-date status, and the ability to approve any pending actions. > [!TIP] |
| security | Anti Malware Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-malware-policies-configure.md | description: Admins can learn how to view, create, modify, and remove anti-malwa Previously updated : 4/18/2023 Last updated : 06/09/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Configure anti-malware policies in EOP [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, email messages are automatically protected against malware by EOP. EOP uses anti-malware policies for malware protection settings. For more information, see [Anti-malware protection](anti-malware-protection-about.md). The default anti-malware policy automatically applies to all recipients. For greater granularity, you can also create custom anti-malware policies that apply to specific users, groups, or domains in your organization. |
| security | Anti Malware Protection About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-malware-protection-about.md | description: Admins can learn about anti-malware protection and anti-malware pol Previously updated : 4/19/2023 Last updated : 06/09/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Anti-malware protection in EOP [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, email messages are automatically protected against malware by EOP. Some of the major categories of malware are: - **Viruses** that infect other programs and data, and spread through your computer or network looking for programs to infect. In Microsoft 365 organizations with mailboxes in Exchange Online or standalone E EOP offers multi-layered malware protection that's designed to catch all known malware in Windows, Linux, and Mac that travels into or out of your organization. The following options help provide anti-malware protection: - **Layered defenses against malware**: Multiple anti-malware scan engines help protect against both known and unknown threats. These engines include powerful heuristic detection to provide protection even during the early stages of a malware outbreak. This multi-engine approach has been shown to provide significantly more protection than using just one anti-malware engine.-- **Real-time threat response**: During some outbreaks, the anti-malware team may have enough information about a virus or other form of malware to write sophisticated policy rules that detect the threat, even before a definition is available from any of the scan engines used by the service. These rules are published to the global network every 2 hours to provide your organization with an extra layer of protection against attacks.+- **Real-time threat response**: During some outbreaks, the anti-malware team might have enough information about a virus or other form of malware to write sophisticated policy rules that detect the threat, even before a definition is available from any of the scan engines used by the service. These rules are published to the global network every 2 hours to provide your organization with an extra layer of protection against attacks. - **Fast anti-malware definition deployment**: The anti-malware team maintains close relationships with partners who develop anti-malware engines. As a result, the service can receive and integrate malware definitions and patches before they're publicly released. Our connection with these partners often allows us to develop our own remedies as well. The service checks for updated definitions for all anti-malware engines every hour. -In EOP, messages that are found to contain malware in _any_ attachments are quarantined. Whether the recipients can view or otherwise interact with the quarantined messages is controlled by _quarantine policies_. By default, messages that were quarantined due to malware can only be viewed and released by admins. For more information, see the following topics: +In EOP, messages that are found to contain malware in _any_ attachments are quarantined. Whether the recipients can view or otherwise interact with the quarantined messages is controlled by _quarantine policies_. By default, messages that were quarantined due to malware can only be viewed and released by admins. For more information, see the following articles: - [Anatomy of a quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy) - [EOP anti-malware policy settings](recommended-settings-for-eop-and-office365.md#eop-anti-malware-policy-settings) - [Manage quarantined messages and files as an admin in EOP](quarantine-admin-manage-messages-files.md). -As explained in the next section, anti-malware policies also contain a _common attachments filter_. Message that contain the specified file types are _automatically_ identified as malware. You can choose whether to quarantine or reject the messages. +As explained in the next section, anti-malware policies also contain a _common attachments filter_. Messages that contain the specified file types are _automatically_ identified as malware. You can choose whether to quarantine or reject the messages. For more information about anti-malware protection, see the [Anti-malware protection FAQ](anti-malware-protection-faq.yml). To submit malware to Microsoft, see [Report messages and files to Microsoft](sub ## Anti-malware policies -Anti-malware policies control the settings and notification options for malware detections. The important settings in anti-malware policies are: +Anti-malware policies control the settings and notification options for malware detections. The important settings in anti-malware policies are described in the following subsections. ++### Recipient filters in anti-malware policies ++In custom anti-malware policies, you can specify recipient conditions and exceptions that determine who the policy applies to. You can use the following properties for conditions and exceptions: ++- **Users** +- **Groups** +- **Domains** ++You can only use a condition or exception once, but the condition or exception can contain multiple values. Multiple values of the same condition or exception use OR logic (for example, _\<recipient1\>_ or _\<recipient2\>_). Different conditions or exceptions use AND logic (for example, _\<recipient1\>_ and _\<member of group 1\>_). ++> [!IMPORTANT] +> Multiple different types of conditions or exceptions are not additive; they're inclusive. The policy is applied _only_ to those recipients that match _all_ of the specified recipient filters. For example, you configure a recipient filter condition in the policy with the following values: +> +> - Users: romain@contoso.com +> - Groups: Executives +> +> The policy is applied to romain@contoso.com _only_ if he's also a member of the Executives group. If he's not a member of the group, then the policy is not applied to him. +> +> Likewise, if you use the same recipient filter as an exception to the policy, the policy is not applied to romain@contoso.com _only_ if he's also a member of the Executives group. If he's not a member of the group, then the policy still applies to him. ++### Common attachments filter in anti-malware policies -- **Recipient filters**: For custom anti-malware policies, you can specify recipient conditions and exceptions that determine who the policy applies to. You can use these properties for conditions and exceptions:+There are certain types of files that you really shouldn't send via email (for example, executable files). Why bother scanning these types of files for malware, when you should probably block them all, anyway? That's where the common attachments filter comes in. The file types that you specify are automatically treated as malware. - - **Users** - - **Groups** - - **Domains** +- The default file types: `ace, apk, app, appx, ani, arj, bat, cab, cmd,com, deb, dex, dll, docm, elf, exe, hta, img, iso, jar, jnlp, kext, lha, lib, library, lnk, lzh, macho, msc, msi, msix, msp, mst, pif, ppa, ppam, reg, rev, scf, scr, sct, sys, uif, vb, vbe, vbs, vxd, wsc, wsf, wsh, xll, xz, z`. - You can only use a condition or exception once, but the condition or exception can contain multiple values. Multiple values of the same condition or exception use OR logic (for example, _\<recipient1\>_ or _\<recipient2\>_). Different conditions or exceptions use AND logic (for example, _\<recipient1\>_ and _\<member of group 1\>_). +- Additional predefined file types that you can select from in the Microsoft 365 Defender portal<sup>\*</sup>: `7z, 7zip, a, accdb, accde, action, ade, adp, appxbundle, asf, asp, aspx, avi, bin, bundle, bz, bz2, bzip2, cab, caction, cer, chm, command, cpl, crt, csh, css, der, dgz, dmg, doc, docx, dot, dotm, dtox, dylib, font, gz, gzip, hlp, htm, html, imp, inf, ins, ipa, isp, its, jnlp, js, jse, ksh, lqy, mad, maf, mag, mam, maq, mar, mas, mat, mav, maw, mda, mdb, mde, mdt, mdw, mdz, mht, mhtml, mscompress, msh, msh1, msh1xml, msh2, msh2xml, mshxml, msixbundle, o, obj, odp, ods, odt, one, onenote, ops, package, pages, pbix, pdb, pdf, php, pkg, plugin, pps, ppsm, ppsx, ppt, pptm, pptx, prf, prg, ps1, ps1xml, ps2, ps2xml, psc1, psc2, pst, pub, py, rar, rpm, rtf, scpt, service, sh, shb, shtm, shx, so, tar, tarz, terminal, tgz, tool, url, vhd, vsd, vsdm, vsdx, vsmacros, vss, vssx, vst, vstm, vstx, vsw, workflow, ws, xhtml, xla, xlam, xls, xlsb, xlsm, xlsx, xlt, xltm, xltx, zi, zip, zipx`. - > [!IMPORTANT] - > Multiple different types of conditions or exceptions are not additive; they're inclusive. The policy is applied _only_ to those recipients that match _all_ of the specified recipient filters. For example, you configure a recipient filter condition in the policy with the following values: - > - > - Users: romain@contoso.com - > - Groups: Executives - > - > The policy is applied to romain@contoso.com _only_ if he's also a member of the Executives group. If he's not a member of the group, then the policy is not applied to him. - > - > Likewise, if you use the same recipient filter as an exception to the policy, the policy is not applied to romain@contoso.com _only_ if he's also a member of the Executives group. If he's not a member of the group, then the policy still applies to him. +<sup>\*</sup> You can enter any text value in the Defender portal or using the _FileTypes_ parameter in the [New-MalwareFilterPolicy](/powershell/module/exchange/new-malwarefilterpolicy) or [Set-MalwareFilterPolicy](/powershell/module/exchange/set-malwarefilterpolicy) cmdlets in Exchange Online PowerShell. -- **Enable the common attachments filter**: There are certain types of files that you really shouldn't send via email (for example, executable files). Why bother scanning these types of files for malware, when you should probably block them all, anyway? That's where the common attachments filter comes in. The file types that you specify are automatically treated as malware.+The common attachments filter uses best effort true-typing to detect the file type regardless of the filename extension. If true-typing fails or isn't supported for the specified file type, then simple extension matching is used. - - The default file types: `ace, apk, app, appx, ani, arj, bat, cab, cmd,com, deb, dex, dll, docm, elf, exe, hta, img, iso, jar, jnlp, kext, lha, lib, library, lnk, lzh, macho, msc, msi, msix, msp, mst, pif, ppa, ppam, reg, rev, scf, scr, sct, sys, uif, vb, vbe, vbs, vxd, wsc, wsf, wsh, xll, xz, z`. +When files are detected by the common attachments filter, you can choose to **Reject the message with a non-delivery report (NDR)** or **Quarantine the message**. - - Additional predefined file types that you can select from in the Microsoft 365 Defender portal<sup>\*</sup>: `7z, 7zip, a, accdb, accde, action, ade, adp, appxbundle, asf, asp, aspx, avi, bin, bundle, bz, bz2, bzip2, cab, caction, cer, chm, command, cpl, crt, csh, css, der, dgz, dmg, doc, docx, dot, dotm, dtox, dylib, font, gz, gzip, hlp, htm, html, imp, inf, ins, ipa, isp, its, jnlp, js, jse, ksh, lqy, mad, maf, mag, mam, maq, mar, mas, mat, mav, maw, mda, mdb, mde, mdt, mdw, mdz, mht, mhtml, mscompress, msh, msh1, msh1xml, msh2, msh2xml, mshxml, msixbundle, o, obj, odp, ods, odt, one, onenote, ops, package, pages, pbix, pdb, pdf, php, pkg, plugin, pps, ppsm, ppsx, ppt, pptm, pptx, prf, prg, ps1, ps1xml, ps2, ps2xml, psc1, psc2, pst, pub, py, rar, rpm, rtf, scpt, service, sh, shb, shtm, shx, so, tar, tarz, terminal, tgz, tool, url, vhd, vsd, vsdm, vsdx, vsmacros, vss, vssx, vst, vstm, vstx, vsw, workflow, ws, xhtml, xla, xlam, xls, xlsb, xlsm, xlsx, xlt, xltm, xltx, zi, zip, zipx`. +### Zero-hour auto purge (ZAP) in anti-malware policies - <sup>\*</sup> You can enter any text value in the Defender portal or using the _FileTypes_ parameter in the [New-MalwareFilterPolicy](/powershell/module/exchange/new-malwarefilterpolicy) or [Set-MalwareFilterPolicy](/powershell/module/exchange/set-malwarefilterpolicy) cmdlets in Exchange Online PowerShell. +ZAP for malware quarantines messages that are found to contain malware _after_ they've been delivered to Exchange Online mailboxes. By default, ZAP for malware is turned on, and we recommend that you leave it on. For more information, see [Zero-hour auto purge (ZAP) for malware](zero-hour-auto-purge.md#zero-hour-auto-purge-zap-for-malware). - The common attachments filter uses best effort true-typing to detect the file type regardless of the filename extension. If true-typing fails or isn't supported for the specified file type, then simple extension matching is used. +### Quarantine policies in anti-malware policies - - **When these file types are found**: When files are detected by the common attachments filter, you can choose to **Reject the message with a non-delivery report (NDR)** or **Quarantine the message**. +Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. By default, recipients don't receive notifications for messages that were quarantined as malware. For more information, see [Anatomy of a quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy). -- **Zero-hour auto purge (ZAP) for malware**: ZAP for malware quarantines messages that are found to contain malware _after_ they've been delivered to Exchange Online mailboxes. By default, ZAP for malware is turned on, and we recommend that you leave it on.+### Admin notifications in anti-malware policies -- **Quarantine policy**: Select the quarantine policy that applies to messages that are quarantined as malware. Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. By default, recipients don't receive notifications for messages that were quarantined as malware. For more information, see [Anatomy of a quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy).+You can specify an additional recipient (an admin) to receive notifications for malware detected in messages from internal or external senders. You can customize the **From address**, **subject**, and **message text** for internal and external notifications. -- **Admin notifications**: You can specify an additional recipient (an admin) to receive notifications for malware detected in messages from internal or external senders. You can customize the **From address**, **subject**, and **message text** for internal and external notifications.+> [!NOTE] +> Admin notifications are sent only for _attachments_ that are classified as malware. +> +> The quarantine policy that's assigned to the anti-malware policy determines whether recipients receive email notifications for messages that were quarantined as malware. - > [!NOTE] - > Admin notifications are sent only for _attachments_ that are classified as malware. - > - > The quarantine policy that's assigned to the anti-malware policy determines whether recipients receive email notifications for messages that were quarantined as malware. +### Priority of anti-malware policies -- **Priority**: If you create multiple custom anti-malware policies, you can specify the order that they're applied. No two policies can have the same priority, and policy processing stops after the first policy is applied (the highest priority policy for that recipient).+If you create multiple custom anti-malware policies, you can specify the order that they're applied. No two policies can have the same priority, and policy processing stops after the first policy is applied (the highest priority policy for that recipient). - For more information about the order of precedence and how multiple policies are evaluated and applied, see [Order and precedence of email protection](how-policies-and-protections-are-combined.md). +For more information about the order of precedence and how multiple policies are evaluated, see [Order and precedence of email protection](how-policies-and-protections-are-combined.md) and [Order of precedence for preset security policies and other policies](preset-security-policies.md#order-of-precedence-for-preset-security-policies-and-other-policies). ## Default anti-malware policy -Every organization has a built-in anti-malware policy named Default that has these properties: +Every organization has a built-in anti-malware policy named Default that has the following properties: - The policy is the default policy (the **IsDefault** property has the value `True`), and you can't delete the default policy. - The policy is automatically applied to all recipients in the organization, and you can't turn it off. |
| security | Anti Malware Protection For Spo Odfb Teams About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about.md | description: Learn about how SharePoint Online detects viruses in files that use Previously updated : 1/31/2023 Last updated : 06/09/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> # Built-in virus protection in SharePoint Online, OneDrive, and Microsoft Teams [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)- Microsoft 365 uses a common virus detection engine for scanning files that users upload to SharePoint Online, OneDrive, and Microsoft Teams. This protection is included with all subscriptions that include SharePoint Online, OneDrive, and Microsoft Teams. > [!IMPORTANT] |
| security | Anti Phishing From Email Address Validation | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-from-email-address-validation.md | ms.assetid: eef8408b-54d3-4d7d-9cf7-ad2af10b2e0e - m365-security - tier2-description: Admins can learn about the types of email addresses that are accepted or rejected by Exchange Online Protection (EOP) and Outlook.com to help prevent phishing. +description: Admins can learn how Exchange Online Protection (EOP) and Outlook.com enforce email address syntax to help prevent phishing. Previously updated : 11/30/2022 Last updated : 06/09/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # How EOP validates the From address to prevent phishing [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)--Phishing attacks are a constant threat to any email organization. In addition to using [spoofed (forged) sender email addresses](anti-phishing-protection-spoofing-about.md), attackers often use values in the From address that violate internet standards. To help prevent this type of phishing, Exchange Online Protection (EOP) and Outlook.com now require inbound messages to include an RFC-compliant From address as described in this article. This enforcement was enabled in November 2017. --**Notes**: +Phishing attacks are a constant threat to any email organization. In addition to using [spoofed (forged) sender email addresses](anti-phishing-protection-spoofing-about.md), attackers often use values in the From address that violate internet standards. To help prevent this type of phishing, Exchange Online Protection (EOP) and Outlook.com require inbound messages to include an RFC-compliant From address as described in this article. - If you regularly receive email from organizations that have malformed From addresses as described in this article, encourage these organizations to update their email servers to comply with modern security standards. The From address is defined in detail across several RFCs (for example, RFC 5322 - **local-part**: A string that identifies the mailbox associated with the address. This value is unique within the domain. Often, the mailbox owner's username or GUID is used. - **domain**: The fully qualified domain name (FQDN) of the email server that hosts the mailbox identified by the local-part of the email address. - These are some additional considerations for the EmailAddress value: + Also: - - Only one email address. + - One email address only. - We recommend that you don't separate the angle brackets with spaces.- - Don't include additional text after the email address. --## Examples of valid and invalid From addresses --The following From email addresses are valid: --- `From: sender@contoso.com`--- `From: <sender@contoso.com>`--- `From: < sender@contoso.com >` (Not recommended because there are spaces between the angle brackets and the email address.)--- `From: "Sender, Example" <sender.example@contoso.com>`--- `From: "Microsoft 365" <sender@contoso.com>`--- `From: Microsoft 365 <sender@contoso.com>` (Not recommended because the display name isn't enclosed in double quotation marks.)--The following From email addresses are invalid: --- `From: <firstname lastname@contoso.com>` (The email address contains a space.)--- **No From address**: Some automated messages don't include a From address. In the past, when Microsoft 365 or Outlook.com received a message without a From address, the service added the following default From: address to make the message deliverable:-- `From: <>` -- Now, messages with a blank From address are no longer accepted. --- `From: Microsoft 365 sender@contoso.com` (The display name is present, but the email address isn't enclosed in angle brackets.)--- `From: "Microsoft 365" <sender@contoso.com> (Sent by a process)` (Text after the email address.)--- `From: Sender, Example <sender.example@contoso.com>` (The display name contains a comma, but isn't enclosed in double quotation marks.)--- `From: "Microsoft 365 <sender@contoso.com>"` (The whole value is incorrectly enclosed in double quotation marks.)+ - Don't include text after the email address. -- `From: "Microsoft 365 <sender@contoso.com>" sender@contoso.com` (The display name is present, but the email address isn't enclosed in angle brackets.)+## Examples of good and bad From addresses -- `From: Microsoft 365<sender@contoso.com>` (No space between the display name and the left angle bracket.)+The following table contains examples of valid From addresses: -- `From: "Microsoft 365"<sender@contoso.com>` (No space between the closing double quotation mark and the left angle bracket.)+|Address|Comments| +||| +|`From: sender@contoso.com`|OK| +|`From: <sender@contoso.com>`|OK| +|`From: < sender@contoso.com >`|OK, but not recommended because there are spaces between the angle brackets and the email address.| +|`From: "Sender, Example" <sender.example@contoso.com>`|OK| +|`From: "Microsoft 365" <sender@contoso.com>`|OK| +|`From: Microsoft 365 <sender@contoso.com>`|OK, but not recommended because the display name isn't enclosed in double quotation marks.| -## Suppress auto-replies to your custom domain +The following table contains examples of From addresses that aren't valid: -You can't use the value `From: <>` to suppress auto-replies. Instead, you need to set up a null MX record for your custom domain. Auto-replies (and all replies) are naturally suppressed because there's no published address that the responding server can send messages to. +|Address|Comments| +||| +|**No From address**|In the past, when Microsoft 365 or Outlook.com received a message without a From address, the service added `From: <>` to make the message deliverable. As of November 2017, messages with blank From addresses aren't accepted.| +|`From: <firstname lastname@contoso.com>`|The email address contains a space.| +|`From: Microsoft 365 sender@contoso.com`|The display name is present, but the email address isn't enclosed in angle brackets.| +|`From: "Microsoft 365" <sender@contoso.com> (Sent by a process)`|Text after the email address.| +|`From: Sender, Example <sender.example@contoso.com>`|The display name contains a comma, but isn't enclosed in double quotation marks.| +|`From: "Microsoft 365 <sender@contoso.com>"`|The whole value is incorrectly enclosed in double quotation marks.| +|`From: "Microsoft 365 <sender@contoso.com>" sender@contoso.com`|The display name is present, but the email address isn't enclosed in angle brackets.| +|`From: Microsoft 365<sender@contoso.com>`|No space between the display name and the left angle bracket.| +|`From: "Microsoft 365"<sender@contoso.com>`|No space between the closing double quotation mark and the left angle bracket.| -- Choose an email domain that can't receive email. For example, if your primary domain is contoso.com, you might choose noreply.contoso.com.+## Suppress auto-replies to custom domains -- The null MX record for this domain consists of a single period.+You can't use the value `From: <>` to suppress auto-replies. Instead, you need to set up a *null MX record* for the custom domain. After you set up the null MX record, *all* replies are naturally suppressed because there's no published address for the responding server to send messages to. -For example: +For the null MX record, choose an email domain that can't receive email. For example, if the primary domain is contoso.com, you might choose noreply.contoso.com. The null MX record for this domain consists of a single period. For example: ```text noreply.contoso.com IN MX . For more information about publishing a null MX, see [RFC 7505](https://tools.ie ## Override From address enforcement -To bypass the From address requirements for inbound email, you can use the IP Allow List (connection filtering) or mail flow rules (also known as transport rules) as described in [Create safe sender lists in Microsoft 365](create-safe-sender-lists-in-office-365.md). +To bypass the From address requirements for inbound email, you can use the IP Allow List (connection filtering) or mail flow rules (also known as transport rules) as described in [Create safe sender lists in Microsoft 365](create-safe-sender-lists-in-office-365.md). Outlook.com doesn't allow overrides of any kind, even through support requests. -You can't override the From address requirements for outbound email that you send from Microsoft 365. In addition, Outlook.com won't allow overrides of any kind, even through support. +You can't override the From address requirements for outbound email that you send from Microsoft 365 or Outlook.com. ## Other ways to prevent and protect against cybercrimes in Microsoft 365 -For more information on how you can strengthen your organization against phishing, spam, data breaches, and other threats, see [Best practices for securing Microsoft 365 for business plans](../../business-premium/secure-your-business-data.md). +For more information on how to strengthen your organization against phishing, spam, data breaches, and other threats, see [Best practices for securing Microsoft 365 for business plans](../../business-premium/secure-your-business-data.md). |
| security | Anti Phishing Mdo Impersonation Insight | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-mdo-impersonation-insight.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Impersonation insight in Defender for Office 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- _Impersonation_ is when the sender of an email message looks similar to a real or expected sender's email address. Attackers often use impersonated sender email addresses in phishing or other types of attacks to gain the trust of the recipient. There are two basic types of impersonation: - **Domain impersonation**: Contains subtle differences in the domain. For example, lila@ćóntoso.com impersonates lila@contoso.com. The insight has two modes: - **Insight mode**: If impersonation protection is enabled and configured in any anti-phishing policies, the insight shows the number of detected messages from impersonated domains and impersonated users (senders) over the past seven days. The number shown is the total of all detected impersonation attempts from all anti-phishing policies. - **What if mode**: If impersonation protection isn't enabled and configured in any active anti-phishing policies, the insight shows how many messages _would have been_ detected by impersonation protection over the past seven days. -To view information about the impersonation detections, select the **View impersonations** link in the impersonation insight. +To view information about impersonation detections, select **View impersonations** in the impersonation insight to go to the **Impersonation insight** page. ## View information about domain impersonation detections -After you select the **View impersonations** link in the impersonation insight, you're taken to the **Impersonation insight** page. To go directly to the **Impersonation insight** page, use <https://security.microsoft.com/impersonationinsight>. +The **Impersonation insight** page at <https://security.microsoft.com/impersonationinsight> is available when you select **View impersonations** in the impersonation insight on the **Anti-phishing** page. ++On the **Impersonation insight** page, verify the **Domains** tab is selected. -On the **Impersonation insight** page, verify that the **Domains** tab is selected. The following information is shown:<sup>\*</sup>: +You can sort the entries by clicking on an available column header. The following columns are available:<sup>\*</sup>: - **Sender Domain**: The impersonating domain, which is the domain that was used to send the email message. - **Message count**: The number of messages from impersonating sender domain over the last seven days. On the **Impersonation insight** page, verify that the **Domains** tab is select - **Yes**: The domain was configured as trusted domain (an exception for impersonation protection) in the anti-phishing policy that detected the message. Messages from the impersonated domain were detected, but allowed. - **No**: The domain was configured for impersonation protection in the anti-phishing policy that detected the message. The action for domain impersonation detections in the anti-phishing policy is done to the message. -Select a column header to sort by that column. --sup>\*</sup> To see all columns, you likely need to do one or more of the following steps: +<sup>\*</sup> To see all columns, you likely need to do one or more of the following steps: - Horizontally scroll in your web browser. - Narrow the width of appropriate columns. When you're finished in the details flyout, select **Close**. ## View information about user impersonation detections -After you select the **View impersonations** link in the impersonation insight, you're taken to the **Impersonation insight** page. To go directly to the **Impersonation insight** page, use <https://security.microsoft.com/impersonationinsight>. +The **Impersonation insight** page at <https://security.microsoft.com/impersonationinsight> is available when you select **View impersonations** in the impersonation insight on the **Anti-phishing** page. -On the **Impersonation insight** page, select the **Users** tab. The following information is shown:<sup>\*</sup>: +On the **Impersonation insight** page, select the **Users** tab. ++You can sort the entries by clicking on an available column header. The following columns are available:<sup>\*</sup>: - **Sender**: The email address of the impersonating sender that sent the email message. - **Message count**: The number of messages from the impersonating sender over the last seven days. On the **Impersonation insight** page, select the **Users** tab. The following i - **Yes**: The sender was configured as trusted user (an exception for impersonation protection) in the anti-phishing policy that detected the message. Messages from the impersonated sender were detected, but allowed. - **No**: The sender was configured for impersonation protection in the anti-phishing policy that detected the message. The action for user impersonation detections in the anti-phishing policy is done to the message. -Select a column header to sort by that column. --sup>\*</sup> To see all columns, you likely need to do one or more of the following steps: +<sup>\*</sup> To see all columns, you likely need to do one or more of the following steps: - Horizontally scroll in your web browser. - Narrow the width of appropriate columns. |
| security | Anti Phishing Policies About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-policies-about.md | description: Admins can learn about the anti-phishing policies that are availabl search.appverid: met150 Previously updated : 5/4/2023 Last updated : 06/09/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Anti-phishing policies in Microsoft 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- Policies to configure anti-phishing protection settings are available in Microsoft 365 organizations with Exchange Online mailboxes, standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, and Microsoft Defender for Office 365 organizations. Examples of Microsoft Defender for Office 365 organizations include: The following spoof settings are available in anti-phishing policies in EOP and - **Enable spoof intelligence**: Turns spoof intelligence on or off. We recommend that you leave it turned on. - When spoof intelligence is enabled, the **spoof intelligence insight** shows spoofed senders that were automatically detected and allowed or blocked by spoof intelligence. You can manually override the spoof intelligence verdict to allow or block the detected spoofed senders from within the insight. But when you do, the spoofed sender disappears from the spoof intelligence insight, and is now visible only on the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. You can also manually create allow or block entries for spoofed senders in the Tenant Allow/Block List. For more information, see the following articles: + When spoof intelligence is enabled, the **spoof intelligence insight** shows spoofed senders that were automatically detected and allowed or blocked by spoof intelligence. You can manually override the spoof intelligence verdict to allow or block the detected spoofed senders from the insight. But when you do, the spoofed sender disappears from the spoof intelligence insight, and is visible only on the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. Or, you can manually create allow or block entries for spoofed senders in the Tenant Allow/Block List, even if they're not detected by the spoof intelligence insight. For more information, see the following articles: - [Spoof intelligence insight in EOP](anti-spoofing-spoof-intelligence.md)- - [Manage the Tenant Allow/Block List in EOP](tenant-allow-block-list-about.md) + - [Spoofed senders in the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#spoofed-senders-in-the-tenant-allowblock-list) > [!NOTE] >- > - Anti-spoofing protection is enabled by default in the default anti-phishing policy and in any new custom anti-phishing policies that you create. + > - Anti-spoofing protection is enabled in the Standard and Strict preset security policies, and is enabled by default in the default anti-phishing policy and in new custom anti-phishing policies that you create. > - You don't need to disable anti-spoofing protection if your MX record doesn't point to Microsoft 365; you enable Enhanced Filtering for Connectors instead. For instructions, see [Enhanced Filtering for Connectors in Exchange Online](/Exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors). > - Disabling anti-spoofing protection only disables _implicit_ spoofing protection from [composite authentication](email-authentication-about.md#composite-authentication) checks. For information about how _explicit_ [DMARC](email-authentication-dmarc-configure.md) checks are affected by anti-spoofing protection and the configuration of the DMARC policy (`p=quarantine` or `p=reject` in the DMARC record), see the [Spoof protection and sender DMARC policies](#spoof-protection-and-sender-dmarc-policies) section. |
| security | Anti Phishing Policies Eop Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-policies-eop-configure.md | description: Admins can learn how to create, modify, and delete the anti-phishin search.appverid: met150 Previously updated : 5/3/2023 Last updated : 06/09/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> # Configure anti-phishing policies in EOP [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, anti-phishing policies provide anti-spoofing protection. For more information, see [Spoof settings in anti-phishing policies](anti-phishing-policies-about.md#spoof-settings). The default anti-phishing policy automatically applies to all recipients. For greater granularity, you can also create custom anti-phishing policies that apply to specific users, groups, or domains in your organization. |
| security | Anti Phishing Policies Mdo Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure.md | description: Admins can learn how to create, modify, and delete the advanced ant search.appverid: met150 Previously updated : 5/3/2023 Last updated : 06/09/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Configure anti-phishing policies in Microsoft Defender for Office 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In organizations with Microsoft Defender for Office 365, anti-phishing policies provide the following types of protection: - The same anti-spoofing protection that's available in Exchange Online Protection (EOP). For more information, see [Spoof settings](anti-phishing-policies-about.md#spoof-settings). |
| security | Anti Phishing Protection About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-protection-about.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Anti-phishing protection in Microsoft 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- *Phishing* is an email attack that tries to steal sensitive information in messages that appear to be from legitimate or trusted senders. There are specific categories of phishing. For example: - **Spear phishing** uses focused, customized content that's specifically tailored to the targeted recipients (typically, after reconnaissance on the recipients by the attacker). Last updated 11/30/2022 - **Business email compromise (BEC)** uses forged trusted senders (financial officers, customers, trusted partners, etc.) to trick recipients into approving payments, transferring funds, or revealing customer data. Learn more by watching [this video](https://www.youtube.com/watch?v=8Kn31h9HwIQ&list=PL3ZTgFEc7LystRja2GnDeUFqk44k7-KXf&index=2). -- **Ransomware** that encrypts your data and demands payment to decrypt it almost always starts out in phishing messages. Anti-phishing protection can't help you decrypt encrypted files, but it can help detect the initial phishing messages that are associated with the ransomware campaign. For more information about recovering from a ransomware attack, see [Ransomware incident response playbooks](/security/ransomware/).+- **Ransomware** that encrypts your data and demands payment to decrypt it almost always starts in phishing messages. Anti-phishing protection can't help you decrypt encrypted files, but it can help detect the initial phishing messages that are associated with the ransomware campaign. For more information about recovering from a ransomware attack, see [Ransomware incident response playbooks](/security/ransomware/). With the growing complexity of attacks, it's even difficult for trained users to identify sophisticated phishing messages. Fortunately, Exchange Online Protection (EOP) and the additional features in Microsoft Defender for Office 365 can help. ## Anti-phishing protection in EOP -EOP (that is, Microsoft 365 organizations without Microsoft Defender for Office 365) contains features that can help protect your organization from phishing threats: +Microsoft 365 organizations with mailboxes in Exchange Online or standalone EOP organizations without Exchange Online mailboxes contain the following features that help protect your organization from phishing threats: - **Spoof intelligence**: Use the spoof intelligence insight to review detected spoofed senders in messages from external and internal domains, and manually allow or block those detected senders. For more information, see [Spoof intelligence insight in EOP](anti-spoofing-spoof-intelligence.md). - **Anti-phishing policies in EOP**: Turn spoof intelligence on or off, turn unauthenticated sender indicators in Outlook on or off, and specify the action for blocked spoofed senders. For more information, see [Configure anti-phishing policies in EOP](anti-phishing-policies-eop-configure.md). - **Honor the sender's DMARC policy when the message is detected as spoof** (currently in Preview): Control what happens to messages where the sender fails explicit [DMARC](email-authentication-dmarc-configure.md) checks and the DMARC policy is set to `p=quarantine` or `p=reject`. For more information, see [Spoof protection and sender DMARC policies](anti-phishing-policies-about.md#spoof-protection-and-sender-dmarc-policies). + **Honor the sender's DMARC policy when the message is detected as spoof**: Control what happens to messages where the sender fails explicit [DMARC](email-authentication-dmarc-configure.md) checks and the DMARC policy is set to `p=quarantine` or `p=reject`. For more information, see [Spoof protection and sender DMARC policies](anti-phishing-policies-about.md#spoof-protection-and-sender-dmarc-policies). -- **Allow or block spoofed senders in the Tenant Allow/Block List**: When you override the verdict in the spoof intelligence insight, the spoofed sender becomes a manual allow or block entry that only appears on the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. You can also manually create allow or block entries for spoof senders before they're detected by spoof intelligence. For more information, see [Manage the Tenant Allow/Block List in EOP](tenant-allow-block-list-about.md).+- **Allow or block spoofed senders in the Tenant Allow/Block List**: When you override the verdict in the spoof intelligence insight, the spoofed sender becomes a manual allow or block entry that only appears on the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. You can also manually create allow or block entries for spoofed senders before they're detected by spoof intelligence. For more information, see [Spoofed senders in the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#spoofed-senders-in-the-tenant-allowblock-list). - **Implicit email authentication**: EOP enhances standard email authentication checks for inbound email ([SPF](email-authentication-spf-configure.md), [DKIM](email-authentication-dkim-configure.md), and [DMARC](email-authentication-dmarc-configure.md) with sender reputation, sender history, recipient history, behavioral analysis, and other advanced techniques to help identify forged senders. For more information, see [Email authentication in Microsoft 365](email-authentication-about.md). Microsoft Defender for Office 365 contains additional and more advanced anti-phi - **Anti-phishing policies in Microsoft Defender for Office 365**: Configure impersonation protection settings for specific message senders and sender domains, mailbox intelligence settings, and adjustable advanced phishing thresholds. For more information, see [Configure anti-phishing policies in Microsoft Defender for Office 365](anti-phishing-policies-mdo-configure.md). For more information about the differences between anti-phishing policies in EOP and anti-phishing policies in Defender for Office 365, see [Anti-phishing policies in Microsoft 365](anti-phishing-policies-about.md). - **Campaign Views**: Machine learning and other heuristics identify and analyze messages that are involved in coordinated phishing attacks against the entire service and your organization. For more information, see [Campaign Views in Microsoft Defender for Office 365](campaigns.md).-- **Attack simulation training**: Admins can create fake phishing messages and send them to internal users as an education tool. For more information, see [Simulate a phishing attack](attack-simulation-training-simulations.md).+- **Attack simulation training**: Admins can create fake phishing messages and send them to internal users as an education tool. For more information, see [Get started using Attack simulation training](attack-simulation-training-get-started.md). ## Other anti-phishing resources - For end users: [Protect yourself from phishing schemes and other forms of online fraud](https://support.microsoft.com/office/be0de46a-29cd-4c59-aaaf-136cf177d593).- - [How Microsoft 365 validates the From address to prevent phishing](anti-phishing-from-email-address-validation.md). |
| security | Anti Phishing Protection Spoofing About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-protection-spoofing-about.md | ms.localizationpriority: high description: Admins can learn about the anti-spoofing features that are available in Exchange Online Protection (EOP), which can help mitigate against phishing attacks from spoofed senders and domains. Previously updated : 11/30/2022 Last updated : 06/09/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Anti-spoofing protection in EOP [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, EOP includes features to help protect your organization from spoofed (forged) senders. -When it comes to protecting its users, Microsoft takes the threat of phishing seriously. Spoofing is a common technique that's used by attackers. **Spoofed messages appear to originate from someone or somewhere other than the actual source**. This technique is often used in phishing campaigns that are designed to obtain user credentials. The anti-spoofing technology in EOP specifically examines forgery of the From header in the message body (used to display the message sender in email clients). When EOP has high confidence that the From header is forged, the message is identified as spoofed. +When it comes to protecting its users, Microsoft takes the threat of phishing seriously. Spoofing is a common technique that's used by attackers. **Spoofed messages appear to originate from someone or somewhere other than the actual source**. This technique is often used in phishing campaigns that are designed to get user credentials. The anti-spoofing technology in EOP specifically examines forgery of the From header in the message body, because that header value is the message sender that's shown in email clients. When EOP has high confidence that the From header is forged, the message is identified as spoofed. The following anti-spoofing technologies are available in EOP: - **Email authentication**: An integral part of any anti-spoofing effort is the use of email authentication (also known as email validation) by SPF, DKIM, and DMARC records in DNS. You can configure these records for your domains so destination email systems can check the validity of messages that claim to be from senders in your domains. For inbound messages, Microsoft 365 requires email authentication for sender domains. For more information, see [Email authentication in Microsoft 365](email-authentication-about.md). - EOP analyzes and blocks messages that can't be authenticated by the combination of standard email authentication methods and sender reputation techniques. + EOP analyzes and blocks messages based on the combination of standard email authentication methods and sender reputation techniques. :::image type="content" source="../../media/eop-anti-spoofing-protection.png" alt-text="The EOP anti-spoofing checks" lightbox="../../media/eop-anti-spoofing-protection.png"::: -- **Spoof intelligence insight**: Review spoofed messages from senders in internal and external domains during the last 7 days, and allow or block those senders. For more information, see [Spoof intelligence insight in EOP](anti-spoofing-spoof-intelligence.md).+- **Spoof intelligence insight**: Review detected spoofed messages from senders in internal and external domains during the last seven days. For more information, see [Spoof intelligence insight in EOP](anti-spoofing-spoof-intelligence.md). -- **Allow or block spoofed senders in the Tenant Allow/Block List**: When you override the verdict in the spoof intelligence insight, the spoofed sender becomes a manual allow or block entry that only appears on the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. You can also manually create allow or block entries for spoof senders before they're detected by spoof intelligence. For more information, see [Manage the Tenant Allow/Block List in EOP](tenant-allow-block-list-about.md).+- **Allow or block spoofed senders in the Tenant Allow/Block List**: When you override the verdict in the spoof intelligence insight, the spoofed sender becomes a manual allow or block entry that only appears on the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. You can also manually create allow or block entries for spoof senders before they're detected by spoof intelligence. For more information, see [Spoofed senders in the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#spoofed-senders-in-the-tenant-allowblock-list). - **Anti-phishing policies**: In EOP and Microsoft Defender for Office 365, anti-phishing policies contain the following anti-spoofing settings: - Turn spoof intelligence on or off. The following anti-spoofing technologies are available in EOP: For more information, see [Spoof settings in anti-phishing policies](anti-phishing-policies-about.md#spoof-settings). - **Note**: Anti-phishing policies in Defender for Office 365 contain addition protections, including **impersonation** protection. For more information, see [Exclusive settings in anti-phishing policies in Microsoft Defender for Office 365](anti-phishing-policies-about.md#exclusive-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365). + Anti-phishing policies in Defender for Office 365 contain addition protections, including *impersonation* protection. For more information, see [Exclusive settings in anti-phishing policies in Microsoft Defender for Office 365](anti-phishing-policies-about.md#exclusive-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365). - **Spoof detections report**: For more information, see [Spoof Detections report](reports-email-security.md#spoof-detections-report). - **Note**: Defender for Office 365 organizations can also use Real-time detections (Plan 1) or Threat Explorer (Plan 2) to view information about phishing attempts. For more information, see [Microsoft 365 threat investigation and response](office-365-ti.md). + Defender for Office 365 organizations can also use Real-time detections (Plan 1) or Threat Explorer (Plan 2) to view information about phishing attempts. For more information, see [Microsoft 365 threat investigation and response](office-365-ti.md). ## How spoofing is used in phishing attacks -Spoofing messages have the following negative implications for users: +Spoofed senders in messages have the following negative implications for users: -- **Spoofed messages deceive users**: A spoofed message might trick the recipient into clicking a link and giving up their credentials, downloading malware, or replying to a message with sensitive content (known as a business email compromise or BEC).+- **Deception**: Messages from spoofed senders might trick the recipient into selecting a link and giving up their credentials, downloading malware, or replying to a message with sensitive content (known as business email compromise or BEC). The following message is an example of phishing that uses the spoofed sender msoutlook94@service.outlook.com: :::image type="content" source="../../media/1a441f21-8ef7-41c7-90c0-847272dc5350.jpg" alt-text="Phishing message impersonating service.outlook.com." lightbox="../../media/1a441f21-8ef7-41c7-90c0-847272dc5350.jpg"::: - This message didn't come from service.outlook.com, but the attacker spoofed the **From** header field to make it look like it did. This was an attempt to trick the recipient into clicking the **change your password** link and giving up their credentials. + This message didn't come from service.outlook.com, but the attacker spoofed the **From** header field to make it look like it did. The sender attempted to trick the recipient into selecting the **change your password** link and providing their credentials. The following message is an example of BEC that uses the spoofed email domain contoso.com: Spoofing messages have the following negative implications for users: The message looks legitimate, but the sender is spoofed. -- **Users confuse real messages for fake ones**: Even users who know about phishing might have difficulty seeing the differences between real messages and spoofed messages.+- **Confusion**: Even users who know about phishing might have difficulty seeing the differences between real messages and messages from spoofed senders. The following message is an example of a real password reset message from the Microsoft Security account: Spoofing messages have the following negative implications for users: ## Different types of spoofing -Microsoft differentiates between two different types of spoofed messages: +Microsoft differentiates between two different types of spoofed senders in messages: - **Intra-org spoofing**: Also known as _self-to-self_ spoofing. For example: Microsoft differentiates between two different types of spoofed messages: - `reason=6xx` indicates intra-org spoofing. - - SFTY is the safety level of the message. 9 indicates phishing, .11 indicates intra-org spoofing. + - `SFTY` is the safety level of the message. `9` indicates phishing, `.11` indicates intra-org spoofing. - **Cross-domain spoofing**: The sender and recipient domains are different, and have no relationship to each other (also known as external domains). For example: > From: chris@contoso.com <br> To: michelle@tailspintoys.com Microsoft differentiates between two different types of spoofed messages: - `reason=000` indicates the message failed explicit email authentication. `reason=001` indicates the message failed implicit email authentication. - - `SFTY` is the safety level of the message. 9 indicates phishing, .22 indicates cross-domain spoofing. --> [!NOTE] -> If you've gotten a message like ***compauth=fail reason=###*** and need to know about composite authentication (compauth), and the values related to spoofing, see [*Anti-spam message headers in Microsoft 365*](message-headers-eop-mdo.md). Or go directly to the [*reason*](message-headers-eop-mdo.md) codes. + - `SFTY` is the safety level of the message. `9` indicates phishing, `.22` indicates cross-domain spoofing. -For more information about DMARC, see [Use DMARC to validate email in Microsoft 365](email-authentication-dmarc-configure.md). + For more information about **Authentication-Results** and `compauth` values, see [Authentication-results message header fields](message-headers-eop-mdo.md#authentication-results-message-header-fields). ## Problems with anti-spoofing protection -Mailing lists (also known as discussion lists) are known to have problems with anti-spoofing due to the way they forward and modify messages. +Mailing lists (also known as discussion lists) are known to have problems with anti-spoofing protection due to the way they forward and modify messages. For example, Gabriela Laureano (glaureano@contoso.com) is interested in bird watching, joins the mailing list birdwatchers@fabrikam.com, and sends the following message to the list: The mailing list server receives the message, modifies its content, and replays To help mailing list messages pass anti-spoofing checks, do following steps based on whether you control the mailing list: -- Your organization owns the mailing list:-+- **Your organization owns the mailing list**: - Check the FAQ at DMARC.org: [I operate a mailing list and I want to interoperate with DMARC, what should I do?](https://dmarc.org/wiki/FAQ#I_operate_a_mailing_list_and_I_want_to_interoperate_with_DMARC.2C_what_should_I_do.3F).- - Read the instructions at this blog post: [A tip for mailing list operators to interoperate with DMARC to avoid failures](/archive/blogs/tzink/a-tip-for-mailing-list-operators-to-interoperate-with-dmarc-to-avoid-failures).+ - Consider installing updates on your mailing list server to support ARC. For more information, see <http://arc-spec.org>. - - Consider installing updates on your mailing list server to support ARC, see <http://arc-spec.org>. --- Your organization doesn't own the mailing list:-- - Ask the maintainer of the mailing list to configure email authentication for the domain that the mailing list is relaying from. -- When enough senders reply back to domain owners that they should set up email authentication records, it spurs them into taking action. While Microsoft also works with domain owners to publish the required records, it helps even more when individual users request it. -- - Create inbox rules in your email client to move messages to the Inbox. You can also ask your admins to configure overrides as described in [Spoof intelligence insight in EOP](anti-spoofing-spoof-intelligence.md) and [Manage the Tenant Allow/Block List](tenant-allow-block-list-about.md). -- - Use the Tenant Allow/Block List to create an override for the mailing list to treat it as legitimate. For more information, see [Create allow entries for spoofed senders](tenant-allow-block-list-email-spoof-configure.md#create-allow-entries-for-spoofed-senders). +- **Your organization doesn't own the mailing list**: + - Ask the maintainer of the mailing list to configure email authentication for the domain that the mailing list is relaying from. The owners are more likely to act if enough members ask them to set up email authentication. While Microsoft also works with domain owners to publish the required records, it helps even more when individual users request it. + - Create Inbox rules in your email client to move messages to the Inbox. + - Use the Tenant Allow/Block List to create an allow entry for the mailing list to treat it as legitimate. For more information, see [Create allow entries for spoofed senders](tenant-allow-block-list-email-spoof-configure.md#create-allow-entries-for-spoofed-senders). If all else fails, you can report the message as a false positive to Microsoft. For more information, see [Report messages and files to Microsoft](submissions-report-messages-files-to-microsoft.md). If all else fails, you can report the message as a false positive to Microsoft. If you're an admin who currently sends messages to Microsoft 365, you need to ensure that your email is properly authenticated. Otherwise, it might be marked as spam or phishing. For more information, see [Solutions for legitimate senders who are sending unauthenticated email](email-authentication-about.md#solutions-for-legitimate-senders-who-are-sending-unauthenticated-email). -Senders in an individual user's (or admin's) Safe Senders list will bypass parts of the filtering stack, including spoof protection. For more information, see [Outlook Safe Senders](create-safe-sender-lists-in-office-365.md#use-outlook-safe-senders). +Senders in individual user (or admin) Safe Senders lists bypass parts of the filtering stack, including spoof protection. For more information, see [Outlook Safe Senders](create-safe-sender-lists-in-office-365.md#use-outlook-safe-senders). -Admins should avoid (when possible) using allowed sender lists or allowed domain lists. These senders bypass all spam, spoofing, and phishing protection, and also sender authentication (SPF, DKIM, DMARC). For more information, see [Use allowed sender lists or allowed domain lists](create-safe-sender-lists-in-office-365.md#use-allowed-sender-lists-or-allowed-domain-lists). +If at all possible, admins should avoid using allowed sender lists or allowed domain lists in anti-spam policies. These senders bypass most of the filtering stack (high confidence phishing and malware messages are always quarantined). For more information, see [Use allowed sender lists or allowed domain lists](create-safe-sender-lists-in-office-365.md#use-allowed-sender-lists-or-allowed-domain-lists). |
| security | Anti Phishing Protection Tuning | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-protection-tuning.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Tune anti-phishing protection -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)--Although Microsoft 365 comes with a variety of anti-phishing features that are enabled by default, it's possible that some phishing messages could still get through to your mailboxes. This topic describes what you can do to discover why a phishing message got through, and what you can do to adjust the anti-phishing settings in your Microsoft 365 organization _without accidentally making things worse_. +Although Microsoft 365 comes with a variety of anti-phishing features that are enabled by default, it's possible that some phishing messages could still get through to mailboxes in your organization. This article describes what you can do to discover why a phishing message got through, and what you can do to adjust the anti-phishing settings in your Microsoft 365 organization _without accidentally making things worse_. ## First things first: deal with any compromised accounts and make sure you block any more phishing messages from getting through If a recipient's account was compromised as a result of the phishing message, fo If your subscription includes Microsoft Defender for Office 365, you can use [Office 365 Threat Intelligence](office-365-ti.md) to identify other users who also received the phishing message. You have additional options to block phishing messages: - [Safe Links in Microsoft Defender for Office 365](safe-links-policies-configure.md)- - [Safe Attachments in Microsoft Defender for Office 365](safe-attachments-policies-configure.md)+- [Anti-phishing policies in Microsoft Defender for Office 365](anti-phishing-policies-mdo-configure.md). You can temporarily increase the **Advanced phishing thresholds** in the policy from **Standard** to **Aggressive**, **More aggressive**, or **Most aggressive**. -- [Anti-phishing policies in Microsoft Defender for Office 365](anti-phishing-policies-mdo-configure.md). Note that you can temporarily increase the **Advanced phishing thresholds** in the policy from **Standard** to **Aggressive**, **More aggressive**, or **Most aggressive**.--Verify these Defender for Office 365 features are turned on. +Verify these policies are working. Safe Links and Safe Attachments protection is turned on by default, thanks to Built-in protection in [preset security policies](preset-security-policies.md). Anti-phishing has a default policy that applies to all recipients where anti-spoofing protection is turned on by default. Impersonation protection isn't turned on in the policy, and therefore needs to be configured. For instructions, see [Configure anti-phishing policies in Microsoft Defender for Office 365](anti-phishing-policies-mdo-configure.md). ## Report the phishing message to Microsoft -Reporting phishing messages is helpful in tuning the filters that are used to protect all customers in Microsoft 365. For instructions, see [Report messages and files to Microsoft](submissions-report-messages-files-to-microsoft.md). +Reporting phishing messages is helpful in tuning the filters that are used to protect all customers in Microsoft 365. For instructions, see [Use the Submissions page to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft](submissions-admin.md). ## Inspect the message headers You can examine the headers of the phishing message to see if there's anything that you can do yourself to prevent more phishing messages from coming through. In other words, examining the messages headers can help you identify any settings in your organization that were responsible for allowing the phishing messages in. -Specifically, you should check the **X-Forefront-Antispam-Report** header field in the message headers for indications of skipped filtering for spam or phishing in the Spam Filtering Verdict (SFV) value. Messages that skip filtering will have an entry of `SCL:-1`, which means one of your settings allowed this message through by overriding the spam or phishing verdicts that were determined by the service. For more information on how to get message headers and the complete list of all available anti-spam and anti-phishing message headers, see [Anti-spam message headers in Microsoft 365](message-headers-eop-mdo.md). +Specifically, you should check the **X-Forefront-Antispam-Report** header field in the message headers for indications of skipped filtering for spam or phishing in the Spam Filtering Verdict (SFV) value. Messages that skip filtering have an entry of `SCL:-1`, which means one of your settings allowed this message through by overriding the spam or phishing verdicts that were determined by the service. For more information on how to get message headers and the complete list of all available anti-spam and anti-phishing message headers, see [Anti-spam message headers in Microsoft 365](message-headers-eop-mdo.md). ++> [!TIP] +> You can copy and paste the contents of a message header into the [Message Header Analyzer](https://mha.azurewebsites.net/) tool. This tool helps parse headers and put them into a more readable format. ++You can also use the [configuration analyzer](configuration-analyzer-for-security-policies.md) to compare your EOP and Defender for Office 365 security policies to the Standard and Strict recommendations. ## Best practices to stay protected - On a monthly basis, run [Secure Score](../defender/microsoft-secure-score.md) to assess your organization's security settings. -- For messages that end up in quarantine by mistake, or for messages that are allowed through, we recommend that you search for those messages in [Threat Explorer and real-time detections](threat-explorer-about.md). You can search by sender, recipient, or message ID. After you locate the message, go to details by clicking on the subject. For a quarantined message, look to see what the "detection technology" was so that you can use the appropriate method to override. For an allowed message, look to see which policy allowed the message.+- For messages that end up in quarantine by mistake (false positives), or for messages that are allowed through (false negatives), we recommend that you search for those messages in [Threat Explorer and real-time detections](threat-explorer-about.md). You can search by sender, recipient, or message ID. After you locate the message, go to details by clicking on the subject. For a quarantined message, look to see what the "detection technology" was so that you can use the appropriate method to override. For an allowed message, look to see which policy allowed the message. -- Email from spoofed senders (the From address of the message doesn't match the source of the message) is classified as phishing in Defender for Office 365. Sometimes spoofing is benign, and sometimes users don't want messages from specific spoofed sender to be quarantined. To minimize the impact to users, periodically review the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md), the **Spoofed senders** tab in the [Tenant Allow/Block List](tenant-allow-block-list-about.md), and the [Spoof detections report](reports-email-security.md#spoof-detections-report). Once you have reviewed allowed and blocked spoofed senders and made any necessary overrides, you can be confident to [configure spoof intelligence in anti-phishing policies](anti-phishing-policies-about.md#spoof-settings) to **Quarantine** suspicious messages instead of delivering them to the user's Junk Email folder.+- Email from spoofed senders (the From address of the message doesn't match the source of the message) is classified as _phishing_ in Defender for Office 365. Sometimes spoofing is benign, and sometimes users don't want messages from specific spoofed sender to be quarantined. To minimize the impact to users, periodically review the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md), [entries for spoofed senders in the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#use-the-microsoft-365-defender-portal-to-view-entries-for-spoofed-senders-in-the-tenant-allowblock-list), and the [Spoof detections report](reports-email-security.md#spoof-detections-report). After you review allowed and blocked spoofed senders and make any necessary overrides, you can confidently [configure spoof intelligence in anti-phishing policies](anti-phishing-policies-about.md#spoof-settings) to **Quarantine** suspicious messages instead of delivering them to the user's Junk Email folder. -- You can repeat the above step for Impersonation (domain or user) in Microsoft Defender for Office 365. The Impersonation report is found under **Threat Management** \> **Dashboard** \> **Insights**.+- In Defender for Office 365, you can also use the **Impersonation insight** page at <https://security.microsoft.com/impersonationinsight> to track user impersonation or domain impersonation detections. For more information, see [Impersonation insight in Defender for Office 365](anti-phishing-mdo-impersonation-insight.md). -- Periodically review the [Threat Protection Status report](reports-defender-for-office-365.md#threat-protection-status-report).+- Periodically review the [Threat Protection Status report](reports-defender-for-office-365.md#threat-protection-status-report) for phishing detections. -- Some customers inadvertently allow phishing messages through by putting their own domains in the Allow sender or Allow domain list in anti-spam policies. Although this configuration will allow some legitimate messages through, it will also allow malicious messages that would normally be blocked by the spam and/or phishing filters. Instead of allowing the domain, you should correct the underlying problem.+- Some customers inadvertently allow phishing messages through by putting their own domains in the Allow sender or Allow domain list in anti-spam policies. Although this configuration allows some legitimate messages through, it also allows malicious messages that would normally be blocked by the spam and/or phishing filters. Instead of allowing the domain, you should correct the underlying problem. The best way to deal with legitimate messages that are blocked by Microsoft 365 (false positives) that involve senders in your domain is to fully and completely configure the SPF, DKIM, and DMARC records in DNS for _all_ of your email domains: Specifically, you should check the **X-Forefront-Antispam-Report** header field For configuration instructions, see: - [Set up SPF to help prevent spoofing](email-authentication-spf-configure.md)- - [Use DKIM to validate outbound email sent from your custom domain](email-authentication-dkim-configure.md)- - [Use DMARC to validate email](email-authentication-dmarc-configure.md) - Whenever possible, we recommend that you deliver email for your domain directly to Microsoft 365. In other words, point your Microsoft 365 domain's MX record to Microsoft 365. Exchange Online Protection (EOP) is able to provide the best protection for your cloud users when their mail is delivered directly to Microsoft 365. If you must use a third-party email hygiene system in front of EOP, use Enhanced Filtering for Connectors. For instructions, see [Enhanced Filtering for Connectors in Exchange Online](/Exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors). -- Using the [built-in Report button in Outlook on the web](submissions-outlook-report-messages.md#use-the-built-in-report-button-in-outlook-on-the-web) or the [Microsoft Report Message or Report Phishing add-ins](submissions-outlook-report-messages.md#use-the-report-message-and-report-phishing-add-ins-in-outlook) to report messages to Microsoft helps with the training of our detection systems. Admins should also take advantage of [admin submission](submissions-admin.md) capabilities to report messages to Microsoft.+- Have users use the [built-in Report button in Outlook on the web](submissions-outlook-report-messages.md#use-the-built-in-report-button-in-outlook-on-the-web) or deploy the [Microsoft Report Message or Report Phishing add-ins](submissions-outlook-report-messages.md#use-the-report-message-and-report-phishing-add-ins-in-outlook) in your organization. Configure the [user reported settings](submissions-user-reported-messages-custom-mailbox.md) to send user reported messages to a reporting mailbox, to Microsoft, or both. User reported messages are then available to admins on the **User reported** tab on the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=user>. Admin can report user reported messages or any messages to Microsoft as described in [Use the Submissions page to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft](submissions-admin.md). User or admin reporting of false positives or false negatives to Microsoft is important, because it helps train our detection systems. - Multi factor authentication (MFA) is a good way to prevent compromised accounts. You should strongly consider enabling MFA for all of your users. For a phased approach, start by enabling MFA for your most sensitive users (admins, executives, etc.) before you enable MFA for everyone. For instructions, see [Set up multi-factor authentication](../../admin/security-and-compliance/set-up-multi-factor-authentication.md). - Forwarding rules to external recipients are often used by attackers to extract data. Use the **Review mailbox forwarding rules** information in [Microsoft Secure Score](../defender/microsoft-secure-score.md) to find and even prevent forwarding rules to external recipients. For more information, see [Mitigating Client External Forwarding Rules with Secure Score](/archive/blogs/office365security/mitigating-client-external-forwarding-rules-with-secure-score).++ Use the [Autofowarded messages report](/exchange/monitoring/mail-flow-reports/mfr-auto-forwarded-messages-report) to view specific details about forwarded email. |
| security | Anti Spam Backscatter About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-backscatter-about.md | -description: In this article, you'll learn about Backscatter and Microsoft Exchange Online Protection (EOP) +description: In this article, admins can about backscatter and how Microsoft Exchange Online Protection (EOP) tries to prevent it. Previously updated : 12/01/2022 Last updated : 06/09/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Backscatter in EOP -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)+*Backscatter* is non-delivery reports (also known as NDRs or bounce messages) that you receive for messages that you didn't send. Spammers often use real email addresses as the From address to lend credibility to their messages, and forge (spoof) the From address (also known as the `5322.From` or P2 address) to create backscatter. When a non-existent recipient receives spam, the destination email server is essentially tricked into returning the undeliverable message in an NDR to the forged sender in the From address. -*Backscatter* is non-delivery reports (also known as NDRs or bounce messages) that you receive for messages that you didn't send. Backscatter is caused by spammers forging (spoofing) the From address (also known as the `5322.From` or P2 address) in their messages. Spammers will often use real email addresses as the From address to lend credibility to their messages. When spam is sent to a non-existent recipient, the destination email server is essentially tricked into returning the undeliverable message in an NDR to the forged sender in the From address. +Exchange Online Protection (EOP) makes every effort to identify and silently drop messages from dubious sources without generating an NDR. But, based on the sheer volume email flowing through the service, there's always the possibility that EOP will unintentionally send backscatter. -In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, EOP makes every effort to identify and silently drop messages from dubious sources without generating an NDR. But, based on the sheer volume email flowing through the service, there's always the possibility that EOP will unintentionally send backscatter. --Backscatterer.org maintains a blocklist (also known as a DNS blocklist or DNSBL) of email servers that were responsible for sending backscatter, and EOP servers might appear on this list. But, we don't try to remove ourselves from the Backscatterer.org blocklist because (by their own admission) their list isn't a list of spammers. +Backscatterer.org maintains a blocklist (also known as a DNS blocklist or DNSBL) of email servers that were responsible for sending backscatter, and EOP servers might appear on this list. This list isn't a list of spammers. > [!TIP]-> The Backscatterer.org website (<http://www.backscatterer.org/?target=usage>) recommends using their service in Safe mode instead of Reject mode, because large email services almost always send some backscatter. +> The Backscatterer.org website (<http://www.backscatterer.org/?target=usage>) recommends using their service in Safe mode as large email services almost always send some backscatter. |
| security | Anti Spam Bulk Complaint Level Bcl About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-bulk-complaint-level-bcl-about.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Bulk complaint level (BCL) in EOP -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, EOP assigns a bulk complaint level (BCL) value to inbound messages from bulk senders. The BCL value is added to the message in an X-header and is similar to the [spam confidence level (SCL)](anti-spam-spam-confidence-level-scl-about.md) that's used to identify messages as spam. A higher BCL value indicates a bulk message is more likely to exhibit undesirable spam-like behavior. Microsoft uses both internal and third party sources to identify bulk mail and determine the appropriate BCL value. Bulk senders vary in their sending patterns, content creation, and recipient acquisition practices. Good bulk senders send desired messages with relevant content to their subscribers. These messages generate few complaints from recipients. Other bulk senders send unsolicited messages that closely resemble spam and generate many complaints from recipients. Messages from a bulk sender are known as bulk mail or gray mail. |
| security | Anti Spam Policies Asf Settings About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-policies-asf-settings-about.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Advanced Spam Filter (ASF) settings in EOP -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)--In all Microsoft 365 organizations, the Advanced Spam Filter (ASF) settings in anti-spam policies in EOP allow admins to mark messages as spam based on specific message properties. ASF specifically targets these properties because they're commonly found in spam. Depending on the property, ASF detections will either mark the message as **Spam** or **High confidence spam**. +In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, Advanced Spam Filter (ASF) settings in anti-spam policies allow admins to mark messages as spam based on specific message properties. ASF specifically targets these properties because they're commonly found in spam. Depending on the property, ASF detections mark the message as **Spam** or **High confidence spam**. > [!NOTE]-> Enabling one or more of the ASF settings is an aggressive approach to spam filtering. You can't report messages that are filtered by ASF as false positives. You can identify messages that were filtered by ASF by: +> Enabling one or more of the ASF settings is an aggressive approach to spam filtering. You can't report messages that are filtered by ASF as false positives to Microsoft. You can identify messages that were filtered by ASF by: > > - Periodic quarantine notifications from spam and high confidence spam filter verdicts. > - The presence of filtered messages in quarantine. > - The specific `X-CustomSpam:` X-header fields that are added to messages as described in this article. >-> ASF adds `X-CustomSpam:` X-header fields to messages _after_ the messages have been processed by Exchange mail flow rules (also known as transport rules), so you can't use mail flow rules to identify and act on messages that were filtered by ASF. +> ASF adds `X-CustomSpam:` X-header fields to messages _after_ the messages have been processed by Exchange mail flow rules (also known as transport rules), so you can't use mail flow rules to identify and act on messages that were filtered by ASF. You can use [Inbox rules](https://support.microsoft.com/office/8400435c-f14e-4272-9004-1548bb1848f2) in mailboxes to affect the delivery of the message. The following sections describe the ASF settings and options that are available in anti-spam policies in the Microsoft 365 Defender portal, and in Exchange Online PowerShell or standalone EOP PowerShell ([New-HostedContentFilterPolicy](/powershell/module/exchange/new-hostedcontentfilterpolicy) and [Set-HostedContentFilterPolicy](/powershell/module/exchange/set-hostedcontentfilterpolicy)). For more information, see [Configure anti-spam policies in EOP](anti-spam-policies-configure.md). The following sections describe the ASF settings and options that are available For each ASF setting, the following options are available in anti-spam policies: -- **On**: ASF adds the corresponding X-header field to the message, and either marks the message as **Spam** (SCL 5 or 6 for [Increase spam score settings](#increase-spam-score-settings)) or **High confidence spam** (SCL 9 for [Mark as spam settings](#mark-as-spam-settings)).-- **Off**: The ASF setting is disabled. This is the default value, and we recommend that you don't change it.-- **Test**: ASF adds the corresponding X-header field to the message. What happens to the message is determined by the **Test mode** (*TestModeAction*) value:- - **None**: Message delivery is unaffected by the ASF detection. The message is still subject to other types of filtering and rules in EOP. - - **Add default X-header text (*AddXHeader*)**: The X-header value `X-CustomSpam: This message was filtered by the custom spam filter option` is added to the message. You can use this value in Inbox rules (not mail flow rules) to affect the delivery of the message. - - **Send Bcc message (*BccMessage*)**: The specified email addresses (the *TestModeBccToRecipients* parameter value in PowerShell) are added to the Bcc field of the message, and the message is delivered to the additional Bcc recipients. In the Microsoft 365 Defender portal, you separate multiple email addresses by semicolons (;). In PowerShell, you separate multiple email addresses by commas. -- **Notes**: +- **On**: ASF adds the corresponding X-header field to the message, and marks the message as **Spam** (SCL 5 or 6 for [Increase spam score settings](#increase-spam-score-settings)) or **High confidence spam** (SCL 9 for [Mark as spam settings](#mark-as-spam-settings)). +- **Off**: The ASF setting is disabled. This is the default value. +- **Test**: ASF adds the corresponding X-header field to the message. What happens to the message is determined by the **Test mode** (_TestModeAction_) value: + - **None**: Message delivery is unaffected by the ASF detection. The message is still subject to other types of filtering and rules in EOP and Defender for Office 365. + - **Add default X-header text (_AddXHeader_)**: The X-header value `X-CustomSpam: This message was filtered by the custom spam filter option` is added to the message. You can use this value in Inbox rules (not mail flow rules) to affect the delivery of the message. + - **Send Bcc message (_BccMessage_)**: The specified email addresses (the _TestModeBccToRecipients_ parameter value in PowerShell) are added to the Bcc field of the message, and the message is delivered to the additional Bcc recipients. In the Microsoft 365 Defender portal, you separate multiple email addresses by semicolons (;). In PowerShell, you separate multiple email addresses by commas. - Test mode isn't available for the following ASF settings:- - **Conditional Sender ID filtering: hard fail** (*MarkAsSpamFromAddressAuthFail*) - - **NDR backscatter**(*MarkAsSpamNdrBackscatter*) - - **SPF record: hard fail** (*MarkAsSpamSpfRecordHardFail*) - - The same test mode action is applied to *all* ASF settings that are set to **Test**. You can't configure different test mode actions for different ASF settings. + - **Conditional Sender ID filtering: hard fail** (_MarkAsSpamFromAddressAuthFail_) + - **NDR backscatter**(_MarkAsSpamNdrBackscatter_) + - **SPF record: hard fail** (_MarkAsSpamSpfRecordHardFail_) + - The same test mode action is applied to _all_ ASF settings that are set to **Test**. You can't configure different test mode actions for different ASF settings. ## Increase spam score settings -The following **Increase spam score** ASF settings result in an increase in spam score and therefore a higher chance of getting marked as spam with a spam confidence level (SCL) of 5 or 6, which corresponds to a **Spam** filter verdict and the corresponding action in anti-spam policies. Not every email that matches the following settings will be marked as spam. +The following **Increase spam score** ASF settings result in an increase in spam score and therefore a higher chance of getting marked as spam with a spam confidence level (SCL) of 5 or 6, which corresponds to a **Spam** filter verdict and the corresponding action in anti-spam policies. Not every message that matches the following ASF conditions is marked as spam. |Anti-spam policy setting|Description|X-header added| ||||-|**Image links to remote websites** <p> *IncreaseScoreWithImageLinks*|Messages that contain `<Img>` HTML tag links to remote sites (for example, using http) are marked as spam.|`X-CustomSpam: Image links to remote sites`| -|**Numeric IP address in URL** <p> *IncreaseScoreWithNumericIps*|Messages that contain numeric-based URLs (typically, IP addresses) are marked as spam.|`X-CustomSpam: Numeric IP in URL`| -|**URL redirect to other port** <p> *IncreaseScoreWithRedirectToOtherPort*|Messages that contain hyperlinks that redirect to TCP ports other than 80 (HTTP), 8080 (alternate HTTP), or 443 (HTTPS) are marked as spam.|`X-CustomSpam: URL redirect to other port`| -|**Links to .biz or .info websites** <p> *IncreaseScoreWithBizOrInfoUrls*|Messages that contain `.biz` or `.info` links in the body of the message are marked as spam.|`X-CustomSpam: URL to .biz or .info websites`| +|**Image links to remote websites** (_IncreaseScoreWithImageLinks_)|Messages that contain `<Img>` HTML tag links to remote sites (for example, using http) are marked as spam.|`X-CustomSpam: Image links to remote sites`| +|**Numeric IP address in URL** (_IncreaseScoreWithNumericIps_)|Messages that contain numeric-based URLs (typically, IP addresses) are marked as spam.|`X-CustomSpam: Numeric IP in URL`| +|**URL redirect to other port** (_IncreaseScoreWithRedirectToOtherPort_)|Messages that contain hyperlinks that redirect to TCP ports other than 80 (HTTP), 8080 (alternate HTTP), or 443 (HTTPS) are marked as spam.|`X-CustomSpam: URL redirect to other port`| +|**Links to .biz or .info websites** (_IncreaseScoreWithBizOrInfoUrls_)|Messages that contain `.biz` or `.info` links in the body of the message are marked as spam.|`X-CustomSpam: URL to .biz or .info websites`| ## Mark as spam settings The following **Mark as spam** ASF settings set the SCL of detected messages to |Anti-spam policy setting|Description|X-header added| ||||-|**Empty messages** <p> *MarkAsSpamEmptyMessages*|Messages with no subject, no content in the message body, and no attachments are marked as high confidence spam.|`X-CustomSpam: Empty Message`| -|**Embedded tags in HTML** <p> *MarkAsSpamEmbedTagsInHtml*|Messages that contain `<embed>` HTML tags are marked as high confidence spam. <p> This tag allows the embedding of different kinds of documents in an HTML document (for example, sounds, videos, or pictures).|`X-CustomSpam: Embed tag in html`| -|**JavaScript or VBScript in HTML** <p> *MarkAsSpamJavaScriptInHtml*|Messages that use JavaScript or Visual Basic Script Edition in HTML are marked as high confidence spam. <p> These scripting languages are used in email messages to cause specific actions to automatically occur.|`X-CustomSpam: Javascript or VBscript tags in HTML`| -|**Form tags in HTML** <p> *MarkAsSpamFormTagsInHtml*|Messages that contain `<form>` HTML tags are marked as high confidence spam. <p> This tag is used to create website forms. Email advertisements often include this tag to solicit information from the recipient.|`X-CustomSpam: Form tag in html`| -|**Frame or iframe tags in HTML** <p> *MarkAsSpamFramesInHtml*|Messages that contain `<frame>` or `<iframe>` HTML tags are marked as high confidence spam. <p> These tags are used in email messages to format the page for displaying text or graphics.|`X-CustomSpam: IFRAME or FRAME in HTML`| -|**Web bugs in HTML** <p> *MarkAsSpamWebBugsInHtml*|A *web bug* (also known as a *web beacon*) is a graphic element (often as small as one pixel by one pixel) that's used in email messages to determine whether the message was read by the recipient. <p> Messages that contain web bugs are marked as high confidence spam. <p> Legitimate newsletters might use web bugs, although many consider this an invasion of privacy. |`X-CustomSpam: Web bug`| -|**Object tags in HTML** <p> *MarkAsSpamObjectTagsInHtml*|Messages that contain `<object>` HTML tags are marked as high confidence spam. <p> This tag allows plug-ins or applications to run in an HTML window.|`X-CustomSpam: Object tag in html`| -|**Sensitive words** <p> *MarkAsSpamSensitiveWordList*|Microsoft maintains a dynamic but non-editable list of words that are associated with potentially offensive messages. <p> Messages that contain words from the sensitive word list in the subject or message body are marked as high confidence spam.|`X-CustomSpam: Sensitive word in subject/body`| -|**SPF record: hard fail** <p> *MarkAsSpamSpfRecordHardFail*|Messages sent from an IP address that isn't specified in the SPF Sender Policy Framework (SPF) record in DNS for the source email domain are marked as high confidence spam. <p> Test mode isn't available for this setting.|`X-CustomSpam: SPF Record Fail`| +|**Empty messages** (_MarkAsSpamEmptyMessages_)|Messages with no subject, no content in the message body, and no attachments are marked as high confidence spam.|`X-CustomSpam: Empty Message`| +|**Embedded tags in HTML** (_MarkAsSpamEmbedTagsInHtml_)|Messages that contain `<embed>` HTML tags are marked as high confidence spam. <br><br> This tag allows the embedding of different kinds of documents in an HTML document (for example, sounds, videos, or pictures).|`X-CustomSpam: Embed tag in html`| +|**JavaScript or VBScript in HTML** (_MarkAsSpamJavaScriptInHtml_)|Messages that use JavaScript or Visual Basic Script Edition in HTML are marked as high confidence spam. <br><br> These scripting languages are used in email messages to cause specific actions to automatically occur.|`X-CustomSpam: Javascript or VBscript tags in HTML`| +|**Form tags in HTML** (MarkAsSpamFormTagsInHtml_)|Messages that contain `<form>` HTML tags are marked as high confidence spam. <br><br> This tag is used to create website forms. Email advertisements often include this tag to solicit information from the recipient.|`X-CustomSpam: Form tag in html`| +|**Frame or iframe tags in HTML** (MarkAsSpamFramesInHtml_)|Messages that contain `<frame>` or `<iframe>` HTML tags are marked as high confidence spam. <br><br> These tags are used in email messages to format the page for displaying text or graphics.|`X-CustomSpam: IFRAME or FRAME in HTML`| +|**Web bugs in HTML** (MarkAsSpamWebBugsInHtml_)|A _web bug_ (also known as a _web beacon_) is a graphic element (often as small as one pixel by one pixel) that's used in email messages to determine whether the recipient read the message. <br><br> Messages that contain web bugs are marked as high confidence spam. <br><br> Legitimate newsletters might use web bugs, although many consider this an invasion of privacy. |`X-CustomSpam: Web bug`| +|**Object tags in HTML** (MarkAsSpamObjectTagsInHtml_)|Messages that contain `<object>` HTML tags are marked as high confidence spam. <br><br> This tag allows plug-ins or applications to run in an HTML window.|`X-CustomSpam: Object tag in html`| +|**Sensitive words** (MarkAsSpamSensitiveWordList_)|Microsoft maintains a dynamic but non-editable list of words that are associated with potentially offensive messages. <br><br> Messages that contain words from the sensitive word list in the subject or message body are marked as high confidence spam.|`X-CustomSpam: Sensitive word in subject/body`| +|**SPF record: hard fail** (MarkAsSpamSpfRecordHardFail_)|Messages sent from an IP address that isn't specified in the SPF Sender Policy Framework (SPF) record in DNS for the source email domain are marked as high confidence spam. <br><br> Test mode isn't available for this setting.|`X-CustomSpam: SPF Record Fail`| The following **Mark as spam** ASF settings set the SCL of detected messages to 6, which corresponds to a **Spam** filter verdict and the corresponding action in anti-spam policies. |Anti-spam policy setting|Description|X-header added| ||||-|**Sender ID filtering hard fail** <p> *MarkAsSpamFromAddressAuthFail*|Messages that hard fail a conditional Sender ID check are marked as spam. <p> This setting combines an SPF check with a Sender ID check to help protect against message headers that contain forged senders. <p> Test mode isn't available for this setting.|`X-CustomSpam: SPF From Record Fail`| -|**Backscatter** <p> *MarkAsSpamNdrBackscatter*|*Backscatter* is useless non-delivery reports (also known as NDRs or bounce messages) caused by forged senders in email messages. For more information, see [Backscatter messages and EOP](anti-spam-backscatter-about.md). <p> You don't need to configure this setting in the following environments, because legitimate NDRs are delivered, and backscatter is marked as spam: <ul><li>Microsoft 365 organizations with Exchange Online mailboxes.</li><li>On-premises email organizations where you route *outbound* email through EOP.</li></ul> <p> In standalone EOP environments that protect inbound email to on-premises mailboxes, turning this setting on or off has the following result: <ul><li> **On**: Legitimate NDRs are delivered, and backscatter is marked as spam.</li><li>**Off**: Legitimate NDRs and backscatter go through normal spam filtering. Most legitimate NDRs will be delivered to the original message sender. Some, but not all, backscatter is marked as spam. By definition, backscatter can only be delivered to the spoofed sender, not to the original sender.</li></ul> <p> Test mode isn't available for this setting.|`X-CustomSpam: Backscatter NDR`| +|**Sender ID filtering hard fail** (MarkAsSpamFromAddressAuthFail_)|Messages that hard fail a conditional Sender ID check are marked as spam. <br><br> This setting combines an SPF check with a Sender ID check to help protect against message headers that contain forged senders. <br><br> Test mode isn't available for this setting.|`X-CustomSpam: SPF From Record Fail`| +|**Backscatter** (MarkAsSpamNdrBackscatter_)|_Backscatter_ is useless non-delivery reports (also known as NDRs or bounce messages) caused by forged senders in email messages. For more information, see [Backscatter messages and EOP](anti-spam-backscatter-about.md). <br><br> You don't need to configure this setting in the following environments, because legitimate NDRs are delivered and backscatter is marked as spam: <ul><li>Microsoft 365 organizations with Exchange Online mailboxes.</li><li>On-premises email organizations where you route _outbound_ email through EOP.</li></ul> <br><br> In standalone EOP environments that protect inbound email to on-premises mailboxes, turning this setting on or off has the following result: <ul><li> **On**: Legitimate NDRs are delivered, and backscatter is marked as spam.</li><li>**Off**: Legitimate NDRs and backscatter go through normal spam filtering. Most legitimate NDRs are delivered to the original message sender. Some, but not all backscatter is marked as spam. By definition, backscatter can be delivered only to the spoofed sender, not to the original sender.</li></ul> <br><br> Test mode isn't available for this setting.|`X-CustomSpam: Backscatter NDR`| |
| security | Anti Spam Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-policies-configure.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Configure anti-spam policies in EOP [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, inbound email messages are automatically protected against spam by EOP. EOP uses anti-spam policies (also known as spam filter policies or content filter policies) as part of your organization's overall defense against spam. For more information, see [Anti-spam protection](anti-spam-protection-about.md). The default anti-spam policy automatically applies to all recipients. For greater granularity, you can also create custom anti-spam policies that apply to specific users, groups, or domains in your organization. |
| security | Anti Spam Protection About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-protection-about.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Anti-spam protection in EOP [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-defender)- > [!NOTE] > This topic is intended for admins. For end-user topics, see [Overview of the Junk Email Filter](https://support.microsoft.com/office/5ae3ea8e-cf41-4fa0-b02a-3b96e21de089) and [Learn about junk email and phishing](https://support.microsoft.com/office/86c1d76f-4d5a-4967-9647-35665dc17c31). |
| security | Anti Spam Spam Confidence Level Scl About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-spam-confidence-level-scl-about.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Spam confidence level (SCL) in EOP -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, inbound messages go through spam filtering in EOP and are assigned a spam score. That score is mapped to an individual spam confidence level (SCL) value that's added to the message in an X-header. A higher SCL value indicates a message is more likely to be spam. EOP takes action on the message based on the SCL value. The following table describes what the SCL values mean and the default action that's taken on those messages. |
| security | Anti Spam Spam Vs Bulk About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-spam-vs-bulk-about.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # What's the difference between junk email and bulk email in EOP? -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, customers sometimes ask: "What's the difference between junk email and bulk email?" This article explains the difference and describes the controls that are available in EOP. - **Junk email** is spam, which is an unsolicited and universally unwanted message (when identified correctly). EOP rejects spam based on the reputation of the source email server. If a message passes source IP inspection, it continues through spam filtering. If the message is classified as **Spam** or **High confidence spam** by spam filtering, what happens to the message depends on the verdict and the anti-spam policy that detected the message: |
| security | Anti Spoofing Spoof Intelligence | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spoofing-spoof-intelligence.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Spoof intelligence insight in EOP [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, inbound email messages are automatically protected against spoofing. EOP uses **spoof intelligence** as part of your organization's overall defense against phishing. For more information, see [Anti-spoofing protection in EOP](anti-phishing-protection-spoofing-about.md). When a sender spoofs an email address, they appear to be a user in one of your organization's domains, or a user in an external domain that sends email to your organization. Attackers who spoof senders to send spam or phishing email need to be blocked. But there are scenarios where legitimate senders are spoofing. For example: When a sender spoofs an email address, they appear to be a user in one of your o - The sender is on a mailing list (also known as a discussion list), and the mailing list relays email from the original sender to all the participants on the mailing list. - An external company sends email on behalf of another company (for example, an automated report or a software-as-a-service company). -You can use the **spoof intelligence insight** in the Microsoft 365 Defender portal to quickly identify spoofed senders who are legitimately sending you unauthenticated email (messages from domains that don't pass SPF, DKIM, or DMARC checks), and manually allow those senders. +You can use the *spoof intelligence insight* in the Microsoft 365 Defender portal to quickly identify spoofed senders who are legitimately sending you unauthenticated email (messages from domains that don't pass SPF, DKIM, or DMARC checks), and manually allow those senders. By allowing known senders to send spoofed messages from known locations, you can reduce false positives (good email marked as bad). By monitoring the allowed spoofed senders, you provide an additional layer of security to prevent unsafe messages from arriving in your organization. -Likewise, you can review spoofed senders that were allowed by spoof intelligence and manually block those senders from the spoof intelligence insight. +Likewise, you can use the spoof intelligence insight to review spoofed senders that were allowed by spoof intelligence and manually block those senders. The rest of this article explains how to use the spoof intelligence insight in the Microsoft 365 Defender portal and in PowerShell (Exchange Online PowerShell for Microsoft 365 organizations with mailboxes in Exchange Online; standalone EOP PowerShell for organizations without Exchange Online mailboxes). > [!NOTE] >-> - Only spoofed senders that were detected by spoof intelligence appear in the spoof intelligence insight. When you override the allow or block verdict in the insight, the spoofed sender becomes a manual allow or block entry that appears only on the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. You can also manually create allow or block entries for spoofed senders before they're detected by spoof intelligence. For more information, see [Manage the Tenant Allow/Block List in EOP](tenant-allow-block-list-about.md). +> - Only spoofed senders that were detected by spoof intelligence appear in the spoof intelligence insight. When you override the allow or block verdict in the insight, the spoofed sender becomes a manual allow or block entry that appears only on the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. You can also manually create allow or block entries for spoofed senders before they're detected by spoof intelligence. For more information, see [Spoofed senders in the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#spoofed-senders-in-the-tenant-allowblock-list). > > - The spoof intelligence insight and the **Spoofed senders** tab in the Tenant Allow/Block list replace the functionality of the spoof intelligence policy that was available on the anti-spam policy page in the Security & Compliance Center. > The rest of this article explains how to use the spoof intelligence insight in t - For our recommended settings for spoof intelligence, see [EOP anti-phishing policy settings](recommended-settings-for-eop-and-office365.md#eop-anti-phishing-policy-settings). -## Open the spoof intelligence insight in the Microsoft 365 Defender portal +## Find the spoof intelligence insight in the Microsoft 365 Defender portal ++1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Tenant Allow/Block Lists** in the **Rules** section. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>. -1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Tenant Allow/Block Lists** in the **Rules** section. To go directly to the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. +2. Select the **Spoofed senders** tab. -2. On the **Tenant Allow/Block Lists** page, the spoof intelligence insight looks like this: +3. On the **Spoofed senders** tab, the spoof intelligence insight looks like this: :::image type="content" source="../../media/m365-sc-spoof-intelligence-insight.png" alt-text="The Spoof intelligence insight on the Anti-phishing policy page" lightbox="../../media/m365-sc-spoof-intelligence-insight.png"::: The insight has two modes: - **Insight mode**: If spoof intelligence is enabled, the insight shows you how many messages were detected by spoof intelligence during the past seven days.- - **What if mode**: If spoof intelligence is disabled, then the insight shows you how many messages *would* have been detected by spoof intelligence during the past seven days. + - **What if mode**: If spoof intelligence is disabled, then the insight shows you how many messages *would have been* detected by spoof intelligence during the past seven days. -To view information about the spoof intelligence detections, click **View spoofing activity** in the spoof intelligence insight. +To view information about the spoof intelligence detections, select **View spoofing activity** in the spoof intelligence insight to go to the **Spoof intelligence insight** page. -### View information about spoofed messages +### View information about spoof detections > [!NOTE]-> Remember, only spoofed senders that were detected by spoof intelligence appear on this page. When you override the allow or block verdict in the insight, the spoofed sender becomes a manual allow or block entry that appears only on the **Spoofed senders** on the **Tenant Allow/Block Lists** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. +> Remember, only spoofed senders that were detected by spoof intelligence appear on this page. -On the **Spoof intelligence insight** page that appears after you click **View spoofing activity** in the spoof intelligence insight, the page contains the following information: +The **Spoof intelligence insight** page at <https://security.microsoft.com/spoofintelligence> is available when you select **View spoofing activity** from the spoof intelligence insight on the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page. ++On the **Spoof intelligence insight** page, you can sort the entries by clicking on an available column header. The following columns are available: - **Spoofed user**: The **domain** of the spoofed user that's displayed in the **From** box in email clients. The From address is also known as the `5322.From` address.-- **Sending infrastructure**: Also known as the _infrastructure_. The sending infrastructure will be one of the following values:+- **Sending infrastructure**: Also known as the _infrastructure_. The sending infrastructure is one of the following values: - The domain found in a reverse DNS lookup (PTR record) of the source email server's IP address. - If the source IP address has no PTR record, then the sending infrastructure is identified as \<source IP\>/24 (for example, 192.168.100.100/24). - A verified DKIM domain.-- **Message count**: The number of messages from the combination of the spoofed domain _and_ the sending infrastructure to your organization within the last 7 days.+- **Message count**: The number of messages from the combination of the spoofed domain _and_ the sending infrastructure to your organization within the last seven days. - **Last seen**: The last date when a message was received from the sending infrastructure that contains the spoofed domain. - **Spoof type**: One of the following values: - **Internal**: The spoofed sender is in a domain that belongs to your organization (an [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains)). On the **Spoof intelligence insight** page that appears after you click **View s - **Allowed**: The domain failed explicit email authentication checks [SPF](email-authentication-anti-spoofing.md), [DKIM](email-authentication-dkim-configure.md), and [DMARC](email-authentication-dmarc-configure.md). However, the domain passed our implicit email authentication checks ([composite authentication](email-authentication-about.md#composite-authentication)). As a result, no anti-spoofing action was taken on the message. - **Blocked**: Messages from the combination of the spoofed domain _and_ sending infrastructure are marked as bad by spoof intelligence. The action that's taken on the spoofed messages is controlled by the default anti-phishing policy or custom anti-phishing policies (the default value is **Move message to Junk Email folder**). For more information, see [Configure anti-phishing policies in Microsoft Defender for Office 365](anti-phishing-policies-mdo-configure.md). -You can click selected column headings to sort the results. +To change the list of spoofed senders from normal to compact spacing, select :::image type="icon" source="../../media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="../../media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**. -To filter the results, you have the following options: +To filter the entries, select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**. The following filters are available in the **Filter** flyout that opens: -- Click the **Filter** button. In the **Filter** flyout that appears, you can filter the results by:- - **Spoof type** - - **Action** -- Use the **Search** box to enter a comma-separated list of spoofed domain values or sending infrastructure values to filter the results.+- **Spoof type**: The available values are **Internal** and **External**. +- **Action**: The available values are **Allow** and **Block** -### View details about spoofed messages +When you're finished in the **Filter** flyout, select **Apply**. To clear the filters, select :::image type="icon" source="../../media/m365-cc-sc-clear-filters-icon.png" border="false"::: **Clear filters**. -When you select an entry from the list, a details flyout appears that contains the following information and features: +Use the :::image type="icon" source="../../media/m365-cc-sc-search-icon.png" border="false"::: **Search** box and a corresponding value to find specific entries. -- **Allow to spoof** or **Block from spoofing**: Select one of these values to override the original spoof intelligence verdict and move the entry from the spoof intelligence insight to the Tenant Allow/Block List as an allow or block entry for spoof.-- Why we caught this.-- What you need to do.-- A domain summary that includes most of the same information from the main spoof intelligence page.-- WhoIs data about the sender.-- A link to open [Threat Explorer](threat-explorer-about.md) to see additional details about the sender under **View** \> **Phish** in Microsoft Defender for Office 365.-- Similar messages we have seen in your tenant from the same sender.+Use :::image type="icon" source="../../media/m365-cc-sc-download-icon.png" border="false"::: **Export** to export the list of spoof detections to a CSV file. -### About allowed spoofed senders +### View details about spoof detections ++When you select a spoof detection from the list by clicking anywhere in the row other than the check box next to the first column, a details flyout opens that contains the following information: ++- **Why did we catch this?** section: Why we detected this sender as spoof, and what you can do for further information. +- **Domain summary** section: Includes the same information from the main **Spoof intelligence insight** page. +- **WhoIs data** section: Technical information about the sender's domain. +- **Explorer investigation** section: In Defender for Office 365 organization, this section contains a link to open [Threat Explorer](threat-explorer-about.md) to see additional details about the sender on the **Phish** tab. +- **Similar Emails** section: Contains the following information about the spoof detection: + - **Date** + - **Subject** + - **Recipient** + - **Sender** + - **Sender IP** ++ Select **Customize columns** to remove the columns that are shown. When you're finished, select **Apply**. ++> [!TIP] +> To see details about other entries without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. -An allowed spoofed sender in the spoof intelligence insight or a blocked spoofed sender that you manually changed to **Allow to spoof** only allows messages from the combination of the spoofed domain _and_ the sending infrastructure. It does not allow email from the spoofed domain from any source, nor does it allow email from the sending infrastructure for any domain. +To change the spoof detection from **Allow** to **Block** or vice-versa, see the next section. ++### Override the spoof intelligence verdict ++On the **Spoof intelligence insight** page at <https://security.microsoft.com/spoofintelligence>, use either of the following methods to override the spoof intelligence verdict: ++- Select one or more entries from the list by selecting the check box next to the first column. + 1. Select the :::image type="icon" source="../../media/m365-cc-sc-bulk-actions-icon.png" border="false"::: **Bulk actions** action that appears. + 2. In the **Bulk actions** flyout that opens, select **Allow to spoof** or **Block from spoofing**, and then select **Apply**. ++- Select the entry from the list by clicking anywhere in the row other than the check box. ++ In the details flyout that opens, select **Allow to spoof** or **Block from spoofing** at the top of the flyout, and then select **Apply**. ++Back on the **Spoof intelligence insight** page, the entry is removed from the list, and is added to the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>. ++### About allowed spoofed senders -For example, the following spoofed sender is allowed to spoof: +Messages from an allowed spoofed sender (automatically detected or manually configured) are allowed only using the combination of the spoofed domain *and* the sending infrastructure. For example, the following spoofed sender is allowed to spoof: - **Domain**: gmail.com - **Infrastructure**: tms.mx.com -Only email from that domain/sending infrastructure pair will be allowed to spoof. Other senders attempting to spoof gmail.com aren't automatically allowed. Messages from senders in other domains that originate from tms.mx.com are still checked by spoof intelligence, and might be blocked. +Only email from that domain/sending infrastructure pair is allowed to spoof. Other senders attempting to spoof gmail.com aren't automatically allowed. Messages from senders in other domains that originate from tms.mx.com are still checked by spoof intelligence, and might be blocked. ## Use the spoof intelligence insight in Exchange Online PowerShell or standalone EOP PowerShell -In PowerShell, you use the **Get-SpoofIntelligenceInsight** cmdlet to **view** allowed and blocked spoofed senders that were detected by spoof intelligence. To manually allow or block the spoofed senders, you need to use the **New-TenantAllowBlockListSpoofItems** cmdlet. For more information, see [Use PowerShell to manage spoofed sender entries to the Tenant Allow/Block List](tenant-allow-block-list-about.md). +In PowerShell, you use the **Get-SpoofIntelligenceInsight** cmdlet to *view* allowed and blocked spoofed senders that were detected by spoof intelligence. To manually allow or block the spoofed senders, you need to use the **New-TenantAllowBlockListSpoofItems** cmdlet. For more information, see [Use PowerShell to create allow entries for spoofed senders in the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#use-powershell-to-create-allow-entries-for-spoofed-senders-in-the-tenant-allowblock-list) and [Use PowerShell to create block entries for spoofed senders in the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#use-powershell-to-create-block-entries-for-spoofed-senders-in-the-tenant-allowblock-list). To view the information in the spoof intelligence insight, run the following command: For detailed syntax and parameter information, see [Get-SpoofIntelligenceInsight Be diligent about spoofing and phishing protection. Here are related ways to check on senders who are spoofing your domain and help prevent them from damaging your organization: -- Check the **Spoof Mail Report**. You can use this report often to view and help manage spoofed senders. For information, see [Spoof Detections report](reports-email-security.md#spoof-detections-report).+- Check the **Spoof Mail Report**. Use this report often to view and help manage spoofed senders. For information, see [Spoof Detections report](reports-email-security.md#spoof-detections-report). -- Review your Sender Policy Framework (SPF) configuration. For a quick introduction to SPF and to get it configured quickly, see [Set up SPF in Microsoft 365 to help prevent spoofing](email-authentication-spf-configure.md). For a more in-depth understanding of how Office 365 uses SPF, or for troubleshooting or non-standard deployments such as hybrid deployments, start with [How Office 365 uses Sender Policy Framework (SPF) to prevent spoofing](email-authentication-anti-spoofing.md).+- Review your Sender Policy Framework (SPF) configuration. For a quick introduction to SPF and to get it configured quickly, see [Set up SPF in Microsoft 365 to help prevent spoofing](email-authentication-spf-configure.md). For a more in-depth understanding of how Microsoft 365 uses SPF, or for troubleshooting or non-standard deployments such as hybrid deployments, start with [How Microsoft 365 uses Sender Policy Framework (SPF) to prevent spoofing](email-authentication-anti-spoofing.md). - Review your DomainKeys Identified Mail (DKIM) configuration. You should use DKIM in addition to SPF and DMARC to help prevent attackers from sending messages that look like they are coming from your domain. DKIM lets you add a digital signature to email messages in the message header. For information, see [Use DKIM to validate outbound email sent from your custom domain in Office 365](email-authentication-dkim-configure.md). |
| security | Configure Junk Email Settings On Exo Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-junk-email-settings-on-exo-mailboxes.md | The safelist collection on a mailbox includes the Safe Senders list, the Safe Re - **Move messages to Junk Email folder**: Domain entries and sender email address entries are honored. Messages from those senders are not moved to the Junk Email folder. - **Quarantine**: Domain entries are not honored (messages from those senders are quarantined). Email address entries are honored (messages from those senders are not quarantined) if either of the following statements are true: - The message is not identified as malware or high confidence phishing (malware and high confidence phishing messages are quarantined).- - The email address is not also in a block entry in the [Tenant Allow/Block List](manage-tenant-allow-block-list.md) (messages from those senders will be quarantined). + - The email address is not also in a block entry in the [Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-domains-and-email-addresses). - In standalone EOP with directory synchronization, domain entries aren't synchronized by default, but you can enable synchronization for domains. For more information, see [Configure Content Filtering to Use Safe Domain Data: Exchange 2013 Help | Microsoft Learn](/exchange/configure-content-filtering-to-use-safe-domain-data-exchange-2013-help). - You can't directly modify the Safe Recipients list by using the **Set-MailboxJunkEmailConfiguration** cmdlet (the _TrustedRecipientsAndDomains_ parameter doesn't work). You modify the Safe Senders list, and those changes are synchronized to the Safe Recipients list. |
| security | Connectors Mail Flow Intelligence | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/connectors-mail-flow-intelligence.md | Last updated 12/01/2022 - [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) - [Microsoft 365 Defender](../defender/microsoft-365-defender.md) -In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, you typically use a connector to route email messages from EOP to your on-premises email environment. You might also use a connector to route messages from Microsoft 365 to a partner organization. When Microsoft 365 can't deliver these messages via the connector, they're queued in Microsoft 365. Microsoft 365 will continue to retry delivery for each message for 24 hours. After 24 hours, the queued message will expire, and the message will be returned to the original sender in a non-delivery report (also known as an NDR or bounce message). +In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, you typically use a connector to route email messages from EOP to your on-premises email environment. You might also use a connector to route messages from Microsoft 365 to a partner organization. When Microsoft 365 can't deliver these messages via the connector, they're queued in Microsoft 365. Microsoft 365 continues to retry delivery for each message for 24 hours. After 24 hours, the queued message expires, and the message is returned to the original sender in a non-delivery report (also known as an NDR or bounce message). Microsoft 365 generates an error when a message can't be delivered by using a connector. The most common errors and their solutions are described in this article. Collectively, queuing and notification errors for undeliverable messages sent via connectors is known as _mail flow intelligence_. ## Error code: 450 4.4.312 DNS query failed -Typically, this error means Microsoft 365 tried to connect to the smart host that's specified in the connector, but the DNS query to find the smart host's IP addresses failed. The possible causes for this error are: +Microsoft 365 tried to connect to the smart host that's specified in the connector, but the DNS query to find the smart host's IP addresses failed. The possible causes for this error are: - There's an issue with your domain's DNS hosting service (the party that maintains the authoritative name servers for your domain).- - Your domain has recently expired, so the MX record can't be retrieved.- - Your domain's MX record has recently changed, and the DNS servers still have previously cached DNS information for your domain. ### How do I fix error code 450 4.4.312? - Work with your DNS hosting service to identify and fix the problem with your domain.--- If the error is from your partner organization (for example, a 3rd party cloud service provider), contact your partner to fix the issue.+- If the error is from a partner organization (for example, a third party cloud service provider), contact the partner to fix the issue. ## Error code: 450 4.4.315 Connection timed out -Typically, this means Microsoft 365 can't connect to the destination email server. The error details will explain the problem. For example: +Microsoft 365 can't connect to the destination email server. The error details explain the problem. For example: - Your on-premises email server is down.- - There's an error in the connector's smart host settings, so Microsoft 365 is trying to connect to the wrong IP address. ### How do I fix error code 450 4.4.315? -- Find out which scenario applies to you, and make the necessary corrections. For example, if mail flow has been working correctly, and you haven't changed the connector settings, you need to check your on-premises email environment to see if the server is down, or if there have been any changes to your network infrastructure (for example, you've changed internet service providers, so you now have different IP addresses).--- If the error is from your partner organization (for example, a 3rd party cloud service provider), contact your partner to fix the issue.+- Find out which scenario applies to you, and make the necessary corrections. For example, if mail flow is working correctly, and you haven't changed the connector settings, check your on-premises email environment to see if the server is down, or if there were changes to your network infrastructure (for example, you changed internet service providers, so you now have different IP addresses). +- If the error is from a partner organization (for example, a third party cloud service provider), contact the partner to fix the issue. ## Error code: 450 4.4.316 Connection refused -Typically, this error means Microsoft 365 encountered a connection error when it tried to connect to the destination email server. A likely cause for this error is your firewall is blocking connections from Microsoft 365 IP addresses. Or, this error might be by design if you've completely migrated your on-premises email system to Microsoft 365 and shut down your on-premises email environment. +Microsoft 365 encountered a connection error when it tried to connect to the destination email server. A likely cause for this error is your firewall is blocking connections from Microsoft 365 IP addresses. Or, this error might be by design if you've migrated your on-premises email system to Microsoft 365 and shut down your on-premises email environment. ### How do I fix error code 450 4.4.316? -- If you have mailboxes in your on-premises environment, you need to modify your firewall settings to allow connections from Microsoft 365 IP addresses on TCP port 25 to your on-premises email servers. For a list of the Microsoft 365 IP addresses, see [Microsoft 365 URLs and IP address ranges](../../enterprise/urls-and-ip-address-ranges.md).+- If you have mailboxes in your on-premises environment, modify your firewall settings to allow connections from Microsoft 365 IP addresses on TCP port 25 to your on-premises email servers. For a list of the Microsoft 365 IP addresses, see [Microsoft 365 URLs and IP address ranges](../../enterprise/urls-and-ip-address-ranges.md). ++- If no more messages should be delivered to your on-premises environment, select **Fix now** in the alert so Microsoft 365 can immediately reject the messages with invalid recipients. This action reduces the risk of exceeding your organization's quota for invalid recipients, which could impact normal message delivery. Or, use the following instructions to manually fix the issue: ++ - Disable or delete the connector that delivers email from Microsoft 365 to your on-premises email environment: -- If no more messages should be delivered to your on-premises environment, click **Fix now** in the alert so Microsoft 365 can immediately reject the messages with invalid recipients. This will reduce the risk of exceeding your organization's quota for invalid recipients, which could impact normal message delivery. Or, you can use the following instructions to manually fix the issue:+ 1. In the EAC at <https://admin.exchange.microsoft.com>, go to **Mail flow** \> **Connectors**. Or, to go directly to the **Connectors** page, use <https://admin.exchange.microsoft.com/#/connectors>. - - In the Exchange admin center, disable or delete the connector that delivers email from Microsoft 365 to your on-premises email environment: + 2. On the **Connectors** page, delete or disable the connector with the **From** value **Office 365** and the **To** value **Your organization's email server** by doing one of the following steps: - 1. In the EAC at <https://admin.exchange.microsoft.com>, go to **Mail flow** \> **Connectors**. To go directly to the **Connectors** page, use <https://admin.exchange.microsoft.com/#/connectors>. + - Select the connector from the list by selecting the round check box that appears next to the **Status** column. + 1. Select the :::image type="icon" source="../../media/m365-cc-sc-delete-icon.png" border="false"::: **Delete** action that appears. + 2. In the confirmation flyout that opens, select **Confirm**. - 2. Select the connector with the **From** value **Office 365** and the **To** value **Your organization's email server** and do one of the following steps: - - Delete the connector by clicking **Delete**  - - Disable the connector by clicking **Edit**  and clearing **Turn it on**. + - Select the connector from the list by clicking anywhere in the row other than the round check box that appears next to the **Status** column. In the connector details flyout that opens, do either of the following actions: + - Delete the connector by selecting :::image type="icon" source="../../media/m365-cc-sc-delete-icon.png" border="false"::: **Delete** at the top of the flyout, and then select **Confirm** in the confirmation flyout that opens. + - Disable the connector by selecting :::image type="icon" source="../../media/m365-cc-sc-disable-icon.png" border="false"::: **Disable** at the top of the flyout, and then select **Confirm** in the confirmation flyout that opens. - - Change the accepted domain in Microsoft 365 that's associated with your on-premises email environment from **Internal Relay** to **Authoritative**. For instructions, see [Manage accepted domains in Exchange Online](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains). + - In Microsoft 365, change the accepted domain that's associated with your on-premises email environment from **Internal Relay** to **Authoritative**. For instructions, see [Manage accepted domains in Exchange Online](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains). - **Note**: Typically, these changes take between 30 minutes and one hour to take effect. After one hour, verify that you no longer receive the error. +- If the error is from a partner organization (for example, a third party cloud service provider), contact the partner to fix the issue. -- If the error is from your partner organization (for example, a 3rd party cloud service provider), you need to contact your partner to fix the issue.+> [!NOTE] +> Typically, these changes take between 30 minutes and one hour to take effect. After one hour, verify that you no longer receive the error. ## Error code: 450 4.4.317 Cannot connect to remote server -Typically, this error means Microsoft 365 connected to the destination email server, but the server responded with an immediate error, or doesn't meet the connection requirements. The error details will explain the problem. For example: +Microsoft 365 connected to the destination email server, but the server responded with an immediate error or doesn't meet the connection requirements. The error details explain the problem. For example: - The destination email server responded with a "Service not available" error, which indicates the server is unable to maintain communication with Microsoft 365. - The connector is configured to require TLS, but the destination email server doesn't support TLS. ### How do I fix error code 450 4.4.317? -- Verify the TLS settings and certificates on your on-premises email servers, and the TLS settings on the connector.-- If the error is from your partner organization (for example, a 3rd party cloud service provider), you need to contact your partner to fix the issue.+- Verify the TLS settings and certificates on your on-premises email servers and the TLS settings on the connector. +- If the error is from a partner organization (for example, a third party cloud service provider), contact the partner to fix the issue. ## Error code: 450 4.4.318 Connection was closed abruptly -Typically, this error means Microsoft 365 is having difficulty communicating with your on-premises email environment, so the connection was dropped. The possible causes for this error are: +Microsoft 365 is having difficulty communicating with your on-premises email environment, so the connection was dropped. Possible causes for this error are: - Your firewall uses SMTP packet examination rules, and those rules aren't working correctly. - Your on-premises email server isn't working correctly (for example, service hangs, crashes, or low system resources), which is causing the server to time out and close the connection to Microsoft 365. Typically, this error means Microsoft 365 is having difficulty communicating wit - Find out which scenario applies to you, and make the necessary corrections. - If the problem is caused by network issues between your on-premises environment and Microsoft 365, contact your network team to troubleshoot the issue.-- If the error is from your partner organization (for example, a 3rd party cloud service provider), you need to contact your partner to fix the issue.+- If the error is from a partner organization (for example, a third party cloud service provider), contact the partner to fix the issue. ## Error code: 450 4.7.320 Certificate validation failed -Typically, this error means Microsoft 365 encountered an error while trying to validate the certificate of the destination email server. The error details will explain the error. For example: +Microsoft 365 encountered an error while trying to validate the certificate of the destination email server. The error details explain the error. For example: -- Certificate expired-- Certificate subject mismatch-- Certificate is no longer valid+- Certificate expired. +- Certificate subject mismatch. +- Certificate is no longer valid. ### How do I fix error code 450 4.7.320? - Fix the certificate or the settings on the connector so that queued messages in Microsoft 365 can be delivered.-- If the error is from your partner organization (for example, a 3rd party cloud service provider), you need to contact your partner to fix the issue.+- If the error is from a partner organization (for example, a third party cloud service provider), contact the partner to fix the issue. ## Other error codes Microsoft 365 is having difficulty delivering messages to your on-premises or partner email server. Use the **Destination server** information in the error to examine the issue in your environment, or modify the connector if there's a configuration error. -If the error is from your partner organization (for example, a 3rd party cloud service provider), you need to contact your partner to fix the issue. +If the error is from a partner organization (for example, a third party cloud service provider), contact the partner to fix the issue. |
| security | Create Block Sender Lists In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/create-block-sender-lists-in-office-365.md | Blocked sender lists and blocked domain lists in anti-spam policies in EOP inspe ## Use block entries in the Tenant Allow/Block List -Our number one recommended option for blocking mail from specific senders or domains is the Tenant Allow/Block List. For instructions, see [Allow or block email using the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md). +Our number one recommended option for blocking mail from specific senders or domains is the Tenant Allow/Block List. For instructions, see [Create block entries for domains and email addresses](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-domains-and-email-addresses) and [Create block entries for spoofed senders](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-spoofed-senders). Email messages from these senders are marked as _high confidence spam_ (SCL = 9). What happens to the messages is determined by the [anti-spam policy](anti-spam-policies-configure.md) that detected the message for the recipient. In the default anti-spam policy and new custom policies, messages that are marked as high confidence spam are delivered to the Junk Email folder by default. In Standard and Strict [preset security policies](preset-security-policies.md), high confidence spam messages are quarantined. |
| security | Create Safe Sender Lists In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365.md | The rest of this article contains specifics about each method. ## Use allow entries in the Tenant Allow/Block List -Our number one recommended option for allowing mail from senders or domains is the Tenant Allow/Block List. For instructions, see [Allow or block email using the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md). +Our number one recommended option for allowing mail from senders or domains is the Tenant Allow/Block List. For instructions, see [Create allow entries for domains and email addresses](tenant-allow-block-list-email-spoof-configure.md#create-allow-entries-for-domains-and-email-addresses) and [Create allow entries for spoofed senders](tenant-allow-block-list-email-spoof-configure.md#create-allow-entries-for-spoofed-senders). Only if you can't use the Tenant Allow/Block List for some reason should you consider using a different method to allow senders. When messages skip spam filtering due to entries in a user's Safe Senders list, - **Move messages to Junk Email folder**: Domain entries and sender email address entries are honored. Messages from those senders aren't moved to the Junk Email folder. - **Quarantine**: Domain entries aren't honored (messages from those senders are quarantined). Email address entries are honored (messages from those senders aren't quarantined) if either of the following statements are true: - The message isn't identified as malware or high confidence phishing (malware and high confidence phishing messages are quarantined).- - The email address isn't also in a block entry in the [Tenant Allow/Block List](tenant-allow-block-list-about.md) (messages from those senders will be quarantined). + - The email address isn't also in a block entry in the [Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-domains-and-email-addresses). - Entries for blocked senders and blocked domains are honored (messages from those senders are moved to the Junk Email folder). Safe mailing list settings are ignored. ## Use the IP Allow List |
| security | Email Authentication About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-authentication-about.md | Once you've gotten started with an SPF fallback policy of `?all`, you can gradua ### Configure permitted senders of unauthenticated email -You can also use the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md) and the [Tenant Allow/Block List](tenant-allow-block-list-about.md) to permit senders to transmit unauthenticated messages to your organization. +You can also use the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md#override-the-spoof-intelligence-verdict) and the [Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#create-allow-entries-for-spoofed-senders) to permit senders to transmit unauthenticated messages to your organization. For external domains, the spoofed user is the domain in the From address, while the sending infrastructure is one of the following values: |
| security | Email Authentication Dmarc Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-authentication-dmarc-configure.md | Microsoft 365 is configured like this because some legitimate email may fail DMA - Users add safe senders individually by using their email client. -- Admins can use the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md) or the [Tenant Allow/Block List](tenant-allow-block-list-about.md) to allow messages from the spoofed sender.+- Admins can use the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md#override-the-spoof-intelligence-verdict) or the [Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#create-allow-entries-for-spoofed-senders) to allow messages from the spoofed sender. - Admins create an Exchange mail flow rule (also known as a transport rule) for all users that allows messages for those particular senders. |
| security | Microsoft Defender For Office 365 Product Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview.md | description: Security in Office 365, from EOP to Defender for Office 365 Plans 1 adobe-target: true Previously updated : 1/31/2023 Last updated : 06/09/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> # Microsoft Defender for Office 365 security product overview [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)- This article will introduce you to your new Microsoft Defender for Office 365 security properties in the Cloud. Whether you're part of a Security Operations Center, you're a Security Administrator new to the space, or you want a refresher, let's get started. > [!CAUTION] |
| security | Migrate To Defender For Office 365 Onboard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365-onboard.md | As you find and fix issues, you can add more users to the pilot groups (and corr - Filter in Threat Explorer to identify the messages. - Filter in Advanced Hunting to identify the messages. - Report any false positives to Microsoft as early as possible through admin submissions, use the [Tenant Allow/Block List](tenant-allow-block-list-about.md) feature to configure safe overrides for those false positives. + Report any false positives to Microsoft as early as possible through [admin submissions](submissions-admin.md), and use the [Tenant Allow/Block List](tenant-allow-block-list-about.md) feature to configure safe overrides for those false positives. - It's also a good idea to examine unnecessary overrides. In other words, look at the verdicts that Microsoft 365 would have provided on the messages. If Microsoft 365 rendered the correct verdict, then the need for override is greatly diminished or eliminated. |
| security | Quarantine About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-about.md | How long quarantined messages or files are held in quarantine before they expire |||::|| |Messages quarantined by anti-spam policies: spam, high confidence spam, phishing, high confidence phishing, or bulk.|15 days: <ul><li>In the default anti-spam policy.</li><li>In anti-spam policies that you create in PowerShell.</li></ul> <br/> 30 days in anti-spam policies that you create in the Microsoft 365 Defender portal.|Yes|You can configure (lower) this value in anti-spam policies. For more information, see the **Retain spam in quarantine for this many days** (_QuarantineRetentionPeriod_) setting in [Configure anti-spam policies](anti-spam-policies-configure.md).| |Messages quarantined by anti-phishing policies: spoof intelligence in EOP; user impersonation, domain impersonation, or mailbox intelligence in Defender for Office 365.|30 days|Yes|This retention period is also controlled by the **Retain spam in quarantine for this many days** (_QuarantineRetentionPeriod_) setting in **anti-spam** policies. The retention period that's used is the value from the first matching **anti-spam** policy that the recipient is defined in.|-|Messages quarantined by anti-malware policies (malware messages).|30 days|No|If you turn on common attachments filtering in anti-malware policies (in the default policy or in custom policies), file attachments in email messages to the affected recipients are treated as malware based solely on the file extension. A predefined list of mostly executable file types is used by default, but you can customize the list. For more information, see [Anti-malware policies](anti-malware-protection-about.md#anti-malware-policies).| +|Messages quarantined by anti-malware policies (malware messages).|30 days|No|If you turn on the *common attachments filter* in anti-malware policies (in the default policy or in custom policies), file attachments in email messages to the affected recipients are treated as malware based solely on the file extension. A predefined list of mostly executable file types is used by default, but you can customize the list. For more information, see [Common attachments filter in anti-malware policies](anti-malware-protection-about.md#common-attachments-filter-in-anti-malware-policies).| |Messages quarantined by Safe Attachments policies in Defender for Office 365 (malware messages).|30 days|No|| |Messages quarantined by mail flow rules: the action is **Deliver the message to the hosted quarantine** (_Quarantine_).|30 days|No|| |Files quarantined by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams (malware files).|30 days|No|Files quarantined in SharePoint or OneDrive are removed fom quarantine after 30 days, but the blocked files remain in SharePoint or OneDrive in the blocked state.| |
| security | Quarantine Admin Manage Messages Files | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-admin-manage-messages-files.md | Watch this short video to learn how to manage quarantined messages as an admin. - _Submit messages from quarantine to Microsoft_: Membership in the **Security Administrator** role group. - _Read-only access to quarantined messages for all users_: Membership in the **Global Reader**, **Security Reader**, or **View-Only Organization Management** role groups. - [Email & collaboration RBAC in the Microsoft 365 Defender portal](mdo-portal-permissions.md): Membership in the **Quarantine Administrator** role group. To do quarantine procedures in Exchange Online PowerShell, you also need membership in the **Hygiene Management** role group in Exchange Online RBAC.- - [Azure AD RBAC](../../admin/add-users/about-admin-roles.md): Membership in the **Global Administrator**, **Security Administrator**, **Global Reader**, or **Security Reader** roles gives users the required permissions _and_ permissions for other features in Microsoft 365. + - [Azure AD RBAC](../../admin/add-users/about-admin-roles.md): Membership these roles gives users the required permissions _and_ permissions for other features in Microsoft 365: + - _Take action on quarantined messages for all users_: Membership in the **Global Administrator** or **Security Administrator** roles. + - _Submit messages from quarantine to Microsoft_: Membership in the **Security Administrator** role. + - _Read-only access to quarantined messages for all users_: Membership in the **Global Reader** or **Security Reader** roles. - Quarantined messages and files are retained for a default period of time based on why they were quarantined. After the retention period expires, the messages are automatically deleted and aren't recoverable. For more information, see [Quarantined email messages in EOP and Defender for Office 365](quarantine-about.md). |
| security | Recommended Settings For Eop And Office365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365.md | Last updated 5/3/2023 - [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) - [Microsoft 365 Defender](../defender/microsoft-365-defender.md) -**Exchange Online Protection (EOP)** is the core of security for Microsoft 365 subscriptions and helps keep malicious emails from reaching your employee's inboxes. But with new, more sophisticated attacks emerging every day, improved protections are often required. **Microsoft Defender for Office 365** Plan 1 or Plan 2 contain additional features that give admins more layers of security, control, and investigation. +**Exchange Online Protection (EOP)** is the core of security for Microsoft 365 subscriptions and helps keep malicious emails from reaching your employee's inboxes. But with new, more sophisticated attacks emerging every day, improved protections are often required. **Microsoft Defender for Office 365** Plan 1 or Plan 2 contain additional features that give more layers of security, control, and investigation. -Although we empower security administrators to customize their security settings, there are two security levels in EOP and Microsoft Defender for Office 365 that we recommend: **Standard** and **Strict**. Although customer environments and needs are different, these levels of filtering will help prevent unwanted mail from reaching your employees' Inbox in most situations. +Although we empower security administrators to customize their security settings, there are two security levels in EOP and Microsoft Defender for Office 365 that we recommend: **Standard** and **Strict**. Although customer environments and needs are different, these levels of filtering help prevent unwanted mail from reaching your employees' Inbox in most situations. To automatically apply the Standard or Strict settings to users, see [Preset security policies in EOP and Microsoft Defender for Office 365](preset-security-policies.md). This article describes the default settings, and also the recommended Standard and Strict settings to help protect your users. The tables contain the settings in the Microsoft 365 Defender portal and PowerShell (Exchange Online PowerShell or standalone Exchange Online Protection PowerShell for organizations without Exchange Online mailboxes). > [!NOTE]-> The Office 365 Advanced Threat Protection Recommended Configuration Analyzer (ORCA) module for PowerShell can help you (admins) find the current values of these settings. Specifically, the **Get-ORCAReport** cmdlet generates an assessment of anti-spam, anti-phishing, and other message hygiene settings. You can download the ORCA module at <https://www.powershellgallery.com/packages/ORCA/>. +> The Office 365 Advanced Threat Protection Recommended Configuration Analyzer (ORCA) module for PowerShell can help admins find the current values of these settings. Specifically, the **Get-ORCAReport** cmdlet generates an assessment of anti-spam, anti-phishing, and other message hygiene settings. You can download the ORCA module at <https://www.powershellgallery.com/packages/ORCA/>. > > In Microsoft 365 organizations, we recommend that you leave the Junk Email Filter in Outlook set to **No automatic filtering** to prevent unnecessary conflicts (both positive and negative) with the spam filtering verdicts from EOP. For more information, see the following articles: > This article describes the default settings, and also the recommended Standard a Anti-spam, anti-malware, and anti-phishing are EOP features that can be configured by admins. We recommend the following Standard or Strict configurations. +### EOP anti-malware policy settings ++To create and configure anti-malware policies, see [Configure anti-malware policies in EOP](anti-malware-policies-configure.md). ++Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. For more information, see [Anatomy of a quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy). ++The policy named AdminOnlyAccessPolicy enforces the historical capabilities for messages that were quarantined as malware as described in the table [here](quarantine-end-user.md). ++Users can't release their own messages that were quarantined as malware, regardless of how the quarantine policy is configured. If the policy allows users to release their own quarantined messages, users are instead allowed to _request_ the release of their quarantined malware messages. ++|Security feature name|Default|Standard|Strict|Comment| +||::|::|::|| +|**Protection settings**||||| +|**Enable the common attachments filter** (_EnableFileFilter_)|Selected (`$true`)<sup>\*</sup>|Selected (`$true`)|Selected (`$true`)|For the list of file types in the common attachments filter, see [Common attachments filter in anti-malware policies](anti-malware-protection-about.md#common-attachments-filter-in-anti-malware-policies). <br><br> <sup>\*</sup> The common attachments filter is on by default in new anti-malware policies that you create in the Defender portal. The common attachments filter is off by default in the default anti-malware policy and in new policies that you create in PowerShell.| +|Common attachment filter notifications: **When these file types are found** (_FileTypeAction_)|**Reject the message with a non-delivery report (NDR)** (`Reject`)|**Reject the message with a non-delivery report (NDR)** (`Reject`)|**Reject the message with a non-delivery report (NDR)** (`Reject`)|| +|**Enable zero-hour auto purge for malware** (_ZapEnabled_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| +|**Quarantine policy** (_QuarantineTag_)|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|| +|**Admin notifications**||||| +|**Notify an admin about undelivered messages from internal senders** (_EnableInternalSenderAdminNotifications_ and _InternalSenderAdminAddress_)|Not selected (`$false`)|Not selected (`$false`)|Not selected (`$false`)|We have no specific recommendation for this setting.| +|**Notify an admin about undelivered messages from external senders** (_EnableExternalSenderAdminNotifications_ and _ExternalSenderAdminAddress_)|Not selected (`$false`)|Not selected (`$false`)|Not selected (`$false`)|We have no specific recommendation for this setting.| +|**Customize notifications**||||We have no specific recommendations for these settings.| +|**Use customized notification text** (_CustomNotifications_)|Not selected (`$false`)|Not selected (`$false`)|Not selected (`$false`)|| +|**From name** (_CustomFromName_)|Blank|Blank|Blank|| +|**From address** (_CustomFromAddress_)|Blank|Blank|Blank|| +|**Customize notifications for messages from internal senders**||||These settings are used only if **Notify an admin about undelivered messages from internal senders** is selected.| +|**Subject** (_CustomInternalSubject_)|Blank|Blank|Blank|| +|**Message** (_CustomInternalBody_)|Blank|Blank|Blank|| +|**Customize notifications for messages from external senders**||||These settings are used only if **Notify an admin about undelivered messages from external senders** is selected.| +|**Subject** (_CustomExternalSubject_)|Blank|Blank|Blank|| +|**Message** (_CustomExternalBody_)|Blank|Blank|Blank|| + ### EOP anti-spam policy settings To create and configure anti-spam policies, see [Configure anti-spam policies in EOP](anti-spam-policies-configure.md). Admins can create or use quarantine policies with more restrictive or less restr |Security feature name|Default|Standard|Strict|Comment| ||::|::|::|| |**Bulk email threshold & spam properties**|||||-|**Bulk email threshold** <br><br> _BulkThreshold_|7|6|5|For details, see [Bulk complaint level (BCL) in EOP](anti-spam-bulk-complaint-level-bcl-about.md).| -|_MarkAsSpamBulkMail_|`On`|`On`|`On`|This setting is only available in PowerShell.| +|**Bulk email threshold** (_BulkThreshold_)|7|6|5|For details, see [Bulk complaint level (BCL) in EOP](anti-spam-bulk-complaint-level-bcl-about.md).| +|_MarkAsSpamBulkMail_)|(`On`)|(`On`)|(`On`)|This setting is only available in PowerShell.| |**Increase spam score** settings|Off|Off|Off|All of these settings are part of the Advanced Spam Filter (ASF). For more information, see the [ASF settings in anti-spam policies](#asf-settings-in-anti-spam-policies) section in this article.| |**Mark as spam** settings|Off|Off|Off|Most of these settings are part of ASF. For more information, see the [ASF settings in anti-spam policies](#asf-settings-in-anti-spam-policies) section in this article.|-|**Contains specific languages** <br><br> _EnableLanguageBlockList_ <br><br> _LanguageBlockList_|**Off** <br><br> `$false` <br><br> Blank|**Off** <br><br> `$false` <br><br> Blank|**Off** <br><br> `$false` <br><br> Blank|We have no specific recommendation for this setting. You can block messages in specific languages based on your business needs.| -|**From these countries** <br><br> _EnableRegionBlockList_ <br><br> _RegionBlockList_|**Off** <br><br> `$false` <br><br> Blank|**Off** <br><br> `$false` <br><br> Blank|**Off** <br><br> `$false` <br><br> Blank|We have no specific recommendation for this setting. You can block messages from specific countries based on your business needs.| +|**Contains specific languages** (_EnableLanguageBlockList_ and _LanguageBlockList_)|**Off** (`$false` and Blank)|**Off** (`$false` and Blank)|**Off** (`$false` and Blank)|We have no specific recommendation for this setting. You can block messages in specific languages based on your business needs.| +|**From these countries** (_EnableRegionBlockList_ and _RegionBlockList_)|**Off** (`$false` and Blank)|**Off** (`$false` and Blank)|**Off** (`$false` and Blank)|We have no specific recommendation for this setting. You can block messages from specific countries based on your business needs.| |**Test mode** (_TestModeAction_)|**None**|**None**|**None**|This setting is part of ASF. For more information, see the [ASF settings in anti-spam policies](#asf-settings-in-anti-spam-policies) section in this article.| |**Actions**|||||-|**Spam** detection action <br><br> _SpamAction_|**Move message to Junk Email folder** <br><br> `MoveToJmf`|**Move message to Junk Email folder** <br><br> `MoveToJmf`|**Quarantine message** <br><br> `Quarantine`|| -|**Quarantine policy** for **Spam** <br><br> _SpamQuarantineTag_|DefaultFullAccessPolicy┬╣|DefaultFullAccessPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if spam detections are quarantined.| -|**High confidence spam** detection action <br><br> _HighConfidenceSpamAction_|**Move message to Junk Email folder** <br><br> `MoveToJmf`|**Quarantine message** <br><br> `Quarantine`|**Quarantine message** <br><br> `Quarantine`|| -|**Quarantine policy** for **Hight confidence spam** <br><br> _HighConfidenceSpamQuarantineTag_|DefaultFullAccessPolicy┬╣|DefaultFullAccessWithNotificationPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if high confidence spam detections are quarantined.| -|**Phishing** detection action <br><br> _PhishSpamAction_|**Move message to Junk Email folder**<sup>\*</sup> <br><br> `MoveToJmf`|**Quarantine message** <br><br> `Quarantine`|**Quarantine message** <br><br> `Quarantine`|<sup>\*</sup> The default value is **Move message to Junk Email folder** in the default anti-spam policy and in new anti-spam policies that you create in PowerShell. The default value is **Quarantine message** in new anti-spam policies that you create in the Microsoft 365 Defender portal.| -|**Quarantine policy** for **Phishing** <br><br> _PhishQuarantineTag_|DefaultFullAccessPolicy┬╣|DefaultFullAccessWithNotificationPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if phishing detections are quarantined.| -|**High confidence phishing** detection action <br><br> _HighConfidencePhishAction_|**Quarantine message** <br><br> `Quarantine`|**Quarantine message** <br><br> `Quarantine`|**Quarantine message** <br><br> `Quarantine`|Users can't release their own messages that were quarantined as high confidence phishing, regardless of how the quarantine policy is configured. If the policy allows users to release their own quarantined messages, users are instead allowed to _request_ the release of their quarantined high-confidence phishing messages.| -|**Quarantine policy** for **High confidence phishing** <br><br> _HighConfidencePhishQuarantineTag_|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|| -|**Bulk** detection action <br><br> _BulkSpamAction_|**Move message to Junk Email folder** <br><br> `MoveToJmf`|**Move message to Junk Email folder** <br><br> `MoveToJmf`|**Quarantine message** <br><br> `Quarantine`|| -|**Quarantine policy** for **Bulk** <br><br> _BulkQuarantineTag_|DefaultFullAccessPolicy┬╣|DefaultFullAccessPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if bulk detections are quarantined.| -|**Retain spam in quarantine for this many days** <br><br> _QuarantineRetentionPeriod_|15 days|30 days|30 days|This value also affects messages that are quarantined by anti-phishing policies. For more information, see [Quarantined email messages in EOP](quarantine-about.md).| -|**Enable spam safety tips** <br><br> _InlineSafetyTipsEnabled_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| -|Enable zero-hour auto purge (ZAP) for phishing messages <br><br> _PhishZapEnabled_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| -|Enable ZAP for spam messages <br><br> _SpamZapEnabled_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| +|**Spam** detection action (_SpamAction_)|**Move message to Junk Email folder** (`MoveToJmf`)|**Move message to Junk Email folder** (`MoveToJmf`)|**Quarantine message** (`Quarantine`)|| +|**Quarantine policy** for **Spam** (_SpamQuarantineTag_)|DefaultFullAccessPolicy┬╣|DefaultFullAccessPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if spam detections are quarantined.| +|**High confidence spam** detection action (_HighConfidenceSpamAction_)|**Move message to Junk Email folder** (`MoveToJmf`)|**Quarantine message** (`Quarantine`)|**Quarantine message** (`Quarantine`)|| +|**Quarantine policy** for **Hight confidence spam** (_HighConfidenceSpamQuarantineTag_)|DefaultFullAccessPolicy┬╣|DefaultFullAccessWithNotificationPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if high confidence spam detections are quarantined.| +|**Phishing** detection action (_PhishSpamAction_)|**Move message to Junk Email folder** (`MoveToJmf`)<sup>\*</sup>|**Quarantine message** (`Quarantine`)|**Quarantine message** (`Quarantine`)|<sup>\*</sup> The default value is **Move message to Junk Email folder** in the default anti-spam policy and in new anti-spam policies that you create in PowerShell. The default value is **Quarantine message** in new anti-spam policies that you create in the Defender portal.| +|**Quarantine policy** for **Phishing** (_PhishQuarantineTag_)|DefaultFullAccessPolicy┬╣|DefaultFullAccessWithNotificationPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if phishing detections are quarantined.| +|**High confidence phishing** detection action (_HighConfidencePhishAction_)|**Quarantine message** (`Quarantine`)|**Quarantine message** (`Quarantine`)|**Quarantine message** (`Quarantine`)|Users can't release their own messages that were quarantined as high confidence phishing, regardless of how the quarantine policy is configured. If the policy allows users to release their own quarantined messages, users are instead allowed to _request_ the release of their quarantined high-confidence phishing messages.| +|**Quarantine policy** for **High confidence phishing** (_HighConfidencePhishQuarantineTag_)|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|| +|**Bulk** detection action (_BulkSpamAction_)|**Move message to Junk Email folder** (`MoveToJmf`)|**Move message to Junk Email folder** (`MoveToJmf`)|**Quarantine message** (`Quarantine`)|| +|**Quarantine policy** for **Bulk** (_BulkQuarantineTag_)|DefaultFullAccessPolicy┬╣|DefaultFullAccessPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if bulk detections are quarantined.| +|**Retain spam in quarantine for this many days** (_QuarantineRetentionPeriod_)|15 days|30 days|30 days|This value also affects messages that are quarantined by anti-phishing policies. For more information, see [Quarantined email messages in EOP](quarantine-about.md).| +|**Enable spam safety tips** (_InlineSafetyTipsEnabled_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| +|Enable zero-hour auto purge (ZAP) for phishing messages (_PhishZapEnabled_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| +|Enable ZAP for spam messages (_SpamZapEnabled_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| |**Allow & block list**|||||-|Allowed senders <br><br> _AllowedSenders_|None|None|None|| -|Allowed sender domains <br><br> _AllowedSenderDomains_|None|None|None|Adding domains to the allowed senders list is a very bad idea. Attackers would be able to send you email that would otherwise be filtered out. <br><br> Use the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md) and the [Tenant Allow/Block List](tenant-allow-block-list-about.md) to review all senders who are spoofing sender email addresses in your organization's email domains or spoofing sender email addresses in external domains.| -|Blocked senders <br><br> _BlockedSenders_|None|None|None|| -|Blocked sender domains <br><br> _BlockedSenderDomains_|None|None|None|| +|Allowed senders (_AllowedSenders_)|None|None|None|| +|Allowed sender domains (_AllowedSenderDomains_)|None|None|None|Adding domains to the allowed senders list is a very bad idea. Attackers would be able to send you email that would otherwise be filtered out. <br><br> Use the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md) and the [Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#spoofed-senders-in-the-tenant-allowblock-list) to review all senders who are spoofing sender email addresses in your organization's email domains or spoofing sender email addresses in external domains.| +|Blocked senders (_BlockedSenders_)|None|None|None|| +|Blocked sender domains (_BlockedSenderDomains_)|None|None|None|| ┬╣ As described in [Full access permissions and quarantine notifications](quarantine-policies.md#full-access-permissions-and-quarantine-notifications), your organization might use NotificationEnabledPolicy instead of DefaultFullAccessPolicy in the default security policy or in new custom security policies that you create. The only difference between these two quarantine policies is quarantine notifications are turned on in NotificationEnabledPolicy and turned off in DefaultFullAccessPolicy. For more information about Advanced Spam Filter (ASF) settings in anti-spam poli |Security feature name|Default|Recommended<br>Standard|Recommended<br>Strict|Comment| ||::|::|::||-|**Image links to remote sites** <br><br> _IncreaseScoreWithImageLinks_|Off|Off|Off|| -|**Numeric IP address in URL** <br><br> _IncreaseScoreWithNumericIps_|Off|Off|Off|| -|**URL redirect to other port** <br><br> _IncreaseScoreWithRedirectToOtherPort_|Off|Off|Off|| -|**Links to .biz or .info websites** <br><br> _IncreaseScoreWithBizOrInfoUrls_|Off|Off|Off|| -|**Empty messages** <br><br> _MarkAsSpamEmptyMessages_|Off|Off|Off|| -|**Embed tags in HTML** <br><br> _MarkAsSpamEmbedTagsInHtml_|Off|Off|Off|| -|**JavaScript or VBScript in HTML** <br><br> _MarkAsSpamJavaScriptInHtml_|Off|Off|Off|| -|**Form tags in HTML** <br><br> _MarkAsSpamFormTagsInHtml_|Off|Off|Off|| -|**Frame or iframe tags in HTML** <br><br> _MarkAsSpamFramesInHtml_|Off|Off|Off|| -|**Web bugs in HTML** <br><br> _MarkAsSpamWebBugsInHtml_|Off|Off|Off|| -|**Object tags in HTML** <br><br> _MarkAsSpamObjectTagsInHtml_|Off|Off|Off|| -|**Sensitive words** <br><br> _MarkAsSpamSensitiveWordList_|Off|Off|Off|| -|**SPF record: hard fail** <br><br> _MarkAsSpamSpfRecordHardFail_|Off|Off|Off|| -|**Sender ID filtering hard fail** <br><br> _MarkAsSpamFromAddressAuthFail_|Off|Off|Off|| -|**Backscatter** <br><br> _MarkAsSpamNdrBackscatter_|Off|Off|Off|| -|**Test mode** <br><br> _TestModeAction_)|None|None|None|For ASF settings that support **Test** as an action, you can configure the test mode action to **None**, **Add default X-Header text**, or **Send Bcc message** (`None`, `AddXHeader`, or `BccMessage`). For more information, see [Enable, disable, or test ASF settings](anti-spam-policies-asf-settings-about.md#enable-disable-or-test-asf-settings).| +|**Image links to remote sites** (_IncreaseScoreWithImageLinks_)|Off|Off|Off|| +|**Numeric IP address in URL** (_IncreaseScoreWithNumericIps_)|Off|Off|Off|| +|**URL redirect to other port** (_IncreaseScoreWithRedirectToOtherPort_)|Off|Off|Off|| +|**Links to .biz or .info websites** (_IncreaseScoreWithBizOrInfoUrls_)|Off|Off|Off|| +|**Empty messages** (_MarkAsSpamEmptyMessages_)|Off|Off|Off|| +|**Embed tags in HTML** (_MarkAsSpamEmbedTagsInHtml_)|Off|Off|Off|| +|**JavaScript or VBScript in HTML** (_MarkAsSpamJavaScriptInHtml_)|Off|Off|Off|| +|**Form tags in HTML** (_MarkAsSpamFormTagsInHtml_)|Off|Off|Off|| +|**Frame or iframe tags in HTML** (_MarkAsSpamFramesInHtml_)|Off|Off|Off|| +|**Web bugs in HTML** (_MarkAsSpamWebBugsInHtml_)|Off|Off|Off|| +|**Object tags in HTML** (_MarkAsSpamObjectTagsInHtml_)|Off|Off|Off|| +|**Sensitive words** (_MarkAsSpamSensitiveWordList_)|Off|Off|Off|| +|**SPF record: hard fail** (_MarkAsSpamSpfRecordHardFail_)|Off|Off|Off|| +|**Sender ID filtering hard fail** (_MarkAsSpamFromAddressAuthFail_)|Off|Off|Off|| +|**Backscatter** (_MarkAsSpamNdrBackscatter_)|Off|Off|Off|| +|**Test mode** (_TestModeAction_)|None|None|None|For ASF settings that support **Test** as an action, you can configure the test mode action to **None**, **Add default X-Header text**, or **Send Bcc message** (`None`, `AddXHeader`, or `BccMessage`). For more information, see [Enable, disable, or test ASF settings](anti-spam-policies-asf-settings-about.md#enable-disable-or-test-asf-settings).| > [!NOTE] > ASF adds `X-CustomSpam:` X-header fields to messages _after_ the messages have been processed by Exchange mail flow rules (also known as transport rules), so you can't use mail flow rules to identify and act on messages that were filtered by ASF. For more information about the default sending limits in the service, see [Sendi |Security feature name|Default|Recommended<br>Standard|Recommended<br>Strict|Comment| ||::|::|::||-|**Set an external message limit** <br><br> _RecipientLimitExternalPerHour_|0|500|400|The default value 0 means use the service defaults.| -|**Set an internal message limit** <br><br> _RecipientLimitInternalPerHour_|0|1000|800|The default value 0 means use the service defaults.| -|**Set a daily message limit** <br><br> _RecipientLimitPerDay_|0|1000|800|The default value 0 means use the service defaults.| -|**Restriction placed on users who reach the message limit** <br><br> _ActionWhenThresholdReached_|**Restrict the user from sending mail until the following day** <br><br> `BlockUserForToday`|**Restrict the user from sending mail** <br><br> `BlockUser`|**Restrict the user from sending mail** <br><br> `BlockUser`|| -|**Automatic forwarding rules** <br><br> _AutoForwardingMode_|**Automatic - System-controlled** <br><br> `Automatic`|**Automatic - System-controlled** <br><br> `Automatic`|**Automatic - System-controlled** <br><br> `Automatic`| -|**Send a copy of outbound messages that exceed these limits to these users and groups** <br><br> _BccSuspiciousOutboundMail_ <br><br> _BccSuspiciousOutboundAdditionalRecipients_|Not selected <br><br> `$false` <br><br> Blank|Not selected <br><br> `$false` <br><br> Blank|Not selected <br><br> `$false` <br><br> Blank|We have no specific recommendation for this setting. <br><br> This setting only works in the default outbound spam policy. It doesn't work in custom outbound spam policies that you create.| -|**Notify these users and groups if a sender is blocked due to sending outbound spam** <br><br> _NotifyOutboundSpam_ <br><br> _NotifyOutboundSpamRecipients_|Not selected <br><br> `$false` <br><br> Blank|Not selected <br><br> `$false` <br><br> Blank|Not selected <br><br> `$false` <br><br> Blank|The default [alert policy](../../compliance/alert-policies.md) named **User restricted from sending email** already sends email notifications to members of the **TenantAdmins** (**Global admins**) group when users are blocked due to exceeding the limits in policy. **We strongly recommend that you use the alert policy rather than this setting in the outbound spam policy to notify admins and other users**. For instructions, see [Verify the alert settings for restricted users](removing-user-from-restricted-users-portal-after-spam.md#verify-the-alert-settings-for-restricted-users).| --### EOP anti-malware policy settings --To create and configure anti-malware policies, see [Configure anti-malware policies in EOP](anti-malware-policies-configure.md). --Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. For more information, see [Anatomy of a quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy). --The policy named AdminOnlyAccessPolicy enforces the historical capabilities for messages that were quarantined as malware as described in the table [here](quarantine-end-user.md). --Users can't release their own messages that were quarantined as malware, regardless of how the quarantine policy is configured. If the policy allows users to release their own quarantined messages, users are instead allowed to _request_ the release of their quarantined malware messages. --|Security feature name|Default|Standard|Strict|Comment| -||::|::|::|| -|**Protection settings**||||| -|**Enable the common attachments filter** <br><br> _EnableFileFilter_|Selected <br><br> `$true`<sup>\*</sup>|Selected <br><br> `$true`|Selected <br><br> `$true`|For the list of file types in the common attachments filter, see [Anti-malware policies](anti-malware-protection-about.md#anti-malware-policies). <br><br> <sup>\*</sup> The common attachments filter is on by default in new anti-malware policies that you create in the Microsoft 365 Defender portal. The common attachments filter is off by default in the default anti-malware policy and in new policies that you create in PowerShell.| -|Common attachment filter notifications (**When these file types are found**) <br><br> _FileTypeAction_|**Reject the message with a non-delivery report (NDR)** <br><br> `Reject`|**Reject the message with a non-delivery report (NDR)** <br><br> `Reject`|**Reject the message with a non-delivery report (NDR)** <br><br> `Reject`|| -|**Enable zero-hour auto purge for malware** <br><br> _ZapEnabled_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| -|**Quarantine policy** <br><br> _QuarantineTag_|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|| -|**Admin notifications**||||| -|**Notify an admin about undelivered messages from internal senders** <br><br> _EnableInternalSenderAdminNotifications_ <br><br> _InternalSenderAdminAddress_|Not selected <br><br> `$false`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|We have no specific recommendation for this setting.| -|**Notify an admin about undelivered messages from external senders** <br><br> _EnableExternalSenderAdminNotifications_ <br><br> _ExternalSenderAdminAddress_|Not selected <br><br> `$false`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|We have no specific recommendation for this setting.| -|**Customize notifications**||||We have no specific recommendations for these settings.| -|**Use customized notification text** <br><br> _CustomNotifications_|Not selected <br><br> `$false`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|| -|**From name** <br><br> _CustomFromName_|Blank <br><br> `$null`|Blank <br><br> `$null`|Blank <br><br> `$null`|| -|**From address** <br><br> _CustomFromAddress_|Blank <br><br> `$null`|Blank <br><br> `$null`|Blank <br><br> `$null`|| -|**Customize notifications for messages from internal senders**||||These settings are used only if **Notify an admin about undelivered messages from internal senders** is selected.| -|**Subject** <br><br> _CustomInternalSubject_|Blank <br><br> `$null`|Blank <br><br> `$null`|Blank <br><br> `$null`|| -|**Message** <br><br> _CustomInternalBody_|Blank <br><br> `$null`|Blank <br><br> `$null`|Blank <br><br> `$null`|| -|**Customize notifications for messages from external senders**||||These settings are used only if **Notify an admin about undelivered messages from external senders** is selected.| -|**Subject** <br><br> _CustomExternalSubject_|Blank <br><br> `$null`|Blank <br><br> `$null`|Blank <br><br> `$null`|| -|**Message** <br><br> _CustomExternalBody_|Blank <br><br> `$null`|Blank <br><br> `$null`|Blank <br><br> `$null`|| +|**Set an external message limit** (_RecipientLimitExternalPerHour_)|0|500|400|The default value 0 means use the service defaults.| +|**Set an internal message limit** (_RecipientLimitInternalPerHour_)|0|1000|800|The default value 0 means use the service defaults.| +|**Set a daily message limit** (_RecipientLimitPerDay_)|0|1000|800|The default value 0 means use the service defaults.| +|**Restriction placed on users who reach the message limit** (_ActionWhenThresholdReached_)|**Restrict the user from sending mail until the following day** (`BlockUserForToday`)|**Restrict the user from sending mail** (`BlockUser`)|**Restrict the user from sending mail** (`BlockUser`)|| +|**Automatic forwarding rules** (_AutoForwardingMode_)|**Automatic - System-controlled** (`Automatic`)|**Automatic - System-controlled** (`Automatic`)|**Automatic - System-controlled** (`Automatic`)| +|**Send a copy of outbound messages that exceed these limits to these users and groups** (_BccSuspiciousOutboundMail_ and _BccSuspiciousOutboundAdditionalRecipients_)|Not selected (`$false` and Blank)|Not selected (`$false` and Blank)|Not selected (`$false` and Blank)|We have no specific recommendation for this setting. <br><br> This setting works only in the default outbound spam policy. It doesn't work in custom outbound spam policies that you create.| +|**Notify these users and groups if a sender is blocked due to sending outbound spam** (_NotifyOutboundSpam_ and _NotifyOutboundSpamRecipients_)|Not selected (`$false` and Blank)|Not selected (`$false` and Blank)|Not selected (`$false` and Blank)|The default [alert policy](../../compliance/alert-policies.md) named **User restricted from sending email** already sends email notifications to members of the **TenantAdmins** (**Global admins**) group when users are blocked due to exceeding the limits in policy. **We strongly recommend that you use the alert policy rather than this setting in the outbound spam policy to notify admins and other users**. For instructions, see [Verify the alert settings for restricted users](removing-user-from-restricted-users-portal-after-spam.md#verify-the-alert-settings-for-restricted-users).| ### EOP anti-phishing policy settings Admins can create or use quarantine policies with more restrictive or less restr |Security feature name|Default|Standard|Strict|Comment| ||::|::|::|| |**Phishing threshold & protection**|||||-|**Enable spoof intelligence** <br><br> _EnableSpoofIntelligence_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| +|**Enable spoof intelligence** (_EnableSpoofIntelligence_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| |**Actions**|||||-|**Honor DMARC record policy when the message when the message is detected as spoof** <br><br> _HonorDmarcPolicy_|Not selected <br><br> `$false`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|**This setting is currently in Preview.** <br><br> When this setting is turned on, you control what happens to messages where the sender fails explicit [DMARC](email-authentication-dmarc-configure.md) checks when the policy action in the DMARC TXT record is set to `p=quarantine` or `p=reject`. For more information, see [Spoof protection and sender DMARC policies](anti-phishing-policies-about.md#spoof-protection-and-sender-dmarc-policies).| -|**If the message is detected as spoof and DMARC Policy is set as p=quarantine** <br><br> _DmarcQuarantineAction_|**Quarantine the message** <br><br> _Quarantine_|**Quarantine the message** <br><br> _Quarantine_|**Quarantine the message** <br><br> _Quarantine_|**This setting is currently in Preview.** <br><br> This action is meaningful only when **Honor DMARC record policy when the message when the message is detected as spoof** is turned on.| -|**If the message is detected as spoof and DMARC Policy is set as p=reject** <br><br> _DmarcRejectAction_|**Quarantine the message** <br><br> _Quarantine_|**Quarantine the message** <br><br> _Quarantine_|**Quarantine the message** <br><br> _Quarantine_|**This setting is currently in Preview.** <br><br> This action is meaningful only when **Honor DMARC record policy when the message when the message is detected as spoof** is turned on.| -|**If the message is detected as spoof and DMARC Policy is set as p=reject** <br><br> _DmarcRejectAction_|**Quarantine the message** <br><br> _Quarantine_|**Quarantine the message** <br><br> _Quarantine_|**Quarantine the message** <br><br> _Quarantine_|**This setting is currently in Preview.** <br><br> This action is meaningful only when **Honor DMARC record policy when the message when the message is detected as spoof** is turned on.| -|**If the message is detected as spoof by spoof intelligence** <br><br> _AuthenticationFailAction_|**Move the message to the recipients' Junk Email folders** <br><br> `MoveToJmf`|**Move the message to the recipients' Junk Email folders** <br><br> `MoveToJmf`|**Quarantine the message** <br><br> `Quarantine`|This setting applies to spoofed senders that were automatically blocked as shown in the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md) or manually blocked in the [Tenant Allow/Block List](tenant-allow-block-list-about.md). <br><br> If you select **Quarantine the message** as the action for the spoof verdict, an **Apply quarantine policy** box is available.| -|**Quarantine policy** for **Spoof** <br><br> _SpoofQuarantineTag_|DefaultFullAccessPolicy┬╣|DefaultFullAccessPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if spoof detections are quarantined.| -|**Show first contact safety tip** <br><br> _EnableFirstContactSafetyTips_|Not selected <br><br> `$false`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|For more information, see [First contact safety tip](anti-phishing-policies-about.md#first-contact-safety-tip).| -|**Show (?) for unauthenticated senders for spoof** <br><br> _EnableUnauthenticatedSender_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Adds a question mark (?) to the sender's photo in Outlook for unidentified spoofed senders. For more information, see [Unauthenticated sender indicators](anti-phishing-policies-about.md#unauthenticated-sender-indicators).| -|**Show "via" tag** <br><br> _EnableViaTag_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Adds a via tag (chris@contoso.com via fabrikam.com) to the From address if it's different from the domain in the DKIM signature or the **MAIL FROM** address. <br><br> For more information, see [Unauthenticated sender indicators](anti-phishing-policies-about.md#unauthenticated-sender-indicators).| +|**Honor DMARC record policy when the message when the message is detected as spoof** (_HonorDmarcPolicy_)|Not selected (`$false`)|Not selected (`$false`)|Not selected (`$false`)|**This setting is currently in Preview.** <br><br> When this setting is turned on, you control what happens to messages where the sender fails explicit [DMARC](email-authentication-dmarc-configure.md) checks when the policy action in the DMARC TXT record is set to `p=quarantine` or `p=reject`. For more information, see [Spoof protection and sender DMARC policies](anti-phishing-policies-about.md#spoof-protection-and-sender-dmarc-policies).| +|**If the message is detected as spoof and DMARC Policy is set as p=quarantine** (_DmarcQuarantineAction_)|**Quarantine the message** (_Quarantine_)|**Quarantine the message** (_Quarantine_)|**Quarantine the message** (_Quarantine_)|**This setting is currently in Preview.** <br><br> This action is meaningful only when **Honor DMARC record policy when the message when the message is detected as spoof** is turned on.| +|**If the message is detected as spoof and DMARC Policy is set as p=reject** (_DmarcRejectAction_)|**Quarantine the message** (_Quarantine_)|**Quarantine the message** (_Quarantine_)|**Quarantine the message** (_Quarantine_)|**This setting is currently in Preview.** <br><br> This action is meaningful only when **Honor DMARC record policy when the message when the message is detected as spoof** is turned on.| +|**If the message is detected as spoof and DMARC Policy is set as p=reject** (_DmarcRejectAction_)|**Quarantine the message** (_Quarantine_)|**Quarantine the message** (_Quarantine_)|**Quarantine the message** (_Quarantine_)|**This setting is currently in Preview.** <br><br> This action is meaningful only when **Honor DMARC record policy when the message when the message is detected as spoof** is turned on.| +|**If the message is detected as spoof by spoof intelligence** (_AuthenticationFailAction_)|**Move the message to the recipients' Junk Email folders** (`MoveToJmf`)|**Move the message to the recipients' Junk Email folders** (`MoveToJmf`)|**Quarantine the message** (`Quarantine`)|This setting applies to spoofed senders that were automatically blocked as shown in the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md) or manually blocked in the [Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-spoofed-senders). <br><br> If you select **Quarantine the message** as the action for the spoof verdict, an **Apply quarantine policy** box is available.| +|**Quarantine policy** for **Spoof** (_SpoofQuarantineTag_)|DefaultFullAccessPolicy┬╣|DefaultFullAccessPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if spoof detections are quarantined.| +|**Show first contact safety tip** (_EnableFirstContactSafetyTips_)|Not selected (`$false`)|Not selected (`$false`)|Not selected (`$false`)|For more information, see [First contact safety tip](anti-phishing-policies-about.md#first-contact-safety-tip).| +|**Show (?) for unauthenticated senders for spoof** (_EnableUnauthenticatedSender_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|Adds a question mark (?) to the sender's photo in Outlook for unidentified spoofed senders. For more information, see [Unauthenticated sender indicators](anti-phishing-policies-about.md#unauthenticated-sender-indicators).| +|**Show "via" tag** (_EnableViaTag_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|Adds a via tag (chris@contoso.com via fabrikam.com) to the From address if it's different from the domain in the DKIM signature or the **MAIL FROM** address. <br><br> For more information, see [Unauthenticated sender indicators](anti-phishing-policies-about.md#unauthenticated-sender-indicators).| ┬╣ As described in [Full access permissions and quarantine notifications](quarantine-policies.md#full-access-permissions-and-quarantine-notifications), your organization might use NotificationEnabledPolicy instead of DefaultFullAccessPolicy in the default security policy or in new custom security policies that you create. The only difference between these two quarantine policies is quarantine notifications are turned on in NotificationEnabledPolicy and turned off in DefaultFullAccessPolicy. Additional security benefits come with a Microsoft Defender for Office 365 subsc > [!IMPORTANT] > > - The default anti-phishing policy in Microsoft Defender for Office 365 provides [spoof protection](anti-phishing-policies-about.md#spoof-settings) and mailbox intelligence for all recipients. However, the other available [impersonation protection](#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365) features and [advanced settings](#advanced-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365) are not configured or enabled in the default policy. To enable all protection features, use one of the following methods:-> > - Turn on and use the Standard and/or Strict [preset security policies](preset-security-policies.md) and configure impersonation protection there. > - Modify the default anti-phishing policy.-> > - Create additional anti-phishing policies. >-> - Although there's no default Safe Attachments policy or Safe Links policy, the **Built-in protection** preset security policy provides Safe Attachments protection and Safe Links protection to all recipients (users who aren't defined in the Standard or Strict preset security policies or in custom Safe Attachments policies or Safe Links policies). For more information, see [Preset security policies in EOP and Microsoft Defender for Office 365](preset-security-policies.md). +> - Although there's no default Safe Attachments policy or Safe Links policy, the **Built-in protection** preset security policy provides Safe Attachments protection and Safe Links protection to all recipients who aren't defined in the Standard preset security policy, the Strict preset security policy, or in custom Safe Attachments or Safe Links policies). For more information, see [Preset security policies in EOP and Microsoft Defender for Office 365](preset-security-policies.md). > > - [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](safe-attachments-for-spo-odfb-teams-about.md) protection and [Safe Documents](safe-documents-in-e5-plus-security-about.md) protection have no dependencies on Safe Links policies. For more information about this setting, see [Advanced phishing thresholds in an |Security feature name|Default|Standard|Strict|Comment| ||::|::|::||-|**Phishing email threshold** <br><br> _PhishThresholdLevel_|**1 - Standard** <br><br> `1`|**3 - More aggressive** <br><br> `3`|**4 - Most aggressive** <br><br> `4`|| +|**Phishing email threshold** (_PhishThresholdLevel_)|**1 - Standard** (`1`)|**3 - More aggressive** (`3`)|**4 - Most aggressive** (`4`)|| #### Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365 Admins can create or use quarantine policies with more restrictive or less restr |Security feature name|Default|Standard|Strict|Comment| ||::|::|::|| |**Phishing threshold & protection**|||||-|**Enable users to protect** (impersonated user protection) <br><br> _EnableTargetedUserProtection_ <br><br> _TargetedUsersToProtect_|Not selected <br><br> `$false` <br><br> none|Selected <br><br> `$true` <br><br> \<list of users\>|Selected <br><br> `$true` <br><br> \<list of users\>|We recommend adding users (message senders) in key roles. Internally, protected senders might be your CEO, CFO, and other senior leaders. Externally, protected senders could include council members or your board of directors.| -|**Enable domains to protect** (impersonated domain protection)|Not selected|Selected|Selected|| -|**Include domains I own** <br><br> _EnableOrganizationDomainsProtection_|Off <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|| -|**Include custom domains** <br><br> _EnableTargetedDomainsProtection_ <br><br> _TargetedDomainsToProtect_|Off <br><br> `$false` <br><br> none|Selected <br><br> `$true` <br><br> \<list of domains\>|Selected <br><br> `$true` <br><br> \<list of domains\>|We recommend adding domains (sender domains) that you don't own, but you frequently interact with.| -|**Add trusted senders and domains** <br><br> _ExcludedSenders_ <br><br> _ExcludedDomains_|None|None|None|Depending on your organization, we recommend adding senders or domains that are incorrectly identified as impersonation attempts.| -|**Enable mailbox intelligence** <br><br> _EnableMailboxIntelligence_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| -|**Enable intelligence for impersonation protection** <br><br> _EnableMailboxIntelligenceProtection_|Off <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|This setting allows the specified action for impersonation detections by mailbox intelligence.| +|User impersonation protection: **Enable users to protect** (_EnableTargetedUserProtection_ and _TargetedUsersToProtect_)|Not selected (`$false` and none)|Selected (`$true` and \<list of users\>))|Selected (`$true` and \<list of users\>))|We recommend adding users (message senders) in key roles. Internally, protected senders might be your CEO, CFO, and other senior leaders. Externally, protected senders could include council members or your board of directors.| +|Domain impersonation protection: **Enable domains to protect**|Not selected|Selected|Selected|| +|**Include domains I own** (_EnableOrganizationDomainsProtection_)|Off (`$false`)|Selected (`$true`)|Selected (`$true`)|| +|**Include custom domains** (_EnableTargetedDomainsProtection_ and _TargetedDomainsToProtect_)|Off (`$false` and none)|Selected (`$true` and \<list of domains\>))|Selected (`$true` and \<list of domains\>))|We recommend adding domains (sender domains) that you don't own, but you frequently interact with.| +|**Add trusted senders and domains** (_ExcludedSenders_ and _ExcludedDomains_)|None|None|None|Depending on your organization, we recommend adding senders or domains that are incorrectly identified as impersonation attempts.| +|**Enable mailbox intelligence** (_EnableMailboxIntelligence_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| +|**Enable intelligence for impersonation protection** (_EnableMailboxIntelligenceProtection_)|Off (`$false`)|Selected (`$true`)|Selected (`$true`)|This setting allows the specified action for impersonation detections by mailbox intelligence.| |**Actions**|||||-|**If a message is detected as user impersonation** <br><br> _TargetedUserProtectionAction_|**Don't apply any action** <br><br> `NoAction`|**Quarantine the message** <br><br> `Quarantine`|**Quarantine the message** <br><br> `Quarantine`|| -|**Quarantine policy** for **user impersonation** <br><br> _TargetedUserQuarantineTag_|DefaultFullAccessPolicy┬╣|DefaultFullAccessWithNotificationPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if user impersonation detections are quarantined.| -|**If a message is detected as domain impersonation** <br><br> _TargetedDomainProtectionAction_|**Don't apply any action** <br><br> `NoAction`|**Quarantine the message** <br><br> `Quarantine`|**Quarantine the message** <br><br> `Quarantine`|| -|**Quarantine policy** for **domain impersonation** <br><br> _TargetedDomainQuarantineTag_|DefaultFullAccessPolicy┬╣|DefaultFullAccessWithNotificationPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if domain impersonation detections are quarantined.| -|**If mailbox intelligence detects an impersonated user** <br><br> _MailboxIntelligenceProtectionAction_|**Don't apply any action** <br><br> `NoAction`|**Move the message to the recipients' Junk Email folders** <br><br> `MoveToJmf`|**Quarantine the message** <br><br> `Quarantine`|| -|**Quarantine policy** for **mailbox intelligence impersonation** <br><br> _MailboxIntelligenceQuarantineTag_|DefaultFullAccessPolicy┬╣|DefaultFullAccessPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if mailbox intelligence detections are quarantined.| -|**Show user impersonation safety tip** <br><br> _EnableSimilarUsersSafetyTips_|Off <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|| -|**Show domain impersonation safety tip** <br><br> _EnableSimilarDomainsSafetyTips_|Off <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|| -|**Show user impersonation unusual characters safety tip** <br><br> _EnableUnusualCharactersSafetyTips_|Off <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|| +|**If a message is detected as user impersonation** (_TargetedUserProtectionAction_)|**Don't apply any action** (`NoAction`)|**Quarantine the message** (`Quarantine`)|**Quarantine the message** (`Quarantine`)|| +|**Quarantine policy** for **user impersonation** (_TargetedUserQuarantineTag_)|DefaultFullAccessPolicy┬╣|DefaultFullAccessWithNotificationPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if user impersonation detections are quarantined.| +|**If a message is detected as domain impersonation** (_TargetedDomainProtectionAction_)|**Don't apply any action** (`NoAction`)|**Quarantine the message** (`Quarantine`)|**Quarantine the message** (`Quarantine`)|| +|**Quarantine policy** for **domain impersonation** (_TargetedDomainQuarantineTag_)|DefaultFullAccessPolicy┬╣|DefaultFullAccessWithNotificationPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if domain impersonation detections are quarantined.| +|**If mailbox intelligence detects an impersonated user** (_MailboxIntelligenceProtectionAction_)|**Don't apply any action** (`NoAction`)|**Move the message to the recipients' Junk Email folders** (`MoveToJmf`)|**Quarantine the message** (`Quarantine`)|| +|**Quarantine policy** for **mailbox intelligence impersonation** (_MailboxIntelligenceQuarantineTag_)|DefaultFullAccessPolicy┬╣|DefaultFullAccessPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if mailbox intelligence detections are quarantined.| +|**Show user impersonation safety tip** (_EnableSimilarUsersSafetyTips_)|Off (`$false`)|Selected (`$true`)|Selected (`$true`)|| +|**Show domain impersonation safety tip** (_EnableSimilarDomainsSafetyTips_)|Off (`$false`)|Selected (`$true`)|Selected (`$true`)|| +|**Show user impersonation unusual characters safety tip** (_EnableUnusualCharactersSafetyTips_)|Off (`$false`)|Selected (`$true`)|Selected (`$true`)|| ┬╣ As described in [Full access permissions and quarantine notifications](quarantine-policies.md#full-access-permissions-and-quarantine-notifications), your organization might use NotificationEnabledPolicy instead of DefaultFullAccessPolicy in the default security policy or in new custom security policies that you create. The only difference between these two quarantine policies is quarantine notifications are turned on in NotificationEnabledPolicy and turned off in DefaultFullAccessPolicy. These are the same settings that are available in [anti-spam policy settings in Safe Attachments in Microsoft Defender for Office 365 includes global settings that have no relationship to Safe Attachments policies, and settings that are specific to each Safe Links policy. For more information, see [Safe Attachments in Defender for Office 365](safe-attachments-about.md). -Although there's no default Safe Attachments policy, the **Built-in protection** preset security policy provides Safe Attachments protection to all recipients (users who aren't defined in the Standard or Strict preset security policies or in custom Safe Attachments policies). For more information, see [Preset security policies in EOP and Microsoft Defender for Office 365](preset-security-policies.md). +Although there's no default Safe Attachments policy, the **Built-in protection** preset security policy provides Safe Attachments protection to all recipients who aren't defined in the Standard or Strict preset security policies or in custom Safe Attachments policies. For more information, see [Preset security policies in EOP and Microsoft Defender for Office 365](preset-security-policies.md). #### Global settings for Safe Attachments In PowerShell, you use the [Set-AtpPolicyForO365](/powershell/module/exchange/se |Security feature name|Default|Built-in protection|Comment| ||::|::||-|**Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams** <br><br> _EnableATPForSPOTeamsODB_|Off <br><br> `$false`|On <br><br> `$true`|To prevent users from downloading malicious files, see [Use SharePoint Online PowerShell to prevent users from downloading malicious files](safe-attachments-for-spo-odfb-teams-configure.md#step-2-recommended-use-sharepoint-online-powershell-to-prevent-users-from-downloading-malicious-files).| -|**Turn on Safe Documents for Office clients** <br><br> _EnableSafeDocs_|Off <br><br> `$false`|On <br><br> `$true`|This feature is available and meaningful only with licenses that are not included in Defender for Office 365 (for example, Microsoft 365 A5 or Microsoft 365 E5 Security). For more information, see [Safe Documents in Microsoft 365 A5 or E5 Security](safe-documents-in-e5-plus-security-about.md).| -|**Allow people to click through Protected View even if Safe Documents identified the file as malicious** <br><br> _AllowSafeDocsOpen_|Off <br><br> `$false`|Off <br><br> `$false`|This setting is related to Safe Documents.| +|**Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams** (_EnableATPForSPOTeamsODB_)|Off (`$false`)|On (`$true`)|To prevent users from downloading malicious files, see [Use SharePoint Online PowerShell to prevent users from downloading malicious files](safe-attachments-for-spo-odfb-teams-configure.md#step-2-recommended-use-sharepoint-online-powershell-to-prevent-users-from-downloading-malicious-files).| +|**Turn on Safe Documents for Office clients** (_EnableSafeDocs_)|Off (`$false`)|On (`$true`)|This feature is available and meaningful only with licenses that aren't included in Defender for Office 365 (for example, Microsoft 365 A5 or Microsoft 365 E5 Security). For more information, see [Safe Documents in Microsoft 365 A5 or E5 Security](safe-documents-in-e5-plus-security-about.md).| +|**Allow people to click through Protected View even if Safe Documents identified the file as malicious** (_AllowSafeDocsOpen_)|Off (`$false`)|Off (`$false`)|This setting is related to Safe Documents.| #### Safe Attachments policy settings To configure these settings, see [Set up Safe Attachments policies in Defender f In PowerShell, you use the [New-SafeAttachmentPolicy](/powershell/module/exchange/new-safeattachmentpolicy) and [Set-SafeAttachmentPolicy](/powershell/module/exchange/set-safelinkspolicy) cmdlets for these settings. > [!NOTE]-> As described earlier, there is no default Safe Attachments policy, but Safe Attachments protection is assigned to all recipients by the [**Built-in protection** preset security policy](preset-security-policies.md) (users who aren't defined in any Safe Attachments policies). +> As described earlier, although there's no default Safe Attachments policy, the **Built-in protection** preset security policy provides Safe Attachments protection to all recipients who aren't defined in the Standard preset security policy, the Strict preset security policy, or in custom Safe Attachments policies. > > The **Default in custom** column refers to the default values in new Safe Attachments policies that you create. The remaining columns indicate (unless otherwise noted) the values that are configured in the corresponding preset security policies. Users can't release their own messages that were quarantined as malware by Safe |Security feature name|Default in custom|Built-in protection|Standard|Strict|Comment| ||::|::|::|::||-|**Safe Attachments unknown malware response** <br><br> _Enable_ and _Action_|**Off** <br><br> `-Enable $false` and `-Action Block`|**Block** <br><br> `-Enable $true` and `-Action Block`|**Block** <br><br> `-Enable $true` and `-Action Block`|**Block** <br><br> `-Enable $true` and `-Action Block`|When the _Enable_ parameter is $false, the value of the _Action_ parameter doesn't matter.| -|**Quarantine policy** <br><br> _QuarantineTag_|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|| -|**Redirect attachment with detected attachments** : **Enable redirect** <br><br> _Redirect_ <br><br> _RedirectAddress_|Not selected and no email address specified. <br><br> `-Redirect $false` <br><br> _RedirectAddress_ is blank (`$null`)|Not selected and no email address specified. <br><br> `-Redirect $false` <br><br> _RedirectAddress_ is blank (`$null`)|Selected and specify an email address. <br><br> `$true` <br><br> an email address|Selected and specify an email address. <br><br> `$true` <br><br> an email address|Redirect messages to a security admin for review. <br><br> **Note**: This setting is not configured in the **Standard**, **Strict**, or **Built-in protection** preset security policies. The **Standard** and **Strict** values indicate our **recommended** values in new Safe Attachments policies that you create.| -|**Apply the Safe Attachments detection response if scanning can't complete (timeout or errors)** <br><br> _ActionOnError_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| +|**Safe Attachments unknown malware response** (_Enable_ and _Action_)|**Off** (`-Enable $false` and `-Action Block`)|**Block** (`-Enable $true` and `-Action Block`)|**Block** (`-Enable $true` and `-Action Block`)|**Block** (`-Enable $true` and `-Action Block`)|When the _Enable_ parameter is $false, the value of the _Action_ parameter doesn't matter.| +|**Quarantine policy** (_QuarantineTag_)|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|| +|**Redirect attachment with detected attachments** : **Enable redirect** (_Redirect_ and _RedirectAddress_)|Not selected and no email address specified. (`-Redirect $false` and _RedirectAddress_ is blank)|Not selected and no email address specified. (`-Redirect $false` and _RedirectAddress_ is blank)|Selected and specify an email address. (`$true` and \<email address\>))|Selected and specify an email address. (`$true` and \<email address\>))|Redirect messages to a security admin for review. <br><br> **Note**: This setting isn't configured in the **Standard**, **Strict**, or **Built-in protection** preset security policies. The **Standard** and **Strict** values indicate our **recommended** values in new Safe Attachments policies that you create.| +|**Apply the Safe Attachments detection response if scanning can't complete (timeout or errors)** (_ActionOnError_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| ### Safe Links policy settings For more information about Safe Links protection, see [Safe Links in Defender for Office 365](safe-links-about.md). -Although there's no default Safe Links policy, the **Built-in protection** preset security policy provides Safe Links protection to all recipients (users who aren't defined in the Standard or Strict preset security policies or in custom Safe Links policies). For more information, see [Preset security policies in EOP and Microsoft Defender for Office 365](preset-security-policies.md). +Although there's no default Safe Links policy, the **Built-in protection** preset security policy provides Safe Links protection to all recipients who aren't defined in the Standard preset security policy, the Strict preset security policy or in custom Safe Links policies. For more information, see [Preset security policies in EOP and Microsoft Defender for Office 365](preset-security-policies.md). To configure Sae Links policy settings, see [Set up Safe Links policies in Microsoft Defender for Office 365](safe-links-policies-configure.md). In PowerShell, you use the [New-SafeLinksPolicy](/powershell/module/exchange/new ||::|::|::|::|| |**URL & click protection settings**|||||| |**Email**|||||The settings in this section affect URL rewriting and time of click protection in email messages.|-|**On: Safe Links checks a list of known, malicious links when users click links in email. URLs are rewritten by default.** <br><br> _EnableSafeLinksForEmail_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| -|**Apply Safe Links to email messages sent within the organization** <br><br> _EnableForInternalSenders_|Selected <br><br> `$true`|Not selected <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|| -|**Apply real-time URL scanning for suspicious links and links that point to files** <br><br> _ScanUrls_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| -|**Wait for URL scanning to complete before delivering the message** <br><br> _DeliverMessageAfterScan_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| -|**Do not rewrite URLs, do checks via Safe Links API only** <br><br> _DisableURLRewrite_|Selected<sup>\*</sup> <br><br> `$true`|Selected <br><br> `$true`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|<sup>\*</sup> In new Safe Links policies that you create in the Defender portal, this setting is selected by default. In new Safe Links policies that you create in PowerShell, the default value of the _DisableURLRewrite_ parameter is `$false`.| -|**Do not rewrite the following URLs in email** <br><br> _DoNotRewriteUrls_|Blank <br><br> `$null`|Blank <br><br> `$null`|Blank <br><br> `$null`|Blank <br><br> `$null`|We have no specific recommendation for this setting. <br><br> **Note**: Entries in the "Do not rewrite the following URLs" list are not scanned or wrapped by Safe Links during mail flow. Report the URL as **Should not have been blocked (False positive)** and select **Alow this URL** to add an allow entry to the Tenant Allow/Block List so the URL isn't scanned or wrapped by Safe Links during mail flow _and_ at time of click. For instructions, see [Report good URLs to Microsoft](submissions-admin.md#report-good-urls-to-microsoft).| +|**On: Safe Links checks a list of known, malicious links when users click links in email. URLs are rewritten by default.** (_EnableSafeLinksForEmail_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| +|**Apply Safe Links to email messages sent within the organization** (_EnableForInternalSenders_)|Selected (`$true`)|Not selected (`$false`)|Selected (`$true`)|Selected (`$true`)|| +|**Apply real-time URL scanning for suspicious links and links that point to files** (_ScanUrls_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| +|**Wait for URL scanning to complete before delivering the message** (_DeliverMessageAfterScan_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| +|**Do not rewrite URLs, do checks via Safe Links API only** (_DisableURLRewrite_)|Selected (`$false`)<sup>\*</sup>|Selected (`$true`)|Not selected (`$false`)|Not selected (`$false`)|<sup>\*</sup> In new Safe Links policies that you create in the Defender portal, this setting is selected by default. In new Safe Links policies that you create in PowerShell, the default value of the _DisableURLRewrite_ parameter is `$false`.| +|**Do not rewrite the following URLs in email** (_DoNotRewriteUrls_)|Blank|Blank|Blank|Blank|We have no specific recommendation for this setting. <br><br> **Note**: Entries in the "Don't rewrite the following URLs" list aren't scanned or wrapped by Safe Links during mail flow. Report the URL as **Should not have been blocked (False positive)** and select **Allow this URL** to add an allow entry to the Tenant Allow/Block List so the URL isn't scanned or wrapped by Safe Links during mail flow _and_ at time of click. For instructions, see [Report good URLs to Microsoft](submissions-admin.md#report-good-urls-to-microsoft).| |**Teams**|||||The setting in this section affects time of click protection in Microsoft Teams.|-|**On: Safe Links checks a list of known, malicious links when users click links in Microsoft Teams. URLs are not rewritten.** <br><br> _EnableSafeLinksForTeams_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| +|**On: Safe Links checks a list of known, malicious links when users click links in Microsoft Teams. URLs are not rewritten.** (_EnableSafeLinksForTeams_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| |**Office 365 apps**|||||The setting in this section affects time of click protection in Office apps.|-|**On: Safe Links checks a list of known, malicious links when users click links in Microsoft Office apps. URLs are not rewritten.** <br><br> _EnableSafeLinksForOffice_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Use Safe Links in supported Office 365 desktop and mobile (iOS and Android) apps. For more information, see [Safe Links settings for Office apps](safe-links-about.md#safe-links-settings-for-office-apps).| +|**On: Safe Links checks a list of known, malicious links when users click links in Microsoft Office apps. URLs are not rewritten.** (_EnableSafeLinksForOffice_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|Use Safe Links in supported Office 365 desktop and mobile (iOS and Android) apps. For more information, see [Safe Links settings for Office apps](safe-links-about.md#safe-links-settings-for-office-apps).| |**Click protection settings**||||||-|**Track user clicks** <br><br> _TrackClicks_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| -|**Let users click through to the original URL** <br><br> _AllowClickThrough_|Selected<sup>\*</sup> <br><br> `$true`|Selected <br><br> `$true`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|<sup>\*</sup> In new Safe Links policies that you create in the Defender portal, this setting is selected by default. In new Safe Links policies that you create in PowerShell, the default value of the _AllowClickThrough_ parameter is `$false`.| -|**Display the organization branding on notification and warning pages** <br><br> _EnableOrganizationBranding_|Not selected <br><br> `$false`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|We have no specific recommendation for this setting. <br><br> Before you turn on this setting, you need to follow the instructions in [Customize the Microsoft 365 theme for your organization](../../admin/setup/customize-your-organization-theme.md) to upload your company logo.| +|**Track user clicks** (_TrackClicks_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| +|**Let users click through to the original URL** (_AllowClickThrough_)|Selected (`$false`)<sup>\*</sup>|Selected (`$true`)|Not selected (`$false`)|Not selected (`$false`)|<sup>\*</sup> In new Safe Links policies that you create in the Defender portal, this setting is selected by default. In new Safe Links policies that you create in PowerShell, the default value of the _AllowClickThrough_ parameter is `$false`.| +|**Display the organization branding on notification and warning pages** (_EnableOrganizationBranding_)|Not selected (`$false`)|Not selected (`$false`)|Not selected (`$false`)|Not selected (`$false`)|We have no specific recommendation for this setting. <br><br> Before you turn on this setting, you need to follow the instructions in [Customize the Microsoft 365 theme for your organization](../../admin/setup/customize-your-organization-theme.md) to upload your company logo.| |**Notification**||||||-|**How would you like to notify your users?** <br><br> _CustomNotificationText_ <br><br> _UseTranslatedNotificationText_|**Use the default notification text** <br><br> Blank (`$null`) <br><br> `$false`|**Use the default notification text** <br><br> Blank (`$null`) <br><br> `$false`|**Use the default notification text** <br><br> Blank (`$null`) <br><br> `$false`|**Use the default notification text** <br><br> Blank (`$null`) <br><br> `$false`|We have no specific recommendation for this setting. <br><br> You can select **Use custom notification text** (`-CustomNotificationText "<Custom text>"`) to enter and use customized notification text. If you specify custom text, you can also select **Use Microsoft Translator for automatic localization** (`-UseTranslatedNotificationText $true`) to automatically translate the text into the user's language.| +|**How would you like to notify your users?** (_CustomNotificationText_ and _UseTranslatedNotificationText_)|**Use the default notification text** (Blank and `$false`)|**Use the default notification text** (Blank and `$false`)|**Use the default notification text** (Blank and `$false`)|**Use the default notification text** (Blank and `$false`)|We have no specific recommendation for this setting. <br><br> You can select **Use custom notification text** (`-CustomNotificationText "<Custom text>"`) to enter and use customized notification text. If you specify custom text, you can also select **Use Microsoft Translator for automatic localization** (`-UseTranslatedNotificationText $true`) to automatically translate the text into the user's language.| ## Related articles In PowerShell, you use the [New-SafeLinksPolicy](/powershell/module/exchange/new - Admins and users can submit false positives (good email marked as bad) and false negatives (bad email allowed) to Microsoft for analysis. For more information, see [Report messages and files to Microsoft](submissions-report-messages-files-to-microsoft.md). -- Use these links for info on how to **set up** your [EOP service](/exchange/standalone-eop/set-up-your-eop-service), and **configure** [Microsoft Defender for Office 365](defender-for-office-365.md). Don't forget the helpful directions in '[Protect Against Threats in Office 365](protect-against-threats.md)'.+- Use these links for info on how to _set up_ your [EOP service](/exchange/standalone-eop/set-up-your-eop-service), and _configure_ [Microsoft Defender for Office 365](defender-for-office-365.md). Don't forget the helpful directions in [Protect Against Threats in Office 365](protect-against-threats.md). - **Security baselines for Windows** can be found here: [Where can I get the security baselines?](/windows/security/threat-protection/windows-security-baselines#where-can-i-get-the-security-baselines) for GPO/on-premises options, and [Use security baselines to configure Windows devices in Intune](/intune/protect/security-baselines) for Intune-based security. Finally, a comparison between Microsoft Defender for Endpoint and Microsoft Intune security baselines is available in [Compare the Microsoft Defender for Endpoint and the Windows Intune security baselines](/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline#compare-the-microsoft-defender-atp-and-the-windows-intune-security-baselines). |
| security | How To Handle False Negatives In Microsoft Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-negatives-in-microsoft-defender-for-office-365.md | Defender for Office 365 can help you understand why emails are getting delivered 2. End users can also add the sender to the [block senders list](https://support.microsoft.com/office/block-a-mail-sender-b29fd867-cac9-40d8-aed1-659e06a706e4#:~:text=1%20On%20the%20Home%20tab%2C%20in%20the%20Delete,4%20Click%20OK%20in%20both%20open%20dialog%20boxes..) in Outlook to prevent emails from this sender from being delivered to their inbox. 3. Admins can triage the user reported messages from [User reported tab on the Submissions page](/microsoft-365/security/office-365-security/admin-submission#view-user-reported-messages-to-microsoft). 4. From those reported messages, admins can **submit to** [Microsoft for analysis](/microsoft-365/security/office-365-security/admin-submission#notify-users-from-within-the-portal) to learn why that email was allowed in the first place.-5. If needed, while submitting to Microsoft for analysis, admins can create a [block for the sender](/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure) to mitigate the problem. +5. If needed, while submitting to Microsoft for analysis, admins can [create a block entry for the sender](../tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-domains-and-email-addresses) to mitigate the problem. 6. Once the results for submissions are available, read the verdict to understand why emails were allowed, and how your tenant setup could be improved to prevent similar situations from happening in the future. ## Handling malicious emails in junk folder of end users Defender for Office 365 can help you understand why emails are getting delivered 1. Ask end users to report the email as **phishing** using Microsoft Message Add-in, or Microsoft Phish Add-in, or the Outlook buttons. 2. Admins can triage the user reported messages from the [User reported tab on the Submissions page](/microsoft-365/security/office-365-security/admin-submission#view-user-reported-messages-to-microsoft). 3. From those reported messages admins can **submit to** [Microsoft for analysis](/microsoft-365/security/office-365-security/admin-submission#notify-users-from-within-the-portal) and learn why that email was allowed in the first place.-4. If needed, while submitting to Microsoft for analysis, admins can create a [block for the sender](/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure) to mitigate the problem. +4. If needed, while submitting to Microsoft for analysis, admins can [create a block entry for the sender](../tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-domains-and-email-addresses) to mitigate the problem. 5. Once the results for submissions are available, read the verdict to understand why emails were allowed, and how your tenant setup could be improved to prevent similar situations from happening in the future. ## Handling malicious emails landing in the quarantine folder of end users |
| security | How To Handle False Positives In Microsoft Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-positives-in-microsoft-defender-for-office-365.md | Microsoft Defender for Office 365 helps deal with important legitimate business 2. End users can also add the sender to the [**safe sender list**](https://support.microsoft.com/office/safe-senders-in-outlook-com-470d4ee6-e3b6-402b-8cd9-a6f00eda7339) in Outlook to prevent the email from these senders landing in Junk folder. 3. Admins can triage the user-reported messages from [the User reported tab on the Submission page](/microsoft-365/security/office-365-security/admin-submission#view-user-reported-messages-to-microsoft). 4. From those reported messages admins can submit to [**Microsoft for analysis**](/microsoft-365/security/office-365-security/admin-submission#notify-users-from-within-the-portal) and understand why was that email blocked in the first place.-5. If needed, while submitting to Microsoft for analysis, admins can judiciously create an [**allow** for a sender](/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure) to mitigate the problem. +5. If needed, while submitting to Microsoft for analysis, admins can judiciously [create an allow entry for the sender](../tenant-allow-block-list-email-spoof-configure.md#create-allow-entries-for-domains-and-email-addresses) to mitigate the problem. 6. Once the results from the admin submission are available, read it to understand why emails were blocked and how your tenant setup could be improved to *prevent* similar situations from happening in the future. ## Handling legitimate emails that are in quarantine folder of end users |
| security | Submissions User Reported Messages Custom Mailbox | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-user-reported-messages-custom-mailbox.md | Before you get started, you need to configure Exchange Online Protection and Def - Turn off Zero-hour auto purge (ZAP) for malware (**Protection settings** section \> **Enable zero-hour auto purge for malware** isn't selected or `-ZapEnabled $false` in PowerShell). - - Turn off common attachments filtering (**Protection settings** section \> **Enable the common attachments filter** isn't selected or `-EnableFileFilter $false` in PowerShell). + - Turn off the [common attachments filter](anti-malware-protection-about.md#common-attachments-filter-in-anti-malware-policies) (**Protection settings** section \> **Enable the common attachments filter** isn't selected or `-EnableFileFilter $false` in PowerShell). For instructions, see [Create an anti-malware policy](anti-malware-policies-configure.md#use-the-microsoft-365-defender-portal-to-create-anti-malware-policies). |
| security | Tenant Allow Block List Email Spoof Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure.md | To create block entries for *domains and email addresses*, use either of the fol - From the **Domains & addresses** tab on the **Tenant Allow/Block Lists** page or in PowerShell as described in this section. -To create block entries for *spoofed senders*, see [this section](#use-the-microsoft-365-defender-portal-to-create-block-entries-for-spoofed-senders-in-the-tenant-allowblock-list) later in this article. +To create block entries for *spoofed senders*, see [this section](#create-block-entries-for-spoofed-senders) later in this article. By default, allow entries for domains and email addresses exist for 30 days. During those 30 days, Microsoft learns from the allow entries and [removes them or automatically extends them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those entities are delivered, unless something else in the message is detected as malicious. By default, allow entries for spoofed senders never expire. -#### Use the Microsoft 365 Defender portal to create block entries for domains and email addresses in the Tenant Allow/Block List --Email messages from these senders are marked as *high confidence spam* (SCL = 9). What happens to the messages is determined by the [anti-spam policy](anti-spam-policies-configure.md) that detected the message for the recipient. For more information, see the **Spam** detection action in [EOP anti-spam policy settings](recommended-settings-for-eop-and-office365.md#eop-anti-spam-policy-settings). +Email from these blocked senders is marked as *high confidence spam* (SCL = 9). What happens to the messages is determined by the [anti-spam policy](anti-spam-policies-configure.md) that detected the message for the recipient. For more information, see the **Spam** detection action in [EOP anti-spam policy settings](recommended-settings-for-eop-and-office365.md#eop-anti-spam-policy-settings). > [!NOTE] > Users in the organization also can't *send* email to these blocked domains and addresses. The message is returned in the following non-delivery report (also known as an NDR or bounce message): `550 5.7.703 Your message can't be delivered because one or more recipients are blocked by your organization's tenant recipient block policy.` The entire message is blocked for all *external* recipients of the message, even if only one recipient email address or domain is defined in the block entry. +#### Use the Microsoft 365 Defender portal to create block entries for domains and email addresses in the Tenant Allow/Block List + 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>. 2. On the **Tenant Allow/Block Lists** page, verify that the **Domains & addresses** tab is selected. For detailed syntax and parameter information, see [Remove-TenantAllowBlockListI ## Spoofed senders in the Tenant Allow/Block List -When you override the verdict in the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md), the spoofed sender becomes a manual allow or block entry that only appears on the **Spoofed senders** tab in the Tenant Allow/Block List. +When you override the verdict in the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md), the spoofed sender becomes a manual allow or block entry that only appears on the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page. ### Create allow entries for spoofed senders -To create allow entries for spoofed senders, use either of the following methods: +To create allow entries for *spoofed senders*, use any of the following methods: -- From the **Emails** tab on the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=email>. When you submit a message that was blocked by [spoof intelligence](anti-spoofing-spoof-intelligence.md) as **Should not have been blocked (False positive)**, an allow entry for the spoofed sender is added to the **Spoofed senders** tab in the Tenant Allow/Block List. For instructions, see [Submit good email to Microsoft](submissions-admin.md#report-good-email-to-microsoft).+- From the **Emails** tab on the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=email>. For instructions, see [Submit good email to Microsoft](submissions-admin.md#report-good-email-to-microsoft). + - When you submit a message that was detected and blocked by [spoof intelligence](anti-spoofing-spoof-intelligence.md), an allow entry for the spoofed sender is added to the **Spoofed senders** tab in the Tenant Allow/Block List. + - If the sender wasn't detected and blocked by spoof intelligence, submitting the message to Microsoft doesn't create an allow entry for the sender in the Tenant Allow/Block List. +- From the **Spoof intelligence insight** page at <https://security.microsoft.com/spoofintelligence> *if* the sender was detected and blocked by spoof intelligence. For instructions, see [Override the spoof intelligence verdict](anti-spoofing-spoof-intelligence.md#override-the-spoof-intelligence-verdict). + - When you override the verdict in the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md), the spoofed sender becomes a manual entry that appears only on the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page. - From the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page or in PowerShell as described in this section. > [!NOTE] To create allow entries for spoofed senders, use either of the following methods > > Only the combination of the spoofed user *and* the sending infrastructure as defined in the [domain pair](#domain-pair-syntax-for-spoofed-sender-entries) is allowed to spoof. >-> When you configure an allow entry for a domain pair, the spoofed sender becomes a manual allow entry that appears only on the **Spoofed senders** tab in the Tenant Allow/Block List. -> > Allow entries for spoofed senders never expire.-> -> If the sender wasn't blocked by spoof intelligence, submitting the message to Microsoft doesn't create an allow entry for the sender in the Tenant Allow/Block List. #### Use the Microsoft 365 Defender portal to create allow entries for spoofed senders in the Tenant Allow/Block List New-TenantAllowBlockListSpoofItems -Identity Default -Action Allow -SendingInfra For detailed syntax and parameter information, see [New-TenantAllowBlockListSpoofItems](/powershell/module/exchange/new-tenantallowblocklistspoofitems). -### Use the Microsoft 365 Defender portal to create block entries for spoofed senders in the Tenant Allow/Block List +### Create block entries for spoofed senders -You can create block entries for spoofed senders directly in the Tenant Allow/Block List. The steps are nearly identical to [creating allow entries for spoofed senders](#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-spoofed-senders-in-the-tenant-allowblock-list) as previously described in this article. +To create block entries for *spoofed senders*, use any of the following methods: -The only difference is: for the **Action** value in Step 4, select **Block** instead of **Allow**. +- From the **Emails** tab on the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=email>. For instructions, see [Report questionable email to Microsoft](submissions-admin.md#report-questionable-email-to-microsoft). +- From the **Spoof intelligence insight** page at <https://security.microsoft.com/spoofintelligence> *if* the sender was detected and allowed by spoof intelligence. For instructions, see [Override the spoof intelligence verdict](anti-spoofing-spoof-intelligence.md#override-the-spoof-intelligence-verdict). + - When you override the verdict in the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md), the spoofed sender becomes a manual entry that appears only on the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page. +- From the **Spoofed senders** tab on the **Tenant Allow/Block Lists** page or in PowerShell as described in this section. > [!NOTE]-> Email messages from these senders are marked as *phishing*. What happens to the messages is determined by the [anti-spam policy](anti-spam-policies-configure.md) that detected the message for the recipient. For more information, see the **Phishing** detection action in [EOP anti-spam policy settings](recommended-settings-for-eop-and-office365.md#eop-anti-spam-policy-settings). >-> Only the combination of the spoofed user *and* the sending infrastructure as defined in the [domain pair](#domain-pair-syntax-for-spoofed-sender-entries) is blocked from spoofing. +> Only the combination of the spoofed user *and* the sending infrastructure defined in the [domain pair](#domain-pair-syntax-for-spoofed-sender-entries) is blocked from spoofing. +> +> Email from these senders is marked as *phishing*. What happens to the messages is determined by the [anti-spam policy](anti-spam-policies-configure.md) that detected the message for the recipient. For more information, see the **Phishing** detection action in [EOP anti-spam policy settings](recommended-settings-for-eop-and-office365.md#eop-anti-spam-policy-settings). > > When you configure a block entry for a domain pair, the spoofed sender becomes a manual allow entry that appears only on the **Spoofed senders** tab in the Tenant Allow/Block List. > > Block entries for spoofed senders never expire. -#### Use PowerShell to create block entries for spoofed senders in the Tenant Allow/Block List +#### Use the Microsoft 365 Defender portal to create block entries for spoofed senders in the Tenant Allow/Block List ++The steps are nearly identical to [creating allow entries for spoofed senders](#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-spoofed-senders-in-the-tenant-allowblock-list) as previously described in this article. ++The only difference is: for the **Action** value in Step 4, select **Block** instead of **Allow**. ++##### Use PowerShell to create block entries for spoofed senders in the Tenant Allow/Block List In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax: |
| security | Tenant Wide Setup For Increased Security | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-wide-setup-for-increased-security.md | To automate your setup of Microsoft Defender for Office 365 visit the Standard a |Area|Default policy?|Recommendation| ||||-|**Anti-phishing**|Yes|Configure the default anti-phishing policy as described here: [Configure anti-phishing protection settings in EOP and Defender for Office 365](protect-against-threats.md#part-2anti-phishing-protection-in-eop-and-defender-for-office-365). <p> More information: <ul><li>[Anti-phishing policies in Microsoft 365](anti-phishing-policies-about.md)</li><li>[Recommended anti-phishing policy settings in Microsoft Defender for Office 365](recommended-settings-for-eop-and-office365.md#anti-phishing-policy-settings-in-microsoft-defender-for-office-365)</li><li> [Impersonation insight](anti-phishing-mdo-impersonation-insight.md)</li><li>[Spoof intelligence insight in EOP](anti-spoofing-spoof-intelligence.md)</li><li>[Manage the Tenant Allow/Block List](tenant-allow-block-list-about.md).</li></ul>| +|**Anti-phishing**|Yes|Configure the default anti-phishing policy as described here: [Configure anti-phishing protection settings in EOP and Defender for Office 365](protect-against-threats.md#part-2anti-phishing-protection-in-eop-and-defender-for-office-365). <p> More information: <ul><li>[Anti-phishing policies in Microsoft 365](anti-phishing-policies-about.md)</li><li>[Recommended anti-phishing policy settings in Microsoft Defender for Office 365](recommended-settings-for-eop-and-office365.md#anti-phishing-policy-settings-in-microsoft-defender-for-office-365)</li><li> [Impersonation insight](anti-phishing-mdo-impersonation-insight.md)</li><li>[Spoof intelligence insight in EOP](anti-spoofing-spoof-intelligence.md)</li><li>[Spoofed senders in the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#spoofed-senders-in-the-tenant-allowblock-list).</li></ul>| |**Anti-Malware Engine**|Yes|Configure the default anti-malware policy as described here: [Configure anti-malware protection settings in EOP](protect-against-threats.md#part-1anti-malware-protection-in-eop). <p> More information: <ul><li>[Anti-malware protection](anti-malware-protection-about.md)</li><li>[Recommended anti-malware policy settings](recommended-settings-for-eop-and-office365.md#eop-anti-malware-policy-settings)</li><li>[Configure anti-malware policies](anti-malware-policies-configure.md)</li></ul>| |**Safe Attachments in Defender for Office 365**|No|Configure the global settings for Safe Attachments and create a Safe Attachments policy as described here: [Configure Safe Attachments settings in Microsoft Defender for Office 365](protect-against-threats.md#safe-attachments-policies-in-microsoft-defender-for-office-365). <p> More information: <ul><li>[Recommended Safe Attachments settings](recommended-settings-for-eop-and-office365.md#safe-attachments-settings)</li><li>[Safe Attachments in Microsoft Defender for Office 365](safe-attachments-about.md)</li><li>[Set up Safe Attachments policies](safe-attachments-policies-configure.md)</li><li>[Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](safe-attachments-for-spo-odfb-teams-about.md)</li><li>[Safe Documents in Microsoft 365 E5](safe-documents-in-e5-plus-security-about.md)</li></ul>| |**Safe Links in Microsoft Defender for Office 365**|No|Create a Safe Links policy as described here: [Configure Safe Links settings in Microsoft Defender for Office 365](protect-against-threats.md#safe-links-policies-in-microsoft-defender-for-office-365). <p> More information: <ul><li>[Safe Links policy settings](recommended-settings-for-eop-and-office365.md#safe-links-policy-settings)</li><li>[Set up Safe Links policies](safe-links-policies-configure.md)</li><li>[Safe Links in Microsoft Defender for Office 365](safe-links-about.md)</li></ul>| |
| security | Try Microsoft Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/try-microsoft-defender-for-office-365.md | The settings are also described in the following tables. |EnableForInternalSenders|False| |EnableOrganizationBranding|False| |EnableSafeLinksForEmail|True|-|EnableSafeLinksForOffice|False| -|EnableSafeLinksForTeams|False| +|EnableSafeLinksForOffice|True| +|EnableSafeLinksForTeams|True| |IsBuiltInProtection|False| |LocalizedNotificationTextList|{}| |RecommendedPolicyType|Evaluation| |
| syntex | Adoption Scenarios | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/adoption-scenarios.md | When you automate this scenario, you can ensure that: - The number of manual reminders is reduced. - The number of fines for non-compliance is reduced. >-## See also --[Get started driving adoption of Microsoft Syntex](adoption-getstarted.md) --[Manage contracts using a Microsoft 365 solution](solution-manage-contracts-in-microsoft-365.md) |
| syntex | Create Local Model | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/create-local-model.md | description: Learn how to create a local model on a local SharePoint site with M Microsoft Syntex provides an option to create and train models locally on your own SharePoint site. These models can be used only on the site where they're created. > [!NOTE]-> If you want to make your model discoverable and available for other users, you need to create an *enterprise model*. An enterprise model is a model that is created and trained in the [content center](create-a-content-center.md). +> If you want to make your model discoverable and available for other users, you need to [create an enterprise model](create-syntex-model.md). An enterprise model is a model that is created and trained in the [content center](create-a-content-center.md). Currently, information about [model usage analytics](model-usage-analytics.md) is only available for enterprise models. By activating document classification and extraction on your SharePoint site, Syntex lets you classify files in document libraries, extract information from new files, and automate activities based on extracted information. |
| syntex | Delete A Model | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/delete-a-model.md | description: Learn how to delete a model in Microsoft Syntex. <sup>**Applies to:**   ✓ All custom models   |   ✓ All prebuilt models</sup> -At some point, you might want to delete a model. Before you delete the model, you must first remove the model from all of the SharePoint document libraries where it has been applied. +At some point, you might want to delete a Syntex model if it's no longer being used, if it contains inaccurate or outdated information, or if it's taking up too much storage space. -## Remove a model from a library +> [!NOTE] +> Deleting a model doesn't delete the associated content type. -You can remove a model from a document library either from the model home page, or from the document library (**Automate** > **View applied models** > **Remove from library**). +## Delete a model from the model home page -> [!NOTE] -> Deleting a model does not delete the associated content type. +This is the easiest method to use to delete a model. It deletes the model and automatically removes it from all of the document libraries where it has been applied. -## Delete a model +1. On the home page of the model, select **Model settings**. -Follow these steps to delete a model. +  -1. Make sure the model has been [removed](#remove-a-model-from-a-library) from its document library. - -2. From the content center, select **Models** to see your models list. +2. On the **Model settings** panel, at the bottom of the panel, select **Delete model**. ++  ++3. To confirm you want to delete the model, on the **Delete** screen, select **Delete**. ++  -3. On the **Models** page, select the model you want to delete. + > [!NOTE] + > For freeform and structured models, this action doesn't delete the model in AI Builder. It only deletes it from the SharePoint document library in Syntex. ++## Delete a model from the Models library ++You can also delete a model from the **Models** library. However, before you delete the model, you must first remove the model from all of the document libraries where it has been applied. ++1. Remove the model either from the model home page or from the document library by selecting **Automate** > **View applied models** > **Remove from library**. ++ > [!NOTE] + > If you try to delete a model that has been applied to one or more libraries, you will receive an error message indicating that you must first remove it from all libraries to which it's been applied. + +2. From the **Models** library, select the model you want to delete. -4. By using either the ribbon or the **Show actions** button (next to the model name), select **Delete**. +3. By using either the ribbon or the **Show actions** button (next to the model name), select **Delete**.  -5. On the **Delete model** panel, select **Delete**. +4. To confirm you want to delete the model, on the **Delete** screen, select **Delete**. -## See also -[Rename a model](rename-a-model.md) |
| syntex | Requirements And Limitations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/requirements-and-limitations.md | Prebuilt models: | Icon | Description | | - | - | |  | **Supported languages** <br>This model supports all of the Latin-based languages, including: English, French, German, Italian, and Spanish. | +|  | **Supported languages** <br>This model supports any language that uses the Latin character set (for example, English, French, German, Italian, and Spanish). | |  | **OCR considerations** <br>This model uses optical character recognition (OCR) technology to scan .pdf files, image files, and .tiff files. OCR processing works best on documents that meet the following requirements: <br> - File format of .jpg, .png, or .pdf (text or scanned). Text-embedded .pdf files are better, because there won't be any errors in character extraction and location. <br> - If your .pdf files are password-locked, you must remove the lock before submitting them. <br> - The combined file size of the documents used for training per collection must not exceed 50 MB, and PDF documents shouldn't have more than 500 pages. <br> - For images, dimensions must be between 50 x 50 and 10,000 x 10,000 pixels. Images that are very wide or have odd dimensions (for example, floor plans) might get truncated in the OCR process and lose accuracy. <br> - For .pdf files, dimensions must be at most 11 x 17 inches, corresponding to Legal or A3 paper sizes and smaller. <br> - If scanned from paper documents, scans should be high-quality images. <br> - Must use the Latin alphabet (English characters). <br> Note the following differences about Microsoft Office text-based files and OCR-scanned files (.pdf, image, or .tiff): <br> - All files: Truncated at 64,000 characters (in training and when run against files in a document library). <br> - OCR-scanned files: There's a 500-page limit. Only PDF and image file types are processed by OCR. | |  | **Multi-Geo environments** <br>When setting up Syntex in a [Microsoft 365 Multi-Geo](/microsoft-365/enterprise/microsoft-365-multi-geo) environment, you can only configure it to use the model type in the central location. If you want to use this model type in a satellite location, contact Microsoft support. | |  | **Multi-model libraries** <br>If two or more trained models are applied to the same library, the file is classified using the model that has the highest average confidence score. The extracted entities will be from the applied model only. | Prebuilt models: | Icon | Description | | - | - | |  | **Supported file types** <br>This model supports the following file types: .bmp, .jpeg, .pdf, .png, and .tiff. |-|  | **Supported languages** <br>This model supports only English language contracts from the United States. | +|  | **Supported languages** <br>This model supports only English language contracts. | |  | **OCR considerations** <br>This model uses optical character recognition (OCR) technology to scan .pdf files, image files, and .tiff files. OCR processing works best on documents that meet the following requirements: <br> - File format of .jpg, .png, or .pdf (text or scanned). Text-embedded .pdf files are better, because there won't be any errors in character extraction and location. <br> - For .pdf and .tiff files, up to 2,000 pages can be processed. <br> - The file size must be less than 50 MB. <br> - For images, dimensions must be between 50 x 50 and 10,000 x 10,000 pixels. <br> - For .pdf files, dimensions must be at most 11 x 17 inches, corresponding to Legal or A3 paper sizes and smaller. <br> - The total size of the training data is 500 pages or less. <br> Note the following differences about Microsoft Office text-based files and OCR-scanned files (.pdf, image, or .tiff): <br> - Office files: Truncated at 64,000 characters (in training and when run against files in a document library). <br> - OCR-scanned files: There's a 20-page limit.| |  | **Multi-Geo environments** <br>When setting up Syntex in a [Microsoft 365 Multi-Geo](/microsoft-365/enterprise/microsoft-365-multi-geo) environment, you can only configure it to use the model type in the central location. If you want to use this model type in a satellite location, contact Microsoft support. | |  | **Multi-model libraries** <br>If two or more trained models are applied to the same library, the file is classified using the model that has the highest average confidence score. The extracted entities will be from the applied model only. | Prebuilt models: | Icon | Description | | - | - | |  | **Supported file types** <br>This model supports the following file types: .bmp, .jpeg, .pdf, .png, and .tiff. |-|  | **Supported languages** <br>This model supports only English language invoices from the United States. | +|  | **Supported languages** <br>This model supports invoices in English, Spanish, German, French, Italian, Portuguese, and Dutch. | |  | **OCR considerations** <br>This model uses optical character recognition (OCR) technology to scan .pdf files, image files, and .tiff files. OCR processing works best on documents that meet the following requirements: <br> - File format of .jpg, .png, or .pdf (text or scanned). Text-embedded .pdf files are better, because there won't be any errors in character extraction and location. <br> - For .pdf and .tiff files, up to 2,000 pages can be processed. <br> - The file size must be less than 50 MB. <br> - For images, dimensions must be between 50 x 50 and 10,000 x 10,000 pixels. <br> - For .pdf files, dimensions must be at most 11 x 17 inches, corresponding to Legal or A3 paper sizes and smaller. <br> - The total size of the training data is 500 pages or less. <br> Note the following differences about Microsoft Office text-based files and OCR-scanned files (.pdf, image, or .tiff): <br> - Office files: Truncated at 64,000 characters (in training and when run against files in a document library). <br> - OCR-scanned files: There's a 20-page limit.| |  | **Multi-Geo environments** <br>When setting up Syntex in a [Microsoft 365 Multi-Geo](/microsoft-365/enterprise/microsoft-365-multi-geo) environment, you can only configure it to use the model type in the central location. If you want to use this model type in a satellite location, contact Microsoft support. | |  | **Multi-model libraries** <br>If two or more trained models are applied to the same library, the file is classified using the model that has the highest average confidence score. The extracted entities will be from the applied model only. | Prebuilt models: | Icon | Description | | - | - | |  | **Supported file types** <br>This model supports the following file types: .bmp, .jpeg, .pdf, .png, and .tiff. |-|  | **Supported languages** <br>This model supports English sales receipts from Australia, Canada, Great Britain, India, and the United States. | +|  | **Supported languages** <br>This model supports sales in English, Croation, Czech, Danish, Dutch, Finnish, German, Hungarian, Italian, Japanese, Latvian, Lithuanian, Norwegian, Portuguese, Spanish, Swedish, and Vietnamese. | |  | **OCR considerations** <br>This model uses optical character recognition (OCR) technology to scan .pdf files, image files, and .tiff files. OCR processing works best on documents that meet the following requirements: <br> - File format of .jpg, .png, or .pdf (text or scanned). Text-embedded .pdf files are better, because there won't be any errors in character extraction and location. <br> - For .pdf and .tiff files, up to 2,000 pages can be processed. <br> - The file size must be less than 50 MB. <br> - For images, dimensions must be between 50 x 50 and 10,000 x 10,000 pixels. <br> - For .pdf files, dimensions must be at most 11 x 17 inches, corresponding to Legal or A3 paper sizes and smaller. <br> - The total size of the training data is 500 pages or less. <br> Note the following differences about Microsoft Office text-based files and OCR-scanned files (.pdf, image, or .tiff): <br> - Office files: Truncated at 64,000 characters (in training and when run against files in a document library). <br> - OCR-scanned files: There's a 20-page limit.| |  | **Multi-Geo environments** <br>When setting up Syntex in a [Microsoft 365 Multi-Geo](/microsoft-365/enterprise/microsoft-365-multi-geo) environment, you can only configure it to use the model type in the central location. If you want to use this model type in a satellite location, contact Microsoft support. | |  | **Multi-model libraries** <br>If two or more trained models are applied to the same library, the file is classified using the model that has the highest average confidence score. The extracted entities will be from the applied model only. | |
| syntex | Scenario Generate Routine Documents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/scenario-generate-routine-documents.md | description: Learn how to use Microsoft Syntex to automatically generate routine Use the content assembly feature in Microsoft Syntex to create modern templates for files that need to be created on a regular basis. Files can then be generated based on these templates, either through manual request or through an automation. Features used:- - Content assembly + - Content assembly + - SharePoint lists - Power Automate :::column-end::: :::column span=""::: |
| syntex | Scenario Handle Incoming Documents | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/scenario-handle-incoming-documents.md | description: Learn how to use Microsoft Syntex to manage various incoming busine - Content assembly :::column-end::: :::column span="":::-  +  :::column-end::: :::row-end::: Taking this a little further, PowerApps can begin to list all the active tenants As part of annual verification of partners and vendors, W-9 forms and Certificates of Liability (CLIs) are sent in. These documents are reviewed and updates are made accordingly. Thousands of CLIs and W-9 forms are reviewed manually for changes and updates into the appropriate systems used for bids. -An improved process is required to do more with less. A Power Platform solution is created to extract attachments from incoming emails to save them to SharePoint. Syntex models are then created to identify and extract information from CLIs and W-9 forms, such as name, type of coverage, amount of coverage, date. Extracted information can be used to populate other applications used during construction proposals. +An improved process is required to do more with less. A Power Platform solution is created to extract attachments from incoming emails to save them to SharePoint. ++Syntex models are then created to identify and extract information from CLIs and W-9 forms, such as name, type of coverage, amount of coverage, date. Extracted information can be used to populate other applications used during construction proposals. <br> <br> |
| syntex | Scenario Organize Repositories | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/scenario-organize-repositories.md | description: Learn how to use Microsoft Syntex to manage and organize document l ## Policies and procedures -Your organization drafts and stores policies and procedures in a few large documents in SharePoint or several smaller documents, all in a document library that typically has a well-defined folder structure. Experienced users might know where the policy or procedure is they need to reference to do their job effectively. However, new users or users who donΓÇÖt regularly focus on a specific policy might not know where to look. +Your organization drafts and stores policies and procedures in a few large documents in SharePoint or several smaller documents, all in a document library that typically has a well-defined folder structure. -By using Syntex and the SharePoint term store, as policies are added to the library and processed Syntex can assign the correct term. Users are then able to filter or search using these terms, or thier synonyms. The terms can also be used to generate topics in Viva Topics. The Viva Topics curation AI will then generate topics for these terms and associate files tagged with the term. Instead of navigating a folder structure, users can then search for synonyms or alternate names as defined in the topic and see the appropriate policy or procedure. +Experienced users might know where the policy or procedure is they need to reference to do their job effectively. However, new users or users who donΓÇÖt regularly focus on a specific policy might not know where to look. ++By using Syntex and the SharePoint term store, as policies are added to the library and processed Syntex can assign the correct term. Users are then able to filter or search using these terms, or their synonyms. ++The terms can also be used to generate topics in Viva Topics. The Viva Topics curation AI will then generate topics for these terms and associate files tagged with the term. ++Instead of navigating a folder structure, users can then search for synonyms or alternate names as defined in the topic and see the appropriate policy or procedure. <br> |