| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Viva Goals Activity | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/activity-reports/viva-goals-activity.md | + + Title: "Microsoft 365 admin center Viva Goals activity reports" +++ Last updated : 06/09/2023+audience: Admin +++ms.localizationpriority: medium ++- Tier2 +- scotvorg +- M365-subscription-management +- Adm_O365 +- Adm_NonTOC ++search.appverid: +- BCS160 +- MET150 +- MOE150 +- GEA150 +description: "Learn how to get a Microsoft 365 Apps for usage report to learn more about user adoption of Viva Goals." +++# Microsoft 365 Reports in the admin center - Viva Goals activity ++The Microsoft 365 Reports dashboard shows you the activity overview across the products in your organization. It enables you to drill to individual product level reports to give you more granular insight about the activities within each product. Check out the [Reports overview topic](activity-reports.md). ++In the Viva Goals report, you can understand the activity of every Viva Goals user in your organization. It also helps you to understand the level of collaboration going on by looking at the active usage and number of OKRs created. ++## How do I get to the Viva Goals activity report? ++1. In the admin center, go to the **Reports**, and then select **Usage**. +2. Find **Viva Goals page**. ++## Interpret the Viva Goals report ++You can use this report to see the activity and usage of Viva Goals in your organization. You see the following summary charts in this report: +++**Active users** shows you the number of daily active users on each day over time. This includes Viva Goals on the web and Teams app usage. ++**Active self-service users** shows you the number of daily active users with self-service license each day over time. ++**Active users by client type** shows you the number of daily active users on each day over time, displayed by client type (Viva Goals for the Web, Viva Goals on Teams, Viva Goals on Azure DevOps, and more.) ++**User actions by activities** shows you the daily number of actions created or edited over time by Viva Goals users. This includes Viva Goals on all client types. ++**Active Viva Goals organizations** shows you the daily active organizations each day over time. This includes all the activities in a Viva Goals organization. ++The report also has a table that shows activity for each Viva Goals user in your organization. ++Select Choose Columns to add or remove columns from the table. +++You can also export the report data into an Excel .csv file by selecting the Export link. This exports the Viva Goals usage data of all users and enables you to do simple sorting and filtering for further analysis. ++The Viva Goals report can be viewed for trends over the last 7 days, 30 days, 90 days, or 180 days. If you select a particular day in the report, the per user data table will be updated accordingly to display users' usage on that day. However, this feature only works for the most recent 28 days. ++## User activity table ++|Item |Description | +||| +|User name |The user's principal name. | +|Display name |The full name of the user. | +|Last activity date |The latest date the user in that row had activity in Viva Goals, including any of the activities. | +|Is self-serve trial |Indicates whether the user has a self-serve trial license | +|Microsoft Teams |Indicates whether the user uses the Viva Goals app on Microsoft Teams | +|Slack |Indicates whether the user uses the Viva Goals integration on Slack | +|Azure DevOps |Indicates whether the user uses the Viva Goals integration on Azure DevOps | +|Web |Indicates whether the user uses Viva Goals on web | +|Check-ins |Number of check-ins done by the user on Viva Goals within the time range selected | +|OKRs created |Number of OKRs created by the user on Viva Goals within the time range selected | +|Projects created |Number of Projects created by the user on Viva Goals within the time range selected | +|OKR engagement |Number of reactions on the OKRs by the user on Viva Goals within the time range selected | +|Dashboards created |Number of Dashboards created by the user on Viva Goals within the time range selected | |
| admin | About Admin Roles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/about-admin-roles.md | f1.keywords: Previously updated : 02/18/2020 Last updated : 05/31/2023 audience: Admin Because admins have access to sensitive data and files, we recommend that you fo | Assign the *least permissive* role | Assigning the *least permissive* role means giving admins only the access they need to get the job done. For example, if you want someone to reset employee passwords you shouldn't assign the unlimited global admin role, you should assign a limited admin role, like Password admin or Helpdesk admin. | | Require multi-factor authentication for admins | It's actually a good idea to require MFA for all of your users, but admins should definitely be required to use MFA to sign in. MFA makes users use a second method of identification to verify their identity. Admins can have access to much of customer and employee data. If you require MFA, even if the admin's password gets compromised, the password is useless without the second method of identification. <br><br>When you turn on MFA, the next time the user signs in, they'll need to provide an alternate email address and phone number for account recovery. <br> [Set up multi-factor authentication](../security-and-compliance/set-up-multi-factor-authentication.md) | -If you get a message in the admin center that you don't have permissions to edit a setting or page, it's because you're assigned a role that doesn't have that permission. +If you get a message in the admin center that you don't have permissions to edit a setting or page, it's because you're assigned a role that doesn't have that permission. Talk to another admin to assign you the correct permissions or see [Assign admin roles](assign-admin-roles.md) to assign yourself the correct role. ## Commonly used Microsoft 365 admin center roles |
| admin | Give Mailbox Permissions To Another User | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/give-mailbox-permissions-to-another-user.md | description: "Give a Microsoft 365 user the right to access another user's mailb # Give mailbox permissions to another Microsoft 365 user - Admin help -As the admin, you may have company requirements to allow some users access to another user's mailbox. For example, you may want to enable an assistant to send or read email from their manager's mailbox, or one of your user's the ability to send email on behalf of another user. This topic shows you how to accomplish this. - +As the admin, you may have company requirements to allow some users access to another user's mailbox. For example, you may want to enable an assistant to send or read email from their manager's mailbox. Or you may want to give one of your users the ability to send email on behalf of another user. + If you're looking for information about creating and managing shared mailboxes, check out [Create a shared mailbox](../email/create-a-shared-mailbox.md). > [!TIP] > If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use.- -## Looking to set up mailbox permissions? -Mailbox permissions allow you to give read/write access to a mailbox to another user. The articles below might give you the help you need to set up and use this feature: +## Set up mailbox permissions - **Setting up the permissions:** - -The first step to setting up permissions is deciding which actions you want to allow the other user to take in the given mailbox. You can allow a user to read emails from the mailbox, send emails on behalf of another user, and send emails as if they were sent from that mailbox. Refer to the following articles on how to set up each type of permissions: +The first step to setting up permissions is deciding which actions you want to allow the other user to take in the given mailbox. You can allow a user to read emails from the mailbox, send emails on behalf of another user, and send emails as if they were sent from that mailbox. Permissions can only be set up within the current organization. It's not possible to set up mailbox permissions for users in another organization. Read the sections below for the task you want to complete: - [Read email from another user's mailbox](give-mailbox-permissions-to-another-user.md#read-email-in-another-users-mailbox)- + - [Send email from another user's mailbox](give-mailbox-permissions-to-another-user.md#send-email-from-another-users-mailbox) - [Send email on behalf of another user](give-mailbox-permissions-to-another-user.md#send-email-on-behalf-of-another-user)- - **Changing propagation:** - -Once you've set up the permissions, it can take up to 60 minutes for the changes to propagate through the system and be in effect. - - **How to use it once permissions are set up:** - -There are a few different ways you can access a mailbox once you've been given access. For help on this, refer to this article: [Access another person's mailbox](https://support.microsoft.com/office/A909AD30-E413-40B5-A487-0EA70B763081). > [!NOTE]-> The permissions can be set up only within the current organization tenant. It is not possible to set up mailbox permissions with out of tenant users. +> Once you've set up the permissions, it can take up to 60 minutes for the changes to propagate through the system and be in effect. + +### Access another person's mailbox + +There are a few different ways to access a mailbox once you've given permission and access. See the [Access another person's mailbox](https://support.microsoft.com/office/A909AD30-E413-40B5-A487-0EA70B763081) article for the steps. ## Send email from another user's mailbox ::: moniker range="o365-worldwide" 1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a> page. - + 2. Select the name of the user (from whom you plan to give a sending permission) to open their properties pane.- -3. On the **Mail** tab, select **Manage mailbox permissions**. -4. Next to **Send as**, select **Edit**. +3. On the **Mail** tab, select **Send as permissions**. ++4. Select **Add permissions**, then choose the name of the person who you want this user to be able to send as. ++5. Select **Add**. -5. Select **Add permissions**, then choose the name of the person who you want this user to be able to send as. - -6. Select **Add**. - ::: moniker-end ::: moniker range="o365-21vianet" -1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=850628" target="_blank">Active users</a> page. +1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=850628" target="_blank">Active users</a> page. 2. Select the user you want, expand **Mail Settings**, and then Select **Edit** next to **Mailbox permissions**. -3. Next to **Send as**, select **Edit**. +3. Next to **Send as**, select **Edit**. ++4. Select **Add permissions**, then choose the name of the person who you want this user to be able to send as. -4. Select **Add permissions**, then choose the name of the person who you want this user to be able to send as. - 5. Select **Add**. ::: moniker-end There are a few different ways you can access a mailbox once you've been given a ::: moniker range="o365-worldwide" 1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a> page. - + 2. Select the name of the user (whose mailbox you want to allow to be read) to open their properties pane.- -3. On the **Mail** tab, select **Manage mailbox permissions**. - -4. Next to **Read and manage**, select **Edit**. - -5. Select **Add permissions**, then choose the name of the user or users that you want to allow to read email from this mailbox. -6. Select **Add**. +3. On the **Mail** tab, select **Read and manage permissions**. +4. Select **Add permissions**, then choose the name of the user or users that you want to allow to read email from this mailbox. ++5. Select **Add**. > [!NOTE] > **Read** and **Manage** permissions are called **Full Access** permission when granted in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a>. This permission allows the assigned user mailbox to read as well as manage emails in the user mailbox on which the permission is assigned. Full Access permission does not grant **Send as** or **Send on behalf** permissions. There are a few different ways you can access a mailbox once you've been given a ::: moniker-end - ## Send email on behalf of another user ::: moniker range="o365-worldwide" There are a few different ways you can access a mailbox once you've been given a 1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a> page. 2. Select the name of the user (from whom you plan to give a **Send on behalf** permission) to open their properties pane.- -3. On the **Mail** tab, select **Manage mailbox permissions**. - -4. Next to **Send on behalf**, select **Edit**. -5. Select **Add permissions**, then choose the name of the user or users that you want to allow to send email on behalf of this mailbox. +3. On the **Mail** tab, select **Send on behalf of permissions**. -6. Select **Add**. +4. Select **Add permissions**, then choose the name of the user or users that you want to allow to send email on behalf of this mailbox. ++5. Select **Add**. ::: moniker-end ::: moniker range="o365-21vianet" -1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=850628" target="_blank">Active users</a> page. +1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=850628" target="_blank">Active users</a> page. 2. Select the user you want, expand **Mail Settings**, and then select **Edit** next to **Mailbox permissions**. 3. Next to **Send on behalf**, select **Edit**.- + 4. Select **Add permissions**, then choose the name of the user or users that you want to allow to send email on behalf of this mailbox. 5. Select **Add**. |
| compliance | Compliance Easy Trials Compliance Manager Assessments | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-easy-trials-compliance-manager-assessments.md | f1.keywords: Previously updated : 10/28/2021 Last updated : 06/14/2023 audience: Admin description: "Learn how to join the Microsoft Purview Compliance Manager premium # About the free trial for Microsoft Purview Compliance Manager premium assessments -Compliance Manager helps you manage your organizationΓÇÖs compliance requirements and assess and improve your compliance score. The assessments you build are based on templates that correspond to governmental regulations and industry standards around the world. +Compliance Manager helps you automatically assess and manage compliance across your multicloud environment. The assessments you build are based on templates that correspond to governmental regulations and industry standards around the world. -Your licensing agreement to use Compliance Manager may include one or more built-in templates for building assessments. An extensive library of premium assessment templates is also available for building assessments specific to your organizationΓÇÖs needs. To try out these templates before purchasing licenses, sign up for the free Compliance Manager premium assessments trial. +Your licensing agreement to use Compliance Manager may include one or more built-in regulatory templates for building assessments. An extensive library of premium regulations is also available for building assessments specific to your organizationΓÇÖs needs. To try out these regulatory templates before purchasing licenses, sign up for the free Compliance Manager premium assessments trial. [!INCLUDE [purview-preview](../includes/purview-preview.md)] See the [terms and conditions](/legal/microsoft-365/microsoft-365-trial) for Mic ## Set up a premium assessments trial -You can sign up for a trial in the Microsoft Purview compliance portal using the **Trials** link in the left navigation pane. Select the **Compliance Manager premium assessment trial** to start a trial for premium assessment templates. --This premium assessment trial is available to organizations using Compliance Manager under a commercial license. For GCC and DOD information and trial options, see [Working with Compliance Manager templates](compliance-manager-templates.md). +You can sign up for a trial in the Microsoft Purview compliance portal using the **Trials** link in the left navigation pane. Select the **Compliance Manager premium assessment trial** to start the trial. This premium assessment trial is available to organizations using Compliance Manager under a commercial license. For GCC and DOD information and trial options, see [Working with Compliance Manager templates](compliance-manager-templates.md). Full access to Compliance Manager features may depend on your licensing agreement for Compliance Manager. To learn more about the free compliance trial that includes Compliance Manager, see [About the free trial for Microsoft Purview](compliance-easy-trials.md). Full access to Compliance Manager features may depend on your licensing agreemen ## Template licensing -Starting your one-time trial for premium assessments gives you the right to use 25 premium templates of your choice for free for 90 days. You can create as many assessments from the 25 templates as you wish. --After you start your trial, go to your **Assessments** tab in Compliance Manager and view the **Activated/Licensed templates** counter to see how many templates are available and are in use. This counter will show your 25 licensed templates. As you create assessments using these templates, your activated number will update. Template use is counted based on the underlying certification, meaning that multiple assessments based on the same template, or different versions of the same template that support different products, will count as one template use. +Starting your one-time trial for premium assessments gives you the right to use 25 premium regulatory templates of your choice for free for 90 days. You can create as many assessments from the 25 templates as you wish. -For more information about how to use and manage Compliance Manager templates, see [Working with assessment templates](compliance-manager-templates.md). +After you start your trial, go to your **Assessments** tab in Compliance Manager and view the **Activated/Regulations** counter to see how many regulation templates are available and are in use. This counter shows your 25 licensed regulatory templates. As you create assessments for these regulations, your activated number updates. Multiple assessments based on the same regulation count as one regulatory template use. For more information, see [Learn about regulations in Compliance Manager](compliance-manager-templates.md). ## Required roles for starting the trial Get more details about [roles for starting Microsoft 365 trials](compliance-easy ## During your trial -Throughout your trial, you can review the **Trial summary** section of the **Overview** page in Compliance Manager to see how many assessments youΓÇÖve created, how many improvement actions youΓÇÖve taken, how that has contributed to your compliance score, and how much time remains in your trial. From here, you can also review the list of available templates and learn more about purchasing them for ongoing use. +Throughout your trial, you can review the **Trial summary** section of the **Overview** page in Compliance Manager to see how many assessments youΓÇÖve created, how many improvement actions youΓÇÖve taken, how that has contributed to your compliance score, and how much time remains in your trial. From here, you can also review the list of available regulations and learn more about purchasing them for ongoing use. ## After the trial -After your trial ends, the templates you used won't receive automatic updates and may fall out of date with any regulatory changes. We recommend that you delete assessments built from templates that you donΓÇÖt intend to purchase. +After your trial ends, the regulatory templates you used won't receive automatic updates and may fall out of date with any regulatory changes. We recommend that you delete assessments built from regulatory templates that you donΓÇÖt intend to purchase. ## Learn more and explore other trials |
| compliance | Compliance Manager Glossary | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-manager-glossary.md | f1.keywords: Previously updated : 05/16/2023 Last updated : 06/14/2023 audience: Admin This glossary provides a brief description of important terms and concepts in th | **Improvement action**| A compliance activity with recommended implementation instructions, intended to help towards completion of a control. | | **License** | In the context of Compliance Manager regulations: A single Compliance Manager license allows you to create an unlimited number of assessments for multiple versions of a regulation. | | **Regulation**| A rule or requirement imposed by a governing authority, such as a government agency, to achieve a specific purpose. Also commonly understood as a standard or framework. Compliance Manager supports several industry regulations, providing over 360 regulatory templates for building assessments. |-| **Service**| A data source, such as Microsoft Azure or Amazon Web Services (AWS); or more broadly, the digital entity thatΓÇÖs being assessed and that benefits from the actions taken. For an assessment, you designate the service that it should evaluate. Completing an improvement action in the assessment will benefit the service. | -| **Service instance**| For Compliance Manager connectors, each service instance represents an account with a non-Microsoft service provider. For example, an organization may have multple accounts in Salesforce, such as one for development and testing, one for prodcution, etc. Connectors are set up for each service instance using one email address and password. So an organization may have several connectors for one service, which enables the organization to monitor assessment progress across all instances of a service. | +| **Service**| A data source, such as Microsoft Azure or Amazon Web Services (AWS); or more broadly, the digital entity thatΓÇÖs being assessed and that benefits from the actions taken. For an assessment, you designate the service that it should evaluate. Completing an improvement action in the assessment benefits the service. | +| **Service instance**| For Compliance Manager connectors, each service instance represents an account with a non-Microsoft service provider. For example, an organization may have multiple accounts in Salesforce, such as one for development and testing, one for production, etc. Connectors are set up for each service instance using one email address and password. So an organization may have several connectors for one service, which enables the organization to monitor assessment progress across all instances of a service. | | **Solution**| A feature or capability used to complete an improvement action. For example, a Microsoft product, such as Microsoft Data Loss Prevention, or a setting in a service like Azure or AWS. |-| **Subscription**| A type of account to create, assess, and manage a service coverd by Microsoft Defender for Cloud, such as Azure, Google Cloud Platform, or Amazon Web Services. Examples: an Azure account for development and testing purposes, an Azure account for production, etc. | +| **Subscription**| A type of account to create, assess, and manage a service covered by Microsoft Defender for Cloud, such as Azure, Google Cloud Platform, or Amazon Web Services. Examples: an Azure account for development and testing purposes, an Azure account for production, etc. | | **Virtual resources**| A cloud computing-based resource that is managed virtually, such as VMs and virtual storage disks. | |
| compliance | Dlp Create Deploy Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-create-deploy-policy.md | To configure a new DLP rule to generate a *block* popup using trusted domains ru ```powershell PS C:\> New-DlpComplianceRule -Name <DLP Rule Name> -Policy <DLP Policy Name> -NotifyUser Owner -NotifyPolicyTipDisplayOption "Dialog" -BlockAccess $true -ContentContainsSensitiveInformation @(@{operator = "And"; groups = @(@{operator = "Or"; name = "Default"; labels = @(@{name=<Label GUID 1>;type="Sensitivity"},@{name=<Label GUID 2>;type="Sensitivity"})})}) -ExceptIfRecipientDomainIs @("contoso.com","microsoft.com") ```++Use these procedures to access the [Business justification X-Header](dlp-policy-reference.md#business-justification-x-header). + ## Deployment A successful policy deployment isn't just about getting the policy into your environment to enforce controls on user actions. A haphazard, rushed deployment can negatively impact business process and annoy your users. Those consequences will slow acceptance of DLP technology in your organization and the safer behaviors it promotes. Ultimately making your sensitive items less safe in the long run. |
| compliance | Dlp Learn About Dlp | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-learn-about-dlp.md | You can also view details of the associated event with rich metadata in the same > [!div class="mx-imgBorder"] >  -### Reports +### DLP Activity Explorer and reports -The [DLP reports](view-the-dlp-reports.md#view-the-reports-for-data-loss-prevention) show broad trends over time and give specific insights into: +The Activity explorer tab on the DLP page has the *Activity* filter preset to *DLPRuleMatch*. Use this tool to review activity related to content that contains sensitive info or has labels applied, such as what labels were changed, files were modified, and matched a rule. -- **DLP Policy Matches** over time and filter by date range, location, policy, or action-- **DLP incident matches** also shows matches over time, but pivots on the items rather than the policy rules.-- **DLP false positives and overrides** shows the count of false positives and, if configured, user-overrides along with the user justification.+<!----> -### DLP Activity Explorer +You can view the last 30 days of DLP information in [Activity Axplorer](data-classification-activity-explorer.md) using these preconfigured filters: -The Activity explorer tab on the DLP page has the *Activity* filter preset to *DLPRuleMatch*. Use this tool to review activity related to content that contains sensitive info or has labels applied, such as what labels were changed, files were modified, and matched a rule. +- Endpoint DLP activities +- Files containing sensitive info types +- Egress activities +- DLP policies that detected activities +- DLP policy rules that detected activities ++You can also access DLP report using via these cmdlets in the Security & Compliance PowerShell. ++1. [Connect to Security & Compliance PowerShell](/powershell/exchange/connect-to-scc-powershell) ++Use these cmdlets: ++[Get-DlpDetailReport](/powershell/module/exchange/get-dlpdetailreport) +[Get-DlpDetectionsReport](/powershell/module/exchange/get-dlpdetectionsreport) +[Get-DlpSiDetectionsReport](/powershell/module/exchange/get-dlpsidetectionsreport) ++However, DLP reports need pull data from across Microsoft 365, including Exchange Online. For this reason, the following cmdlets for DLP reports are available in Exchange Online Powershell. To use the cmdlets for these DLP reports, do these steps: ++1. [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) ++Use these cmdlets: ++[Get-DlpDetailReport](/powershell/module/exchange/get-dlpdetailreport) +[Get-MailDetailDlpPolicyReport](/powershell/module/exchange/get-maildetaildlppolicyreport) - #### Contextual summary |
| compliance | Dlp Owa Policy Tips | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-owa-policy-tips.md | f1.keywords: Previously updated : 05/24/2023 Last updated : 06/15/2023 audience: Admin search.appverid: MET150 description: "DLP policy tip reference for Outlook 2013 for Win32." Yes. > [!IMPORTANT]-> When emails are encrypted with Microsoft Purview Message Encryption and the policy used to detect them uses the detect encryption condition policy tips will not appear. +> +> - When emails are encrypted with Microsoft Purview Message Encryption and the policy used to detect them uses the detect encryption condition policy tips will not appear. +> - Poicy tips that rely on conditions which evaluate custom X-headers will not display for Outlook on the Web messages because the transport service on the mailbox servers insert custom X-header values after the policy tips are evaluated. ## Email notification supported for Outlook on the Web |
| compliance | Dlp Policy Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-policy-reference.md | Unrestricted policies are created and managed by users in these role groups: See, [Permissions](dlp-create-deploy-policy.md#permissions) for more details. -Unrestricted administrators can manage all policies and see all the alerts and events that flow from policy matches into the [Alerts dashboard](dlp-alerts-dashboard-learn.md#learn-about-the-data-loss-prevention-alerts-dashboard) and [DLP Activity Explorer](dlp-learn-about-dlp.md#dlp-activity-explorer). +Unrestricted administrators can manage all policies and see all the alerts and events that flow from policy matches into the [Alerts dashboard](dlp-alerts-dashboard-learn.md#learn-about-the-data-loss-prevention-alerts-dashboard) and [DLP Activity Explorer](dlp-learn-about-dlp.md#dlp-activity-explorer-and-reports). ### Administrative Unit restricted policies (preview) The intent of **User overrides** is to give users a way to bypass, with justific Typically, user overrides are useful when your organization is first rolling out a policy. The feedback that you get from any override justifications and identifying false positives helps in tuning the policy. -<!-- This section covers what they are and how to best use them in conjunction with Test/Turn it on right away and link out to where to find the business justification for the override (DLP reports? /microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide) /microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide#view-the-justification-submitted-by-a-user-for-an-override--> - - If the policy tips in the most restrictive rule allow people to override the rule, then overriding this rule also overrides any other rules that the content matched. -<!----> --To learn more about user overrides, see: --- [View the justification submitted by a user for an override](view-the-dlp-reports.md#view-the-justification-submitted-by-a-user-for-an-override)- #### Business justification X-Header -When a user overrides a block with override action on an email, the override option and the text that they provide are stored in the [Audit log](/microsoft-365/compliance/audit-solutions-overview.md) and in the email X-header. To view the business justification overrides, open the [DLP false positives and overrides report](/microsoft-365/compliance/view-the-dlp-reports#view-the-justification-submitted-by-a-user-for-an-override) or you can [search the audit log in the compliance portal](audit-log-search.md) for `ExceptionInfo` value for the details. Here's an example of the audit log values: +When a user overrides a block with override action on an email, the override option and the text that they provide are stored in the [Audit log](/microsoft-365/compliance/audit-solutions-overview.md) and in the email X-header. To view the business justification overrides [search the audit log in the compliance portal](audit-log-search.md) for `ExceptionInfo` value for the details. Here's an example of the audit log values: ```xml { "FalsePositive"; false, If you have an automated process that makes use of the business justification va ### Incident reports -<!--DLP interacts with other M365 information protection services, like IR. Link this to a process outline for triaging/managing/resolving DLP incidents --/microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide -/microsoft-365/compliance/dlp-configure-view-alerts-policies?view=o365-worldwide--> - When a rule is matched, you can send an incident report to your compliance officer (or any people you choose) with details of the event. The report includes information about the item that was matched, the actual content that matched the rule, and the name of the person who last modified the content. For email messages, the report also includes the original message as an attachment that matches a DLP policy. DLP feeds incident information to other Microsoft Purview Information Protection services, like [insider risk management](insider-risk-management.md). In order to get incident information to insider risk management, you must set the **Incident reports** severity level to **High**. |
| compliance | Dlp Policy Tips Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-policy-tips-reference.md | f1.keywords: CSH Previously updated : 04/15/2021 Last updated : 06/15/2023 audience: Admin Custom sensitive information types will also be detected in addition to the abov |**App and platform**|**DLP policy tip support**|**Sensitive information types supported**|**Conditions and actions supported**|**Comments**| |:--|:--|:--|:--|:--|-|**Outlook On the Web**|:::image type="icon" source="../medi)| +|**Outlook On the Web**|:::image type="icon" source="../medi)| |**Outlook Win32 (ver. 2105 build 14026.20000 and semi-annual channel ver. 2102 build 13801.20862)**|:::image type="icon" source="../media/rightmrk.png" border="false":::|all SITS are supported for E5 users; pre-configured SITs and customer SITs are supported for E3 users|subset|See [Outlook 2013 and later supports showing policy tips for only some conditions](#outlook-2013-and-later-supports-showing-policy-tips-for-only-some-conditions) and [Outlook 2013 and later and Office apps on Desktop support showing policy tips for only some sensitive information types](#outlook-2013-and-later-and-office-apps-on-desktop-support-showing-policy-tips-for-only-some-sensitive-information-types) for details on support for sensitive information types and DLP conditions and actions supported for showing DLP policy tips on Outlook Win32.| |**Outlook Mobile (iOS, Android)/Outlook Mac**|:::image type="icon" source="../media/crsmrk.png" border="false":::|none|none|DLP policy tips aren't supported on Outlook mobile| |**Outlook Mac**|:::image type="icon" source="../media/crsmrk.png" border="false":::|none|none|DLP policy tips are not supported on Outlook for Mac| |
| compliance | Dlp Test Dlp Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-test-dlp-policies.md | You should test and tune the behavior of your Microsoft Purview Data Loss Preven ## Test mode -When you deploy a new policy, [you should run it in test mode,](dlp-overview-plan-for-dlp.md#policy-deployment) and then use the [view the reports for](view-the-dlp-reports.md) and any [alerts](dlp-alerts-dashboard-learn.md) to assess the impact. Test mode allows you to see the impact of an individual policy on all the items that are in the policies scope. You use it to find out what items match a policy. +When you deploy a new policy, [you should run it in test mode,](dlp-overview-plan-for-dlp.md#policy-deployment) and then use the [alerts](dlp-alerts-dashboard-learn.md) to assess the impact. Test mode allows you to see the impact of an individual policy on all the items that are in the policies scope. You use it to find out what items match a policy. ## Test-DlpPolicies (preview) |
| compliance | Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/encryption.md | f1.keywords: Previously updated : 8/15/2019 Last updated : 06/14/2023 audience: Admin -description: "With Office 365, your content is encrypted at rest and in transit with the strongest encryption, protocols, and technologies available. Get an overview of encryption in Office 365." +description: "With Microsoft 365, your content is encrypted at rest and in transit with the strongest encryption, protocols, and technologies available. Get an overview of encryption in Office 365." # Encryption -Encryption is an important part of your file protection and information protection strategy. This article provides an overview of encryption for Office 365. Get help with encryption tasks like how to set up encryption for your organization and how to password-protect Office documents. +Encryption is an important part of your file protection and information protection strategy. This article provides an overview of encryption for Microsoft 365. Get help with encryption tasks like how to set up encryption for your organization and how to password-protect Office documents. -- For information about certificates and technologies like TLS, see [Technical reference details about encryption in Office 365](technical-reference-details-about-encryption.md).+- For information about certificates and technologies like TLS, see [Technical reference details about encryption in Microsoft 365](technical-reference-details-about-encryption.md). -- For information about how to configure or set up encryption for your organization, see [Set up encryption in Office 365 Enterprise](set-up-encryption.md).+- For information about how to configure or set up encryption for your organization, see [Set up encryption in Microsoft 365 Enterprise](set-up-encryption.md). [!INCLUDE [purview-preview](../includes/purview-preview.md)] -## What is encryption, and how does it work in Office 365? +## What is encryption, and how does it work in Microsoft 365? The encryption process encodes your data (referred to as plaintext) into ciphertext. Unlike plaintext, ciphertext can't be used by people or computers unless and until the ciphertext is decrypted. Decryption requires an encryption key that only authorized users have. Encryption helps ensure that only authorized recipients can decrypt your content. Content includes files, email messages, calendar entries, and so on. You can have multiple layers of encryption in place at the same time. For exampl **Examples of data at rest** include files that you've uploaded to a SharePoint library, Project Online data, documents that you've uploaded in a Skype for Business meeting, email messages and attachments that you've stored in folders in your mailbox, and files you've uploaded to OneDrive for Business. - **Examples of data in transit** include mail messages that are in the process of being delivered, or conversations that are taking place in an online meeting. In Office 365, data is in transit whenever a user's device is communicating with a Microsoft server, or when a Microsoft server is communicating with another server. + **Examples of data in transit** include mail messages that are in the process of being delivered, or conversations that are taking place in an online meeting. In Microsoft 365, data is in transit whenever a user's device is communicating with a Microsoft server, or when a Microsoft server is communicating with another server. With Office 365, multiple layers and kinds of encryption work together to secure your data. The following table includes some examples, with links to additional information. |**Kinds of Content**|**Encryption Technologies**|**Resources to learn more**| |:--|:--|:--|-|Files on a device. These files can include email messages saved in a folder, Office documents saved on a computer, tablet, or phone, or data saved to the Microsoft cloud. <br/> |BitLocker in Microsoft datacenters. BitLocker can also be used on client machines, such as Windows computers and tablets <br/> Distributed Key Manager (DKM) in Microsoft datacenters <br/> Customer Key for Microsoft 365 <br/> |[Windows IT Center: BitLocker](/windows/device-security/bitlocker/bitlocker-overview) <br/> [Microsoft Trust Center: Encryption](https://www.microsoft.com/TrustCenter/Security/Encryption) <br/> [Cloud security controls series: Encrypting Data at Rest](https://blogs.microsoft.com/microsoftsecure/2015/09/10/cloud-security-controls-series-encrypting-data-at-rest) <br/> [How Exchange Online secures your email secrets](exchange-online-secures-email-secrets.md) <br/> [Service encryption with Customer Key](customer-key-overview.md) <br/> | -|Files in transit between users. These files can include Office documents or SharePoint list items shared between users. <br/> |TLS for files in transit <br/> |[Data Encryption in OneDrive for Business and SharePoint Online](data-encryption-in-odb-and-spo.md) <br/> [Skype for Business Online: Security and Archiving](/office365/servicedescriptions/skype-for-business-online-service-description/skype-for-business-online-features) <br/> | -|Email in transit between recipients. This email includes email hosted by Exchange Online. <br/> |Microsoft Purview Message Encryption with Azure Rights Management, S/MIME, and TLS for email in transit <br/> |[Message Encryption](ome.md) <br/> [Email encryption in Office 365](email-encryption.md) <br/> [How Exchange Online uses TLS to secure email connections in Office 365](exchange-online-uses-tls-to-secure-email-connections.md) <br/> | -|Chats, messages, and files in transit between recipients using Microsoft Teams. <br/> |Teams uses TLS and MTLS to encrypt instant messages. Media traffic is encrypted using Secure RTP (SRTP). Teams uses FIPS (Federal Information Processing Standard) compliant algorithms for encryption key exchanges. <br/> |[Encryption for Teams](/microsoftteams/teams-security-guide#encryption-for-teams) <br/> | +|Files on a device. These files can include email messages saved in a folder, Office documents saved on a computer, tablet, or phone, or data saved to the Microsoft cloud.|BitLocker in Microsoft datacenters. BitLocker can also be used on client machines, such as Windows computers and tablets<br/>Distributed Key Manager (DKM) in Microsoft datacenters<br/>Customer Key for Microsoft 365|[Windows IT Center: BitLocker](/windows/device-security/bitlocker/bitlocker-overview)<br/>[Microsoft Trust Center: Encryption](https://www.microsoft.com/TrustCenter/Security/Encryption)<br/>[Cloud security controls series: Encrypting Data at Rest](https://blogs.microsoft.com/microsoftsecure/2015/09/10/cloud-security-controls-series-encrypting-data-at-rest)<br/>[How Exchange Online secures your email secrets](exchange-online-secures-email-secrets.md)<br/>[Service encryption with Customer Key](customer-key-overview.md)| +|Files in transit between users. These files can include Office documents or SharePoint list items shared between users.|TLS for files in transit|[Data Encryption in OneDrive for Business and SharePoint Online](data-encryption-in-odb-and-spo.md)<br/>[Skype for Business Online: Security and Archiving](/office365/servicedescriptions/skype-for-business-online-service-description/skype-for-business-online-features)| +|Email in transit between recipients. This email includes email hosted by Exchange Online.|Microsoft Purview Message Encryption with Azure Rights Management, S/MIME, and TLS for email in transit|[Message Encryption](ome.md)<br/>[Email encryption in Office 365](email-encryption.md)<br/>[How Exchange Online uses TLS to secure email connections in Office 365](exchange-online-uses-tls-to-secure-email-connections.md)| +|Chats, messages, and files in transit between recipients using Microsoft Teams.|Teams uses TLS and MTLS to encrypt instant messages. Media traffic is encrypted using Secure RTP (SRTP). Teams uses FIPS (Federal Information Processing Standard) compliant algorithms for encryption key exchanges.|[Encryption for Teams](/microsoftteams/teams-security-guide#encryption-for-teams)| ++## Microsoft 365 Crypto Update ++In late August 2023, Microsoft Purview Information Protection will begin to use Advanced Encryption Standard (AES) with 256-bit key length in Cipher Block Chaining mode (AES256-CBC). By October 2023, AES256-CBC will be the default for encryption of Microsoft 365 Apps documents and emails. You may need to take action to support this change in your organization. For more information, see [Technical reference details about encryption](technical-reference-details-about-encryption.md). ## What if I need more control over encryption to meet security and compliance requirements? |
| compliance | Get Started With The Default Dlp Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/get-started-with-the-default-dlp-policy.md | To help protect the sensitive information, the default DLP policy: - Shows a policy tip and sends an email notification to users when they attempt to share this sensitive information with people outside your organization. For more information on these options, see [Send email notifications and show policy tips for DLP policies](use-notifications-and-policy-tips.md). -- Generates detailed activity reports so that you can track things like who shared the content with people outside your organization and when they did it. You can use the [DLP reports](view-the-dlp-reports.md) and [audit log data](audit-log-search.md) (where **Activity** = **DLP**) to see this information.+- Generates detailed activity reports so that you can track things like who shared the content with people outside your organization and when they did it. You can use the [audit log data](audit-log-search.md) (where **Activity** = **DLP**) to see this information. To quickly refine the default DLP policy, you can choose to have it: |
| compliance | Microsoft 365 Compliance Center | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/microsoft-365-compliance-center.md | f1.keywords: Previously updated : 01/01/2023 Last updated : 06/14/2023 audience: ITPro If you're interested in your organization's compliance posture, you're going to Read this article to get acquainted with the compliance portal, [how to access it](#how-do-i-access-the-compliance-portal), and your [next steps](#next-steps). -[](https://compliance.microsoft.com) +[](https://compliance.microsoft.com) [!INCLUDE [purview-preview](../includes/purview-preview.md)] In addition to links in cards on the home page, you'll see a navigation pane on |Navigation|Comments| |||-| <br> Manage retention and deletion of high-value items for business, legal, or regulatory record-keeping requirements.| +| <br> Manage retention and deletion of high-value items for business, legal, or regulatory record-keeping requirements. <p> [Privacy risk management](/privacy/priva/priva-overview) <br> Proactively identify and protect against privacy risks such as data hoarding, problematic data transfers, and data oversharing with Microsoft Priva. <p> [Subject rights requests](/privacy/priva/subject-rights-requests) <br> Help alleviate the complexity and length of time involved in responding to data subject inquires with [Microsoft Priva](/privacy/priva/priva-overview). | ## How do I access the compliance portal? |
| compliance | Mip Easy Trials | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/mip-easy-trials.md | The default DLP policy for Teams detects the presence of credit card numbers in This policy is unobtrusive to users with no policy tip visible and no messages blocked, but admins will have records of the sensitive information shared in these messages. If required, you can edit the settings to change this default configuration. -To see the results of this policy, use [DLP Activity Explorer](dlp-learn-about-dlp.md#dlp-activity-explorer). +To see the results of this policy, use [DLP Activity Explorer](dlp-learn-about-dlp.md#dlp-activity-explorer-and-reports). If you want to edit the DLP policy, see [Create and Deploy data loss prevention policies](dlp-create-deploy-policy.md). If content contains 10 or more instances of credit cards and one or more of the This policy is unobtrusive to users with no policy tip visible and no actions blocked, but admins will have records of all suspicious activity. If required, you can edit these settings to change this default configuration. -To see the results of this policy, use [DLP Activity Explorer](dlp-learn-about-dlp.md#dlp-activity-explorer). +To see the results of this policy, use [DLP Activity Explorer](dlp-learn-about-dlp.md#dlp-activity-explorer-and-reports). If you want to edit the DLP policy, see [Create and Deploy data loss prevention policies](dlp-create-deploy-policy.md). |
| compliance | Restore An Inactive Mailbox | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/restore-an-inactive-mailbox.md | f1.keywords: Previously updated : 09/12/2019 Last updated : 06/14/2023 audience: Admin An inactive mailbox (which is a type of soft-deleted mailbox) is used to retain See the [More information](#more-information) section in this article for more details about the differences between restoring and recovering an inactive mailbox. > [!NOTE]-> You can't recover or restore an inactive mailbox that's configured with an auto-expanding archive. If you need to recover data from an inactive mailbox with an auto-expanding archive, use content search to export the data from the mailbox and then import to another mailbox. For instructions, see following articles: +> You can't recover or restore an inactive mailbox that's configured with an auto-expanding archive. If, for compliance reasons, you need to recover data from an inactive mailbox with an auto-expanding archive, use content search to export the data from the mailbox. This action is supported for eDiscovery purposes only, and can't be used as a backup solution. For instructions to use content search for the recovery of data for eDiscovery, see following articles: > > - [Content search](ediscovery-content-search.md) > - [Export content search results](export-search-results.md) |
| compliance | Retention Label Flow | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention-label-flow.md | f1.keywords: Previously updated : 03/27/2023 Last updated : 06/14/2023 audience: Admin Although renaming and moving files after an instance of the flow is triggered ar - If you select the relabel action in the flow, the retention label that you select as the replacement can't be [configured to mark the item as a regulatory record](declare-records.md#configuring-retention-labels-to-declare-records). It can be configured to mark the item as a record, or not mark the item as a record. +- If your chosen flow uses an [environment type other than Default](/power-platform/admin/environments-overview#types-of-environments), you must use [PowerShell to create the retention label](/powershell/module/exchange/new-compliancetag), and use the *FlowId* parameter. + ## Power Automate dependency Power Automate is a workflow service that automates actions across applications and services. Specific to running a Power Automate flow at the end of the retention period: |
| compliance | Technical Reference Details About Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/technical-reference-details-about-encryption.md | f1.keywords: Previously updated : 09/11/2019 Last updated : 06/14/2023 audience: ITPro -Refer to this article to learn about certificates, technologies, and TLS cipher suites used for [encryption in Office 365](encryption.md). This article also provides details about planned deprecations. +Refer to this article to learn about certificates, technologies, and TLS cipher suites used for [encryption in Microsoft 365](encryption.md). This article also provides details about planned deprecations. -- If you're looking for overview information, see [Encryption in Office 365](encryption.md).-- If you're looking for setup information, see [Set up encryption in Office 365 Enterprise](set-up-encryption.md).+- If you're looking for overview information, see [Encryption in Microsoft 365](encryption.md). +- If you're looking for setup information, see [Set up encryption in Microsoft 365 Enterprise](set-up-encryption.md). - For information about cipher suites supported by specific versions of Windows, see [Cipher Suites in TLS/SSL (Schannel SSP)](/windows/desktop/SecAuthN/cipher-suites-in-schannel). [!INCLUDE [purview-preview](../includes/purview-preview.md)] You don't need to purchase or maintain certificates for Office 365. Instead, Off To provide best-in-class encryption, Office 365 regularly reviews supported encryption standards. Sometimes, old standards are deprecated as they become out of date and less secure. This article describes currently supported cipher suites and other standards and details about planned deprecations. -## FIPS compliance for Office 365 +## FIPS compliance for Microsoft 365 All cipher suites supported by Office 365 use algorithms acceptable under FIPS 140-2. Office 365 inherits FIPS validations from Windows (through Schannel). For information about Schannel, see [Cipher Suites in TLS/SSL (Schannel SSP)](/windows/desktop/SecAuthN/cipher-suites-in-schannel).- -## Versions of TLS supported by Office 365 -TLS, and SSL that came before TLS, are cryptographic protocols that secure communication over a network by using security certificates to encrypt a connection between computers. Office 365 supports TLS version 1.2 (TLS 1.2). +## AES256-CBC support for Microsoft 365 ++In late August 2023, Microsoft Purview Information Protection will begin to use Advanced Encryption Standard (AES) with 256-bit key length in Cipher Block Chaining mode (AES256-CBC). By October 2023, AES256-CBC will be the default for encryption of Microsoft 365 Apps documents and emails. You may need to take action to support this change in your organization. ++### Who is impacted and what do I need to do? ++Use this table to figure out if you have to take action: ++|**Client applications**|**Service applications**|**Action required?**|**What do I need to do?**| +|:--|:--|:--|:--| +|Microsoft 365 Apps|Exchange Online, SharePoint Online |No|N/A| +|Office 2013, 2016, 2019, or 2021|Exchange Online, SharePoint Online| Yes (Optional)| See [Set up Office 2013, 2016, 2019, or 2021 for AES256-CBC mode](#set-up-office-2013-2016-2019-or-2021-for-aes256-cbc-mode). | +|Microsoft 365 Apps|Exchange Server or hybrid|Yes (Mandatory)| See [Set up Exchange Server for AES256-CBC support](#set-up-exchange-server-for-aes256-cbc-support).| +|Office 2013, 2016, 2019, or 2021|Exchange Server or hybrid| Yes (Mandatory)| Complete [Option 1](#option-1) (required), and then see [Set up Office 2013, 2016, 2019, or 2021 for AES256-CBC mode](#set-up-office-2013-2016-2019-or-2021-for-aes256-cbc-mode). | +|Microsoft 365 Apps|MIP SDK|Yes (Optional)| See [Set up MIP SDK for AES256-CBC support](#set-up-mip-sdk-for-aes256-cbc-support).| +|Any|SharePoint Server|No|N/A| ++#### Set up Office 2013, 2016, 2019, or 2021 for AES256-CBC mode ++You need to configure Office 2013, 2016, 2019, or 2021 to use AES256-CBC mode using Group Policy, or by using the Cloud Policy service for Microsoft 365. Starting with version 16.0.16327 of Microsoft 365 Apps, CBC mode is used by default. Use the `Encryption mode for Information Rights Management (IRM)` setting under `User Configuration/Administrative Templates/Microsoft Office 2016/Security Settings`. ++For example, to force CBC mode, select the group policy setting as follows: ++Encryption mode for Information Rights Management (IRM): [1, Cipher Block Chaining (CBC)] ++#### Set up Exchange Server for AES256-CBC support ++Exchange Server doesn't support decrypting content that uses AES256-CBC. To work around this problem, you have two options. ++##### Option 1 ++Customers using Exchange Online with the Azure Rights Management Connector service deployed will be opted out of the AES256-CBC publishing change in both Exchange Online and SharePoint Online. ++To move to AES256-CBC mode, complete these steps: ++1. Install the hotfix on your Exchange Servers when it becomes available. For the most recent information about ship dates, see the [Microsoft 365 product roadmap](https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=117576). ++1. If you're using Exchange Server with the Azure Rights Management Connector Service, you'll need to run the GenConnectorConfig.ps1 script on each Exchange server. For more information, see [Configure servers for the Rights Management connector](/azure/information-protection/configure-servers-rms-connector). To download the Azure RMS connector, see the [official Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40839) ++Once your organization has installed the patch across all of your Exchange Servers, open a support case and request these services to be enabled for AES256-CBC publishing. ++##### Option 2 ++This option gives you some extra time before you need to patch all of your Exchange servers. Use this option if you're unable to complete the steps in [option 1](#option-1) when the hotfix becomes available. Instead, deploy group policy or client settings that force Microsoft 365 clients to keep using AES128-ECB mode. Deploy this setting using Group Policy, or by using the Cloud Policy service for Microsoft 365. You can configure Office and Microsoft 365 Apps for Windows to use ECB or CBC mode with the `Encryption mode for Information Rights Management (IRM)` setting under `User Configuration/Administrative Templates/Microsoft Office 2016/Security Settings`. Starting with version 16.0.16327 of Microsoft 365 Apps, CBC mode is used by default. ++For example, to force EBC mode for Windows clients, set the group policy setting as follows: ++Encryption mode for Information Rights Management (IRM): [2, Electronic Codebook (ECB)] ++To configure settings for Office for Mac clients, see [Set suite-wide preferences for Office for Mac](/deployoffice/mac/preferences-office). ++As soon as you can, complete the steps in [option 1](#set-up-exchange-server-for-aes256-cbc-support). ++#### Set up MIP SDK for AES256-CBC support ++Update to MIP SDK 1.13 or later. If you choose to update to MIP SDK 1.13, you'll need to configure a setting to force AES256-CBC. For more information, see the [MIP SDK Version 1.13.158 Critical Update](/information-protection/develop/version-release-history). Later versions of the MIP SDK will protect Microsoft 365 files and email with AES256-CBC by default. ++## Versions of TLS supported by Microsoft 365 ++TLS, and SSL that came before TLS, are cryptographic protocols that secure communication over a network by using security certificates to encrypt a connection between computers. Microsoft 365 supports TLS version 1.2 (TLS 1.2). -TLS version 1.3 (TLS 1.3) is supported by some of the services. +Some of the services continue to support TLS version 1.3 (TLS 1.3). > [!IMPORTANT] > Be aware that TLS versions deprecate, and that deprecated versions *should not be used* where newer versions are available. If your legacy services do not require TLS 1.0 or 1.1 you should disable them. To maintain a secure connection to Office 365 and Microsoft 365 services, all cl ## Deprecating support for 3DES -Since October 31, 2018, Office 365 no longer supports the use of 3DES cipher suites for communication to Office 365. More specifically, Office 365 no longer supports the TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher suite. Since February 28, 2019, this cipher suite has been disabled in Office 365. Clients and servers that communicate with Office 365 must support one or more of the supported ciphers. For a list of supported ciphers, see [TLS cipher suites supported by Office 365](#tls-cipher-suites-supported-by-office-365). +Since October 31, 2018, Microsoft 365 no longer supports the use of 3DES cipher suites for communication to Microsoft 365. More specifically, Microsoft 365 no longer supports the TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher suite. Since February 28, 2019, this cipher suite has been disabled in Microsoft 365. Clients and servers that communicate with Microsoft 365 must support one or more of the supported ciphers. For a list of supported ciphers, see [TLS cipher suites supported by Microsoft 365](#tls-cipher-suites-supported-by-microsoft-365). -## Deprecating SHA-1 certificate support in Office 365 +## Deprecating SHA-1 certificate support in Microsoft 365 -Since June 2016, Office 365 no longer accepts an SHA-1 certificate for outbound or inbound connections. Use SHA-2 (Secure Hash Algorithm 2) or a stronger hashing algorithm in the certificate chain. +Since June 2016, Microsoft 365 no longer accepts an SHA-1 certificate for outbound or inbound connections. Use SHA-2 (Secure Hash Algorithm 2) or a stronger hashing algorithm in the certificate chain. -## TLS cipher suites supported by Office 365 +## TLS cipher suites supported by Microsoft 365 -TLS uses *cipher suites*, collections of encryption algorithms, to establish secure connections. Office 365 supports the cipher suites listed in the following table. The table lists the cipher suites in order of strength, with the strongest cipher suite listed first. +TLS uses *cipher suites*, collections of encryption algorithms, to establish secure connections. Microsoft 365 supports the cipher suites listed in the following table. The table lists the cipher suites in order of strength, with the strongest cipher suite listed first. -Office 365 responds to a connection request by first attempting to connect using the most secure cipher suite. If the connection doesn't work, Office 365 tries the second most secure cipher suite in the list, and so on. The service continues down the list until the connection is accepted. Likewise, when Office 365 requests a connection, the receiving service chooses whether TLS will be used and which cipher suite to use. +Microsoft 365 responds to a connection request by first attempting to connect using the most secure cipher suite. If the connection doesn't work, Microsoft 365 tries the second most secure cipher suite in the list, and so on. The service continues down the list until the connection is accepted. Likewise, when Microsoft 365 requests a connection, the receiving service chooses whether to use TLS and which cipher suite to use. | Cipher suite name | Key exchange algorithm/strength | Forward secrecy | Cipher/strength | Authentication algorithm/strength | |:--|:--|:--|:--|:--|-| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 <br/> | ECDH/192 <br/> | Yes <br/> | AES/256 <br/> | RSA/112 <br/> | -| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 <br/> | ECDH/128 <br/> | Yes <br/> | AES/128 <br/> | RSA/112 <br/> | -| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 <br/> | ECDH/192 <br/> | Yes <br/> | AES/256 <br/> | RSA/112 <br/> | -| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 <br/> | ECDH/128 <br/> | Yes <br/> | AES/128 <br/> | RSA/112 <br/> | -| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA <br/> | ECDH/192 <br/> | Yes <br/> | AES/256 <br/> | RSA/112 <br/> | -| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA <br/> | ECDH/128 <br/> | Yes <br/> | AES/128 <br/> | RSA/112 <br/> | -| TLS_RSA_WITH_AES_256_GCM_SHA384 <br/> | RSA/112 <br/> | No <br/> | AES/256 <br/> | RSA/112 <br/> | -| TLS_RSA_WITH_AES_128_GCM_SHA256 <br/> | RSA/112 <br/> | No <br/> | AES/256 <br/> | RSA/112 <br/> | +| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | ECDH/192 | Yes | AES/256 | RSA/112 | +| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | ECDH/128 | Yes | AES/128 | RSA/112 | +| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | ECDH/192 | Yes | AES/256 | RSA/112 | +| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | ECDH/128 | Yes | AES/128 | RSA/112 | +| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | ECDH/192 | Yes | AES/256 | RSA/112 | +| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | ECDH/128 | Yes | AES/128 | RSA/112 | +| TLS_RSA_WITH_AES_256_GCM_SHA384 | RSA/112 | No | AES/256 | RSA/112 | +| TLS_RSA_WITH_AES_128_GCM_SHA256 | RSA/112 | No | AES/256 | RSA/112 | The following cipher suites supported TLS 1.0 and 1.1 protocols until their deprecation date. For GCC High and DoD environments that deprecation date was January 15, 2020. For Worldwide and GCC environments that date was October 15, 2020. -| Protocols | Cipher suite name | Key exchange algorithm/strength | Forward secrecy | Cipher/strength | Authentication algorithm/strength | +| Protocols | Cipher suite name | Key exchange algorithm/strength | Forward secrecy | Cipher/strength | Authentication algorithm/strength | |:--|:--|:--|:--|:--|:--|-| TLS 1.0, 1.1, 1.2 <br/> | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA <br/> | ECDH/192 <br/> | Yes <br/> | AES/256 <br/> | RSA/112 <br/> | -| TLS 1.0, 1.1, 1.2 <br/> | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA <br/> | ECDH/128 <br/> | Yes <br/> | AES/128 <br/> | RSA/112 <br/> | -| TLS 1.0, 1.1, 1.2 <br/> | TLS_RSA_WITH_AES_256_CBC_SHA <br/> | RSA/112 <br/> | No <br/> | AES/256 <br/> | RSA/112 <br/> | -| TLS 1.0, 1.1, 1.2 <br/> | TLS_RSA_WITH_AES_128_CBC_SHA <br/> | RSA/112 <br/> | No <br/> | AES/128 <br/> | RSA/112 <br/> | -| TLS 1.0, 1.1, 1.2 <br/> | TLS_RSA_WITH_AES_256_CBC_SHA256 <br/> | RSA/112 <br/> | No <br/> | AES/256 <br/> | RSA/112 <br/> | -| TLS 1.0, 1.1, 1.2 <br/> | TLS_RSA_WITH_AES_128_CBC_SHA256 <br/> | RSA/112 <br/> | No <br/> | AES/256 <br/> | RSA/112 <br/> | --Certain Office 365 products (including Microsoft Teams) use [Azure Front Door](/azure/frontdoor/front-door-overview) to terminate TLS connections and route network traffic efficiently. At least one of the [cipher suites supported by Azure Front Door over TLS 1.2](/azure/frontdoor/front-door-faq#what-are-the-current-cipher-suites-supported-by-azure-front-door-) must be enabled to successfully connect to these products. For Windows 10 and above, we recommend enabling one or both of the ECDHE cipher suites for better security. Windows 7, 8, and 8.1 are not compatible with Azure Front Door's ECDHE cipher suites and the DHE cipher suites have been provided for compatibility with those operating systems. +| TLS 1.0, 1.1, 1.2 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | ECDH/192 | Yes | AES/256 | RSA/112 | +| TLS 1.0, 1.1, 1.2 | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | ECDH/128 | Yes | AES/128 | RSA/112 | +| TLS 1.0, 1.1, 1.2 | TLS_RSA_WITH_AES_256_CBC_SHA | RSA/112 | No | AES/256 | RSA/112 | +| TLS 1.0, 1.1, 1.2 | TLS_RSA_WITH_AES_128_CBC_SHA | RSA/112 | No | AES/128 | RSA/112 | +| TLS 1.0, 1.1, 1.2 | TLS_RSA_WITH_AES_256_CBC_SHA256 | RSA/112 | No | AES/256 | RSA/112 | +| TLS 1.0, 1.1, 1.2 | TLS_RSA_WITH_AES_128_CBC_SHA256 | RSA/112 | No | AES/256 | RSA/112 | ++Certain Office 365 products (including Microsoft Teams) use [Azure Front Door](/azure/frontdoor/front-door-overview) to terminate TLS connections and route network traffic efficiently. At least one of the [cipher suites supported by Azure Front Door over TLS 1.2](/azure/frontdoor/front-door-faq#what-are-the-current-cipher-suites-supported-by-azure-front-door-) must be enabled to successfully connect to these products. For Windows 10 and above, we recommend enabling one or both of the ECDHE cipher suites for better security. Windows 7, 8, and 8.1 aren't compatible with Azure Front Door's ECDHE cipher suites and the DHE cipher suites have been provided for compatibility with those operating systems. ## Related articles |
| compliance | View The Dlp Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/view-the-dlp-reports.md | - Title: "View the reports for data loss prevention"-- NOCSH--- Previously updated : 6/7/2018----- tier1-- purview-compliance-- MOE150-- MET150--- seo-marvel-apr2020-- admindeeplinkEXCHANGE -description: Use the DLP reports in Office 365 to view the number of DLP policy matches, overrides, or false positives and see whether they're trending up or down over time. ---# View the reports for data loss prevention --After you create your Microsoft Purview data loss prevention (DLP) policies, you'll want to verify that they're working as you intended and helping you to stay compliant. With the DLP reports in the Microsoft Purview compliance portal, you can quickly view: --- **DLP policy matches** This report shows the count of DLP policy matches over time. You can filter the report by date, location, policy, or action. You can use this report to:-- - Tune or refine your DLP policies as you run them in test mode. You can view the specific rule that matched the content. -- - Focus on specific time periods and understand the reasons for spikes and trends. -- - Discover business processes that violate your organization's DLP policies. -- - Understand any business impact of the DLP policies by seeing what actions are being applied to content. -- - Verify compliance with a specific DLP policy by showing any matches for that policy. -- - View a list of top users and repeat users who are contributing to incidents in your organization. -- - View a list of the top types of sensitive information in your organization. --- **DLP incidents** This report also shows policy matches over time, like the policy matches report. However, the policy matches report shows matches at a rule level; for example, if an email matched three different rules, the policy matches report shows three different line items. By contrast, the incidents report shows matches at an item level; for example, if an email matched three different rules, the incidents report shows a single line item for that piece of content.-- Because the report counts are aggregated differently, the policy matches report is better for identifying matches with specific rules and fine tuning DLP policies. The incidents report is better for identifying specific pieces of content that are problematic for your DLP policies. --- **DLP false positives and overrides** If your DLP policy allows users to override it or report a false positive, this report shows a count of such instances over time. You can filter the report by date, location, or policy. You can use this report to:-- - Tune or refine your DLP policies by seeing which policies incur a high number of false positives. -- - View the justifications submitted by users when they resolve a policy tip by overriding the policy. -- - Discover where DLP policies conflict with valid business processes by incurring a high number of user overrides. --All DLP reports can show data from the most recent four-month time period. The most recent data can take up to 24 hours to appear in the reports. --You can find these reports in the Microsoft Purview compliance portal \> **Reports** \> **Dashboard**. -- ---## View the justification submitted by a user for an override --If your DLP policy allows users to override it, you can use the false positive and override report to view the text submitted by users in the policy tip. -- --## Take action on insights and recommendations --Reports can show insights and recommendations where you can click the red warning icon to see details about potential issues and take possible remedial action. -- --## Permissions for DLP reports --To view DLP reports in the Purview compliance portal, you have to be assigned the: --- **Security Reader** role in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a>. By default, this role is assigned to the Organization Management and Security Reader role groups in the Exchange admin center.--- **View-Only DLP Compliance Management** role in the Purview compliance portal. By default, this role is assigned to the Compliance Administrator, Organization Management, Security Administrator, and Security Reader role groups in the Purview compliance portal.--- **View-Only Recipients** role in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a>. By default, this role is assigned to the Compliance Management, Organization Management, and View-Only Organization Management role groups in the Exchange admin center.--## Find the cmdlets for the DLP reports --To use the DLP reporting cmdlets, do these steps: --1. [Connect to Security & Compliance PowerShell](/powershell/exchange/connect-to-scc-powershell) --2. Use these cmdlets: -- - [Get-DlpDetailReport](/powershell/module/exchange/get-dlpdetailreport) - - [Get-DlpDetectionsReport](/powershell/module/exchange/get-dlpdetectionsreport) - - [Get-DlpSiDetectionsReport](/powershell/module/exchange/get-dlpsidetectionsreport) --However, DLP reports need pull data from across Microsoft 365, including Exchange Online. For this reason, the following cmdlets for DLP reports are available in Exchange Online Powershell. To use the cmdlets for these DLP reports, do these steps: --1. [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) --2. Use these cmdlets: -- - [Get-DlpDetailReport](/powershell/module/exchange/get-dlpdetailreport) - - [Get-MailDetailDlpPolicyReport](/powershell/module/exchange/get-maildetaildlppolicyreport) |
| enterprise | Advanced Data Residency | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/advanced-data-residency.md | The following workloads are included in ADR. For more information, see: The Advanced Data Residency ("ADR") add-on is intended for Microsoft 365 enterprise customers who have comprehensive data residency requirements. To be eligible to purchase ADR, customers must meet the following pre-requisites: -- The _Tenant_ _Default Geography_ must be one of the countries included in the _Local Region Geography_ as listed in Table 1 on the page [Overview and Definitions](m365-dr-overview.md) page for Data Residency.+- The _Tenant_ _Default Geography_ must be one of the countries included in the _Local Region Geography_ (Australia, Brazil, Canada, France, Germany, India, Japan, Poland, Qatar, South Korea, Norway, South Africa, Sweden, Switzerland, United Arab Emirates, and United Kingdom). - Customers must have licensed one or more of the following products: - Microsoft 365 F1, F3, E3, or E5 - Office 365 F3, E1, E3, or E5 |
| loop | Loop Components Sharepoint | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/loop/loop-components-sharepoint.md | + Last updated : 03/31/2023 + Title: "Manage Loop experiences (Loop workspaces and Loop components) in SharePoint" +++++recommendations: true +audience: Admin +f1.keywords: +- NOCSH ++ms.localizationpriority: medium +++- Strat_SP_admin +- Microsoft 365-collaboration +- Tier3 +search.appverid: +- SPO160 +- MET150 +description: "Learn how to manage Loop experiences (Loop workspaces and Loop components) by using PowerShell and Cloud Policy." +++# Manage Loop experiences (Loop workspaces and Loop components) in SharePoint ++Loop experiences on Microsoft 365 OneDrive or SharePoint are backed by .fluid or .loop files. IT admins need to manage access to Loop experiences from **BOTH**: +1. Cloud Policy +2. SharePoint PowerShell command ++## Requirements ++Just like other Microsoft 365 experiences, Loop also leverages core services across SharePoint and Microsoft 365. To effectively enable Loop experiences or OneDrive and SharePoint files-backed experiences powered by Fluid Framework, follow the instructions in [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges) to ensure connections to Loop services. ++#### Microsoft 365 Groups for Cloud Policy ++This section is not required if you choose to apply the Loop settings to all the users in your tenant; however, if you want to scope, you must create or use an existing Microsoft 365 group that defines which users in your organization this policy will apply to. You can learn how to create a Microsoft 365 group by visiting [Create a Microsoft 365 group](/microsoft-365/admin/create-groups/create-groups). ++You'll be able to use this group for the Cloud Policy setup procedure below. ++If you prefer, you can also create other types of groups to use with Cloud Policy. See [learn more about creating groups in the Microsoft 365 admin center](/microsoft-365/admin/email/create-edit-or-delete-a-security-group) or [learn more about creating dynamic groups in AzureAD](/azure/active-directory/external-identities/use-dynamic-groups). ++#### Exchange Online license ++The Loop app currently requires each user to have an Exchange Online license. If not, users will experience failures in the Loop app, be unable to create new Loop workspaces, will not receive notifications or signals when users collaborate and update, and other experiences may also fail. ++#### WebSocket connections ++Loop's near real-time communications are enabled by the core services that run a WebSocket server. Coauthors in the same session need to establish secured WebSocket connections to this service to send and receive collaborative data such as changes made by others, live cursors, presence, etc. These experiences are crucial to Loop, and all the scenarios powered by Fluid framework. So, at the minimum, WebSocket will need to be unblocked from the user's endpoint. ++## Available policy settings ++There are several IT Admin settings provided to enable the Loop app and Loop experiences across Microsoft 365: ++|Configure|Setting Type|Specific Policy|Notes +||||| +|Loop app workspaces|Cloud Policy|**Create and view Loop workspaces in Loop**|*Loop app only checks the setting in this row| +|Loop component experiences across Microsoft 365*|Cloud Policy|**Create and view Loop files in Microsoft apps that support Loop**|Applies to:<br/>- Outlook integration<br/>- Word for the web integration<br/>- Whiteboard integration<br/>Does NOT apply to:<br/>- Loop app<br/>- Teams integration| +|Outlook integration of Loop experiences|Cloud Policy|**Create and view Loop files in Outlook**|First checks **Create and view Loop files in Microsoft apps that support Loop**, then applies **Create and view Loop files in Outlook** if applicable| +|Teams integration|SharePoint property|See [Settings management for Loop components in Teams](#settings-management-for-loop-functionality-in-teams)|*Teams only checks the setting in this row| ++## Example configurations ++|Scenario|Policies Configured| +||| +|Enable Loop workspaces in the app and Loop components everywhere|**Create and view Loop workspaces in Loop** = Enabled<br/>**Create and view Loop files in Microsoft apps that support Loop** = Enabled<br/>[Teams-only] `Set-SPOTenant -IsLoopEnabled $true`| +|Enable Loop components everywhere<br/>Disable Loop workspaces in the app during public preview|**Create and view Loop workspaces in Loop** = Disabled<br/>**Create and view Loop files in Microsoft apps that support Loop** = Enabled<br/>[Teams-only] `Set-SPOTenant -IsLoopEnabled $true`| +|Enable Loop components everywhere, but Disable in eCommunication (Outlook, Teams)<br/>Disable Loop workspaces in the app during public preview|**Create and view Loop workspaces in Loop** = Disabled<br/>**Create and view Loop files in Microsoft apps that support Loop** = Enabled<br/>**Create and view Loop files in Outlook** = Disabled<br/>[Teams-only] `Set-SPOTenant -IsLoopEnabled $false`| ++## Settings management in Cloud Policy ++The Loop experiences (except for Microsoft Teams) check the following Cloud Policy settings. See [Available policy settings](#available-policy-settings) to understand how each app checks these settings: ++- **Create and view Loop files in Microsoft apps that support Loop** +- **Create and view Loop files in Outlook** +- **Create and view Loop workspaces in Loop** + - Note: this policy was previously mistitled 'Create and view Loop files in Loop' ++See the [Cloud Policy](/deployoffice/admincenter/overview-cloud-policy) setting templates for more information on the settings above. ++> [!TIP] +> If you're new to Cloud Policy and looking to enable the Loop app for your organization during the public preview, you may appreciate a more step by step document for how to roll out Cloud Policy settings to your tenant. If so, check out this Tech Community blog: [Learn how to enable the Microsoft Loop app, now in Public Preview](https://techcommunity.microsoft.com/t5/microsoft-365-blog/learn-how-to-enable-the-microsoft-loop-app-now-in-public-preview/ba-p/3769013). ++To configure these Cloud Policy settings: +1. Sign in to https://config.office.com/ with your Microsoft 365 admin credentials. +2. Select **Customization** from the left pane. +3. Select **Policy Management**. +4. Create a new policy configuration or edit an existing one. +5. In **Choose the scope**, choose either the "all users" option or select the group for which you want to apply the policy. See [Microsoft 365 Groups for Cloud Policy](#microsoft-365-groups-for-cloud-policy) for more information. +6. In **Configure Settings**, choose one of the settings listed at the top of this section. +7. In configuration setting, choose one of the following: + - For **Create and view Loop files in Microsoft apps that support Loop** + - **Enabled**: Loop experience is available to users. + - **Disabled**: Loop experience is not available to users. + - **Not configured**: Loop experience is available to users. + - For **Create and view Loop files in Outlook** + - **Enabled**: Loop experience is available to users. + - **Disabled**: Loop experience is not available to users. + - **Not configured**: Loop experience is available to users. + - For **Create and view Loop workspaces in Loop** + - **Enabled**: Loop app and creation of workspaces is available to users. + - **Disabled**: Loop app creation of workspaces is not available to users. + - **Not configured**: Loop app and creation of workspaces is not available to users. + - Loop during Public Preview is IT Admin Opt-in by default. + - Loop app will still open Loop components when workspaces is disabled. If this is not rolled out to your environment, Loop component will open in Office.com. + - Ensure additional [Loop service requirements](#requirements) are met. +8. Save the policy configuration. +9. Reassign priority for any security group if required. (If two or more policy configurations are applicable to the same set of users, the one with the higher priority is applied.) +10. In case you create a new policy configuration or change the configuration for an existing policy, there will be a delay in the change being reflected as follows: + - If there were existing policy configurations prior to the change, then it will take 90 mins for the change to be reflected. + - If there were no policy configurations prior to the change then it will take 24 hours for the change to be reflected. ++## Settings management for Loop functionality in Teams ++You'll need the latest version of SharePoint PowerShell module to enable or disable Loop experiences in Teams. Loop components default to ON for all organizations. Because Loop components are designed for collaboration, the components are always shared as editable by others, even if your organization is set to default to view-only for other file types. See the Learn more link next to the setting for more details. ++|Experience|SharePoint organization properties|Notes| +||-|| +|Loop components in Teams|`IsLoopEnabled` (boolean)|This property controls Loop experiences in Microsoft Teams. | +|Collaborative meeting notes|`IsCollabMeetingNotesFluidEnabled` (boolean)|This property controls the collaborative meeting notes integration in Microsoft Teams.| ++To check your tenant's default file permissions ++1. Go to the [Microsoft 365 admin center](https://admin.microsoft.com). +2. Under Admin centers, select **SharePoint**. +3. Select **Policies** > **Sharing**, and under **File and folder links**, view your organization's default file permissions. ++To check if Loop components are enabled, run `Get-SPOTenant` without any arguments. Verify the value of IsLoopEnabled is true. ++To enable Loop components in Teams, run `Set-SPOTenant -IsLoopEnabled $true`. The change will take a short time to apply across your organization. ++The feature will be available on Teams Windows Desktop, Mac, iOS, Android, and web. When enabled, users will see a new option for inserting Loop components in the message compose experience for these clients. ++To disable Loop components in Teams, run `Set-SPOTenant -IsLoopEnabled $false`. The change will take a short time to apply across your organization. If your organization has multiple regions (that is, organization URLs), you need to disable loop components for all the regions to have consistent results across the organization. ++## eDiscovery for Loop components ++Loop components created in Teams or Outlook are discoverable and have eDiscovery workflow support using the Microsoft Purview tool. Currently, these files are stored in the creatorΓÇÖs OneDrive and are available for search and collection, and render in review for both eDiscovery (Standard) and eDiscovery (Premium). The HTML offline export format is supported on eDiscovery (Premium). You can also download and re-upload the files to any OneDrive to view them in their native format. ++Microsoft is currently working on a third-party export API solution for Loop components. ++> [!NOTE] +> The Loop app and content created in the Loop app does not yet support eDiscovery workflows. ++## Related topics ++[Get started with Microsoft Loop - Microsoft Support](https://support.microsoft.com/office/get-started-with-microsoft-loop-9f4d8d4f-dfc6-4518-9ef6-069408c21f0c) ++[Overview of Loop components in Teams](loop-components-teams.md) ++[Use Loop components in Outlook](https://support.microsoft.com/office/9b47c279-011d-4042-bd7f-8bbfca0cb136) ++[Use Loop components in Word for the web](https://support.microsoft.com/office/645cc20d-5c98-4bdb-b559-380c5a27c5e5) ++[Loop components in Whiteboard](https://support.microsoft.com/office/c5f08f54-995e-473e-be6e-7f92555da347) |
| loop | Loop Components Teams | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/loop/loop-components-teams.md | + + Title: Overview of Loop components in Teams ++++audience: Admin +++ Last updated : 07/16/2021+ms.localizationpriority: medium +search.appverid: MET150 ++ - M365-collaboration +description: Learn how to manage Loop components in Teams. +f1.keywords: +- CSH ++ - NewAdminCenter_Update + - chat-teams-channels-revamp +appliesto: + - Microsoft Teams +++# Overview of Loop components in Teams ++Loop components in Teams chat offer a new way to ideate, create, and make decisions together. Send a component - like a table, task list, or paragraph ΓÇö where everyone in your chat can edit inline and see changes as they're made. ++> [!Note] +> Loop components is the first feature of the [Microsoft Loop app](https://www.microsoft.com/en-us/microsoft-loop) to become available in Teams. ++**Get tasks done faster together.** Crowd-source an agenda, track a group's action items, or take notes collectively. These are just a few scenarios made easier with Loop components. ++**Share components.** In this release, you can share Loop components into different Teams chats. Recipients can edit from wherever they are and see updates instantly no matter where the changes were made. ++**Start in chat, build from there.** Every component you create from Teams chat is automatically saved to a file in OneDrive. So, you might begin collaborating in chat then later move to the file on Office.com, where you have a larger visual space for editing and can add as many components as you like. ++For information on admin settings for Loop components in Teams, see [Manage Loop components in SharePoint](loop-components-sharepoint.md). ++## Clients and platforms ++Available on Teams apps on Windows, Mac, iOS, and Android. ++## Loop components and .fluid files ++Loop components created in Teams are backed by a .fluid (will be changed to .loop in the near future) file stored in the creator's OneDrive. Being a file in OneDrive means that users can create, discover, and manage Loop components (.fluid files) as easily as any Office document. ++## How are .fluid files stored? ++.fluid files appear on Office.com and OneDrive, such as in the Recent and Recommended areas. Users can search for content in .fluid files from Office.com and OneDrive. .fluid files can be restored to previous versions from OneDrive. To create Loop components chat participants must have a OneDrive account. Without a valid OneDrive account, chat participants might still be able to collaborate on a component created by other users who have a valid OneDrive account, but can't create their own. ++Moving a .fluid file from OneDrive to a SharePoint site will result in the live component failing to load in Teams chat. ++## What happens if the owner of the file leaves the company? ++OneDrive retention policies apply to .fluid files just as they do to other content created by the user. ++## How are .fluid files shared? ++Loop components can be inserted in Teams chat or copied from one chat to another. (Loop components aren't yet supported in channels.) They default to the organization's existing permissions, but users can change permissions before sending to ensure everyone has access. ++Opening components from Teams chat in Office.com offers share functionality at the top of the window, similar to the sharing options offered for other Office documents. ++## What if a .fluid file becomes corrupted or damaged? ++Version History allows you to review, restore, or copy from previous versions of the file. ++## What apps can open and edit .fluid files? ++.fluid files can only be opened as links in your browser, such as Office.com, and as Loop components in Teams chat. If downloaded, they can't be opened again without first uploading them back to OneDrive or SharePoint. ++## Does .fluid files support eDiscovery? ++Currently, .fluid files are stored in the creator's OneDrive and are available for search and collection in eDiscovery (Standard) and available for search, collection, review, and export in eDiscovery (Premium). More information about eDiscovery support is outlined in the [Settings management](loop-components-sharepoint.md#settings-management-for-loop-functionality-in-teams) section. ++## If Loop is disabled from the admin switch, what will the user experience be? ++If you disable these experiences as outlined in the [Settings management](loop-components-sharepoint.md#settings-management-for-loop-functionality-in-teams) section, the following experience changes will apply: ++- The create/insert entry point within Teams messaging will be hidden. Users won't be able to create new .fluid files. +- Existing messages that would have formerly rendered as an interactive Loop component will instead render as a hyperlink "Loop component." No interactive content will be displayed within Teams. +- When an end-user clicks on the "Loop component" hyperlink or browses to a .fluid file in OneDrive for Business and clicks to open, it will open the file in a separate browser tab. End-users will still be able to edit the file. ++## Known issues ++- With tenant default file permissions set to *Specific people* (only the people the user specifies), copying the link to the Loop component and pasting it in another chat requires the sender to use the permissions dialog and add the recipients in the Specific people option to grant access properly. +- With tenant default file permissions set to *Specific people* (only the people the user specifies), creating a live component in group chat with more than 20 members will require the sender to manually select the permission options for the component. +- Searching for Loop components in Teams search will return a link to the component in office.com, not the chat message itself. +- Loop components are disabled in federated chats. +- Guests won't be able to view or collaborate on a Loop component. +- Loop components aren't supported in Teams channels. +- Loop components in chat won't load only if file was moved to different library. If file is moved to different folder then it will continue to load in chat. |
| security | Attack Surface Reduction Rules Deployment Implement | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-implement.md | search.appverid: met150 Implementing attack surface reduction (ASR) rules move the first test ring into an enabled, functional state. -> [!div class="mx-imgBorder"] > :::image type="content" source="images/asr-rules-implementation-steps.png" alt-text="The procedure to implement ASR rules" lightbox="images/asr-rules-implementation-steps.png"::: |
| security | Microsoft Defender Antivirus Compatibility | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility.md | description: Learn about Microsoft Defender Antivirus with other security produc ms.localizationpriority: medium Previously updated : 06/07/2023 Last updated : 06/14/2023 Defender for Endpoint affects whether Microsoft Defender Antivirus can run in pa > - The table in this section summarizes the features and capabilities that are actively working or not, according to whether Microsoft Defender Antivirus is in active mode, passive mode, or disabled/uninstalled. This table designed to be informational only. > - **Do not turn off capabilities**, such as real-time protection, cloud-delivered protection, or limited periodic scanning if you are using Microsoft Defender Antivirus in passive mode, or if you are using [EDR in block mode](edr-in-block-mode.md), which works behind the scenes to detect and remediate malicious artifacts that were detected post-breach. -| Protection | Microsoft Defender Antivirus <br/>(*Active mode*) | Microsoft Defender Antivirus <br/>(*Passive mode*) | Microsoft Defender Antivirus <br/>(*Disabled or uninstalled*) | [EDR in block mode](edr-in-block-mode.md) | +| Protection | Microsoft Defender Antivirus <br/>(*Active mode*) | Microsoft Defender Antivirus <br/>(*Passive mode*) | Microsoft Defender Antivirus <br/>(*Disabled or uninstalled*) | |:|:|:|:|:| -| [Real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md) | Yes | [See note 1](#notes-about-protection-states) | No | No | -| [Cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) | Yes | No | No | No | -| [Network protection](network-protection.md) | Yes | No | No | No | -| [Attack surface reduction rules](attack-surface-reduction.md) | Yes | No | No | No | -| [Limited periodic scanning availability](limited-periodic-scanning-microsoft-defender-antivirus.md) | No | Yes | No | No | -| [File scanning and detection information](review-scan-results-microsoft-defender-antivirus.md) | Yes | Yes <br/>[See note 2](#notes-about-protection-states) | No | Yes | -| [Threat remediation](configure-remediation-microsoft-defender-antivirus.md) | Yes | [See note 3](#notes-about-protection-states) | No | Yes | -| [Security intelligence updates](microsoft-defender-antivirus-updates.md) | Yes | Yes <br/>[See note 4](#notes-about-protection-states) | No | Yes<br/>[See note 4](#notes-about-protection-states) | -| [Data Loss Prevention](../../compliance/endpoint-dlp-learn-about.md) | Yes | Yes | No | No | -| [Controlled folder access](controlled-folders.md) | Yes |No | No | No | -| [Web content filtering](web-content-filtering.md) | Yes | [See note 5](#notes-about-protection-states) | No | No | -| [Device control](device-control-report.md) | Yes | Yes | No | No | -| [PUA protection](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) | Yes | No | No | No | +| [Real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md) | Yes | [See note 1](#notes-about-protection-states) | No | +| [Cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) | Yes | No | No | +| [Network protection](network-protection.md) | Yes | No | No | +| [Attack surface reduction rules](attack-surface-reduction.md) | Yes | No | No | +| [Limited periodic scanning availability](limited-periodic-scanning-microsoft-defender-antivirus.md) | No | Yes | No | +| [File scanning and detection information](review-scan-results-microsoft-defender-antivirus.md) | Yes | Yes <br/>[See note 2](#notes-about-protection-states) | No | +| [Threat remediation](configure-remediation-microsoft-defender-antivirus.md) | Yes | [See note 3](#notes-about-protection-states) | No | +| [Security intelligence updates](microsoft-defender-antivirus-updates.md) | Yes | Yes <br/>[See note 4](#notes-about-protection-states) | No | +| [Data Loss Prevention](../../compliance/endpoint-dlp-learn-about.md) | Yes | Yes | No | +| [Controlled folder access](controlled-folders.md) | Yes |No | No | +| [Web content filtering](web-content-filtering.md) | Yes | [See note 5](#notes-about-protection-states) | No | +| [Device control](device-control-report.md) | Yes | Yes | No | +| [PUA protection](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) | Yes | No | No | ### Notes about protection states |
| security | Microsoft Defender Endpoint | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint.md | |
| security | Troubleshoot Onboarding | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-onboarding.md | |
| security | Microsoft 365 Security Center Mdi | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-center-mdi.md | ms.mktglfcycl: deploy ms.localizationpriority: medium f1.keywords: - NOCSH--- Previously updated : 07/06/2022+++ Last updated : 06/07/2023 audience: ITPro search.appverid: -Microsoft Defender for Identity is now part of Microsoft 365 Defender. The Microsoft 365 Defender portal allows security admins to perform their security tasks in one location. This will simplify workflows, and add the functionality of the other Microsoft 365 Defender services. Microsoft 365 Defender will be the home for monitoring and managing security across your Microsoft identities, data, devices, apps, and infrastructure. +Microsoft Defender for Identity is now part of Microsoft 365 Defender. The Microsoft 365 Defender portal allows security admins to perform their security tasks in one location. This will simplify workflows, and add the functionality of the other Microsoft 365 Defender services. Microsoft 365 Defender will be the home for monitoring and managing security across your Microsoft identities, data, devices, apps, and infrastructure. Microsoft Defender for Identity contributes identity focused information into the incidents and alerts that Microsoft 365 Defender presents. This information is key to providing context and correlating alerts from the other products within Microsoft 365 Defender. -## Quick reference --The table below lists the changes in navigation between Microsoft Defender for Identity and Microsoft 365 Defender. --| **Defender for** Identity | **Microsoft 365 Defender** | -| -- | | -| Timeline | Microsoft 365 Defender Alerts/Incidents queue | -| Reports |Lateral movement path and passwords exposed in cleartext reports are covered by the [Identity security posture assessments](/defender-for-identity/security-assessment#assessment-reports) (ISPM)<br>Health issues are available in Settings -> Identities -> Health issues<br>Summary of alerts can be found by exporting the alerts queue or using Advanced Hunting (30 days of data)<br>Modification to sensitive groups can be found by using Advanced hunting<br>Customized reports can be created in Microsoft 365 Defender portal using Advanced hunting | -| User page | Microsoft 365 Defender User page | -| Device page | Microsoft 365 Defender Device page | -| Group page | Microsoft 365 Defender groups side pane | -| Alert page | Microsoft 365 Defender Alert page | -| Search | Microsoft 365 Defender Search | -| Health center | Settings -> Identities -> Sensors | -| Entity Activities | Advanced hunting <br> Device timeline <br> Identity timeline | -| Settings | Settings -> Identities | -| Users and accounts | Assets -> Identities | -| Identity security posture | [Microsoft Defender for Identity's security posture assessments](/defender-for-identity/security-assessment) | -| Onboarding a new Workspace | Settings -> Identities (automatically) | --## What's changed --### Defender for Identity settings --To access the Microsoft Defender for Identity configuration settings, in [Microsoft 365 Defender](https://security.microsoft.com), go to **Settings** and then **Identities**. --### Defender for Identity security posture --All the identity security posture management assessments that were previously accessible in Defender for Cloud Apps are now available in Microsoft Secure Score, which can be found at <https://security.microsoft.com/securescore> in the [Microsoft 365 Defender portal](https://security.microsoft.com). For more information, see [Microsoft Defender for Identity's security posture assessments](/defender-for-identity/security-assessment). --### Global search +## Converged experiences in Microsoft 365 Defender -Global search in Microsoft 365 Defender (using the search bar at the top of the page) allows security teams to look for any entity being monitored by Microsoft 365 Defender, be it identity, endpoint, Office 365 data, and more. Results can be interacted with directly from the search drop-down, or security teams can choose to select **All users** or **All devices** to see all entities associated with that search term. +[Microsoft 365 Defender](https://security.microsoft.com) combines security capabilities that protect, detect, investigate, and respond to email, collaboration, identity, and device threats, and now includes all functionality provided in the [classic Defender for Identity portal](/defender-for-identity/classic-workspace-portal). -### Onboarding and administration +While they may not be in exactly same pages, much of your data is integrated into Microsoft 365 Defender pages so that you can view your data across all of your monitored entities. -The onboarding process is now automatic for new customers, with no need to manually configure a workspace. Additionally, all the admin features are available under the **Identities** menu in Microsoft 365 Defender's Settings. +The following sections describe enhanced Defender for Identity features found in Microsoft 365 Defender. -### Alerting and incident correlation +### Configuration and posture -Defender for Identity alerts are now included in Microsoft 365 Defender's alert queue, making them available to the auto incident correlation feature. This ensures that all alerts are available in one place, and that the scope of a breach can be determined quicker than before. For more information, see [Defender for Identity security alerts in Microsoft 365 Defender](/defender-for-identity/manage-security-alerts). +|Area |Description | +||| +|**Global exclusions** | In Microsoft 365 Defender, use alert tuning to define global exclusions that can apply to all Defender for Identity security alerts, instead of having to configure the exclusion in each, individual detection exclusion. <br><br> For more information, see [Global excluded entities](/defender-for-identity/exclusions). | +|**Manage action and directory service accounts** | By default, Microsoft 365 Defender is configured to use the *local system*. Therefore, you'll only need to configure action and directory service account settings if you want a specific user account to perform the user remediation actions.<br><br> For more information, see [Microsoft Defender for Identity action accounts](/defender-for-identity/manage-action-accounts). | +|**Remove a learning period** | Some Defender for Identity alerts rely on learning periods to build a profile of patterns, and then distinguish between legitimate and suspicious activities. <br><br>Microsoft 365 Defender supports an advanced setting to control whether to see alerts during the learning period before that profile is fully built. Changing this setting results in an increased number of alerts, with some of them being for legitimate traffic and activities. <br><br>For more information see [Remove the learning period for alerts](/defender-for-identity/advanced-settings). | +|**Custom permission roles** | Microsoft 365 Defender supports custom permission roles. <br><br>For more information, see [Microsoft 365 Defender role-based access control (RBAC)](manage-rbac.md) | +|**Microsoft Secure Score** | All security posture management assessments that were previously available from Microsoft Defender for Cloud Apps are now available in [Microsoft Secure Score](https://security.microsoft.com/securescore), in Microsoft 365 Defender. <br><br> For more information, see [Microsoft Defender for Identity's security posture assessments](/defender-for-identity/security-assessment). | +|**API** | Use any of the following Microsoft 365 Defender APIs with Defender for Identity: <br><br>- [Query activities via API](api-advanced-hunting.md) <br>- [Manage security alerts via API](api-incident.md) <br>- [Stream security alerts and activities to Microsoft Sentinel](streaming-api.md)<br><br>**Tip**: Microsoft 365 Defender only stores advanced hunting data for 30 days. If you need longer retention periods, stream the activities to Microsoft Sentinel or another partner security information and event management (SIEM) system. | +| **Onboarding** | Defender for Identity onboarding is now automatic for new customers, with no need to configure a workspace. <br><br>If you need to delete your instance, do so together with Microsoft support. | -### Advanced hunting (new) +### Investigation -You can now proactively search for threats and malicious activity by using advanced hunting queries. These powerful queries can be used to locate and review threat indicators and entities for both known and potential threats. -Custom detection rules can be built from advanced hunting queries to help you proactively watch for events that might be indicative of breach activity and misconfigured devices. For more information, see [Proactively hunt for threats with advanced hunting in Microsoft 365 Defender](advanced-hunting-overview.md). +|Area |Description | +||| +|**Identity page** | The Microsoft 365 Defender identity details page provides data about each identity, such as: <br><br>- Any associated alerts <br>- Active Directory account control<br>- Risky lateral movement paths<br>- A timeline of activities and alerts<br>- Details about observed locations, devices and groups. <br><br>For more information, see [Investigate users in Microsoft 365 Defender](investigate-users.md). | +|**Device page** | Microsoft 365 Defender alert evidence lists all devices and users connected to each suspicious activity. Investigate further by selecting a specific device in an alert to access a device details page. <br><br>For more information, see [Investigate devices in the Microsoft Defender for Endpoint Devices list](../defender-endpoint/investigate-machines.md). | +|**Advanced hunting** | Microsoft 365 Defender helps you proactively search for threats and malicious activity by using advanced hunting queries. These powerful queries can be used to locate and review threat indicators and entities for both known and potential threats. <br><br>Build custom detection rules from advanced hunting queries to help you proactively watch for events that might be indicative of breach activity and misconfigured devices. <br><br>For more information, see [Proactively hunt for threats with advanced hunting in Microsoft 365 Defender](advanced-hunting-overview.md). | +|**Global search** | Using the search bar at the top of the Microsoft 365 Defender page to search for any entity being monitored by Microsoft 365 Defender, including identities, endpoints, Office 365 data, and more. <br><br>Select results directly from the search drop-down, or select **All users** or **All devices** to see all entities associated with a given search term. | +| **Lateral movement paths** | Microsoft 365 Defender provides lateral movement path data on the **Advanced hunting** page and the **Lateral movement paths** security assessment, in addition to the **Lateral movement paths** tab on the user details page. <br><br> For more information, see [Understand and investigate lateral movement paths (LMPs) with Microsoft Defender for Identity](/defender-for-identity/understand-lateral-movement-paths). | -### Alert exclusions (updated) +### Detection and response -The alert interface is more user friendly, including adding a useful search function. Additionally, it now includes global exclusions. This means that any entity can be excluded from all alerts generated by Defender for Identity, helping with any testing scenarios you may have. For more information, see [Configure Defender for Identity detection exclusions in Microsoft 365 Defender](/defender-for-identity/exclusions). +|Area |Description | +||| +| **Alert and incident correlation** | Defender for Identity alerts are now included in Microsoft 365 Defender's alert queue, making them available to the automated incident correlation feature. <br><br>View all of your alerts in one place, and determine the scope of the breach even quicker than before. <br><br>For more information, see [Investigate Defender for Identity alerts in Microsoft 365 Defender](/defender-for-identity/manage-security-alerts). | +| **Alert exclusions and tuning** | Microsoft 365 Defender's alert interface is more user friendly, and includes a search function and global exclusions, meaning you can exclude any entity from all alerts generated by Defender for Identity. <br><br>For more information, see [Configure Defender for Identity detection exclusions in Microsoft 365 Defender](/defender-for-identity/exclusions).| +| **Remediation actions** | Defender for Identity remediation actions, such as disabling accounts or requiring password resets, are available from the Microsoft 365 Defender user details page. <br><br>For more information, see [Remediation actions in Microsoft Defender for Identity](/defender-for-identity/remediation-actions). -### Entity profiles -Defender for Identity data is now included in the Microsoft 365 User and Device entity profiles. -### Remediation actions (new) --Defender for Identity remediation actions, such as disabling accounts or requiring password resets, can now be taken from the Microsoft 365 Defender User page. For more information, see [Remediation actions in Microsoft Defender for Identity](/defender-for-identity/remediation-actions). --### Lateral movement paths --In addition to the **Lateral movement paths** tab on the user page, lateral movement paths can also be discovered via the **Advanced hunting** feature and the Lateral Movement paths security assessment. For more information, see [Microsoft Defender for Identity Lateral Movement Paths (LMPs)](/defender-for-identity/understand-lateral-movement-paths). --## Related videos --- [New for Microsoft Defender for Identity](https://www.microsoft.com/videoplayer/embed/RE4HcEU)+## Quick reference -## Related information +The table below lists the changes in navigation between Microsoft Defender for Identity and Microsoft 365 Defender. +| **Defender for** Identity | **Microsoft 365 Defender** | +| -- | | +| **Timeline** |- Microsoft 365 Defender Alerts/Incidents queue | +| **Reports** |- Lateral movement path and passwords exposed in cleartext reports are covered by the [Identity security posture assessments](/defender-for-identity/security-assessment#assessment-reports) (ISPM)<br><br>- Health issues are available in **Settings** -> **Identities** -> **Health issues**<br><br>- View a summary of alerts by exporting the alerts queue or from the **Advanced hunting** page, which provides 30 days of data<br><br>- Modify sensitive groups from the **Advanced hunting** page<br><br>**Tip**: Use the **Advanced hunting** page to create customized reports in Microsoft 365 Defender. | +| **Identity page** | Microsoft 365 Defender user details page | +| **Device page** | Microsoft 365 Defender device details page | +| **Group page** | Microsoft 365 Defender groups side pane | +| **Alert page** | Microsoft 365 Defender alert details page <br><br>**Tip**: Use [alert tuning](investigate-alerts.md#tune-an-alert) to optimize the alerts you see in Microsoft 365 Defender. | +| **Search** | Microsoft 365 Defender global search | +| **Health center** | **Settings** -> **Identities** -> **Health issues** -> **Global / Sensor health issues** | +| **Entity activities** | - **Advanced hunting** <br>- Device page > **Timeline** <br>- Identity page > **Timeline** tab | +| **Settings** | **Settings** -> **Identities** | +| **Users and accounts** | **Assets** -> **Identities** | +| **Identity security posture** | [Microsoft Defender for Identity's security posture assessments](/defender-for-identity/security-assessment) | +| **Onboarding a new workspace** | **Settings** -> **Identities** (automatically) | +| **About** | **Settings > Identities > About** | +++## Next steps ++For more information, see: ++- [Related videos for Microsoft Defender for Identity](https://www.microsoft.com/videoplayer/embed/RE4HcEU) - [Microsoft 365 Defender](microsoft-365-defender.md)-+- [Microsoft Defender for Identity](/defender-for-identity/) |
| security | Air Remediation Actions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-remediation-actions.md | Microsoft Defender for Office 365 includes remediation actions to address variou |User|A user is sending malware/phish|Automated investigation doesn't result in a specific pending action. <p> The user might be reporting malware/phish, or someone could be [spoofing the user](anti-phishing-protection-spoofing-about.md) as part of an attack. Use [Threat Explorer](threat-explorer-about.md) to view and handle email containing [malware](threat-explorer-views.md#malware) or [phish](threat-explorer-views.md#phish).| |User|Email forwarding <br> (Mailbox forwarding rules are configured, chch could be used for data exfiltration.)|Remove forwarding rule <p> Use the [Autofowarded messages report](/exchange/monitoring/mail-flow-reports/mfr-auto-forwarded-messages-report) to view specific details about forwarded email.| |User|Email delegation rules <br> (A user's account has delegations set up.)|Remove delegation rule <p> If your organization is using [Microsoft Defender for Endpoint](/windows/security/threat-protection/), consider [investigating the user](/microsoft-365/security/defender-endpoint/investigate-user) who's getting the delegation permission.|-|User|Data exfiltration <br> (A user violated email or file-sharing [DLP policies](../../compliance/dlp-learn-about-dlp.md) |Automated investigation doesn't result in a specific pending action. <p> [View DLP reports and take action](../../compliance/view-the-dlp-reports.md).| +|User|Data exfiltration <br> (A user violated email or file-sharing [DLP policies](../../compliance/dlp-learn-about-dlp.md) |Automated investigation doesn't result in a specific pending action. <p> [Get started with Activity Explorer](../../compliance/data-classification-activity-explorer.md#get-started-with-activity-explorer).| |User|Anomalous email sending <br> (A user recently sent more email than during the previous 7-10 days.)|Automated investigation doesn't result in a specific pending action. <p> Sending a large volume of email isn't malicious by itself; the user might just have sent email to a large group of recipients for an event. To investigate, use the [New users forwarding email insight in the EAC](/exchange/monitoring/mail-flow-insights/mfi-new-users-forwarding-email-insight) and [Outbound message report in the EAC](/exchange/monitoring/mail-flow-reports/mfr-inbound-messages-and-outbound-messages-reports) to determine what's going on and take action.| ## Next steps |
| security | Attack Simulation Training End User Notifications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-end-user-notifications.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # End-user notifications for Attack simulation training [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)- In Attack simulation training in Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, end-user notifications are email messages that are sent to users as a result of [simulations](attack-simulation-training-simulations.md) or [simulation automations](attack-simulation-training-simulation-automations.md). The following types of end-user notifications are available: - **Positive reinforcement notification**: Sent when users report a simulated phishing message. |
| security | Attack Simulation Training Faq | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-faq.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Attack simulation training deployment considerations and FAQ [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)- Attack simulation training enables Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2 organizations to measure and manage social engineering risk by allowing the creation and management of phishing simulations that are powered by real-world, de-weaponized phishing payloads. Hyper-targeted training, delivered in partnership with Terranova security, helps improve knowledge and change employee behavior. For more information about getting started with Attack simulation training, see [Get started using Attack simulation training](attack-simulation-training-get-started.md). |
| security | Attack Simulation Training Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-get-started.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Get started using Attack simulation training [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** - [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md) - In organizations with Microsoft Defender for Office 365 Plan 2 (add-on licenses or included in subscriptions like Microsoft 365 E5), you can use Attack simulation training in the Microsoft 365 Defender portal to run realistic attack scenarios in your organization. These simulated attacks can help you identify and find vulnerable users before a real attack impacts your bottom line. Read this article to learn more. Watch this short video to learn more about Attack simulation training. |
| security | Attack Simulation Training Insights | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-insights.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Insights and reports for Attack simulation training [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** - [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md) - In Attack simulation training in Microsoft Defender for Office Plan 2 or Microsoft 365 E5, Microsoft provides insights and reports from the results of simulations and the corresponding trainings. This information keeps you informed on the threat readiness progress of your users, and recommended next steps to better prepare your users for future attacks. Insights and reports are available in the following locations on the **Attack simulation training** page in the Microsoft 365 Defender portal: |
| security | Attack Simulation Training Landing Pages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-landing-pages.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Landing pages in Attack simulation training -**Applies to** - [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md) - In Attack simulation training in Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, landing pages are the web pages that users are taken to if they open the payload in the simulation. For getting started information about Attack simulation training, see [Get started using Attack simulation training](attack-simulation-training-get-started.md). |
| security | Attack Simulation Training Login Pages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-login-pages.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Login pages in Attack simulation training -**Applies to** - [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md) - In Attack simulation training in Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, login pages are shown to users in simulations that use **Credential Harvest** and **Link in Attachment** [social engineering techniques](attack-simulation-training-simulations.md#select-a-social-engineering-technique). For getting started information about Attack simulation training, see [Get started using Attack simulation training](attack-simulation-training-get-started.md). |
| security | Attack Simulation Training Payload Automations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-payload-automations.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Payload automations for Attack simulation training [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** - [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md) - In Attack simulation training in Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, payload automations (also known as _payload harvesting_) collect information from real-world phishing attacks that were reported by users in your organization. Although the numbers of these messages are likely low in your organization, you can specify the conditions to look for in phishing attacks (for example, recipients, social engineering technique, sender information, etc.). Attack simulation training will then mimic the messages and payloads used in the attack to automatically launch harmless simulations to targeted users. For getting started information about Attack simulation training, see [Get started using Attack simulation training](attack-simulation-training-get-started.md). |
| security | Attack Simulation Training Payloads | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-payloads.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Payloads in Attack simulation training [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** - [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md) - In Attack simulation training in Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, a _payload_ is the link or attachment in the simulated phishing email message that's presented to users. Attack simulation training offers a robust built-in payload catalog for the available social engineering techniques. However, you might want to create custom payloads that work better for your organization. For getting started information about Attack simulation training, see [Get started using Attack simulation training](attack-simulation-training-get-started.md). |
| security | Attack Simulation Training Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-settings.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Global settings in Attack simulation training [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** - [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md) - In Attack simulation training in Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, the **Settings** tab contains settings that affect all simulations: - **Repeat offender threshold**: A _repeat offender_ is someone who gives up their credentials in multiple consecutive simulations. How many simulations in a row constitute a repeat offender is determined by the repeat offender threshold. Information about repeat offenders appears in the following locations: |
| security | Attack Simulation Training Simulation Automations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-simulation-automations.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Simulation automations for Attack simulation training [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** - [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md) - In Attack simulation training in Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, simulation automations allow you to run multiple benign cyberattack simulations in your organization. Simulation automations can contain multiple social engineering techniques and payloads, and can start on an automated schedule. Creating a simulation automation is very similar to [creating an individual simulation](attack-simulation-training-simulations.md), except for the ability to select multiple techniques, payloads, and the automation schedule. For getting started information about Attack simulation training, see [Get started using Attack simulation training](attack-simulation-training-get-started.md). |
| security | Attack Simulation Training Simulations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-simulations.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Simulate a phishing attack with Attack simulation training [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** - [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md) - In Attack simulation training in Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, simulations are benign cyberattacks that you run in your organization. These simulations test your security policies and practices, as well as train your employees to increase their awareness and decrease their susceptibility to attacks. This article walks you through creating a simulated phishing attack using Attack simulation training. For getting started information about Attack simulation training, see [Get started using Attack simulation training](attack-simulation-training-get-started.md). |
| security | Attack Simulation Training Teams | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-teams.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Microsoft Teams in Attack simulation training Last updated 4/4/2023 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)- In organizations with Microsoft Defender for Office 365 Plan 2 or Microsoft 365 Defender, admins can now use Attack simulation training to deliver simulated phishing messages in Microsoft Teams. For more information about attack simulation training, see [Get started using Attack simulation training in Defender for Office 365](attack-simulation-training-get-started.md). The addition of Teams in Attack simulation training affects the following features: |
| security | Attack Simulation Training Training Campaigns | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-training-campaigns.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Training campaigns in Attack simulation training [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** - [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md) - In Attack simulation training in Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, Training campaigns are a faster, more direct way to provide security training to users. Instead of creating and launching [simulated phishing attacks](attack-simulation-training-simulations.md) that eventually lead to training, you can create and assign Training campaigns directly to users. A Training campaign contains one or more built-in Training modules that you select. Currently, there are over 70 Training modules to select from. For more information about Training modules, see [Training modules for Training campaigns in Attack simulation training](attack-simulation-training-training-modules.md). |
| security | Attack Simulation Training Training Modules | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-training-modules.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Training modules for Training campaigns in Attack simulation training [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** - [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md) - In Attack simulation training in Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, you select one or more Training modules to include in Training campaigns that you create and assign to users. For more information about Training campaigns, see [Training campaigns in Attack simulation training](attack-simulation-training-training-campaigns.md). To see the available Training modules, open the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Attack simulation training** \> **Content library** tab \> and then select **Training modules**. Or, to go directly to the **Content library** tab where you can select **Training modules**, use <https://security.microsoft.com/attacksimulator?viewid=contentlibrary>. |
| security | Azure Ip Protection Features | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/azure-ip-protection-features.md | f1.keywords: Previously updated : 1/31/2023 Last updated : 6/14/2023 audience: ITPro +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Protection features in Azure Information Protection rolling out to existing tenants -**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- To help with the initial step in protecting your information, starting July 2018 all Azure Information Protection eligible tenants will have the protection features in Azure Information Protection turned on by default. The protection features in Azure Information Protection were formerly known in Office 365 as Rights Management or Azure RMS. If your organization has an Office E3 service plan or a higher service plan, you'll now get a head start protecting information through Azure Information Protection when we roll out these features. ## Changes beginning July 1, 2018 |
| security | Campaigns | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/campaigns.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Campaigns in Microsoft Defender for Office 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)- In Microsoft 365 organizations with Microsoft Defender for Office 365 Plan 2, the _campaigns_ feature identifies and categorizes coordinated phishing and malware email attacks. Microsoft's categorization of email attacks into discrete campaigns helps you to: - Efficiently investigate and respond to email attacks. |
| security | Configuration Analyzer For Security Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Configuration analyzer for protection policies in EOP and Microsoft Defender for Office 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- Configuration analyzer in the Microsoft 365 Defender portal provides a central location to find and fix security policies where the settings are below the Standard protection and Strict protection profile settings in [preset security policies](preset-security-policies.md). The following types of policies are analyzed by the configuration analyzer: |
| security | Configure Junk Email Settings On Exo Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-junk-email-settings-on-exo-mailboxes.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Configure junk email settings on Exchange Online mailboxes [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online, organizational anti-spam settings are controlled by Exchange Online Protection (EOP). For more information, see [Anti-spam protection in EOP](anti-spam-protection-about.md). But, there are also specific anti-spam settings that admins can configure on individual mailboxes in Exchange Online: |
| security | Connection Filter Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/connection-filter-policies-configure.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Configure connection filtering [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with Exchange Online mailboxes or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, _connection filtering_ and the default connection filter policy identify good or bad source email servers by IP addresses. The key components of the default connection filter policy are: - **IP Allow List**: Skip spam filtering for all incoming messages from the specified source IP addresses or IP address ranges. All incoming messages are scanned for malware and high-confidence phishing. For other scenarios where spam filtering still occurs on messages from servers in the IP Allow List, see the [Scenarios where messages from sources in the IP Allow List are still filtered](#scenarios-where-messages-from-sources-in-the-ip-allow-list-are-still-filtered) section later in this article. For more information about how the IP Allow List should fit into your overall safe senders strategy, see [Create safe sender lists in EOP](create-safe-sender-lists-in-office-365.md). |
| security | Connectors Detect Respond To Compromise | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/connectors-detect-respond-to-compromise.md | description: Learn how to recognize and respond to a compromised connector in Mi search.appverid: met150 Previously updated : 5/22/2023 Last updated : 6/14/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Respond to a compromised connector [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** --- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- Connectors are used for enabling mail flow between Microsoft 365 and email servers that you have in your on-premises environment. For more information, see [Configure mail flow using connectors in Exchange Online](/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/use-connectors-to-configure-mail-flow). An inbound connector with the **Type** value `OnPremises` is considered compromised when an attacker creates a new connector or modifies and existing connector to send spam or phishing email. |
| security | Connectors Mail Flow Intelligence | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/connectors-mail-flow-intelligence.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Mail flow intelligence in EOP [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, you typically use a connector to route email messages from EOP to your on-premises email environment. You might also use a connector to route messages from Microsoft 365 to a partner organization. When Microsoft 365 can't deliver these messages via the connector, they're queued in Microsoft 365. Microsoft 365 continues to retry delivery for each message for 24 hours. After 24 hours, the queued message expires, and the message is returned to the original sender in a non-delivery report (also known as an NDR or bounce message). Microsoft 365 generates an error when a message can't be delivered by using a connector. The most common errors and their solutions are described in this article. Collectively, queuing and notification errors for undeliverable messages sent via connectors is known as _mail flow intelligence_. |
| security | Connectors Remove Blocked | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/connectors-remove-blocked.md | description: Admins can learn how to remove connectors from the Restricted entit search.appverid: met150 Previously updated : 5/19/2023 Last updated : 6/14/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Remove blocked connectors from the Restricted entities page [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** --- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, several things happen if an [inbound connector](/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/use-connectors-to-configure-mail-flow) is detected as potentially compromised: - The connector is prevented from sending or relaying email. |
| security | Create Block Sender Lists In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/create-block-sender-lists-in-office-365.md | search.appverid: description: Admins can learn about the available and preferred options to block inbound messages in Exchange Online Protection (EOP). Previously updated : 1/31/2023 Last updated : 6/14/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Create blocked sender lists in EOP [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, EOP offers multiple ways of blocking email from unwanted senders. Collectively, you can think of these options as _blocked sender lists_. The available blocked sender lists are described in the following list in order from most recommended to least recommended: |
| security | Create Safe Sender Lists In Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Create safe sender lists in EOP [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- If you're a Microsoft 365 customer with mailboxes in Exchange Online or a standalone Exchange Online Protection (EOP) customer without Exchange Online mailboxes, EOP offers multiple ways of ensuring that users receive email from trusted senders. Collectively, you can think of these options as _safe sender lists_. The available safe sender lists are described in the following list in order from most recommended to least recommended: |
| security | Defender For Office 365 Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/defender-for-office-365-whats-new.md | f1.keywords: NOCSH ms.localizationpriority: medium Previously updated : 04/12/2023 Last updated : 06/14/2023 audience: ITPro +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # What's new in Microsoft Defender for Office 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to:** --- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- This article lists new features in the latest release of Microsoft Defender for Office 365. Features that are currently in preview are denoted with **(preview)**. Learn more by watching [this video](https://www.youtube.com/watch?v=Tdz6KfruDGo&list=PL3ZTgFEc7LystRja2GnDeUFqk44k7-KXf&index=3). |
| security | Detect And Remediate Illicit Consent Grants | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> + # Detect and Remediate Illicit Consent Grants [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- **Summary** Learn how to recognize and remediate the illicit consent grants attack in Microsoft 365. ## What is the illicit consent grant attack in Microsoft 365? |
| security | Detect And Remediate Outlook Rules Forms Attack | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/detect-and-remediate-outlook-rules-forms-attack.md | f1.keywords: Previously updated : 1/31/2023 Last updated : 6/14/2023 audience: ITPro - tier2 - m365-security- ms.localizationpriority: medium search.appverid: - MET150 description: Learn how to recognize and remediate the Outlook rules and custom f +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> + # Detect and Remediate Outlook Rules and Custom Forms Injections Attacks [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] |
| security | Email Analysis Investigations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-analysis-investigations.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Email analysis in investigations for Microsoft Defender for Office 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- During the automated investigation of alerts, Microsoft Defender for Office 365 analyzes the original email for threats and identifies other emails that are related to the original email and potentially part of an attack. This analysis is important because email attacks rarely consist of a single email. The automated investigation's email analysis identifies email clusters using attributes from the original email to query for emails sent and received by your organization. This is similar to a security operations analyst would hunt for the related emails in Explorer or Advanced Hunting. Several queries are used to identify matching emails because attackers typically morph the email parameters to avoid security detection. The clustering analysis performs these checks to determine how to handle emails involved in the investigation: |
| security | Email Authentication About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-authentication-about.md | ms.localizationpriority: high description: Admins can learn how EOP uses email authentication (SPF, DKIM, and DMARC) to help prevent spoofing, phishing, and spam. Previously updated : 1/31/2023 Last updated : 6/15/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Email authentication in EOP [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- Email authentication (also known as email validation) is a group of standards that tries to stop spoofing (email messages from forged senders). In all Microsoft 365 organizations, EOP uses these standards to verify inbound email: - [SPF](email-authentication-spf-configure.md) |
| security | Email Authentication Anti Spoofing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-authentication-anti-spoofing.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # How Microsoft 365 uses Sender Policy Framework (SPF) to prevent spoofing [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- An _SPF TXT record_ is a record in DNS that helps prevent spoofing and phishing by identifying valid sources of messages from senders in the domain. SPF validates the origin of email messages by verifying the IP address of the sender against the alleged owner of the sending domain. > [!NOTE] |
| security | Email Authentication Dkim Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-authentication-dkim-configure.md | f1.keywords: Previously updated : 1/31/2023 Last updated : 6/15/2023 audience: ITPro +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Use DKIM to validate outbound email sent from your custom domain [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)-- This article lists the steps to use DomainKeys Identified Mail (DKIM) with Microsoft 365 to ensure that destination email systems trust messages sent outbound from your custom domain. +This article lists the steps to use DomainKeys Identified Mail (DKIM) with Microsoft 365 to ensure that destination email systems trust messages sent outbound from your custom domain. In this article: |
| security | Email Authentication Dkim Support About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-authentication-dkim-support-about.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Support for validation of DKIM signed messages [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- Exchange Online Protection (EOP) and Exchange Online both support inbound validation of Domain Keys Identified Mail ([DKIM](https://www.rfc-editor.org/rfc/rfc6376.txt)) messages. DKIM validates that an email message wasn't *spoofed* by someone else, and was sent from the domain it *says* it came from. It ties an email message to the organization that sent it. DKIM verification is used automatically for all messages sent with IPv6. Microsoft 365 also supports DKIM when mail is sent over IPv4. (For more information about IPv6 support, see [Support for anonymous inbound email messages over IPv6](mail-flow-inbound-ipv6-support-about.md).) |
| security | Email Authentication Dmarc Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-authentication-dmarc-configure.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Use DMARC to validate email [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- Domain-based Message Authentication, Reporting, and Conformance ([DMARC](https://dmarc.org)) works with Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) to authenticate mail senders. DMARC ensures the destination email systems trust messages sent from your domain. Using DMARC with SPF and DKIM gives organizations more protection against spoofing and phishing email. DMARC helps receiving mail systems decide what to do with messages from your domain that fail SPF or DKIM checks. |
| security | Email Authentication Dmarc Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-authentication-dmarc-reports.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Use DMARC Reports to validate email in Microsoft Office 365 |
| security | Email Authentication Spf Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-authentication-spf-configure.md | f1.keywords: Previously updated : 1/31/2023 Last updated : 6/15/2023 audience: ITPro +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Set up SPF to help prevent spoofing -- [Prerequisites](#prerequisites)-- [Create or update your SPF TXT record](#create-or-update-your-spf-txt-record)-- [How to handle subdomains?](#how-to-handle-subdomains)-- [Troubleshooting SPF](#troubleshooting-spf)--<!-- [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)>- This article describes how to update a Domain Name Service (DNS) record so that you can use Sender Policy Framework (SPF) email authentication with your custom domain in Office 365. SPF helps *validate* outbound email sent from your custom domain (is coming from who it says it is). It's a first step in setting up the full recommended email authentication methods of SPF, [DKIM](email-authentication-dkim-configure.md), and [DMARC](email-authentication-dmarc-configure.md). |
| security | Email Security In Microsoft Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-security-in-microsoft-defender.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Email security with Threat Explorer in Microsoft Defender for Office 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to:** -- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)--In this article: --- [View malware detected in email](#view-malware-detected-in-email)-- [View phishing URL and click verdict data](#view-phishing-url-and-click-verdict-data)-- [Start automated investigation and response](#start-automated-investigation-and-response)--> [!NOTE] -> This is part of a **3-article series** on **Threat Explorer (Explorer)**, **email security**, and **Explorer and Real-time detections** (such as differences between the tools, and permissions needed to operate them). The other two articles in this series are [Threat hunting in Threat Explorer](threat-explorer-threat-hunting.md) and [Threat Explorer and Real-time detections](real-time-detections.md). - This article explains how to view and investigate malware and phishing attempts that are detected in email by Microsoft 365 security features. ## View malware detected in email |
| security | Eop About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/eop-about.md | f1.keywords: Previously updated : 1/31/2023 Last updated : 6/15/2023 audience: ITPro description: Learn how Exchange Online Protection (EOP) can help protect your on search.appverid: met150+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Exchange Online Protection overview [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- Exchange Online Protection (EOP) is the cloud-based filtering service that protects your organization against spam, malware, and other email threats. EOP is included in all Microsoft 365 organizations with Exchange Online mailboxes. > [!NOTE] |
| security | Help And Support For Eop | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/help-and-support-for-eop.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Help and support for EOP [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, the technical support resources listed in this article will help you find answers if you are having difficulty with EOP. Microsoft provides help for EOP in a variety of places and methods including self-support and assisted-support. ## Self-support options |
| security | How Policies And Protections Are Combined | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/how-policies-and-protections-are-combined.md | description: Admins can learn about the application order of protections in Exch search.appverid: met150 Previously updated : 1/31/2023 Last updated : 6/15/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Order and precedence of email protection [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, inbound email may be flagged by multiple forms of protection. For example, the built-in anti-phishing policies in EOP that are available to all Microsoft 365 customers, and the more robust anti-phishing policies that are available to Microsoft Defender for Office 365 customers. Messages also pass through multiple detection scans for malware, spam, phishing, etc. Given all this activity, there may be some confusion as to which policy is applied. In general, a policy that's applied to a message is identified in the **X-Forefront-Antispam-Report** header in the **CAT (Category)** property. For more information, see [Anti-spam message headers](message-headers-eop-mdo.md). |
| security | Investigate Malicious Email That Was Delivered | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/investigate-malicious-email-that-was-delivered.md | f1.keywords: Previously updated : 1/31/2023 Last updated : 6/15/2023 audience: ITPro +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Investigate malicious email that was delivered in Microsoft 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to:** --- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- [Microsoft Defender for Office 365](defender-for-office-365.md) enables you to investigate activities that put people in your organization at risk, and to take action to protect your organization. For example, if you are part of your organization's security team, you can find and investigate suspicious email messages that were delivered. You can do this by using [Threat Explorer (or real-time detections)](threat-explorer-about.md). > [!NOTE] |
| security | Mail Flow About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mail-flow-about.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Mail flow in EOP [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)--In Microsoft 365 organizations with Exchange Online mailboxes, or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, all messages sent to your organization pass through EOP before users see them. You have options about how to route messages that pass through EOP for processing before they are routed to user mailboxes. +In Microsoft 365 organizations with Exchange Online mailboxes, or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, all messages sent to your organization pass through EOP before users see them. You have options about how to route messages that pass through EOP for processing before they're routed to user mailboxes. ## Working with messages and message access options -EOP offers flexibility in how your messages are routed. The following topics explain steps in the mail flow process. +EOP offers flexibility in how your messages are routed. The following articles explain steps in the mail flow process. -[Use Directory Based Edge Blocking to reject messages sent to invalid recipients](/exchange/mail-flow-best-practices/use-directory-based-edge-blocking) Describes the Directory Based Edge Blocking feature which lets you reject messages for invalid recipients at the service network perimeter. +[Directory Based Edge Blocking](/exchange/mail-flow-best-practices/use-directory-based-edge-blocking) reject messages to invalid recipients at the service network perimeter by default. [View or edit accepted domains in EOP](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) describes how to manage domains that are associated with your EOP service. -If you add subdomains to your organization, your EOP service can help you manage these too. Learn more about subdomains at [Enable mail flow for subdomains in Exchange Online](/exchange/mail-flow-best-practices/manage-accepted-domains/enable-mail-flow-for-subdomains). +Your EOP service can help you manage subdomains that you add to your organization. Learn more about subdomains at [Enable mail flow for subdomains in Exchange Online](/exchange/mail-flow-best-practices/manage-accepted-domains/enable-mail-flow-for-subdomains). [Configure mail flow using connectors](/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/use-connectors-to-configure-mail-flow) introduces connectors and shows how you can use them to customize mail routing. Scenarios include ensuring secure communication with a partner organization and setting up a smart host. |
| security | Mail Flow Inbound Ipv6 Support About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mail-flow-inbound-ipv6-support-about.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Add support for anonymous inbound email over IPv6 in Microsoft 365 -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- Microsoft 365 organizations with Exchange Online mailboxes and standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes support anonymous inbound email over IPv6. The source IPv6 email server must meet both of the following requirements: - The source IPv6 address must have a valid reverse DNS lookup (PTR) record that allows the destination to find the domain name from the IPv6 address. After anonymous inbound IPv6 message support is enabled in your organization, th ## Troubleshooting -- If the source email server doesn't have an IPv6 reverse DNS lookup record, the messages will be rejected with the following error:+- If the source email server doesn't have an IPv6 reverse DNS lookup record, the messages are rejected with the following error: > 450 4.7.25 Service unavailable, sending IPv6 address [2a01:111:f200:2004::240] must have reverse DNS record. -- If the sender doesn't pass SPF or DKIM validation, the messages will be rejected with the following error:+- If the sender doesn't pass SPF or DKIM validation, the messages are rejected with the following error: > 450 4.7.26 Service unavailable, message sent over IPv6 [2a01:111:f200:2004::240] must pass either SPF or DKIM validation. -- If you try to receive anonymous IPv6 messages before you've opted in, the message will be rejected with the following error:+- If you try to receive anonymous IPv6 messages before you've opted in, the message is rejected with the following error: > 550 5.2.1 Service unavailable, [contoso.com] does not accept email over IPv6. -## Related topics +## Related articles [Support for validation of DKIM signed messages](email-authentication-dkim-support-about.md) |
| security | Mail Flow Troubleshooting | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mail-flow-troubleshooting.md | +appliesto: + - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - Γ£à <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> # Troubleshooting mail sent to Microsoft 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)--This article provides troubleshooting information for senders who are experiencing issues when trying to send email to inboxes in Microsoft 365 and best practices for bulk mailing to customers. +This article provides troubleshooting information for senders who are experiencing issues when trying to send email to recipients in Microsoft 365, and best practices for bulk mailing to customers. ## Are you managing your IP and domain's sending reputation? -EOP filtering technologies are designed to provide anti-spam protection for Microsoft 365 and other Microsoft products like Exchange Server. We also use SPF, DKIM, and DMARC; email authentication technologies that help address the problem of spoofing and phishing by verifying that the domain sending the email is authorized to do so. EOP filtering is influenced by many factors related to the sending IP, domain, authentication, list accuracy, complaint rates, content and more. Of these, one of the principal factors in driving down a sender's reputation and their ability to deliver email is their junk email complaint rate. +[Exchange Online Protection](eop-about.md) (EOP) provides anti-spam protection for Microsoft 365. We also use email authentication technologies like SPF, DKIM, and DMARC to verify that the domain sending the email is authorized to do so. Many factors influence EOP filtering. For example, the sending IP, domain, email authentication, list accuracy, complaint rates, content, and more. One of the principal factors in driving down a sender's reputation and their ability to deliver email is their junk email complaint rate. ## Are you sending email from new IP addresses? -IP addresses not previously used to send email typically don't have any reputation built up in our systems. As a result, emails from new IPs are more likely to experience delivery issues. Once the IP has built a reputation for not sending spam, EOP typically allows for a better email delivery experience. +IP addresses that have never been used to send email typically don't have any reputation in our systems. As a result, email from new sources are more likely to experience delivery issues. Once the IP address has built a reputation for not sending spam, EOP typically allows for a better email delivery experience. -New IPs that are added for domains that are authenticated under existing SPF records typically experience the added benefit of inheriting some of the domain's sending reputation. If your domain has a good sending reputation new IPs may experience a faster ramp up time. A new IP can expect to be fully ramped within a couple of weeks or sooner depending on volume, list accuracy, and junk email complaint rates. +New IPs for domains with existing SPF records typically experience the added benefit of inheriting some of the domain's sending reputation. If your domain has a good sending reputation, new IPs might experience a faster ramp up time. A new IP can expect to be fully ramped within a couple of weeks or less depending on volume, list accuracy, and junk email complaint rates. ## Confirm that your DNS is set up correctly For instructions about how to create and maintain DNS records, including the MX record required for mail routing, you need to contact your DNS hosting provider. -## Ensure that you do not advertise yourself as a non-routable IP +## Ensure that you don't advertise yourself as a nonroutable IP -We may not accept email from senders who fail a reverse-DNS lookup. In some cases, legitimate senders advertise themselves incorrectly as a non-internet routable IP when attempting to open a connection to EOP. IP addresses that are reserved for private (non-routable) networking include: +We might not accept email from senders who fail a reverse-DNS lookup. In some cases, legitimate senders advertise themselves incorrectly as a non-internet routable IP when attempting to open a connection to EOP. IP addresses that are reserved for private (nonroutable) networking include: - 192.168.0.0/16 (or 192.168.0.0 - 192.168.255.255) - 10.0.0.0/8 (or 10.0.0.0 - 10.255.255.255) We may not accept email from senders who fail a reverse-DNS lookup. In some case ## You received a non-delivery report (NDR) when sending email to a user in Office 365 -Some delivery issues are the result of the sender's IP address being blocked by Microsoft or because the user account is identified as banned sender due to previous spam activity. If you believe that you've received the NDR in error, first follow any instructions in the NDR message to resolve the issue. +Some delivery issues are the result of Microsoft blocking the sender's IP address, or the user account is identified as banned sender due to previous spam activity. If you believe that you received the non-delivery report (also known as an NDR or bounce message) in error, follow any instructions in the NDR message to resolve the issue. For more information about the error you received, see the list of error codes in [Email non-delivery reports in Exchange Online](/exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/non-delivery-reports-in-exchange-online). - For example, if you receive the following NDR, it indicates that the sending IP address was blocked by Microsoft: +For example, the following NDR indicates that Microsoft blocked the sending IP address: - `550 5.7.606-649 Access denied, banned sending IP [x.x.x.x]; To request removal from this list please visit https://sender.office.com/ and follow the directions.` +`550 5.7.606-649 Access denied, banned sending IP [x.x.x.x]; To request removal from this list please visit https://sender.office.com/ and follow the directions.` -To request removal from this list, you can [Use the delist portal to remove yourself from the blocked senders list](use-the-delist-portal-to-remove-yourself-from-the-office-365-blocked-senders-lis.md). +To request removal from this list, see [Use the delist portal to remove yourself from the blocked senders list](use-the-delist-portal-to-remove-yourself-from-the-office-365-blocked-senders-lis.md). ## My email landed in the recipient's Junk Email folder -If a message was incorrectly identified as spam by EOP, you can work with the recipient to submit this false positive message to the Microsoft Spam Analysis Team, who evaluates and analyzes the message. For more information, see [Report messages and files to Microsoft](submissions-report-messages-files-to-microsoft.md). +If a message was incorrectly identified as spam by EOP, you can work with the recipient to submit this false positive message to Microsoft for analysis. For more information, see [Report messages and files to Microsoft](submissions-report-messages-files-to-microsoft.md). -## Traffic from my IP address is throttled by EOP +## EOP throttled traffic from my IP address -If you receive an NDR from EOP that indicates that your IP address is being throttled by EOP, for example: +You receive the following NDR because suspicious activity was detected from the source IP address. Mail from the source has been temporarily restricted while it's being evaluated. - `host xxxx.outlook.com [x.x.x.x]: 451 4.7.550 Access denied, please try again later` +`host xxxx.outlook.com [x.x.x.x]: 451 4.7.550 Access denied, please try again later` -You received the NDR because suspicious activity has been detected from the IP address and it has been temporarily restricted while it's being further evaluated. If the suspicion is cleared through evaluation, this restriction will be lifted shortly. +After we evaluate the messages and determine everything is OK, we remove the restriction. ## I can't receive email from senders in Microsoft 365 - In order to receive messages from our users, make sure your network allows connections from the IP addresses that EOP uses in our datacenters. For more information, see [Exchange Online Protection IP addresses](../../enterprise/urls-and-ip-address-ranges.md). +To receive messages from Microsoft 365 senders, make sure your network allows connections from the IP addresses that EOP uses in our datacenters. For more information, see [Exchange Online Protection IP addresses](../../enterprise/urls-and-ip-address-ranges.md). ## Best practices for bulk emailing to Microsoft 365 users -If you often conduct bulk email campaigns to Microsoft 365 users and want to ensure that your emails arrive in a safe and timely manner, follow the tips in this section. +If you often conduct bulk email campaigns to Microsoft 365 users, follow the tips in this section. ### Ensure that the From name reflects who is sending the message -The Subject should be a brief summary of what the message is about, and the message body should clearly and succinctly indicate what the offering, service, or product is about. For example: +The Subject line of the message should be a brief summary of what the message is about. The message body should clearly and succinctly indicate what the offering, service, or product is about. For example: Correct: Incorrect: > From: someone@outlook.com <br> Subject: Catalogs -The easier you make it for people to know who you are and what you are doing, the less difficulty you have delivering through most spam filters. +The easier you make it for people to know who you are and what you're doing, the less difficulty you have with most spam filters. ### Always include an unsubscribe option in campaign emails -Marketing emails, especially newsletters, should always include a way of unsubscribing from future emails. For example: +Marketing email, especially newsletters, should always include a way to unsubscribe. For example: - `This email was sent to example@contoso.com by sender@fabrikam.com.` +`This email was sent to example@contoso.com by sender@fabrikam.com.` - `Update Profile/Email Address | Instant removal with SafeUnsubscribe™ | Privacy Policy` +`Update Profile/Email Address | Instant removal with SafeUnsubscribe™ | Privacy Policy` -Some senders include this option by requiring recipients to send an email to a certain alias with "Unsubscribe" in the subject. This isn't preferable to the one-click example above. If you do choose to require recipients to send a mail, ensure that when they click the link, all the required fields are pre-populated. +Requiring recipients to send email with "Unsubscribe" in the Subject line is less preferable than the one-click option. If you require recipients to send a message, ensure that the link takes them to a form where all required fields are populated. ### Use the double opt-in option for marketing email or newsletter registration -This industry best practice is recommended if your company requires or encourages users to register their contact information in order to access your product or services. Some companies make it a practice to automatically sign up their users for marketing emails or e-newsletters during the registration process, but this is considered a questionable marketing practice in the world of email filtering. +This industry best practice is recommended if your company requires or encourages users to register their contact information to access your product or services. The practice of automatically signing up users for marketing emails or e-newsletters during the registration process is questionable in today's internet environment. -During the registration process, if the "Yes, please send me your newsletter" or "Yes, please send me special offers" checkbox is selected by default, users who don't pay close attention may unintentionally sign up for marketing email or newsletters that they don't want to receive. +If the options to receive your newsletter or special offers are selected by default in your registration process, it's very likely that uninterested users will get your email. - Microsoft recommends the double opt-in option instead, which means that the checkbox for marketing emails or newsletters is unchecked by default. Additionally, once the registration form has been submitted, a verification email is sent to the user with a URL that allows them to confirm their decision to receive marketing emails. +Microsoft recommends the double opt-in option, which means that the check box for marketing email or newsletters isn't selected by default. Additionally, once the registration form has been submitted, a verification email is sent to the user. The verification email contains a URL that allows the user to confirm their decision to receive marketing email. - This helps ensure that only those users who want to receive marketing email are signed up for the emails, subsequently clearing the sending company of any questionable email marketing practices. +The double opt-in method helps to eliminate any questionable email marketing practices, because no one can claim that they unintentionally signed up for marketing email. ### Ensure that email message content is transparent and traceable -Just as important as the way the emails are sent is the content they contain. When creating email content, use the following best practices to ensure that your emails won't be flagged by email filtering +Email content is as important as the way you send email. Use the following best practices to ensure that your email isn't flagged by email filtering -- When the email message requests that recipients add the sender to the address book, it should clearly state that such action isn't a guarantee of delivery.+- Requests for recipients to add the sender to their address book should clearly state that this action doesn't guarantee of delivery. -- Redirects included in the body of the message should be similar and consistent, and not multiple and varied. A redirect in this context is anything that points away from the message, such as links and documents. If you have a lot of advertising or Unsubscribe links or Update the Profile links, they should all point to the same domain. For example:+- Redirects included in the body of the message should be similar and consistent, and not multiple and varied. A redirect in this context is anything that points away from the message, such as links and documents. If you have many advertising links, unsubscribe links, or update the profile links, they all should point to the same domain. For example: Correct (all domains are the same): Just as important as the way the emails are sent is the content they contain. Wh `options.yahoo.com` -- Avoid content with large images and attachments, or messages that are solely composed of an image.+- Avoid content with large images and attachments, or messages that are composed entirely of an image. - Your public privacy or P3P settings should clearly state the presence of tracking pixels (web bugs or beacons). ### Remove incorrect email aliases from your databases -Any email alias in your database that creates a bounce-back is unnecessary and puts your outbound emails at risk for further scrutiny by email filtering services. Ensure that your email database is up-to-date. +Any incorrect email addresses in your database that result in NDRs are unnecessary and put your outbound email at risk for further scrutiny by email filtering services. Ensure that your email database is up-to-date. |
| security | Mdo Data Retention | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-data-retention.md | f1.keywords: Previously updated : 3/9/2023 Last updated : 6/15/2023 audience: ITPro +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> # Data retention information for Microsoft Defender for Office 365 |
| security | Mdo Email Entity Page | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-email-entity-page.md | f1.keywords: Previously updated : 3/28/2023 Last updated : 6/15/2023 audience: ITPro +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> # The Email entity page [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to:** -- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)--**In this article:** -- [Reach the email entity page](#how-to-get-to-the-email-entity-page)-- [Read the email entity page](#how-to-read-the-email-entity-page)-- [Use email entity page tabs](#how-to-use-the-email-entity-page-tabs)-- [New to the email entity page](#available-on-the-email-entity-page)- Admins of Microsoft Defender for Office 365 E5, and Defender for Office P1 and P2 have a 360-degree view of email using the **Email entity page**. This go-to email page was created to enhance information delivered throughout Microsoft Defender for Office 365 and Microsoft 365 Defender. See email details in the experiences below, including [previewing and downloading the email](#email-preview-and-download-for-cloud-mailboxes), the email headers *with the option to copy*, Detection details, Threats detected, Latest and Original delivery locations, Delivery actions, and IDs like Alert ID, Network Message ID and more. |
| security | Mdo Portal Permissions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-portal-permissions.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Microsoft Defender for Office 365 permissions in the Microsoft 365 Defender portal [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Exchange Online Protection](eop-about.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- Global roles in Azure Active Directory (Azure AD) allow you to manage permissions and access to capabilities in all of Microsoft 365, which also includes Microsoft Defender for Office 365. But, if you need to limit permissions and capabilities to security features in Defender for Office 365 only, you can assign **Email & collaboration** permissions in the Microsoft 365 Defender portal. To manage Defender for Office 365 permissions in the Microsoft 365 Defender portal, go to **Permissions** \> **Email & collaboration roles** \> **Roles** or go directly to <https://security.microsoft.com/emailandcollabpermissions>. |
| security | Mdo Sec Ops Guide | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-sec-ops-guide.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Microsoft Defender for Office 365 Security Operations Guide [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to:** -- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- This article gives an overview of the requirements and tasks for successfully operating Microsoft Defender for Office 365 in your organization. These tasks help ensure that your security operations center (SOC) provides a high-quality, reliable approach to protect, detect, and respond to email and collaboration-related security threats. The rest of this guide describes the required activities for SecOps personnel. The activities are grouped into prescriptive daily, weekly, monthly, and ad-hoc tasks. |
| security | Mdo Sec Ops Manage Incidents And Alerts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-sec-ops-manage-incidents-and-alerts.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Manage incidents and alerts from Microsoft Defender for Office 365 in Microsoft 365 Defender [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to:** -- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- An [incident](/microsoft-365/security/defender/incidents-overview) in Microsoft 365 Defender is a collection of correlated alerts and associated data that define the complete story of an attack. Defender for Office 365 [alerts](/microsoft-365/compliance/alert-policies#default-alert-policies), [automated investigation and response (AIR)](air-about.md#the-overall-flow-of-air), and the outcome of the investigations are natively integrated and correlated on the **Incidents** page in Microsoft 365 Defender at <https://security.microsoft.com/incidents-queue>. We refer to this page as the _Incidents queue_. Alerts are created when malicious or suspicious activity affects an entity (for example, email, users, or mailboxes). Alerts provide valuable insights about in-progress or completed attacks. However, an ongoing attack can affect multiple entities, which results in multiple alerts from different sources. Some built-in alerts automatically trigger AIR playbooks. These playbooks do a series of investigation steps to look for other impacted entities or suspicious activity. |
| security | Mdo Support Teams About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-support-teams-about.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Microsoft Defender for Office 365 support for Microsoft Teams (Preview) Last updated 4/21/2023 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)- > [!NOTE] > This article lists new features in the latest release of Microsoft Defender for Office 365. These features are currently in preview. Once you run the cmdlet, please be aware that it will take a few days for the features to to be available. |
| security | Message Headers Eop Mdo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/message-headers-eop-mdo.md | description: Admins can learn about the header fields that are added to messages Previously updated : 12/02/2022 Last updated : 6/15/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Anti-spam message headers in Microsoft 365 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- In all Microsoft 365 organizations, Exchange Online Protection (EOP) scans all incoming messages for spam, malware, and other threats. The results of these scans are added to the following header fields in messages: - **X-Forefront-Antispam-Report**: Contains information about the message and about how it was processed.- - **X-Microsoft-Antispam**: Contains additional information about bulk mail and phishing.- - **Authentication-results**: Contains information about SPF, DKIM, and DMARC (email authentication) results. This article describes what's available in these header fields. The individual fields and values are described in the following table. |Field|Description| ||| |`ARC`|The `ARC` protocol has the following fields: <ul><li>`AAR`: Records the content of the **Authentication-results** header from DMARC.</li><li>`AMS`: Includes cryptographic signatures of the message.</li><li>`AS`: Includes cryptographic signatures of the message headers. This field contains a tag of a chain validation called `"cv="`, which includes the outcome of the chain validation as **none**, **pass**, or **fail**.</li></ul>|-|`CAT:`|The category of protection policy, applied to the message: <ul><li>`BULK`: Bulk</li><li>`DIMP`: Domain Impersonation</li><li>`GIMP`: [Mailbox intelligence based impersonation](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)</li><li>`HPHSH` or `HPHISH`: High confidence phishing</li><li>`HSPM`: High confidence spam</li><li>`MALW`: Malware</li><li>`PHSH`: Phishing</li><li>`SPM`: Spam</li><li>`SPOOF`: Spoofing</li><li>`UIMP`: User Impersonation</li><li>`AMP`: Anti-malware</li><li>`SAP`: Safe attachments</li><li>`FTBP`: Anti-malware filetype policy</li><li>`OSPM`: Outbound spam</li></ul> <br/> An inbound message may be flagged by multiple forms of protection and multiple detection scans. Policies have different priorities, and the policy with the highest priority is applied first. For more information, see [What policy applies when multiple protection methods and detection scans run on your email](how-policies-and-protections-are-combined.md).| +|`CAT:`|The category of protection policy, applied to the message: <ul><li>`BULK`: Bulk</li><li>`DIMP`: Domain Impersonation</li><li>`GIMP`: [Mailbox intelligence based impersonation](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)</li><li>`HPHSH` or `HPHISH`: High confidence phishing</li><li>`HSPM`: High confidence spam</li><li>`MALW`: Malware</li><li>`PHSH`: Phishing</li><li>`SPM`: Spam</li><li>`SPOOF`: Spoofing</li><li>`UIMP`: User Impersonation</li><li>`AMP`: Anti-malware</li><li>`SAP`: Safe attachments</li><li>`FTBP`: Anti-malware filetype policy</li><li>`OSPM`: Outbound spam</li></ul> <br/> An inbound message might be flagged by multiple forms of protection and multiple detection scans. Policies have different priorities, and the policy with the highest priority is applied first. For more information, see [What policy applies when multiple protection methods and detection scans run on your email](how-policies-and-protections-are-combined.md).| |`CIP:[IP address]`|The connecting IP address. You can use this IP address in the IP Allow List or the IP Block List. For more information, see [Configure connection filtering](connection-filter-policies-configure.md).|-|`CTRY`|The source country as determined by the connecting IP address, which may not be the same as the originating sending IP address.| +|`CTRY`|The source country as determined by the connecting IP address, which might not be the same as the originating sending IP address.| |`H:[helostring]`|The HELO or EHLO string of the connecting email server.| |`IPV:CAL`|The message skipped spam filtering because the source IP address was in the IP Allow List. For more information, see [Configure connection filtering](connection-filter-policies-configure.md).| |`IPV:NLI`|The IP address wasn't found on any IP reputation list.|-|`LANG`|The language in which the message was written, as specified by the country code (for example, ru_RU for Russian).| +|`LANG`|The language that the message was written in as specified by the country code (for example, ru_RU for Russian).| |`PTR:[ReverseDNS]`|The PTR record (also known as the reverse DNS lookup) of the source IP address.| |`SCL`|The spam confidence level (SCL) of the message. A higher value indicates the message is more likely to be spam. For more information, see [Spam confidence level (SCL)](anti-spam-spam-confidence-level-scl-about.md).| |`SFTY`|The message was identified as phishing and is also marked with one of the following values: <ul><li>9.19: Domain impersonation. The sending domain is attempting to [impersonate a protected domain](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365). The safety tip for domain impersonation is added to the message (if it's enabled).</li><li>9.20: User impersonation. The sending user is attempting to impersonate a user in the recipient's organization, or [a protected user that's specified in an anti-phishing policy](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365) in Microsoft Defender for Office 365. The safety tip for user impersonation is added to the message (if it's enabled).</li><li>9.25: First contact safety tip. This value _might_ be an indication of a suspicious or phishing message. For more information, see [First contact safety tip](anti-phishing-policies-about.md#first-contact-safety-tip).</li></ul>| |`SFV:BLK`|Filtering was skipped and the message was blocked because it was sent from an address in a user's Blocked Senders list. <p> For more information about how admins can manage a user's Blocked Senders list, see [Configure junk email settings on Exchange Online mailboxes](configure-junk-email-settings-on-exo-mailboxes.md).|-|`SFV:NSPM`|Spam filtering marked the message as non-spam and the message was sent to the intended recipients.| +|`SFV:NSPM`|Spam filtering marked the message as nonspam and the message was sent to the intended recipients.| |`SFV:SFE`|Filtering was skipped and the message was allowed because it was sent from an address in a user's Safe Senders list. <p> For more information about how admins can manage a user's Safe Senders list, see [Configure junk email settings on Exchange Online mailboxes](configure-junk-email-settings-on-exo-mailboxes.md).| |`SFV:SKA`|The message skipped spam filtering and was delivered to the Inbox because the sender was in the allowed senders list or allowed domains list in an anti-spam policy. For more information, see [Configure anti-spam policies](anti-spam-policies-configure.md).| |`SFV:SKB`|The message was marked as spam because it matched a sender in the blocked senders list or blocked domains list in an anti-spam policy. For more information, see [Configure anti-spam policies](anti-spam-policies-configure.md).|-|`SFV:SKI`|The message was marked based on content of the intra-organizational message. For example, the message was marked as SCL 1 for non-spam or SCL 5 to 9 for spam.| -|`SFV:SKN`|The message was marked as non-spam prior to being processed by spam filtering. For example, the message was marked as SCL -1 or **Bypass spam filtering** by a mail flow rule.| +|`SFV:SKI`|The message was marked based on content of the intra-organizational message. For example, the message was marked as SCL 1 for nonspam or SCL 5 to 9 for spam.| +|`SFV:SKN`|The message was marked as nonspam before processing by spam filtering. For example, the message was marked as SCL -1 or **Bypass spam filtering** by a mail flow rule.| |`SFV:SKQ`|The message was released from the quarantine and was sent to the intended recipients.|-|`SFV:SKS`|The message was marked as spam prior to being processed by spam filtering. For example, the message was marked as SCL 5 to 9 by a mail flow rule.| +|`SFV:SKS`|The message was marked as spam before processing by spam filtering. For example, the message was marked as SCL 5 to 9 by a mail flow rule.| |`SFV:SPM`|The message was marked as spam by spam filtering.| |`SRV:BULK`|The message was identified as bulk email by spam filtering and the bulk complaint level (BCL) threshold. When the _MarkAsSpamBulkMail_ parameter is `On` (it's on by default), a bulk email message is marked as spam (SCL 6). For more information, see [Configure anti-spam policies](anti-spam-policies-configure.md).|-|`X-CustomSpam: [ASFOption]`|The message matched an Advanced Spam Filter (ASF) setting. To see the X-header value for each ASF setting, see [Advanced Spam Filter (ASF) settings](anti-spam-policies-asf-settings-about.md). <br><br> **Note**: ASF adds `X-CustomSpam:` X-header fields to messages _after_ the messages have been processed by Exchange mail flow rules (also known as transport rules), so you can't use mail flow rules to identify and act on messages that were filtered by ASF.| +|`X-CustomSpam: [ASFOption]`|The message matched an Advanced Spam Filter (ASF) setting. To see the X-header value for each ASF setting, see [Advanced Spam Filter (ASF) settings](anti-spam-policies-asf-settings-about.md). <br><br> **Note**: ASF adds `X-CustomSpam:` X-header fields to messages _after_ the messages were processed by Exchange mail flow rules (also known as transport rules), so you can't use mail flow rules to identify and act on messages that were filtered by ASF.| ## X-Microsoft-Antispam message header fields The following table describes the fields and possible values for each email auth |Field|Description| |||-|`action`|Indicates the action taken by the spam filter based on the results of the DMARC check. For example: <ul><li>**oreject** or **o.reject**: Stands for override reject. In this case Microsoft 365 uses this action when it receives a message that fails the DMARC check from a domain whose DMARC TXT record has a policy of p=reject. Instead of deleting or rejecting the message, Microsoft 365 marks the message as spam. For more information on why Microsoft 365 is configured this way, see [How Microsoft 365 handles inbound email that fails DMARC](email-authentication-dmarc-configure.md#how-microsoft-365-handles-inbound-email-that-fails-dmarc).</li><li>**pct.quarantine**: Indicates that a percentage less than 100% of messages that don't pass DMARC are delivered anyway. This means that the message failed DMARC and the policy was set to quarantine, but the pct field wasn't set to 100% and the system randomly determined not to apply the DMARC action, as per the specified domain's policy.</li><li>**pct.reject**: Indicates that a percentage less than 100% of messages that don't pass DMARC are delivered anyway. This means that the message failed DMARC and the policy was set to reject, but the pct field wasn't set to 100% and the system randomly determined not to apply the DMARC action, as per the specified domain's policy.</li><li>**permerror**: A permanent error occurred during DMARC evaluation, such as encountering an incorrectly formed DMARC TXT record in DNS. Attempting to resend this message isn't likely to end with a different result. Instead, you may need to contact the domain's owner in order to resolve the issue.</li><li>**temperror**: A temporary error occurred during DMARC evaluation. You may be able to request that the sender resend the message later in order to process the email properly.</li></ul>| -|`compauth`|Composite authentication result. Used by Microsoft 365 to combine multiple types of authentication such as SPF, DKIM, DMARC, or any other part of the message to determine whether or not the message is authenticated. Uses the From: domain as the basis of evaluation.| -|`dkim`|Describes the results of the DKIM check for the message. Possible values include: <ul><li>**pass**: Indicates the DKIM check for the message passed.</li><li>**fail (reason)**: Indicates the DKIM check for the message failed and why. For example, if the message wasn't signed or the signature wasn't verified.</li><li>**none**: Indicates that the message wasn't signed. This may or may not indicate that the domain has a DKIM record or the DKIM record doesn't evaluate to a result, only that this message wasn't signed.</li></ul>| -|`dmarc`|Describes the results of the DMARC check for the message. Possible values include: <ul><li>**pass**: Indicates the DMARC check for the message passed.</li><li>**fail**: Indicates the DMARC check for the message failed.</li><li>**bestguesspass**: Indicates that no DMARC TXT record for the domain exists, but if one had existed, the DMARC check for the message would have passed.</li><li>**none**: Indicates that no DMARC TXT record exists for the sending domain in DNS.| +|`action`|Indicates the action taken by the spam filter based on the results of the DMARC check. For example: <ul><li>`oreject` or `o.reject`: Stands for override reject. In this case, Microsoft 365 uses this action when it receives a message that fails the DMARC check from a domain whose DMARC TXT record has a policy of p=reject. Instead of deleting or rejecting the message, Microsoft 365 marks the message as spam. For more information on why Microsoft 365 is configured this way, see [How Microsoft 365 handles inbound email that fails DMARC](email-authentication-dmarc-configure.md#how-microsoft-365-handles-inbound-email-that-fails-dmarc).</li><li>`pct.quarantine`: Indicates that a percentage less than 100% of messages that don't pass DMARC are delivered anyway. This result means that the message failed DMARC and the policy was set to quarantine. But, the pct field wasn't set to 100%, and the system randomly determined not to apply the DMARC action per the specified domain's policy.</li><li>`pct.reject`: Indicates that a percentage less than 100% of messages that don't pass DMARC are delivered anyway. This result means that the message failed DMARC and the policy was set to reject. But, the pct field wasn't set to 100% and the system randomly determined not to apply the DMARC action per the specified domain's policy.</li><li>`permerror`: A permanent error occurred during DMARC evaluation, such as encountering an incorrectly formed DMARC TXT record in DNS. Attempting to resend this message isn't likely to end with a different result. Instead, you might need to contact the domain's owner in order to resolve the issue.</li><li>`temperror`: A temporary error occurred during DMARC evaluation. You might be able to request that the sender resend the message later in order to process the email properly.</li></ul>| +|`compauth`|Composite authentication result. Used by Microsoft 365 to combine multiple types of authentication (SPF, DKIM, and DMARC), or any other part of the message to determine whether or not the message is authenticated. Uses the From: domain as the basis of evaluation.| +|`dkim`|Describes the results of the DKIM check for the message. Possible values include: <ul><li>**pass**: Indicates the DKIM check for the message passed.</li><li>**fail (reason)**: Indicates the DKIM check for the message failed and why. For example, if the message wasn't signed or the signature wasn't verified.</li><li>**none**: Indicates that the message wasn't signed. This result might or might not indicate that the domain has a DKIM record or the DKIM record doesn't evaluate to a result.</li></ul>| +|`dmarc`|Describes the results of the DMARC check for the message. Possible values include: <ul><li>**pass**: Indicates the DMARC check for the message passed.</li><li>**fail**: Indicates the DMARC check for the message failed.</li><li>**bestguesspass**: Indicates that no DMARC TXT record exists for the domain exists. If the domain had a DMARC TXT record, the DMARC check for the message would have passed.</li><li>**none**: Indicates that no DMARC TXT record exists for the sending domain in DNS.| |`header.d`|Domain identified in the DKIM signature if any. This is the domain that's queried for the public key.| |`header.from`|The domain of the `5322.From` address in the email message header (also known as the From address or P2 sender). Recipient sees the From address in email clients.|-|`reason`|The reason the composite authentication passed or failed. The value is a 3-digit code. For example: <ul><li>**000**: The message failed explicit authentication (`compauth=fail`). For example, the message received a DMARC fail with an action of quarantine or reject.</li><li>**001**: The message failed implicit authentication (`compauth=fail`). This means that the sending domain didn't have email authentication records published, or if they did, they had a weaker failure policy (SPF soft fail or neutral, DMARC policy of `p=none`).</li><li>**002**: The organization has a policy for the sender/domain pair that is explicitly prohibited from sending spoofed email. This setting is manually set by an admin.</li><li>**010**: The message failed DMARC with an action of reject or quarantine, and the sending domain is one of your organization's accepted-domains (this is part of self-to-self, or intra-org, spoofing).</li><li>**1xx** or **7xx**: The message passed authentication (`compauth=pass`). The last two digits are internal codes used by Microsoft 365.</li><li>**2xx**: The message soft-passed implicit authentication (`compauth=softpass`). The last two digits are internal codes used by Microsoft 365.</li><li>**3xx**: The message wasn't checked for composite authentication (`compauth=none`).</li><li>**4xx** or **9xx**: The message bypassed composite authentication (`compauth=none`). The last two digits are internal codes used by Microsoft 365.</li><li>**6xx**: The message failed implicit email authentication, and the sending domain is one of your organization's accepted domains (this is part of self-to-self or intra-org spoofing).</li></ul>| -|`smtp.mailfrom`|The domain of the `5321.MailFrom` address (also known as the MAIL FROM address, P1 sender, or envelope sender). This is the email address that's used for non-delivery reports (also known as NDRs or bounce messages).| -|`spf`|Describes the results of the SPF check for the message. Possible values include: <ul><li>`pass (IP address)`: The SPF check for the message passed and includes the sender's IP address. The client is authorized to send or relay email on behalf of the sender's domain.</li><li>`fail (IP address)`: The SPF check for the message failed and includes the sender's IP address. This is sometimes called _hard fail_.</li><li>`softfail (reason)`: The SPF record designated the host as not being allowed to send, but is in transition.</li><li>`neutral`: The SPF record explicitly states that it doesn't assert whether the IP address is authorized to send.</li><li>`none`: The domain doesn't have an SPF record or the SPF record doesn't evaluate to a result.</li><li>`temperror`: A temporary error has occurred. For example, a DNS error. The same check later might succeed.</li><li>`permerror`: A permanent error has occurred. For example, the domain has a badly formatted SPF record.</li></ul>| +|`reason`|The reason the composite authentication passed or failed. The value is a 3-digit code. For example: <ul><li>**000**: The message failed explicit authentication (`compauth=fail`). For example, the message received a DMARC fail with an action of quarantine or reject.</li><li>**001**: The message failed implicit authentication (`compauth=fail`). This result means that the sending domain didn't have email authentication records published, or if they did, they had a weaker failure policy (SPF `~all` or `?all`, or s DMARC policy of `p=none`).</li><li>**002**: The organization has a policy for the sender/domain pair that is explicitly prohibited from sending spoofed email. An admin manually configures this setting.</li><li>**010**: The message failed DMARC with an action of reject or quarantine, and the sending domain is one of your organization's accepted-domains (self-to-self or intra-org spoofing).</li><li>**1xx** or **7xx**: The message passed authentication (`compauth=pass`). The last two digits are internal codes used by Microsoft 365.</li><li>**2xx**: The message soft-passed implicit authentication (`compauth=softpass`). The last two digits are internal codes used by Microsoft 365.</li><li>**3xx**: The message wasn't checked for composite authentication (`compauth=none`).</li><li>**4xx** or **9xx**: The message bypassed composite authentication (`compauth=none`). The last two digits are internal codes used by Microsoft 365.</li><li>**6xx**: The message failed implicit email authentication, and the sending domain is one of your organization's accepted domains (self-to-self or intra-org spoofing).</li></ul>| +|`smtp.mailfrom`|The domain of the `5321.MailFrom` address (also known as the MAIL FROM address, P1 sender, or envelope sender). This email address is used for non-delivery reports (also known as NDRs or bounce messages).| +|`spf`|Describes the results of the SPF check for the message. Possible values include: <ul><li>`pass (IP address)`: The SPF check for the message passed and includes the sender's IP address. The client is authorized to send or relay email on behalf of the sender's domain.</li><li>`fail (IP address)`: The SPF check for the message failed and includes the sender's IP address. This result is sometimes called _hard fail_.</li><li>`softfail (reason)`: The SPF record designated the host as not being allowed to send, but is in transition.</li><li>`neutral`: The SPF record explicitly states that it doesn't assert whether the IP address is authorized to send.</li><li>`none`: The domain doesn't have an SPF record or the SPF record doesn't evaluate to a result.</li><li>`temperror`: A temporary error has occurred. For example, a DNS error. The same check later might succeed.</li><li>`permerror`: A permanent error has occurred. For example, the domain has a badly formatted SPF record.</li></ul>| |
| security | Message Trace Scc | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/message-trace-scc.md | description: Admins can use the message trace link in the Microsoft 365 Defender search.appverid: met150 Previously updated : 1/31/2023 Last updated : 6/15/2023+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/eop-about" target="_blank">Exchange Online Protection</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft 365 Defender</a> # Message trace in the Microsoft 365 Defender portal [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies to** -- [Exchange Online Protection](eop-about.md)-- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)-- [Microsoft 365 Defender](../defender/microsoft-365-defender.md)- Message trace follows email messages as they travel through your Exchange Online organization. You can determine if a message was received, rejected, deferred, or delivered by the service. It also shows what actions were taken on the message before it reached its final status. You can use the information from message trace to efficiently answer user questions about what happened to messages, troubleshoot mail flow issues, and validate policy changes. |
| security | Migrate To Defender For Office 365 Onboard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365-onboard.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> # Migrate to Microsoft Defender for Office 365 - Phase 3: Onboard |
| security | Migrate To Defender For Office 365 Prepare | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365-prepare.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> # Migrate to Microsoft Defender for Office 365 - Phase 1: Prepare -**Applies to** -- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)- <br> |:::image type="content" source="../../medi)| |
| security | Migrate To Defender For Office 365 Setup | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365-setup.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> # Migrate to Microsoft Defender for Office 365 - Phase 2: Setup -**Applies to:** -- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)- <br> |[:::image type="content" source="../../medi)| |
| security | Migrate To Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365.md | +appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 plan 1 and plan 2</a> # Migrate from a third-party protection service or device to Microsoft Defender for Office 365 -**Applies to** -- [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md)- If you already have an existing third-party protection service or device that sits in front of Microsoft 365, you can use this guide to migrate your protection to Microsoft Defender for Office 365 to get the benefits of a consolidated management experience, potentially reduced cost (using products that you already pay for), and a mature product with integrated security protection. For more information, see [Microsoft Defender for Office 365](https://www.microsoft.com/security/business/threat-protection/office-365-defender). Watch this short video to learn more about migrating to Defender for Office 365. |
| security | Office 365 Ti | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/office-365-ti.md | f1.keywords: Previously updated : 1/31/2023 Last updated : 6/15/2023 audience: Admin ms.localizationpriority: medium+appliesto: + - ✅ <a href="https://learn.microsoft.com/microsoft-365/security/office-365-security/microsoft-defender-for-office-365-product-overview" target="_blank">Microsoft Defender for Office 365 plan 2</a> # Threat investigation and response [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -**Applies To** -- [Microsoft Defender for Office 365 plan 2](defender-for-office-365.md)- Threat investigation and response capabilities in [Microsoft Defender for Office 365](defender-for-office-365.md) help security analysts and administrators protect their organization's Microsoft 365 for business users by: - Making it easy to identify, monitor, and understand cyberattacks. |
| security | Submissions Outlook Report Messages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-outlook-report-messages.md | description: Learn how to report phishing and suspicious emails in Outlook using search.appverid: met150 Previously updated : 12/05/2022 Last updated : 6/9/2023 # Report phishing and suspicious emails in Outlook for admins |
| solutions | Data Privacy Protection Assess | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/data-privacy-protection-assess.md | When you begin your data privacy journey, you'll want to first understand what t |Action|Description|Get details| |:|:-|:| |Use Priva to understand your organization's personal data.| Priva evaluates your organization's Microsoft 365 environment to determine the types and amounts of sensitive information types and where they're stored. It then gives you insights and key analytics to help you understand the privacy issues and associated risks in your organization.<br><br>To get started with Priva, check to make sure your users are appropriately licensed and have the roles they need. It's also a good idea to confirm that the [Microsoft 365 audit log is enabled](/privacy/priva/priva-setup#enable-the-microsoft-365-audit-log).<br><br> We recommend making some initial settings before you start. Visit Priva settings to turn [anonymization](/privacy/priva/priva-settings#anonymization) **On** for greater protection while reviewing sensitive data, and turn [user notification emails](/privacy/priva/priva-settings#user-notification-emails) **Off** while you're getting familiar with Privacy Risk Management policies. You can turn both on later.| [Learn more about Priva](/privacy/priva/priva-overview) <br><br> [Check Priva licensing guidance](/privacy/priva/priva-setup)<br><br>[Set user permissions for Priva](/privacy/priva/priva-permissions)<br><br>[Check Priva settings](/privacy/priva/priva-settings)<br><br>[Find and visualize personal data in your organization](/privacy/priva/priva-data-profile)|-|Visit Compliance Manager to get your initial compliance score.| The next step is knowing which data protection regulations apply to your organization so you know what your obligations are.<p><p>Keeping up with new and updated laws and regulations can be a full-time job in itself, and many organizations struggle with manual processes for monitoring, updating, and reporting on their state of compliance. Compliance Manager helps manage the complexities of implementing controls through built-in control mapping, versioning, and continuous control assessments. This automation and continuous monitoring helps you to stay current with regulations and certifications, and eases reporting to auditors. <p><p>Use Compliance Manager to quickly assess your current environment and get an initial compliance score based on the Microsoft data protection baseline assessment. From there, you can provide information about your industry and location so Compliance Manager can recommend assessments for regulations that are most likely to apply to you. | [Learn more about Compliance Manager](../compliance/compliance-manager.md)<br><br>[Start a premium assessments trial for quick setup of recommended assessments](../compliance/compliance-manager-setup.md#start-a-premium-assessments-trial)<br><br>[Understand how your compliance score is calculated](../compliance/compliance-score-calculation.md)| +|Visit Compliance Manager to assess your compliance posture.| The next step is knowing which data protection regulations apply to your organization so you know what your obligations are.<p><p>Keeping up with new and updated laws and regulations can be a full-time job in itself, and many organizations struggle with manual processes for monitoring, updating, and reporting on their state of compliance. Compliance Manager helps manage the complexities of implementing controls through built-in control mapping, versioning, and continuous control assessments. This automation and continuous monitoring helps you to stay current with regulations and certifications, and eases reporting to auditors. <p><p>Use Compliance Manager to quickly assess your current environment and get an initial compliance score based on the Microsoft data protection baseline assessment. From there, you can create assessments that cover your multicloud environment and keep you on track with the regulations that are most relevant to your organization. | [Learn more about Compliance Manager](../compliance/compliance-manager.md)<br><br>[Start a premium assessments trial](../compliance/compliance-manager-setup.md#start-a-premium-assessments-trial)<br><br>[Learn about multicloud support](../compliance/compliance-manager-multicloud.md)| ## Optimizing your initial setup |
| solutions | Manage Devices With Intune Dlp Mip | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/manage-devices-with-intune-dlp-mip.md | description: Implement Endpoint DLP by working with your information protection # Step 7. Implement data loss prevention (DLP) with information protection capabilities -If your organization has already put the time into understanding your data, developing a data sensitivity schema, and applying the schema, you might be ready to extend elements of this schema to endpoints by using Microsoft Purview data loss prevention (DLP) policies. +If your organization has already put the time into understanding your data, developing a data sensitivity schema, and applying the schema, you might be ready to extend elements of this schema to endpoints by using Microsoft Purview Data Loss Prevention (DLP) policies. Endpoint data loss prevention (Endpoint DLP) currently applies to: - Windows 10, Windows 11 Endpoint data loss prevention (Endpoint DLP) currently applies to: DLP policies are created by your information protection and governance team. Each DLP policy defines what elements within a data set to look for, like sensitive information types or labels, and how to protect this data. -For example, a DLP policy can look for personal data like a passport number. The DLP policy will include a condition that triggers the policy to take action, such as when a passport number is shared with people outside your organization. The action the policy takes can be configured as well. Options range from simply reporting the action to admins, warning users, or even preventing the data from being shared. +For example, a DLP policy can look for personal data like a passport number. The DLP policy includes a condition that triggers the policy to take action, such as when a passport number is shared with people outside your organization. The action the policy takes can be configured as well. Options range from simply reporting the action to admins, warning users, or even preventing the data from being shared. -The DLP policy also specifies the location to apply the policy to, such as Exchange email and SharePoint sites. One of the locations available to admins is devices. If devices is selected, you can specify which users and user groups to apply the policy to. You can also specify users and user groups to exclude from the policy. +The DLP policy also specifies the location to apply the policy to, such as Exchange email and SharePoint sites. One of the locations available to admins is devices. If devices are selected, you can specify which users and user groups to apply the policy to. You can also specify users and user groups to exclude from the policy. -If your information protection and governance team is ready to extend DLP policies to endpoints, youΓÇÖll need to coordinate with them to enable devices for Endpoint DLP, test and tune DLP policies, train users, and monitor the results. +If your information protection and governance team is ready to extend DLP policies to endpoints, you need to coordinate with them to enable devices for Endpoint DLP, test and tune DLP policies, train users, and monitor the results.  Use the following steps to work with your information protection team. |Step |Description | ||| |1 | [Learn about Endpoint data loss prevention](../compliance/endpoint-dlp-learn-about.md). |-|2 | Enable devices for Endpoint DLP. If you onboarded devices to Microsoft Defender for Endpoint, your devices are already enabled for Endpoint DLP. If your devices are not onboarded to Defender for Endpoint, see [Get started with Endpoint data loss prevention](../compliance/endpoint-dlp-getting-started.md) for instructions.| -|3 | Work with your information protection and governance team to define, test, and tune policies. This includes monitoring the results. See these resources:<br>- [Using Endpoint data loss prevention](../compliance/endpoint-dlp-using.md)<br>- [View the reports for data loss prevention](../compliance/view-the-dlp-reports.md) | +|2 | Enable devices for Endpoint DLP. If you onboarded devices to Microsoft Defender for Endpoint, your devices are already enabled for Endpoint DLP. If your devices aren't onboarded to Defender for Endpoint, see [Get started with Endpoint data loss prevention](../compliance/endpoint-dlp-getting-started.md) for instructions.| +|3 | Work with your information protection and governance team to define, test, and tune policies. This includes monitoring the results. See these resources:<br>- [Using Endpoint data loss prevention](../compliance/endpoint-dlp-using.md)<br>- [Get started with Activity Explorer](../compliance/data-classification-activity-explorer.md) | |
| syntex | Requirements And Limitations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/requirements-and-limitations.md | Prebuilt models: | Icon | Description | | - | - |-| .| |  | **Supported languages** <br>This model supports any language that uses the Latin character set (for example, English, French, German, Italian, and Spanish). | |  | **OCR considerations** <br>This model uses optical character recognition (OCR) technology to scan .pdf files, image files, and .tiff files. OCR processing works best on documents that meet the following requirements: <br> - File format of .jpg, .png, or .pdf (text or scanned). Text-embedded .pdf files are better, because there won't be any errors in character extraction and location. <br> - If your .pdf files are password-locked, you must remove the lock before submitting them. <br> - The combined file size of the documents used for training per collection must not exceed 50 MB, and PDF documents shouldn't have more than 500 pages. <br> - For images, dimensions must be between 50 x 50 and 10,000 x 10,000 pixels. Images that are very wide or have odd dimensions (for example, floor plans) might get truncated in the OCR process and lose accuracy. <br> - For .pdf files, dimensions must be at most 11 x 17 inches, corresponding to Legal or A3 paper sizes and smaller. <br> - If scanned from paper documents, scans should be high-quality images. <br> - Must use the Latin alphabet (English characters). <br> Note the following differences about Microsoft Office text-based files and OCR-scanned files (.pdf, image, or .tiff): <br> - All files: Truncated at 64,000 characters (in training and when run against files in a document library). <br> - OCR-scanned files: There's a 500-page limit. Only PDF and image file types are processed by OCR. | |  | **Multi-Geo environments** <br>When setting up Syntex in a [Microsoft 365 Multi-Geo](/microsoft-365/enterprise/microsoft-365-multi-geo) environment, you can only configure it to use the model type in the central location. If you want to use this model type in a satellite location, contact Microsoft support. | |