| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Admin Center Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/admin-overview/admin-center-overview.md | For more information, see [Try or buy a Microsoft 365 for business subscription] We love to hear from you! Reporting bugs and sharing feedback helps us make the Microsoft 365 admin center better. To give feedback, select the **Feedback** button on the bottom of the page and use the form to send us your thoughts. Select the checkbox and confirm your email address if you want someone from the Microsoft 365 admin center team to follow up on your comments. We can't promise to follow up on every piece of feedback, but we're going to try! -You can also give feedback from outside of the admin center on our UserVoice forum. You can use this page to make feature suggestions that can be voted on by other forum users: [UserVoice forum for the new admin center](https://go.microsoft.com/fwlink/?linkid=2024994). +<!You can also give feedback from outside of the admin center on our UserVoice forum. You can use this page to make feature suggestions that can be voted on by other forum users: [UserVoice forum for the new admin center](https://go.microsoft.com/fwlink/?linkid=2024994).> ### What about the specific types of IT roles and other workspaces like Security, Device Management, or Exchange? |
| business-premium | M365 Customize Sign In | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365-customize-sign-in.md | The elements you can update are: - Banner logo - Username hint -For examples of privacy and consent notices, see Appendix A in [Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations](https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/14/ssmanual2009.pdf). +For examples of privacy and consent notices, see Appendix A in [Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations](https://www.justice.gov/file/442111/download). ## Next steps 1. [Use the Guided process for basic setup](m365bp-setup.md). -2. [Set up your security capabilities](m365bp-security-overview.md). +2. [Set up your security capabilities](m365bp-security-overview.md). |
| business-premium | M365bp Trial Playbook Microsoft Business Premium | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-trial-playbook-microsoft-business-premium.md | description: "Make the most of your Microsoft 365 Business Premium trial. Try ou # Trial playbook: Microsoft Business Premium -Welcome to the Microsoft Business Premium trial playbook. This playbook will help you make the most of your 30-day free trial by teaching you how Microsoft 365 Business Premium increases productivity and helps safeguard your organization with Defender for Business. Using Microsoft recommendations, learn how Defender can help you define protection policies, analyze threats to your organization, and enable you to respond to cyberattacks. +Welcome to the Microsoft Business Premium trial playbook. This playbook will help you make the most of your 30-day free trial by experiencing how Microsoft 365 Business Premium increases productivity and helps safeguard your organization with advanced security capabilities. Using Microsoft recommendations, learn how you can set up your threat protection features, analyze detected threats, and respond to cyberattacks. ## Set up the Microsoft 365 Business Premium trial First, [set up your trial](../business-premium/m365bp-setup.md)! After you've initiated the trial and completed the setup process, it may take up to two hours for changes to take effect. -We have automatically configured [Preset security policies](/security/office-365-security/preset-security-policies.md) in your environment. These policies represent a baseline protection profile that's suitable for most users. Standard protection includes: +Microsoft 365 Business Premium includes [Preset security policies](/security/office-365-security/preset-security-policies.md) that you can use in your environment. These policies represent a baseline protection profile that's suitable for most users. Standard protection includes: -- Safe Links, Safe Attachments and Anti-Phishing policies that are scoped to the entire tenant or subset of users you may have chosen during the trial setup process.+- [Safe Links](../security/office-365-security/safe-links.md), [Safe Attachments](../security/office-365-security/safe-attachments.md) and [Anti-Phishing](../security/office-365-security/anti-phishing-protection.md) policies that are scoped to the entire tenant or the subset of users you may have chosen during the trial setup process. (Your trial subscription is for up to 25 users.) -- Protection to all of the Microsoft 365 Business Premium features such as: SharePoint, OneDrive, Office apps, and Microsoft Teams.+- Protection for productivity apps, such as [SharePoint](/sharepoint/introduction), [OneDrive](/onedrive/one-drive-quickstart-small-business), [Office apps](/deployoffice/about-microsoft-365-apps), and [Microsoft Teams](/microsoftteams/teams-overview). ## Add a domain -When you purchase the Microsoft 365 Business Premium trial, you have the option of using a domain you own, or buying one during the sign-up. +When you try or buy Microsoft 365 Business Premium, you have the option of using a domain you own, or buying one during the sign-up process. > [!Note] > If you purchased a new domain when you signed up, your domain is all set up and you can move to Add users and assign licenses. Go to the admin center([https://admin.microsoft.com](https://admin.microsoft.com)). 1. From the admin center menu, choose **Setup** to start the wizard. -2. Select **Set up email with a custom domain** and then, **Use a domain you already own** such as contoso.com. +2. Select **Set up email with a custom domain** and then, **Use a domain you already own** such as `contoso.com`. 3. Follow the rest of the steps in the wizard to complete the process. > [!Important]- > If you purchased a domain during the sign-up, you will not see the Add a domain step here. Go to Add users instead. + > If you purchased a domain during the sign-up, you will not see the **Add a domain** step here. Go to **Add users** instead. -4. Follow the steps in the wizard to Create DNS records at any DNS hosting provider for Office 365 that verifies you own the domain. If you know your domain host, see Add a domain to Microsoft 365. +4. Follow the steps in the wizard to [create DNS records at any DNS hosting provider for Office 365](/microsoft-365/admin/get-help-with-domains/create-dns-records-at-any-dns-hosting-provider) that verifies you own the domain. If you know your domain host, see [Add a domain to Microsoft 365](/microsoft-365/admin/setup/add-domain). 5. If your hosting provider is GoDaddy or another host enabled with domain connect, the process is easy and you'll be automatically asked to sign in and let Microsoft authenticate on your behalf. |
| commerce | What If My Subscription Expires | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/what-if-my-subscription-expires.md | The following table explains what you can expect when a paid Microsoft 365 for b > [!NOTE] >-> **What is "customer data"?** Customer data, as defined in the [Microsoft Online Service Terms](https://go.microsoft.com/fwlink/p/?LinkId=613649), refers to all data, including all text, sound, or image files that are provided to Microsoft by, or on behalf of, the customer through the customer's use of Microsoft 365 services. To learn more about the protection of customer data, see the [Get started with the Microsoft Service Trust Portal](../../compliance/get-started-with-service-trust-portal.md). +> **What is "customer data"?** Customer data, as defined in the [Microsoft Online Service Terms](https://www.microsoft.com/en-us/licensing/product-licensing/products), refers to all data, including all text, sound, or image files that are provided to Microsoft by, or on behalf of, the customer through the customer's use of Microsoft 365 services. To learn more about the protection of customer data, see the [Get started with the Microsoft Service Trust Portal](../../compliance/get-started-with-service-trust-portal.md). ## What happens if I cancel a subscription? |
| compliance | Apply Retention Labels Automatically | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/apply-retention-labels-automatically.md | When you create an auto-apply policy, you select a retention label to automatica - If you are using records management: - **Solutions** \> **Records management** \> **Label policies** tab \> **Auto-apply a label** - - If you are using data lifeycle management: - - **Solutions** \> **Data lifeycle management** \> **Label policies** tab \> **Auto-apply a label** + - If you are using data lifecycle management: + - **Solutions** \> **Data lifecycle management** \> **Label policies** tab \> **Auto-apply a label** Don't immediately see your solution in the navigation pane? First select **Show all**. |
| compliance | Create Apply Retention Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-apply-retention-labels.md | Decide before you create your retention label policy whether it will be **adapti - **Solutions** > **Records management** > > **Label policies** tab > **Publish labels** - If you are using data lifecycle management:- - **Solutions** > **Data lifeycle management** > **Label policies** tab > **Publish labels** + - **Solutions** > **Data lifecycle management** > **Label policies** tab > **Publish labels** Don't immediately see your solution in the navigation pane? First select **Show all**. |
| compliance | Search The Audit Log In Security And Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance.md | Why a unified audit log? Because you can search the audit log for activities per | Retention policies and retention labels|MIPLabel, MipAutoLabelExchangeItem, MipAutoLabelSharePointItem, MipAutoLabelSharePointPolicyLocation| | Sensitive information types|DlpSensitiveInformationType| | Sensitivity labels|MIPLabel, SensitivityLabelAction, SensitivityLabeledFileAction, SensitivityLabelPolicyMatch|+| Encrypted message portal|OMEPortal| | SharePoint Online|SharePoint, SharePointFileOperation,SharePointSharingOperation, SharePointListOperation, SharePointCommentOperation | | Stream|MicrosoftStream| | Threat Intelligence|ThreatIntelligence, ThreatIntelligenceUrl, ThreatFinder, ThreatIntelligenceAtpContent| Click one of the following links to go to a specific table. [Encrypted message portal activities](#encrypted-message-portal-activities) :::column-end::: :::column:::- [SystemSync activities] (#systemsync-activities) + [SystemSync activities](#systemsync-activities) :::column-end::: :::column::: |
| contentunderstanding | Skos Format Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/skos-format-reference.md | ex:TermA sharepoint-taxonomy:topLevelTermOf ex:TermSetA. **sharepoint-taxonomy:inTermSet** -Use this to map a [Term](/dotnet/api/microsoft.sharepoint.taxonomy.term) to a [TermSet](/dotnet/api/microsoft.sharepoint.taxonomy.termset). A [Term](/dotnet/api/microsoft.sharepoint.taxonomy.term) can only exist in a single [TermSet](/dotnet/api/microsoft.sharepoint.taxonomy.termset). SharePoint requires this property when [defining a term](https://github.com/MicrosoftDocs/microsoft-365-docs-pr/blob/3a3cd54dd076b18bdff1d43b3e342897f8704c23/microsoft-365/contentunderstanding/skos-format-reference.md#term). +Use this to map a [Term](/dotnet/api/microsoft.sharepoint.taxonomy.term) to a [TermSet](/dotnet/api/microsoft.sharepoint.taxonomy.termset). A [Term](/dotnet/api/microsoft.sharepoint.taxonomy.term) can only exist in a single [TermSet](/dotnet/api/microsoft.sharepoint.taxonomy.termset). SharePoint requires this property when [defining a term](#sharepoint-taxonomy-vocabulary). ## Required labels propertyName|Has Property Label|SharedCustomPropertyForTerm, LocalCustomProperty ## See also -[Import a term set using a SKOS-based format](import-term-set-skos.md) +[Import a term set using a SKOS-based format](import-term-set-skos.md) |
| enterprise | Upgrade From Lync 2013 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/upgrade-from-lync-2013.md | That means there will be no further updates, patches, or fixes for the product ( ## Plan ahead -Check the dates that support ends on the [Product Lifecycle site](/lifecycle/products/lync-server-2013). Plan your upgrades or migrations with these dates in mind. Remember that your product *won't stop working* at the date listed. But because your installation will no longer be patched after that date, you'll want to plan a smooth transition to the next version of the product. The table below lists the options available to you. +Check the dates that support ends on the [Product Lifecycle site](/lifecycle/products/microsoft-lync-server-2013). Plan your upgrades or migrations with these dates in mind. Remember that your product *won't stop working* at the date listed. But because your installation will no longer be patched after that date, you'll want to plan a smooth transition to the next version of the product. The table below lists the options available to you. |End of support product|Supported|Recommended| |||| |
| enterprise | Use Microsoft 365 Cdn With Spo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/use-microsoft-365-cdn-with-spo.md | To enable your organization to use private origins, type the following command: Set-PnPTenantCdnEnabled -CdnType Private -Enable $true ``` -For more information about this cmdlet, see [Set-PnPTenantCdnEnabled](/powershell/module/sharepoint-pnp/set-pnptenantcdnenabled). +For more information about this cmdlet, see [Set-PnPTenantCdnEnabled](https://pnp.github.io/powershell/cmdlets/Set-PnPTenantCdnEnabled.html). <a name="Office365CDNforPnPPoshFileType"> </a> ### Change the list of file types to include in the Office 365 CDN (Optional) To see what file types are currently allowed by the CDN, use the **Get-PnPTenant Get-PnPTenantCdnPolicies -CdnType <Public | Private> ``` -For more information about these cmdlets, see [Set-PnPTenantCdnPolicy](/powershell/module/sharepoint-pnp/set-pnptenantcdnpolicy) and [Get-PnPTenantCdnPolicies](/powershell/module/sharepoint-pnp/get-pnptenantcdnpolicies). +For more information about these cmdlets, see [Set-PnPTenantCdnPolicy](https://pnp.github.io/powershell/cmdlets/Set-PnPTenantCdnPolicy.html) and [Get-PnPTenantCdnPolicies](https://pnp.github.io/powershell/cmdlets/Get-PnPTenantCdnPolicies.html). <a name="Office365CDNforPnPPoshSiteClassification"> </a> ### Change the list of site classifications you want to exclude from the Office 365 CDN (Optional) The _ExcludeRestrictedSiteClassifications_ property contains the site classifica The _ExcludeIfNoScriptDisabled_ property excludes content from the CDN based on the site-level _NoScript_ attribute settings. By default, the _NoScript_ attribute is set to **Enabled** for _Modern_ sites and **Disabled** for _Classic_ sites. This depends on your tenant settings. -For more information about these cmdlets, see [Set-PnPTenantCdnPolicy](/powershell/module/sharepoint-pnp/set-pnptenantcdnpolicy) and [Get-PnPTenantCdnPolicies](/powershell/module/sharepoint-pnp/get-pnptenantcdnpolicies). +For more information about these cmdlets, see [Set-PnPTenantCdnPolicy](https://pnp.github.io/powershell/cmdlets/Set-PnPTenantCdnPolicy.html) and [Get-PnPTenantCdnPolicies](https://pnp.github.io/powershell/cmdlets/Get-PnPTenantCdnPolicies.html). <a name="Office365CDNforSPOOriginPnPPosh"> </a> ### Add an origin for your assets Add-PnPTenantCdnOrigin -CdnType Private -OriginUrl sites/test/siteassets/folder% Add-PnPTenantCdnOrigin -CdnType Private -OriginUrl "sites/test/siteassets/folder 1" ``` -For more information about this command and its syntax, see [Add-PnPTenantCdnOrigin](/powershell/module/sharepoint-pnp/add-pnptenantcdnorigin). +For more information about this command and its syntax, see [Add-PnPTenantCdnOrigin](https://pnp.github.io/powershell/cmdlets/Add-PnPTenantCdnOrigin.html). > [!NOTE] > In private origins, assets being shared from an origin must have a major version published before they can be accessed from the CDN. Normally, these origins are set up for you by default when you enable the Office Add-PnPTenantCdnOrigin -CdnType Public -OriginUrl */masterpage ``` -For more information about this command and its syntax, see [Add-PnPTenantCdnOrigin](/powershell/module/sharepoint-pnp/add-pnptenantcdnorigin). +For more information about this command and its syntax, see [Add-PnPTenantCdnOrigin](https://pnp.github.io/powershell/cmdlets/Add-PnPTenantCdnOrigin.html). Once you've run the command, the system synchronizes the configuration across the datacenter. This can take up to 15 minutes. Once you've run the command, the system synchronizes the configuration across th Add-PnPTenantCdnOrigin -CdnType Private -OriginUrl */publishingimages ``` -For more information about this command and its syntax, see [Add-PnPTenantCdnOrigin](/powershell/module/sharepoint-pnp/add-pnptenantcdnorigin). +For more information about this command and its syntax, see [Add-PnPTenantCdnOrigin](https://pnp.github.io/powershell/cmdlets/Add-PnPTenantCdnOrigin.html). Once you've run the command, the system synchronizes the configuration across the datacenter. This can take up to 15 minutes. Use the **Add-PnPTenantCdnOrigin** cmdlet to define a site collection as a priva Add-PnPTenantCdnOrigin -CdnType Private -OriginUrl sites/site1/siteassets ``` -For more information about this command and its syntax, see [Add-PnPTenantCdnOrigin](/powershell/module/sharepoint-pnp/add-pnptenantcdnorigin). +For more information about this command and its syntax, see [Add-PnPTenantCdnOrigin](https://pnp.github.io/powershell/cmdlets/Add-PnPTenantCdnOrigin.html). Once you've run the command, the system synchronizes the configuration across the datacenter. You may see a _Configuration pending_ message which is expected as the SharePoint Online tenant connects to the CDN service. This can take up to 15 minutes. You can remove access to a folder or SharePoint library that you identified as a Remove-PnPTenantCdnOrigin -OriginUrl <path> -CdnType <Public | Private | Both> ``` -For information on how to use this cmdlet, see [Remove-PnPTenantCdnOrigin](/powershell/module/sharepoint-pnp/remove-pnptenantcdnorigin). +For information on how to use this cmdlet, see [Remove-PnPTenantCdnOrigin](https://pnp.github.io/powershell/cmdlets/Remove-PnPTenantCdnOrigin.html). <a name="Office365CDNforSPOModifyOriginPnPPosh"> </a> #### Modify an origin in the Office 365 CDN To disable use of the private origins in the CDN, enter the following command: Set-PnPTenantCdnEnabled -CdnType Private -Enable $false ``` -For more information about this cmdlet, see [Set-PnPTenantCdnEnabled](/powershell/module/sharepoint-pnp/set-pnptenantcdnenabled). +For more information about this cmdlet, see [Set-PnPTenantCdnEnabled](https://pnp.github.io/powershell/cmdlets/Set-PnPTenantCdnEnabled.html). </details> |
| enterprise | Use Powershell To Perform A Staged Migration To Microsoft 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/use-powershell-to-perform-a-staged-migration-to-microsoft-365.md | Before you migrate mailboxes to Microsoft 365 by using a staged migration, there - Use Outlook from outside your corporate network to connect to your on-premises Exchange mailbox. -- Use the [Microsoft Remote Connectivity Analyzer](https://https://testconnectivity.microsoft.com/) to test your connection settings. Use the Outlook Anywhere (RPC over HTTP) or Outlook Autodiscover tests.+- Use the [Microsoft Remote Connectivity Analyzer](https://testconnectivity.microsoft.com/) to test your connection settings. Use the Outlook Anywhere (RPC over HTTP) or Outlook Autodiscover tests. - Run the following commands in Exchange Online PowerShell: |
| enterprise | Use Powershell To Perform An Imap Migration To Microsoft 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/use-powershell-to-perform-an-imap-migration-to-microsoft-365.md | Get-MigrationBatch -Identity IMAPBatch1 | Format-List Status Email systems use a DNS record called an MX record to figure out where to deliver emails. During the email migration process, your MX record was pointing to your source email system. Now that the email migration to Microsoft 365 is complete, it's time to point your MX record at Microsoft 365. This helps make sure that email is delivered to your Microsoft 365 mailboxes. By moving the MX record, you can also turn off your old email system when you're ready. -For many DNS providers, there are specific instructions to change your MX record. If your DNS provider isn't included, or if you want to get a sense of the general directions, [general MX record instructions](https://go.microsoft.com/fwlink/?LinkId=397449) are provided as well. +For many DNS providers, there are specific instructions to change your MX record. If your DNS provider isn't included, or if you want to get a sense of the general directions, [general MX record instructions](/microsoft-365/admin/get-help-with-domains/create-dns-records-at-any-dns-hosting-provider?view=o365-worldwide#add-an-mx-record-for-email-outlook-exchange-online) are provided as well. It can take up to 72 hours for the email systems of your customers and partners to recognize the changed MX record. Wait at least 72 hours before you proceed to the next task: Step 6: Delete IMAP migration batch. |
| enterprise | Using Content Search Web Part Instead Of Content Query Web Part To Improve Perfo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/using-content-search-web-part-instead-of-content-query-web-part-to-improve-perfo.md | Once you've added a Content Search Web Part, you can refine the search and retur ## Query building and testing tool -For a tool to build and test complex queries, see the [Search Query Tool](https://sp2013searchtool.codeplex.com/) on Codeplex. +For a tool to build and test complex queries, see the [Search Query Tool](https://github.com/pnp/PnP-Tools/tree/master/Solutions/SharePoint.Search.QueryTool#download-the-tool). |
| enterprise | Why You Need To Use Microsoft 365 Powershell | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/why-you-need-to-use-microsoft-365-powershell.md | Set-CsMeetingConfiguration -AdmitAnonymousUsersByDefault $False -AllowConference ``` > [!NOTE]-> To run this command, you must install the [Skype for Business Online PowerShell Module](https://www.microsoft.com/download/details.aspx?id=39366). +> To run this command, you must install the [Skype for Business Online PowerShell Module](/skypeforbusiness/set-up-your-computer-for-windows-powershell/download-and-install-the-skype-for-business-online-connector). The interpretation of this PowerShell command is: The interpretation of this PowerShell script is: [Manage Microsoft 365 user accounts, licenses, and groups with PowerShell](manage-user-accounts-and-licenses-with-microsoft-365-powershell.md) -[Use Windows PowerShell to create reports in Microsoft 365](use-windows-powershell-to-create-reports-in-microsoft-365.md) +[Use Windows PowerShell to create reports in Microsoft 365](use-windows-powershell-to-create-reports-in-microsoft-365.md) |
| lighthouse | M365 Lighthouse Get Help And Support | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-get-help-and-support.md | Several options are available if you need help. First, check to see if there are 3. In the list of services, find **Microsoft 365 suite**, and then expand it to show all the services in the suite. 4. Find **Microsoft 365 Lighthouse** and check the health. -- See if the issue is listed in [Known issues with Microsoft 365 Lighthouse](/office365/troubleshoot/microsoft-365-lighthouse/lighthouse-known-issues).+- See if the issue is listed in [Known issues with Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-known-issues?view=o365-worldwide). If you're experiencing an issue that isn't listed in any of these resources, then follow the instructions in this article to view self-help options or to create a service request. If you're experiencing an issue that isn't listed in any of these resources, the [Known issues with Microsoft 365 Lighthouse](m365-lighthouse-known-issues.md) (article)\ [Microsoft 365 Lighthouse FAQ](m365-lighthouse-faq.yml) (article)\-[Troubleshooot and resolve problems and error messages in Microsoft 365 Lighthouse](m365-lighthouse-troubleshoot.md) (article) +[Troubleshooot and resolve problems and error messages in Microsoft 365 Lighthouse](m365-lighthouse-troubleshoot.md) (article) |
| lti | Teams Meetings With Canvas | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lti/teams-meetings-with-canvas.md | Microsoft Teams meetings is a Learning Tools Interoperability (LTI) app that hel > > - Your tenant must have an Microsoft Education license. > - Only a single Microsoft tenant can be used for mapping users between Canvas and Microsoft.-> - You will have to turn off School Data Sync (SDS) before using the Class Teams LTI in order to avoid duplication of groups. +> - If you plan to use the Microsoft Teams Sync feature of Canvas concurrently with MicrosoftΓÇÖs School Data Sync (SDS), don't include class and class roster data in your SDS sync. You can continue to use SDS to sync all other data including users, organizations, parent contacts, and demographics. +> - You can use Teams Meetings LTI without enabling **Course Sync**. However, you won't be able to use the **Add entire class** option. You can either type or copy and paste attendees' email addresses, or add channels of existing teams to the meetings. ## Microsoft Office 365 Admin Set up the Microsoft Teams LTI 1.3 Integration. As a Canvas Admin, you'll need to add the Microsoft Teams meetings LTI app within your environment. Make a note of the LTI Client ID for the app. +- Microsoft Teams meetings - 170000000000703 1. Access **Admin settings** > **Apps**. |
| security | Common Exclusion Mistakes Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/common-exclusion-mistakes-microsoft-defender-antivirus.md | +- Microsoft Defender for Endpoint Plan 1 - Microsoft Defender Antivirus **Platforms**+ - Windows - macOS - Linux -You can define an exclusion list for items that you don't want Microsoft Defender Antivirus to scan. Such excluded items could contain threats that make your device vulnerable. This article describes some common mistake that you should avoid when defining exclusions. +> [!IMPORTANT] +> **Add exclusions with caution**. Exclusions for Microsoft Defender Antivirus scans reduce the level of protection for devices. ++You can define an exclusion list for items that you don't want Microsoft Defender Antivirus to scan. However, excluded items could contain threats that make your device vulnerable. This article describes some common mistakes that you should avoid when defining exclusions. Before defining your exclusion lists, see [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions). ## Excluding certain trusted items -Certain files, file types, folders, or processes should not be excluded from scanning even though you trust them to be not malicious. --Do not define exclusions for the folder locations, file extensions, and processes that are listed in the following sections: -- Folder locations-- File extensions-- Processes--### Folder locations --In general, do not define exclusions for the following folder locations: --`%systemdrive%` --`C:` --`C:\` --`C:\*` --`%ProgramFiles%\Java` --`C:\Program Files\Java` --`%ProgramFiles%\Contoso\` --`C:\Program Files\Contoso\` +Certain files, file types, folders, or processes shouldn't be excluded from scanning even though you trust them to be not malicious. -`%ProgramFiles(x86)%\Contoso\` +Don't define exclusions for the folder locations, file extensions, and processes that are listed in the following sections: -`C:\Program Files (x86)\Contoso\` +- [Folder locations](#folder-locations) +- [File extensions](#file-extensions) +- [Processes](#processes) -`C:\Temp` --`C:\Temp\` --`C:\Temp\*` --`C:\Users\` --`C:\Users\*` --`C:\Users\<UserProfileName>\AppData\Local\Temp\` **Note the following exception for SharePoint**: Do exclude -`C:\Users\ServiceAccount\AppData\Local\Temp` when you use [file-level antivirus protection in SharePoint](https://support.microsoft.com/office/certain-folders-may-have-to-be-excluded-from-antivirus-scanning-when-you-use-file-level-antivirus-software-in-sharepoint-01cbc532-a24e-4bba-8d67-0b1ed733a3d9). --`C:\Users\<UserProfileName>\AppData\LocalLow\Temp\` **Note the following exception for SharePoint**: Do exclude `C:\Users\Default\AppData\Local\Temp` when you use [file-level antivirus protection in SharePoint](https://support.microsoft.com/office/certain-folders-may-have-to-be-excluded-from-antivirus-scanning-when-you-use-file-level-antivirus-software-in-sharepoint-01cbc532-a24e-4bba-8d67-0b1ed733a3d9). --`%Windir%\Prefetch` --`C:\Windows\Prefetch` --`C:\Windows\Prefetch\` --`C:\Windows\Prefetch\*` --`%Windir%\System32\Spool` --`C:\Windows\System32\Spool` --`C:\Windows\System32\CatRoot2` -`%Windir%\Temp` +### Folder locations -`C:\Windows\Temp` +> [!IMPORTANT] +> Certain folders shouldn't be excluded from scans because they end up being folders where malicious files can get dropped. -`C:\Windows\Temp\` +In general, don't define exclusions for the following folder locations: -`C:\Windows\Temp\*` +- `%systemdrive%` +- `C:`, `C:\`, or `C:\*` +- `%ProgramFiles%\Java` or `C:\Program Files\Java` +- `%ProgramFiles%\Contoso\`, `C:\Program Files\Contoso\`, `%ProgramFiles(x86)%\Contoso\`, or `C:\Program Files (x86)\Contoso\` +- `C:\Temp`, `C:\Temp\`, or `C:\Temp\*` +- `C:\Users\` or `C:\Users\*` +- `C:\Users\<UserProfileName>\AppData\Local\Temp\` or `C:\Users\<UserProfileName>\AppData\LocalLow\Temp\`. **Note the following important exceptions for SharePoint**: **Do exclude** `C:\Users\ServiceAccount\AppData\Local\Temp` or `C:\Users\Default\AppData\Local\Temp` when you use [file-level antivirus protection in SharePoint](https://support.microsoft.com/office/certain-folders-may-have-to-be-excluded-from-antivirus-scanning-when-you-use-file-level-antivirus-software-in-sharepoint-01cbc532-a24e-4bba-8d67-0b1ed733a3d9). +- `%Windir%\Prefetch`, `C:\Windows\Prefetch`, `C:\Windows\Prefetch\`, or `C:\Windows\Prefetch\*` +- `%Windir%\System32\Spool` or `C:\Windows\System32\Spool` +- `C:\Windows\System32\CatRoot2` +- `%Windir%\Temp`, `C:\Windows\Temp`, `C:\Windows\Temp\`, or `C:\Windows\Temp\*` #### Linux and macOS Platforms -`/` --`/bin` --`/sbin` --`/usr/lib` +In general, don't define exclusions for the following folder locations: +- `/` +- `/bin` or `/sbin` +- `/usr/lib` ### File extensions -In general, do not define exclusions for the following file extensions: --`.7z` --`.bat` --`.bin` --`.cab` --`.cmd` --`.com` --`.cpl` --`.dll` --`.exe` --`.fla` --`.gif` --`.gz` --`.hta` --`.inf` --`.java` --`.jar` --`.job` --`.jpeg` --`.jpg` --`.js` --`.ko` --`.ko.gz` --`.msi` --`.ocx` --`.png` --`.ps1` --`.py` --`.rar` --`.reg` --`.scr` --`.sys` --`.tar` --`.tmp` --`.url` --`.vbe` --`.vbs` --`.wsf` --`.zip` +> [!IMPORTANT] +> Certain file extensions shouldn't be excluded because they can be file types that are used in an attack. ++In general, don't define exclusions for the following file extensions: ++- `.7z` +- `.bat` +- `.bin` +- `.cab` +- `.cmd` +- `.com` +- `.cpl` +- `.dll` +- `.exe` +- `.fla` +- `.gif` +- `.gz` +- `.hta` +- `.inf` +- `.java` +- `.jar` +- `.job` +- `.jpeg` +- `.jpg` +- `.js` +- `.ko` or `.ko.gz` +- `.msi` +- `.ocx` +- `.png` +- `.ps1` +- `.py` +- `.rar` +- `.reg` +- `.scr` +- `.sys` +- `.tar` +- `.tmp` +- `.url` +- `.vbe` +- `.vbs` +- `.wsf` +- `.zip` ### Processes -In general, do not define exclusions for the following processes: --`AcroRd32.exe` --`bitsadmin.exe` --`excel.exe` --`iexplore.exe` --`java.exe` --`outlook.exe` --`psexec.exe` --`powerpnt.exe` --`powershell.exe` --`schtasks.exe` --`svchost.exe` --`wmic.exe` --`winword.exe` --`wuauclt.exe` --`addinprocess.exe` +> [!IMPORTANT] +> Certain processes shouldn't be excluded because they get used during attacks. ++In general, don't define exclusions for the following processes: ++- `AcroRd32.exe` +- `addinprocess.exe` +- `addinprocess32.exe` +- `addinutil.exe` +- `bash.exe` +- `bginfo.exe` +- `bitsadmin.exe` +- `cdb.exe` +- `csi.exe` +- `dbghost.exe` +- `dbgsvc.exe` +- `dnx.exe` +- `dotnet.exe` +- `excel.exe` +- `fsi.exe` +- `fsiAnyCpu.exe` +- `iexplore.exe` +- `java.exe` +- `kd.exe` +- `lxssmanager.dll` +- `msbuild.exe` +- `mshta.exe` +- `ntkd.exe` +- `ntsd.exe` +- `outlook.exe` +- `psexec.exe` +- `powerpnt.exe` +- `powershell.exe` +- `rcsi.exe` +- `svchost.exe` +- `schtasks.exe` +- `system.management.automation.dll` +- `windbg.exe` +- `winword.exe` +- `wmic.exe` +- `wuauclt.exe` -`addinprocess32.exe` --`addinutil.exe` --`bash.exe` --`bginfo.exe` --`cdb.exe` --`csi.exe` --`dbghost.exe` --`dbgsvc.exe` --`dnx.exe` --`dotnet.exe` --`fsi.exe` --`fsiAnyCpu.exe` --`kd.exe` --`ntkd.exe` --`lxssmanager.dll` --`msbuild.exe` --`mshta.exe` --`ntsd.exe` --`rcsi.exe` --`system.management.automation.dll` --`windbg.exe` +> [!NOTE] +> You can choose to exclude file types, such as `.gif`, `.jpg`, `.jpeg`, or `.png` if your environment has a modern, up-to-date software with a strict update policy to handle any vulnerabilities. #### Linux and macOS Platforms -`bash` --`sh` --`python` and `python3` --`java` +In general, don't define exclusions for the following processes: -`zsh` --> [!NOTE] -> You can choose to exclude file types, such as `.gif`, `.jpg`, `.jpeg`, or `.png` if your environment has a modern, up-to-date software with a strict update policy to handle any vulnerabilities. +- `bash` +- `java` +- `python` and `python3` +- `sh` +- `zsh` ## Using just the file name in the exclusion list Malware might have the same name as that of a file that you trust and want to ex ## Using a single exclusion list for multiple server workloads -Do not use a single exclusion list to define exclusions for multiple server workloads. Split the exclusions for different application or service workloads into multiple exclusion lists. For example, the exclusion list for your IIS Server workload must be different from the exclusion list for your SQL Server workload. +Don't use a single exclusion list to define exclusions for multiple server workloads. Split the exclusions for different application or service workloads into multiple exclusion lists. For example, the exclusion list for your IIS Server workload must be different from the exclusion list for your SQL Server workload. ## Using incorrect environment variables as wildcards in the file name and folder path or extension exclusion lists -Microsoft Defender Antivirus Service runs in system context using the LocalSystem account, which means it gets information from the system environment variable, and not from the user environment variable. Use of environment variables as a wildcard in exclusion lists is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, do not use user environment variables as wildcards when adding Microsoft Defender Antivirus folder and process exclusions. See the table under [System environment variables](configure-extension-file-exclusions-microsoft-defender-antivirus.md#system-environment-variables) for a complete list of system environment variables. +Microsoft Defender Antivirus Service runs in system context using the LocalSystem account, which means it gets information from the system environment variable, and not from the user environment variable. Use of environment variables as a wildcard in exclusion lists is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, don't use user environment variables as wildcards when adding Microsoft Defender Antivirus folder and process exclusions. See the table under [System environment variables](configure-extension-file-exclusions-microsoft-defender-antivirus.md#system-environment-variables) for a complete list of system environment variables. See [Use wildcards in the file name and folder path or extension exclusion lists](configure-extension-file-exclusions-microsoft-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) for information on how to use wildcards in exclusion lists. |
| security | Customize Controlled Folders | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/customize-controlled-folders.md | For more information about customizing the notification when a rule is triggered - [Protect important folders with controlled folder access](controlled-folders.md) - [Enable controlled folder access](enable-controlled-folders.md)-- [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md)+- [Enable attack surface reduction rules](enable-attack-surface-reduction.md) |
| security | Defender Endpoint Plan 1 2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2.md | You can use this article to help clarify what protection is provided by the diff ## Compare Defender for Endpoint plans -| Subscription | What's included | +The following table summarizes what's included in each Defender for Endpoint plan. ++| Plan | What's included | |:|:|-| [Defender for Endpoint Plan 1](defender-endpoint-plan-1.md) | [Next-generation protection](defender-endpoint-plan-1.md#next-generation-protection) <br/>(includes antimalware and antivirus) <p> [Attack surface reduction](defender-endpoint-plan-1.md#attack-surface-reduction) <p> [Manual response actions](defender-endpoint-plan-1.md#manual-response-actions) <p> [Centralized management](defender-endpoint-plan-1.md#centralized-management) <p>[Security reports](defender-endpoint-plan-1.md#reporting) <p>[APIs](defender-endpoint-plan-1.md#apis) <p> [Support for Windows 10, iOS, Android OS, and macOS devices](defender-endpoint-plan-1.md#cross-platform-support)| -| [Defender for Endpoint Plan 2](microsoft-defender-endpoint.md) | Defender for Endpoint Plan 1 capabilities, plus: <p> <p> [Device discovery](device-discovery.md) <p> [Device inventory](machines-view-overview.md) <p> [Core Defender Vulnerability Management capabilities](../defender-vulnerability-management/defender-vulnerability-management-capabilities.md) <p> [Threat Analytics](threat-analytics.md) <p> [Automated investigation and response](automated-investigations.md) <p> [Advanced hunting](advanced-hunting-overview.md) <p> [Endpoint detection and response](overview-endpoint-detection-response.md) <p> [Microsoft Threat Experts](microsoft-threat-experts.md) <p>Support for [Windows](configure-endpoints.md) (client and server) and [non-Windows platforms](configure-endpoints-non-windows.md)<br/> (macOS, iOS, Android, and Linux) | -| [Defender Vulnerability Management add-on](../defender-vulnerability-management/defender-vulnerability-management-capabilities.md) | Additional Defender Vulnerability Management for Defender for Endpoint Plan 2: <p><p> [Security baselines assessment](../defender-vulnerability-management/tvm-security-baselines.md) <p> [Block vulnerable applications](../defender-vulnerability-management/tvm-block-vuln-apps.md) <p> [Browser extensions](../defender-vulnerability-management/tvm-browser-extensions.md) <p> [Digital certificate assessment](../defender-vulnerability-management/tvm-certificate-inventory.md) <p> [Network share analysis](../defender-vulnerability-management/tvm-network-share-assessment.md) <p> Support for [Windows](configure-endpoints.md) (client and server) and [non-Windows platforms](configure-endpoints-non-windows.md)<br/> (macOS, iOS, Android, and Linux) | +| [Defender for Endpoint Plan 1](defender-endpoint-plan-1.md) | <ul><li>[Next-generation protection](defender-endpoint-plan-1.md#next-generation-protection) (includes antimalware and antivirus)</li><li>[Attack surface reduction](defender-endpoint-plan-1.md#attack-surface-reduction)</li><li> [Manual response actions](defender-endpoint-plan-1.md#manual-response-actions)</li><li>[Centralized management](defender-endpoint-plan-1.md#centralized-management)</li><li>[Security reports](defender-endpoint-plan-1.md#reporting)</li><li>[APIs](defender-endpoint-plan-1.md#apis)</li><li>[Support for Windows 10, iOS, Android OS, and macOS devices](defender-endpoint-plan-1.md#cross-platform-support)</li></ul>| +| [Defender for Endpoint Plan 2](microsoft-defender-endpoint.md) | All of the Defender for Endpoint Plan 1 capabilities, plus:<ul><li>[Device discovery](device-discovery.md)</li><li>[Device inventory](machines-view-overview.md)</li><li>[Core Defender Vulnerability Management capabilities](../defender-vulnerability-management/defender-vulnerability-management-capabilities.md)</li><li>[Threat Analytics](threat-analytics.md)</li><li>[Automated investigation and response](automated-investigations.md)</li><li>[Advanced hunting](advanced-hunting-overview.md)</li><li>[Endpoint detection and response](overview-endpoint-detection-response.md)</li><li>[Microsoft Threat Experts](microsoft-threat-experts.md)</li><li>Support for [Windows](configure-endpoints.md) (client and server) and [non-Windows platforms](configure-endpoints-non-windows.md) (macOS, iOS, Android, and Linux)</li></ul> | +| [Defender Vulnerability Management add-on](../defender-vulnerability-management/defender-vulnerability-management-capabilities.md) | Additional Defender Vulnerability Management for Defender for Endpoint Plan 2:<ul><li>[Security baselines assessment](../defender-vulnerability-management/tvm-security-baselines.md)</li><li>[Block vulnerable applications](../defender-vulnerability-management/tvm-block-vuln-apps.md)</li><li>[Browser extensions](../defender-vulnerability-management/tvm-browser-extensions.md)</li><li>[Digital certificate assessment](../defender-vulnerability-management/tvm-certificate-inventory.md)</li><li>[Network share analysis](../defender-vulnerability-management/tvm-network-share-assessment.md)</li><li>Support for [Windows](configure-endpoints.md) (client and server) and [non-Windows platforms](configure-endpoints-non-windows.md) (macOS, iOS, Android, and Linux)</li></ul> | ++## Mixed licensing scenarios ++Suppose that your organization is using a mix of Microsoft endpoint security subscriptions, such as Defender for Endpoint Plan 1 and Defender for Endpoint Plan 2. **Currently, the highest functional Microsoft endpoint security subscription sets the experience for your tenant**. In this example, your tenant experience would be Defender for Endpoint Plan 2 for all users. ++However, **you can contact support and request an override for your tenant experience**. That is, you could request an override to keep the Defender for Endpoint Plan 1 experience for all users. ++- For details about licenses and product terms, see [Licensing and product terms for Microsoft 365 subscriptions](https://www.microsoft.com/licensing/terms/productoffering/Microsoft365/MCA). +- For information about how to contact support, see [Contact Microsoft Defender for Endpoint support](contact-support.md). ++> [!TIP] +> If your organization is a small or medium-sized business, see the following articles: +> - [What is Microsoft Defender for Business?](../defender-business/mdb-overview.md) +> - [Compare security features in Microsoft 365 plans for small and medium-sized businesses](../defender-business/compare-mdb-m365-plans.md). ## Start a trial |
| security | Deployment Vdi Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus.md | -In addition to standard on-premises or hardware configurations, you can also use Microsoft Defender Antivirus in a remote desktop (RDS) or non-persistent virtual desktop infrastructure (VDI) environment. +In addition to standard on-premises or hardware configurations, you can use Microsoft Defender Antivirus in a remote desktop (RDS) or non-persistent virtual desktop infrastructure (VDI) environment. With the ability to easily deploy updates to VMs running in VDIs, you can get updates on your machines quickly and easily. You no longer need to create and seal golden images on a periodic basis, as updates are expanded into their component bits on the host server and then downloaded directly to the VM when it's turned on. -For more information on Microsoft Remote Desktop Services and VDI support, see [Azure Virtual Desktop Documentation](/azure/virtual-desktop). --For Azure-based virtual machines, see [Install Endpoint Protection in Microsoft Defender for Cloud](/azure/defender-for-cloud/endpoint-protection-recommendations-technical). --With the ability to easily deploy updates to VMs running in VDIs, we've shortened this guide to focus on how you can get updates on your machines quickly and easily. You no longer need to create and seal golden images on a periodic basis, as updates are expanded into their component bits on the host server and then downloaded directly to the VM when it's turned on. +> [!NOTE] +> The Defender for Endpoint demo site at `demo.wd.microsoft.com` is deprecated and will be removed in the future. This guide describes how to configure your VMs for optimal protection and performance, including how to: This guide describes how to configure your VMs for optimal protection and perfor You can also download the whitepaper [Microsoft Defender Antivirus on Virtual Desktop Infrastructure](https://demo.wd.microsoft.com/Content/wdav-testing-vdi-ssu.pdf), which looks at the new shared security intelligence update feature, alongside performance testing and guidance on how you can test antivirus performance on your own VDI. -> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. +For more information on Microsoft Remote Desktop Services and VDI support, see [Azure Virtual Desktop Documentation](/azure/virtual-desktop). ++For Azure-based virtual machines, see [Install Endpoint Protection in Microsoft Defender for Cloud](/azure/defender-for-cloud/endpoint-protection-recommendations-technical). > [!IMPORTANT] > Although the VDI can be hosted on Windows Server 2012 or Windows Server 2016, the virtual machines (VMs) should be running Windows 10, 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows.-> > There are performance and feature improvements to the way in which Microsoft Defender AV operates on virtual machines in Windows 10 Insider Preview, build 18323 (and later). We'll identify in this guide if you need to be using an Insider Preview build; if it isn't specified, then the minimum required version for the best protection and performance is Windows 10 1607. ## Set up a dedicated VDI file share We suggest starting with once a day, but you should experiment with increasing o Security intelligence packages are typically published once every three to four hours. Setting a frequency shorter than four hours isn't advised because it will increase the network overhead on your management machine for no benefit. You can also set up your single server or machine to fetch the updates on behalf of the VMs at an interval and place them in the file share for consumption.-This is possible when the devices have the share and NTFS permissions for the read access to the share so they can grab the updates. +This is possible when the devices have the share and NTFS permissions for the read access to the share so they can grab the updates. To do this: -To do this: 1. Create an SMB/CIFS file share. 2. Use the following example to create a file share with the following share permissions. To do this: For this example, the file share is: - \\\fileserver.fqdn\mdatp$\wdav-update + `\\fileserver.fqdn\mdatp$\wdav-update` ### Set a scheduled task to run the PowerShell script Suppressing notifications prevents notifications from Microsoft Defender Antivir > [!TIP] > To open the Action Center on Windows 10 or Windows 11, take one of the following steps:-> > - On the right end of the taskbar, select the Action Center icon. > - Press the Windows logo key button + A. > - On a touchscreen device, swipe in from the right edge of the screen. Disabling a scan after an update will prevent a scan from occurring after receiv This policy prevents a scan from running immediately after an update. +## Disable the `ScanOnlyIfIdle` option ++Use the following cmdlet, to stop a quick or scheduled scan whenever the device goes idle if it is in passive mode. ++```PowerShell +Set-MpPreference -ScanOnlyIfIdleEnabled $false +``` ++You can also disable the `ScanOnlyIfIdle` option in Microsoft Defender Antivirus by configuration via local or domain group policy. This prevents the significant CPU contention in high density environments. ++For more information, see [Start the scheduled scan only when computer is on but not in use](https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::scan_scanonlyifidle). + ## Scan VMs that have been offline 1. In your Group Policy Editor, go to **Windows components** \> **Microsoft Defender Antivirus** \> **Scan**. |
| security | Enable Troubleshooting Mode | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-troubleshooting-mode.md | Title: Get started with troubleshooting mode in Microsoft Defender for Endpoint (preview) + Title: Get started with troubleshooting mode in Microsoft Defender for Endpoint description: Turn on the Microsoft Defender for Endpoint troubleshooting mode to address various antivirus issues. keywords: antivirus, troubleshoot, troubleshooting mode, tamper protection, compatibility search.product: eADQiWindows 10XVcnh-# Get started with troubleshooting mode in Microsoft Defender for Endpoint (preview) +# Get started with troubleshooting mode in Microsoft Defender for Endpoint [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] ms.technology: mde >Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) -> [!IMPORTANT] -> Some information relates to pre-released products which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - Microsoft Defender for Endpoint troubleshooting mode allows you to troubleshoot various Microsoft Defender antivirus features by enabling them from the device and testing different scenarios, even if they're controlled by the organization policy. The troubleshooting mode is disabled by default and requires you to turn it on for a device (and/or group of devices) for a limited time. Note that this is exclusively an Enterprise-only feature, and requires Microsoft 365 Defender access. ## What do you need to know before you begin? |
| security | Troubleshooting Mode Scenarios | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshooting-mode-scenarios.md | Title: Troubleshooting mode scenarios in Microsoft Defender for Endpoint (preview) + Title: Troubleshooting mode scenarios in Microsoft Defender for Endpoint description: Use the Microsoft Defender for Endpoint troubleshooting mode to address various antivirus issues. keywords: antivirus, troubleshoot, troubleshooting mode, tamper protection, compatibility search.product: eADQiWindows 10XVcnh-# Troubleshooting mode scenarios in Microsoft Defender for Endpoint (preview) +# Troubleshooting mode scenarios in Microsoft Defender for Endpoint [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] ms.technology: mde > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) -> [!IMPORTANT] -> Some information relates to pre-released products which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - Microsoft Defender for Endpoint troubleshooting mode allows you to troubleshoot various Microsoft Defender Antivirus features by enabling them from the device and testing different scenarios, even if they're controlled by the organization policy. The troubleshooting mode is disabled by default and requires you to turn it on for a device (and/or group of devices) for a limited time. Note that this is exclusively an enterprise-only feature, and requires Microsoft 365 Defender access. ## Scenario 1: Unable to install application |
| security | Air View Investigation Results | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/air-view-investigation-results.md | The investigation status indicates the progress of the analysis and actions. As |**Starting**|The investigation has been triggered and waiting to start running.| |**Running**|The investigation process has started and is underway. This state also occurs when [pending actions](air-review-approve-pending-completed-actions.md#approve-or-reject-pending-actions) are approved.| |**No Threats Found**|The investigation has finished and no threats (user account, email message, URL, or file) were identified. <p> **TIP**: If you suspect something was missed (such as a false negative), you can take action using [Threat Explorer](threat-explorer.md).|-|**Threats Found**|The automated investigation found issues, but there are no specific remediation actions to resolve those issues. <p> The **Threats Found** status can occur when some type of user activity was identified but no cleanup actions are available. Examples include any of the following user activities: <ul><li>A [data loss prevention](../../compliance/dlp-learn-about-dlp.md) event</li><li>An email sending anomaly</li><li>Sent malware</li><li>Sent phish</li></ul> <p> The investigation found no malicious URLs, files, or email messages to remediate, and no mailbox activity to fix, such as turning off forwarding rules or delegation. <p> **TIP**: If you suspect something was missed (such as a false negative), you can investigate and take action using [Threat Explorer](threat-explorer.md)| +|**Partially Investigated**|The automated investigation found issues, but there are no specific remediation actions to resolve those issues. <p> The **Partially Investigated** status can occur when some type of user activity was identified but no cleanup actions are available. Examples include any of the following user activities: <ul><li>A [data loss prevention](../../compliance/dlp-learn-about-dlp.md) event</li><li>An email sending anomaly</li><li>Sent malware</li><li>Sent phish</li></ul> <p> **Note**: This **Partially Investigated** status used to be labeled as **Threats Found**. <p> The investigation found no malicious URLs, files, or email messages to remediate, and no mailbox activity to fix, such as turning off forwarding rules or delegation. <p> **TIP**: If you suspect something was missed (such as a false negative), you can investigate and take action using [Threat Explorer](threat-explorer.md)| |**Terminated By System**|The investigation stopped. An investigation can stop for several reasons: <ul><li>The investigation's pending actions expired. Pending actions time out after awaiting approval for one week</li><li>There are too many actions. For example, if there are too many users clicking on malicious URLs, it can exceed the investigation's ability to run all the analyzers, so the investigation halts</li></ul> <p> **TIP**: If an investigation halts before actions were taken, try using [Threat Explorer](threat-explorer.md) to find and address threats.| |**Pending Action**|The investigation has found a threat, such as a malicious email, a malicious URL, or a risky mailbox setting, and an action to remediate that threat is [awaiting approval](air-review-approve-pending-completed-actions.md). <p> The **Pending Action** state is triggered when any threat with a corresponding action is found. However, the list of pending actions can increase as an investigation runs. View investigation details to see if other items are still pending completion.|-|**Remediated**|The investigation finished and all remediation actions were approved (noted as fully remediated). <p> **NOTE**: Approved remediation actions can have errors that prevent the actions from being taken. Regardless of whether remediation actions are successfully completed, the investigation status does not change. View investigation details.| +|**Remediated**|The investigation finished and all remediation actions were approved (noted as fully remediated). <p> **NOTE**: Approved remediation actions can have errors that prevent the actions from being taken. Regardless of whether remediation actions are successfully completed, the investigation status doesn't change. View investigation details.| |**Partially Remediated**|The investigation resulted in remediation actions, and some were approved and completed. Other actions are still [pending](air-review-approve-pending-completed-actions.md).|-|**Failed**|At least one investigation analyzer ran into a problem where it could not complete properly. <p> **NOTE** If an investigation fails after remediation actions were approved, the remediation actions might still have succeeded. View the investigation details.| +|**Failed**|At least one investigation analyzer ran into a problem where it couldn't complete properly. <p> **NOTE** If an investigation fails after remediation actions were approved, the remediation actions might still have succeeded. View the investigation details.| |**Queued By Throttling**|An investigation is being held in a queue. When other investigations complete, queued investigations begin. Throttling helps avoid poor service performance. <p> **TIP**: Pending actions can limit how many new investigations can run. Make sure to [approve (or reject) pending actions](air-review-approve-pending-completed-actions.md#approve-or-reject-pending-actions).| |**Terminated By Throttling**|If an investigation is held in the queue too long, it stops. <p> **TIP**: You can [start an investigation from Threat Explorer](automated-investigation-response-office.md#example-a-security-administrator-triggers-an-investigation-from-threat-explorer).| Certain kinds of alerts trigger automated investigation in Microsoft 365. To lea - Email counts are calculated at the time of the investigation, and some counts are recalculated when you open investigation flyouts (based on an underlying query). -- The email counts shown for the email clusters on the **Email** tab and the email quantity value shown on cluster flyout are calculated at the time of investigation, and do not change.+- The email counts shown for the email clusters on the **Email** tab and the email quantity value shown on cluster flyout are calculated at the time of investigation, and don't change. - The email count shown at the bottom of the **Email** tab of the email cluster flyout and the count of email messages shown in Explorer reflect email messages received after the investigation's initial analysis. Certain kinds of alerts trigger automated investigation in Microsoft 365. To lea - Volume anomalies represent a potential threat, and accordingly could be less severe compared to malware or phish threats that are identified using anti-virus engines, detonation, or malicious reputation. -- You do not have to approve every action. If you do not agree with the recommended action or your organization does not choose certain types of actions, then you can choose to **Reject** the actions or simply ignore them and take no action.+- You don't have to approve every action. If you don't agree with the recommended action or your organization doesn't choose certain types of actions, then you can choose to **Reject** the actions or simply ignore them and take no action. - Approving and/or rejecting all actions lets the investigation fully close (status becomes remediated), while leaving some actions incomplete results in the investigation status changing to a partially remediated state. |
| security | Configure Anti Malware Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-anti-malware-policies.md | Creating a custom anti-malware policy in the Microsoft 365 Defender portal creat A blank value means the default quarantine policy is used (AdminOnlyAccessPolicy for malware detections). When you later edit the anti-malware policy or view the settings, the default quarantine policy name is shown. For more information about default quarantine policies that are used for supported protection filtering verdicts, see [this table](quarantine-policies.md#step-2-assign-a-quarantine-policy-to-supported-features). + > [!NOTE] + > Users can't release their own messages that were quarantined as malware. At best, admins can configure the quarantine policy so users can request the release of their quarantined malware messages. + - **Notify recipients when messages are quarantined as malware**:- - If you select this option, the message is quarantined. A copy of the message is delivered to the recipients, but *all* attachments (not just malware attachments) are replaced with a single text file named **Malware Alert Text.txt**. + - If you select this option, the message is quarantined. A copy of the message is delivered to the recipients, but _all_ attachments (not just malware attachments) are replaced with a single text file named **Malware Alert Text.txt**. The default text in the replacement text file is described in [Anti-malware policies](anti-malware-protection.md#anti-malware-policies). To use custom text instead, enter the text in the **Custom notification text to recipient** box. |
| security | Configure Your Spam Filter Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-your-spam-filter-policies.md | Creating a custom anti-spam policy in the Microsoft 365 Defender portal creates > <sup>2</sup> You can this use value as a condition in mail flow rules to filter or route the message. > > <sup>3</sup> A blank **Select a policy** value means the default quarantine policy for that particular verdict is used. When you later edit the anti-spam policy or view the settings, the default quarantine policy name is shown. For more information about default quarantine policies that are used for the spam filter verdicts, see [this table](quarantine-policies.md#step-2-assign-a-quarantine-policy-to-supported-features).+ > + > Users can't release their own messages that were quarantined as high confidence phishing. At best, admins can configure the quarantine policy so users can request the release of their quarantined high confidence phishing messages. - **Retain spam in quarantine for this many days**: Specifies how long to keep the message in quarantine if you selected **Quarantine message** as the action for a spam filtering verdict. After the time period expires, the message is deleted, and is not recoverable. A valid value is from 1 to 30 days. |
| security | Quarantine Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-policies.md | The default quarantine policies, preset permission groups, and permissions are d ## Assign quarantine policies in supported policies in the Microsoft 365 Defender portal +> [!NOTE] +> Users can't release their own messages that were quarantined as malware (anti-malware policies) or high confidence phishing (anti-spam policies), regardless of how the quarantine policy is configured. At best, admins can configure the quarantine policy so users can request the release of their quarantined malware or high confidence phishing messages. + ### Anti-spam policies 1. In the [Microsoft 365 Defender portal](https://security.microsoft.com), go to **Email & collaboration** \> **Policies & rules** \> **Threat policies** \> **Anti-spam** in the **Policies** section. |
| security | Ensuring You Always Have The Optimal Security Controls With Preset Security Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/ensuring-you-always-have-the-optimal-security-controls-with-preset-security-policies.md | Once youΓÇÖve chosen between the Standard and Strict security preset policies fo 1. Select **Threat policies**. 1. Select **Preset Security Policies** underneath the **Templated policies** heading 1. Select **Manage** underneath the Standard protection preset.-1. Add the users, groups, or domains you want to apply the Standard preset to, in the EOP protections apply to section. Click the **Next** button. -1. Add the users, groups, or domains you want to apply the Standard preset to, in the MDO protections apply to section. Click the **Next** button. -1. Click on the **Confirm** button. -1. Select the **Manage** link in the Strict protection preset. -1. Add the users, groups, or domains you want to apply the Standard preset to, in the EOP protections apply to section. Click the **Next** button. -1. Add the users, groups, or domains you want to apply the Standard preset to, in the MDO protections apply to section. Click the **Next** button. -1. Click on the **Confirm** button. +1. Select **All Recipients** to apply Exchange Online Protection tenant wide, or select **Specific recipients** to manually add add users, groups, or domains you want to apply the protection policy to. Click the **Next** button. +1. Select **All Recipients** to apply Defender for Office 365 Protection tenant wide, or select **Specific recipients** to manually add add users, groups, or domains you want to apply the protection policy to. Click the **Next** button. +1. On the **Impersonation Protection** section, add email addresses & domains to protect from impersonation attacks, then add any trusted senders and domains you do not want the impersonation protection to apply to, then press **Next** +3. Click on the **Confirm** button. +4. Select the **Manage** link in the Strict protection preset. +5. Repeat steps 7-10 again, but for the users strict protection should be applied to. (if applicable) +7. Click on the **Confirm** button. > [!TIP] > To learn more about preset polcies click [here](../../office-365-security/preset-security-policies.md) |
| solutions | Identity Design Principles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/identity-design-principles.md | To [Multi-Geo](../enterprise/microsoft-365-multi-geo.md) or not to Multi-Geo, th - It doesn't to provide performance benefits. It could make performance worse if the [network design](https://aka.ms/office365networking) is not correct. Get devices "close" to the Microsoft network, not necessarily to your data. - It's not a solution for [GDPR compliance](https://www.microsoft.com/trust-center/privacy/gdpr-overview). GDPR doesn't focus on data sovereignty or storage locations. There are other compliance frameworks for that. - It doesn't solve delegation of administration (see below) or [information barriers](../compliance/information-barriers.md).-- It's not the same as multi-tenant and requires additional [user provisioning](https://github.com/MicrosoftDocs/azure-docs-pr/blob/master/articles/active-directory/hybrid/how-to-connect-sync-feature-preferreddatalocation.md) workflows.+- It is not the same as multi-tenant and requires additional [user provisioning](/azure/active-directory/hybrid/how-to-connect-sync-feature-preferreddatalocation) workflows. - It doesn't [move your tenant](../enterprise/moving-data-to-new-datacenter-geos.md) (your Azure AD) to another geography. ## Delegation of administration |
| solutions | Information Protection Deploy Assess | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/information-protection-deploy-assess.md | See these articles for more information: - [Customize a built-in sensitive information type](../compliance/customize-a-built-in-sensitive-information-type.md) - [Learn about sensitive information types](../compliance/sensitive-information-type-learn-about.md)-- [Create a custom sensitive information type in the Microsoft 365 Purview compliance portal](../compliance/create-a-custom-sensitive-information-type.md)-- [Create a custom sensitive information type in Security & Compliance PowerShell](../compliance/create-a-custom-sensitive-information-type-in-scc-powershell.md)-- [Create custom sensitive information types with Exact Data Match based classification](../compliance/create-custom-sensitive-information-types-with-exact-data-match-based-classification.md)+- [Create a custom sensitive information type in the Security & Compliance Center](../compliance/create-a-custom-sensitive-information-type.md) +- [Create a custom sensitive information type in Security & Compliance Center PowerShell](../compliance/create-a-custom-sensitive-information-type-in-scc-powershell.md) +- [Create custom sensitive information types with Exact Data Match based classification](/microsoft-365/compliance/sit-get-started-exact-data-match-based-sits-overview?view=o365-worldwide) ### Content Explorer |
| test-base | Accesslevel | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/test-base/accesslevel.md | + + Title: 'Request to change access level' +description: How to request to change access level +search.appverid: MET150 ++++audience: Software-Vendor + Last updated : 06/16/2022++ms.localizationpriority: medium ++++f1.keywords: NOCSH +++# Request to change access level ++We're now making access to pre-release Windows update content more available. Once your request for access to pre-release updates is approved, your uploaded packages will automatically get scheduled to be tested against the pre-release Windows updates for the OS versions selected during onboarding. ++To request access, select the "Access level change request" option in the left navigation bar and fill out all the details for your organization and submit the request. You'll be notified on the registered email address once your request is approved. Once approved, when a new pre-release build is available, your packages will automatically get tested against the new update for the versions selected. ++> [!div class="mx-imgBorder"] +> [  ](Media/accesslevelchange.png#lightbox) |