| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | About Shared Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/email/about-shared-mailboxes.md | Before you [create a shared mailbox](create-a-shared-mailbox.md), here are some > [!NOTE]-> To access a shared mailbox, a user must have an Exchange Online license, but the shared mailbox doesn't require a separate license. Every shared mailbox has a corresponding user account. Notice how you weren't asked to provide a password when you created the shared mailbox? The account has a password, but it's system-generated (unknown). You shouldn't use the account to log in to the shared mailbox. Without a license, shared mailboxes are limited to 50 GB. To increase the size limit to 100 GB, the shared mailbox must be assigned an Exchange Online Plan 2 license. The Exchange Online Plan 1 license with an Exchange Online Archiving add-on license will only increase the size of the archive mailbox. This will also let you enable auto-expanding archiving for additional archive storage capacity. Similarly, if you want to place a shared mailbox on litigation hold, the shared mailbox must have an Exchange Online Plan 2 license or an Exchange Online Plan 1 license with an Exchange Online Archiving add-on license. If you want to apply advanced features such as Microsoft Defender for Office 365, eDiscovery (Premium), or retention policies, the shared mailbox must be licensed for those features. +> To access a shared mailbox, a user must have an Exchange Online license, but the shared mailbox doesn't require a separate license. Every shared mailbox has a corresponding user account. Notice how you weren't asked to provide a password when you created the shared mailbox? The account has a password, but it's system-generated (unknown). You shouldn't use the account to log in to the shared mailbox. Without a license, shared mailboxes are limited to 50 GB. To increase the size limit to 100 GB, the shared mailbox must be assigned an Exchange Online Plan 2 license. The Exchange Online Plan 1 license with an Exchange Online Archiving add-on license will only increase the size of the archive mailbox. This will also let you enable auto-expanding archiving for additional archive storage capacity. Similarly, if you want to place a shared mailbox on litigation hold, the shared mailbox must have an Exchange Online Plan 2 license or an Exchange Online Plan 1 license with an Exchange Online Archiving add-on license. +> +>If you want to apply advanced features such as Microsoft Defender for Office 365, eDiscovery (Premium), or retention policies, licenses may be required. For more information, see [Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance). > [!NOTE] > Prior to July 2018, all unlicensed shared mailboxes were provisioned with a size of 100 GB. For more information, see [Correcting Shared Mailbox provisioning and sizing](https://techcommunity.microsoft.com/t5/exchange-team-blog/correcting-shared-mailbox-provisioning-and-sizing/ba-p/607991). |
| compliance | Define Mail Flow Rules To Encrypt Email | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/define-mail-flow-rules-to-encrypt-email.md | description: "Admins can learn to create mail flow rules (transport rules) to en As an administrator that manages Exchange Online, you can create mail flow rules (also known as transport rules) to help protect email messages you send and receive. You can set up rules to encrypt any outgoing email messages and remove encryption from encrypted messages coming from inside your organization or from replies to encrypted messages sent from your organization. You can use the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center (EAC)</a> or Exchange Online PowerShell to create these rules. In addition to overall encryption rules, you can also choose to enable or disable individual message encryption options for end users. -You can't encrypt inbound mail from senders outside of your Exchange Online organization. If a mail flow rule is set up to encrypt mail from outside the organization, the mail will be rejected and returned to the sender. +You can't encrypt inbound mail from senders outside of your Exchange Online organization. If a mail flow rule is set up to encrypt mail from outside the organization, the inbound mail will be delivered without encryption. If you recently migrated from Active Directory RMS to Azure Information Protection, you'll need to review your existing mail flow rules to ensure that they continue to work in your new environment. Also, to use Microsoft Purview Message Encryption with Azure Information Protection, you need to update your existing mail flow rules. Otherwise, your users will continue to receive encrypted mail that uses the previous HTML attachment format instead of the new, seamless experience. If you haven't set up message encryption yet, see [Set up Microsoft Purview Message Encryption](set-up-new-message-encryption-capabilities.md) for information. |
| compliance | Dlp Firefox Extension Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-firefox-extension-get-started.md | Here's a list of applicable roles. To learn more about them, see [Permissions in - Information Protection Investigator - Information Protection Reader -Here's a list of applicable role groups. To learn more about the, see [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md). +Here's a list of applicable role groups. To learn more about these role groups, see [Permissions in the Microsoft Purview compliance portal](microsoft-365-compliance-center-permissions.md). - Information Protection - Information Protection Admins After ingesting the ADMX, the steps below can be followed to create a configurat If you don't want to use Microsoft Intune, you can use group policies to deploy the extension across your organization. -#### Adding the Chrome Extension to the ForceInstall List +#### Adding the Firefox Extension to the ForceInstall List 1. In the Group Policy Management Editor, navigate to your OU. |
| compliance | Dlp Policy Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-policy-reference.md | A DLP policy can find and protect items that contain sensitive information acros |Location |Supports Administrative Units |Include/Exclude scope |Data state |Additional prerequisites | ||||||-|Exchange email online|Yes |distribution group | data-in-motion| No | -|SharePoint online sites|No |sites | data-at-rest </br> data-in-use | No| -|OneDrive for Business accounts|Yes| account or distribution group |data-at-rest </br> data-in-use|No| -|Teams chat and channel messages|Yes | account or distribution group |data-in-motion </br> data-in-use | No | -|Microsoft Defender for Cloud Apps|No | cloud app instance |data-at-rest | - [Use data loss prevention policies for non-Microsoft cloud apps](dlp-use-policies-non-microsoft-cloud-apps.md#use-data-loss-prevention-policies-for-non-microsoft-cloud-apps) | -|Devices|Yes |user or group |data-at-rest </br> data-in-use </br> data-in-motion |- [Learn about Endpoint data loss prevention](endpoint-dlp-learn-about.md) </br>- [Get started with Endpoint data loss prevention](endpoint-dlp-getting-started.md) </br>- [Configure device proxy and internet connection settings for Information Protection](device-onboarding-configure-proxy.md#configure-device-proxy-and-internet-connection-settings-for-information-protection) | -|On-premises repositories (file shares and SharePoint)|No |repository | data-at-rest | - [Learn about the data loss prevention on-premises repositories](dlp-on-premises-scanner-learn.md) </br> - [Get started with the data loss prevention on-premises repositories](dlp-on-premises-scanner-get-started.md#get-started-with-the-data-loss-prevention-on-premises-repositories) | -|Power BI |No| workspaces | data-in-use | No| --#### Exchange location scoping +|Exchange |Yes |- Distribution groups </br> - Security groups </br> - Non-mail enabled security groups </br> - Dynamic distribution lists </br> - Microsoft 365 groups (Group members only, not the group as an entity) | data-in-motion | No | +|SharePoint |No |Sites | data-at-rest </br> data-in-use | No| +|OneDrive |Yes| - Distribution groups </br> - Security groups </br> - Non-mail enabled security groups </br> - Microsoft 365 groups (Group members only, not the group as an entity) |data-at-rest </br> data-in-use|No| +|Teams chat and channel messages|Yes | - Distribution groups </br> - Security groups </br> - Non-mail enabled security groups </br> - Microsoft 365 groups (Group members only, not the group as an entity)|data-in-motion </br> data-in-use | No | +|Microsoft Defender for Cloud Apps|No | Cloud app instance |data-at-rest | - [Use data loss prevention policies for non-Microsoft cloud apps](dlp-use-policies-non-microsoft-cloud-apps.md#use-data-loss-prevention-policies-for-non-microsoft-cloud-apps) | +|Devices|Yes |- Distribution groups </br> - Security groups </br> - Non-mail enabled security groups </br> - Microsoft 365 groups (Group members only, not the group as an entity) |data-at-rest </br> data-in-use </br> data-in-motion |- [Learn about Endpoint data loss prevention](endpoint-dlp-learn-about.md) </br>- [Get started with Endpoint data loss prevention](endpoint-dlp-getting-started.md) </br>- [Configure device proxy and internet connection settings for Information Protection](device-onboarding-configure-proxy.md#configure-device-proxy-and-internet-connection-settings-for-information-protection) | +|On-premises repositories (file shares and SharePoint)|No |Repository | data-at-rest | - [Learn about the data loss prevention on-premises repositories](dlp-on-premises-scanner-learn.md) </br> - [Get started with the data loss prevention on-premises repositories](dlp-on-premises-scanner-get-started.md#get-started-with-the-data-loss-prevention-on-premises-repositories) | +|Power BI |No| Workspaces | data-in-use | No| +| Third-party apps | None | No | No | No | +| Power BI | No | None | No | No | +++#### Exchange location scoping If you choose to include specific distribution groups in Exchange, the DLP policy is scoped only to the emails sent by members of that group. Similarly excluding a distribution group excludes all the emails sent by the members of that distribution group from policy evaluation. |
| compliance | Double Key Encryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/double-key-encryption.md | For more information about the default, cloud-based tenant root keys, see [Plann Double Key Encryption is intended for your most sensitive data that is subject to the strictest protection requirements. DKE isn't intended for all data. In general, you use Double Key Encryption to protect only a small part of your overall data. You should do due diligence in identifying the right data to cover with this solution before you deploy. In some cases, you might need to narrow your scope and use other solutions for most of your data, such as Microsoft Purview Information Protection with Microsoft-managed keys or BYOK. These solutions are sufficient for documents that aren't subject to enhanced protections and regulatory requirements. Also, these solutions enable you to use the most powerful Office 365 services; services that you can't use with DKE encrypted content. For example: -- Transport rules including anti-malware and spam that require visibility into the attachment+- Mail flow rules including anti-malware and spam that require visibility into the attachment - Microsoft Delve - eDiscovery - Content search and indexing If your organizations have any of the following requirements, you can use DKE to ## System and licensing requirements for DKE -**Double Key Encryption** comes with Microsoft 365 E5. If you donΓÇÖt have a Microsoft 365 E5 license, you can sign up for a [trial](https://aka.ms/M365E5ComplianceTrial). For more information about these licenses, see [Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance). +Double Key Encryption comes with Microsoft 365 E5. If you donΓÇÖt have a Microsoft 365 E5 license, you can sign up for a [trial](https://aka.ms/M365E5ComplianceTrial). For more information about these licenses, see [Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance). -**Azure Information Protection**. DKE works with sensitivity labels and requires Azure Information Protection. +DKE sensitivity labels are made available to end users through the sensitivity button in the AIP Unified Labeling client in Office Desktop Apps, File Explorer right-click, AIP Powershell, and the AIP scanner. Install these prerequisites on each client computer where you want to protect and consume protected documents. -DKE sensitivity labels are made available to end users through the sensitivity button in the AIP Unified Labeling client in Office Desktop Apps, File Explorer right-click, AIP Powershell and the AIP scanner. Install these prerequisites on each client computer where you want to protect and consume protected documents. +### Azure Information Protection is required for DKE -**Microsoft Office Apps for enterprise** version 2009 or later (Desktop versions of Word, Excel, PowerPoint and Outlook) on Windows. +DKE works with sensitivity labels and requires Azure Information Protection service for encryption. -**Azure Information Protection Unified Labeling Client** versions 2.14.94.0 or later. Download and install the Unified Labeling client from the [Microsoft download center](https://www.microsoft.com/download/details.aspx?id=53018) for DKE label support in Word, Excel and PowerPoint. [Open a support case](/azure/information-protection/information-support#to-contact-microsoft-support) for Unified Labeling client versions with DKE label support in Outlook. +### Azure Information Protection Unified Labeling Client and Office Apps for Desktop requirements for DKE ++If you choose to use the labeling client and Office Apps for Desktop combination, use the following information. ++- Unified Labeling Client version 2.14.94.0 or later. Download and install the Unified Labeling client from the [Microsoft download center](https://www.microsoft.com/download/details.aspx?id=53018). ++- Microsoft Office Apps for enterprise requirements for DKE with the AIP labeling client version 2009 or later (Desktop versions of Word, Excel, PowerPoint and Outlook) on Windows. ++- For Outlook Desktop, [open a support case](/azure/information-protection/information-support#to-contact-microsoft-support) for Unified Labeling client versions with DKE label support in Outlook. ++### DKE built-in labeling requirements for DKE ++For information about support in Word, Excel, and PowerPoint see the [capabilities tables](sensitivity-labels-versions.md) and the row **Double Key Encryption (DKE)**. ## Supported environments for storing and viewing DKE-protected content |
| compliance | Ediscovery Delete Items In The Recoverable Items Folder Of Mailboxes On Hold | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery-delete-items-in-the-recoverable-items-folder-of-mailboxes-on-hold.md | This article explains how admins can delete items from the Recoverable Items fol ## Before you delete items - To create and run a Content Search, you have to be a member of the eDiscovery Manager role group or be assigned the Compliance Search management role. To delete messages, you have to be a member of the Organization Management role group or be assigned the Search And Purge management role. For information about adding users to a role group, see [Assign eDiscovery permissions](./ediscovery-assign-permissions.md).- - If a mailbox is assigned to an organization-wide retention policy, you have to exclude the mailbox from the policy before you can delete items from the Recoverable Items folder. It may take up to 24 hours to synchronize the policy change, and remove the mailbox from the policy. For more information, see "Organization-wide retention policies" in the [Remove all holds from the mailbox](#organization-wide-retention-policies) section in this article.- - You can't perform this procedure for a mailbox that has been assigned retention settings with a retention policy that's locked by using Preservation Lock. That's because this lock prevents you from removing or excluding the mailbox from the policy and from disabling the Managed Folder Assistant on the mailbox. For more information about locking policies for retention,see [Use Preservation Lock to restrict changes to retention policies and retention label policies](retention-preservation-lock.md).- - The procedure described in this article isn't supported for inactive mailboxes. That's because you can't reapply a hold (or retention policy) to an inactive mailbox after you remove it. When you remove a hold from an inactive mailbox, it's changed to a normal soft-deleted mailbox and will be permanently deleted from your organization after it's processed by the Managed Folder Assistant.- - If a mailbox isn't placed on hold (or doesn't have single item recovery enabled), you can delete the items from the Recoverable Items folder. For more information about how to do this, see [Search for and delete email messages in your organization](./search-for-and-delete-messages-in-your-organization.md). ## Step 1: Collect information about the mailbox This article explains how admins can delete items from the Recoverable Items fol This first step is to collect selected properties from the target mailbox that will affect this procedure. Be sure to write down these settings or save them to a text file because you'll change some of these properties and then revert back to the original values in Step 6, after you delete items from the Recoverable Items folder. Here's a list of the mailbox properties you need to collect. - *SingleItemRecoveryEnabled* and *RetainDeletedItemsFor*. If necessary, you'll disable single recovery and increase the deleted items retention period in Step 3.- - *LitigationHoldEnabled* and *InPlaceHolds*. You need to identify all the holds placed on the mailbox so that you can temporarily remove them in Step 3. See the [More information](#more-information) section for tips about how to identify the type hold that might be placed on a mailbox. Additionally, you need to get the mailbox client access settings so you can temporarily disable them so the owner (or other users) can't access the mailbox during this procedure. Finally, you can get the current size and number of items in the Recoverable Items folder. After you delete items in the Recoverable Items folder in Step 5, you'll use this information to verify that items were removed. Additionally, you need to get the mailbox client access settings so you can temp If the value of the *DelayHoldApplied* or *DelayReleaseHoldApplied* property is set to **True**, a delay hold is applied to the mailbox and must be removed. For more information about delay holds, see [Step 4: Remove the delay hold from the mailbox](#step-4-remove-the-delay-hold-from-the-mailbox). - If the value of either properties is set to **False**, a delay hold is not applied to the mailbox, and you can skip Step 4. + If the value of either properties is set to **False**, a delay hold isn't applied to the mailbox, and you can skip Step 4. 7. Run the following command to get the current size and total number of items in folders and subfolders in the Recoverable Items folder in the user's primary mailbox. Additionally, you need to get the mailbox client access settings so you can temp After collecting and saving information about the mailbox, the next step is to prepare the mailbox by performing the following tasks: - **Disable client access to mailbox** so that the mailbox owner can't access their mailbox and make any changes to the mailbox data during this procedure.- - **Increase the deleted item retention period** to 30 days (the maximum value in Exchange Online) so that items aren't purged from the Recoverable Items folder before you can delete them in Step 5.- - **Disable single Item recovery** so that items won't be retained (for the duration of the deleted item retention period) after you delete them from the Recoverable Items folder in Step 5.- - **Disable the Managed Folder Assistant** so that it doesn't process the mailbox and retain the items that you delete in Step 5. Perform the following steps in Exchange Online PowerShell. Perform the following steps in Exchange Online PowerShell. > [!NOTE] > It might take up to 240 minutes to disable single item recovery. Don't delete items in the Recoverable Items folder until this period has elapsed. -4. Run the following command to prevent the Managed Folder Assistant from processing the mailbox. As previously explained, you can disable the Managed Folder Assistant only if a retention policy with a Preservation Lock is not applied to the mailbox. +4. Run the following command to prevent the Managed Folder Assistant from processing the mailbox. As previously explained, you can disable the Managed Folder Assistant only if a retention policy with a Preservation Lock isn't applied to the mailbox. ```powershell Set-Mailbox <username> -ElcProcessingDisabled $true After you identify the retention policy, go to the **Data lifecycle management** ### Organization-wide retention policies -Organization-wide, Exchange-wide, and Teams-wide retention policies are applied to every mailbox in the organization. They are applied at the organization level (not the mailbox level) and are returned when you run the **Get-OrganizationConfig** cmdlet in Step 1. Run the following command in [Security & Compliance PowerShell](/powershell/exchange/exchange-online-powershell) to identify the organization-wide retention policies. Use the GUID (not including the `mbx` prefix) for the organization-wide retention policies that you identified in Step 1. +Organization-wide, Exchange-wide, and Teams-wide retention policies are applied to every mailbox in the organization. They're applied at the organization level (not the mailbox level) and are returned when you run the **Get-OrganizationConfig** cmdlet in Step 1. Run the following command in [Security & Compliance PowerShell](/powershell/exchange/exchange-online-powershell) to identify the organization-wide retention policies. Use the GUID (not including the `mbx` prefix) for the organization-wide retention policies that you identified in Step 1. ```powershell Get-RetentionCompliancePolicy <retention policy GUID without prefix> | FL Name ``` -After you identify the organization-wide retention policies, go to the **Data lifecycle management** > **Microsoft 365** > **Retention** page in the compliance portal, edit each organization-wide retention policy that you identified in the previous step, and add the mailbox to the list of excluded recipients. Doing this will remove the user's mailbox from the retention policy. +After you identify the organization-wide retention policies, go to the **Data lifecycle management** > **Microsoft 365** > **Retention** page in the compliance portal, edit each organization-wide retention policy that you identified in the previous step, and add the mailbox to the list of excluded recipients. Doing this removes the user's mailbox from the retention policy. > [!IMPORTANT] > After you exclude a mailbox from an organization-wide retention policy, it may take up to 24 hours to synchronize this change and remove the mailbox from the policy. Get-ComplianceCase $CaseHold.CaseId | FL Name $CaseHold.Name ``` -After you've identified the name of the eDiscovery case and the hold, go to the **eDiscovery** \> **eDiscovery** page in the compliance center, open the case, and remove the mailbox from the hold. For more information about identifying eDiscovery holds, see the "eDiscovery holds" section in [How to identify the type of hold placed on an Exchange Online mailbox](ediscovery-identify-a-hold-on-an-exchange-online-mailbox.md#ediscovery-holds). +After you've identified the name of the eDiscovery case and the hold, go to the **eDiscovery** \> **eDiscovery** page in the compliance portal, open the case, and remove the mailbox from the hold. For more information about identifying eDiscovery holds, see the "eDiscovery holds" section in [How to identify the type of hold placed on an Exchange Online mailbox](ediscovery-identify-a-hold-on-an-exchange-online-mailbox.md#ediscovery-holds). ## Step 4: Remove the delay hold from the mailbox Now you're ready to actually delete items in the Recoverable Items folder by usi To search for items that are located in the Recoverable Items folder, we recommend that you perform a *targeted collection*. This means you narrow the scope of your search only to items located in the Recoverable Items folder. You can do this by running the script in the [Use Content Search for targeted collections](use-content-search-for-targeted-collections.md) article. This script returns the value of the folder ID property for all the subfolders in the target Recoverable Items folder. Then you use the folder ID in a search query to return items located in that folder. +>[!NOTE] +>If the mailbox quota is met and the user mailbox is declining emails, you may receive a 554 5.2.0 error when deleting recoverable items. For more information, see ["554 5.2.0 STOREDRV.Deliver.Exception" when sending emails in Exchange Online](/exchange/troubleshoot/email-delivery/ndr/mapiexceptionnotfound-ndr). + Here's an overview of the process to search for and delete items in a user's Recoverable Items folder: 1. Run the targeted collection script that returns the folder IDs for all folders in the target user's mailbox. The script connects to Exchange Online PowerShell and Security & Compliance PowerShell in the same PowerShell session. For more information, see [Run the script to get a list of folders for a mailbox](use-content-search-for-targeted-collections.md#step-1-run-the-script-to-get-a-list-of-folders-for-a-mailbox-or-site). Here's an overview of the process to search for and delete items in a user's Rec Here's a list and description of the subfolders in the Recoverable Items folder that you can search and delete items from: - - **Deletions**: Contains soft-deleted items whose deleted item retention period has not expired. Users can recover soft-deleted items from this subfolder using the Recover Deleted Items tool in Outlook. -+ - **Deletions**: Contains soft-deleted items whose deleted item retention period hasn't expired. Users can recover soft-deleted items from this subfolder using the Recover Deleted Items tool in Outlook. - **DiscoveryHolds**: Contains hard-deleted items that have been preserved by an eDiscovery hold or a retention policy. This subfolder isn't visible to end users.- - **SubstrateHolds**: Contains hard-deleted items from Teams and other cloud-based apps that have been preserved by a retention policy or other type of hold. This subfolder isn't visible to end users. -3. Use the **New-ComplianceSearch** cmdlet (in Security & Compliance PowerShell) or use the Content search tool in the compliance center to create a content search that returns items from the target user's Recoverable Items folder. You can do this by including the FolderId in the search query for all subfolders that you want to search. For example, the following query returns all messages in the Deletions and eDiscoveryHolds subfolders: +3. Use the **New-ComplianceSearch** cmdlet (in Security & Compliance PowerShell) or use the Content search tool in the compliance portal to create a content search that returns items from the target user's Recoverable Items folder. You can do this by including the FolderId in the search query for all subfolders that you want to search. For example, the following query returns all messages in the Deletions and eDiscoveryHolds subfolders: ```text folderid:<folder ID of Deletions subfolder> OR folderid:<folder ID of DiscoveryHolds subfolder> Get-MailboxFolderStatistics <username> -FolderScope RecoverableItems -Archive | The final step is to revert the mailbox back to its previous configuration. This means resetting the properties that you changed in Step 2 and reapplying the holds that you removed in Step 3. This includes: - Changing the deleted item retention period back to its previous value. Alternatively, you can just leave this set to 30 days, the maximum value in Exchange Online.- - Re-enabling single Item recovery.- - Re-enabling the client access methods so that the owner can access their mailbox.- - Reapplying the holds and retention policies that you removed.- - Re-enabling the Managed Folder Assistant to process the mailbox. > [!IMPORTANT] Perform the following steps (in the specified sequence) in Exchange Online Power **Retention policies applied to specific mailboxes** - Use the compliance portal to add the mailbox back to the retention policy. Go to the **Data lifecycle management** > **Microsoft 365** > **Retention** page in the compliance center, edit the retention policy, and add the mailbox back to the list of recipients that the retention policy is applied to. + Use the compliance portal to add the mailbox back to the retention policy. Go to the **Data lifecycle management** > **Microsoft 365** > **Retention** page in the compliance portal, edit the retention policy, and add the mailbox back to the list of recipients that the retention policy is applied to. **Organization-wide retention policies** - If you removed an organization-wide or Exchange-wide retention policy by excluding it from the policy, then use the compliance portal to remove the mailbox from the list of excluded users. Go to the **Data lifecycle management** > **Microsoft 365** > **Retention** page in the compliance center, edit the organization-wide retention policy, and remove the mailbox from the list of excluded recipients. Doing this will reapply the retention policy to the user's mailbox. + If you removed an organization-wide or Exchange-wide retention policy by excluding it from the policy, then use the compliance portal to remove the mailbox from the list of excluded users. Go to the **Data lifecycle management** > **Microsoft 365** > **Retention** page in the compliance portal, edit the organization-wide retention policy, and remove the mailbox from the list of excluded recipients. Doing this reapplies the retention policy to the user's mailbox. **eDiscovery case holds** |
| compliance | Sensitivity Labels Teams Groups Sites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-teams-groups-sites.md | f1.keywords: Previously updated : 05/23/2023 Last updated : 06/01/2023 audience: Admin After you enable and configure sensitivity labels for containers, users can addi  -After a sensitivity label has been applied to a site, you must be a [site admin](/sharepoint/site-permissions#site-admins) to change the label in SharePoint or Teams. +After a sensitivity label has been applied to a site, you must have the following role to change that label in SharePoint or Teams: +- For a group-connect site: Microsoft 365 group [Owners](/microsoft-365/admin/create-groups/office-365-groups) +- For a site that isn't group-connected: SharePoint [site admin](/sharepoint/site-permissions#site-admins) > [!NOTE] > Sensitivity labels for containers support [Teams shared channels](/MicrosoftTeams/shared-channels). If a team has any shared channels, they automatically inherit sensitivity label settings from their parent team, and that label can't be removed or replaced with a different label. |
| enterprise | Cross Tenant Sharepoint Migration Step6 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/cross-tenant-sharepoint-migration-step6.md | description: "Step 6 of the SharePoint site Cross-tenant migration feature" This is Step 6 in a solution designed to complete a Cross-tenant SharePoint migration. To learn more, see [Cross-tenant SharePoint migration overview](cross-tenant-SharePoint-migration.md). -- Step 1: [Connect to the source and the target tenants](cross-tenant-SharePoint-migration-step1.md)+- Step 1: [Connect to the source and the tarIPs tenants](cross-tenant-SharePoint-migration-step1.md) - Step 2: [Establish trust between the source and the target tenant](cross-tenant-SharePoint-migration-step2.md) - Step 3: [Verify trust has been established](cross-tenant-SharePoint-migration-step3.md) - Step 4: [Pre-create users and groups](cross-tenant-SharePoint-migration-step4.md) Now you're ready to start your SharePoint migration. Before starting any cross-t 2. To start the migration, a SharePoint Online Admin or Microsoft 365 Global Admin of the source tenant must run the following command: ```PowerShell-Start-SPOCrossTenantGroupContentMove  -SourceGroupAlias <…> -TargetGroupAlias <…> -TargetCrossTenantHostUrl <…> +Start-SPOCrossTenantGroupContentMove  -SourceSiteUrl <…> -TargetSiteUrl <…> -TargetCrossTenantHostUrl| <…> ``` |Parameters|Description| |||-|SourceSiteUrl|Full URL of the SharePoint Site of the on the Source tenant, for example: https://sourcetenant.sharepoint.com/sites/sitename| -|TargetSiteUrl |Full URL of the SharePoint Site of the on the Target tenant, for example: https://targettenant.sharepoint.com/sites/newsitename.| +|SourceSiteUrl|Full URL of the SharePoint Site of the Source tenant, for example: https://sourcetenant.sharepoint.com/sites/sitename | +|TargetSiteUrl |Full URL of the SharePoint Site of the Target tenant, for example: https://targettenant.sharepoint.com/sites/newsitename | |TargetCrossTenantHostUrl|The Cross-tenant host URL of the target tenant. The target tenant Admin can determine the TargetCrossTenantHostUrl by running *Get-SPOCrossTenantHostUrl* on their tenant.| | |
| security | Mdb Asr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-asr.md | ms.localizationpriority: medium - m365-security - tier1-+ search.appverid: MET150 f1.keywords: NOCSH audience: Admin |
| security | Mdb Controlled Folder Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-controlled-folder-access.md | ms.localizationpriority: medium - m365-security - tier1-+ search.appverid: MET150 f1.keywords: NOCSH audience: Admin |
| security | Mdb Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-reports.md | |
| security | Device Control Removable Storage Access Control Faq | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control-faq.md | search.appverid: met150 **Applies to:** - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)+- [Microsoft Defender for Business](/microsoft-365/security/defender-business) + This article provides answers to frequently asked questions about device control removable storage capabilities in Microsoft Defender for Endpoint. The best way to understand this is to check the event on the Advanced hunting wh ## Can I use both Group Policy and Intune deploy policies? You can use Group Policy and Intune to manage device control, but for one machine, use *either* Group Policy *or* Intune. If a machine is covered by both, device control will only apply the Group Policy setting.++## Is device control available in Microsoft Defender for Business? ++Yes, for Windows and Mac. ++To set up device control on Windows, use [attack surface reduction rules in Defender for Business](/microsoft-365/security/defender-business/mdb-asr). You'll need [Microsoft Intune](/mem/intune/fundamentals/what-is-intune). The standalone version of Defender for Business does not include Intune, but it can be added on. [Microsoft 365 Business Premium](/microsoft-365/business-premium) does include Intune. See [Microsoft Defender for Endpoint Device Control Removable Storage Access Control](device-control-removable-storage-access-control.md). ++To set up device control on Mac, use Intune or Jamf. See [Device Control for macOS](mac-device-control-overview.md). |
| security | Device Control Removable Storage Access Control | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control.md | search.appverid: met150 **Applies to:** - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)+- [Microsoft Defender for Business](/microsoft-365/security/defender-business) > [!NOTE] > The Group Policy management and Intune OMA-URI/Custom Policy management of this product are now generally available (4.18.2106): See [Tech Community blog: Protect your removable storage and printer with Microsoft Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/protect-your-removable-storage-and-printers-with-microsoft/ba-p/2324806). |
| security | Device Control Removable Storage Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-control-removable-storage-protection.md | search.appverid: met150 **Applies to:** - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)+- [Microsoft Defender for Business](/microsoft-365/security/defender-business) [!INCLUDE [Prerelease](../includes/prerelease.md)] |
| security | Device Control Report | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-control-report.md | You can use device control events through **Advanced hunting** and **Device cont - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)+- [Microsoft Defender for Business](/microsoft-365/security/defender-business) The [Microsoft 365 Defender portal](https://security.microsoft.com/advanced-hunting) shows events triggered by the Device Control Removable Storage Access Control and Printer Protection. To access the Microsoft 365 Defender portal, you must have the following subscription: The audit events include: Device control in Defender for Endpoint empowers security administrators with tools that enable them to track their organization's device control security through reports. You can find the device control report in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)). Go to **Reports** > **Endpoints**. Find **Device control** card, and select the link to open the report. -The Device protection card on the **Reports** dashboard shows the number of audit events generated by media type, over the last 180 days; the raw events under the **View details** shows events over the last 30 days. +The Device protection card on the **Reports** dashboard shows the number of audit events generated by media type, over the last 180 days; the raw events under the **View details** show events over the last 30 days. The **View details** button shows more media usage data in the **Device control report** page. |
| security | Enable Troubleshooting Mode | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-troubleshooting-mode.md | During troubleshooting mode, you can use the PowerShell command `Set-MPPreferenc :::image type="content" source="../../media/ts-mode-menu.png" alt-text="Turn on troubleshooting mode" lightbox="../../media/ts-mode-menu.png"::: +> [!NOTE] +> The **Turn on troubleshooting mode** option is available on all devices, even if the device does not meet the prerequisites for troubleshooting mode. + 3. Confirm you want to turn on troubleshooting mode for the device. :::image type="content" source="../../media/ts-mode-conf-flyout.png" alt-text="The configuration flyout" lightbox="../../media/ts-mode-conf-flyout.png"::: |
| security | Mac Device Control Faq | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-device-control-faq.md | Last updated 03/31/2023 - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)+- [Microsoft Defender for Business](/microsoft-365/security/defender-business) + This article provides answers to frequently asked questions about Device Control capabilities in Microsoft Defender for Endpoint. This article provides answers to frequently asked questions about Device Control ### How do I know whether the machine is Device Control enabled, and what is the Default Enforcement? -Answer: Run _mdatp device-control policy preferences list_, you will see all the iOS policies on this machine: +Answer: Run _mdatp device-control policy preferences list_ to see all the iOS policies on this machine: :::image type="content" source="images/macos-device-control-faq-enabled-default-enforcement.png" alt-text="Shows how to run mdatp device-control policy preferences list to see if a device is Device Control enabled. " lightbox="images/macos-device-control-faq-enabled-default-enforcement.png"::: ### How do I know whether the policy has been delivered to the client machine? -Answer: Run _mdatp device-control policy rules list_, you will see all the iOS policies on this machine:ΓÇ» +Answer: Run _mdatp device-control policy rules list_ to see all the iOS policies on this machine: :::image type="content" source="images/macos-device-control-faq-policy-is-on-client.png" alt-text="Shows how to run mdatp device-control policy rules list to determine whether a policy has been configured on the endpoint." lightbox="images/macos-device-control-faq-policy-is-on-client.png"::: -Answer 2: Run _mdatp device-control policy groups list_, you will see all the iOS groups on this machine:ΓÇ» +Answer 2: Run _mdatp device-control policy groups list_ to see all the iOS groups on this machine: :::image type="content" source="images/macos-device-control-faq-policy-is-on-client-ios-groups.png" alt-text="Shows how to see all of the iOS groups on the device." lightbox="images/macos-device-control-faq-policy-is-on-client-ios-groups.png"::: |
| security | Mac Device Control Intune | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-device-control-intune.md | Last updated 03/31/2023 - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)+- [Microsoft Defender for Business](/microsoft-365/security/defender-business) + > Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) |
| security | Mac Device Control Jamf | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-device-control-jamf.md | Last updated 03/31/2023 - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)+- [Microsoft Defender for Business](/microsoft-365/security/defender-business) > Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) Microsoft Defender for Endpoint Device Control feature enables you to audit, all Before you get started with Removable Storage Access Control, you must confirm yourΓÇ»[Microsoft 365 subscription](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans?rtc=3). To access and use Removable Storage Access Control, you must have Microsoft 365 E3. + ## Deploy policy by using JAMF ### Step 1: Create policy JSON -Now, you have ΓÇÿgroupsΓÇÖ and ΓÇÿrulesΓÇÖ and ΓÇÿsettingsΓÇÖ, combine ΓÇÿsettingsΓÇÖ and ΓÇÿgroupsΓÇÖ and rules into one JSON, here is the demo file: [mdatp-devicecontrol/deny_removable_media_except_kingston.json at main ┬╖ microsoft/mdatp-devicecontrol (github.com)](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/macOS/policy/examples/deny_removable_media_except_kingston.json). Make sure to validate your policy with the JSON schema to make ensure your policy format is correct: [mdatp-devicecontrol/device_control_policy_schema.json at main ┬╖ microsoft/mdatp-devicecontrol (github.com)](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/macOS/policy/device_control_policy_schema.json). +Now, you have ΓÇÿgroupsΓÇÖ and ΓÇÿrulesΓÇÖ and ΓÇÿsettingsΓÇÖ, combine ΓÇÿsettingsΓÇÖ and ΓÇÿgroupsΓÇÖ and rules into one JSON, here is the demo file: [mdatp-devicecontrol/deny_removable_media_except_kingston.json at main ┬╖ microsoft/mdatp-devicecontrol (github.com)](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/macOS/policy/examples/deny_removable_media_except_kingston.json). Make sure to validate your policy with the JSON schema so your policy format is correct: [mdatp-devicecontrol/device_control_policy_schema.json at main ┬╖ microsoft/mdatp-devicecontrol (github.com)](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/macOS/policy/device_control_policy_schema.json). See [Device Control for macOS](mac-device-control-overview.md) for information about settings, rules and groups. A new ΓÇÿDevice ControlΓÇÖ property will now be available to add to the UX. - [Device Control for macOS](mac-device-control-overview.md) - [Deploy and manage Device Control using Intune](mac-device-control-intune.md)-- [macOS Device Control frequently asked questions (FAQ)](mac-device-control-faq.md)+- [macOS Device Control frequently asked questions (FAQ)](mac-device-control-faq.md) |
| security | Mac Device Control Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-device-control-overview.md | Last updated 04/03/2023 - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)+- [Microsoft Defender for Business](/microsoft-365/security/defender-business) > Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) Device Control for macOS has the following prerequisites: > - Minimum OS version: macOS 11 or higher > - Minimum product version: 101.34.20 -## Overveiw +## Overview -Microsoft Defender for Endpoint Device Control feature enables you to audit, allow, or prevent the read, write, or execute access to removable storage, and allows you to manage iOS and Portable device and Apple APFS encrypted device and Bluetooth media with or without exclusions. +Microsoft Defender for Endpoint Device Control feature enables you to: ++- Audit, allow, or prevent the read, write, or execute access to removable storage; and +- Manage iOS and Portable devices, and Apple APFS encrypted devices and Bluetooth media, with or without exclusions. ## Prepare your endpoints - Microsoft Defender for Endpoint entitlement (can be trial) - Minimum OS version: macOS 11 or higher-- Deploy Full Disk Access: you may already have been previously created and deployed this [https://github.com/microsoft/mdatp-xplat/blob/master/macos/mobileconfig/profiles/fulldisk.mobileconfig](https://github.com/microsoft/mdatp-xplat/blob/master/macos/mobileconfig/profiles/fulldisk.mobileconfig) for other MDE features. You need to grant additional Full Disk Access permission for a new application: com.microsoft.dlp.daemon. +- Deploy Full Disk Access: you may already have been previously created and deployed this [https://github.com/microsoft/mdatp-xplat/blob/master/macos/mobileconfig/profiles/fulldisk.mobileconfig](https://github.com/microsoft/mdatp-xplat/blob/master/macos/mobileconfig/profiles/fulldisk.mobileconfig) for other MDE features. You need to grant Full Disk Access permission for a new application: `com.microsoft.dlp.daemon`. - Enable Device Control on the MDE Preference setting: Data Loss Prevention (DLP)/Features/ Example 2: [demo.mobileconfig](https://github.com/microsoft/mdatp-devicecontrol/ ``` - Minimum product version: 101.91.92 or higher- - Run _mdatp version_ through Terminal, you will see product version on your client machine: +- Run _mdatp version_ through Terminal to see the product version on your client machine: :::image type="content" source="images/macos-device-control-mdatp-version-terminal.png " alt-text="Shows the results when you run mdatp version in Terminal to see the product version on a client machine." lightbox="images/macos-device-control-mdatp-version-terminal.png "::: Here are the properties you can use when you create the group and policy. | Property name | Description | Options | |:|:|:|-| features | Feature specific configurations | You can set ‘disable’ false/true for following features: <br> <ul><li>removableMedia</li><li>appleDevice</li><li>portableDevice, including camera or PTP media</li><li>bluetoothDevice</li></ul> <br> Default is true, so if you do not configure this value, even you create custom policy for removableMedia, system will not apply because it is disabled by default. | -| global | Set default enforcement | You can set **defaultEnforcement**: <br> <ul><li>allow: _default_</li><li>deny</li></ul> | -| ux | You can set hyperlink on notification. | navigationTarget: string, for example, "http://www.microsoft.com". | +| features | Feature specific configurations | You can set `disable` to false or true for following features: <br/>- `removableMedia`<br/>- `appleDevice`<br/>- `portableDevice`, including camera or PTP media<br/>- `bluetoothDevice`<br/><br/>The default is `true`, so if you don't configure this value, it will not apply even if you create a custom policy for `removableMedia`, because it's disabled by default. | +| global | Set default enforcement | You can set `defaultEnforcement` to<br/>- `allow` (_default_)<br/>- `deny` | +| ux | You can set a hyperlink on notification. | `navigationTarget: string`. Example: `"http://www.microsoft.com"` | ### Group | Property name | Description | Options | |:|:|:|-| $type | The kind of group | “device” | -| id | GUID, a unique ID, represents the group and will be used in the policy. | You can generate ID through [New-Guid (Microsoft.PowerShell.Utility) - PowerShell](/powershell/module/microsoft.powershell.utility/new-guid?view=powershell-7.2&preserve-view=true) or the uuidgen command on macOS | -| name | Friendly name for the group. | string | -| query | The media coverage under this group | See the **query** properties tables below for details. | +| `$type` | The kind of group | “device” | +| `id` | GUID, a unique ID, represents the group and will be used in the policy. | You can generate the ID through [New-Guid (Microsoft.PowerShell.Utility) - PowerShell](/powershell/module/microsoft.powershell.utility/new-guid?view=powershell-7.2&preserve-view=true) or the uuidgen command on macOS | +| `name` | Friendly name for the group. | string | +| `query` | The media coverage under this group | See the **query** properties tables below for details. | ### Query Query type 1 is as follows: | Property name | Description | Options | |:|:|:|-| $type | Identify the logical operation to perform on the clauses | **all**: Any attributes under the **clauses** will be an _And_ relationship. For example, if the administrator puts `vendorId` and `serialNumber`, for every connected USB, the system will check to see whether the USB meets both values.<br> **and**: is equivalent to _all_ <br> **any:** The attributes under the **clauses** will be _Or_ relationship. For example, if administrator puts `vendorId` and `serialNumber`, for every connected USB, system will do the enforcement as long as the USB has either an identical `vendorId` or `serialNumber` value. <br> **or**: is equivalent to _any_ | -| clauses | Use media device property to set group condition. | An array of clause objects which are evaluated to determine group membership. See the [Clause](#clause) section below. | +| `$type` | Identify the logical operation to perform on the clauses | **all**: Any attributes under the **clauses** are an _And_ relationship. For example, if the administrator puts `vendorId` and `serialNumber`, for every connected USB, the system checks to see whether the USB meets both values.<br> **and**: is equivalent to _all_ <br> **any:** The attributes under the **clauses** are _Or_ relationship. For example, if administrator puts `vendorId` and `serialNumber`, for every connected USB, system does the enforcement as long as the USB has either an identical `vendorId` or `serialNumber` value. <br> **or**: is equivalent to _any_ | +| `clauses` | Use media device property to set group condition. | An array of clause objects that are evaluated to determine group membership. See the [Clause](#clause) section below. | Query type 2 is as follows: | Property name | Description | Options | |:|:|:|-| $type | Identify the logical operation to perform on the subquery | not: logical negation of a query | -| query | A subquery | **A query which will be negated.** | +| `$type` | Identify the logical operation to perform on the subquery | not: logical negation of a query | +| `query` | A subquery | **A query which will be negated.** | ### Clause Query type 2 is as follows: | Property name | Description | Options | |:|:|:|-| $type | The type of clause | See the following table for supported clauses. | -| value | $type specific value to use | | +| `$type` | The type of clause | See the following table for supported clauses. | +| `value` | $type specific value to use | | #### Supported clauses | clause $type | value | Description | |:|:|:|-| primaryId | One of: <br>- apple_devices <br>-removable_media_devices <br>- portable_devices <br>- bluetooth_devices | | -| vendorId | 4 digit hexadecimal string | Matches a device’s vendor ID | -| productId | 4 digit hexadecimal string | Matches a device’s product ID | -| serialNumber | string | Matches a device’s serial number. Will not match if device does not have a serial number. | -| encryption | apfs | Match if a device is apfs-encrypted. | -| groupId | UUID string | Match if a device is a member of another group. ‘value’ represents the UUID of the group to match against. <br> Note: The group must be defined within the policy prior to the clause. | +| `primaryId` | One of: <br>- `apple_devices`<br>- `removable_media_devices` <br>- `portable_devices` <br>- `bluetooth_devices` | | +| `vendorId` | 4 digit hexadecimal string | Matches a device’s vendor ID | +| `productId` | 4 digit hexadecimal string | Matches a device’s product ID | +| `serialNumber` | string | Matches a device’s serial number. Doesn't match if the device doesn't have a serial number. | +| `encryption` | apfs | Match if a device is apfs-encrypted. | +| `groupId` | UUID string | Match if a device is a member of another group. The value represents the UUID of the group to match against. <br> The group must be defined within the policy prior to the clause. | ### Access policy rule | Property name | Description | Options | |:|:|:|-| id | GUID, a unique ID, represents the rule and will be used in the policy. | New-Guid (Microsoft.PowerShell.Utility) - PowerShell <br> uuidgen | -| name | String, the name of the policy and will display on the toast based on the policy setting. | | -| includeGroups | The group(s) that the policy will be applied to. If multiple groups are specified, the policy will be applied to any media in all those groups. If not specified, the rule will be applied to all devices. | The **id** value inside the group must be used at this instance. If there are multiple groups in the `includeGroups`, it will be _AND_. <br> `"includeGroups": ["3f082cd3-f701-4c21-9a6a-ed115c28e217"]` | -| excludeGroups | The group(s) that the policy will not be applied to. | The **id** value inside the group must be used at this instance. If there are multiple groups in the excludeGroups, it will be _OR_. | -| entries | One rule can have multiple entries; each entry with a unique GUID tells Device Control one restriction.| See entry properties table below to get details. | +| `id` | GUID, a unique ID, represents the rule and will be used in the policy. | New-Guid (Microsoft.PowerShell.Utility) - PowerShell <br> uuidgen | +| `name` | String, the name of the policy and will display on the toast based on the policy setting. | | +| `includeGroups` | The group(s) that the policy will be applied to. If multiple groups are specified, the policy applies to any media in all those groups. If not specified, the rule applies to all devices. | The **id** value inside the group must be used in this instance. If multiple groups are in the `includeGroups`, it's _AND_. <br/> `"includeGroups": ["3f082cd3-f701-4c21-9a6a-ed115c28e217"]` | +| `excludeGroups` | The group(s) that the policy doesn't apply to. | The **id** value inside the group must be used in this instance. If multiple groups are in the excludeGroups, it's _OR_. | +| `entries` | One rule can have multiple entries; each entry with a unique GUID tells Device Control one restriction.| See entry properties table later in this article to get the details. | -The following table lists the properties you can use in entry: +The following table lists the properties you can use in your entry: | Property name | Description | Options | |:|:|:|-| $type | | Includes: <br> <ul><li>removableMedia</li><li>appleDevice</li><li>PortableDevice</li><li>bluetoothDevice</li><li>generic</li></ul> | -| enforcement | | <ul><li>$type:</li><ul><li>allow</li><li>deny</li><li>auditAllow</li><li>auditDeny</li></ul></ul><br> **When $type allow is selected, options value supports:** <br> <ul><li>`disable_audit_allow`: Even if **Allow** happens and the **auditAllow** is setting configured, the system won't send event.</li></ul> <br> **When $type deny is selected, options value supports:** <br> <ul><li>`disable_audit_deny`: Even if **Block** happens and the **auditDeny** is setting configured, the system won't show notification or send event.</li></ul><br> **When $type auditAllow is selected, options value supports:** <br> <ul><li>send_event</li></ul> <br> **When $type auditDeny is selected, options value supports: <br> <ul><li>send_event</li><li>show_notification</li></ul> | -| access| |Specify one or more access rights for this rule. These may include either device specific granular permissions, or broader generic permissions. See table below for more details on the valid access types for a given entry $type. | -| id| UUID| | +| `$type` | | Includes: <br/>- `removableMedia`<br/>- `appleDevice`<br/>- `PortableDevice`<br/>- `bluetoothDevice`<br/>- `generic` | +| enforcement | | - `$type`:<br/>- `allow`<br/>- `deny`<br/>- `auditAllow`<br/>- `auditDeny`<br/><br/>**When $type allow is selected, options value supports:** <br/>- `disable_audit_allow`<br/> Even if **Allow** happens and the **auditAllow** is setting configured, the system won't send event.<br/><br/>**When $type deny is selected, options value supports:** <br/>`disable_audit_deny`<br/>Even if **Block** happens and the **auditDeny** is setting configured, the system won't show notification or send event.<br/><br/>**When $type auditAllow is selected, options value supports:** <br/>`send_event`<br/><br/>**When $type auditDeny is selected, options value supports:** <br/>`send_event`<br/>`show_notification` | +| `access`| |Specify one or more access rights for this rule. These may include either device specific granular permissions, or broader generic permissions. See table below for more details on the valid access types for a given entry $type. | +| `id`| UUID| | The following table lists the properties you can use in entry: The following table lists the properties you can use in entry: | Property name | Description | Options | |:|:|:|-| $type | The type of enforcement | See table below for supported enforcements | -| options | $type specific value to use | An array of options for the entry. May be omitted if not options are desired. | +| `$type` | The type of enforcement | See table below for supported enforcements | +| `options` | $type specific value to use | An array of options for the entry. May be omitted if not options are desired. | #### Enforcement type | Property name | Description | Options | |:|:|:|-|Enforcement $type | ‘options’ values [string] | Description | -| allow | disable_audit_allow | Even if **Allow** happens and the **auditAllow** is setting configured, the system won't send event. | -| deny | disable_audit_deny | Even if **Block** happens and the auditDeny is setting configured, the system won't show notification or send event. | -| auditAllow | send_event | Send telemetry | -| auditDeny | <ol><li>send_event</li><li>show_notification/li></ol> | <ol><li>Send telemetry</li><li>Display Block UX to user/li></ol> | +|`Enforcement $type` | `options` values [string] | Description | +| `allow` | `disable_audit_allow` | Even if **Allow** happens and the **auditAllow** is setting configured, the system won't send event. | +| `deny` | `disable_audit_deny` | Even if **Block** happens and the auditDeny is setting configured, the system won't show notification or send event. | +| `auditAllow` | `send_event` | Send telemetry | +| `auditDeny` | - `send_event`<br/>- `show_notification` | - Send telemetry<br/>- Display Block UX to user | ### Access types The following table lists the properties you can use in entry: | generic | generic_write | | Equivalent to setting all access values denoted in this table that map to generic_write. | | generic | generic_execute | | Equivalent to setting all access values denoted in this table that map to generic_execute. | -## Enduser experience +## End-user experience -Once Deny happens and the notification is enabled in the policy, the end user will see a dialog: +Once Deny happens and the notification is enabled in the policy, the end user sees a dialog: :::image type="content" source="images/macos-device-control-enduser-experience-dialog.png" alt-text="Shows a Device Control Dialog that indicates the USB device is restricted" lightbox="images/macos-device-control-enduser-experience-dialog.png"::: ## Reporting -You will be able to see the policy event on Advanced hunting and Device Control report. For more details, see [Protect your organization's data with Device Control](device-control-report.md). +You'll be able to see the policy event on Advanced hunting and Device Control report. For more information, see [Protect your organization's data with Device Control](device-control-report.md). ## Scenarios Here are some common scenarios to help you familiarize with Microsoft Defender f ### Scenario 1: Deny any removable media but allow specific USBs -In this scenario, you need to create two groups: one group for any removable medias, and another group for approved USBs group. You also need to create an access policy rule. +In this scenario, you need to create two groups: one group for any removable media, and another group for approved USBs group. You also need to create an access policy rule. #### Step 1: Settings: enable Device Control and set Default Enforcement Create access policy rule and put into ‘rules’: ] ``` -In this case, only have one access rule policy, but if you have multiple, make sure add all into ‘rules’. +In this case, only have one access rule policy, but if you have multiple, make sure to add all into ‘rules’. ## See also - [Deploy Device Control by using Intune](mac-device-control-intune.md) - [Deploy Device Control by using JAMF](mac-device-control-jamf.md)-- [MacOS Device Control frequently asked questions (FAQ)](mac-device-control-faq.md)+- [macOS Device Control frequently asked questions (FAQ)](mac-device-control-faq.md) |
| security | Tamper Resiliency | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tamper-resiliency.md | + + Title: Tamper resiliency with Microsoft Defender for Endpoint +description: Learn about the anti-tampering capabilities of Microsoft Defender for Endpoint. ++++++ Last updated : 06/01/2023+++- tier1 +- highpri +f1.keywords: NOCSH +audience: ITPro +++# Protect your organization from the effects of tampering ++Tampering is the general term used to describe attackers attempts to impair the effectiveness of Microsoft Defender for Endpoint. The ultimate goal of attackers isn't to affect just one device, but rather to achieve their objective such as launching a ransomware attack. As such, the anti-tampering capabilities of Microsoft Defender for Endpoint extend beyond preventing tampering of a single device to detecting attacks and minimizing their impact. ++**Applies to:** ++- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) +- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) +- [Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-defender) +- [Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-overview) ++## Organization wide tamper resiliency is built on Zero Trust ++The foundation for defending against tampering is following a [Zero Trust](/windows/security/zero-trust-windows-device-health) model. ++- Follow the best practice of least privilege. See [Access control overview for Windows](/windows/security/identity-protection/access-control/access-control). +- Configure [Conditional Access policies](/azure/active-directory/conditional-access/overview) to keep untrusted users and devices isolated. ++In order to provide an effective defense against tampering, devices must be healthy. ++- [Onboard devices to Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboard-configure). +- Make sure [security intelligence and antivirus updates](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates) are installed. +- Managed devices centrally, such as by [Microsoft Intune](/mem/intune/protect/advanced-threat-protection-configure), [Microsoft Defender for Endpoint Security Configuration Management](/mem/intune/protect/mde-security-integration), or [Configuration Manager](/mem/configmgr/protect/deploy-use/endpoint-protection-configure). ++> [!NOTE] +> On Windows devices, Microsoft Defender Antivirus can be managed by using Group Policy, Windows Management Instrumentation (WMI), and PowerShell cmdlets. However, those methods are more susceptible to tampering than by using Microsoft Intune, Configuration Manager, or Microsoft Defender for Endpoint Security Configuration Management. +> If you're using Group Policy, we recommend [disabling local overrides for Microsoft Defender Antivirus settings](/microsoft-365/security/defender-endpoint/configure-local-policy-overrides-microsoft-defender-antivirus#configure-local-overrides-for-microsoft-defender-antivirus-settings) and [disabling local list merging](/microsoft-365/security/defender-endpoint/configure-local-policy-overrides-microsoft-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged). ++You can view health status for [Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/device-health-microsoft-defender-antivirus-health) health and [sensors](/microsoft-365/security/defender-endpoint/device-health-sensor-health-os) in the [device health reports in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/device-health-reports). ++## Preventing tampering on a single device ++Attackers use various tampering techniques to disable Microsoft Defender for Endpoint on a single device. These techniques are prevented differently on different operating systems. ++| Control | OS | Technique Families | +| || | +| [Tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection) | Windows | - Terminating/suspending processes<br/>- Stopping/pausing/suspending services<br/>- Modifying registry settings including exclusions<br/>- Manipulating/hijacking DLLs<br/>- Manipulation/modification of the file system<br/>- Agent integrity | +| [Tamper protection](/microsoft-365/security/defender-endpoint/tamperprotection-macos) | Mac | - Terminating/suspending processes<br/>- Manipulation/modification of the file system<br/>- Agent integrity| +| [Attack surface reduction (ASR) rules](attack-surface-reduction.md) | Windows | Kernel drivers (see [Block abuse of exploited vulnerable signed drivers](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference#block-abuse-of-exploited-vulnerable-signed-drivers))| +| [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide) (WDAC) | Windows | Kernel drivers (see [Microsoft vulnerable driver blocklist](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules))| +++## Understanding the different ways to prevent driver based tampering on Windows ++One of the most common tampering techniques is to use a vulnerable driver to gain access to the kernel. This driver is often wrapped in an easy to deploy tool, but the underlying technique is the same. ++In order to prevent a driver based tampering on a single device, the device needs to be configured to block the loading of that driver before the attack. ++Microsoft provides several ways to keep devices well protected and up-to-date against driver based tampering. ++### Broadest protection - Microsoft vulnerable driver blocklist ++The blocklist is updated with each new major release of Windows, typically 1-2 times per year. Microsoft will occasionally publish future updates through regular Windows servicing. With Windows 11 2022 update, the vulnerable driver blocklist is enabled by default for all devices, but requires either memory integrity (also known as hypervisor-protected code integrity or HVCI), Smart App Control, or S mode to be active. ++See [Microsoft vulnerable driver blocklist](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist). ++For devices that don't meet those requirements, this list of drivers can be blocked by using Windows Defender Application Control policy.  ++See [Vulnerable Driver blocklist XML](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist). +++### Faster updates - Block exploited vulnerable and signed drivers ASR rule ++This list of drivers blocked by the exploited and vulnerable drivers get updated more frequently than the recommended drivers blocklist. ASR rules can run in audit mode first to ensure that there's no impact before applying the rule in block mode. ++See([Block abuse of exploited vulnerable signed drivers rule](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference#block-abuse-of-exploited-vulnerable-signed-drivers)). ++### Block other drivers - Windows Defender Application Control (WDAC) ++Attackers might attempt to use drivers that aren't blocked by either the recommended driver blocklist or an ASR rule. In this case, customers can protect themselves by using [WDAC to create a policy to block](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide) ++WDAC also provides an audit mode to help understand the impact of applying the policy in block mode to avoid accidentally impacting legitimate use. ++## Preventing tampering via Microsoft Defender Antivirus exclusions on Windows ++A common technique used by attackers is to make unauthorized changes to anti-virus exclusions. Tamper protection prevents such attacks from occurring when all of the following conditions are met: ++- The device is managed by Intune; and +- The device has [Disable Local Admin Merge enabled](/microsoft-365/security/defender-endpoint/configure-local-policy-overrides-microsoft-defender-antivirus#use-microsoft-intune-to-disable-local-list-merging). ++For more information, see [Tamper protection for antivirus exclusions](/microsoft-365/security/defender-endpoint/manage-tamper-protection-intune#tamper-protection-for-antivirus-exclusions). ++Attackers can be preventing from discovering existing antivirus exclusions by enabling [HideExclusionsFromLocalAdmin](/windows/client-management/mdm/defender-csp#configurationhideexclusionsfromlocaladmins). ++## Detecting potential tampering activity in the Microsoft 365 Defender portal ++When tampering is detected, an alert is raised. Some of the alert titles for tampering are: ++- Possible Antimalware Scan Interface (AMSI) tampering +- Potential attempt to tamper with MDE via drivers +- Tamper protection bypass +- Tampering with the Microsoft Defender for Endpoint sensor +- Possible tampering with protected processes ++If the [Block abuse of exploited vulnerable signed drivers](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference#block-abuse-of-exploited-vulnerable-signed-drivers) attack surface reduction (ASR) rule is triggered, the event is viewable in the [ASR Report](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-report) and in [Advanced Hunting](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-operationalize#asr-rules-advanced-hunting) ++If [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide) (WDAC) is enabled, the [block and audit activity can be seen in Advanced Hunting](/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting). ++++ |
| security | Additional Information Xdr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/additional-information-xdr.md | + + Title: Additional information and important considerations related to Defender Experts for XDR ++description: Additional information and important considerations related to Defender Experts for XDR +keywords: XDR, Xtended detection and response, defender experts for xdr, Microsoft Defender Experts for XDR, managed threat hunting, managed detection and response (MDR) service, service delivery manager, real-time visibility with XDR experts, Additional information related to XDR +search.product: Windows 10 +++ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++ - m365-security + - tier1 ++search.appverid: met150 Last updated : 05/29/2023+++# Additional information ++**Applies to:** ++- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ++## Important considerations for you ++To realize the benefits of Microsoft Defender Experts for XDR, you and your security operations center (SOC) team must take note of the following considerations to ensure timely incident remediation, improve your organizationΓÇÖs security posture, and protect your organization from threats. ++- **Engage actively through the readiness assessment process** ΓÇô The [readiness assessment](get-started-xdr.md#run-initial-defender-experts-readiness-checks) when onboarding for Defender Experts for XDR is an integral part of the offering. Completing it successfully ensures prompt service coverage and protects your organization against known threats. +- **Act on guided responses in a timely manner** ΓÇô For any suspicious incidents and alerts, our experts provide a detailed investigation summary and guided responses for remediation. We expect your SOC team to act on these guided responses in a timely manner to prevent further impact from any malicious attempts. +- **Configure recommended settings and follow best practices to improve security posture** ΓÇô As part of our service, your service delivery manager and security analyst team share ongoing recommendations to strengthen your security posture. These recommendations are based on incidents investigated in your organization. Your SOC team should review these recommendations and implement them as soon as possible to protect your organization against future threats. ++## Note about incident response ++Defender Experts for XDR isn't an incident response (IR) service. While it augments your SOC team to triage, investigate, and remediate threats, Defender Experts for XDR won't be able to provide recovery and crisis management services **if a major security incident has already occurred** in your organization. You should engage instead with your own security IR provider to address urgent incident response issues. ++If you don't have your own security IR team, [Microsoft Incident Response](https://www.microsoft.com/en-us/security/business/microsoft-incident-response +) can help mitigate a breach and recover your operations. If you're an existing unified or premier support customer, create a support request in the [Microsoft Services Hub](https://serviceshub.microsoft.com/home) to engage with them. Otherwise, fill out the [Experiencing a Cybersecurity Incident?](https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbRypQlJUvhTFIvfpiAfrpFQdUOTdRRFpDUFQ1TzNLVFZXV0VUOVlVN0szUiQlQCN0PWcu) form. We'll review the details and quickly call you with instructions to get started. ++### See also ++[Frequently asked questions](frequently-asked-questions.md) |
| security | Auditing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/auditing.md | + + Title: How to search the audit logs for actions performed by Defender Experts ++description: As a tenant administrator, you can use Microsoft Purview to search the audit logs for the actions Microsoft Defender Experts did in your tenant to perform their investigations +keywords: XDR, Xtended detection and response, defender experts for xdr, Microsoft Defender Experts for XDR, managed threat hunting, managed detection and response (MDR) service, service delivery manager, real-time visibility with XDR experts, threat hunting and analysis +search.product: Windows 10 +++ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++ - m365-security + - tier1 ++search.appverid: met150 Last updated : 05/29/2023+++# Auditing ++**Applies to:** ++- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ++As a tenant administrator, you can use Microsoft Purview to search the audit logs for the times Microsoft Defender Experts signed into your tenant and the actions they did there to perform their investigations. You can also search the audit logs for the changes done by your tenant administrators to the Defender Experts settings. ++[Audit (Standard)](/microsoft-365/compliance/audit-solutions-overview) is turned on by default for all Microsoft Defender Experts for XDR customers when paid licenses are assigned to the tenant. If you have a trial license, work with your service delivery manager to turn on Audit if it isnΓÇÖt yet. ++> [!NOTE] +> Make sure you have the right [permissions](/microsoft-365/compliance/audit-log-search#before-you-search-the-audit-log) to search for audit logs. ++## Search the audit logs for actions performed by Defender Experts ++1. Sign into the [Microsoft Purview compliance portal](https://compliance.microsoft.com/) to use [Audit New Search](/microsoft-365/compliance/audit-new-search). +2. Provide a **Date and time range (UTC)**. +3. Select the **Workload** and **Record type** from the list shown in the following table to further narrow your search +4. Select **Search** to list the audit logs related to actions taken by our experts in your tenant. ++ +++| Action performed by Defender Experts | Workload | Record type | +|--|--|--| +| Sign into customer tenant | AzureActiveDirectory | AzureActiveDirectoryStsLogon | +| Make changes to incidents in Microsoft 365 Defender portal | Microsoft365Defender | MS365Dincident | +|Make changes to alert suppression rules in Microsoft 365 Defender portal|Microsoft365Defender|MS365DSuppressionRule| +|Make changes to indicators in Microsoft Defender for Endpoint|MicrosoftDefenderForEndpoint|MSDEIndicatorsSettings| +|Perform device remediation actions in Microsoft Defender for Endpoint|MicrosoftDefenderForEndpoint|MSDEResponseActions| ++ ++## Search the audit logs for actions performed by your administrators in the Defender Experts settings ++1. Sign into the [Microsoft Purview compliance portal](https://compliance.microsoft.com/) to use [Audit New Search](/microsoft-365/compliance/audit-new-search). +2. Provide a **Date and time range (UTC)**. +3. Under **Workload**, choose _MicrosoftDefenderExperts_. +4. Select **Search** to list the audit logs related to actions taken by your tenant administrators to the Defender Experts settings. ++ ++## Search the audit logs using a PowerShell script ++In addition to using Audit New Search in the Microsoft Purview compliance portal, you can use PowerShell cmdlets to search for audit logs. [Learn more](/microsoft-365/compliance/audit-log-search-script) ++### See also ++[Additional information](additional-information-xdr.md) |
| security | Before You Begin Xdr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/before-you-begin-xdr.md | + + Title: Before you begin using Defender Experts for XDR ++description: To enable us to get started with this managed service, we require the following licensing prerequisites +keywords: XDR, Xtended detection and response, defender experts for xdr, Microsoft Defender Experts for XDR, managed threat hunting, managed detection and response (MDR) service, service delivery manager, Microsoft Defender Experts for hunting, threat hunting and analysis, Microsoft XDR service +search.product: Windows 10 +++ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++ - m365-security + - tier1 ++search.appverid: met150 Last updated : 11/17/2022+++# Before you begin ++**Applies to:** ++- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ++This document outlines the key prerequisites you must meet and essential information you must know before purchasing the Microsoft Defender Experts for XDR service. ++## Eligibility and licensing ++Defender Experts for XDR is a separate service from your existing Defender products. To enable us to get started with this managed service, we require the following licensing prerequisites: +- Microsoft Defender for Endpoint P2 must be licensed and enabled on eligible devices +- Microsoft Defender Antivirus must be licensed and enabled in active mode on devices onboarded to Defender for Endpoint (required for endpoint detection and response capabilities) +- Azure Active Directory (Azure AD) Premium P1 must be licensed for all users and enabled (required for enabling secure service provider access) ++Aside from the requirements stated previously, to get Defender Experts for XDR coverage for the following eligible products, you must have their appropriate product licenses: +- Microsoft Defender for Office 365 P2 +- Microsoft Defender for Identity +- Microsoft Defender for Cloud Apps ++Defender Experts for XDR is a managed extended detection and response (XDR) service. To get native XDR coverage, we recommend deploying the full Microsoft 365 Defender suite. ++As part of the service's built-in [Microsoft Defender Experts for Hunting](defender-experts-for-hunting.md), you're also assigned two **Ask Defender Experts** credits on the first of each month, which you may use to submit questions. You can still submit inquiries beyond the initial number of allocated credits. Unused credits expire 90 days from date of assignment or at the end of the subscription term, whichever is shortest. ++[Learn more about Microsoft's commercial licensing terms](https://www.microsoft.com/licensing/terms/productoffering/Microsoft365/MCA) +++## Access requirements ++Anyone from your organization can complete the [customer interest form](https://aka.ms/IWantDefenderExperts) for the Defender Experts for XDR service, however, you need to work with your Commercial Executive to transact the Defender Experts for XDR SKU. ++Defender Experts for XDR requests for certain roles and permissions for you to fully access the service capabilities. [Learn more](dex-xdr-permissions.md) ++## Service availability and data protection ++Defender Experts for XDR is a managed extended detection and response service that proactively hunts for threats across endpoints, email, identity, and cloud apps. To carry out hunting on your behalf, Microsoft experts need access to your Microsoft 365 Defender advanced hunting data. Purchasing this service means youΓÇÖre granting permission to Microsoft experts to access the said data. ++The following sections enumerate additional information about the serviceΓÇÖs data usage, compliance, and availability. For more information about Microsoft's commitment in valuing and protecting your data, visit the [Trust Center](https://www.microsoft.com/en-us/trust-center/product-overview) then scroll down to **Additional products and services** > **Managed Security Services** > **[Microsoft Defender Experts](https://aka.ms/trustcenter-defenderexperts)** ++### Data collection, usage, and retention ++All data used for hunting from existing Defender services will continue to reside in the customer's original Microsoft 365 Defender service storage location. [Learn more](/microsoft-365/enterprise/o365-data-locations) ++Defender Experts for XDR operational data, such as case tickets and analyst notes, are generated and stored in a Microsoft data center in the US region for the length of the service, irrespective of the Microsoft 365 Defender service storage location. Data generated for the reporting dashboard is stored in customer's Microsoft 365 Defender service storage location. Reporting data and operational data will be retained for a grace period of no less than 90 days after a customer leaves the service. ++Microsoft experts hunt over [advanced hunting logs](advanced-hunting-schema-tables.md) in Microsoft 365 Defender advanced hunting tables. The data in these tables depend on the set of Defender services the customer is enabled for (for example, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Azure AD). Experts also use a large set of internal threat intelligence data to inform their hunting and automation. ++### Security and compliance ++When you purchase and onboard to Defender Experts for XDR, you're granting permission to Microsoft experts to access your advanced hunting data. ++This service has been developed in alignment with existing security and privacy standards and is working towards several certifications, including ISO 27001 and ISO 27018. ++### Availability +This service is available worldwide for our customers in our commercial public clouds. If you're interested to learn more, reach out to your Microsoft account team. ++### Language +This service is currently delivered in English language only. ++### Next step ++[Get started with Microsoft Defender Experts for XDR](get-started-xdr.md) |
| security | Dex Xdr Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/dex-xdr-overview.md | -# Expanded Microsoft Defender Experts for XDR preview -+# Microsoft Defender Experts for XDR **Applies to:** - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) +> [!IMPORTANT] +> Microsoft Defender Experts for XDR is sold separately from other Microsoft 365 Defender products. If you're a Microsoft 365 Defender customer and are interested in purchasing Defender Experts for XDR, complete a [customer interest form](https://aka.ms/IWantDefenderExperts). -The **Microsoft Defender Experts for XDR** (Defender Experts for XDR) preview is a managed detection and response service that helps your security operations centers (SOCs) focus and accurately respond to incidents that matter. It provides extended detection and response for customers who use Microsoft 365 Defender workloads: Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, and Azure Active Directory (Azure AD). +Microsoft Defender Experts for XDR is a managed extended detection and response service that helps your security operations centers (SOCs) focus and accurately respond to incidents that matter. It provides extended detection and response for customers who use Microsoft 365 Defender Defender Experts for XDR augments your SOC by combining automation and Microsoft's security analyst expertise, helping you detect and respond to threats with confidence and improve your security posture. With deep product expertise powered by threat intelligence, we're uniquely positioned to help you: Defender Experts for XDR augments your SOC by combining automation and Microsoft - **Access expertise when you need it** - Extend your team's capacity with access to Defender Experts for assistance on an investigation - **Stay ahead of emerging threats** - Our experts proactively hunt for emerging threats in your environment, informed by unparalleled threat intelligence and visibility -In addition to the constantly updated research and intelligence tailored for the threats currently seen across the various Microsoft 365 Defender signals, as part of the preview, you'll receive guided response from our security analysts and support from Microsoft's security-focused service delivery managers (SDMs). In this preview, you can try the service for free and enjoy the following capabilities: +In addition to the constantly updated research and intelligence tailored for the threats currently seen across the various Microsoft 365 Defender signals, you'll receive guided response from our security analysts and support from Microsoft's security-focused service delivery managers (SDMs). This service lets you enjoy the following capabilities: - **Managed detection and response** - Expert analysts manage your Microsoft 365 Defender incident queue and handle triage and investigation on your behalf; they partner with you and your team to take action or guide you to respond to incidents - **Proactive threat hunting** - [Microsoft Defender Experts for Hunting](../defender/defender-experts-for-hunting.md) is built in to extend your team's threat hunting capabilities and prioritize significant threats - **Live dashboards and reports** - Transparent view of our operations on your behalf and noise free, actionable view into what matters for you coupled with detailed analytics - **Proactive check-ins for continuous security improvements** - Periodic check-ins with your named service delivery team to guide your Defender Experts for XDR experience and improve your security posture -## Prerequisites --> [!NOTE] -> The prerequisites specified in this section are currently applicable for preview. --To enable us to get started with this managed service, we require the following prerequisites: --- Defender for Endpoint P2 must be licensed for devices and users in scope for the preview and Microsoft Defender Antivirus must be enabled in active mode on devices onboarded to Defender for Endpoint (required for endpoint detection and response capabilities)-- Azure AD Premium P1 must be licensed for all users and enabled (required for enabling secure service provider access)--Aside from the requirements stated above, to get Defender Experts for XDR coverage for the following eligible products, you must have their appropriate product licenses: --- Defender for Office 365 P2-- Defender for Identity-- Defender for Cloud Apps--This service is available worldwide for our customers in our commercial public clouds. We're gradually expanding the preview to more customers. If you're interested to learn more, reach out to your Microsoft account team. --## Go to the next step +### Next step -[Get started](get-started-xdr.md) +[Before you begin](before-you-begin-xdr.md) |
| security | Dex Xdr Permissions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/dex-xdr-permissions.md | + + Title: How Microsoft Defender Experts for XDR permissions work ++description: Configuring permissions in customer's XDR tenants +keywords: XDR, Xtended detection and response, defender experts for xdr, configuring permissions in xdr, Microsoft Defender Experts for XDR, managed threat hunting, managed detection and response (MDR) service, service delivery manager, real-time visibility with XDR experts +search.product: Windows 10 +++ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++ - m365-security + - tier1 ++search.appverid: met150 Last updated : 05/29/2023+++# How Microsoft Defender Experts for XDR permissions work ++**Applies to:** ++- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ++For Microsoft Defender Experts for XDR incident investigations, when our experts need access to your tenants, we follow the just-in-time and least privilege principles to provide the right level of access at the right time. To deliver on these requirements, we built the Microsoft Defender Experts permissions platform using the following capabilities in Microsoft Azure Active Directory (Azure AD): ++- **Granular delegated admin privileges (GDAP)**: As part of onboarding, we provision the Microsoft Experts tenant as a service provider on your tenant to use the GDAP capability and get the right access level to our experts. The roles granted to our experts are configured using [cross-tenant role assignment](/azure/active-directory/external-identities/cross-tenant-access-overview) to ensure that they only have permissions that you have explicitly granted to them. +- **Azure AD cross-tenant access policies**: To enforce restrictions on our expertsΓÇÖ access to your tenant, we need to establish a cross-tenant trust between our experts and your tenant. To enable this trust, we configure a cross-tenant access policy in your tenant as part of onboarding. These cross-tenant access policies are created with read-only permissions to avoid any disruption. +- **Conditional access for external users**: We restrict our expertsΓÇÖ access to your tenants from our secure environment by using compliant devices with strong multifactor authentication (MFA). To enforce the trust settings configured in cross-tenant access policy and block access otherwise, we configure these conditional access policies in your tenant. +- **Just-in-time (JIT) access**: Even after you have permitted our experts access to your environment, we limit their access based on JIT permissions for case investigation, with limited duration for each role. Our experts must first request access and get approval in our internal system to gain the appropriate role in your tenant. Our expertsΓÇÖ access to your tenant is audited as part of Azure AD sign-in logs for you to review ++## Configuring permissions in customer tenants ++Once you select the permissions youΓÇÖd like to grant to our experts, we create the following policies in your tenant using the Security Administrator or Global Administrator context: ++- **Configure Microsoft Experts as a service provider** ΓÇô This setting lets our experts access the tenant environment as external collaborators without requiring you to create accounts for them. +- **Configure role assignments for our experts** ΓÇô This setting controls the roles our experts are allowed in the tenant. You select the appropriate roles during the onboarding process +- **Configure cross-tenant access settings with MFA and compliant device as the trust settings** ΓÇô This setting configures a trust relationship between customer and Microsoft Experts tenants based on MFA and device compliance in the Microsoft Experts tenant. This policy can be found under **Azure Active Directory** > **External Identities** > **Cross-tenant access Settings** with the name _Microsoft Experts_. +- **Configure conditional access policies** ΓÇô These policies restrict our experts to only access your tenant from the Microsoft Experts secure workstations with MFA verification. Two policies are configured with the naming convention _Microsoft Security Experts-\<policy name\>-DO NOT DELETE_. ++These policies are configured during the onboarding process and require the relevant administrator to stay signed in to complete the steps. Once the above policies are created and the permissions setup is considered complete, you'll see a notification that the setup is complete. ++### See also ++[Additional information](additional-information-xdr.md) |
| security | Frequently Asked Questions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/frequently-asked-questions.md | Title: FAQs related to Microsoft Defender Experts for XDR preview + Title: FAQs related to Microsoft Defender Experts for XDR description: Frequently asked questions related to Defender Experts for XDR keywords: XDR, Xtended detection and response, defender experts for xdr, Microsoft Defender Experts for XDR, managed threat hunting, managed detection and response (MDR) service, service delivery manager, real-time visibility with XDR experts, FAQ's related to XDR Last updated 11/17/2022 - Microsoft 365 Defender - | Questions | Answers | |||-| **How is Microsoft Defender Experts for XDR different from Microsoft Defender Experts for Hunting?** | [Microsoft Defender Experts for Hunting](../defender/defender-experts-for-hunting.md) provides threat hunting service to proactively find threats. This service is meant for customers that have a robust security operations center and want that deep expertise in hunting to expose advanced threats. Microsoft Defender Experts for XDR provides end-to-end security operations capabilities to monitor, investigate, and respond to security alerts. This service is meant for customers with constrained security operations centers (SOCs) that are overburdened with alert volume, in need of skilled experts, or both. Defender Experts for XDR also includes the proactive threat hunting offered by Defender Experts for Hunting| -| **What products does Defender Experts for XDR operate on?** | Refer to the [Prerequisites](/microsoft-365/security/defender/dex-xdr-overview#prerequisites) section for details. | -| **Is there a minimum criteria or size requirements to get Defender Experts for XDR?** | Not in preview. We'll evaluate and provide these requirements as part of our general availability. | -| **Does Defender Experts for XDR replace my SOC team?** | No. Defender Experts for XDR is meant to augment your SOC team reducing their workload and collaborating with them to protect your organization from threat actors. But we don't replace your SOC team or their processes. | -| **What actions can your experts take during incident investigation?** | Our expert analysts can take actions based on the roles granted to them in your Microsoft 365 Defender portal. If our analysts are granted a security reader role, they can investigate and provide guided response for your SOC team to act on. If our analysts are granted a security operator role, they can also take specific remediation actions agreed upon with your SOC team. Finally, if they're granted a security administrator role, they can take higher privilege actions like managing certain settings as agreed upon with you. | -| **Can your experts help me improve my security posture?** | Yes, our experts will provide necessary guidance before and during the preview to improve your security posture. | -| **Can Defender Experts for XDR help with an active compromise or vulnerability?** | No, Defender Experts currently don't provide incident response services. Contact your Microsoft representative to engage Microsoft Detection and Response Team (DART) for incident response assistance. | -| **How can my organization participate in the Defender Experts for XDR preview?** |We're gradually expanding the preview to more customers. Contact your Microsoft representative to access the preview.| -| **When will Defender Experts for XDR be generally available?** | We'll announce general availability dates closer to the launch date. | +| **How is Microsoft Defender Experts for XDR different from Microsoft Defender Experts for Hunting?** | [Microsoft Defender Experts for Hunting](../defender/defender-experts-for-hunting.md) provides proactive threat hunting service to proactively find threats. This service is meant for customers that have a robust security operations center and want that deep expertise in hunting to expose advanced threats. Microsoft Defender Experts for XDR provides end-to-end security operations capabilities to monitor, investigate, and respond to security alerts. This service is meant for customers with constrained security operations centers (SOCs) that are overburdened with alert volume, in need of skilled experts, or both. Defender Experts for XDR also includes the proactive threat hunting offered by Defender Experts for Hunting| +| **Does Defender Experts for XDR require Microsoft Sentinel?** | No. Defender Experts can use Microsoft 365 Defender data in customersΓÇÖ original locations for each Microsoft 365 Defender product deployed. | +| **What products does Defender Experts for XDR operate on?** | Refer to the [Before you begin](before-you-begin-xdr.md) for details. | +| **Does Defender Experts for XDR replace my SOC team?** | Defender Experts for XDR currently provide coverage for Microsoft 365 Defender incidents. It's the ideal way to augment your SOC team, reduce their workload, and collaborate with them to protect your organization from activity groups. | +| **What actions can your experts take during incident investigation?** | Our expert analysts can take actions based on the roles granted to them in your Microsoft 365 Defender portal. If our analysts are granted a security reader role, they can investigate and provide guided response for your SOC team to act on. If our analysts are granted a security operator role, they can also take specific remediation actions agreed upon with your SOC team. | +| **What types of incidents can your experts investigate?** | Defender Experts for XDR covers incidents categorized as High or Medium severity in Windows, Linux, and macOS devices. Incidents categorized as Compliance, Data Loss Prevention (DLP), or Custom Detections and those affecting internet of things (IoT), iOS, or Android devices are outside the serviceΓÇÖs scope. | +| **Can your experts help me improve my security posture?** | Yes, our experts provide necessary guidance regularly to improve your security posture. +| **Can Defender Experts for XDR help with an active compromise or vulnerability?** | No, Defender Experts currently don't provide incident response services. Contact your Microsoft representative or fill out the [Experiencing a Cybersecurity Incident?](https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbRypQlJUvhTFIvfpiAfrpFQdUOTdRRFpDUFQ1TzNLVFZXV0VUOVlVN0szUiQlQCN0PWcu) form to engage Microsoft Incident Response for incident response assistance. | +| **How can my organization participate in the Defender Experts for XDR service?** | Contact your Microsoft representative to express interest in Defender Experts for XDR.| ++### See also ++[How Microsoft Defender Experts for XDR permissions work](dex-xdr-permissions.md) |
| security | Get Started Xdr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/get-started-xdr.md | Title: Get started with Microsoft Defender Experts for XDR + Title: Getting started with Microsoft Defender Experts for XDR -description: Once the Defender Experts for XDR team are ready to onboard you, we'll reach out to get you started. +description: Defender Experts for XDR lets you determine the individuals or groups within your organization that need to be notified if there's a critical incident keywords: XDR, Xtended detection and response, defender experts for xdr, Microsoft Defender Experts for XDR, managed threat hunting, managed detection and response (MDR) service, service delivery manager, Microsoft Defender Experts for hunting, threat hunting and analysis, Microsoft XDR service search.product: Windows 10 -Once the Defender Experts for XDR team is ready to onboard you, we'll reach out to get you started. +Once the Defender Experts for XDR team is ready to onboard your organization, youΓÇÖll receive a welcome email to continue the setup and get you started. -## Activate your trial license +Select the link in the welcome email to directly launch the Defender Experts settings step-by-step guide in the Microsoft 365 Defender portal. You can also open this guide by going to **Settings** > **Defender Experts** and selecting **Get started**. -1. Select the link in the welcome email to go directly to the Defender Experts settings page in the Microsoft 365 Defender portal. You can also open this page by going to **Settings** > **Defender Experts**. -2. Read the Defender Experts for XDR preview terms and conditions then select **Accept** to accept them. -3. Get your free license in Microsoft 365 admin center. In the checkout page, select **Place order**. + ## Grant permissions to our experts -By default, Defender Experts for XDR requires the following permissions to investigate incidents and notify you when you need to take action: +By default, Defender Experts for XDR requires **Service provider access** that lets our experts sign into your tenant and deliver services based on assigned security roles. [Learn more about cross-tenant access](/azure/active-directory/external-identities/cross-tenant-access-overview) ++You also need to grant our experts temporary, scoped access only as needed, depending on the type of work youΓÇÖd like them to handle on your behalf: -- **Service provider access** - This permission lets our experts sign in to your tenant and deliver services based on assigned security roles. For details, [learn more about cross-tenant access](/azure/active-directory/external-identities/cross-tenant-access-overview).-- **Security reader** - This built-in Azure Active Directory (Azure AD) role lets our experts investigate incidents and provide guidance on necessary response actions.+- **Investigate incidents and guide my responses** (default) ΓÇô This option lets our experts proactively monitor and investigate incidents and guide you through any necessary response actions. (Access level: Security Reader) +- **Respond directly to active threats** (recommended) ΓÇô This option lets our experts contain and remediate active threats immediately while investigating, thus reducing the threatΓÇÖs impact, and improving your overall response efficiency. (Access level: Security Operator) -You can also provide our experts the following permissions to investigate incidents on your behalf: +[Learn more about access levels](/azure/active-directory/roles/permissions-reference) -- **Security operator** (recommended) - In addition to the permissions provided to a security reader, this built-in Azure AD role lets our experts take necessary actions to remediate active threats.-- **Security administrator** (optimal) - In addition to the permissions provided to a security operator, this built-in Azure AD role lets our experts configure security settings and deploy preventive measures.+ -[Learn more about Azure AD roles and permissions](/azure/active-directory/roles/permissions-reference) +**To grant our experts permissions:** -Follow these steps to grant our experts additional permissions: +1. In the same Defender Experts settings step-by-step guide, under **Permissions**, choose the access level(s) you want to grant our experts. +2. Select **Next** to [add contact persons or teams](#tell-us-who-to-contact-for-important-matters). ++> [!IMPORTANT] +> If you skip providing additional permissions, our experts won't be able to take certain response actions to secure your organization. -1. In the same Defender Experts settings page mentioned earlier, select **Manage permissions**. -2. Under **Additional permissions**, select the other role(s) you want to grant. -3. Select **Give access**. +To edit or update permissions after the initial setup, go to **Settings** > **Defender Experts** > **Permissions**. In this page, you could also turn **Access security data from all devices** on or off under the access levels. > [!IMPORTANT]-> If you skip providing additional permissions, our experts won't be able to take certain response actions to secure your network. +> If you turn off **Access security data from all devices**, our experts wonΓÇÖt be able to investigate incidents involving devices that belong to Microsoft Defender for Endpoint device groups. [Learn more about device groups](../defender-endpoint/machine-groups.md) ++## Tell us who to contact for important matters ++Defender Experts for XDR lets you determine the individuals or groups within your organization that need to be notified if there are critical incidents, service updates, occasional queries, and other recommendations. Once identified, the individuals will receive an email notifying them that they have been chosen as a contact for incident notification or service review purposes. ++ ++**To add notification contacts:** ++1. In the same Defender Experts settings step-by-step guide, under **Incident contact**, search for and add your contact persons or teams that we can notify for guided response actions or any communication that requires a prompt response. ++> [!NOTE] +> Given the urgent nature of the communications, it is recommended to have someone available at all times. ++2. Select **Next**. Under **Service review contact**, search for and add your contact persons or teams that we can engage with for ongoing security briefings done by our service delivery team. +3. Select **Next**. The settings guide then provides you with information about the **Next steps**, including working with our experts to [optimize your security posture](#run-initial-defender-experts-readiness-checks). +4. Select **Close** to exit the settings step-by-step guide. ++To edit or update your notification contacts after the initial setup, go to **Settings** > **Defender Experts** > **Notification contacts**: ++1. Search for your **Contact person or team** in the text field provided. +2. Select the **Notification type** from the dropdown box. +3. Select **Add**. ++ ++## Run initial Defender Experts readiness checks ++Apart from onboarding service delivery, our expertise on the Microsoft 365 Defender product suite enables Defender Experts for XDR to run an initial readiness assessment to help you get the most out of your Microsoft security products. ++The initial readiness engagement is based on your [Microsoft Secure Score](../defender/microsoft-secure-score.md) and Defender Experts' policy recommendations. Our experts help prioritize and customize our recommendations to fit your environment. They request your engagement to get those configurations implemented. ++Once youΓÇÖve completed the readiness checks, our experts will start monitoring your environment closely to identify latent threats, sources of risk, and normal activity. As we get better understanding of your critical assets, we can streamline the service and fine-tune our responses. ++### Next step -## Go to the next step +[Start using Microsoft Defender Experts for XDR service](start-using-mdex-xdr.md) -[Start using Microsoft Defender Experts for XDR preview service](start-using-mdex-xdr.md) +### See also +- [Frequently asked questions](frequently-asked-questions.md) +- [How Microsoft Defender Experts for XDR permissions work](dex-xdr-permissions.md) |
| security | Start Using Mdex Xdr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/start-using-mdex-xdr.md | Title: How to use the Microsoft Defender Experts for XDR preview service + Title: How to use the Microsoft Defender Experts for XDR service -description: Defender Experts for XDR will help prioritizing and customizing recommendations to fit your environment +description: Defender Experts for XDR helps prioritize and customize recommendations to fit your environment keywords: XDR, Xtended detection and response, defender experts for xdr, Microsoft Defender Experts for XDR, managed threat hunting, managed detection and response (MDR) service, service delivery manager, real-time visibility with XDR experts, threat hunting and analysis search.product: Windows 10 -# Start using Defender Experts for XDR preview service -+# Start using Defender Experts for XDR service **Applies to:** - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) --## Run initial Defender readiness checks +After you completed the [onboarding steps and readiness checks](get-started-xdr.md) for Microsoft Defender Experts for XDR, our experts will start monitoring your environment to streamline the service so we can perform comprehensive service on your behalf. During this stage, our experts identify latent threats, sources of risk, and normal activity. -Apart from onboarding service delivery, our expertise on the Microsoft 365 Defender product suite enables Defender Experts for XDR to run an initial readiness engagement to help you get the most out of your Microsoft security products. This engagement will be based on your [Microsoft Secure Score](microsoft-secure-score.md) and Defender Experts' policy recommendations. Our experts will help prioritizing and customizing our recommendations to fit your environment. They'll request your engagement to get those configurations implemented. +Once our experts begin to perform comprehensive response work on your behalf, youΓÇÖll start receiving notifications about incidents that require remediation steps and targeted recommendations on critical incidents. You can also chat with our experts or your service delivery managers (SDMs) regarding important queries and regular business and security posture reviews and view real-time reports on the number of incidents weΓÇÖve investigated and resolved on your behalf. ## Managed detection and response -Through a combination of automation and human expertise, our service triages Microsoft 365 Defender incidents, prioritizes them on your behalf, filters out the noise, carries out detailed investigations, and provides detailed guided response to your security operations center (SOC) teams. Alternatively, our analysts can take a response step on your behalf. +Through a combination of automation and human expertise, Defender Experts for XDR triages Microsoft 365 Defender incidents, prioritizes them on your behalf, filters out the noise, carries out detailed investigations, and provides actionable guided response to your security operations center (SOC) teams. ++### Incident notifications ++Once our experts start investigating an incident, the incident's **Assigned to** and **Status** fields are updated to _Defender Experts_ and _In progress_, respectively. ++When our experts conclude their investigation on an incident, the incidentΓÇÖs **Classification** field is updated to one of the following, depending on the expertsΓÇÖ findings: ++- True Positive +- False Positive +- Informational, Expected Activity ++The **Determination** field corresponding to each classification is also updated to provide more insights on the findings that led our experts to determine the said classification. ++ ++If an incident is classified as _False Positive_ or _Informational_, _Expected Activity_, then the incident's **Status** field gets updated to _Resolved_. Our experts then conclude their work on this incident and the **Assigned to** field gets updated to _Unassigned_. Our experts may share updates from their investigation and their conclusion when resolving an incident. These updates are posted in the incidentΓÇÖs **Comments and history** flyout panel. ++> [!NOTE] +> Incident comments are one-way posts. Defender Experts canΓÇÖt respond to any comments or questions you add in the **Comments and history** panel. If you wish to correspond with our experts, reply to the email Defender Experts sent you instead. ++Otherwise, if an incident is classified as _True Positive_, our experts then identify recommended response actions that need to be performed. The method in which the actions are performed depends on the permissions and access levels you have given the Defender Experts for XDR service. [Learn more about granting permissions to our experts](get-started-xdr.md#grant-permissions-to-our-experts) ++- If you have granted Defender Experts for XDR the recommended Security Operator access permissions, our experts could perform the recommended response actions on the incident on your behalf. These actions, along with an **Investigation summary**, show up in the incidentΓÇÖs [Guided response](#how-to-use-guided-response-in-microsoft-365-defender) flyout panel in your Microsoft 365 Defender portal for you or your SOC team to review. Once our experts conclude their work on the incident, its **Status** field is then updated to _Resolved_ and the **Assigned to** field is updated to _Unassigned_. ++- If you have granted Defender Experts for XDR the default Security Reader access, then the recommended response actions, along with an **Investigation summary**, show up in the incidentΓÇÖs **Guided response** flyout panel in your Microsoft 365 Defender portal for you or your SOC team to perform. To identify this handover, the incidentΓÇÖs **Assigned to** field is updated to _Customer_. ++You can check the number of incidents that are awaiting your action in the Defender Experts card in your Microsoft 365 Defender portal: ++ -You'll receive detailed response playbooks via emails. You'll also be able to filter the Microsoft 365 Defender portal incident view using the _Defender Experts_ tag to see the current state of the incidents Defender Experts are actively investigating, or the incidents that require your action. Our analysts will also add relevant comments in Microsoft 365 Defender portal's **Comments & history** section so you and your SOC analysts can track the investigation progress. +To view the incidents our experts have investigated or are currently investigating, filter the incident queue in your Microsoft 365 Defender portal using the _Defender Experts_ tag. ++ ++### How to use guided response in Microsoft 365 Defender ++In the Microsoft 365 Defender portal, an incident that requires your attention using guided response has the **Assigned to** field set to _Customer_ and a task card on top of the **Incidents** pane. Your designated incident contacts also receives a corresponding email notification with a link to the Defender portal to view the incident. [Learn more about notification contacts](get-started-xdr.md#tell-us-who-to-contact-for-important-matters) ++Select **View guided response** on the task card or on the top of the portal page (**Guided response** tab) to open a flyout panel where you can read our expertsΓÇÖ investigation summary, complete pending actions identified by our experts, or engage with them through chat. ++ ++#### Investigation summary ++The **Investigation summary** section provides you with more context about the incident analyzed by our experts to provide you with visibility about its severity and potential impact if not addressed immediately. It could include the device timeline, indicators of attack and indicators of compromise (IOCs) observed, and other details. ++ ++#### Actions ++The **Actions** tab displays task cards that contain response actions recommended by our experts. ++ ++Defender Experts for XDR currently supports the following one-click guided response actions: ++|**Action**|**Description**| +||--| +|[Isolate device](/microsoft-365/security/defender-endpoint/respond-machine-alerts##isolate-devices-from-the-network)|Isolates a device, which helps prevent an attacker from controlling it and performing further activities such as data exfiltration and lateral movement. The isolated device will still be connected to Microsoft Defender for Endpoint.| +|[Quarantine file](/microsoft-365/security/defender-endpoint/respond-file-alerts##stop-and-quarantine-files)|Stops running processes, quarantines the files, and deletes persistent data such as registry keys.| ++Apart from these one-click actions, you can also receive guided responses from our experts that you need to perform manually. ++> [!NOTE] +> Before performing any of the recommended guided response actions, make sure that they are not already being addressed by your automated investigation and response configurations. [Learn more about automated investigation and response capabilities in Microsoft 365 Defender](m365d-autoir.md) -Response recommendations include, but aren't limited to: +**To view and perform the guided response actions:** -- Collect investigation package-- Run antivirus scan-- Trigger and prioritize action in an automatic investigation-- Stop and quarantine file-- Delete email-- Block designated OAuth cloud apps+1. Select the arrow buttons in a task card to expand it and read more information about the recommendation or collapse it. +1. For cards with one-click response actions, select the recommended action. The **Action status** in the card changes to **In progress**, then to **Failed** or **Completed**, depending on the actionΓÇÖs outcome. -These recommendations also appear in the **Comments & history** section of each related incident in the Microsoft 365 Defender portal so you can view them at your convenience. +> [!TIP] +> You can also monitor the status of in-portal response actions in the [Action center](m365d-action-center.md). ++3. For cards with recommended actions that you need to perform manually, select **Mark as complete** once youΓÇÖve performed them. +1. If you donΓÇÖt want to complete a recommended action right away, select the ellipsis icon on the top of the card and choose any of the following other options: + - **Mark in progress** + - **Mark as skipped** + - **Mark as new** ++#### Chat ++The **Chat** tab provides you with a space in the Microsoft 365 Defender portal to engage with our experts and further understand the incident, our investigation, and the recommended actions we provided. You could ask about a malicious executable, malicious attachment, information about activity groups, advanced hunting queries, or any other information that would assist you with the incident resolution. ++ ++> [!NOTE] +> The chat option is only available for incidents where we issued guided response. ++## Get visibility to Defender Experts investigations in your SIEM or ITSM application ++As Defender Experts for XDR investigate incidents and come up with remediation actions, you can have visibility to their work on incidents in your security information and event management (SIEM) and IT service management (ITSM) applications, including applications that are available out of the box. ++### Microsoft Sentinel ++You can get incident visibility in Microsoft Sentinel by turning on its out-of-the-box Microsoft 365 Defender data connector. [Learn more](/azure/sentinel/connect-microsoft-365-defender). ++Once you have turned on the connector, updates by Defender Experts to the **Status**, **Assigned to**, **Classification**, and **Determination** fields in Microsoft 365 Defender will show up in the corresponding **Status**, **Owner**, and **Reason for closing** fields in Sentinel. ++> [!NOTE] +> The status of incidents in Microsoft 365 Defender typically transitions from _Active_ to _In progress_ to _Resolved_, while in Sentinel, it follows the _New_ to _Active_ to _Resolved_ path. ++The following section describes how an incident handled by our experts is updated in Sentinel as it progresses through the investigation journey: ++1. An incident being investigated by our experts has the **Owner** listed as _Defender Experts_. +1. An incident that our experts have confirmed as a _True Positive_ has a guided response posted in Microsoft 365 Defender, and the **Owner** is listed as _Customer_. You need to act on the incident based on using the provided guided response. +1. Once our experts have concluded their investigation and closed an incident as _False Positive_ or _Informational_, _Expected Activity_, the incidentΓÇÖs **Status** is updated to _Resolved_ and a **Reason for closing** is provided. ++ ++### Other applications ++You could obtain visibility into incidents in your SIEM or ITSM application by using the [Microsoft 365 Defender API](../defender/api-overview.md) or [connectors in Sentinel](/azure/sentinel/data-connectors-reference). ++After configuring a connector, the updates by Defender Experts to an incidentΓÇÖs **Status**, **Assigned to**, **Classification**, and **Determination** fields in Microsoft 365 Defender can be synchronized with the third-party SIEM or ITSM applications, depending on how the field mapping has been implemented. To illustrate, you can take a look at the [connector available from Sentinel to ServiceNow](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Servicenow/StoreApp). ## Get real-time visibility with Defender Experts for XDR reports -Defender Experts for XDR will include an interactive, on-demand report that provides a clear summary of the work our expert analysts are doing on your behalf, aggregate information about your incident landscape, and granular details about specific incidents. Your service delivery manager (SDM) will also use the report to provide you with more context regarding your XDR Experts service during a monthly business review. +Defender Experts for XDR includes an interactive, on-demand report that provides a clear summary of the work our expert analysts are doing on your behalf, aggregate information about your incident landscape, and granular details about specific incidents. Your service delivery manager (SDM) also uses the report to provide you with more context regarding the service during a monthly business review. ++ ++Each section of the report is designed to provide more insights about the incidents our experts investigated and resolved in your environment in real time. You can also select the **Date range** to get detailed information about incidents based on severity, category, and understand the time taken to investigate and resolve an incident during a specific period. ++### Understand the Defender Experts for XDR report ++The topmost section of the Defender Experts for XDR report provides the percentage of incidents we resolved in your environment, providing you with transparency in our operations. This percentage is derived from the following figures, which are also presented in the report: ++- **Investigated** ΓÇô The number of active threats and other incidents from your incident queue that we triaged, investigated, or currently investigating within our scope. +- **Resolved** ΓÇô The total number of investigated incidents that were closed. +- **Resolved directly** ΓÇô The number of investigated incidents that we were able to close directly on your behalf. +- **Resolved with your help** ΓÇô The number of investigated incidents that were resolved because of your action on one or more guided response tasks. ++The **Incidents by severity** and **Incidents by category** sections break down resolved incidents by severity and attack technique or threat type, respectively. These sections let you identify potential attack entry points and types of threats detected in your environment, assess their impact, and develop strategies to mitigate and prevent them. Select **View incidents** to get a filtered view of the incident queue based on the selections you made in each of the two sections. ++The **Average incident resolution time** section displays a bar chart of the average time, in minutes, our experts spent investigating and closing incidents in your environment and the average time you spent performing the recommended guided response actions. ++If youΓÇÖve set Defender Experts for XDR to have **Security Reader** access, the **Average incident resolution time** section also displays the estimated **Potential time savings** you could realize if you let our experts take managed remediation actions on your behalf by [providing them the permissions](get-started-xdr.md#grant-permissions-to-our-experts) to do so. The potential time savings are derived by calculating the total time it took you to complete recommended guided response actions after our experts issued them to you during your selected date range. Otherwise, if the service has **Security Operator** access, this report section displays the estimated time you already saved by granting us permission to take managed remediation actions on your behalf. To change access levels, select **Edit permissions**. ## Collaborate with a trusted advisor The service delivery manager (SDM) is responsible for managing the overall relat The SDM provides the following - Service readiness support- - Educate customers about the end-to-end service experience, from signup to regular operations and escalation process. - Help establish a service-ready security posture, including guidance on required controls and policy updates.- - Service operations support- - Provide unique service delivery content and reporting, including periodic business reviews. + - Provide tailored service delivery content and reporting, including periodic business reviews. - Serve as a single point of contact for feedback and escalations related to Defender Experts Service. ## Proactive managed hunting Select **Ask Defender Experts** directly inside the Microsoft 365 security porta - Gather additional information on alerts and incidents, including root causes and scope - Gain clarity into suspicious devices, alerts, or incidents and get the next steps if faced with an advanced attacker-- Determine risks and available protections related to threat actors, campaigns, or emerging attacker techniques+- Determine risks and available protections related to activity groups, campaigns, or emerging attacker techniques > [!NOTE] > Ask Defender Experts is not a security incident response service. It's intended to provide a better understanding of complex threats affecting your organization. Engage with your own security incident response team to address urgent security incident response issues. If you don't have your own security incident response team and would like Microsoft's help, create a support request in the [Premier Services Hub](/services-hub/). The option to **Ask Defender Experts** is available in the incidents and alerts  -## Opt out of preview --Consult your service delivery manager (SDM) to opt out of the preview. --## See also +### See also -[Read through frequently asked questions and answers](frequently-asked-questions.md) +- [Search audit logs for actions performed by Defender Experts](auditing.md) +- [Additional information](additional-information-xdr.md) +- [Frequently asked questions](frequently-asked-questions.md) |
| security | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/whats-new.md | For more information on what's new with other Microsoft Defender security produc You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter). +## June 2023 ++- (GA) Microsoft Defender Experts for XDR is now generally available. Defender Experts for XDR augments your security operations center by combining automation and Microsoft's security analyst expertise, helping you detect and respond to threats with confidence and improve your security posture. Microsoft Defender Experts for XDR is sold separately from other Microsoft 365 Defender products. If you're a Microsoft 365 Defender customer and are interested in purchasing Defender Experts for XDR, see [Overview of Microsoft Defender Experts for XDR](dex-xdr-overview.md). + ## May 2023 - (GA) [Alert tuning](investigate-alerts.md#tune-an-alert) is now generally available. Alert tuning lets you fine-tune alerts to reduce investigation time and focus on resolving high priority alerts. Alert tuning replaces the Alert suppression feature.-- (GA) [Automatic attack disruption](automatic-attack-disruption.md) is now generally available.+- (GA) [Automatic attack disruption](automatic-attack-disruption.md) is now generally available. This capability automatically disrupts human-operated ransomware (HumOR), business email compromise (BEC), and adversary-in-the-middle (AiTM) attacks. - (Preview) [Custom functions](advanced-hunting-custom-functions.md) are now available in advanced hunting. You can now create your own custom functions so you can reuse any query logic when you hunt in your environment. ## April 2023 This change introduces a new navigation menu within the Microsoft 365 Defender p ## February 2023 - (GA) The [query resources report in advanced hunting](advanced-hunting-limits.md#view-query-resources-report-to-find-inefficient-queries) is now generally available.+- (Preview) The [automatic attack disruption](automatic-attack-disruption.md) capability now disrupts business email compromise (BEC). ## January 2023 This change introduces a new navigation menu within the Microsoft 365 Defender p - (Preview) Microsoft Defender Experts for XDR (Defender Experts for XDR) is now available for preview. Defender Experts for XDR is a managed detection and response service that helps your security operations centers (SOCs) focus and accurately respond to incidents that matter. It provides extended detection and response for customers who use Microsoft 365 Defender workloads: Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, and Azure Active Directory (Azure AD). For details, refer to [Expanded Microsoft Defender Experts for XDR preview](dex-xdr-overview.md). - (Preview) The query resource report is now available in advanced hunting. The report shows your organization's consumption of CPU resources for hunting based on queries that ran in the last 30 days using any of the hunting interfaces. See [View query resources report](advanced-hunting-limits.md#view-query-resources-report-to-find-inefficient-queries) to find inefficient queries. +## October 2022 ++- (Preview) The new automatic attack disruption capability is now in preview. This capability combines security research insights and advances AI models to automatically contain attacks in progress. Automatic attack disruption also provides more time to security operations centers (SOCs) to fully remediate an attack and limits an attack's impact to organizations. This preview automatically disrupts ransomware attacks. + ## August 2022 - (GA) [Microsoft Defender Experts for Hunting](defender-experts-for-hunting.md) is now generally available. If you're a Microsoft 365 Defender customer with a robust security operations center but want Microsoft to help you proactively hunt for threats across endpoints, Office 365, cloud applications, and identity using Microsoft Defender data, then learn more about applying, setting up, and using the service. Defender Experts for Hunting is sold separately from other Microsoft 365 Defender products. |
| security | Try Microsoft Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/try-microsoft-defender-for-office-365.md | Watch this short video to learn more about how you can get more done in less tim > [!VIDEO https://www.microsoft.com/videoplayer/embed/RWMmIe] +For pricing information, see [Microsoft Defender for Office 365](https://www.microsoft.com/security/business/siem-and-xdr/microsoft-defender-office-365). + ## How trials and evaluations work for Defender for Office 365 ### Policies |
| syntex | Syntex Licensing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-licensing.md | description: Learn about licensing for Microsoft Syntex. Microsoft Syntex has two types of product offerings to choose from: -- SharePoint Syntex per-user licensing-- Microsoft Syntex pay-as-you-go+- [Microsoft Syntex pay-as-you-go](#microsoft-syntex-pay-as-you-go) +- [SharePoint Syntex per-user licensing](#microsoft-syntex-per-user-licensing) The features available for each license type are described below. <!-- You can use both licenses if you need to.--> Pay-as-you-go is a way to pay for Microsoft Syntex using an Azure subscription. - Prebuilt document processing - Unstructured document processing (formerly document understanding)+- Optical character recognition All users in your organization will be able to create and apply unstructured and prebuilt document processing models and can upload documents to a primed library. This is charged on a pay-per-use basis. -## SharePoint Syntex per-user licensing +## Microsoft Syntex per-user licensing -To use Microsoft Syntex, you must have a license for each Syntex user. If you remove all Syntex per-user licenses from your tenant at a future date (or your trial expires), users will no longer be able to create, publish, or run custom models. Additionally, term store reports, SKOS taxonomy import, and content type push will no longer be available. No models, content, or metadata will be deleted, and site permissions won't be changed. +To use Syntex, you must have a license for each Syntex user. If you remove all Syntex per-user licenses from your tenant at a future date (or your trial expires), users will no longer be able to create, publish, or run custom models. Additionally, term store reports, SKOS taxonomy import, and content type push will no longer be available. No models, content, or metadata will be deleted, and site permissions won't be changed. #### Tasks requiring a per-user license |
| syntex | Syntex Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-overview.md | This feature is useful when you have a specific piece of information you want to [Learn more about using annotations in Microsoft Syntex.](annotations.md) +## Optical character recognition ++ :::column span=""::: +  + :::column-end::: + :::column span="3"::: + The optical character recognition (OCR) service in Syntex lets you extract printed or handwritten text from images. Syntex automatically scans the image files, extracts the relevant text, and makes the text from the images available for search and indexing. This lets you quickly and accurately find the keywords and phrases you're looking for. + :::column-end::: ++[Learn more about using the OCR service in Microsoft Syntex.](ocr.md) + ## Content compliance :::row::: |