| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Assign Admin Roles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/assign-admin-roles.md | f1.keywords: Previously updated : 02/18/2020 Last updated : 06/27/2023 audience: Admin -Check out [Microsoft 365 small business help](https://go.microsoft.com/fwlink/?linkid=2197659) on YouTube. +A Microsoft 365 subscription comes with a set of admin roles that you can assign to users in your organization using the Microsoft 365 admin center. Each admin role maps to common business functions and gives people in your organization permissions to do specific tasks in the admin centers. For more information, see [About admin roles](about-admin-roles.md). -If you're the person who purchased your Microsoft business subscription, you are the global admin. This means you have unlimited control over the products in your subscriptions and you can access most data. --For more information, see [About admin roles](about-admin-roles.md). +> [!IMPORTANT] +> If you're the person who purchased your Microsoft business subscription, you are the global admin. This means you have unlimited control over the products in your subscriptions and you can access most data. When you add new users, if you don't assign them an admin role then they are in the *user role* and don't have admin privileges to any of the Microsoft admin centers. But if you need help getting things done, you can assign an admin role to a user. For example, if you need someone to help reset passwords, you shouldn't assign them the global admin role, you should assign them the password admin role. Having too many global admins, with unlimited access to your data and online business, is a security risk. +You can assign users to a role in two different ways: ++- You can go to the user's details and **Manage roles** to assign a role to the user. +- Or you can go to **Roles** and select the role, and then add multiple users to it. + ## Watch: Add an admin Check out this video and others on our [YouTube channel](https://go.microsoft.com/fwlink/?linkid=2198030). > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE1FOfO] +If you found this video helpful, check out the [complete training series for small businesses and those new to Microsoft 365](https://go.microsoft.com/fwlink/?linkid=2197659) on YouTube. ++## Steps: Add an admin + 1. When you sign up for Microsoft 365 Business, you automatically become a global admin. To help manage the business, you can make other people admins as well. 1. In the Microsoft 365 admin center, select **Users** > <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">**Active users**</a>. 1. Choose the user you want to make an admin, and then select **Manage roles**.+1. Select the admin access you want the user to have and select **Save changes**. -If you found this video helpful, check out the [complete training series for small businesses and those new to Microsoft 365](../../business-video/index.yml). --## Assign admin roles +### Assign admin roles to users using Roles -You can assign users to a role in two different ways: +1. In the admin center, go to <a href="https://go.microsoft.com/fwlink/p/?linkid=2097861" target="_blank"> **Roles** -> **Role assignments**</a>. Choose the **Azure AD**, **Exchange**, **Intune** or **Billing** tab to view the admin roles available for your organization. -- You can go to the user's details and **Manage roles** to assign a role to the user.-- Or you can go to **Roles** and select the role, and then add multiple users to it.--### Assign admin roles to users using Roles + > [!NOTE] + > You might not see all the tabs depending on your Microsoft 365 subscription. -1. In the admin center, go to <a href="https://go.microsoft.com/fwlink/p/?linkid=2097861" target="_blank">**Role assignments**</a>. Choose the **Azure AD** or **Intune** tabs to view the admin roles available for your organization. -2. Select the admin role that you want to assign the user to. -3. Select **Assigned admins** > **Add**. -4. Type the user's **display name** or **username**, and then select the user from the list of suggestions. -5. Add multiple users until you're done. -6. Select **Save**, and then the user will be added to the list of assigned admins. +1. Select the admin role that you want to assign the user to. +1. On the Assigned tab, select **Add users** or **Add groups**. +1. Type the user's **display name** or **username**, and then select the user from the list of suggestions. +1. Add multiple users until you're done. +1. Select **Add**, and the user or users will be added to the list of assigned admins. ### Assign a user to an admin role from Active users You can check admin role permissions in 2 different ways: [About Microsoft 365 admin roles](about-admin-roles.md) (article)\ [Azure AD built-in roles](/azure/active-directory/roles/permissions-reference) (article)\ [Assign roles to user accounts with PowerShell](../../enterprise/assign-roles-to-user-accounts-with-microsoft-365-powershell.md) (article)\-[Authorize or remove partner relationships](../misc/add-partner.md) (article) +[Add, change, or remove partner relationships](../misc/add-partner.md) (article) |
| admin | Adoption Score | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/adoption/adoption-score.md | description: "Learn how Microsoft Adoption Score reflects people and technology Adoption Score supports the journey to digital transformation with insights about how your organization uses Microsoft 365 and the technology experiences that support it. Your organization's score reflects people and technology experience measurements and can be compared to benchmarks from organizations similar in size to yours. +## Watch: Adoption Score overview + > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE53oqt?autoplay=false] It provides: We provide metrics, insights, and recommendations in two areas: For each of the mentioned categories, we look at public research to identify some best practices and associated benefits in the form of organizational effectiveness. For example, Forrester research has shown that when people collaborate and share content in the cloud (instead of emailing attachments), they can save up to 100 minutes a week. Furthermore, we quantify the use of these best practices in your organization to help you see where you are on your digital transformation journey. + Visit [privacy controls for Adoption Score](privacy.md) to understand more about options to configure people experiences for your organization. + - **Technology experiences:** Your organization depends on reliable and well-performing technology, and the efficient use of Microsoft 365. [Endpoint analytics](https://aka.ms/endpointanalytics) helps you understand how your organization can be impacted by performance and health issues with your hardware and software. [Network connectivity](../../enterprise/microsoft-365-networking-overview.md) helps you understand Exchange, SharePoint, and Microsoft Teams performance on your network architecture. You can review and update network settings to improve connectivity. Microsoft 365 apps health helps you understand whether the devices in your organization are running Microsoft 365 apps on recommended channels. > [!NOTE] > All insights are calculated using data at the organizational level, not the individual level. -## How to enable Adoption Score --To enable Adoption Score: --1. Sign in to the Microsoft 365 admin center as a Global Administrator and go to **Reports** > **Adoption Score** -2. Select **enable Adoption Score**. It can take up to 24 hours for insights to become available. --> [!NOTE] -> Only an IT professional with the Global Administrator role can opt-in for Adoption Score. --Visit [privacy controls for Adoption Score](privacy.md) to understand more about options to configure people experiences for your organization. - ## Adoption Score Prerequisites For people experiences data, you need a Microsoft 365 for business or Office 365 for enterprise subscription. For endpoint analytics data for your tenant, you need to add Microsoft Intune to your subscription. Intune helps protect your organization's data by managing devices and apps. Once you have Intune, you can turn on endpoint analytics within the Intune experience. To learn more about Microsoft Intune, see the [Microsoft Intune documentation](/mem/intune/). |
| admin | Add Another Email Alias For A User | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/email/add-another-email-alias-for-a-user.md | f1.keywords: Previously updated : 02/18/2020 Last updated : 06/20/2023 audience: Admin -description: "Learn how you can have more than one email address, called an email alias, associated with your Microsoft 365 for business account. " +description: "Learn how you can add more than one email address, called an email alias to users in your Microsoft 365 organization." # Add another email alias for a Microsoft 365 business subscription user -This article is for Microsoft 365 administrators who have business subscriptions. It's not for home users. - -A primary email address in Microsoft 365 is usually the email address a user was assigned when their account was created. When the user sends email to someone else, their primary email address is what typically appears in the *From* field in email apps. They can also have more than one email address associated with their Microsoft 365 for business account. These additional addresses are called aliases. - -For example, let's say Jenna has the email address jenna@contosoco.com, but she also wants to receive email at jen@contosoco.com because some people refer to her by that name. You can create aliases for her so that both email addresses go to Jenna's inbox. - -You can create up to 400 aliases for a user. No additional fees or licenses are required. +A primary email address in Microsoft 365 is usually the email address a user was assigned when their account was created. When the user sends email to someone else, their primary email address is what typically appears in the *From* field in email apps. They can also have more than one email address associated with their Microsoft 365 for business account. These additional addresses are called aliases. You can create up to 400 aliases for a user. No additional fees or licenses are required. This article is for Microsoft 365 administrators who have business subscriptions. It's not for home users. ++For example, Jenna at your organization has the email address jenna@contosoco.com, but she also wants to receive email at jen@contosoco.com because some people refer to her by that name. You can create aliases for her so that email sent to both email addresses go to Jenna's inbox. -> [!Tip] -> If you want multiple people to manage email sent to a single email address like info@NodPublishers.com or sales@NodPublishers.com, create a shared mailbox. To learn more, see [Create a shared mailbox](create-a-shared-mailbox.md). +If you want multiple people to manage email sent to a single email address like info@contoso.com or sales@contoso.com, create a shared mailbox. Learn more at [Create a shared mailbox](create-a-shared-mailbox.md). ++> [!NOTE] +> This article is for Microsoft 365 administrators who have business subscriptions. It's not for home users. > [!TIP] > If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use.- -## Add email aliases to a user -You must have Global Admin rights to add email aliases to a user. +## Before you begin ++You must be a member of the Global admin role to add email aliases to a user. For more info, see [About admin roles in the Microsoft 365 admin center](../add-users/about-admin-roles.md). ++## Add email aliases to a user 1. In the admin center, go to the **Users** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=834822" target="_blank">Active users</a> page. -2. On the **Active Users** page, select the user > **Manage username and email**. You won't see this option if the person doesn't have a license assigned to them. - -3. Select **+ Add an alias** and enter a new alias for the user. - - > [!Important] - > If you get the error message "**A parameter cannot be found that matches parameter name 'EmailAddresses**," it means that it's taking a bit longer to finish setting up your tenant, or your custom domain if you recently added one. The setup process can take up to 4 hours to complete. Wait a while so the set up process has time to finish, and then try again. If the problem persists, call Support and they will do a full sync for you. - - - > [!IMPORTANT] - > If you purchased your subscription from GoDaddy or another Partner, to set the new alias as the primary, you must go to the GoDaddy/partner management console. +2. On the **Active Users** page, select the user > **Manage username and email**. You won't see this option if the person doesn't have a license assigned to them. +3. Add the new name in the **Username** field, select a domain and choose **Add**. - > [!IMPORTANT] - > If you get the error message **This user is synchronized with your local Active Directory. Some details can be edited only through your local Active Directory**, It means that the Active Directory is authoritative for attributes on synchronized users, you need to modify the attributes in your on-premises Active Directory. - > [!TIP]- > The email alias must end with a domain from the drop-down list. To add another domain name to the list, see [Add a domain to Microsoft 365](../setup/add-domain.md). - - -5. When you're done, choose **Save changes**. - -6. Wait 24 hours for the new aliases to populate throughout Microsoft 365. - - The user will now have a primary address and an alias. For example, all mail sent to Eliza Hoffman's primary address, Eliza@NodPublishers.com, and her alias, Sales@NodPublishers.com, will go to Eliza's Inbox. - + > The email alias must end with a domain from the drop-down list. To add another domain name to the list, see [Add a domain to Microsoft 365](../setup/add-domain.md). -7. **When the user replies, the *From* address will depend on her Outlook client. Outlook on the web will use the alias at which the email was received (we'll call this the ping-pong principle). Outlook desktop will use her primary email alias.** For example, let's say a message is sent to Sales@NodPublishers.com, and it arrives in Eliza's inbox. When Eliza replies to the message using Outlook desktop, her primary email address will appear as Eliza@NodPublishers.com, not Sales@NodPublishers.com. - -## Did you get "A parameter cannot be found that matches parameter name EmailAddresses"? +4. When you're done, choose **Save changes**. -If you get the error message "**A parameter cannot be found that matches parameter name EmailAddresses**" it means that it's taking a bit longer to finish setting up your tenant, or your custom domain if you recently added one. The setup process can take up to 4 hours to complete. Wait a while so the set up process has time to finish, and then try again. If the problem persists, call Support and they will do a full sync for you. - -## Did you purchase your subscription from GoDaddy or another Partner? +5. Wait 24 hours for the new aliases to update in Microsoft 365. ++6. The user will now have a primary address and an alias. For example, all mail sent to jenna@contoso.com, and her alias, jen@contoso.com, will go to Jenna's inbox. **When the user replies, the *From* address will depend on her Outlook client. Outlook on the web will use the alias at which the email was received. Outlook desktop will use her primary email alias.** ++### Sending email from the proxy address easily ++Your users can now send from their aliases when using Outlook on the web. When the global admin has set the `Set-OrganizationConfig -SendFromAliasEnabled $true` cmdlet, users within the organization will get access to a list of checkboxes where each entry corresponds to an alias in their Outlook settings. Selecting an alias will make it appear in the **From** dropdown in the **Compose** form. ++## Troubleshooting ++### Did you get "A parameter cannot be found that matches parameter name EmailAddresses" message? ++If you get this error message it means that it's taking a bit longer to finish setting up your tenant, or your custom domain if you recently added one. The setup process can take up to 4 hours to complete. Wait a while so the setup process has time to finish, and then try again. If the problem persists, call Support and they will do a full sync for you. +### Did you get "This user is synchronized with your local Active Directory. Some details can be edited only through your local Active Directory" message? -If you purchased your subscription from GoDaddy or another Partner, to set the new alias as the primary, you must go to the GoDaddy/partner management console. +If you get this error message it means that you need to add the alias in your on-premises Active Directory. -## Sending email from the proxy address easily +### Did you purchase your subscription from GoDaddy or another Partner? -A new feature is rolling out in July 2021 that allows users to send from their aliases easily when using Outlook on the web. When the feature rolls out to a tenancy where the tenant admin uses the `Set-OrganizationConfig -SendFromAliasEnabled $true` cmdlet, users within the tenancy will get access to a list of checkboxes where each entry corresponds to an alias in their Outlook settings. Selecting an alias will make it appear in the From dropdown in the Compose form. +If you purchased your subscription from GoDaddy or another Partner, to set the new alias as the primary, you can't set the new alias in the Microsoft 365 admin center. You must go to the GoDaddy/partner management console. ## Related content |
| admin | Configure Email Forwarding | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/email/configure-email-forwarding.md | |
| admin | Set Password Expiration Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/set-password-expiration-policy.md | f1.keywords: Previously updated : 02/18/2020 Last updated : 06/26/2023 audience: Admin description: "Learn how an admin can set a password expiration policy for your b Check out all of our small business content on [Small business help & learning](https://go.microsoft.com/fwlink/?linkid=2224585). -## Before you begin --This article is for people who set password expiration policy for a business, school, or nonprofit. To complete these steps, you need to sign in with your Microsoft 365 admin account. [What's an admin account?](/microsoft-365/admin/add-users/about-admin-roles). +This article is for people who set password expiration policy for a business, school, or nonprofit Microsoft 365 organization. -As an admin, you can make user passwords expire after a certain number of days, or set passwords to never expire. By default, passwords are set to never expire for your organization. +As the admin, you can make user passwords expire after a certain number of days, or set passwords to never expire. **By default, passwords are set to never expire for your organization**. Current research strongly indicates that mandated password changes do more harm than good. They drive users to choose weaker passwords, re-use passwords, or update old passwords in ways that are easily guessed by hackers. We recommend enabling [multi-factor authentication](../security-and-compliance/set-up-multi-factor-authentication.md). To learn more about password policy, check out [Password policy recommendations](../misc/password-policy-recommendations.md). -You must be a [global admin](../add-users/about-admin-roles.md) to perform these steps. +## Before you begin -If you're a user, you don't have the permissions to set your password to never expire. Ask your work or school technical support to do the steps in this article for you. +You must be a [global admin](../add-users/about-admin-roles.md) to perform these steps. > [!TIP] > If you need help with the steps in this topic, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. If you're a user, you don't have the permissions to set your password to never e Follow the steps below if you want to set user passwords to expire after a specific amount of time. -1. In the Microsoft 365 admin center, go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2072756" target="_blank">**Security & privacy** tab</a>. +1. In the Microsoft 365 admin center, go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2072756" target="_blank">**Org Settings** tab</a>. - If you aren't a global admin or security admin, you won't see the Security & privacy option. - -1. Select **Password expiration policy**. + If you aren't a global admin or security admin, you won't see this page. -1. If you wish to require users to change their passwords periodically, make sure that the **Set passwords to never expire** box is not checked. +2. On the **Password expiration policy** page, uncheck the box to change the password policy. ++3. Type how often passwords should expire. Choose a number of days from **14 to 730** and select **Save**. -1. Type how often passwords should expire. Choose a number of days from 14 to 730. - > [!IMPORTANT] > Password expiration notifications are no longer supported in the Microsoft 365 admin center and Microsoft 365 apps. To learn how to synchronize user password hashes from on premises AD to Azure AD You can set more password policies and restrictions in Azure active directory. Check out [Password policies and account restrictions in Azure Active Directory](/azure/active-directory/authentication/concept-sspr-policy) for more info. -## Update password Policy +## Update password Policy using PowerShell The Set-MsolPasswordPolicy cmdlet updates the password policy of a specified domain or tenant and indicates the length of time that a password remains valid before it must be changed. |
| business-premium | Secure Your Business Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/secure-your-business-data.md | Title: Top 10 ways to secure your data with Microsoft 365 for business + Title: Microsoft 365 for business security best practices f1.keywords: - CSH audience: Admin-+ Previously updated : 06/22/2023 Last updated : 06/28/2023 ms.localizationpriority: medium - highpri search.appverid: description: "Learn best practices to protect your data using Micrsoft 365 Business Basic, Standard, or Premium. Protect devices, email, files, and accounts." -# Secure your data with Microsoft 365 for business +# Microsoft 365 for business security best practices When it comes to securing your business data, Microsoft 365 Business Basic, Standard, and Premium all include antiphishing, antispam, and antimalware protection. However, Microsoft 365 Business Premium includes even more security capabilities, such as advanced cybersecurity protection for devices (such as computers, tablets, and phones; also referred to as endpoints), email & collaboration content (such as Office documents), and information protection. For more information about what each plan includes, see [Microsoft 365 User Subscription Suites for Small and Medium-sized Businesses](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWR6bM). |
| compliance | Apply Sensitivity Label Automatically | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/apply-sensitivity-label-automatically.md | There are two different methods for automatically applying a sensitivity label t Specific to auto-labeling for SharePoint and OneDrive: - - Office files for Word (.docx), PowerPoint (.pptx), and Excel (.xlsx) are supported. + - <a name="file-extensions"></a>Office files for Word (.docx), PowerPoint (.pptx), and Excel (.xlsx) are supported. - These files can be auto-labeled at rest before or after the auto-labeling policies are created. Files can't be auto-labeled if they're part of an open session (the file is open). - Currently, attachments to list items aren't supported and won't be auto-labeled. - Maximum of 25,000 automatically labeled files in your tenant per day. Make sure you're aware of the prerequisites before you configure auto-labeling p - To view file or email contents in the source view, you must have the **Data Classification Content Viewer** role, which is included in the **Content Explorer Content Viewer** role group, or **Information Protection** and **Information Protection Investigators** role groups. Without the required role, you don't see the preview pane when you select an item from the **Items to review** tab. Global admins don't have this role by default. - To auto-label files in SharePoint and OneDrive:- - You have [enabled sensitivity labels for Office files in SharePoint and OneDrive](sensitivity-labels-sharepoint-onedrive-files.md). - - At the time the auto-labeling policy runs, the file mustn't be open by another process or user. A file that's checked out for editing falls into this category. -- If you plan to use [sensitive information types](sensitive-information-type-learn-about.md):- - The sensitive information types you select will apply only to content that's created or modified after these information types are [created or modified](audit-log-activities.md#sensitive-information-types-activities). This restriction applies to all custom sensitive information types and any new built-in information types. - - To test new custom sensitive information types, create them before you create your auto-labeling policy, and then create new documents with sample data for testing. + - You have [enabled sensitivity labels for Office files in SharePoint and OneDrive](sensitivity-labels-sharepoint-onedrive-files.md). + - At the time the auto-labeling policy runs, the file mustn't be open by another process or user. A file that's checked out for editing falls into this category. + - If you plan to use [sensitive information types](sensitive-information-type-learn-about.md): + - The sensitive information types you select will apply only to content that's created or modified after these information types are [created or modified](audit-log-activities.md#sensitive-information-types-activities). This restriction applies to all custom sensitive information types and any new built-in information types. + - To test new custom sensitive information types, create them before you create your auto-labeling policy, and then create new documents with sample data for testing. + - <a name="document-properties"></a>If you plan to use document properties as a condition (**Document property is**), this option uses SharePoint managed properties. The [preparation for DLP policies](protect-documents-that-have-fci-or-other-properties.md#before-you-create-the-dlp-policy) equally applies for when you use this condition with auto-labeling policies. - One or more sensitivity labels [created and published](create-sensitivity-labels.md) (to at least one user) that you can select for your auto-labeling policies. For these labels: - It doesn't matter if the auto-labeling in Office apps label setting is turned on or off, because that label setting supplements auto-labeling policies, as explained in the introduction. Finally, you can use simulation mode to provide an approximation of the time nee 1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft Purview compliance portal</a>, navigate to **Solutions** > **Information protection** > **Auto-labeling**: -+ > [!NOTE] > If you don't see the **Auto-labeling** option, this functionality isn't currently available in your region because of a backend Azure dependency. For more information, see [Azure dependency availability by country](/troubleshoot/azure/general/dependency-availability-by-country). Finally, you can use simulation mode to provide an approximation of the time nee  -3. For the page **Choose info you want this label applied to**: Select one of the templates, such as **Financial** or **Privacy**. You can refine your search by using the **Show options for** dropdown. Or, select **Custom policy** if the templates don't meet your requirements. Select **Next**. +3. For the page **Choose info you want this label applied to**: Select one of the templates, such as **Financial** or **Privacy**. You can refine your search by using the search or dropdown box for countries or regions. Or, select **Custom policy** if the templates don't meet your requirements. Select **Next**. 4. For the page **Name your auto-labeling policy**: Provide a unique name, and optionally a description to help identify the automatically applied label, locations, and conditions that identify the content to label. Finally, you can use simulation mode to provide an approximation of the time nee - Rolling out: For the OneDrive location, you must specify users or groups. Previously, you had to specify sites by URLs. Any existing OneDrive URL sites in auto-labeling policies will continue to work but before you can specify new OneDrive locations, or for restricted admins, you must first delete any existing site URLs. Groups supported: distribution groups, Microsoft 365 groups, mail-enabled security groups, and security groups. -7. For the **Set up common or advanced rules** page: Keep the default of **Common rules** to define rules that identify content to label across all your selected locations. If you need different rules per location, including more options for Exchange, select **Advanced rules**. Then select **Next**. - - The rules use conditions that include [sensitive information types](sensitive-information-type-learn-about.md), [trainable classifiers](classifier-learn-about.md), and sharing options: +7. For the **Set up common or advanced rules** page: Keep the default of **Common rules** to define rules that identify content to label across all your selected locations. If you need different rules per location, including some rules that are only available for Exchange, or SharePoint sites and OneDrive accounts, select **Advanced rules**. Then select **Next**. ++ The rules use conditions that include [sensitive information types](sensitive-information-type-learn-about.md), [trainable classifiers](classifier-learn-about.md), sharing options, and other conditions that are currently in preview: - To select a sensitive information type or trainable classifier as a condition, under **Content contains**, select **Add**, and then choose **Sensitive info types** or **Trainable classifiers**. - To select sharing options as a condition, under **Content is shared**, choose either **only with people inside my organization** or **with people outside my organization**.- - If your location is **Exchange** and you selected **Advanced rules**, there are other conditions that you can select: + - Other conditions (in preview) that you can select: + - [Attachment or file extension is](#file-extensions) + - Attachment or document name contains words or phrases + - [Attachment or document property is](#document-properties) + - Attachment or document size equals or is greater than ++ If your location is **Exchange** and you selected **Advanced rules**, there are additional conditions that you can select: - Sender IP address is - Recipient domain is - Recipient is- - Attachment's file extension is - Attachment is password protected - Any email attachment's content could not be scanned - Any email attachment's content didn't complete scanning Finally, you can use simulation mode to provide an approximation of the time nee - Recipient is a member of - Sender is - For each of these conditions, you can then specify exceptions. - + If your location is **SharePoint sites** or **OneDrive accounts** and you selected **Advanced rules**, there is one other condition that you can select: + - Document created by (in preview) + 8. Depending on your previous choices, you'll now have an opportunity to create new rules by using conditions and exceptions. The configuration options for sensitive information types are the same as those you select for auto-labeling for Office apps. If you need more information, see [Configuring sensitive info types for a label](#configuring-sensitive-info-types-for-a-label). |
| compliance | Encryption Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/encryption-sensitivity-labels.md | f1.keywords: Previously updated : 06/10/2023 Last updated : 06/27/2023 audience: Admin |
| compliance | Insider Risk Management Policy Templates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-policy-templates.md | f1.keywords: Previously updated : 02/21/2023 Last updated : 06/28/2023 audience: itpro - tier1 Use the following table to determine the maximum number of in-scope users suppor |Security policy violation by priority users|1,000| |Security policy violations by departing users|15,000| |Security policy violations by risky users|7,500|-|Forensic evidence|5 users for preview release| +|Forensic evidence|Unlimited| |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | f1.keywords: Previously updated : 06/07/2023 Last updated : 06/27/2023 audience: Admin This configuration is an extension to the **Items** scope, when you [create or e Make sure both options are selected if you don't need to scope the labels to just Word, Excel, and PowerPoint, or to just Outlook. +Remember that other label configurations can also influence whether sensitivity labels are visible in apps. Check the documentation for the label configurations that you use. + > [!NOTE] > The **Files** option can include other items that support this scoping option, such as Power BI files. Check the application's documentation to verify, and remember to test all labeling apps and services used by your organization. |
| compliance | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md | f1.keywords: Previously updated : 06/23/2023 Last updated : 06/28/2023 audience: Admin Whether it be adding new solutions to the [Microsoft Purview compliance portal]( - **General availability (GA)**: Outlook for Android and Outlook for iOS, the [sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) and [label colors](sensitivity-labels-office-apps.md#label-colors) are now in general availability. For iOS, the release is still rolling out. - **In preview**: Now rolling out in preview, OneDrive locations for [auto-labeling policies](apply-sensitivity-label-automatically.md#how-to-configure-auto-labeling-policies-for-sharepoint-onedrive-and-exchange) are changing from sites specified by URLs to users and groups. This change of configuration means that [administrative units](microsoft-365-compliance-center-permissions.md#administrative-units-preview) are now supported for OneDrive auto-labeling policies. Any existing OneDrive sites specified in auto-labeling policies as site URLs will continue to work but before you can add more OneDrive locations, or for restricted admins, you must first delete any existing OneDrive sites specified as URLs. Groups supported: distribution groups, Microsoft 365 groups, mail-enabled security groups, and security groups. - **In preview**: Now rolling out in preview, [limited support for labels configured for user-defined permissions](sensitivity-labels-sharepoint-onedrive-files.md#support-for-labels-configured-for-user-defined-permissions) for Office on the web, SharePoint and OneDrive.+- **In preview**: The following new conditions are rolling out in preview for [auto-labeling policies](apply-sensitivity-label-automatically.md#how-to-configure-auto-labeling-policies-for-sharepoint-onedrive-and-exchange). Just the final new condition listed requires an advanced rule, and is applicable to OneDrive and SharePoint only. All the other new conditions are available in common rules: + - Attachment or file extension is + - Attachment or document name contains words or phrases + - Attachment or document property is + - Attachment or document size equals or is greater than + - Document created by +- **In preview**: A **Contextual Summary** tab is added to auto-labeling policies that are in simulation. Similar to [other solutions that support contextual summary](data-classification-increase-accuracy.md), when you select an item to review, this new tab highlights the matched content and its surrounding context. Use this tab to confirm that the match is positive and therefore suitable to turn on the policy. Or, the match is negative, in which case you can fine-tune the policy and rerun simulation. - **Removal of limitations for Teams when using sensitivity labels**: Several previous limitations are removed for [Teams protected meetings](sensitivity-labels-meetings.md), which include Safari and Firefox support to prevent copy chat, support for virtual desktop infrastructure (VDI), policy settings for justification for changing a label, mandatory labeling, and a help link to a custom help page, and more methods are now supported to prevent copying chat. ## May 2023 |
| enterprise | Additional Office365 Ip Addresses And Urls | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/additional-office365-ip-addresses-and-urls.md | Title: Other endpoints not included in the Office 365 IP Address and URL Web ser Previously updated : 06/15/2022 Last updated : 06/28/2023 audience: Admin Apart from DNS, these instances are all optional for most customers unless you n |3|**Azure AD Connect (w/SSO option)** <p> WinRM & remote PowerShell|Customer STS environment (AD FS Server and AD FS Proxy) \| TCP ports 80 & 443|Inbound server traffic| |4|**STS** such as AD FS Proxy server(s) (for federated customers only)|Customer STS (such as AD FS Proxy) \| Ports TCP 443 or TCP 49443 w/ClientTLS|Inbound server traffic| |5|**[Exchange Online Unified Messaging/SBC integration](/exchange/voice-mail-unified-messaging/telephone-system-integration-with-um/configuration-notes-for-session-border-controllers)**|Bidirectional between on-premises Session Border Controller and \*.um.outlook.com|Outbound server-only traffic|-|6|**Mailbox Migration**<p>When mailbox migration is initiated from on-premises [Exchange Hybrid](/exchange/exchange-deployment-assistant) to Office 365, Office 365 will connect to your published Exchange Web Services (EWS)/Mailbox Replication Services (MRS) server. If you need to allow inbound connections only from specific source IP ranges, create a permit rule for the IP addresses listed in the **Exchange Online** table in [Office 365 URL & IP ranges](urls-and-ip-address-ranges.md). <p> To ensure that connectivity to published EWS endpoints (like OWA) is not blocked, make sure the MRS proxy resolves to a separate FQDN and public IP address before you restrict connections.|Customer on-premises EWS/MRS Proxy <br> TCP port 443|Inbound server traffic| +|6|**Mailbox Migration**<p>When mailbox migration is initiated from on-premises [Exchange Hybrid](/exchange/exchange-deployment-assistant) to Office 365, Office 365 connects to your published Exchange Web Services (EWS)/Mailbox Replication Services (MRS) server. If you need to allow inbound connections only from specific source IP ranges, create a permit rule for the IP addresses listed in the **Exchange Online** table in [Office 365 URL & IP ranges](urls-and-ip-address-ranges.md). <p> To ensure that connectivity to published EWS endpoints (like OWA) is not blocked, make sure the MRS proxy resolves to a separate FQDN and public IP address before you restrict connections.|Customer on-premises EWS/MRS Proxy <br> TCP port 443|Inbound server traffic| |7|**[Exchange Hybrid](/exchange/exchange-deployment-assistant) coexistence functions** such as Free/Busy sharing.|Customer on-premises Exchange server|Inbound server traffic| |8|**[Exchange Hybrid](/exchange/exchange-deployment-assistant) proxy authentication**|Customer on-premises STS|Inbound server traffic| |9|Used to configure [Exchange Hybrid](/exchange/exchange-deployment-assistant), using the **[Exchange Hybrid Configuration Wizard](/exchange/hybrid-configuration-wizard)** <p> Note: These endpoints are only required to configure Exchange hybrid|domains.live.com on TCP ports 80 & 443, only required for Exchange 2010 SP3 Hybrid Configuration Wizard <p> GCC High, DoD IP addresses: 40.118.209.192/32; 168.62.190.41/32 <p> Worldwide Commercial & GCC: \*.store.core.windows.net; asl.configure.office.com; tds.configure.office.com; mshybridservice.trafficmanager.net ; <br> aka.ms/hybridwizard; <br> shcwreleaseprod.blob.core.windows.net/shcw/\*;|Outbound server-only traffic| Apart from DNS, these instances are all optional for most customers unless you n |13|**Skype for Business hybrid on-premises server connectivity** to Skype for Business Online|13.107.64.0/18, 52.112.0.0/14 <br> UDP ports 50,000-59,999 <br> TCP ports 50,000-59,999; 5061|Skype for Business on-premises server outbound connectivity| |14|**Cloud PSTN** with on-premises hybrid connectivity requires network connectivity open to the on-premises hosts. For more details about Skype for Business Online hybrid configurations|See [Plan hybrid connectivity between Skype for Business Server and Office 365](/skypeforbusiness/hybrid/plan-hybrid-connectivity)|Skype for Business on-premises hybrid inbound| |15|**Authentication and identity FQDNs** <p> The FQDN `secure.aadcdn.microsoftonline-p.com` needs to be in your client's Internet Explorer (IE) or Edge Trusted Sites Zone to function.||Trusted Sites|-|16|**Microsoft Teams FQDNs** <p> If you are using Internet Explorer or Microsoft Edge, you need to enable first and third-party cookies and add the FQDNs for Teams to your Trusted Sites. This is in addition to the suite-wide FQDNs, CDNs, and telemetry listed in row 14. See [Known issues for Microsoft Teams](/microsoftteams/known-issues) for more information.||Trusted Sites| -|17|**SharePoint Online and OneDrive for Business FQDNs** <p> All '.sharepoint.com' FQDNs with '\<tenant\>' in the FQDN need to be in your client's IE or Edge Trusted Sites Zone to function. In addition to the suite-wide FQDNs, CDNs, and telemetry listed in row 14, you'll need to also add these endpoints.||Trusted Sites| +|16|**Microsoft Teams FQDNs** <p> If you are using Internet Explorer or Microsoft Edge, you need to enable first, and third-party cookies and add the FQDNs for Teams to your Trusted Sites. This is in addition to the suite-wide FQDNs, CDNs, and telemetry listed in row 14. See [Known issues for Microsoft Teams](/microsoftteams/known-issues) for more information.||Trusted Sites| +|17|**SharePoint Online and OneDrive for Business FQDNs** <p> All '.sharepoint.com' FQDNs with '\<tenant\>' in the FQDN need to be in your client's IE or Edge Trusted Sites Zone to function. In addition to the suite-wide FQDNs, CDNs, and telemetry listed in row 14, you need to also add these endpoints.||Trusted Sites| |18|**Yammer** <br> Yammer is only available in the browser and requires the authenticated user to be passed through a proxy. All Yammer FQDNs need to be in your client's IE or Edge Trusted Sites Zone to function.||Trusted Sites| |19|Use **[Azure AD Connect](/azure/active-directory/hybrid/)** to sync on-premises user accounts to Azure AD.|See [Hybrid Identity Required Ports and Protocols](/azure/active-directory/hybrid/reference-connect-ports), [Troubleshoot Azure AD connectivity](/azure/active-directory/hybrid/tshoot-connect-connectivity), and [Azure AD Connect Health Agent Installation](/azure/active-directory/hybrid/how-to-connect-health-agent-install#outbound-connectivity-to-the-azure-service-endpoints).|Outbound server-only traffic| |20|**[Azure AD Connect](/azure/active-directory/hybrid/)** with 21 ViaNet in China to sync on-premises user accounts to Azure AD.|\*.digicert.com:80 <BR> \*.entrust.net:80 <BR> \*.chinacloudapi.cn:443 <br> secure.aadcdn.partner.microsoftonline-p.cn:443 <br> \*.partner.microsoftonline.cn:443 <p> Also see [Troubleshoot ingress with Azure AD connectivity issues](https://docs.azure.cn/zh-cn/active-directory/hybrid/tshoot-connect-connectivity).|Outbound server-only traffic| |21|**Microsoft Stream** (needs the Azure AD user token). <br> Office 365 Worldwide (including GCC)|\*.cloudapp.net <br> \*.api.microsoftstream.com <br> \*.notification.api.microsoftstream.com <br> amp.azure.net <br> api.microsoftstream.com <br> az416426.vo.msecnd.net <br> s0.assets-yammer.com <br> vortex.data.microsoft.com <br> web.microsoftstream.com <br> TCP port 443|Inbound server traffic| |22|Use **MFA server** for multi-factor authentication requests, both new installations of the server and setting it up with Active Directory Domain Services (AD DS).|See [Getting started with the Azure AD multi-factor authentication Server](/azure/active-directory/authentication/howto-mfaserver-deploy#plan-your-deployment).|Outbound server-only traffic|-|23|**Microsoft Graph Change Notifications** <p> Developers can use [change notifications](/graph/webhooks?context=graph%2fapi%2f1.0&view=graph-rest-1.0&preserve-view=true) to subscribe to events in the Microsoft Graph.|Public Cloud: 52.159.23.209, 52.159.17.84, 13.78.204.0, 52.148.24.136, 52.148.27.39, 52.147.213.251, 52.147.213.181, 20.127.53.125, 40.76.162.99, 40.76.162.42, 70.37.95.92, 70.37.95.11, 70.37.92.195, 70.37.93.191, 70.37.90.219, 20.9.36.45, 20.9.35.166, 20.9.36.128, 20.9.37.73, 20.9.37.76, 20.96.21.67, 20.69.245.215, 104.46.117.15, 20.96.21.98, 20.96.21.115, 137.135.11.161, 137.135.11.116, 20.253.156.113, 137.135.11.222, 137.135.11.250, 52.159.107.50, 52.159.107.4, 52.159.124.33, 52.159.109.205, 52.159.102.72, 20.98.68.182, 20.98.68.57, 20.98.68.200, 20.98.68.203, 20.98.68.218, 20.171.81.121, 20.25.189.138, 20.171.82.192, 20.171.83.146, 20.171.83.157, 52.142.114.29, 52.142.115.31, 20.223.139.245, 51.104.159.213, 51.104.159.181, 51.124.75.43, 51.124.73.177, 104.40.209.182, 51.138.90.7, 51.138.90.52, 20.199.102.157, 20.199.102.73, 20.216.150.67, 20.111.9.46, 20.111.9.77, 13.87.81.123, 13.87.81.35, 20.90.99.1, 13.87.81.133, 13.87.81.141, 20.91.212.211, 20.91.212.136, 20.91.213.57, 20.91.208.88, 20.91.209.147, 20.44.210.83, 20.44.210.146, 20.212.153.162, 52.148.115.48, 52.148.114.238, 40.80.232.177, 40.80.232.118, 52.231.196.24, 40.80.233.14, 40.80.239.196, 20.48.12.75, 20.48.11.201, 20.89.108.161, 20.48.14.35, 20.48.15.147, 104.215.13.23, 104.215.6.169, 20.89.240.165, 104.215.18.55, 104.215.12.254 <br> <p> Microsoft Cloud for US Government: 52.244.33.45, 52.244.35.174, 52.243.157.104, 52.243.157.105, 52.182.25.254, 52.182.25.110, 52.181.25.67, 52.181.25.66, 52.244.111.156, 52.244.111.170, 52.243.147.249, 52.243.148.19, 52.182.32.51, 52.182.32.143, 52.181.24.199, 52.181.24.220 <p> Microsoft Cloud China operated by 21Vianet: 42.159.72.35, 42.159.72.47, 42.159.180.55, 42.159.180.56, 40.125.138.23, 40.125.136.69, 40.72.155.199, 40.72.155.216 <br> TCP port 443 <p> Note: Developers can specify different ports when creating the subscriptions.|Inbound server traffic| -|24|**Network Connection Status Indicator**<p>Used by Windows 10 and 11 to determine if the computer is connected to the internet (does not apply to non-Windows clients). When this URL cannot be reached, Windows will assume it is not connected to the Internet and M365 Apps for Enterprise will not try to verify activation status, causing connections to Exchange and other services to fail.|www.msftconnecttest.com <br> 13.107.4.52<p>Also see [Manage connection endpoints for Windows 11 Enterprise](/windows/privacy/manage-windows-11-endpoints) and [Manage connection endpoints for Windows 10 Enterprise, version 21H2](/windows/privacy/manage-windows-21h2-endpoints).|Outbound server-only traffic| -|25|**Teams Notifications on Mobile Devices**<p>Used by Android and Apple mobile devices to receive push notifications to the Teams client for incoming calls and other Teams services. When these ports are blocked, all push notifications to mobile devices will fail.|For specific ports, see [FCM ports and your firewall in the Google Firebase documentation](https://firebase.google.com/docs/cloud-messaging/concept-options#messaging-ports-and-your-firewall) and [If your Apple devices aren't getting Apple push notifications](https://support.apple.com/en-us/HT203609).|Outbound server-only traffic| +|23|**Microsoft Graph Change Notifications** <p> Developers can use [change notifications](/graph/webhooks?context=graph%2fapi%2f1.0&view=graph-rest-1.0&preserve-view=true) to subscribe to events in the Microsoft Graph.|Public Cloud: 52.159.23.209, 52.159.17.84, 13.78.204.0, 52.148.24.136, 52.148.27.39, 52.147.213.251, 52.147.213.181, 20.127.53.125, 40.76.162.99, 40.76.162.42, 70.37.95.92, 70.37.95.11, 70.37.92.195, 70.37.93.191, 20.9.36.45, 20.9.35.166, 20.9.36.128, 20.96.21.67, 20.69.245.215, 104.46.117.15, 137.135.11.161, 137.135.11.116, 20.253.156.113, 52.159.107.50, 52.159.107.4, 52.159.124.33, 20.98.68.182, 20.98.68.57, 20.98.68.200, 20.171.81.121, 20.25.189.138, 20.171.82.192, 52.142.114.29, 52.142.115.31, 20.223.139.245, 51.124.75.43, 51.124.73.177, 104.40.209.182, 20.199.102.157, 20.199.102.73, 20.216.150.67, 20.91.212.211, 20.91.212.136, 20.91.213.57, 20.44.210.83, 20.44.210.146, 20.212.153.162, 40.80.232.177, 40.80.232.118, 52.231.196.24, 20.48.12.75, 20.48.11.201, 20.89.108.161, 104.215.13.23, 104.215.6.169, 20.89.240.165 <br> <p> Microsoft Cloud for US Government: 52.244.33.45, 52.244.35.174, 52.243.157.104, 52.243.157.105, 52.182.25.254, 52.182.25.110, 52.181.25.67, 52.181.25.66, 52.244.111.156, 52.244.111.170, 52.243.147.249, 52.243.148.19, 52.182.32.51, 52.182.32.143, 52.181.24.199, 52.181.24.220 <p> Microsoft Cloud China operated by 21Vianet: 42.159.72.35, 42.159.72.47, 42.159.180.55, 42.159.180.56, 40.125.138.23, 40.125.136.69, 40.72.155.199, 40.72.155.216 <br> TCP port 443 <p> Note: Developers can specify different ports when creating the subscriptions.|Inbound server traffic| +|24|**Network Connection Status Indicator**<p>Used by Windows 10 and 11 to determine if the computer is connected to the internet (does not apply to non-Windows clients). When this URL cannot be reached, Windows assumes it is not connected to the Internet and M365 Apps for Enterprise will not try to verify activation status, causing connections to Exchange and other services to fail.|www.msftconnecttest.com <br> 13.107.4.52<p>Also see [Manage connection endpoints for Windows 11 Enterprise](/windows/privacy/manage-windows-11-endpoints) and [Manage connection endpoints for Windows 10 Enterprise, version 21H2](/windows/privacy/manage-windows-21h2-endpoints).|Outbound server-only traffic| +|25|**Teams Notifications on Mobile Devices**<p>Used by Android and Apple mobile devices to receive push notifications to the Teams client for incoming calls and other Teams services. When these ports are blocked, all push notifications to mobile devices fail.|For specific ports, see [FCM ports and your firewall in the Google Firebase documentation](https://firebase.google.com/docs/cloud-messaging/concept-options#messaging-ports-and-your-firewall) and [If your Apple devices aren't getting Apple push notifications](https://support.apple.com/en-us/HT203609).|Outbound server-only traffic| ## Related Topics |
| enterprise | Cross Tenant Mailbox Migration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/cross-tenant-mailbox-migration.md | When a mailbox is migrated cross-tenant with this feature, only user visible con > If you are interested in previewing our new feature Domain Sharing for email alongside your cross-tenant mailbox migrations, please complete the form at [aka.ms/domainsharingpreview](https://aka.ms/domainsharingpreview). Domain sharing for email enables users in separate Microsoft 365 tenants to send and receive email using addresses from the same custom domain. The feature is intended to solve scenarios where users in separate tenants need to represent a common corporate brand in their email addresses. The current preview supports sharing domains indefinitely and shared domains during cross-tenant mailbox migration coexistence. ## Licensing+ > [!IMPORTANT] > As of Nov. 2022, **Cross Tenant User Data Migration** is available as an add-on to the following Microsoft 365 subscription plans for Enterprise Agreement customers, and is required for cross-tenant migrations. User licenses are per migration (one-time fee) and can be assigned either on the source or target user object. This license also covers [OneDrive for Business migration](/microsoft-365/enterprise/cross-tenant-onedrive-migration). Contact your Microsoft account team for details.--Microsoft 365 Business Basic/Business Standard/Business Premium/F1/F3/E3/E5/; Office 365 F3/E1/E3/E5; Exchange Online; SharePoint Online; OneDrive for Business. +> +> The Cross Tenant User Data Migration add-on is available as a separate purchase for Microsoft 365 Business Basic, Standard, and Premium; Microsoft 365 F1/F3/E3/E5/; Office 365 F3/E1/E3/E5; Exchange Online; SharePoint Online; and OneDrive for Business. > [!WARNING]-> You must have purchased, or verified that you can purchase, cross tenant user data migration licenses prior to the next steps. Migrations will fail if this has not been completed. Microsoft does not offer exceptions for this licensing. +> You must have purchased, or verified that you can purchase, cross tenant user data migration licenses prior to the next steps. Migrations fail if this step has not been completed. Microsoft does not offer exceptions for this licensing requirement. ## Preparing source and target tenants All users in both the source and target organizations must be licensed with the ### Prepare the target (destination) tenant by creating the migration application and secret -1. Log in to your Azure AD portal (<https://portal.azure.com>) with your target tenant admin credentials +1. Sign in to your Azure AD portal (<https://portal.azure.com>) with your target tenant admin credentials.  -1. Select View under "Manage Azure Active Directory". +1. Under **Manage Azure Active Directory**, select **View**.  -1. On the left navigation bar, select "App registrations". +1. In the navigation pane, select **App registrations**. -1. Select "New registration" +1. Select **New registration**.  -1. On the "Register an application page", under "Supported account types", select" Accounts in any organizational directory (Any Azure AD directory - Multi-tenant)". Then, under "Redirect URI (optional)", select Web and enter <https://office.com>. Lastly, select Register. +1. On the **Register an application page**, under **Supported account types**, select **Accounts in any organizational directory (Any Azure AD directory - Multi-tenant)**. Then, under **Redirect URI (optional)**, select **Web**, and then typer `https://office.com`. Then, select **Register**.  -1. On the top-right corner of the page, you'll see a notification pop-up that states the app was successfully created. -1. Go back to Home, Azure Active Directory and select on "App registrations". -1. Under "Owned applications", find the app you created and select on it. -1. Under "Essentials", you'll need to copy down the "Application (client) ID" as you'll need it later to create a URL for the target tenant. -1. Now, on the left navigation bar, select on "API permissions" to view permissions assigned to your app. -1. By default, User. Read permissions are assigned to the app you created, but we don't require them for mailbox migrations, you can remove that permission. + On the top-right corner of the page, you'll see a notification pop-up that states the app was successfully created. ++1. Go back to the Home page, go to **Azure Active Directory**, and then select **App registrations**. ++1. Under **Owned applications**, find the app you created, and then select it. ++1. Under **Essentials**, copy the **Application (client) ID**. You'll need it later to create a URL for the target tenant. ++1. In the navigation pane, select **API permissions** to view permissions assigned to your app. ++1. By default, **User.Read** permissions are assigned to the app you created, but aren't required for mailbox migrations. You can remove that permission.  -1. Now we need to add permission for mailbox migration, select "Add a permission." -1. In the "Request API permissions" window, select "APIs my organization uses", search for "Office 365 Exchange Online", and select it. +1. To add permission for mailbox migration, select **Add a permission**. ++1. In the **Request API permissions** window, select **APIs my organization uses**, search for `Office 365 Exchange Online`, and then select it.  -1. Next, select "Application permissions." -1. Then, under "Select permissions", expand Mailbox, and check "Mailbox.Migration", and "Add permissions" at the bottom on the screen. +1. Select **Application permissions**. ++1. Under **Select permissions**, expand **Mailbox**, and check **Mailbox.Migration**, and then select **Add permissions** at the bottom on the screen.  -1. Now select Certificates & secrets on the left navigation bar for your application. -1. Under "Client secrets", select "New client secret". +1. Now select **Certificates & secrets** in the navigation pane for your application. ++1. Under **Client secrets**, select **New client secret**.  -1. In the Add a client secret window, enter a description, and configure your desired expiration settings. +1. In the **Add a client secret** window, type a description, and then configure your expiration settings. -> [!NOTE] -> This is the password that will be used when creating your migration endpoint. It is extremely important that you copy this password to your clipboard and or copy this password to secure/secret password safe location. This is the only time you will be able to see this password! If you do somehow lose it or need to reset it, you can log back into our Azure portal, go to App registrations, find your migration app, select Secrets & certificates, and create a new secret for your app. + > [!NOTE] + > The password is used when creating your migration endpoint. It is extremely important that you copy this password to your clipboard and or copy this password to a secure/secret password safe location. This is the only time you will be able to see this password! If you do somehow lose it or need to reset it, you can sign back into the Azure portal, go to **App registrations**, find your migration app, select **Secrets & certificates**, and then create a new secret for your app. ++Now that you've successfully created the migration application and secret, the next steps is to consent to the application. To consent to the application: ++1. Go back to the Azure Active Directory landing page, select **Enterprise applications** in the navigation pane, find your migration app you created, select it, and then select **Permissions**. ++1. Select **Grant admin consent for [your tenant]**. -Now that you've successfully created the migration application and secret, you'll need to consent to the application. To consent to the application: +1. A new browser window opens. Select **Accept**. ++1. You can go back to your portal window and select **Refresh** to confirm your acceptance. -1. Go back to the Azure Active Directory landing page, select on Enterprise applications in the left navigation, find your migration app you created, select it, and select Permissions on the left navigation. -1. Select on the "Grant admin consent for [your tenant]" button. -1. A new browser window will open and select "Accept". -1. You can go back to your portal window and select Refresh to confirm your acceptance. 1. Formulate the URL to send to your trusted partner (source tenant admin) so they can also accept the application to enable mailbox migration. Here's an example of the URL to provide to them you'll need the application ID of the app you created: -```PowerShell -https://login.microsoftonline.com/contoso.onmicrosoft.com/adminconsent?client_id=[application_id_of_the_app_you_just_created]&redirect_uri=https://office.com -``` + `https://login.microsoftonline.com/contoso.onmicrosoft.com/adminconsent?client_id=[application_id_of_the_app_you_just_created]&redirect_uri=https://office.com` -> [!NOTE] -> You will need the application ID of the mailbox migration app you just created. -> You will need to replace contoso.onmicrosoft.com in the above example with your source tenants correct onmicrosoft.com name. -> You will also need to replace [application_id_of_the_app_you_just_created] with the application ID of the mailbox migration app you just created. + > [!NOTE] + > You will need the application ID of the mailbox migration app you just created. + > You will need to replace contoso.onmicrosoft.com in the above example with your source tenants correct onmicrosoft.com name. + > You will also need to replace [application_id_of_the_app_you_just_created] with the application ID of the mailbox migration app you just created. ### Prepare the target tenant by creating the Exchange Online migration endpoint and organization relationship 1. [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) in the target Exchange Online tenant.+ 1. Create a new migration endpoint for Cross-tenant mailbox moves. -> [!NOTE] -> You will need the application ID of the mailbox migration app you just created and the password (secret) you configured during this process. Depending on the Microsoft 365 cloud instance you use, your endpoint may be different. Please refer to the [Microsoft 365 endpoints](/microsoft-365/enterprise/microsoft-365-endpoints) page, select the correct instance for your tenant and review the Exchange Online _Optimize/Required_ address and replace as appropriate. + > [!NOTE] + > You will need the application ID of the mailbox migration app you just created and the password (secret) you configured during this process. Depending on the Microsoft 365 cloud instance you use, your endpoint may be different. See to the [Microsoft 365 endpoints](/microsoft-365/enterprise/microsoft-365-endpoints) page, select the correct instance for your tenant, and then review the Exchange Online _Optimize/Required_ address, and replace as appropriate. -```PowerShell -# Enable customization if tenant is dehydrated -$dehydrated=Get-OrganizationConfig | select isdehydrated -if ($dehydrated.isdehydrated -eq $true) {Enable-OrganizationCustomization} -$AppId = "[Guid copied from the migrations app]" -$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $AppId, (ConvertTo-SecureString -String "[this is your secret password you saved in the previous steps]" -AsPlainText -Force) -New-MigrationEndpoint -RemoteServer outlook.office.com -RemoteTenant "contoso.onmicrosoft.com" -Credentials $Credential -ExchangeRemoteMove:$true -Name "[the name of your migration endpoint]" -ApplicationId $AppId -``` + ```PowerShell + # Enable customization if tenant is dehydrated + $dehydrated=Get-OrganizationConfig | select isdehydrated + if ($dehydrated.isdehydrated -eq $true) {Enable-OrganizationCustomization} + $AppId = "[Guid copied from the migrations app]" + $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $AppId, (ConvertTo-SecureString -String "[this is your secret password you saved in the + previous steps]" -AsPlainText -Force) + New-MigrationEndpoint -RemoteServer outlook.office.com -RemoteTenant "contoso.onmicrosoft.com" -Credentials $Credential -ExchangeRemoteMove:$true -Name "[the name of your migration + endpoint]" -ApplicationId $AppId + ``` -1. Create new or edit your existing organization relationship object to your source tenant. +1. Create a new or edit your existing organization relationship object to your source tenant. -```PowerShell -$sourceTenantId="[tenant id of your trusted partner, where the source mailboxes are]" -$orgrels=Get-OrganizationRelationship -$existingOrgRel = $orgrels | ?{$_.DomainNames -like $sourceTenantId} -If ($null -ne $existingOrgRel) -{ - Set-OrganizationRelationship $existingOrgRel.Name -Enabled:$true -MailboxMoveEnabled:$true -MailboxMoveCapability Inbound -} -If ($null -eq $existingOrgRel) -{ - New-OrganizationRelationship "[name of the new organization relationship]" -Enabled:$true -MailboxMoveEnabled:$true -MailboxMoveCapability Inbound -DomainNames $sourceTenantId -} -``` + ```PowerShell + $sourceTenantId="[tenant id of your trusted partner, where the source mailboxes are]" + $orgrels=Get-OrganizationRelationship + $existingOrgRel = $orgrels | ?{$_.DomainNames -like $sourceTenantId} + If ($null -ne $existingOrgRel) + { + Set-OrganizationRelationship $existingOrgRel.Name -Enabled:$true -MailboxMoveEnabled:$true -MailboxMoveCapability Inbound + } + If ($null -eq $existingOrgRel) + { + New-OrganizationRelationship "[name of the new organization relationship]" -Enabled:$true -MailboxMoveEnabled:$true -MailboxMoveCapability Inbound -DomainNames $sourceTenantId + } + ``` ### Prepare the source (current mailbox location) tenant by accepting the migration application and configuring the organization relationship -1. From a browser, go to the URL link provided by your trusted partner to consent to the mailbox migration application. The URL will look like the following: +1. Using your browser, go to the URL link provided by your trusted partner to consent to the mailbox migration application. The URL will look like the following: -```PowerShell -https://login.microsoftonline.com/contoso.onmicrosoft.com/adminconsent?client_id=[application_id_of_the_app_you_just_created]&redirect_uri=https://office.com -``` + `https://login.microsoftonline.com/contoso.onmicrosoft.com/adminconsent?client_id=[application_id_of_the_app_you_just_created]&redirect_uri=https://office.com` -> [!NOTE] -> You will need the application ID of the mailbox migration app you just created. You will need to replace _contoso.onmicrosoft.com_ in the above example with your source tenant's onmicrosoft.com URL. You will also need to replace [application_id_of_the_app_you_just_created] with the application ID of the mailbox migration app you just created. + > [!NOTE] + > You will need the application ID of the mailbox migration app you just created. You will need to replace `contoso.onmicrosoft.com` in the previous example with your source tenant's `onmicrosoft.com` URL. You will also need to replace [application_id_of_the_app_you_just_created] with the application ID of the mailbox migration app you just created. ++1. Accept the application when the pop-up appears. You can also log into your Azure Active Directory portal and find the application under **Enterprise applications**. -1. Accept the application when the pop-up appears. You can also log into your Azure Active Directory portal and find the application under Enterprise applications. 1. [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) on the source Exchange Online tenant.+ 1. Create a new organization relationship or edit your existing organization relationship object to your target (destination) tenant in Exchange Online PowerShell: -```PowerShell -$targetTenantId="[tenant id of your trusted partner, where the mailboxes are being moved to]" -$appId="[application id of the mailbox migration app you consented to]" -$scope="[name of the mail enabled security group that contains the list of users who are allowed to migrate]" -New-DistributionGroup -Type Security -Name $scope + ```PowerShell + $targetTenantId="[tenant id of your trusted partner, where the mailboxes are being moved to]" + $appId="[application id of the mailbox migration app you consented to]" + $scope="[name of the mail enabled security group that contains the list of users who are allowed to migrate]" + New-DistributionGroup -Type Security -Name $scope $orgrels=Get-OrganizationRelationship-$existingOrgRel = $orgrels | ?{$_.DomainNames -like $targetTenantId} -If ($null -ne $existingOrgRel) -{ - Set-OrganizationRelationship $existingOrgRel.Name -Enabled:$true -MailboxMoveEnabled:$true -MailboxMoveCapability RemoteOutbound -OAuthApplicationId $appId -MailboxMovePublishedScopes $scope -} -If ($null -eq $existingOrgRel) -{ - New-OrganizationRelationship "[name of your organization relationship]" -Enabled:$true -MailboxMoveEnabled:$true -MailboxMoveCapability RemoteOutbound -DomainNames $targetTenantId -OAuthApplicationId $appId -MailboxMovePublishedScopes $scope -} -``` + $existingOrgRel = $orgrels | ?{$_.DomainNames -like $targetTenantId} + If ($null -ne $existingOrgRel) + { + Set-OrganizationRelationship $existingOrgRel.Name -Enabled:$true -MailboxMoveEnabled:$true -MailboxMoveCapability RemoteOutbound -OAuthApplicationId $appId - MailboxMovePublishedScopes $scope + } + If ($null -eq $existingOrgRel) + { + New-OrganizationRelationship "[name of your organization relationship]" -Enabled:$true -MailboxMoveEnabled:$true -MailboxMoveCapability RemoteOutbound -DomainNames $targetTenantId + -OAuthApplicationId $appId -MailboxMovePublishedScopes $scope + } + ``` > [!NOTE] > The tenant ID that you enter as the \$sourceTenantId and \$targetTenantId is the GUID and not the tenant domain name. For an example of a tenant ID and information about finding your tenant ID, see [Find your Microsoft 365 tenant ID](/onedrive/find-your-office-365-tenant-id). |
| frontline | Deploy Dynamic Teams At Scale | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/deploy-dynamic-teams-at-scale.md | +>[!IMPORTANT] +>This feature will begin rolling out for public preview in July 2023. + Frontline teams are a collection of people, content, and tools within an organization for different frontline worker locations. Membership of frontline dynamic teams is determined and managed by a set of Azure Active Directory (Azure AD) attributes. [Learn more about Azure AD attributes](/azure/active-directory/external-identities/customers/how-to-define-custom-attributes). In the setup process, you'll define the following with Azure AD attributes: |
| frontline | Frontline Team Options | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/frontline-team-options.md | +>[!IMPORTANT] +>The ability to deploy frontline dynamic teams at scale will begin rolling out for public preview in July 2023. + ### Licensing For dynamic groups, users need one of the following licenses: Microsoft 365 F1, F3, E1, E3, or E5. If a user doesn't have one of these licenses, they'll need an Azure Active Directory P1 add-on license to leverage dynamic teams. [Learn more about frontline licensing](flw-licensing-options.md). You should use dynamic frontline teams if: - You have AAD attributes that can define who is a frontline worker and what locations they work in. - You want to simplify the process of creating a team for each frontline location, including support for creating new teams when a new location opens. -[Learn more about deploying dynamic frontline teams from your Microsoft 365 admin center](deploy-dynamic-teams-at-scale.md). +[Learn more about deploying dynamic frontline teams from your Teams admin center](deploy-dynamic-teams-at-scale.md). > [!NOTE] > You can't manually add members to dynamic teams. If you need to manually add or remove members, it's recommended that you use a [static team](#when-should-i-choose-static-teams). |
| lighthouse | M365 Lighthouse Manage Tenants Using Deployment Insights | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-manage-tenants-using-deployment-insights.md | Microsoft 365 Lighthouse provides deployment insights within and across the tena 1. In the left navigation pane in Lighthouse, select **Deployment \> Deployment insights**. -2. On the **Deployment insights** page, review the following areas to gather insight on your tenantsΓÇÖ deployment progress. +2. On the **Deployment insights** page, review the following areas to gather insight on your tenants' deployment progress. |Area |Description | |--|-| For additional solutions for common deployment issues, see [Deploying baselines] 3. Select the desired tenant to see specific regressed tasks. -4. Select **View tenant deployment plan** to navigate you to the tenantΓÇÖs deployment plan. +4. Select **View tenant deployment plan** to navigate you to the tenant's deployment plan. 5. From the **Deployment plan** tab, select the regressed task from the list. Every dismissed task and excluded user represent a potential threat. You can aud 5. If a user should no longer be excluded, select **View tenant deployment plan**. -6. From the tenantΓÇÖs **Deployment plan** tab, select the applicable deployment task. +6. From the tenant's **Deployment plan** tab, select the applicable deployment task. 7. From the task details pane, select **Deploy**. The deployment wizard is launched. |
| lighthouse | M365 Lighthouse Reprovision Cloudpc | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-reprovision-cloudpc.md | |
| lighthouse | M365 Lighthouse View Task Details | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-view-task-details.md | |
| security | Compare Mdb M365 Plans | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/compare-mdb-m365-plans.md | Defender for Business brings the enterprise-grade capabilities of Defender for E |[Automated investigation and response](../defender-endpoint/automated-investigations.md) <br/>(*see note 4 below*) |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: ||:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| |[Threat hunting](../defender-endpoint/advanced-hunting-overview.md) and six months of data retention | | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| |[Threat analytics](../defender-endpoint/threat-analytics.md) <br/>(*see note 5 below*) |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|-|[Cross-platform support](../defender-endpoint/minimum-requirements.md) <br/>Windows, Mac, iOS, and Android OS (*For Windows Server and Linux, see note 6 below*) |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| +|[Cross-platform support](../defender-endpoint/minimum-requirements.md) <br/>Windows, Mac, iOS, Android <br/>(*For Windows Server and Linux, see note 6 below*) |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| |[Microsoft Threat Experts](../defender-endpoint/microsoft-threat-experts.md)| | |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|-|Partner APIs|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| +|[Partner APIs and integration](../defender-endpoint/partner-integration.md)|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| +|[SIEM integration](../defender/configure-siem-defender.md)<br/>(*see note 7 below*)|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::|:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false":::| |[Microsoft 365 Lighthouse integration](../../lighthouse/m365-lighthouse-overview.md) <br/>(For viewing security incidents across customer tenants) |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: |:::image type="content" source="../../media/d238e041-6854-4a78-9141-049224df0795.png" alt-text="Included" border="false"::: | > [!NOTE] Defender for Business brings the enterprise-grade capabilities of Defender for E > 5. In Defender for Business, threat analytics are optimized for small and medium-sized businesses. > > 6. To onboard servers, another license is required. See [Onboard devices to Defender for Business](mdb-onboard-devices.md) or [Onboard devices and configure Microsoft Defender for Endpoint capabilities](../defender-endpoint/onboard-configure.md).+> +> 7. Using the [Microsoft 365 Streaming API](../defender/streaming-api.md) with Defender for Business, you can view information about device events in your SIEM server. For more information, see [Supported Microsoft 365 Defender streaming event types in event streaming API](../defender/supported-event-types.md). ## Next steps |
| security | Mdb Roles Permissions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-roles-permissions.md | This article describes how to assign security roles and permissions in Defender :::image type="content" source="media/mdb-setup-step3.png" alt-text="Visual depicting step 3 - assign security roles and permissions in Defender for Business."::: -To perform tasks in the Microsoft 365 Defender portal, such as configuring Defender for Business, viewing reports, or taking response actions on detected threats, appropriate permissions must be assigned to your security team. Permissions are granted through roles that are assigned in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) or in [Azure Active Directory](/azure/active-directory/roles/manage-roles-portal). +Your organization's security team needs certain permissions to perform tasks, such as ++- Configuring Defender for Business +- Onboarding (or removing) devices +- Viewing reports about devices and threat detections +- Viewing incidents and alerts +- Taking response actions on detected threats ++Permissions are granted through certain roles in the [Azure Active Directory](/azure/active-directory/roles/manage-roles-portal). These roles can be assigned in the Microsoft 365 admin center or in the Microsoft Entra admin center. ## What to do The following table describes the three roles that can be assigned in Defender f |:|:| | **Global administrators** (also referred to as global admins) <br/><br/> *As a best practice, limit the number of global admins. See [Security guidelines for assigning roles](/microsoft-365/admin/add-users/about-admin-roles#security-guidelines-for-assigning-roles).* | Global admins can perform all kinds of tasks. The person who signed up your company for Microsoft 365 or for Defender for Business is a global administrator by default. Global admins typically complete the setup and configuration process in Defender for Business, including onboarding devices.<br/><br/> Global admins are able to modify settings across all Microsoft 365 portals, such as: <br/>- The Microsoft 365 admin center ([https://admin.microsoft.com](https://admin.microsoft.com))<br/>- Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) | | **Security administrators** (also referred to as security admins) | Security admins can perform the following tasks: <br/>- View and manage security policies<br/>- View, respond to, and manage alerts <br/>- Take response actions on devices with detected threats<br/>- View security information and reports <br/><br/>In general, security admins use the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) to perform security tasks. |-| **Security reader** | Security readers can perform the following tasks:<br/>- View a list of onboarded devices<br/>- View security policies<br/>- View alerts and detected threats<br/>- View security information and reports <br/><br/>Security readers cannot add or edit security policies, nor can they onboard devices. | +| **Security reader** | Security readers can perform the following tasks:<br/>- View a list of onboarded devices<br/>- View security policies<br/>- View alerts and detected threats<br/>- View security information and reports <br/><br/>Security readers can't add or edit security policies, nor can they onboard devices. | ## View and edit role assignments > [!IMPORTANT] > Microsoft recommends that you grant people access to only what they need to perform their tasks. We call this concept *least privilege* for permissions. To learn more, see [Best practices for least-privileged access for applications](/azure/active-directory/develop/secure-least-privileged-access). -1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in. +You can use the Microsoft 365 admin center or the Microsoft Entra admin center to view and edit role assignments. -2. In the navigation pane, choose **Permissions & roles**, and then under **Azure AD**, select **Roles**. +## [**Microsoft 365 admin center**](#tab/M365Admin) -3. Select one of the following roles that are relevant to Defender for Business: +1. Go to the Microsoft 365 admin center ([https://admin.microsoft.com](https://admin.microsoft.com)) and sign in. - - Global administrator - - Security administrator - - Security reader +2. In the navigation pane, go to **Users** > **Active users**. - A side pane opens and displays information, such as which users are assigned that role. +3. Select a user account to open their flyout pane. -4. In the side pane, select the **Manage members in Azure AD** link. This action takes you to the **Users** view in Azure Active Directory (Azure AD), where you can view and manage your role assignments. +4. On the **Account** tab, under **Roles**, select **Manage roles**. 5. To add or remove a role, use one of the following procedures: | Task | Procedure | |||- | Add a role to a user account | 1. In the [**Users** view in Azure AD](https://portal.azure.com/#view/Microsoft_AAD_UsersAndTenants/UserManagementMenuBlade/~/AllUsers), select a user to open their profile.<br/><br/>2. In the navigation pane, under **Manage**, select **Assigned roles**, and then choose **+ Add assignments**.<br/><br/>3. Search for one of the following roles, select it, and then choose **Add** to assign that role to the user account.<br/>- Global Administrator<br/>- Security Administrator<br/>- Security Reader | - | Remove a role from a user account | 1. In the [**Users** view in Azure AD](https://portal.azure.com/#view/Microsoft_AAD_UsersAndTenants/UserManagementMenuBlade/~/AllUsers), select a user to open their profile.<br/><br/>2. In navigation pane, under **Manage**, select **Assigned roles**.<br/><br/>3. Select one or more administrative roles, and then select **X Remove assignments**. | + | Add a role to a user account | 1. Select **Admin center access**, scroll down, and then expand **Show all by category**.<br/><br/>2. Select one of the following roles:<br/><br/>- Global Administrator (listed under **Global**)<br/>- Security Administrator (listed under **Security & Compliance**)<br/>- Security Reader (listed under **Read-only**)<br/><br/>3. Select **Save changes**. | + | Remove a role from a user account | 1. Either select **User (no admin center access)** to remove *all* admin roles, or clear the checkbox next to one or more of the assigned roles. <br/><br/>2. Select **Save changes**. | ++## [**Microsoft Entra admin center**](#tab/Entra) ++1. Go to the Microsoft Entra admin center ([https://entra.microsoft.com](https://entra.microsoft.com/)) and sign in. ++2. In the navigation pane, go to **Users** > **All users**. ++3. Select a user account to open their profile. ++4. To add or remove a role, use one of the following procedures: ++ | Task | Procedure | + ||| + | Add a role to a user account | 1. Under **Manage**, select **Assigned roles**, and then choose **+ Add assignments**.<br/><br/>2. Search for one of the following roles, select it, and then choose **Add** to assign that role to the user account.<br/><br/>- Global Administrator<br/>- Security Administrator<br/>- Security Reader | + | Remove a role from a user account | 1. Under **Manage**, select **Assigned roles**.<br/><br/>2. Select one or more administrative roles, and then select **X Remove assignments**. | ++ ## Next steps |
| security | Mdb Web Content Filtering | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-web-content-filtering.md | description: Learn how to set up, view, and edit your web content filtering poli Previously updated : 06/20/2023 Last updated : 06/28/2023 In Defender for Business, you can have one web content filtering policy and it's ## Set up web content filtering -1. In the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), choose **Settings** > **Web content filtering** > **+ Add policy**. +1. In the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), go to **Settings** > **Endpoints** > **Rules** > **Web content filtering**, and then select **+ Add policy**. 2. Specify a name and description for your policy. |
| security | Advanced Hunting Query Builder | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-query-builder.md | The query builder in guided mode allows analysts to craft meaningful hunting que The analyst can choose which data set to look at and which filters and conditions to use to narrow the data down to what they need. +You can watch this video to get an overview of guided hunting: ++> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RW12cm6] ## Open Query in builder In the **Advanced hunting** page, select **Create new** to open a new query tab and select **Query in builder**. |
| security | Virus Initiative Criteria | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/intelligence/virus-initiative-criteria.md | Title: Microsoft Virus Initiative description: The Microsoft Virus Initiative (MVI) helps organizations that make antivirus or antimalware products integrate with Windows and share telemetry with Microsoft. -keywords: security, malware, MVI, Microsoft Malware Protection Center, MMPC, alliances, WDSI -ms.sitesec: library ms.localizationpriority: medium The Microsoft Virus Initiative (MVI) helps organizations develop better-together ## Become a member -> [!NOTE] -> The MVI Program is not currently accepting new applications for membership but will reopen for new member applications on June 1, 2023. Please contact MVI@microsoft.com for more information. - You can request membership if you're a representative for an organization that develops and produces antimalware or antivirus technology. To qualify for the MVI program, your organization must meet all the following requirements: |
| security | Anti Spam Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-policies-configure.md | You can configure anti-spam policies in the Microsoft 365 Defender portal or in 5. On the **Bulk email threshold & spam properties** page, configure the following settings: - - **Bulk email threshold**: Specifies the bulk complaint level (BCL) of a message that triggers the specified action for the **Bulk** spam filtering verdict that you configure on the next page. A higher value indicates the message is less desirable (more likely to resemble spam). The default value is 7. For more information, see [Bulk complaint level (BCL) in EOP](anti-spam-bulk-complaint-level-bcl-about.md) and [What's the difference between junk email and bulk email?](anti-spam-spam-vs-bulk-about.md). + - **Bulk email threshold**: Specifies the bulk complaint level (BCL) of a message that triggers the specified action for the **Bulk compliant level (BCL) met or exceeded** spam filtering verdict that you configure on the next page. A higher value indicates the message is less desirable (more likely to resemble spam). The default value is 7. For more information, see [Bulk complaint level (BCL) in EOP](anti-spam-bulk-complaint-level-bcl-about.md) and [What's the difference between junk email and bulk email?](anti-spam-spam-vs-bulk-about.md). - By default, the PowerShell only setting _MarkAsSpamBulkMail_ is `On` in anti-spam policies. This setting dramatically affects the results of a **Bulk** filtering verdict: + By default, the PowerShell only setting _MarkAsSpamBulkMail_ is `On` in anti-spam policies. This setting dramatically affects the results of a **Bulk compliant level (BCL) met or exceeded** filtering verdict: - - **_MarkAsSpamBulkMail_ is On**: A BCL that's greater than or equal to the threshold is converted to an SCL 6 that corresponds to a filtering verdict of **Spam**, and the action for the **Bulk** filtering verdict is taken on the message. - - **_MarkAsSpamBulkMail_ is Off**: The message is stamped with the BCL, but _no action_ is taken for a **Bulk** filtering verdict. In effect, the BCL threshold and **Bulk** filtering verdict action are irrelevant. + - **_MarkAsSpamBulkMail_ is On**: A BCL that's greater than or equal to the threshold is converted to an SCL 6 that corresponds to a filtering verdict of **Spam**, and the action for the **Bulk compliant level (BCL) met or exceeded** filtering verdict is taken on the message. + - **_MarkAsSpamBulkMail_ is Off**: The message is stamped with the BCL, but _no action_ is taken for a **Bulk compliant level (BCL) met or exceeded** filtering verdict. In effect, the BCL threshold and **Bulk compliant level (BCL) met or exceeded** filtering verdict action are irrelevant. - **Spam properties** section: You can configure anti-spam policies in the Microsoft 365 Defender portal or in - **High confidence spam** - **Phishing** - **High confidence phishing**- - **Bulk** + - **Bulk compliant level (BCL) met or exceeded** The available actions for spam filtering verdicts are described in the following table. You can configure anti-spam policies in the Microsoft 365 Defender portal or in ⁵ Users can't release their own messages that were quarantined as high confidence phishing by anti-spam policies, regardless of how the quarantine policy is configured. If the policy allows users to release their own quarantined messages, users are instead allowed to _request_ the release of their quarantined high-confidence phishing messages. - - **Intra-Organizational messages to take action on**: Select what types of intra-organizational messages containing malicious or spam-based URLs to take action on. The default setting is to take no action on messages. The action taken on different spam filtering verdicts for intra-org messages is the same as configured above in the message actions section. -- The default behavior will be updated in the future to take action on high-confidence phishing messages. Additional details on handling malicious intra-organizational messages are communicated through posts in the Message Center Portal. + - **Intra-Organizational messages to take action on**: Controls whether spam filtering and the corresponding verdict actions are applied to internal messages (messages sent between users within the organization). The action that's configured in the policy for the specified spam filter verdicts is taken on messages sent between internal users. The available values are: + - **Default**: This is the default value. Currently, this value is the same as selecting **None**. The behavior for the value **Default** will eventually change to apply the action for high confidence phishing detections in the policy as if you selected **High confidence phishing messages**. Check the Message Center for announcements to changes in this setting. + - **None** + - **High confidence phishing messages** + - **Phishing and high confidence phishing messages** + - **All phishing and high confidence spam messages** + - **All phishing and spam messages** - **Retain spam in quarantine for this many days**: Specifies how long to keep the message in quarantine if you selected **Quarantine message** as the action for a spam filtering verdict. After the time period expires, the message is deleted, and isn't recoverable. A valid value is from 1 to 30 days. |
| security | Anti Spam Protection About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-protection-about.md | The anti-spam settings in EOP are made of the following technologies: - **Connection filtering**: Identifies good and bad email source servers early in the inbound email connection via the IP Allow List, IP Block List, and the *safe list* (a dynamic but non-editable list of trusted senders maintained by Microsoft). You configure these settings in the connection filter policy. Learn more at [Configure connection filtering](connection-filter-policies-configure.md). -- **Spam filtering (content filtering)**: EOP uses the spam filtering verdicts **Spam**, **High confidence spam**, **Bulk email**, **Phishing email** and **High confidence phishing email** to classify messages. You can configure the actions to take based on these verdicts. [Quarantine policies](quarantine-policies.md#anatomy-of-a-quarantine-policy) determine what users are allowed to do to quarantined messages, and whether they receive notifications for their quarantined messages. For more information, see [Configure anti-spam policies in Microsoft 365](anti-spam-policies-configure.md).+- **Spam filtering (content filtering)**: EOP uses the following spam filtering verdicts to classify messages: + - **Spam** + - **High confidence spam** + - **Phishing** + - **High confidence phishing** + - **Bulk**, because the message source met or exceeded the [bulk complaint level (BCL)](anti-spam-bulk-complaint-level-bcl-about.md) threshold. + + You can configure the actions to take based on these verdicts. [Quarantine policies](quarantine-policies.md#anatomy-of-a-quarantine-policy) determine what users are allowed to do to quarantined messages, and whether they receive notifications for their quarantined messages. For more information, see [Configure anti-spam policies in Microsoft 365](anti-spam-policies-configure.md). > [!NOTE]- > By default, spam filtering is configured to send messages that were marked as spam to the recipient's Junk Email folder. However, in hybrid environments where EOP protects on-premises Exchange mailboxes, you need to configure two mail flow rules (also known as transport rules) in your on-premises Exchange organization to recognize the EOP spam headers that are added to messages. For details, see [Configure EOP to deliver spam to the Junk Email folder in hybrid environments](/exchange/standalone-eop/configure-eop-spam-protection-hybrid). + > By default, messages that are marked as **Spam** are delivered and moved to the recipient's Junk Email folder. However, in hybrid environments where EOP protects on-premises Exchange mailboxes, you need to configure two mail flow rules (also known as transport rules) in your on-premises Exchange organization to recognize the EOP spam headers that are added to messages. For details, see [Configure EOP to deliver spam to the Junk Email folder in hybrid environments](/exchange/standalone-eop/configure-eop-spam-protection-hybrid). - **Outbound spam filtering**: EOP also checks to make sure that your users don't send spam, either in outbound message content or by exceeding outbound message limits. For more information, see [Configure outbound spam filtering in Microsoft 365](outbound-spam-policies-configure.md). |
| security | Message Headers Eop Mdo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/message-headers-eop-mdo.md | The individual fields and values are described in the following table. |Field|Description| ||| |`ARC`|The `ARC` protocol has the following fields: <ul><li>`AAR`: Records the content of the **Authentication-results** header from DMARC.</li><li>`AMS`: Includes cryptographic signatures of the message.</li><li>`AS`: Includes cryptographic signatures of the message headers. This field contains a tag of a chain validation called `"cv="`, which includes the outcome of the chain validation as **none**, **pass**, or **fail**.</li></ul>|-|`CAT:`|The category of protection policy, applied to the message: <ul><li>`BULK`: Bulk</li><li>`DIMP`: Domain Impersonation</li><li>`GIMP`: [Mailbox intelligence based impersonation](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)</li><li>`HPHSH` or `HPHISH`: High confidence phishing</li><li>`HSPM`: High confidence spam</li><li>`MALW`: Malware</li><li>`PHSH`: Phishing</li><li>`SPM`: Spam</li><li>`SPOOF`: Spoofing</li><li>`UIMP`: User Impersonation</li><li>`AMP`: Anti-malware</li><li>`SAP`: Safe attachments</li><li>`FTBP`: Anti-malware filetype policy</li><li>`OSPM`: Outbound spam</li></ul> <br/> An inbound message might be flagged by multiple forms of protection and multiple detection scans. Policies have different priorities, and the policy with the highest priority is applied first. For more information, see [What policy applies when multiple protection methods and detection scans run on your email](how-policies-and-protections-are-combined.md).| +|`CAT:`|The category of protection policy, applied to the message: <ul><li>`BULK`: Bulk</li><li>`DIMP`: Domain Impersonation</li><li>`GIMP`: [Mailbox intelligence based impersonation](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)</li><li>`HPHSH` or `HPHISH`: High confidence phishing</li><li>`HSPM`: High confidence spam</li><li>`MALW`: Malware</li><li>`PHSH`: Phishing</li><li>`SPM`: Spam</li><li>`SPOOF`: Spoofing</li><li>`UIMP`: User Impersonation</li><li>`AMP`: Anti-malware</li><li>`SAP`: Safe attachments</li><li>`FTBP`: Anti-malware filetype policy</li><li>`OSPM`: Outbound spam</li><li>`INTOS`: Intra-Org phish action</li></ul> <br/> An inbound message might be flagged by multiple forms of protection and multiple detection scans. Policies have different priorities, and the policy with the highest priority is applied first. For more information, see [What policy applies when multiple protection methods and detection scans run on your email](how-policies-and-protections-are-combined.md).| |`CIP:[IP address]`|The connecting IP address. You can use this IP address in the IP Allow List or the IP Block List. For more information, see [Configure connection filtering](connection-filter-policies-configure.md).| |`CTRY`|The source country as determined by the connecting IP address, which might not be the same as the originating sending IP address.| |`H:[helostring]`|The HELO or EHLO string of the connecting email server.| |
| security | Preset Security Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/preset-security-policies.md | The differences in meaningful policy settings in the Standard preset security po ||::|::| |**Anti-malware policy**|No difference|No difference| |**Anti-spam policy**|||-| **Bulk** detection action (_BulkSpamAction_)|**Move message to Junk Email folder** (`MoveToJmf`)|**Quarantine message** (`Quarantine`)| +| **Bulk compliant level (BCL) met or exceeded** detection action (_BulkSpamAction_)|**Move message to Junk Email folder** (`MoveToJmf`)|**Quarantine message** (`Quarantine`)| | **Bulk email threshold** (_BulkThreshold_)|7|6| | **Spam** detection action (_SpamAction_)|**Move message to Junk Email folder** (`MoveToJmf`)|**Quarantine message** (`Quarantine`)| |**Anti-phishing policy**||| |
| security | Protect Against Threats | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/protect-against-threats.md | For more information about the recommended settings for anti-spam, see [EOP anti - **High confidence spam**: Select **Quarantine message**. - **Phishing**: Select **Quarantine message**. - **High confidence phishing**: Verify **Quarantine messages** is selected.- - **Bulk**: Verify **Move message to Junk Email folder** is selected (Standard) or select **Quarantine message** (Strict). + - **Bulk compliant level (BCL) met or exceeded**: Verify **Move message to Junk Email folder** is selected (Standard) or select **Quarantine message** (Strict). For each action where you select **Quarantine message**, leave the default value in the **Select quarantine policy** box that appears (including blank values) to use the default [quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy) that applies to messages that are quarantined by anti-spam protection. |
| security | Recommended Settings For Eop And Office365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365.md | Admins can create or use quarantine policies with more restrictive or less restr |**Quarantine policy** for **Phishing** (_PhishQuarantineTag_)|DefaultFullAccessPolicy┬╣|DefaultFullAccessWithNotificationPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if phishing detections are quarantined.| |**High confidence phishing** detection action (_HighConfidencePhishAction_)|**Quarantine message** (`Quarantine`)|**Quarantine message** (`Quarantine`)|**Quarantine message** (`Quarantine`)|Users can't release their own messages that were quarantined as high confidence phishing, regardless of how the quarantine policy is configured. If the policy allows users to release their own quarantined messages, users are instead allowed to _request_ the release of their quarantined high-confidence phishing messages.| |**Quarantine policy** for **High confidence phishing** (_HighConfidencePhishQuarantineTag_)|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy||-|**Bulk** detection action (_BulkSpamAction_)|**Move message to Junk Email folder** (`MoveToJmf`)|**Move message to Junk Email folder** (`MoveToJmf`)|**Quarantine message** (`Quarantine`)|| -|**Quarantine policy** for **Bulk** (_BulkQuarantineTag_)|DefaultFullAccessPolicy┬╣|DefaultFullAccessPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if bulk detections are quarantined.| +|**Bulk compliant level (BCL) met or exceeded** (_BulkSpamAction_)|**Move message to Junk Email folder** (`MoveToJmf`)|**Move message to Junk Email folder** (`MoveToJmf`)|**Quarantine message** (`Quarantine`)|| +|**Quarantine policy** for **Bulk compliant level (BCL) met or exceeded** (_BulkQuarantineTag_)|DefaultFullAccessPolicy┬╣|DefaultFullAccessPolicy|DefaultFullAccessWithNotificationPolicy|The quarantine policy is meaningful only if bulk detections are quarantined.| +|**Intra-Organizational messages to take action on** (_IntraOrgFilterState_)|**Default** (Default)|**Default** (Default)|**Default** (Default)|Currently, the value **Default** is the same as selecting **None**. The behavior for the value **Default** will eventually change to apply the action for high confidence phishing detections in the policy as if you selected **High confidence phishing messages**. Check the Message Center for announcements to changes in this setting.| |**Retain spam in quarantine for this many days** (_QuarantineRetentionPeriod_)|15 days|30 days|30 days|This value also affects messages that are quarantined by anti-phishing policies. For more information, see [Quarantined email messages in EOP](quarantine-about.md).| |**Enable spam safety tips** (_InlineSafetyTipsEnabled_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| |Enable zero-hour auto purge (ZAP) for phishing messages (_PhishZapEnabled_)|Selected (`$true`)|Selected (`$true`)|Selected (`$true`)|| |
| solutions | Allow Members To Send As Or Send On Behalf Of Group | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/allow-members-to-send-as-or-send-on-behalf-of-group.md | The **Send on Behalf** permission lets a user send email on behalf of a Microsof ## Allow members to send email as a group -This section explains how to allow users to send email as a group in the<a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center (EAC)</a> in Exchange Online. +This section explains how to allow users to send email as a group in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center (EAC)</a> in Exchange Online. 1. In the Exchange admin center, go to **Recipients** \> <a href="https://go.microsoft.com/fwlink/?linkid=2183233" target="_blank">**Groups**</a>. |