| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Create An Apns Certificate For Ios Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/create-an-apns-certificate-for-ios-devices.md | To manage iOS devices such as iPads and iPhones in Basic Mobility and Security, 1. Sign in to Microsoft 365 with your global admin account. -2. In your browser, type <https://protection.office.com/>. +1. Go to the [Microsoft 365 admin center](https://portal.office.com/adminportal/home?#/MifoDevices), and choose **APNs Certificate for iOS**. -3. Select **Data loss prevention** \> **Device management**, and choose **APNs Certificate for iOS devices**. +1. On the Apple Push Notification Certificate Settings page, choose **Next**. -4. On the Apple Push Notification Certificate Settings page, choose **Next**. +1. Select Download your CSR file and save the certificate signing request to somewhere on your computer that you'll remember. Select **Next**. -5. Select Download your CSR file and save the certificate signing request to somewhere on your computer that you'll remember. Select **Next**. --6. On the Create an APNs certificate page: +1. On the Create an APNs certificate page: 1. Select Apple APNS Portal to open the Apple Push Certificates Portal. To manage iOS devices such as iPads and iPhones in Basic Mobility and Security, > [!TIP] > If you're having trouble downloading the certificate, refresh your browser. -7. Go back to Microsoft 365, and select **Next** to get to the **Upload APNS certificate** page. +1. Go back to Microsoft 365, and select **Next** to get to the **Upload APNS certificate** page. -8. Browse to the APN certificate you downloaded from the Apple Push Certificates Portal. +1. Browse to the APN certificate you downloaded from the Apple Push Certificates Portal. -9. Select **Finish**. +1. Select **Finish**. To complete setup, go back to the Security & Compliance Center \> **Security policies** \> **Device management** \> **Manage settings**. |
| admin | Create Device Security Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/create-device-security-policies.md | You can use Basic Mobility and Security to create device policies that help prot Before you can start, make sure you have activated and set up Basic Mobility and Security. For instructions, see [Overview of Basic Mobility and Security](overview.md). -1. From your browser, type <https://protection.office.com/devicev2>. +1. From your browser, type <https://compliance.microsoft.com/basicmobilityandsecurity>. 2. Select **Create a policy**. - :::image type="content" source="../../media/basic-mobility-security/bms-4-policy.png" alt-text="Basic Mobility and Security policy settings."::: + :::image type="content" source="../../media/basic-mobility-security/basic-mobility-microsoft-purview.png" alt-text="Basic Mobility and Security policy settings."::: 3. On the **Policy settings** page, specify the requirements you want applied to mobile devices in your organization. The policy is pushed to the device of each user the policy applies to the next t After youΓÇÖve created a device policy, check that the policy works as you expect before you deploy it to your organization. -1. From your browser, type [https://protection.office.com/devicev2](https://protection.office.com/devicev2). +1. From your browser, type [https://compliance.microsoft.com/basicmobilityandsecurity](https://compliance.microsoft.com/basicmobilityandsecurity). 2. Select **View the list of managed devices**. 3. Check the status of user devices that have the policy applied. You want the **State** of devices to be **Managed.** 4. You can also do a full or selective wipe on a device by clicking on **Factory reset** or **Remove company data** from **Manage** button after selecting a device. For instructions, see [Wipe a mobile device in Microsoft 365. After youΓÇÖve created a device policy, check that the policy works as you expec After youΓÇÖve created a device policy and verified that it works as expected, deploy it to your organization. -1. From your browser type: [https://protection.office.com/devicev2](https://protection.office.com/devicev2). +1. From your browser type: [https://compliance.microsoft.com/basicmobilityandsecurity](https://compliance.microsoft.com/basicmobilityandsecurity). 2. Select the policy you want to deploy, and choose **Edit** next to **Groups applied to.** 3. Search for a group to add and click on **Select**. 4. Select **Close** and **Change setting.** To help secure your organization information, you should block app access to Mic **To block app access:** -1. From your browser, type [https://protection.office.com/devicev2](https://protection.office.com/devicev2). +1. From your browser, type [https://compliance.microsoft.com/basicmobilityandsecurity](https://compliance.microsoft.com/basicmobilityandsecurity). 2. Select **Manage organization-wide device access settings**.-3. To block unsupported devices, choose **Block** under **If a device isn't supported by Basic Mobility and Security for Microsoft 365**, and then select **Save**. +3. To block unsupported devices, choose **Access** under **If a device isn't supported by Basic Mobility and Security for Microsoft 365**, and then select **Save**. - :::image type="content" source="../../media/basic-mobility-security/bms-5-block-access.png" alt-text="Basic Mobility and Security block access option."::: + :::image type="content" source="../../media/basic-mobility-security/basic-mobility-access.png" alt-text="Basic Mobility and Security block access option."::: ## Step 5: Choose security groups to be excluded from conditional access checks If you want to exclude some people from conditional access checks on their mobile devices and you've created one or more security groups for those people, add the security groups here. The people in these groups won't have any policies enforced for their supported mobile devices. This is the recommended option if you no longer want to use Basic Mobility and Security in your organization. -1. From your browser, type [https://protection.office.com/devicev2](https://protection.office.com/devicev2). +1. From your browser, type [https://compliance.microsoft.com/basicmobilityandsecurity](https://compliance.microsoft.com/basicmobilityandsecurity). 2. Select **Manage organization-wide device access settings**. - :::image type="content" source="../../media/basic-mobility-security/bms-4-policy.png" alt-text="Basic Mobility and Security create a policy option."::: + :::image type="content" source="../../media/basic-mobility-security/basic-mobility-microsoft-purview.png" alt-text="Basic Mobility and Security create a policy option."::: 3. Select **Add** to add the security group that has users you want to exclude from having blocked access to Microsoft 365. When a user has been added to this list, they can access Microsoft 365 email when they are using an unsupported device. If you want to exclude some people from conditional access checks on their mobil 6. On the **Organization-wide device access settings** panel, choose **Save**. - :::image type="content" source="../../media/basic-mobility-security/bms-8-allow-access.png" alt-text="Basic Mobility and Security allow access option."::: + :::image type="content" source="../../media/basic-mobility-security/basic-mobility-groups.png" alt-text="Basic Mobility and Security allow access option."::: ## What is the impact of security policies on different device types? |
| admin | Manage Device Access Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/manage-device-access-settings.md | Use these steps: 3. Go to **Data loss prevention** \> **Device management** \> **Device policies**, and select **Manage organization-wide device access settings**. -4. Select **Block**. +4. Select **Access**. - :::image type="content" source="../../media/basic-mobility-security/bms-5-block-access.png" alt-text="Basic Mobility and Security block access checkbox."::: + :::image type="content" source="../../media/basic-mobility-security/basic-mobility-access.png" alt-text="Basic Mobility and Security block access checkbox."::: 5. Select **Save**. |
| admin | Manage Enrolled Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/manage-enrolled-devices.md | After you've set it up, the people in your organization must enroll their device To get to the device management panel, follow these steps: -1. Go to the [Microsoft 365 admin center](../../admin/admin-overview/admin-center-overview.md). +1. Sign in to the Microsoft 365 admin center, and go to the [Mobile Device Management page](https://portal.office.com/adminportal/home?#/MifoDevices). -2. Type Mobile Device Management into the search field, and select **Mobile Device Management** from the list of results. -- :::image type="content" source="../../media/basic-mobility-security/bms-6-mobile-device-management-option.png" alt-text="Mobile device management option."::: --3. Select **Let's get started**. +1. Select **Let's get started**. ## Manage mobile devices |
| admin | Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/overview.md | Here's a summary of the steps: **Step 3:** Create device policies and apply them to groups of users. When you do this, your users get an enrollment message on their device, and when they've completed enrollment, their devices are restricted by the policies you've set up for them. For more info, see [Enroll your mobile device using Basic Mobility and Security](enroll-your-mobile-device.md). ## Device management tasks |
| admin | Set Up | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/set-up.md | To manage iOS devices like iPad and iPhones, you need to create an APNs certific 1. Sign in to Microsoft 365 with your global admin account. -2. In your browser type: [https://protection.office.com](https://protection.office.com/). --3. Select **Data loss prevention** > **Device management**, and choose **APNs Certificate for iOS devices**. +2. Go to the [Microsoft 365 admin center](https://portal.office.com/adminportal/home?#/MifoDevices), and choose **APNs Certificate for iOS**. 4. On the Apple Push Notification Certificate Settings page, choose **Next**. The next step is to create and deploy device security policies to help protect y 3. Go to **Device policies**. - :::image type="content" source="../../media/basic-mobility-security/bms-4-policy.png" alt-text="Basic Security and Mobility policy settings."::: + :::image type="content" source="../../media/basic-mobility-security/basic-mobility-microsoft-purview.png" alt-text="Basic Security and Mobility policy settings."::: 4. Create and deploy device security policies appropriate for your organization following the steps in [Create device security policies in Basic Mobility and Security](create-device-security-policies.md). |
| admin | Turn Off | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/turn-off.md | These options remove Basic Mobility and Security enforcement for devices in your ## Remove user security groups from Basic Mobility and Security device policies -1. In your browser type: [https://protection.office.com/devicev2](https://protection.office.com/devicev2). +1. In your browser type: [https://compliance.microsoft.com/basicmobilityandsecurity](https://compliance.microsoft.com/basicmobilityandsecurity). 2. Select a device policy, and select **Edit policy**. These options remove Basic Mobility and Security enforcement for devices in your ## Remove Basic Mobility and Security device policies -1. In your browser type: [https://protection.office.com/devicev2](https://protection.office.com/devicev2). +1. In your browser type: [https://compliance.microsoft.com/basicmobilityandsecurity](https://compliance.microsoft.com/basicmobilityandsecurity). 2. Select a device policy, and then select **Delete policy**. |
| admin | Wipe Mobile Device | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/basic-mobility-security/wipe-mobile-device.md | Mobile devices can store sensitive organizational information and provide access ## Wipe a mobile device -1. Go to the [Microsoft 365 admin center](../../admin/admin-overview/admin-center-overview.md). +1. Sign in to the Microsoft 365 admin center, and go to the [Mobile Device Management page](https://portal.office.com/adminportal/home?#/MifoDevices). -2. Type Mobile Device Management into the search field, and select **Mobile Device Management** from the list of results. +1. Select **Manage devices**. - :::image type="content" source="../../media/basic-mobility-security/bms-6-mobile-device-management-option.png" alt-text="Basic Mobility and Secruity mobile device management option."::: +1. Select the device you want to wipe. -3. Select **Manage devices**. +1. Select **Manage**. -4. Select the device you want to wipe. --5. Select **Manage**. --6. Select the type of remote wipe you want to do. +1. Select the type of remote wipe you want to do. - To do a full wipe and restore the device to its factory settings, select **Factory reset**. - To do a selective wipe and delete only Microsoft 365 organization information, select **Remove company data**. - To remove the device from your organization, select **Remove device**. -7. Select **Yes** to confirm. +1. Select **Yes** to confirm. ## How do I know it worked? |
| admin | Create A Shared Mailbox | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/email/create-a-shared-mailbox.md | You can use the following permissions with a shared mailbox: - **Send on Behalf**: The Send on Behalf permission lets a user send email on behalf of the shared mailbox. For example, if John logs into the shared mailbox Reception Building 32 and sends an email, it will look like the mail was sent by "John on behalf of Reception Building 32". You can't use the EAC to grant Send on Behalf permissions, you must use the **Set-Mailbox** cmdlet with the _GrantSendonBehalf_ parameter. +> [!NOTE] +> The **Send As** and **Send on Behalf** permissions do not work in the Outlook desktop client with the *HiddenFromAddressListsEnabled* parameter on the mailbox set to **True**, since they require the mailbox to be visible in Outlook via the Global Address List. + ### Use the EAC to edit shared mailbox delegation 1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a>, go to **Recipients** \> **Mailboxes**. Select the shared mailbox, and then select **Edit** . |
| business-premium | M365bp Increase Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-increase-protection.md | The following image shows some of the default policies that are included with Mi ### View your alert policies -1. Go to the Microsoft 365 Compliance center at [https://compliance.microsoft.com](https://compliance.microsoft.com) and sign in. +1. Go to the Microsoft Purview compliance portal at [https://compliance.microsoft.com](https://compliance.microsoft.com) and sign in. 2. In the navigation pane, choose **Policies**, and then choose **Alert policies**. The following image shows some of the default policies that are included with Mi ### How to view alerts -Depending on the specific alert, you can view your alerts in either the Microsoft 365 Defender portal or the Microsoft 365 Compliance center. +Depending on the specific alert, you can view your alerts in either the Microsoft 365 Defender portal or the Microsoft Purview compliance portal. | Type of alert | What to do | ||| | Security alert, such as when a user clicks a malicious link, an email is reported as malware or phish, or a device is detected as containing malware | Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a> and under **Email & collaboration** select **Policies & rules** > **Alert policy**. Alternatively, you can go directly to <https://security.microsoft.com/alertpolicies>. |-| Compliance alert, such as when a user shares sensitive or confidential information (data loss prevention alert) or there's an unusual volume of external file sharing (information governance alert) | Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft 365 compliance center</a>, and then select **Policies** > **Alert** > **Alert policies**. | +| Compliance alert, such as when a user shares sensitive or confidential information (data loss prevention alert) or there's an unusual volume of external file sharing (information governance alert) | Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft Purview compliance portal</a>, and then select **Policies** > **Alert** > **Alert policies**. | For more information, see [View alerts](../compliance/alert-policies.md#view-alerts). |
| commerce | Cancel Your Subscription | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/cancel-your-subscription.md | If you need to cancel within seven days after the start or renewal of your subsc If more than seven days have passed, [turn off recurring billing](renew-your-subscription.md). This prevents your subscription from renewing at the end of its term. You keep access to your products and services for the remainder of your subscription. If you have an annual subscription and are paying monthly, you are charged each month for the remainder of your subscription term. +> [!NOTE] +> Cancel your free trial any time to stop future charges. After your 1-month free trial, you will be charged the applicable subscription fee. + ### If you don't have a billing profile If you cancel after you start or renew your subscription, you receive a prorated credit or refund. The amount is either credited towards your next invoice or returned to you in the next billing cycle. |
| compliance | Auditing Solutions Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/auditing-solutions-overview.md | The following sections identify the licensing requirements for Audit (Standard) ### Audit (Standard) - Microsoft Business Basic subscription+- Microsoft Business Standard subscription - Microsoft 365 Apps for Business subscription - Microsoft 365 Enterprise E3 subscription - Microsoft 365 Business Premium |
| compliance | Classifier Learn About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/classifier-learn-about.md | Sensitivity labels can use classifiers as conditions, see [Apply a sensitivity l Microsoft 365 comes with multiple pre-trained classifiers: -> [!CAUTION] -> We are deprecating the **Offensive Language** pre-trained classifier because it has been producing a high number of false positives. Don't use it and if you are currently using it, you should move your business processes off of it. We recommend using the **Threat**, **Profanity**, and **Harassment** pre-trained classifiers instead. - - **Agreements**: Detects content related to legal agreements such as non-disclosure agreements, statements of work, loan and lease agreements, employment and non-compete agreements. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml files. - **Resumes**: detects docx, .pdf, .rtf, .txt items that are textual accounts of an applicant's personal, educational, professional qualifications, work experience, and other personally identifying information Microsoft 365 comes with multiple pre-trained classifiers: - **Source Code**: detects items that contain a set of instructions and statements written in the top 25 used computer programming languages on GitHub: ActionScript, C, C#, C++, Clojure, CoffeeScript, Go, Haskell, Java, JavaScript, Lua, MATLAB, Objective-C, Perl, PHP, Python, R, Ruby, Scala, Shell, Swift, TeX, Vim Script. -> [!NOTE] -> Source Code is trained to detect when the bulk of the text is source code. It does not detect source code text that is interspersed with plain text. + > [!NOTE] + > Source Code is trained to detect when the bulk of the text is source code. It does not detect source code text that is interspersed with plain text. - **Tax**: Detects Tax relation content such as tax planning, tax forms, tax filing, tax regulations. Detects content in .docx, .docm, .doc, .dotx, .dotm, .dot, .pdf, .rtf, .txt, .one, .msg, .eml, .pptx, .pptm, .ppt, .potx, .potm, .pot, .ppsx, .ppsm, .pps, .ppam, .ppa, .xlsx, .xlsm, .xlsb, .xls, .csv, .xltx, .xltm, .xlt, .xlam, xla files. These appear in the **Microsoft Purview compliance portal** > **Data classificat Pre-trained classifiers can scan content in these languages: +- Arabic - Chinese (Simplified)+- Chinese (Traditional) +- Dutch - English - French - German - Italian+- Korean - Japanese - Portuguese - Spanish |
| compliance | Communication Compliance Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-policies.md | To copy a policy, users must be a member of the *Communication Compliance* or *C To copy a policy and create a new policy, complete the following steps: 1. Select the policy you want to copy.-2. Select **Copy policy** command bar button on the command bar, or select **Copy policy** from the action menu for the policy. -3. In the **Copy policy** pane, you can accept the default name for the policy in the **Policy name** field or rename the policy. The policy name for the new policy canΓÇÖt be the same as an existing active or deactivated policy. Complete the **Description** field as needed. +2. Select **Copy policy** command bar button on the command bar or select **Copy policy** from the action menu for the policy. +3. In the **Copy policy** pane, you can accept the default name for the policy in the **Policy name** field or rename the policy. The policy name for the new policy can't be the same as an existing active or deactivated policy. Complete the **Description** field as needed. 4. If you don't need further customization of the policy, select **Copy policy** to complete the process. If you need to update the configuration of the new policy, select **Customize policy**. This starts the policy wizard to help you update and customize the new policy. ## User-reported messages policy Configure custom keyword dictionaries (or lexicons) to provide simple management ### Classifiers -Built-in trainable and global classifiers scan sent or received messages across all communication channels in your organization for different types of compliance issues. Classifiers use a combination of artificial intelligence and keywords to identify language in messages likely to violate anti-harassment policies. Built-in classifiers currently support message keyword identification in several languages: +[Built-in trainable and global classifiers](/microsoft-365/compliance/classifier-learn-about) scan sent or received messages across all communication channels in your organization for different types of compliance issues. Classifiers use a combination of artificial intelligence and keywords to identify language in messages likely to violate anti-harassment policies. Built-in classifiers currently support message keyword identification in several languages: - Arabic - Chinese (Simplified) Built-in trainable and global classifiers scan sent or received messages across Communication compliance built-in trainable and global classifiers scan communications for terms, images, and sentiment for the following types of language and content: - **Adult images**: Scans for images that are sexually explicit in nature.+- **Customer Complaints**: Scans for feedback and complaints made about your organization's products or services. - **Discrimination**: Scans for explicit discriminatory language and is particularly sensitive to discriminatory language against the African American/Black communities when compared to other communities. - **Gory images**: Scans for images that depict violence and gore.+- **Harassment**: Scans for offensive conduct targeting people regarding race, color, religion, national origin. - **Profanity**: Scans for profane expressions that embarrass most people. - **Racy images**: Scans for images that are sexually suggestive in nature, but contain less explicit content than images deemed Adult.-- **Targeted harassment**: Scans for offensive conduct targeting people regarding race, color, religion, national origin. - **Threat**: Scans for threats to commit violence or physical harm to a person or property. The *Adult*, *Racy*, and *Gory* image classifiers scan files in .jpeg, .png, .gif, and .bmp formats. The size for image files must be less than 4 megabytes (MB) and the dimensions of the images must be greater than 50x50 pixels and greater than 50 kilobytes (KB) for the image to qualify for evaluation. Image identification is supported for Exchange Online email messages and Microsoft Teams channels and chats. The built-in trainable and global classifiers don't provide an exhaustive list o > [!NOTE] > Policies using classifiers will inspect and evaluate messages with a word count of six or greater. Messages containing less than six words aren't evaluated in policies using classifiers. To identify and take action on shorter messages containing inappropriate content, we recommend including a custom keyword dictionary to communication compliance policies monitoring for this type of content. -For information about trainable classifiers, see [Getting started with trainable classifiers](classifier-get-started-with.md). - ### Optical character recognition (OCR) Configure built-in or custom communication compliance policies to scan and identify printed or handwritten text from images that may be inappropriate in your organization. Integrated [Azure Cognitive Services and optical scanning support](/azure/cognitive-services/computer-vision/overview-ocr) for identifying text in images help analysts and investigators detect and act on instances where inappropriate conduct may be missed in communications that is primarily non-textual. |
| compliance | Get Started With Data Lifecycle Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/get-started-with-data-lifecycle-management.md | If you have a scenario that requires data management of individual items, see th See the following section for information about end-user documentation to support Microsoft 365 retention. -The data lifecycle management capabilities for inactive mailboxes and import of PST files don't require end-user documentation because these are admin operations only. To help users understand and interact with their archive mailboxes in Outlook after you've enabled this capability, see [Manage email storage with online archive mailboxes](https://prod.support.services.microsoft.com/en-us/office/manage-email-storage-with-online-archive-mailboxes-1cae7d17-7813-4fe8-8ca2-9a5494e9a721). +The data lifecycle management capabilities for inactive mailboxes and import of PST files don't require end-user documentation because these are admin operations only. To help users understand and interact with their archive mailboxes in Outlook after you've enabled this capability, see [Manage email storage with online archive mailboxes](https://support.microsoft.com/office/manage-email-storage-with-online-archive-mailboxes-1cae7d17-7813-4fe8-8ca2-9a5494e9a721). ### End-user documentation for retention and deletion |
| compliance | Limits Ediscovery20 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/limits-ediscovery20.md | This article describes the limits in the Microsoft Purview eDiscovery (Premium) The following table lists the limits for cases and review sets in eDiscovery (Premium). -|Description of limit|Limit| -||| -|Total number of documents that can be added to a case (for all review sets in a case).|Up to 40 million (New case format)| -|Total file size per load set. This includes loading non-Office 365 into a review set.|Up to 1TB (New case format)| -|Total amount of data loaded into all review sets in the organization per day.<br/>|2 TB| -|Maximum number of load sets per case.|200| -|Maximum number of review sets per case.|20| -|Maximum number of tag groups per case.|1,000| -|Maximum number of unique tags per case.|1,000<sup>1</sup>| -|Maximum concurrent jobs in your organization to add content to a review set. These jobs are named **Adding data to a review set** and are displayed on the **Jobs** tab in a case.|10<sup>2</sup>| -|Maximum concurrent jobs to add content to a review set per user. These jobs are named **Adding data to a review set** and are displayed on the **Jobs** tab in a case.|3| +|Description of limit|Classic Case Limit|New Case Limit| +|||| +|Total number of documents that can be added to a case (for all review sets in a case).|3 million|40 million| +|Total file size per load set. This includes loading non-Office 365 into a review set.|300 GB|1 TB| +|Total amount of data loaded into all review sets in the organization per day.<br/>|2 TB|2 TB| +|Maximum number of load sets per case.|200|200| +|Maximum number of review sets per case.|20|20| +|Maximum number of tag groups per case.|1,000|1,000| +|Maximum number of unique tags per case.|1,000<sup>1</sup>|1,000<sup>1</sup>| +|Maximum concurrent jobs in your organization to add content to a review set. These jobs are named **Adding data to a review set** and are displayed on the **Jobs** tab in a case.|10<sup>2</sup>|10<sup>2</sup>| +|Maximum concurrent jobs to add content to a review set per user. These jobs are named **Adding data to a review set** and are displayed on the **Jobs** tab in a case.|3|3| ## Hold limits |
| compliance | Use Notifications And Policy Tips | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/use-notifications-and-policy-tips.md | When you create a DLP policy, you can configure the user notifications to: When you create a DLP policy, you can enable **User notifications**. When user notifications are enabled, Microsoft 365 sends out both email notifications and policy tips. You can customize who notification emails are sent to, the email text and the policy tip text. -1. Go to [https://(https://compliance.microsoft.com/permissions](https://(https://compliance.microsoft.com/permissions). +1. Go to the [Microsoft Purview compliance portal](https://compliance.microsoft.com/permissions). 2. Sign in using your work or school account. Currently, Outlook 2013 and later supports showing policy tips only for these co - Content contains - Content is shared -Note that Exceptions are considered conditions and all of these conditions work in Outlook, where they will match content and enforce protective actions on content. But showing policy tips to users is not yet supported. Also, Outlook does not support showing policy tips for a DLP policy that's applied to a dynamic distribution group. +Note that Exceptions are considered conditions and all of these conditions work in Outlook, where they will match content and enforce protective actions on content. But showing policy tips to users is not yet supported. ++> [!NOTE] +> Outlook does not support showing policy tips for a DLP polies that's applied to a dynamic distribution group or non-email enabled security groups. ### Policy tips in the Exchange admin center vs. the Microsoft Purview Compliance portal |
| enterprise | Data Move Faq | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/data-move-faq.md | + + Title: "Data move general FAQ" +++ Last updated : 05/31/2022+audience: ITPro +++ms.localizationpriority: medium +search.appverid: +- MET150 +f1.keywords: +- NOCSH +description: Find answers to frequently asked questions (FAQs) about moving core data to a new Office 365 datacenter geo. ++++# Data move general FAQ ++Here are answers to general questions about moving core customer data at rest to a new datacenter geo. ++### What customers are eligible to request a move? +<details><summary>Click to expand</summary> ++Existing Microsoft 365 commercial customers who selected a country eligible for the new datacenter geo will be able to request a move. The program exists only for tenants with an eligible country code assigned to the Microsoft 365 tenant to migrate core customer data at rest for eligible workloads to the corresponding Microsoft 365 datacenter geo. See [How to request your data move](request-your-data-move.md) to confirm country eligibility. ++</details> ++### How do we define Core Customer Data? +<details><summary>Click to expand</summary> ++Core customer data is a term that refers to a subset of customer data defined in the [Microsoft Online Services Terms](https://aka.ms/ost): ++- Exchange Online mailbox content (email body, calendar entries, and the content of email attachments) +- SharePoint Online site content and the files stored within that site +- Files uploaded to OneDrive for Business ++</details> ++### What is in scope for Teams migration? +<details><summary>Click to expand</summary> ++In addition to Exchange Online, SharePoint Online, and OneDrive for Business; Microsoft will migrate Teams data to the local datacenter. ++- Teams chat messages, including private messages and channel messages. +- Teams images used in chats. ++Teams files are stored in SharePoint Online and Teams chat files are stored in OneDrive for Business. Voicemail, calendar, and contacts are stored in Exchange Online. In many cases, Exchange Online, SharePoint Online, and OneDrive for Business are already used by the customer in the local datacenter geo and are also part of the Microsoft 365 migration program for eligible customer countries. ++</details> ++### At what point is my migration complete so that my tenant's core customer data is being stored at rest in my new geo? +<details><summary>Click to expand</summary> ++Due to shared dependencies between Exchange Online and SharePoint Online/OneDrive for Business, any migration cannot be considered +completed until both services are migrated. Exchange Online and SharePoint Online/OneDrive for Business often migrate at separate times and independently from one another. Customer tenant admins receive confirmation in Message Center when each service migration is completed and can view the data location card in the Admin Center at any time to confirm the core customer data at rest location for +each service. ++</details> ++### How do you make sure my customer data is safe during the move and that I won't experience downtime? +<details><summary>Click to expand</summary> ++Data moves are a back-end service operation with minimal impact to end users. Features that can be impacted are listed in [During and after your data move](during-and-after-your-data-move.md). We adhere to the [Microsoft Online Services Service Level Agreement (SLA)](https://go.microsoft.com/fwlink/p/?LinkId=523897) for availability so there is nothing that customers need to prepare for or to monitor during the move. ++All Microsoft 365 services run the same versions in the datacenters, so you can be assured of consistent functionality. Your service is fully supported throughout the process. ++</details> ++### What is the impact of having different services located in different geos? +<details><summary>Click to expand</summary> ++Some of the Microsoft 365 services may be located in different geos for some existing customers and for customers that are in the middle of the move process. Our services run independently of each other and there is no impact on the user experience if this is the case. However, for data residency purposes, a tenant migration cannot be considered as complete until both Exchange Online and SharePoint Online/OneDrive for Business are migrated to the same datacenter geo. ++</details> ++### Where is my core customer data located? +<details><summary>Click to expand</summary> ++Customer tenant admins can view the data location card in the Admin Center at any time to confirm the core customer data at rest location for each service, specifically for their tenant. We also publish the location of datacenter geos, datacenters, and location of Office 365 customer data on the [Microsoft 365 interactive datacenter maps](https://office.com/datamaps) as a reference for the current default core customer data at rest locations for new tenants. You can verify the location of your customer data at rest via the Data Location section under your Organization Profile in the Microsoft 365 admin center. ++</details> ++### When will I be able to request a move? +<details><summary>Click to expand</summary> ++Please refer to the [How to request your data move](request-your-data-move.md) page for supported timeframes for your datacenter geo. ++</details> ++### How can I request to be moved? +<details><summary>Click to expand</summary> ++Eligible customers will see a page in their [Microsoft 365 admin center](https://admin.microsoft.com/). Please see [How to request your data move](request-your-data-move.md) for instructions on how to request a move. ++</details> ++### Can I change my selection after requesting a move? +<details><summary>Click to expand</summary> ++It is not possible for us to remove you from the process after you submit your request. ++</details> ++### What happens if I do not request a move before the deadline? +<details><summary>Click to expand</summary> ++We cannot accept requests for migration after the open enrollment period. ++</details> ++### What if I want to move my data in order to get better network performance? +<details><summary>Click to expand</summary> ++Physical proximity to a Microsoft 365 datacenter is not a guarantee for a better networking performance. There are many factors and components that affect the network performance between the end user and the Microsoft 365 service. For more information about this and performance tuning, see [Network planning and performance tuning for Microsoft 365](network-planning-and-performance.md). ++</details> ++### Do all the services move their data on the same day? +<details><summary>Click to expand</summary> ++Each service moves independently and will likely move their data at different times. ++</details> ++### Can I choose when I want my data to be moved? +<details><summary>Click to expand</summary> ++Customers are not able to select a specific date, they cannot delay their move, and we cannot share a specific date or timeframe for the moves. ++</details> ++### Can you share when my data will be moved? +<details><summary>Click to expand</summary> ++Data moves are a back-end operation with minimal impact to end users. The complexity, precision, and scale at which we need to perform data moves within a globally operated and automated environment prohibit us from sharing when a data move is expected to complete for your tenant or any other single tenant. Customers will receive one confirmation in Message Center per participating service when its data move has completed. ++</details> ++### What happens if users access services while the data is being moved? +<details><summary>Click to expand</summary> ++See [During and after your data move](during-and-after-your-data-move.md) for a complete list of features that may be limited during portions of the data move for each service. ++</details> ++### How do I know the move is complete? +<details><summary>Click to expand</summary> ++Watch the Microsoft 365 Message Center for confirmation that the move of each service's data is complete. When each service's data is moved, we'll post a completion notice so you'll get three completion notices: one each for Exchange Online, SharePoint Online, and Skype for Business Online. You can also verify the location of your customer data at rest via the Data Location section under your Organization Profile in the Microsoft 365 admin center. ++</details> ++### I am a Microsoft 365 customer in one of the new datacenter geos, but when I signed up, I selected a different country. How can I be moved to the new datacenter geo? +<details><summary>Click to expand</summary> ++It is not possible to change the signup country associated with your tenant. Instead, you need to create a new Microsoft 365 tenant with a new subscription and manually move your users and data to the new tenant. ++</details> ++### What happens if we are in process of email data migration to Microsoft 365 during the Exchange Online move? +<details><summary>Click to expand</summary> ++This is a very common scenario and is fully supported. Cloud migration between datacenter geos does not interfere with any on-premises to cloud mailbox migrations. ++</details> ++### Can I pilot some users? +<details><summary>Click to expand</summary> ++You can create a separate trial tenant to test connectivity, but the trial tenant can't be combined in any way with your existing tenant. ++</details> ++### I don't want to wait for Microsoft to move my data. Can I just create a new tenant and move myself? +<details><summary>Click to expand</summary> ++Yes, however the process will not be as seamless as if Microsoft were to perform the data move. ++If you create a new tenant after the new datacenter geo is available, the new tenant will be hosted in the new geo. This new tenant is completely separate from your previous tenant and you would be responsible for moving all user mailboxes, site content, domain names, and any other data. Note that you can't move the tenant name from one tenant to another. We recommend that you wait for the move program provided by Microsoft as we'll take care of moving all settings, data, and subscriptions for your users. ++</details> ++### My customer data has already been moved to a new datacenter geo. Can I move back? +<details><summary>Click to expand</summary> ++No, this is not possible. Customers who have been moved to new geo datacenters cannot be moved back. As a customer in any geo, you will experience the same quality of service, performance, and security controls as you did before. [Microsoft 365 Multi Geo](https://aka.ms/multi-geo) is available to some customers as an add-on and lets a single tenant create multiple satellite geos and move user data to those geos with data residency commitments. ++</details> ++### Will Microsoft 365 tenants hosted in the new datacenters be available to users outside of the country? +<details><summary>Click to expand</summary> ++Yes. Microsoft maintains a large global network with public Internet connections in more than 130 locations in 35 countries around the world with peering agreements with more than 2,700 Internet Service Providers (ISPs). Users will be able to access the datacenters from wherever they are on the Internet. ++</details> ++### My tenant has configured the Multi Geo add-on. Can I still enroll in my tenant in the Microsoft 365 Move Program? to change my default geo and move any user not in a satellite region to the new default geo? +<details><summary>Click to expand</summary> ++Yes, your tenant is eligible to enroll but there are significant considerations as tenant-level move is not fully supported for customers that have configured [Multi-Geo](https://aka.ms/multi-geo). ++SharePoint Online and OneDrive for Business cannot migrate to the new datacenter geo at the tenant level through this program. The customer administrator can configure OneDrive for Business shares to move to any available region using Multi-Geo, but the default location for the tenant cannot be changed once Multi-Geo has been configured for a tenant. ++For customers that opt-in for migration - we will move all Exchange Online mailboxes from your current default geo to your new local datacenter geo and update the default Exchange Online region. We will not move any EXO mailboxes configured in Multi Geo satellite regions to continue to respect satellite region data residency as you"ve intended. Teams chat service tenant migrations for customers with a Multi Geo configuration behave similarly to Exchange Online. ++</details> ++### I have public folders deployed in my tenant. What will be the impact on public folder access during or after the move? +<details><summary>Click to expand</summary> ++There is no impact to end users accessing public folders during or after the move of public folders. However, the public folders may not be available for administration in the Exchange Admin Center tool till all public folder mailboxes are moved in same region. Please check [this article](https://aka.ms/pfxrf) for more details. ++</details> ++### Related topics ++[Moving core data to new Microsoft 365 datacenter geos](moving-data-to-new-datacenter-geos.md) ++[How to request your data move](request-your-data-move.md) ++[Microsoft 365 Multi Geo](https://aka.ms/multi-geo) ++[Microsoft 365 interactive datacenter map](https://office.com/datamaps) ++[Microsoft 365 Support](../admin/get-help-support.md) ++[New datacenter geos for Microsoft Dynamics CRM Online](/power-platform/admin/new-datacenter-regions) ++[Azure services by region](https://azure.microsoft.com/regions/) |
| enterprise | During And After Your Data Move | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/during-and-after-your-data-move.md | Title: "During and after your data move"--++ Previously updated : 09/22/2021 Last updated : 06/02/2022 audience: ITPro -> Moves occur at different times for each service. As a result, you'll see the described reduced functionality for each service at a different time. +> Moves occur at different times for each service. As a result, you'll see the described reduced functionality for each service at a different time. -Watch the Microsoft 365 Message Center for confirmation when moves for each of Exchange Online, SharePoint Online, and Teams chat service complete. As shown in the table below, it can take up to 24 months after the end of the enrollment period to complete core customer data at rest moves to the new datacenter geo. +Watch the Microsoft 365 Message Center for confirmation when moves for each of Exchange Online, SharePoint Online, and Teams chat service complete. As shown in the table below, it can take up to 24 months after the end of the enrollment period to complete core customer data at rest moves to the new datacenter geo. | Customers with signup country in | All moves completed by | |:--|:--| Because it takes time to move each user to the new datacenter geo for a single t ### Open "Shared Folder" in Outlook Web Access -Some users open a shared mail folder from another mailbox (that the user has read or write permissions to) in Outlook Web Access using the "Shared Folder" feature. The following table describes how access to shared folders works during a mailbox move. Please note that users with full permissions to a shared mailbox can open the mailbox by using Outlook Web Access during the move. +Some users open a shared mail folder from another mailbox (that the user has read or write permissions to) in Outlook Web Access using the "Shared Folder" feature. The following table describes how access to shared folders works during a mailbox move. Please note that users with full permissions to a shared mailbox can open the mailbox by using Outlook Web Access during the move. | Configuration | Description | |:--|:--| Some users open a shared mail folder from another mailbox (that the user has rea When SharePoint Online is moved, data for the following services is also moved: - OneDrive for Business- + - Microsoft 365 Video services- + - Office in a browser- + - Microsoft 365 Apps for enterprise- + - Visio Pro for Microsoft 365- + After we've completed moving your SharePoint Online data, you might see some of the following effects. ### Microsoft 365 Video Services - The data move for video takes longer than the moves for the rest of your content in SharePoint Online.- + - After the SharePoint Online content is moved, there will be a time frame when videos aren't able to be played.- + - We're removing the trans-coded copies from the previous datacenter and transcoding them again in the new datacenter.- + ### Search -In the course of moving your SharePoint Online data, we migrate your search index and search settings to a new location. Until we've **completed** the move of your SharePoint Online data, we continue to serve your users from the index in the original location. In the new location, search automatically starts crawling your content after we've completed moving your SharePoint Online data. From this point and onwards we serve your users from the migrated index. Changes to your content that occurred after the migration aren't included in the migrated index until crawling picks them up. Most customers don't notice that results are less fresh right after we've completed moving their SharePoint Online data, but some customers might experience reduced freshness in the first 24-48 hours +In the course of moving your SharePoint Online data, we migrate your search index and search settings to a new location. Until we've **completed** the move of your SharePoint Online data, we continue to serve your users from the index in the original location. In the new location, search automatically starts crawling your content after we've completed moving your SharePoint Online data. From this point and onwards we serve your users from the migrated index. Changes to your content that occurred after the migration aren't included in the migrated index until crawling picks them up. Most customers don't notice that results are less fresh right after we've completed moving their SharePoint Online data, but some customers might experience reduced freshness in the first 24-48 hours. The following search features are affected: - Search results and Search Web Parts: Results don't include changes that occurred after the migration until crawling picks them up. - + - Delve: Delve doesn't include changes that occurred after the migration until crawling picks them up.- + - Popularity and Search Reports for the site: Counts for Excel reports in the new location only include migrated counts and counts from usage reports that have run after we completed moving your SharePoint Online data. Any counts from the interim period are lost and can't be recovered. This period is typically a couple of days. Some customers might experience shorter or longer losses.- + - Video Portal: View counts and statistics for the Video Portal depend on the statistics for Excel Reports, so view counts and statistics for the Video Portal are lost for the same time period as for the Excel reports.- + - eDiscovery: Items that changed during the migration aren't shown until crawling picks up the changes.- + - Data Loss Protection (DLP): Policies aren't enforced on items that change until crawling picks up the changes. As part of the migration, the default region will change and all new content will be stored at rest in the new default region. Existing content will move in the background with no impact to you for up to 90 days after the first change to the SharePoint Online data location in the admin center. Teams chat services moves each thread individually. The thread is locked in a r ## Skype for Business -Skype for Business moves are no longer available. [Skype for Business Online will be retired](/lifecycle/announcements/skype-for-business-online-retirement) on July 31, 2021. After that time, the service will no longer be accessible. +Skype for Business moves are no longer available. [Skype for Business Online will be retired](/lifecycle/announcements/skype-for-business-online-retirement) on July 31, 2021. After that time, the service will no longer be accessible. -## Related topics - +## Related topics + [How to request your data move](request-your-data-move.md)- -[Data move general FAQ](data-move-faq.yml) ++[Data move general FAQ](data-move-faq.md) [New datacenter geos for Microsoft Dynamics CRM Online](/power-platform/admin/new-datacenter-regions) |
| enterprise | Ipv6 Support | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/ipv6-support.md | Title: "IPv6 support in Microsoft 365 services" Previously updated : 12/03/2021 Last updated : 06/02/2022 audience: ITPro description: "Summary: Describes IPv6 support in Microsoft 365 components and in # IPv6 support in Microsoft 365 services -Microsoft 365 supports both IPv6 and IPv4; however, not all Microsoft 365 features are fully enabled with IPv6. This means that you must use both IPv4 and IPv6 to connect to Microsoft 365. If you are filtering your outbound traffic to Microsoft 365, the full list of IPv6 addresses that are supported by Microsoft 365 can be found in the article [Microsoft 365 URLs and IP address ranges](urls-and-ip-address-ranges.md). After your network is configured and the appropriate IPv6 addresses are allowed, you can download the [Microsoft 365 IPv6 test plan](https://go.microsoft.com/fwlink/?LinkId=293447) from the Microsoft Download Center. +With the growing adoption and support of IPv6 across enterprise networks, service providers and devices, many customers are wondering if their users can continue to access Microsoft 365 services from IPv6 clients and IPv6 networks. Microsoft 365 services can be successfully used from both IPv6 dual stack and IPv6-only devices. In fact, we have an increasing number of customers, from consumers to large enterprises, who are moving towards greater adoption of IPv6. For most customers, IPv4 won't completely disappear from their digital landscape, so we aren't planning to require IPv6 or to de-prioritize IPv4 in any Microsoft 365 features or services. -> [!NOTE] -> Enabling customers to experience Microsoft 365 SaaS services from any location and any device is a priority for Microsoft. This includes allowing customers to connect and consume Microsoft 365 from IPv6 enabled and IPv6 only clients and information systems. It also includes enabling government customers meet IPv6 commitments on their networks while continuing to consume Microsoft 365 productivity scenarios without any interruption. -> This article provides the list of Microsoft 365 SaaS services that allow direct IPv6 connectivity today. The scope of services allowing direct IPv6 connectivity is expected to continue to expand. Microsoft 365 services not explicitly mentioned for direct IPv6 support, to include Azure Active Directory (AAD) Authentication services, should be deemed requiring DNS64/NAT64 to be connected to from IPv6 only clients and environments. This is in alignment with the intent currently outlined in existing NIST USGv6 documentation: Transition Mechanism Capability Requirements in [NIST Special Publication 500-267A Revision 1](https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.500-267Ar1.pdf) NAT64/DNS64 are acceptable technologies to employ. -> - NAT64 support for transition mechanism NAT64 [RFC6146](https://datatracker.ietf.org/doc/html/rfc6146) -Stateful NAT64: Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers -> - DNS64 support for transition mechanism DNS64. [RFC6147](https://datatracker.ietf.org/doc/html/rfc6147) -DNS64: DNS Extensions for Network Address Translation from IPv6 Clients to IPv4 Server +One of our key priorities with Microsoft 365 is to ensure seamless customer and user experiences over the Internet from any location, from any device. This includes access to Microsoft 365 from customer devices that are using IPv6 in the dual stack configuration as well as transitioning to IPv6-only client deployments. In most cases, when you follow a standard Internet-based model of connecting to Microsoft 365 as described in [Microsoft 365 network connectivity principles](microsoft-365-network-connectivity-principles.md), [Microsoft 365 URLs and IP address ranges](urls-and-ip-address-ranges.md), and [Microsoft 365 network planning best practices](network-and-migration-planning.md#best-practices-for-network-planning-and-improving-migration-performance-for-office-365), IPv6 transitions won't be disruptive to your user experience. - -## IPv6 support in Microsoft 365 subscription service +Many Microsoft 365 services already provide native IPv6 support today and can be accessed directly from IPv6 dual stack and IPv6-only clients. Microsoft 365 also allows access through conventional IPv6 to IPv4 translation technologies (such as base 64 proxies or DNS64/NAT64) commonly used by customers and network solution providers to connect to IPv4 Internet resources. -### Exchange Online and IPv6 +As with any SaaS service and the Internet overall, the scope of natively IPv6 enabled Microsoft 365 interfaces, features and APIs expands continuously and without direct customer action or control. If you're running IPv6 or IPv6-only services on your networks that need access to Microsoft 365 and the Internet, it is recommended that you include dynamic IPv6/IPv4 transitional mechanisms such as DNS64/NAT64 to ensure end-to-end IPv6 connectivity to Microsoft 365 without any further network reconfigurations. -If the program that you use to connect to Exchange Online supports IPv6, it will use IPv6 by default on both wired and wireless networks. If you want to control communications to Exchange Online, use the IP address ranges in [Microsoft 365 URLs and IP address ranges](urls-and-ip-address-ranges.md). - -### SharePoint Online and IPv6 +Most of Microsoft 365 services have been or will be enabled with IPv6 capabilities completely transparently for end users and IT admins. Some Microsoft 365 scenarios (such as anonymous inbound e-mail) do have special requirements and considerations for use in conjunction with IPv6. For more details about scenario specific IPv6 requirements and considerations, please contact your Microsoft account team or Microsoft support. - **Microsoft 365 Government G1/G3/G4/K1** If the program that you use to connect to SharePoint Online supports IPv6, it will attempt to use IPv6 by default. - - **Public multi-tenant cloud** Microsoft enables SharePoint Online IPv6 at your request. You need to provide the CIDR notated IP addresses for your organization's DNS infrastructure. Keep in mind that this DNS infrastructure can't be shared by other organizations for IPv6 to be enabled for your tenant. After IPv6 is enabled, if the program that you use to connect to SharePoint Online supports IPv6, it uses IPv6 by default. - -If the program that you use to connect to SharePoint Online supports IPv6, it will use IPv6 by default on both wired and wireless networks. If you want to control communications to SharePoint Online, use the IP address ranges in [Microsoft 365 URLs and IP address ranges](urls-and-ip-address-ranges.md). - - - -### Skype for Business and IPv6 +Here's a short link you can use to come back: [https://aka.ms/o365ip6](https://aka.ms/o365ip6) -Please be aware IPv6 is not supported in Skype for Business and can no longer be enabled. --### Microsoft Teams, SIP Gateway, and IPV6 --Microsoft Teams Direct Routing and SIP Gateway only support IPv4. The Microsoft Teams service and client support both IPv4 and IPv6. If you want to control communications to Microsoft Teams, use the IP address ranges in [Microsoft 365 URLs and IP address ranges](urls-and-ip-address-ranges.md). - -### Exchange Online Protection and IPv6 --Exchange Online Protection (EOP) supports IPv6 if the transmission occurs over Transport Layer Security Protocol. For the EOP range, use [Microsoft 365 URLs and IP address ranges](urls-and-ip-address-ranges.md). - -### IPv6 support for Microsoft 365 government offerings +## See also -Microsoft 365 IPv6 support for government offerings conforms to the Office of Management and Budget (OMB) Memorandum for Chief Information Officers of Executive Departments and Agencies, as well as the Federal Government Adoption of Internet Protocol Version 6 (IPv6) memorandum. [Microsoft Microsoft 365 for Government](https://go.microsoft.com/fwlink/p/?LinkId=325414) is a multi-tenant service that stores US government data in a segregated community cloud. Like other Microsoft 365 offerings, it provides productivity and collaboration services, including Exchange Online, Skype for Business, SharePoint Online, and Microsoft 365 Apps for enterprise. +[Microsoft 365 Network Connectivity Overview](microsoft-365-networking-overview.md) -The Microsoft Microsoft 365 government offerings apply only for 2013 and later. For more information about the Microsoft 365 government offerings, see [Announcing Microsoft 365 for Government: A US Government Community Cloud](https://go.microsoft.com/fwlink/p/?LinkId=325414). International Traffic in Arms Regulations (ITAR) is a set of US government regulations that control the export and import of defense-related articles and services on the [United States Munitions List (USML)](https://go.microsoft.com/fwlink/p/?LinkId=325415). +[Managing Office 365 endpoints](managing-office-365-endpoints.md) -Microsoft Microsoft 365 for Enterprises provides dedicated hosting services for Microsoft productivity solutions that support the security, privacy, and regulatory compliance requirements for US federal agencies requiring Federal Information Security Management (FISMA) certification and commercial entities subject to ITAR. - -## Things to consider when using IPv6 and Microsoft 365 +[Office 365 URLs and IP address ranges](urls-and-ip-address-ranges.md) -We recommend that you do not disable IPv6. For more information, see this [guidance article](https://support.microsoft.com/help/929852/guidance-for-configuring-ipv6-in-windows-for-advanced-users). To determine what IP versions are being used on your network, consider the following: - -- If the display of the **IPConfig** command at the command prompt contains rows named "IPv6 Address" or "Temporary IPv6 Address," you have IPv6 in your environment.+[Office 365 IP Address and URL Web service](microsoft-365-ip-web-service.md) -- If all the IPv6 addresses begin with "fe80" and correspond to rows named "Link-Local IPv6 Address," you don't have IPv6 in your environment.+[Assessing Microsoft 365 network connectivity](assessing-network-connectivity.md) -These considerations might apply to your network: - -- The public subscription service does not support purchase by credit card over IPv6. This does not apply to the Government Community Cloud (GCC) because governments have Enterprise Agreement (EA) licensing.+[Network planning and performance tuning for Microsoft 365](network-planning-and-performance.md) -- IPv6 does not support some Rights Management Services (RMS) scenarios.+[Office 365 performance tuning using baselines and performance history](performance-tuning-using-baselines-and-history.md) -- IPv6 does not support BlackBerry® Enterprise Server (BES) because BlackBerry doesn't support IPv6.+[Performance troubleshooting plan for Office 365](performance-troubleshooting-plan.md) -- If you use Active Directory Federation Services (AD FS) with Microsoft 365, advertising your AD FS network endpoint to Microsoft 365 using IPv6 is not supported. You should not include AAAA records in the AD FS DNS entry when using Exchange Online. +[Content Delivery Networks](content-delivery-networks.md) -Here's a short link you can use to come back: [https://aka.ms/o365ip6]() +[Microsoft 365 connectivity test](https://aka.ms/netonboard) -## See also +[How Microsoft builds its fast and reliable global network](https://azure.microsoft.com/blog/how-microsoft-builds-its-fast-and-reliable-global-network/) -[IPv6 Learning Roadmap](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/gg250710(v%3dws.10)) - -[IPv6 Survival Guide](https://social.technet.microsoft.com/wiki/contents/articles/1728.ipv6-survival-guide.aspx) +[Office 365 Networking blog](https://techcommunity.microsoft.com/t5/Office-365-Networking/bd-p/Office365Networking) |
| enterprise | Moving Data To New Datacenter Geos | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/moving-data-to-new-datacenter-geos.md | Title: "Moving core data to new Microsoft 365 datacenter geos"--++ Previously updated : 11/16/2021 Last updated : 06/02/2022 audience: ITPro -We continue to open new datacenter geos for Microsoft 365 services. These new datacenter geos add capacity and compute resources to support our ongoing customer demand and usage growth. Additionally, the new datacenter geos offer in-geo data residency for core customer data. +We continue to open new datacenter geos for Microsoft 365 services. These new datacenter geos add capacity and compute resources to support our ongoing customer demand and usage growth. Additionally, the new datacenter geos offer in-geo data residency for core customer data. ++Core customer data is a term that refers to a subset of customer data including: -Core customer data is a term that refers to a subset of customer data including: - Exchange Online mailbox content (email body, calendar entries, and the content of email attachments) - SharePoint Online site content and the files stored within that site - Files uploaded to OneDrive for Business Existing customers that have their core customer data stored in an already exist As of October 1, 2020 customers with an Office 365 Education subscription included in the tenant are not eligible for migration. -A complete list of all datacenter geos, datacenters, and the location of customer data at rest is available as part of the [interactive datacenter maps](https://office.com/datamaps). +A complete list of all datacenter geos, datacenters, and the location of customer data at rest is available as part of the [interactive datacenter maps](https://office.com/datamaps). ## Data residency option We provide a data residency option to eligible Microsoft 365 customers who are covered by the datacenter geos listed in the table above. With this option, eligible customers with data residency requirements can request migration of their organization's core customer data at rest to their new datacenter geo. Microsoft will offer a committed deadline to all eligible customers who request migration during the enrollment window. Review the [How to request your data move](request-your-data-move.md) page for more details about the open enrollment window for your datacenter geo and the steps to enroll into the program. Data moves can take up to 24 months after the request period ends to complete. We introduce no unique capabilities, features or compliance certifications with the new datacenter geo.- -The complexity, precision and scale at which we need to perform data moves within a globally operated and automated environment prohibit us from sharing when a data move is expected to complete for your tenant or any other single tenant. Customers will receive one confirmation in Message Center per participating service when its data move has completed. - -Data moves are a back-end service operation with minimal impact to end-users. Features that can be impacted are listed on the [During and after your data move](during-and-after-your-data-move.md) page. We adhere to the [Microsoft Online Services Service Level Agreement (SLA)](https://go.microsoft.com/fwlink/p/?LinkId=523897) for availability so there is nothing that customers need to prepare for or to monitor during the move. Notification of any service maintenance is done if needed. ++The complexity, precision and scale at which we need to perform data moves within a globally operated and automated environment prohibit us from sharing when a data move is expected to complete for your tenant or any other single tenant. Customers will receive one confirmation in Message Center per participating service when its data move has completed. ++Data moves are a back-end service operation with minimal impact to end-users. Features that can be impacted are listed on the [During and after your data move](during-and-after-your-data-move.md) page. We adhere to the [Microsoft Online Services Service Level Agreement (SLA)](https://go.microsoft.com/fwlink/p/?LinkId=523897) for availability so there is nothing that customers need to prepare for or to monitor during the move. Notification of any service maintenance is done if needed. Data moves to the new datacenter geo are completed at no additional cost to the customer.- -## Related topics - ++## Related topics + [How to request your data move](request-your-data-move.md)- -[Data move general FAQ](data-move-faq.yml) ++[Data move general FAQ](data-move-faq.md) [New datacenter geos for Microsoft Dynamics CRM Online](/power-platform/admin/new-datacenter-regions) |
| enterprise | O365 Data Locations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/o365-data-locations.md | Title: "Microsoft 365 data locations"--++ Last updated : 06/02/2022 audience: ITPro description: "Determine where your Microsoft 365 customer data is stored worldwi The tables below shows where customer data is stored at-rest for Microsoft 365 services across all of Microsoft's global cloud locations. Expand the location of your billing address country to find out where customer data for each service would be stored. -If your business is located in the European Union, see [Data locations for the European Union](EU-data-storage-locations.md) for more information. +If your business is located in the European Union, see [Data locations for the European Union](EU-data-storage-locations.md) for more information. -Customers should view tenant specific data location information in your Microsoft 365 admin center in **Settings** > **Org settings** > <a href="https://go.microsoft.com/fwlink/p/?linkid=2067339" target="_blank">**Organization profile** tab</a> > **Data location**. If you [requested to move to a new Geo](request-your-data-move.md), the data location information in the Microsoft 365 admin center may show only your new Geo even though some data may be stored temporarily in your prior Geo during the transition. +Customers should view tenant specific data location information in your Microsoft 365 admin center in **Settings** > **Org settings** > <a href="https://go.microsoft.com/fwlink/p/?linkid=2067339" target="_blank">**Organization profile** tab</a> > **Data location**. If you [requested to move to a new Geo](request-your-data-move.md), the data location information in the Microsoft 365 admin center may show only your new Geo even though some data may be stored temporarily in your prior Geo during the transition. New Microsoft 365 tenants are defaulted to Geo based on the country of the transaction associated with that tenant's first subscription. Find information about the contractual commitments for the storage location of c For Azure Active Directory data locations, please visit [AAD Data Map](https://go.microsoft.com/fwlink/p/?linkid=2092972). -If CustomerΓÇÖs billing address is outside Europe and Customer has an Office 365 Education subscription, then notwithstanding the ΓÇ£Location of Customer Data at Rest for Core Online ServicesΓÇ¥ section of the OST, Microsoft may provision CustomerΓÇÖs Office 365 tenant in, transfer Customer Data to, and store Customer Data at rest anywhere within Europe or North America. If CustomerΓÇÖs billing address is in Europe and Customer has an Office 365 Education subscription, then notwithstanding the ΓÇ£Location of Customer Data at Rest for Core Online ServicesΓÇ¥ section of the OST, Microsoft may provision CustomerΓÇÖs Office 365 tenant in, transfer Customer Data to, and store Customer Data at rest anywhere within the European Union. ---+If Customer's billing address is outside Europe and Customer has an Office 365 Education subscription, then notwithstanding the "Location of Customer Data at Rest for Core Online Services" section of the OST, Microsoft may provision Customer's Office 365 tenant in, transfer Customer Data to, and store Customer Data at rest anywhere within Europe or North America. If Customer's billing address is in Europe and Customer has an Office 365 Education subscription, then notwithstanding the "Location of Customer Data at Rest for Core Online Services" section of the OST, Microsoft may provision Customer's Office 365 tenant in, transfer Customer Data to, and store Customer Data at rest anywhere within the European Union. ## FAQ ### How does Microsoft define data?+<details><summary>Click to expand</summary> Review our [definitions for different types of data](https://go.microsoft.com/fwlink/p/?linkid=864390) on the Microsoft Trust Center. In the [Privacy & Security Terms](https://www.microsoft.com/licensing/terms/product/PrivacyandSecurityTerms/all), Microsoft makes contractual commitments regarding customer data/your data. We refer to core customer data as the customer data that is committed to be stored at rest only within your region according to the [Privacy & Security Terms](https://www.microsoft.com/licensing/terms/product/PrivacyandSecurityTerms/all). +</details> + ### Where are the exact addresses of the data centers? +<details><summary>Click to expand</summary> + Microsoft does not disclose the exact addresses of its data centers. We established this policy to help secure our data center facilities. However, we do list city locations. Please see [Data Center Locations](o365-data-locations.md#data-center-locations) to learn more. +</details> + ### Does the location of your customer data have a direct impact on your end users' experience?+<details><summary>Click to expand</summary> The performance of Microsoft 365 is not simply proportional to a user's distance to data center locations. Microsoft's continued investments in its global cloud network, global cloud infrastructure, and the Microsoft 365 services architecture help provide users with a singular, consistent experience independent of where customer data is stored at rest. If your users are experiencing performance issues, you should troubleshoot those in depth. Microsoft has published guidance for Microsoft 365 customers to plan for and optimize end-user performance on the [Office Support web site](./network-planning-and-performance.md). +</details> + ### How does Microsoft help me comply with my national, regional, and industry-specific regulations?+<details><summary>Click to expand</summary> To help you comply with national, regional, and industry-specific requirements governing the collection and use of individuals' data, Microsoft 365 offers the most comprehensive set of compliance offerings of any global cloud productivity provider. Please review [our compliance offerings](/compliance/regulatory/offering-home) and more details in the [Microsoft Purview](https://go.microsoft.com/fwlink/p/?linkid=862317) section on the Microsoft Trust Center. Also, certain Microsoft 365 plans offer further compliance solutions to help you manage your data, comply with legal and regulatory requirements, and monitor actions taken on your data. +</details> + ### Who can access your data and according to what rules?+<details><summary>Click to expand</summary> Microsoft implements strong measures to help protect your customer data from inappropriate access or use by unauthorized persons. This includes restricting access by Microsoft personnel and subcontractors, and carefully defining requirements for responding to government requests for customer data. However, you can access your own customer data at any time and for any reason. More details are available on the [Microsoft Trust Center](https://go.microsoft.com/fwlink/p/?linkid=864392). +</details> + ### Does Microsoft access your data?+<details><summary>Click to expand</summary> Microsoft automates most Microsoft 365 operations while intentionally limiting its own access to customer data. This helps us manage Microsoft 365 at scale and address the risks of internal threats to customer data. By default, Microsoft engineers have no standing administrative privileges and no standing access to customer data in Microsoft 365. A Microsoft engineer may have limited and logged access to customer data for a limited amount of time, but only when necessary for normal service operations and only when approved by a member of senior management at Microsoft (and, for customers who are licensed for the Customer Lockbox feature, by the customer). +</details> + ### How does Microsoft secure your data?+<details><summary>Click to expand</summary> Microsoft has robust policies, controls, and systems built into Microsoft 365 to help keep your information safe. Review the [Microsoft 365 security section](https://go.microsoft.com/fwlink/p/?linkid=864393) on the Microsoft Trust Center to learn more. +</details> + ### Does Microsoft 365 encrypt your data?+<details><summary>Click to expand</summary> Microsoft 365 uses service-side technologies that encrypt customer data at rest and in transit. For customer data at rest, Microsoft 365 uses volume-level and file-level encryption. For customer data in transit, Microsoft 365 uses multiple encryption technologies for communications between data centers and between clients and servers, such as Transport Layer Security (TLS) and Internet Protocol Security (IPsec). Microsoft 365 also includes customer-managed encryption features. +</details> + ### Where can I find data residency information for Microsoft Azure?+<details><summary>Click to expand</summary> Please review the [Products available by region](https://go.microsoft.com/fwlink/p/?linkid=2093451) page to find data residency information for Microsoft Azure. +</details> + ### What are Multi-Geo Capabilities in Microsoft 365?+<details><summary>Click to expand</summary> -[Multi-Geo](https://go.microsoft.com/fwlink/p/?linkid=872033) gives customers the ability to allocate core customer data at rest to our available locations in the Microsoft 365 cloud. +[Multi-Geo](https://go.microsoft.com/fwlink/p/?linkid=872033) gives customers the ability to allocate core customer data at rest to our available locations in the Microsoft 365 cloud. ++</details> ### What services support Multi-Geo?+<details><summary>Click to expand</summary> [Multi-Geo](https://go.microsoft.com/fwlink/p/?linkid=872033) is available for Exchange Online, OneDrive for Business, SharePoint Online, and Teams. +</details> + ### Why do I see my Microsoft 365 service requests for my data at rest connecting to servers in countries outside of my region?+<details><summary>Click to expand</summary> On occasion, a customer request may be handled by servers in a different region than the location where your data is stored at rest. This may happen where network routing decisions choose a different server for the request processing, but in these cases your data is not moved to a new at rest location. +</details> + ### What are the exceptions for Intune data locations?+<details><summary>Click to expand</summary> -Microsoft will not store Intune customer data at rest outside the stated Geo. except if: +Microsoft will not store Intune customer data at rest outside the stated geo, except if: - It is necessary for Microsoft to provide customer support, troubleshoot the service, or comply with legal requirements. - The customer configures an account to enable such storage of customer data, including through the use of the following:- - Features that are designed to operate globally, such as Content Delivery Network (CDN), which provides a global caching service and stores customer data at edge locations around the world.- - Azure Active Directory (Azure AD), which may store directory data globally. This does not apply to Azure AD deployments in the United States (where Azure AD data is stored solely in the United States) or in Europe (where Azure AD data is stored in Europe or the United States).- - Preview, beta, or other prerelease services, which typically store customer data in the United States but may store it globally. -Regardless, Microsoft does not control or limit the Geo from which customers or their end users may access customer data. Similarly, where customer data in other services is subsequently integrated into Intune, the originating customer data will continue to be stored subject to the other serviceΓÇÖs own Geo commitments (if any); only the copy of the customer data integrated into Intune will be stored in the stated Geo for Intune. +Regardless, Microsoft does not control or limit the Geo from which customers or their end users may access customer data. Similarly, where customer data in other services is subsequently integrated into Intune, the originating customer data will continue to be stored subject to the other service's own Geo commitments (if any); only the copy of the customer data integrated into Intune will be stored in the stated Geo for Intune. ++</details> ### What are the considerations for Microsoft Viva data locations?+<details><summary>Click to expand</summary> - Viva Connections-- - Data for the Dashboard, Resources, and desktop app is stored in SharePoint Online. - - - The Feed includes content from SharePoint Online (News), Stream (stored at rest in SharePoint Online), and Yammer (stored at rest in Yammer). - + - Data for the Dashboard, Resources, and desktop app is stored in SharePoint Online. + - The Feed includes content from SharePoint Online (News), Stream (stored at rest in SharePoint Online), and Yammer (stored at rest in Yammer). - Viva Insights- - Data residency for the Personal app is based on the user's mailbox location.- - The data region for Manager/Leader and Advanced is determined by the primary region of the tenant, not individual users. +</details> + ## Data Center Locations The table below defines the data location for various services. When determining the service locations please refer to these tables. ### Data Center Geographies -The following global geographies can store data at rest. The locations where customer data may be stored can change. +The following global geographies can store data at rest. The locations where customer data may be stored can change. | Global Geographies | Locations where customer data may be stored | | | | New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva Insights - Advanced | United States | </p></details> - ## Belarus <details><summary>Click to expand</summary><p> New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva Insights - Advanced | United States | </p></details> - ## Congo (Brazzaville) <details><summary>Click to expand</summary><p> New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva Insights - Advanced | United States | </p></details> - ## Congo, (Kinshasa) <details><summary>Click to expand</summary><p> New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva Insights - Advanced | United States | </p></details> - ## Cook Islands <details><summary>Click to expand</summary><p> New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva Insights - Advanced | United States | </p></details> - ## Greenland <details><summary>Click to expand</summary><p> New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva Insights - Advanced | United States | </p></details> - ## India <details><summary>Click to expand</summary><p> New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva Insights - Advanced | United States | </p></details> - ## Lesotho <details><summary>Click to expand</summary><p> New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva Insights - Advanced | United States | </p></details> - ## Liberia <details><summary>Click to expand</summary><p> New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva Insights - Advanced | United States | </p></details> - ## Liechtenstein <details><summary>Click to expand</summary><p> New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva Insights - Advanced | United States | </p></details> - ## Nepal <details><summary>Click to expand</summary><p> New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva Insights - Advanced | United States | </p></details> - ## Netherlands <details><summary>Click to expand</summary><p> New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva Insights - Advanced | United States | </p></details> - ## New Caledonia <details><summary>Click to expand</summary><p> New Microsoft 365 tenants are defaulted to Geo based on the country of the billi ## Russian Federation <details><summary>Click to expand</summary><p> - | Service | Location | | | | | Exchange Online | Global Geography 1 ΓÇô EMEA | New Microsoft 365 tenants are defaulted to Geo based on the country of the billi ## Rwanda <details><summary>Click to expand</summary><p> - | Service | Location | | | | | Exchange Online | Global Geography 1 ΓÇô EMEA | New Microsoft 365 tenants are defaulted to Geo based on the country of the billi ## Saint Helena <details><summary>Click to expand</summary><p> - | Service | Location | | | | | Exchange Online | Global Geography 1 ΓÇô EMEA | New Microsoft 365 tenants are defaulted to Geo based on the country of the billi ## Somalia <details><summary>Click to expand</summary><p> - | Service | Location | | | | | Exchange Online | Global Geography 1 ΓÇô EMEA | New Microsoft 365 tenants are defaulted to Geo based on the country of the billi | Viva Insights - Advanced | United States | </p></details> - ## Vietnam <details><summary>Click to expand</summary><p> |
| enterprise | Request Your Data Move | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/request-your-data-move.md | Title: "How to request your data move"--++ Previously updated : 12/10/2019 Last updated : 06/02/2022 audience: ITPro -Eligible Microsoft 365 customers may request migration for their entire organizationΓÇÖs core customer data at rest. The program supports requests for each country in the time period described in the table and from customers with an eligible signup country associated with their Microsoft 365 tenant. +Eligible Microsoft 365 customers may request migration for their entire organization's core customer data at rest. The program supports requests for each country in the time period described in the table and from customers with an eligible signup country associated with their Microsoft 365 tenant. ## When can I request a move? As of January 2020, customers in eligible Office 365 countries can opt-in for mi [Moving core data to new Office 365 datacenter geos](moving-data-to-new-datacenter-geos.md) -[Data move general FAQ](data-move-faq.yml) +[Data move general FAQ](data-move-faq.md) [New datacenter geos for Microsoft Dynamics CRM Online](/power-platform/admin/new-datacenter-regions) |
| lighthouse | M365 Lighthouse Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-whats-new.md | We're continuously adding new features to [Microsoft 365 Lighthouse](m365-lighth > [!NOTE] > Some features get rolled out at different speeds to our customers. If you aren't seeing a feature yet, you should see it soon. -## May 2022 --### Redesigned left navigation pane --We've given the left navigation pane in Microsoft 365 Lighthouse a new look. You'll notice a sleeker design, with top-level nodes like Tenants, Users, and Devices that expand to show related subnodes, like Risky users, Device compliance, and Threat management. This navigation model aligns with the model used by other Microsoft 365 admin centers. --### Enriched user details pane --We've redesigned the user details pane to include more user information and more actions that you can take to better manage users. It now has the same look and feel as the user details pane in the Microsoft 365 admin center. To access the user details pane in Microsoft 365 Lighthouse, select **Users** from the left navigation pane, and then select either **Search users** or **Risky users**. Select any user to open the details pane. - ## April 2022 ### Delegated access type and roles on Tenants page |
| security | TOC | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/TOC.md | ## [Defender for Identity](/defender-for-identity/) ## [Defender for Cloud Apps](/cloud-app-security/) ## [Defender for Business](../defender-business/index.yml) +## [Defender Vulnerability Management](../defender-vulnerability-management/index.yml) |
| security | Cancel Machine Action | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/cancel-machine-action.md | +- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/defender-endpoint) +- [Microsoft Defender for Endpoint Plan 1](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1) [!include[Prerelease information](../../includes/prerelease.md)] |
| security | Configure Endpoints Sccm | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-sccm.md | There are several options you can use to onboard devices using Configuration Man For Windows Server 2012 R2 and Windows Server 2016 - after completing the onboarding steps, you'll need to [Configure and update System Center Endpoint Protection clients](onboard-downlevel.md#configure-and-update-system-center-endpoint-protection-clients). > [!NOTE]-> Defender for Endpoint doesn't support onboarding during the [Out-Of-Box Experience (OOBE)](https://answers.microsoft.com/windows/wiki/windows_10/how-to-complete-the-windows-10-out-of-box/47e3f943-f000-45e3-8c5c-9d85a1a0cf87) phase. Make sure users complete OOBE after running Windows installation or upgrading. +> Defender for Endpoint doesn't support onboarding during the [Out-Of-Box Experience (OOBE)](/windows-hardware/test/assessments/out-of-box-experience) phase. Make sure users complete OOBE after running Windows installation or upgrading. > > Note that it's possible to create a detection rule on a Configuration Manager application to continuously check if a device has been onboarded. An application is a different type of object than a package and program. > If a device is not yet onboarded (due to pending OOBE completion or any other reason), Configuration Manager will retry to onboard the device until the rule detects the status change. |
| security | Configure Extension File Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus.md | See [How to create and deploy antimalware policies: Exclusion settings](/configm 3. Expand the tree to **Windows components** \> **Windows Defender Antivirus** \> **Exclusions**. 4. Open the **Path Exclusions** setting for editing, and add your exclusions.+ 1. Set the option to **Enabled**. 2. Under the **Options** section, select **Show**. 3. Specify each folder on its own line under the **Value name** column. See [How to create and deploy antimalware policies: Exclusion settings](/configm 5. Choose **OK**. 6. Open the **Extension Exclusions** setting for editing and add your exclusions.+ 1. Set the option to **Enabled**. 2. Under the **Options** section, select **Show**. 3. Enter each file extension on its own line under the **Value name** column. You can use the asterisk `*`, question mark `?`, or environment variables (such > [!IMPORTANT] > There are key limitations and usage scenarios for these wildcards:-> > - Environment variable usage is limited to machine variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. > - You can only use a maximum of six wildcards per entry. > - You cannot use a wildcard in place of a drive letter. You can use the asterisk `*`, question mark `?`, or environment variables (such The following table describes how the wildcards can be used and provides some examples. -<br/><br/> - |Wildcard|Examples| ||| |`*` (asterisk) <p> In **file name and file extension inclusions**, the asterisk replaces any number of characters, and only applies to files in the last folder defined in the argument. <p> In **folder exclusions**, the asterisk replaces a single folder. Use multiple `*` with folder slashes `\` to indicate multiple nested folders. After matching the number of wild carded and named folders, all subfolders are also included.|`C:\MyData\*.txt` includes `C:\MyData\notes.txt` <p> `C:\somepath\*\Data` includes any file in `C:\somepath\Archives\Data` and its subfolders, and `C:\somepath\Authorized\Data` and its subfolders <p> `C:\Serv\*\*\Backup` includes any file in `C:\Serv\Primary\Denied\Backup` and its subfolders and `C:\Serv\Secondary\Allowed\Backup` and its subfolders| The following table describes how the wildcards can be used and provides some ex > [!IMPORTANT] > If you mix a file exclusion argument with a folder exclusion argument, the rules will stop at the file argument match in the matched folder, and will not look for file matches in any subfolders.-> > For example, you can exclude all files that start with "date" in the folders `c:\data\final\marked` and `c:\data\review\marked` by using the rule argument `c:\data\*\marked\date*`.-> > This argument, however, will not match any files in subfolders under `c:\data\final\marked` or `c:\data\review\marked`. <a id="review"></a> The following table lists and describes the system account environment variables You can retrieve the items in the exclusion list using one of the following methods: -- [Intune](/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune)+- [Intune](/mem/intune/fundamentals/deployment-guide-intune-setup) - [Microsoft Endpoint Configuration Manager](/configmgr/protect/deploy-use/endpoint-antimalware-policies) - [MpCmdRun](command-line-arguments-microsoft-defender-antivirus.md) - [PowerShell](/powershell/module/defender) You can retrieve the items in the exclusion list using one of the following meth > [!IMPORTANT] > Exclusion list changes made with Group Policy **will show** in the lists in the [Windows Security app](microsoft-defender-security-center-antivirus.md).-> > Changes made in the Windows Security app **will not show** in the Group Policy lists. If you use PowerShell, you can retrieve the list in two ways: |
| security | Configure Proxy Internet | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-proxy-internet.md | The following downloadable spreadsheet lists the services and their associated U |Spreadsheet of domains list| Description| |||-|Microsoft Defender for Endpoint URL list for commercial customers| Spreadsheet of specific DNS records for service locations, geographic locations, and OS for commercial customers. <p> [Download the spreadsheet here.](https://download.microsoft.com/download/6/b/f/6bfff670-47c3-4e45-b01b-64a2610eaefa/mde-urls-commercial.xlsx) +|Microsoft Defender for Endpoint URL list for commercial customers| Spreadsheet of specific DNS records for service locations, geographic locations, and OS for commercial customers. <p> [Download the spreadsheet here.](https://download.microsoft.com/download/6/b/f/6bfff670-47c3-4e45-b01b-64a2610eaefa/mde-urls-commercial.xlsx) <p> Note that Microsoft Defender for Endpoint Plan 1 and Plan 2 share the same proxy service URLs. | Microsoft Defender for Endpoint URL list for Gov/GCC/DoD | Spreadsheet of specific DNS records for service locations, geographic locations, and OS for Gov/GCC/DoD customers. <p> [Download the spreadsheet here.](https://download.microsoft.com/download/6/e-urls-gov.xlsx) If a proxy or firewall has HTTPS scanning (SSL inspection) enabled, exclude the domains listed in the above table from HTTPS scanning. |
| security | Defender Endpoint Plan 1 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1.md | Most organizations use various devices and operating systems. Currently, Defende - Windows 7 (ESU required) - Windows 8.1 - Windows 10, version 1709, or later-- macOS: 11.5 (Big Sur), 10.15.7 (Catalina), or 10.14.6 (Mojave)+- Windows 10 Enterprise +- Windows 10 Enterprise LTSC 2016 (or later)](/windows/whats-new/ltsc/) +- Windows 10 Enterprise IoT +- macOS (the three most recent releases are supported) - iOS - Android OS |
| security | Delete Library | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/delete-library.md | +- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint) [!include[Prerelease information](../../includes/prerelease.md)] |
| security | Deploy Manage Report Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deploy-manage-report-microsoft-defender-antivirus.md | Microsoft Endpoint Manager ([1](#fn1))|Use the [Endpoint Protection point site s Group Policy and Active Directory (domain-joined)|Use a Group Policy Object to deploy configuration changes and ensure Microsoft Defender Antivirus is enabled.|Use Group Policy Objects (GPOs) to [Configure update options for Microsoft Defender Antivirus][] and [Configure Windows Defender features][]|Endpoint reporting is not available with Group Policy. You can generate a list of [Group Policies to determine if any settings or policies are not applied][] PowerShell|Deploy with Group Policy, Microsoft Endpoint Configuration Manager, or manually on individual endpoints.|Use the [Set-MpPreference] and [Update-MpSignature] cmdlets available in the Defender module.|Use the appropriate [Get- cmdlets available in the Defender module][] Windows Management Instrumentation|Deploy with Group Policy, Microsoft Endpoint Configuration Manager, or manually on individual endpoints.|Use the [Set method of the MSFT_MpPreference class][] and the [Update method of the MSFT_MpSignature class][]|Use the [MSFT_MpComputerStatus][] class and the get method of associated classes in the [Windows Defender WMIv2 Provider][]-Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by using Visual Studio virtual machine configuration, or using Azure PowerShell cmdlets](/azure/security/azure-security-antimalware#antimalware-deployment-scenarios). You can also [Install Endpoint protection in Microsoft Defender for Cloud*](/azure/security-center/security-center-install-endpoint-protection)|Configure [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) or [use code samples](https://gallery.technet.microsoft.com/Antimalware-For-Azure-5ce70efe)|Use [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) to enable monitoring. You can also review usage reports in Azure Active Directory to determine suspicious activity, including the [Possibly infected devices][] report and configure an SIEM tool to report on [Microsoft Defender Antivirus events][] and add that tool as an app in AAD. +Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by using Visual Studio virtual machine configuration, or using Azure PowerShell cmdlets](/azure/security/azure-security-antimalware#antimalware-deployment-scenarios). You can also [Install Endpoint protection in Microsoft Defender for Cloud*](/azure/defender-for-cloud/endpoint-protection-recommendations-technical)|Configure [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) or [use code samples](https://gallery.technet.microsoft.com/Antimalware-For-Azure-5ce70efe)|Use [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) to enable monitoring. You can also review usage reports in Azure Active Directory to determine suspicious activity, including the [Possibly infected devices][] report and configure an SIEM tool to report on [Microsoft Defender Antivirus events][] and add that tool as an app in AAD. 1. <span id="fn1" />The availability of some functions and features, especially related to cloud-delivered protection, differ between Microsoft Endpoint Manager (Current Branch) and System Center 2012 Configuration Manager. In this library, we've focused on Windows 10, Windows 11, Windows Server 2016, and Microsoft Endpoint Manager (Current Branch). See [Use Microsoft cloud-provided protection in Microsoft Defender Antivirus](cloud-protection-microsoft-defender-antivirus.md) for a table that describes the major differences. [(Return to table)](#ref2) Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by ## In this section -Topic | Description +Article | Description | [Deploy and enable Microsoft Defender Antivirus protection](deploy-microsoft-defender-antivirus.md) | While the client is installed as a core part of Windows 10 or Windows 11, and traditional deployment does not apply, you will still need to enable the client on your endpoints with Microsoft Endpoint Configuration Manager, Microsoft Intune, or Group Policy Objects. [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) | There are two parts to updating Microsoft Defender Antivirus: updating the client on endpoints (product updates), and updating Security intelligence (protection updates). You can update Security intelligence in a number of ways, using Microsoft Endpoint Configuration Manager, Group Policy, PowerShell, and WMI. |
| security | Deployment Vdi Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus.md | In addition to standard on-premises or hardware configurations, you can also use For more information on Microsoft Remote Desktop Services and VDI support, see [Azure Virtual Desktop Documentation](/azure/virtual-desktop). -For Azure-based virtual machines, see [Install Endpoint Protection in Microsoft Defender for Cloud](/azure/security-center/security-center-install-endpoint-protection). +For Azure-based virtual machines, see [Install Endpoint Protection in Microsoft Defender for Cloud](/azure/defender-for-cloud/endpoint-protection-recommendations-technical). With the ability to easily deploy updates to VMs running in VDIs, we've shortened this guide to focus on how you can get updates on your machines quickly and easily. You no longer need to create and seal golden images on a periodic basis, as updates are expanded into their component bits on the host server and then downloaded directly to the VM when it's turned on. |
| security | Enable Troubleshooting Mode | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-troubleshooting-mode.md | Title: Get started with troubleshooting mode in Microsoft Defender for Endpoint + Title: Get started with troubleshooting mode in Microsoft Defender for Endpoint (preview) description: Turn on the Microsoft Defender for Endpoint troubleshooting mode to address various antivirus issues. keywords: antivirus, troubleshoot, troubleshooting mode, tamper protection, compatibility search.product: eADQiWindows 10XVcnh-# Get started with troubleshooting mode in Microsoft Defender for Endpoint +# Get started with troubleshooting mode in Microsoft Defender for Endpoint (preview) [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)-> [!NOTE] -> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) ++>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) ++> [!IMPORTANT] +> Some information relates to pre-released products which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. Microsoft Defender for Endpoint troubleshooting mode allows you to troubleshoot various Microsoft Defender antivirus features by enabling them from the device and testing different scenarios, even if they're controlled by the organization policy. The troubleshooting mode is disabled by default and requires you to turn it on for a device (and/or group of devices) for a limited time. Note that this is exclusively an Enterprise-only feature, and requires Microsoft 365 Defender access. |
| security | Find Defender Malware Name | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/find-defender-malware-name.md | MS.technology: mde It might be confusing to understand how Defender for Endpoint detects specific malware families. This is because malware naming schemes vary depending on who is first to report it, how it's referred to in the media, and how some companies use specific naming conventions. -Microsoft is part of the [Microsoft Virus Information Alliance (VIA)](/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md) program. This effort is a public collaboration program to help fight cybercrime. Microsoft names specific malware according to the [Computer Antivirus Research Organization (CARO)](/windows/security/threat-protection/intelligence/malware-naming.md). For example, Microsoft detects the Sunburst cyberattack as **Trojan:MSIL/Solorigate.BR!dha**. +Microsoft is part of the [Microsoft Virus Information Alliance (VIA)](/microsoft-365/security/intelligence/virus-information-alliance-criteria) program. This effort is a public collaboration program to help fight cybercrime. Microsoft names specific malware according to the [Computer Antivirus Research Organization (CARO)](/microsoft-365/security/intelligence/malware-naming). For example, Microsoft detects the Sunburst cyberattack as **Trojan:MSIL/Solorigate.BR!dha**. To understand how Microsoft Defender for Endpoint detects specific malware families, you can follow the process outlined below. |
| security | Import Export Exploit Protection Emet Xml | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/import-export-exploit-protection-emet-xml.md | Exploit protection helps protect devices from malware that use exploits to sprea You use the Windows Security app or PowerShell to create a set of mitigations (known as a configuration). You can then export this configuration as an XML file and share it with multiple devices on your network. Then, they all have the same set of mitigation settings. -The [Evaluation Package](https://demo.wd.microsoft.com/Page/EP) contains a sample configuration file (name *ProcessMitigation.xml* (Selfhost v4) you can use to see how the XML structure looks. The sample file also contains settings that have been converted from an [Enhanced Mitigation Experience Toolkit (no longer supported)](https://support.microsoft.com/help/2458544/the-enhanced-mitigation-experience-toolkit) configuration. You can open the file in a text editor (such as Notepad) or import it directly into exploit protection and review the settings in the Windows Security app. +The [Evaluation Package](https://demo.wd.microsoft.com/Page/EP) contains a sample configuration file (name *ProcessMitigation.xml* (Selfhost v4) you can use to see how the XML structure looks. The sample file also contains settings that have been converted from an [Enhanced Mitigation Experience Toolkit (no longer supported)](/lifecycle/products/enhanced-mitigation-experience-toolkit-emet) configuration. You can open the file in a text editor (such as Notepad) or import it directly into exploit protection and review the settings in the Windows Security app. > [!NOTE] > The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. |
| security | Ios Install Unmanaged | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-install-unmanaged.md | Microsoft Defender for Endpoint on iOS threat information is leveraged by Intune Microsoft Defender for Endpoint on iOS supports both the configurations of MAM - **Intune MDM + MAM**: IT administrators can only manage apps using App Protection Policies on devices that are enrolled with Intune mobile device management (MDM).-- **MAM without device enrollment**: MAM without device enrollment, or MAM-WE, allows IT administrators to manage apps using [App Protection Policies](/mem/intune/app/app-protection-policy) on devices not enrolled with Intune MDM. This means apps can be managed by Intune on devices enrolled with third-party EMM providers. +- **MAM without device enrollment**: MAM without device enrollment, or MAM-WE, allows IT administrators to manage apps using [App Protection Policies](/mem/intune/apps/app-protection-policy) on devices not enrolled with Intune MDM. This means apps can be managed by Intune on devices enrolled with third-party EMM providers. To manage apps using in both the above configurations customers should use Intune in the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) To enable this capability an administrator needs to configure the connection between Microsoft Defender for Endpoint and Intune, create the app protection policy, and apply the policy on targeted devices and applications. |
| security | Linux Deploy Defender For Endpoint With Chef | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-deploy-defender-for-endpoint-with-chef.md | end Make sure to update the path name to the location of the onboarding file. To test deploy it on the Chef workstation, just run ``sudo chef-client -z -o mdatp``.-After your deployment you should consider creating and deploying a configuration file to the servers based on [Set preferences for Microsoft Defender for Endpoint on Linux](/linux-preferences.md). +After your deployment you should consider creating and deploying a configuration file to the servers based on [Set preferences for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-preferences). After you've created and tested your configuration file, you can place it into the cookbook/mdatp/files folder where you also placed the onboarding package. Then you can create a settings_mdatp.rb file in the mdatp/recipies folder and add this text: ```powershell |
| security | Linux Install Manually | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-install-manually.md | In order to preview new features and provide early feedback, it is recommended t |Distro & version|Package| ||| |For RHEL/Centos/Oracle 8.0-8.5|<https://packages.microsoft.com/config/rhel/8/[channel].repo>|- |For RHEL/Centos/Oracle 7.2-7.9 & Amazon Linux 2 |<https://packages.microsoft.com/config/rhel/7/[channel].repo>| - |For RHEL/Centos 6.7-6.10|<https://packages.microsoft.com/config/rhel/6/[channel].repo>| + |For RHEL/Centos/Oracle 7.2-7.9 & Amazon Linux 2 |</azure/cognitive-services/speech-service/how-to-configure-rhel-centos-7>| + <!--|For RHEL/Centos 6.7-6.10|<https://packages.microsoft.com/config/rhel/6/[channel].repo>|--> |For Fedora 33|<https://packages.microsoft.com/config/fedora/33/prod.repo>| |For Fedora 34|<https://packages.microsoft.com/config/fedora/34/prod.repo>| |
| security | Linux Support Perf | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-support-perf.md | Open a terminal or SSH into the relevant machine and run the following commands:  > [!NOTE]-> - The analyzer requires 'lxml' to produce the result output. If not installed, the analyzer will try to fetch it from the official repository for python packages below: <https://files.pythonhosted.org/packages/\*/lxml\*.whl> +> - The analyzer requires 'lxml' to produce the result output. If not installed, the analyzer will try to fetch it from the official repository for python packages below: <https://pypi.org/search/?q=lxml> > > - In addition, the tool currently requires Python version 3 or later to be installed. > Open a terminal or SSH into the relevant machine and run the following commands: Description: Additional XML file used by the analyzer when building the HTML report. -- Auditd_info.txt+- Audited_info.txt - Description: details on auditd service and related components for [Linux](/windows/security/threat-protection/microsoft-defender-atp/linux-support-events) OS + Description: details on audited service and related components for [Linux](/microsoft-365/security/defender-endpoint/linux-resources) OS - perf_benchmark.tar.gz |
| security | Live Response Command Examples | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/live-response-command-examples.md | getfile c:\Users\user\Desktop\work.txt -auto > > The following file types *cannot* be downloaded using this command from within Live Response: >-> - [Reparse point files](/windows/desktop/fileio/reparse-points/) -> - [Sparse files](/windows/desktop/fileio/sparse-files/) +> - [Reparse point files](/windows-hardware/drivers/ifs/reparse-points) +> - [Sparse files](/windows-server/administration/windows-commands/fsutil-sparse) > - Empty files > - Virtual files, or files that are not fully present locally > |
| security | Machines View Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/machines-view-overview.md | During the Microsoft Defender for Endpoint onboarding process, devices onboarded ## Navigate to the Device inventory page -Access the device inventory page by selecting **Device inventory** from the **Endpoints** navigation menu in the [Microsoft 365 Defender portal](/defender/microsoft-365-security-center-mde). +Access the device inventory page by selecting **Device inventory** from the **Endpoints** navigation menu in the [Microsoft 365 Defender portal](/microsoft-365/security/defender-business/mdb-get-started). ## Device inventory overview |
| security | Manage Mde Post Migration Group Policy Objects | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-mde-post-migration-group-policy-objects.md | You can use Group Policy Objects in Azure Active Directory Domain Services to ma The following table lists various tasks you can perform to configure Microsoft Defender for Endpoint with Group Policy Objects. -<br/><br/> - |Task|Resources to learn more| ||| |**Manage settings for user and computer objects** <br/><br/> *Customize built-in Group Policy Objects, or create custom Group Policy Objects and organizational units to suit your organizational needs.*|[Administer Group Policy in an Azure Active Directory Domain Services managed domain](/azure/active-directory-domain-services/manage-group-policy)| |**Configure Microsoft Defender Antivirus** <br/><br/> *Configure antivirus features & capabilities, including policy settings, exclusions, remediation, and scheduled scans on your organization's devices (also referred to as endpoints).*|[Use Group Policy settings to configure and manage Microsoft Defender Antivirus](/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus) <br/><br/> [Use Group Policy to enable cloud-delivered protection](/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-group-policy-to-enable-cloud-delivered-protection)|-|**Manage your organization's attack surface reduction rules** <br/><br/> *Customize your attack surface reduction rules by excluding files & folders, or by adding custom text to notification alerts that appear on users' devices.*|[Customize attack surface reduction rules with Group Policy Objects](/microsoft-365/security/defender-endpoint/customize-attack-surface-reduction#use-group-policy-to-exclude-files-and-folders)| +|**Manage your organization's attack surface reduction rules** <br/><br/> *Customize your attack surface reduction rules by excluding files & folders, or by adding custom text to notification alerts that appear on users' devices.*|[Customize attack surface reduction rules with Group Policy Objects](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-implement)| |**Manage exploit protection settings** <br/><br/> *You can customize your exploit protection settings, import a configuration file, and then use Group Policy to deploy that configuration file.*|[Customize exploit protection settings](/microsoft-365/security/defender-endpoint/customize-exploit-protection) <br/><br/> [Import, export, and deploy exploit protection configurations](/microsoft-365/security/defender-endpoint/import-export-exploit-protection-emet-xml) <br/><br/> [Use Group Policy to distribute the configuration](/microsoft-365/security/defender-endpoint/import-export-exploit-protection-emet-xml#use-group-policy-to-distribute-the-configuration)| |**Enable Network Protection** to help prevent employees from using apps that malicious content on the Internet <br/><br/> *We recommend using [audit mode](/microsoft-365/security/defender-endpoint/evaluate-network-protection) at first for network protection in a test environment to see which apps would be blocked before rolling out.*|[Turn on network protection using Group Policy](/microsoft-365/security/defender-endpoint/enable-network-protection#group-policy)| |**Configure controlled folder access** to protect against ransomware <br/><br/> *[Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders) is also referred to as antiransomware protection.*|[Enable controlled folder access using Group Policy](/microsoft-365/security/defender-endpoint/enable-controlled-folders#group-policy)| |
| security | Manage Mde Post Migration Other Tools | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-mde-post-migration-other-tools.md | You can manage some Microsoft Defender Antivirus settings on devices with [Power ## Configure Microsoft Defender for Endpoint with PowerShell -You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules.<br/><br/> +You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. |Task|Resources to learn more| ||| |**Manage Microsoft Defender Antivirus** <br/><br/> View status of antimalware protection, configure preferences for antivirus scans & updates, and make other changes to your antivirus protection.*|[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus) <br/><br/> [Use PowerShell cmdlets to enable cloud-delivered protection](/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-powershell-cmdlets-to-enable-cloud-delivered-protection)| |**Configure exploit protection** to mitigate threats on your organization's devices <br/><br/> *We recommend using exploit protection in [audit mode](/microsoft-365/security/defender-endpoint/evaluate-exploit-protection#powershell) at first. That way, you can see how exploit protection affects apps your organization is using.*|[Customize exploit protection](/microsoft-365/security/defender-endpoint/customize-exploit-protection) <br/><br/> [PowerShell cmdlets for exploit protection](/microsoft-365/security/defender-endpoint/customize-exploit-protection#powershell-reference)|-|**Configure attack surface reduction rules** with PowerShell <br/><br/> *You can use PowerShell to exclude files and folders from attack surface reduction rules.*|[Customize attack surface reduction rules: Use PowerShell to exclude files & folders](/microsoft-365/security/defender-endpoint/customize-attack-surface-reduction#use-powershell-to-exclude-files-and-folders) <br/><br/> Also, see [Ant├│nio Vasconcelo's graphical user interface tool for setting attack surface reduction rules with PowerShell](https://github.com/anvascon/MDATP_PoSh_Scripts/tree/master/ASR%20GUI).| +|**Configure attack surface reduction rules** with PowerShell <br/><br/> *You can use PowerShell to exclude files and folders from attack surface reduction rules.*|[Customize attack surface reduction rules: Use PowerShell to exclude files & folders](/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction) <br/><br/> Also, see [Ant├│nio Vasconcelo's graphical user interface tool for setting attack surface reduction rules with PowerShell](https://github.com/anvascon/MDATP_PoSh_Scripts/tree/master/ASR%20GUI).| |**Enable Network Protection** with PowerShell <br/><br/> *You can use PowerShell to enable Network Protection.*|[Turn on Network Protection with PowerShell](/microsoft-365/security/defender-endpoint/enable-network-protection#powershell)| |**Configure controlled folder access** to protect against ransomware <br/><br/> *[Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders) is also referred to as antiransomware protection.*|[Enable controlled folder access with PowerShell](/microsoft-365/security/defender-endpoint/enable-controlled-folders#powershell)| |**Configure Microsoft Defender Firewall** to block unauthorized network traffic flowing into or out of your organization's devices|[Microsoft Defender Firewall with Advanced Security Administration using Windows PowerShell](/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell)| If you haven't already done so, configure your <a href="https://go.microsoft.com You can also configure whether and what features end users can see in the Microsoft Defender Security Center. - [Overview of the Microsoft Defender Security Center](/microsoft-365/security/defender-endpoint/use)- - [Endpoint protection: Microsoft Defender Security Center](/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center) ## Next steps - [Get an overview of threat and vulnerability management](/microsoft-365/security/defender-endpoint/next-gen-threat-and-vuln-mgt)- - [Visit the Microsoft Defender Security Center security operations dashboard](/microsoft-365/security/defender-endpoint/security-operations-dashboard)- - [Manage Microsoft Defender for Endpoint with Intune](manage-mde-post-migration-intune.md) |
| security | Manage Protection Updates Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-protection-updates-microsoft-defender-antivirus.md | There are five locations where you can specify where an endpoint should obtain u - [Windows Server Update Service](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) <sup>[[1](#fn1)]<sup></sup> - [Microsoft Endpoint Configuration Manager](/configmgr/core/servers/manage/updates) - [Network file share](#unc-share)-- [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft anti-malware](https://www.microsoft.com/wdsi/defenderupdates) <sup>[[2](#fn1)]<sup></sup>+- [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft anti-malware](/microsoft-365/security/defender-endpoint/manage-protection-update-schedule-microsoft-defender-antivirus) <sup>[[2](#fn1)]<sup></sup> (<a id="fn1">1</a>) Intune Internal Definition Update Server - If you use SCCM/SUP to get definition updates for Microsoft Defender Antivirus, and need to access Windows Update on blocked on client devices, you can transition to co-management and offload the endpoint protection workload to Intune. In the anti-malware policy configured in Intune there is an option for 'internal definition update server' which can be configured to use on-premises WSUS as the update source. This helps you control which updates from the official WU server are approved for the enterprise, and also help proxy and save network traffic to the official Windows UPdates network. Security intelligence updates are also delivered multiple times a day, but this > [!IMPORTANT] > If you have set [Microsoft Security intelligence page](https://www.microsoft.com/security/portal/definitions/adl.aspx) updates as a fallback source after Windows Server Update Service or Microsoft Update, updates are only downloaded from security intelligence updates and platform updates when the current update is considered out-of-date. (By default, this is seven consecutive days of not being able to apply updates from the Windows Server Update Service or Microsoft Update services).-> You can, however, [set the number of days before protection is reported as out-of-date](/windows/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).<p> +> You can, however, [set the number of days before protection is reported as out-of-date](/microsoft-365/security/defender-endpoint/manage-outdated-endpoints-microsoft-defender-antivirus).<p> > Starting Monday, October 21, 2019, security intelligence updates and platform updates will be SHA-2 signed exclusively. Devices must be updated to support SHA-2 in order to get the latest security intelligence updates and platform updates. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). Each source has typical scenarios that depend on how your network is configured, in addition to how often they publish updates, as described in the following table: -<br/><br/> - |Location|Sample scenario| ||| |Windows Server Update Service|You are using Windows Server Update Service to manage updates for your network.| |
| security | Manage Updates Baselines Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus.md | No known issues ### What's new - Device control support added for Windows Portable Devices-- Potentially unwanted applications (PUA) protection is turned on by default for consumers (See [Potentially unwanted apps will be blocked by default](https://support.microsoft.com/windows/potentially-unwanted-apps-will-be-blocked-by-default-b9f53cb9-7f1e-40bb-8c6b-a17e0ab6289e))+- Potentially unwanted applications (PUA) protection is turned on by default for consumers (See [Block potentially unwanted applications with Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus).) - Scheduled scans for Group Policy Object managed systems will adhere to user configured scan time - Improvements to the behavior monitoring engine |
| security | Microsoft Defender Antivirus Compatibility | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility.md | This article describes what happens with Microsoft Defender Antivirus and a non- > [!IMPORTANT] > - Microsoft Defender Antivirus is available on devices running Windows 10 and 11, Windows Server 2022, Windows Server 2019, Windows Server, version 1803 or newer, and Windows Server 2016. > - Microsoft Defender Antivirus is also available on Windows Server 2012 R2 when onboarded using the [modern, unified solution](/microsoft-365/security/defender-endpoint/configure-server-endpoints).-> - On Windows 8.1, enterprise-level endpoint antivirus protection is offered as [System Center Endpoint Protection](/previous-versions/system-center/system-center-2012-R2/hh508760(v=technet.10), which is managed through Microsoft Endpoint Configuration Manager. +> - On Windows 8.1, enterprise-level endpoint antivirus protection is offered as [System Center Endpoint Protection](/previous-versions/system-center/system-center-2012-R2/hh508760(v=technet.10)), which is managed through Microsoft Endpoint Configuration Manager. > - Windows Defender is also offered for [consumer devices on Windows 8.1](/previous-versions/windows/it-pro/windows-8.1-and-8/dn344918(v=ws.11)#BKMK_WindowsDefender), although Windows Defender does not provide enterprise-level management. ## Antivirus protection without Defender for Endpoint The following table summarizes what to expect: |:|:|:| |Windows 10 <br/> Windows 11|Microsoft Defender Antivirus|Active mode| |Windows 10 <br/> Windows 11|A non-Microsoft antivirus/antimalware solution|Disabled mode (happens automatically)|-|Windows Server 2022 <br/> Windows Server 2019<br/> Windows Server, version 1803, or newer <br/> Windows Server 2016 |Microsoft Defender Antivirus|Active mode| -|Windows Server 2022<br/>Windows Server 2019<br/>Windows Server, version 1803, or newer <br/> Windows Server 2016 |A non-Microsoft antivirus/antimalware solution|Disabled (set manually) <sup>[[1](#fn1)]</sup>| +|Windows Server 2022 <br/> Windows Server 2019<br/> Windows Server, version 1803, or newer <br/> Windows Server 2016 <br/> Windows Server 2012 R2 |Microsoft Defender Antivirus|Active mode| +|Windows Server 2022<br/>Windows Server 2019<br/>Windows Server, version 1803, or newer <br/> Windows Server 2016 |A non-Microsoft antivirus/antimalware solution|Disabled (set manually) <sup>[[1](#fn1)]</sup>| (<a id="fn1">1</a>) On Windows Server, if you are running a non-Microsoft antivirus product, you can uninstall Microsoft Defender Antivirus to prevent conflict. If the device is onboarded to Microsoft Defender for Endpoint, you can use Microsoft Defender Antivirus in passive mode (see below). |
| security | Microsoft Defender Security Center Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-security-center-antivirus.md | Settings that were previously part of the Windows Defender client and main Windo > [!IMPORTANT] > Disabling the Windows Security app service does not disable Microsoft Defender Antivirus or [Windows Defender Firewall](/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security). These are disabled automatically when a third-party antivirus or firewall product is installed and kept up to date.-> > If you do disable the Windows Security app service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app might display stale or inaccurate information about any antivirus or firewall products you have installed on the device. > It might also prevent Microsoft Defender Antivirus from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you might have previously installed. > This will significantly lower the protection of your device and could lead to malware infection. The following sections describe how to perform some of the most common tasks whe 2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). -3. Select **Virus & threat protection updates**. The currently installed version is displayed along with some information about when it was downloaded. You can check your current against the latest version available for manual download, or review the change log for that version. See [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware](https://www.microsoft.com/wdsi/defenderupdates). +3. Select **Virus & threat protection updates**. The currently installed version is displayed along with some information about when it was downloaded. You can check your current against the latest version available for manual download, or review the change log for that version. See [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus). 4. Select **Check for updates** to download new protection updates (if there are any). The following sections describe how to perform some of the most common tasks whe The following table summarizes exclusion types and what happens: -<br> --**** |Exclusion type|Defined by|What happens| |||| |**File**|Location <br/>Example: `c:\sample\sample.test`|The specific file is skipped by Microsoft Defender Antivirus.| |**Folder**|Location <br/>Example: `c:\test\sample`|All items in the specified folder are skipped by Microsoft Defender Antivirus.| |**File type**|File extension <br/>Example: `.test`|All files with the `.test` extension anywhere on your device are skipped by Microsoft Defender Antivirus.| |**Process**|Executable file path <br>Example: `c:\test\process.exe`|The specific process and any files that are opened by that process are skipped by Microsoft Defender Antivirus.|-| To learn more, see the following resources: |
| security | Mssp List | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mssp-list.md | Logo |Partner name | Description :|:|: |[Accenture Managed Detection & Response (MDR)](https://go.microsoft.com/fwlink/?linkid=2164353) | Manage, maintain, and enhance global cybersecurity operations with extended capabilities that detect, proactively hunt for and respond to advanced cyber-attacks across both IT and OT environments located in the cloud and on-premise.  | [Aujas managed MDE Service](https://go.microsoft.com/fwlink/?linkid=2162429) | Aujas cybersecurity provides 24*7 managed security services across the entire enterprise spectrum, using Microsoft Defender for Endpoint through its Cyber Defense Centers.-| [BDO Digital](https://go.microsoft.com/fwlink/?linkid=2090394) | BDO Digital's Managed Defense uses best practice tools, AI, and in-house security experts for 24/7/365 identity protection +| [BDO Digital](/openspecs/ie_standards/ms-html401/ad459f6f-5219-4f68-829c-a58f7397a11f) | BDO Digital's Managed Defense uses best practice tools, AI, and in-house security experts for 24/7/365 identity protection | [BlueVoyant](https://go.microsoft.com/fwlink/?linkid=2121401) | MDR for Microsoft Defender for Endpoint provides support in monitoring, investigating, and mitigating advanced attacks on endpoints :::image type="content" source="images/bt-logo.png" alt-text="!Image of BT logo.":::|[Managed Endpoint Microsoft from BT](https://www.globalservices.bt.com/en/solutions/solution/endpoint-security-and-protection-solutions)| We have been defending ourselves for many years, this expertise has allowed us to develop unique tradecraft which we use to protect Microsoft customers. We'll provide 24x7x365 monitoring of your Microsoft Defender for Endpoint estate in our global security operation centers. | [Cloud Defender for Cloud](https://go.microsoft.com/fwlink/?linkid=2099315) | InSpark's Cloud Defender for Cloud is a 24x7 managed service that delivers protect, detect & respond capabilities |
| security | Mtd | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mtd.md | This helps reduce potential issues that could arise while rolling out the servic - Devices show up in the device inventory list: After successful onboarding of Defender for Endpoint on the mobile device, verify that the device is listed in the Device Inventory in the [security console](https://security.microsoft.com). -- Run a malware detection test on an Android device: Install any test virus app from the Google play store and verify that it gets detected by Microsoft Defender for Endpoint. Here is an example app that can be used for this test: [Test virus](https://play.google.com/store/apps/details?id=com.androidantivirus.testvirus). Note that on Android Enterprise with a work profile, only the work profile is supported.+- Run a malware detection test on an Android device: Install any test virus app from the Google play store and verify that it gets detected by Microsoft Defender for Endpoint. Here is an example app that can be used for this test: [Test virus](https://play.google.com/store/apps/details?id=com.antivirus&hl=en_US&gl=US). Note that on Android Enterprise with a work profile, only the work profile is supported. - Run a phishing test: Browse to https://smartscreentestratings2.net and verify that it gets blocked by Microsoft Defender for Endpoint. Note that on Android Enterprise with a work profile, only the work profile is supported. |
| security | Onboard Downlevel | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/onboard-downlevel.md | To onboard down-level Windows client endpoints to Defender for Endpoint, you'll For Windows Server 2008 R2 SP1, you have the option of [onboarding through Microsoft Defender for Cloud](#onboard-windows-servers-through-microsoft-defender-for-cloud). > [!NOTE]-> Defender for Endpoint standalone server license is required, per node, in order to onboard a Windows server through Microsoft Monitoring Agent (Option 1). Alternatively, a Microsoft Defender for servers license is required, per node, in order to onboard a Windows server through Microsoft Defender for Cloud (Option 2), see [Supported features available in Microsoft Defender for Cloud](/azure/security-center/security-center-services). +> Defender for Endpoint standalone server license is required, per node, in order to onboard a Windows server through Microsoft Monitoring Agent (Option 1). Alternatively, a Microsoft Defender for servers license is required, per node, in order to onboard a Windows server through Microsoft Defender for Cloud (Option 2), see [Supported features available in Microsoft Defender for Cloud](/azure/defender-for-cloud/supported-machines-endpoint-solutions-clouds-servers). > [!TIP] > After onboarding the device, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Defender for Endpoint endpoint](run-detection-test.md). Follow the steps in [Run a detection test on a newly onboarded device](run-detec Download updates for Windows Server 2008 R2 x64 .NET Framework 3.5.1 (KB315418)<br>- [For Windows Server 2008 R2 x64](https://download.microsoft.com/download/6/8/0/680ee424-358c-4fdf-a0de-b45dee07b711/windows6.1-kb3154518-x64.msu) + [For Windows Server 2008 R2 x64](/iis/install/installing-iis-7/install-windows-server-2008-and-windows-server-2008-r2) >[!NOTE] > This article assumes you are using x64-based servers (MMA Agent .exe x64 New SHA-2 compliant version). |
| security | Partner Applications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/partner-applications.md | Logo|Partner name|Description |[SafeBreach](https://go.microsoft.com/fwlink/?linkid=2114114)|Gain visibility into Defender for Endpoint security events that are automatically correlated with SafeBreach simulations |[Skybox Vulnerability Control](https://go.microsoft.com/fwlink/?linkid=2127467)|Skybox Vulnerability Control cuts through the noise of vulnerability management, correlating business, network, and threat context to uncover your riskiest vulnerabilities |[Splunk](https://go.microsoft.com/fwlink/?linkid=2129805)|The Defender for Endpoint Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk-|[XM Cyber](https://go.microsoft.com/fwlink/?linkid=2136700)|Prioritize your response to an alert based on risk factors and high value assets +|[XM Cyber](/microsoft-365/compliance/insider-risk-management-configure)|Prioritize your response to an alert based on risk factors and high value assets ### Orchestration and automation Logo|Partner name|Description Logo|Partner name|Description :|:|: |[Aruba ClearPass Policy Manager](https://go.microsoft.com/fwlink/?linkid=2127544)|Ensure Defender for Endpoint is installed and updated on each endpoint before allowing access to the network-|[Blue Hexagon for Network](https://go.microsoft.com/fwlink/?linkid=2104613)|Blue Hexagon has built the industry's first real-time deep learning platform for network threat protection +|[Blue Hexagon for Network](/learn/modules/explore-malware-threat-protection/)|Blue Hexagon has built the industry's first real-time deep learning platform for network threat protection | [Corelight]( https://corelight.com/integrations/iot-security)| Using data, sent from Corelight network appliances, Microsoft 365 Defender gains increased visibility into the network activities of unmanaged devices, including communication with other unmanaged devices or external networks. |[CyberMDX](https://go.microsoft.com/fwlink/?linkid=2135620)|Cyber MDX integrates comprehensive healthcare assets visibility, threat prevention and repose into your Defender for Endpoint environment |[HYAS Protect](https://go.microsoft.com/fwlink/?linkid=2156763)|HYAS Protect utilizes authoritative knowledge of attacker infrastructure to proactively protect Microsoft Defender for Endpoint endpoints from cyberattacks |
| security | Prevent Changes To Security Settings With Tamper Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection.md | If your organization uses Microsoft Endpoint Manager (MEM) you can turn tamper p - Your devices must be [onboarded to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboarding). - You must have appropriate [permissions](/microsoft-365/security/defender-endpoint/assign-portal-access) assigned, such as global admin, security admin, or security operations. - Your organization uses [Microsoft Endpoint Manager to manage devices](/mem/endpoint-manager-getting-started). (Microsoft Endpoint Manager (MEM) licenses are required; MEM is included in Microsoft 365 E3/E5, Enterprise Mobility + Security E3/E5, Microsoft 365 Business Premium, Microsoft 365 F1/F3, Microsoft 365 Government G3/G5, and corresponding education licenses.)-- Your Windows devices must be running Windows 11 or Windows 10 [1709](/windows/release-health/status-windows-10-1709), [1803](/windows/release-health/status-windows-10-1803), [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), or later. (For more information about releases, see [Windows 10 release information](/windows/release-health/release-information).)+- Your Windows devices must be running Windows 11 or Windows 10 [1709](/lifecycle/announcements/revised-end-of-service-windows-10-1709), [1803](/lifecycle/announcements/windows-server-1803-end-of-servicing), [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), or later. (For more information about releases, see [Windows 10 release information](/windows/release-health/release-information).) - You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above). - Your devices must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version `1.1.15500.X` (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).) See the following resources: > [!NOTE] > Tamper protection blocks attempts to modify Microsoft Defender Antivirus settings through the registry.-> > To help ensure that tamper protection doesn't interfere with non-Microsoft security products or enterprise installation scripts that modify these settings, go to **Windows Security** and update **Security intelligence** to version 1.287.60.0 or later. (See [Security intelligence updates](https://www.microsoft.com/wdsi/definitions).)-> Once you've made this update, tamper protection continues to protect your registry settings, and logs attempts to modify them without returning errors. +> After you've made this update, tamper protection continues to protect your registry settings, and logs attempts to modify them without returning errors. If you are a home user, or you are not subject to settings managed by a security team, you can use the Windows Security app to manage tamper protection. You must have appropriate admin permissions on your device to do change security settings, such as tamper protection. To learn more about Threat & Vulnerability Management, see [Dashboard insights - - Windows 11 - Windows 11 Enterprise multi-session-- Windows 10 OS [1709](/windows/release-health/status-windows-10-1709), [1803](/windows/release-health/status-windows-10-1803), [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), or later together with [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint).+- Windows 10 OS [1709](/lifecycle/announcements/revised-end-of-service-windows-10-1709), [1803](/lifecycle/announcements/windows-server-1803-end-of-servicing), [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), or later together with [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint). - Windows 10 Enterprise multi-session If you are using Configuration Manager, version 2006, with tenant attach, tamper protection can be extended to Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, and Windows Server 2022. See [Tenant attach: Create and deploy endpoint security Antivirus policy from the admin center (preview)](/mem/configmgr/tenant-attach/deploy-antivirus-policy). |
| security | Report Monitor Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/report-monitor-microsoft-defender-antivirus.md | ms.localizationpriority: medium Previously updated : 10/18/2021 ms.technology: mde With Microsoft Defender Antivirus, you have several options for reviewing protec If you have a third-party security information and event management (SIEM) server, you can also consume [Windows Defender client events](/windows/win32/events/windows-events). -Windows events comprise several security event sources, including Security Account Manager (SAM) events ([enhanced for Windows 10](/windows/whats-new/whats-new-windows-10-version-1507-and-1511), also see the [Security auditing](/windows/device-security/auditing/security-auditing-overview) topic) and [Windows Defender events](troubleshoot-microsoft-defender-antivirus.md). +Windows events comprise several security event sources, including Security Account Manager (SAM) events ([enhanced for Windows 10](/windows/whats-new/whats-new-windows-10-version-1507-and-1511), also see the [Security auditing](/windows/security/threat-protection/auditing/security-auditing-overview) topic) and [Windows Defender events](troubleshoot-microsoft-defender-antivirus.md). These events can be centrally aggregated using the [Windows event collector](/windows/win32/wec/windows-event-collector). Often, SIEM servers have connectors for Windows events, allowing you to correlate all security events in your SIEM server. -You can also [monitor malware events using the Malware Assessment solution in Log Analytics](/azure/log-analytics/log-analytics-malware). +You can also [monitor malware events using the Malware Assessment solution in Log Analytics](/security/benchmark/azure/security-control-logging-monitoring). For monitoring or determining status with PowerShell, WMI, or Microsoft Azure, see the [(Deployment, management, and reporting options table)](deploy-manage-report-microsoft-defender-antivirus.md#ref2). |
| security | Run Analyzer Macos Linux | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/run-analyzer-macos-linux.md | Open a terminal or SSH into the relevant machine and run the following commands: 4. To collect actual diagnostic package and generate the result archive file run again as root: `./mde_support_tool.sh -d` > [!NOTE]-> - For Linux, the analyzer requires 'lxml' to produce the result output. If not installed, the analyzer will try to fetch it from the official repository for python packages below: <https://files.pythonhosted.org/packages/\*/lxml\*.whl> +> - For Linux, the analyzer requires 'lxml' to produce the result output. If not installed, the analyzer will try to fetch it from the official repository for python packages below: <https://pypi.org/search/?q=lxml> > > - In addition, the tool currently requires Python version 3 or later to be installed. > Additional syntax help: Description: Additional XML file used by the analyzer when building the HTML report. -- Auditd_info.txt+- Audited_info.txt - Description: details on auditd service and related components for [Linux](/windows/security/threat-protection/microsoft-defender-atp/linux-support-events) OS + Description: details on audited service and related components for [Linux](/microsoft-365/security/defender-endpoint/linux-resources) OS - perf_benchmark.tar.gz |
| security | Switch To Mde Phase 2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2.md | This step of the setup process involves adding Defender for Endpoint to the excl > To get help configuring exclusions, refer to your solution provider's documentation. The specific exclusions to configure will depend on which version of Windows your endpoints or devices are running, and are listed in the following table.-<br/><br/> | OS |Exclusions | |:--|:--|-|Windows 11 <br/><br/>Windows 10, [version 1803](/windows/release-health/status-windows-10-1803) or later (See [Windows 10 release information](/windows/release-health/release-information))<br/><br/>Windows 10, version 1703 or 1709 with [KB4493441](https://support.microsoft.com/help/4493441) installed <br/><br/> Windows Server 2022<br/><br/>[Windows Server 2019](/windows/release-health/status-windows-10-1809-and-windows-server-2019) <br/><br/>[Windows Server 2016](/windows/release-health/status-windows-10-1607-and-windows-server-2016)<br/><br/>[Windows Server 2012 R2](/windows/release-health/status-windows-8.1-and-windows-server-2012-r2)<br/><br/>[Windows Server, version 1803](/windows-server/get-started/whats-new-in-windows-server-1803) | `C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe`<br/><br/>`C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe`<br/><br/>`C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe`<br/><br/>`C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe`<br/><br/>`C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe`<br/><br/>In addition, on Windows Server 2012 R2 and 2016 running the modern, unified solution the following exclusions are required after updating the Sense EDR component using [KB5005292](https://support.microsoft.com/en-us/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac):<br/> <br/> `C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\MsSense.exe` <br/><br/>`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCnCProxy.exe`<br/><br/>`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseIR.exe`<br/><br/>`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCE.exe`<br/><br/>`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseSampleUploader.exe`<br/><br/>`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCM.exe` | +|Windows 11 <br/><br/>Windows 10, [version 1803](/lifecycle/announcements/windows-server-1803-end-of-servicing) or later (See [Windows 10 release information](/windows/release-health/release-information))<br/><br/>Windows 10, version 1703 or 1709 with [KB4493441](https://support.microsoft.com/help/4493441) installed <br/><br/> Windows Server 2022<br/><br/>[Windows Server 2019](/windows/release-health/status-windows-10-1809-and-windows-server-2019) <br/><br/>[Windows Server 2016](/windows/release-health/status-windows-10-1607-and-windows-server-2016)<br/><br/>[Windows Server 2012 R2](/windows/release-health/status-windows-8.1-and-windows-server-2012-r2)<br/><br/>[Windows Server, version 1803](/windows-server/get-started/whats-new-in-windows-server-1803) | `C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe`<br/><br/>`C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe`<br/><br/>`C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe`<br/><br/>`C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe`<br/><br/>`C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe`<br/><br/>In addition, on Windows Server 2012 R2 and 2016 running the modern, unified solution the following exclusions are required after updating the Sense EDR component using [KB5005292](https://support.microsoft.com/en-us/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac):<br/> <br/> `C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\MsSense.exe` <br/><br/>`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCnCProxy.exe`<br/><br/>`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseIR.exe`<br/><br/>`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCE.exe`<br/><br/>`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseSampleUploader.exe`<br/><br/>`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCM.exe` | |[Windows 8.1](/windows/release-health/status-windows-8.1-and-windows-server-2012-r2)<br/><br/>[Windows 7](/windows/release-health/status-windows-7-and-windows-server-2008-r2-sp1)<br/><br/>[Windows Server 2008 R2 SP1](/windows/release-health/status-windows-7-and-windows-server-2008-r2-sp1) |`C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 6\45\MsSenseS.exe`<br/><br/>**NOTE**: Monitoring Host Temporary Files 6\45 can be different numbered subfolders.<br/><br/>`C:\Program Files\Microsoft Monitoring Agent\Agent\AgentControlPanel.exe`<br/><br/>`C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe`<br/><br/>`C:\Program Files\Microsoft Monitoring Agent\Agent\HSLockdown.exe`<br/><br/>`C:\Program Files\Microsoft Monitoring Agent\Agent\MOMPerfSnapshotHelper.exe`<br/><br/>`C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe`<br/><br/>`C:\Program Files\Microsoft Monitoring Agent\Agent\TestCloudConnection.exe` | ## Add your existing solution to the exclusion list for Microsoft Defender Antivirus When you add [exclusions to Microsoft Defender Antivirus scans](/windows/securit Keep the following points in mind: - *Path exclusions* exclude specific files and whatever those files access.- - *Process exclusions* exclude whatever a process touches, but does not exclude the process itself.- - List your process exclusions using their full path and not by their name only. (The name-only method is less secure.)- - If you list each executable (.exe) as both a path exclusion and a process exclusion, the process and whatever it touches are excluded. ## Set up your device groups, device collections, and organizational units |
| security | Troubleshoot Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus.md | The tables list: > [!TIP] > You can also visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working:-> > - Cloud-delivered protection > - Fast learning (including Block at first sight) > - Potentially unwanted application blocking To troubleshoot this event: <ol> <li>Run the scan again.</li> <li>If it fails in the same way, go to the <a href="https://go.microsoft.com/fwlink/?LinkId=215163">Microsoft Support site</a>, enter the error number in the <b>Search</b> box to look for the error code.</li>-<li>Contact <a href="https://go.microsoft.com/fwlink/?LinkId=215491">Microsoft Technical Support</a>. +<li>Contact <a href="/microsoft-365/admin/get-help-support">Microsoft Technical Support</a>. </li> </ol> </td> Verify that the user has permission to access the necessary resources. If this event persists:<ol> <li>Run the scan again.</li> <li>If it fails in the same way, go to the <a href="https://go.microsoft.com/fwlink/?LinkId=215163">Microsoft Support site</a>, enter the error number in the <b>Search</b> box to look for the error code.</li>-<li>Contact <a href="https://go.microsoft.com/fwlink/?LinkId=215491">Microsoft Technical Support</a>. +<li>Contact <a href="/microsoft-365/admin/get-help-support">Microsoft Technical Support</a>. </li> </ol> </td> To troubleshoot this event: <ol> <li><a href="manage-updates-baselines-microsoft-defender-antivirus.md" data-raw-source="[Update definitions](manage-updates-baselines-microsoft-defender-antivirus.md)">Update definitions</a> and force a rescan directly on the endpoint.</li> <li>Review the entries in the %Windir%\WindowsUpdate.log file for more information about this error.</li>-<li>Contact <a href="https://go.microsoft.com/fwlink/?LinkId=215491">Microsoft Technical Support</a>. +<li>Contact <a href="/microsoft-365/admin/get-help-support">Microsoft Technical Support</a>. </li> </ol> </td> The Microsoft Defender Antivirus client update failed. This event occurs when th To troubleshoot this event: <ol> <li><a href="manage-updates-baselines-microsoft-defender-antivirus.md" data-raw-source="[Update definitions](manage-updates-baselines-microsoft-defender-antivirus.md)">Update definitions</a> and force a rescan directly on the endpoint.</li>-<li>Contact <a href="https://go.microsoft.com/fwlink/?LinkId=215491">Microsoft Technical Support</a>. +<li>Contact <a href="/microsoft-365/admin/get-help-support">Microsoft Technical Support</a>. </li> </ol> </td> To troubleshoot this event: <li>Download the latest definitions from the <a href="https://aka.ms/wdsi">Microsoft Security Intelligence site</a>. Note: The size of the definitions file downloaded from the site can exceed 60 MB and should not be used as a long-term solution for updating definitions. </li>-<li>Contact <a href="https://go.microsoft.com/fwlink/?LinkId=215491">Microsoft Technical Support</a>. +<li>Contact <a href="/microsoft-365/admin/get-help-support">Microsoft Technical Support</a>. </li> </ol> </td> Microsoft Defender Antivirus Real-time Protection has restarted a feature. It is User action: </td> <td >-The real-time protection feature has restarted. If this event happens again, contact <a href="https://go.microsoft.com/fwlink/?LinkId=215491">Microsoft Technical Support</a>. +The real-time protection feature has restarted. If this event happens again, contact <a href="/microsoft-365/admin/get-help-support">Microsoft Technical Support</a>. </td> </tr> <tr> To troubleshoot this event:<ol> </li> </ul> </li>-<li>If it fails in the same way, look up the error code by accessing the <a href="https://go.microsoft.com/fwlink/?LinkId=215163">Microsoft Support Site</a> and entering the error number in the <b>Search</b> box, and contact <a href="https://go.microsoft.com/fwlink/?LinkId=215491">Microsoft Technical Support</a>.</li> +<li>If it fails in the same way, look up the error code by accessing the <a href="https://go.microsoft.com/fwlink/?LinkId=215163">Microsoft Support Site</a> and entering the error number in the <b>Search</b> box, and contact <a href="/microsoft-365/admin/get-help-support">Microsoft Technical Support</a>.</li> </ol> </td> </tr> To troubleshoot this event: <ol> <li>Run the scan again.</li> <li>If it fails in the same way, go to the <a href="https://go.microsoft.com/fwlink/?LinkId=215163">Microsoft Support site</a>, enter the error number in the <b>Search</b> box to look for the error code.</li>-<li>Contact <a href="https://go.microsoft.com/fwlink/?LinkId=215491">Microsoft Technical Support</a>. +<li>Contact <a href="/microsoft-365/admin/get-help-support">Microsoft Technical Support</a>. </li> </ol> </td> |
| security | Troubleshoot Security Config Mgt | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-security-config-mgt.md | To successfully register devices to Azure Active Directory, you'll need to ensur - Computers can authenticate with the domain controller - Computers have access to the following Microsoft resources from inside your organization's network:- - https://enterpriseregistration.windows.net + - /windows/iot/iot-enterprise/commercialization/licensing - https://login.microsoftonline.com - https://device.login.microsoftonline.com - Azure AD connect is configured to sync the computer objects. By default, computer OUs are in Azure AD connect sync scope. If the computer objects belong to specific organizational units (OUs), configure the OUs to sync in Azure AD Connect. To learn more about how to sync computer objects by using Azure AD Connect, see [Organizational unitΓÇôbased filtering](/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering#organizational-unitbased-filtering). |
| security | Troubleshooting Mode Scenarios | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshooting-mode-scenarios.md | Title: Troubleshooting mode scenarios in Microsoft Defender for Endpoint + Title: Troubleshooting mode scenarios in Microsoft Defender for Endpoint (preview) description: Use the Microsoft Defender for Endpoint troubleshooting mode to address various antivirus issues. keywords: antivirus, troubleshoot, troubleshooting mode, tamper protection, compatibility search.product: eADQiWindows 10XVcnh-# Troubleshooting mode scenarios in Microsoft Defender for Endpoint +# Troubleshooting mode scenarios in Microsoft Defender for Endpoint (preview) [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] ms.technology: mde > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) +> [!IMPORTANT] +> Some information relates to pre-released products which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. Microsoft Defender for Endpoint troubleshooting mode allows you to troubleshoot various Microsoft Defender antivirus features by enabling them from the device and testing different scenarios, even if they're controlled by the organization policy. The troubleshooting mode is disabled by default and requires you to turn it on for a device (and/or group of devices) for a limited time. Note that this is exclusively an Enterprise-only feature, and requires Microsoft 365 Defender access. |
| security | Upload Library | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/upload-library.md | +- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint) [!include[Prerelease information](../../includes/prerelease.md)] |
| security | Microsoft 365 Security Mdi Redirection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-mdi-redirection.md | + + Title: Redirecting accounts from Microsoft Defender for Identity to Microsoft 365 Defender +description: How to redirect accounts and sessions from Defender for Identity to Microsoft 365 Defender. +keywords: Microsoft 365 Defender, Getting started with Microsoft 365 Defender, security center redirection +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +++ms.localizationpriority: medium ++audience: ITPro ++ - M365-security-compliance +++ms.technology: m365d ++# Redirecting accounts from Microsoft Defender for Identity to Microsoft 365 Defender +++**Applies to:** ++- Microsoft 365 Defender +- Defender for Identity ++This guide explains how to route accounts to Microsoft 365 Defender by enabling automatic redirection from the former Microsoft Defender for Identity portal (portal.atp.azure.com), to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender</a>. ++## What to expect ++Once automatic redirection is enabled, accounts accessing the former Microsoft Defender for Identity portal at portal.atp.azure.com, will be automatically routed to the Microsoft 365 Defender portal at <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">security.microsoft.com</a>. ++## When does this take effect? ++Once enabled, this update might take effect almost immediately for some accounts. But the redirection might take longer to propagate to every account in your organization. Accounts in active sessions while this setting is applied won't be ejected from their session and will only be routed to Microsoft 365 Defender after ending their current session and signing back in again. ++### Set up portal redirection ++To start routing accounts to Microsoft 365 Defender: ++1. Make sure you're a global administrator or have security administrator permissions in Azure Active Directory. ++1. Sign in to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender</a>. ++1. Navigate to **Settings** > **Identities** > **General** > **Portal redirection** or [click here](https://security.microsoft.com/preferences2/portal_redirection). ++ :::image type="content" source="../../media/portal-redirection.png" alt-text="Portal redirection."lightbox="../../media/portal-redirection.png"::: ++1. Toggle the Automatic redirection setting to **On**. ++>[!IMPORTANT] +>Enabling this setting will not terminate active user sessions. Accounts who are in an active session while this setting is applied will only be directed to Microsoft 365 Defender after ending their current session and signing in again. ++>[!NOTE] +>You must be a global administrator or have security administrator permissions in Azure Active Directory to enable or disable this setting. ++## Can I go back to using the former portal? ++If something isn't working for you or if there's anything you're unable to complete through Microsoft 365 Defender, we want to hear about it. If you've encountered any issues with redirection, we encourage you to let us know by using the Give feedback submission form. ++To revert to the former Microsoft Defender for Identity portal: ++1. Sign in to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender</a> as a global administrator or using and account with security administrator permissions in Azure Active directory. ++2. Navigate to **Settings** > **Identities** > **General** > **Portal redirection** or [open the page here](https://security.microsoft.com/preferences2/portal_redirection). ++3. Toggle the Automatic redirection setting to **Off**. ++This setting can be enabled again at any time. ++Once disabled, accounts will no longer be routed to security.microsoft.com. ++## Related information ++- [Microsoft 365 Defender overview](microsoft-365-defender.md) +- [About Microsoft 365 Defender](https://www.microsoft.com/microsoft-365/security/microsoft-365-defender) +- [Microsoft security portals and admin centers](portals.md) |
| security | Detect And Remediate Outlook Rules Forms Attack | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/detect-and-remediate-outlook-rules-forms-attack.md | The best way to protect your user accounts, and especially your administrator ac - **Unusual impersonated activity (by user)**: This policy profiles your environment and triggers alerts when users perform multiple impersonated activities in a single session with respect to the baseline learned, which could indicate an attempted breach. -- Use a tool like [Office 365 Secure Score](https://securescore.office.com/) to manage account security configurations and behaviors.+- Use a tool like [Office 365 Secure Score](/microsoft-365/security/defender/microsoft-secure-score) to manage account security configurations and behaviors. ### Second: Keep your Outlook clients current |
| security | Manage Tenant Allows | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/manage-tenant-allows.md | Allow Files on the **Submissions** page in Microsoft 365 Defender. ## Add spoofed sender allow entries using PowerShell -To add spoofed sender entries in the Tenant Allow/Block List in [Exchange Online PowerShell](/exchange/connect-to-exchange-online-powershell), use the following syntax: +To add spoofed sender entries in the Tenant Allow/Block List in [Exchange Online PowerShell](/powershell/exchange/exchange-online-powershell), use the following syntax: ```powershell New-TenantAllowBlockListSpoofItems -SpoofedUser <Domain | EmailAddress | *> -SendingInfrastructure <Domain | IPAddress/24> -SpoofType <External | Internal> -Action <Allow | Block> |
| security | Mcas Saas Access Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mcas-saas-access-policies.md | The following illustration and table provide several examples of policies that c ## Next steps -For more information about using Defender for Cloud Apps, see [Microsoft Defender for Cloud Apps documentation](//cloud-app-security/). +For more information about using Defender for Cloud Apps, see [Microsoft Defender for Cloud Apps documentation](/defender-cloud-apps/). |
| security | Real Time Detections | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/real-time-detections.md | To view and use Explorer *or* Real-time detections, you need the following permi To learn more about roles and permissions, see the following articles: - [Permissions in the Microsoft 365 Defender portal](permissions-microsoft-365-security-center.md)-- [Permissions in Exchange Online](/e/exchange/permissions-exo/permissions-exo)+- [Permissions in Exchange Online](/exchange/permissions-exo/permissions-exo) ## More information |
| security | Security Recommendations For Priority Accounts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/security-recommendations-for-priority-accounts.md | Microsoft 365 and Microsoft Defender for Office 365 contain several key features |[Train users](#train-users)|||| > [!NOTE]-> For information about securing _privileged accounts_ (admin accounts), see [this topic](/azure/architecture/framework/security/critical-impact-accounts). +> For information about securing _privileged accounts_ (admin accounts), see [this topic](/security/compass/critical-impact-accounts). ## Increase sign-in security for priority accounts |
| security | Tenant Wide Setup For Increased Security | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-wide-setup-for-increased-security.md | Be sure to visit these two areas in Azure Active Directory to complete tenant-wi If your organization includes offices with secure network access, add the trusted IP address ranges to Azure Active Directory as named locations. This feature helps reduce the number of reported false positives for sign-in risk events. -See: [Named locations in Azure Active Directory](/azure/active-directory/active-directory-named-locations) +See: [Named locations in Azure Active Directory](/azure/active-directory/conditional-access/location-condition) ### Block apps that don't support modern authentication |
| security | User Tags | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/user-tags.md | To see how user tags are part of the strategy to help protect high-impact user a - You can also manage and monitor priority accounts in the Microsoft 365 admin center. For instructions, see [Manage and monitor priority accounts](../../admin/setup/priority-accounts.md). -- For information about securing _privileged accounts_ (admin accounts), see [this topic](/azure/architecture/framework/security/critical-impact-accounts).+- For information about securing _privileged accounts_ (admin accounts), see [this topic](/security/compass/critical-impact-accounts). ## Use the Microsoft 365 Defender portal to create user tags |
| solutions | Collaborate Teams Direct Connect | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-teams-direct-connect.md | When you enable shared channels in Teams with another organization: - Your organization's custom (line of business) apps will be available in shared channels and external participants will be able to access them. - Your organization's apps list will be available in shared channels and external participants will be able to access them. -> [!NOTE] -> Shared channels is in preview and requires that you have configured [Microsoft Teams Public Preview](/MicrosoftTeams/public-preview-doc-updates). If you plan to share channels with other organizations, they must also have configured Teams public preview. - ## Video demonstration This video shows the configuration steps described in this document. Azure AD B2B direct connect is disabled by default. To enable collaboration in s As part of this configuration, we enable the **Office 365** application, which includes Teams and Teams-integrated services such as SharePoint. > [!NOTE]-> Changes to cross-tenant access settings may take two hours to take effect. +> Changes to cross-tenant access settings may take up to three hours fifteen minutes to take effect. ### Add an organization |
| test-base | Clonepackage | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/test-base/clonepackage.md | + + Title: 'Clone an existing package' +description: How to clone an existing package +search.appverid: MET150 ++++audience: Software-Vendor + Last updated : 05/27/2022++ms.localizationpriority: medium ++++f1.keywords: NOCSH +++# Clone an existing package ++In this section, you'll learn how to create a new package by duplicating your previously published package as a starting point. There are multiple entrances on Test Base portal for you to start the clone package journey. ++> [!IMPORTANT] +> To use the clone package function, you need to have at least one successfully uploaded package on Test Base. ++## Starting from the New package page ++> [!div class="mx-imgBorder"] +> [  ](Media/clonepackage01_guidance.png#lightbox) ++1. On the **New package** page, you can select on the **Clone existing package**. Then select one package from the existing package list and click on **'Clone'**. ++ > [!div class="mx-imgBorder"] + > [  ](Media/clonepackage02_clone_package.png#lightbox) ++2. You'll be directed to the New package creation steps with all information and configuration pre-populated as same as the package you cloned. The only information you must have to change is the **Package version** under the **Basic information** section. ++ > [!NOTE] + > The combination of package name and version must be unique within your Test Base account. ++ > [!div class="mx-imgBorder"] + > [  ](Media/clonepackage03_basic_information.png#lightbox) ++3. You're able to: ++ - preview all pre-populated package setting information duplicating from the clone package. + - make any changes from step 1 to step 4 (See Uploading pre-built zip package for more detailed instruction). + - review and publish to Test Base. +++## Starting from the Manage packages page ++On the **Manage packages** page, you can clone a package by selecting on the **'Clone'** icon under the Quick actions column. ++> [!div class="mx-imgBorder"] +> [  ](Media/clonepackage04_manage_packages.png#lightbox) ++Or you can go to the **Package overview** page of the specific package youΓÇÖve selected from the **Manage packages** page and select on the **Clone package** icon in the top action menu. ++> [!div class="mx-imgBorder"] +> [  ](Media/clonepackage05_overview.png#lightbox) + |
| test-base | Testoverview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/test-base/testoverview.md | f1.keywords: NOCSH # Test your application on Test Base -This is a comprehensive guide for you to create a new package and test it on Test Base with various application types. Please refer to the specific documentation for your own app: +In this section, you'll learn how to create packages with different types of applications for uploading and testing on **Test Base**. Application types consist of the following values: -## Test Binaries package on Test Base + > [!div class="mx-imgBorder"] + >  -See [Test Binaries package](testapplication.md) to create a Test Base package with Binaries file (i.e., .exe or .msi). + - **Test Binaries files** -## Test your Intune app on Test Base + See [Creating and Testing Binary Files on Test Base](testapplication.md) to prepare a package with a Binary application file (.exe, .msi) for uploading and testing. -See [Test your Intune app](testintuneapplication.md) to create a Test Base package with an Intunewin app. + - **Intunewin app** -## Upload your Test Base package (Zip) + See [Test your Intune app on Test Base](testintuneapplication.md) to prepare a package with an Intune application file (.intunewin) for uploading and testing. ++ - **Pre-built Zip package** ++ See [Uploading pre-built zip package](uploadApplication.md) if you already have an offline built package in .zip format. ++ - **Clone existing package** ++ See [Clone an existing package](clonepackage.md) to create a new package by duplicating your previously published package. -To learn more, see [Zip upload](uploadApplication.md) if you already have a Test Base package. |