| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Meetings New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/adoption/meetings-new.md | We provide you with supporting data on each of the Set Up, Meet up and Follow Up This represents the phase that involves scheduling and sharing the details of the meeting and participants joining the meeting. - **Communication shared ahead of time**: This represents the score for Microsoft Teams meetings that had a Teams conversation meeting chat started before conducting the meeting. For this to be tracked, a user must go to the meeting chat with the participants and send a message to the participants, before the scheduled meeting time.-- **Scheduled with at least 24 hours notice**: This represents the score for Microsoft Teams meetings that were scheduled at least 24 hours earlier than their start time. - **Invitation accepted at a high rate (>50%)**: This represents the score for Microsoft Teams meetings that had more than 50% of invited participants accept the meeting invite.-- **Joined within 5 minutes of start time (>50%)**: This represents the score for Microsoft Teams meetings that had more than 50% of invited participants join the meeting within 5 minutes of the start time. ## Meet up |
| admin | Servicenow Authentication | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/servicenow-authentication.md | The Microsoft 365 support integration app executes tests to make sure the integr Microsoft 365 support integration is enabled for the user with one of these roles: -- **x_mioms_m365_assis.insights_user**ΓÇöThis role is required to view the **Recommended Solutions & Articles** and **Microsoft Service Health** features in your ServiceNow instance.+- **x_mioms_m365_assis.insights_user**ΓÇöThis role is required to view the **Recommended Solutions & Articles** and **Microsoft Service Health** features in the ServiceNow incident view. -- **x_mioms_m365_assis.administrator**ΓÇöThis role is required to escalate your ServiceNow incidents to Microsoft support using your linked Microsoft 365 Admin account. Continue to the following section to link your admin account in the app's settings.+- **x_mioms_m365_assis.administrator**ΓÇöThis role is required to escalate ServiceNow incidents to Microsoft support using a linked Microsoft 365 admin account. Follow the next section to link your admin account in the app's settings and finalize the steps to create Microsoft support cases. ++In order for every member of your organization to be able to escalate ServiceNow incidents as support cases to Microsoft, each member must have the x_mioms_m365_assis.administrator role applied. The x_mioms_m365_assis.insights_user role is required to gain access to the Recommended Solutions & Articles and Microsoft Service Health information in the ServiceNow incident view; it is not required to create Microsoft support cases. ### Link Microsoft 365 Admin account Continue with these instructions if you are looking to escalate your ServiceNow incidents to Microsoft support from your ServiceNow instance via the app. -If any users are provisioned with the role **x_mioms_m365_assis.administrator** and are using different Microsoft 365 accounts to manage a Microsoft 365 support case, they must set up their Microsoft 365 admin email account by navigating to **Microsoft 365 support** > **Link Account**. +If any users are provisioned with the role **x_mioms_m365_assis.administrator** and are using different Microsoft 365 accounts to manage a Microsoft 365 support case, they must set up their Microsoft 365 admin email account by navigating to **Microsoft 365 support** > **Link Account**. Each member is not required to link their Microsoft 365 tenant email account. You are only required to enter a single valid Microsoft 365 admin email account that has ticket creation permissions. The app will only maintain a single admin account for this purpose. :::image type="content" source="../../media/ServiceNow-guide/servicenow-guide-image21.png" lightbox="../../media/ServiceNow-guide/servicenow-guide-image21.png" alt-text="Graphical user interface, text, application, chat or text message Description automatically generated"::: |
| business-premium | M365bp Set Up Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-set-up-compliance.md | For more information about compliance features in Microsoft 365 for business, se ## Use sensitivity labels -Check out this video and others on our [YouTube channel](https://go.microsoft.com/fwlink/?linkid=2198022). - Sensitivity labels are available in Microsoft 365 Apps (such as Outlook, Word, Excel, and PowerPoint). Examples of labels include: - Normal Use the following articles to get started with DLP: - [Set up BYOD devices](m365bp-set-up-unmanaged-devices.md) or [Set up and secure managed devices](m365bp-protect-managed-devices.md) - [Use email securely](m365bp-use-email-securely.md)-- [Collaborate and share securely](m365bp-collaborate-share-securely.md)+- [Collaborate and share securely](m365bp-collaborate-share-securely.md) |
| compliance | Alert Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/alert-policies.md | The tables also indicate the Office 365 Enterprise and Office 365 US Government |**Email sending limit exceeded**|Generates an alert when someone in your organization has sent more mail than is allowed by the outbound spam policy. This is usually an indication the user is sending too much email or that the account may be compromised. If you get an alert generated by this alert policy, it's a good idea to [check whether the user account is compromised](../security/office-365-security/responding-to-a-compromised-email-account.md).|Medium|No|E1/F1/G1, E3/F3/G3, or E5/G5| |**Form blocked due to potential phishing attempt**|Generates an alert when someone in your organization has been restricted from sharing forms and collecting responses using Microsoft Forms due to detected repeated phishing attempt behavior.|High|No|E1, E3/F3, or E5| |**Form flagged and confirmed as phishing**|Generates an alert when a form created in Microsoft Forms from within your organization has been identified as potential phishing through Report Abuse and confirmed as phishing by Microsoft.|High|No|E1, E3/F3, or E5|-|**Graders disagreement with Tenant Allow/Block List entry**|Generates an alert when Microsoft determines that the admin submission corresponding to an allow entry in the Tenant Allow/Block List is found to be malicious. This event is triggered as soon as the submission has been analyzed by Microsoft. <br/><br/> The allow entry will continue to exist for its stipulated duration. For more information on events that trigger this alert, see [Manage the Tenant Allow/Block list](../security/office-365-security/tenant-allow-block-list-about.md).|Informational|No|E1/F1/G1, E3/F3/G3, or E5/G5| +|**A Tenant Allow Block List entry has been found malicious**|Generates an alert when Microsoft determines that the admin submission corresponding to an allow entry in the Tenant Allow/Block List is found to be malicious. This event is triggered as soon as the submission has been analyzed by Microsoft. <br/><br/> The allow entry will continue to exist for its stipulated duration. For more information on events that trigger this alert, see [Manage the Tenant Allow/Block list](../security/office-365-security/tenant-allow-block-list-about.md).|Informational|No|E1/F1/G1, E3/F3/G3, or E5/G5| |**Malware campaign detected after delivery**┬╣|Generates an alert when an unusually large number of messages containing malware are delivered to mailboxes in your organization. If this event occurs, Microsoft removes the infected messages from Exchange Online mailboxes.|High|No|E5/G5 or Microsoft Defender for Office 365 P2 add-on subscription| |**Malware campaign detected and blocked**┬╣|Generates an alert when someone has attempted to send an unusually large number of email messages containing a certain type of malware to users in your organization. If this event occurs, the infected messages are blocked by Microsoft and not delivered to mailboxes.|Low|No|E5/G5 or Defender for Office 365 P2 add-on subscription| |**Malware campaign detected in SharePoint and OneDrive**┬╣|Generates an alert when an unusually high volume of malware or viruses is detected in files located in SharePoint sites or OneDrive accounts in your organization.|High|No|E5/G5 or Defender for Office 365 P2 add-on subscription| |
| compliance | Customer Key Manage | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/customer-key-manage.md | To initiate the data purge path, complete these steps: ### Revoke your Customer Keys and the availability key for SharePoint Online, OneDrive for Business, and Teams files -Purging of SharePoint, OneDrive for work or school, and Teams files DEPs is not supported in Customer Key. These multi-workload DEPs are used to encrypt data across multiple workloads across all tenant users. Purging such a DEP would result in data from across multiple workloads becoming inaccessible. If you decide to exit Microsoft 365 services altogether, you could pursue the path of tenant deletion per the documented process. See how to [delete a tenant in Azure Active Directory](/azure/active-directory/enterprise-users/directory-delete-howto). +Purging of SharePoint, OneDrive for work or school, and Teams files DEPs is not supported in Customer Key. If you decide to exit Microsoft 365 services altogether, you could pursue the path of tenant deletion per the documented process. See how to [delete a tenant in Azure Active Directory](/azure/active-directory/enterprise-users/directory-delete-howto). ## Related articles |
| compliance | Device Onboarding Sccm | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/device-onboarding-sccm.md | description: Use Configuration Manager to deploy the configuration package on de 4. Select **Download package**, and save the .zip file. -5. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *DeviceComplianceOnboardingScript.cmd*. +5. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *DeviceCompliance.onboarding*. 6. Deploy the package by following the steps in the [Packages and Programs in System Center 2012 R2 Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg699369(v=technet.10)) article. |
| compliance | Encryption Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/encryption-sensitivity-labels.md | f1.keywords: Previously updated : 05/31/2023 Last updated : 06/06/2023 audience: Admin When the options are supported, use the following table to identify when users s When both settings are selected, the label is therefore visible in both Outlook and in Word, Excel, and PowerPoint. -A sensitivity label that lets users assign permissions must be applied to content manually by users; it can't be auto-applied or used as a recommended label. +A sensitivity label that lets users assign permissions can be recommended to users, but can only be automatically applied for the Do Not Forward and Encrypt-Only options. Configuring the user-assigned permissions: |
| compliance | Insider Risk Management Forensic Evidence Manage | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-forensic-evidence-manage.md | When you select the **Forensics evidence** tab, captured clips and associated in Each captured clip includes the following information: -- **Date/time (UTC)**: The date, time (UTC), and duration of the capture.+- **Date/time (UTC)**: The date, time (UTC), and duration of the capture. The duration of the capture is the total time spanned by the capture. The actual length of the capture may be shorter since insider risk management automatically eliminates identical frames. - **Device**: The name of the device in Windows 10/11. - **Activities**: The insider risk management activity type included in the capture. These activities are based on global and policy indicators assigned to the associated policy. - **User**: The name of the user. |
| compliance | Retention | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention.md | f1.keywords: Previously updated : 04/24/2023 Last updated : 06/05/2023 audience: Admin For standard retention labels (they don't mark items as a [record or regulatory For retention labels that mark items as a record or a regulatory record: -- These retention labels are never automatically changed during their configured retention period.+- These retention labels are never automatically changed during their configured retention period, even if the existing label was applied as a default label. - Only admins for the container can manually change or remove retention labels that mark items as a record, but can't manually change or remove retention labels that mark items as a regulatory record. For more information, see [Compare restrictions for what actions are allowed or blocked](records-management.md#compare-restrictions-for-what-actions-are-allowed-or-blocked). |
| compliance | Sensitivity Labels Sharepoint Onedrive Files | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files.md | description: "Administrators can enable sensitivity label support for Word, Exce >*[Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance).* -Enable built-in labeling for [supported Office files](sensitivity-labels-office-apps.md#office-file-types-supported) in SharePoint and OneDrive so that users can apply your [sensitivity labels](sensitivity-labels.md) in Office for the web. When this feature is enabled, users will see the **Sensitivity** button on the ribbon so they can apply labels, and see any applied label name on the status bar. +Enable built-in labeling for [supported Office files](sensitivity-labels-office-apps.md#office-file-types-supported) in SharePoint and OneDrive so that users can apply your [sensitivity labels](sensitivity-labels.md) in Office for the web. When this feature is enabled, users see the **Sensitivity** button on the ribbon so they can apply labels, and see any applied label name on the status bar. Now rolling out in preview: For SharePoint, users can also see and apply sensitivity labels from the details pane. This method is also available from the **Files** tab in Teams. -Enabling this feature also results in SharePoint and OneDrive being able to process the contents of Office files that have been encrypted by using a sensitivity label. The label can be applied in Office for the web, or in Office desktop apps and uploaded or saved in SharePoint and OneDrive. Until you enable this feature, these services can't process encrypted files, which means that coauthoring, eDiscovery, Microsoft Purview data loss prevention, search, and other collaborative features won't work for these files. +Enabling this feature also results in SharePoint and OneDrive being able to process the contents of Office files that have been encrypted by using a sensitivity label. The label can be applied in Office for the web, or in Office desktop apps and uploaded or saved in SharePoint and OneDrive. Until you enable this feature, these services can't process encrypted files, which means that coauthoring, eDiscovery, data loss prevention, search, and other collaborative features won't work for these files. After you enable sensitivity labels for Office files in SharePoint and OneDrive, for new and changed files that have a sensitivity label that applies encryption with a cloud-based key (and doesn't use [Double Key Encryption](double-key-encryption.md)): After you enable sensitivity labels for Office files in SharePoint and OneDrive, - External users can access documents that are labeled with encryption by using guest accounts. For more information, see [Support for external users and labeled content](sensitivity-labels-office-apps.md#support-for-external-users-and-labeled-content). -- Office 365 eDiscovery supports full-text search for these files and data loss prevention (DLP) policies support content in these files.+- eDiscovery supports full-text search for these files and data loss prevention (DLP) policies support content in these files. > [!NOTE] > If encryption has been applied with an on-premises key (a key management topology often referred to as "hold your own key" or HYOK), or by using [Double Key Encryption](double-key-encryption.md), the service behavior for processing the file contents doesn't change. So for these files, coauthoring, eDiscovery, data loss prevention, search, and other collaborative features won't work. |
| compliance | Sensitivity Labels Versions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-versions.md | The numbers listed are the minimum Office application versions required for each |[Sensitivity bar](sensitivity-labels-office-apps.md#sensitivity-bar) and [display label color](sensitivity-labels-office-apps.md#label-colors) |Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2303+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Under review |Under review |Under review |Under review | |[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)|Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Under review |Under review |Under review |Under review | |[Scope labels to files or emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails) |Current Channel: 2301+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: Under review |16.69+ |Preview: Rolling out to [Beta Channel](https://insider.office.com/join/ios) |Preview: Rolling out to [Beta Channel](https://insider.office.com/join/android)| [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |-|[Double Key Encryption (DKE)](encryption-sensitivity-labels.md#double-key-encryption) |Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) |Under review |Under review |Under review| Under review | +|[Double Key Encryption (DKE)](encryption-sensitivity-labels.md#double-key-encryption) |Preview: [Current Channel (Preview)](https://office.com/insider) |Under review |Under review |Under review| Under review | ## Sensitivity label capabilities in Outlook The numbers listed are the minimum Office application versions required for each |[Scope labels to files or emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails) |Current Channel: 2303+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Rolling out: 16.70+ <sup>\*</sup> | Rolling out: 4.2309+ |Rolling out: 4.2309+ |Yes | |[Preventing oversharing as DLP policy tip](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup-preview)|Preview: [Current Channel (Preview)](https://office.com/insider) |Under review |Under review |Under review |Under review | |[Label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments) |Current Channel: 2303+ <br /><br> Monthly Enterprise Channel: 2304+ <br /><br> Semi-Annual Enterprise Channel: 2302+ |Under review |Under review |Under review |Under review |-|[Double Key Encryption (DKE)](encryption-sensitivity-labels.md#double-key-encryption) |Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) |Under review |Under review |Under review| Under review | +|[Double Key Encryption (DKE)](encryption-sensitivity-labels.md#double-key-encryption) |Preview: [Current Channel (Preview)](https://office.com/insider) |Under review |Under review |Under review| Under review | **Footnotes:** |
| includes | Office 365 U.S. Government Dod Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/office-365-u.s.-government-dod-endpoints.md | -<!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> +<!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> <!--Please contact the Office 365 Endpoints team with any questions.--> <!--USGovDoD endpoints version 2023053000--> <!--File generated 2023-05-30 08:00:08.5578-->--## Exchange Online ++## Exchange Online ID | Category | ER | Addresses | Ports -- | -- | | | - ID | Category | ER | Addresses | Ports 4 | Default<BR>Required | Yes | `outlook-dod.office365.us, webmail.apps.mil` | **TCP:** 143, 25, 587, 993, 995 5 | Default<BR>Required | Yes | `attachments-dod.office365-net.us, autodiscover.<tenant>.mail.onmicrosoft.com, autodiscover.<tenant>.mail.onmicrosoft.us, autodiscover.<tenant>.onmicrosoft.com, autodiscover.<tenant>.onmicrosoft.us, autodiscover-s-dod.office365.us` | **TCP:** 443, 80 6 | Allow<BR>Required | Yes | `*.protection.apps.mil, *.protection.office365.us`<BR>`23.103.191.0/24, 23.103.199.0/25, 23.103.204.0/22, 52.181.167.52/32, 52.181.167.91/32, 52.182.95.219/32, 2001:489a:2202::/62, 2001:489a:2202:8::/62, 2001:489a:2202:2000::/63` | **TCP:** 25, 443--## SharePoint Online and OneDrive for Business ++## SharePoint Online and OneDrive for Business ID | Category | ER | Addresses | Ports -- | -- | | | - ID | Category | ER | Addresses | Ports 10 | Default<BR>Required | No | `*.wns.windows.com, g.live.com, oneclient.sfx.ms` | **TCP:** 443, 80 19 | Allow<BR>Required | Yes | `*.od.apps.mil, od.apps.mil` | **TCP:** 443, 80 20 | Default<BR>Required | No | `*.svc.ms, az741266.vo.msecnd.net, spoprod-a.akamaihd.net, static.sharepointonline.com` | **TCP:** 443, 80--## Skype for Business Online and Microsoft Teams ++## Skype for Business Online and Microsoft Teams ID | Category | ER | Addresses | Ports -- | -- | | -- | -- 7 | Optimize<BR>Required | Yes | `*.dod.teams.microsoft.us, *.online.dod.skypeforbusiness.us, dod.teams.microsoft.us`<BR>`52.127.64.0/21, 52.180.249.148/32, 52.180.252.118/32, 52.180.252.187/32, 52.180.253.137/32, 52.180.253.154/32, 52.181.165.243/32, 52.181.166.119/32, 52.181.167.43/32, 52.181.167.64/32, 52.181.200.104/32, 104.212.32.0/22, 104.212.60.0/23, 195.134.240.0/22` | **TCP:** 443<BR>**UDP:** 3478, 3479, 3480, 3481 21 | Default<BR>Required | No | `dodteamsapuiwebcontent.blob.core.usgovcloudapi.net, msteamsstatics.blob.core.usgovcloudapi.net, statics.teams.microsoft.com` | **TCP:** 443 22 | Allow<BR>Required | Yes | `endpoint1-proddodcecompsvc-dodc.streaming.media.usgovcloudapi.net, endpoint1-proddodeacompsvc-dode.streaming.media.usgovcloudapi.net`<BR>`52.181.167.113/32, 52.182.52.226/32` | **TCP:** 443--## Microsoft 365 Common and Office Online + +> [!NOTE] +> For Cross-Cloud Anonymous Join to work properly, you must add these endpoints for the cloud of the target meeting to the safe senders list: +> - [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges) +> - [Office 365 U.S. Government GCC High endpoints](/microsoft-365/enterprise/microsoft-365-u-s-government-gcc-high-endpoints) ++## Microsoft 365 Common and Office Online ID | Category | ER | Addresses | Ports -- | - | | - | - |
| includes | Office 365 U.S. Government Gcc High Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/office-365-u.s.-government-gcc-high-endpoints.md | -<!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> +<!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> <!--Please contact the Office 365 Endpoints team with any questions.--> <!--USGovGCCHigh endpoints version 2023053000--> <!--File generated 2023-05-30 08:00:09.7122-->--## Exchange Online ++## Exchange Online ID | Category | ER | Addresses | Ports -- | -- | | -- | - ID | Category | ER | Addresses | Ports 4 | Default<BR>Required | Yes | `attachments.office365-net.us, autodiscover.<tenant>.mail.onmicrosoft.com, autodiscover.<tenant>.mail.onmicrosoft.us, autodiscover.<tenant>.onmicrosoft.com, autodiscover.<tenant>.onmicrosoft.us, autodiscover-s.office365.us` | **TCP:** 443, 80 5 | Default<BR>Required | Yes | `outlook.office365.us` | **TCP:** 143, 25, 587, 993, 995 6 | Allow<BR>Required | Yes | `*.manage.office365.us, *.protection.office365.us, *.scc.office365.us, manage.office365.us, scc.office365.us`<BR>`13.72.179.197/32, 13.72.183.70/32, 23.103.191.0/24, 23.103.199.128/25, 23.103.208.0/22, 52.227.170.14/32, 52.227.170.120/32, 52.227.178.94/32, 52.227.180.138/32, 52.227.182.149/32, 52.238.74.212/32, 52.244.65.13/32, 2001:489a:2202:4::/62, 2001:489a:2202:c::/62, 2001:489a:2202:2000::/63` | **TCP:** 25, 443--## SharePoint Online and OneDrive for Business ++## SharePoint Online and OneDrive for Business ID | Category | ER | Addresses | Ports -- | -- | | - | - 9 | Optimize<BR>Required | Yes | `*.sharepoint.us`<BR>`20.34.8.0/22, 104.212.50.0/23, 2001:489a:2204:2::/63, 2001:489a:2204:800::/54` | **TCP:** 443, 80 10 | Default<BR>Required | No | `*.wns.windows.com, admin.onedrive.us, g.live.com, oneclient.sfx.ms` | **TCP:** 443, 80 20 | Default<BR>Required | No | `*.svc.ms, az741266.vo.msecnd.net, spoprod-a.akamaihd.net, static.sharepointonline.com` | **TCP:** 443, 80--## Skype for Business Online and Microsoft Teams ++## Skype for Business Online and Microsoft Teams ID | Category | ER | Addresses | Ports -- | -- | | | - 7 | Optimize<BR>Required | Yes | `52.127.88.0/21, 104.212.44.0/22, 195.134.228.0/22` | **UDP:** 3478, 3479, 3480, 3481 21 | Default<BR>Required | No | `msteamsstatics.blob.core.usgovcloudapi.net, statics.teams.microsoft.com, teamsapuiwebcontent.blob.core.usgovcloudapi.net` | **TCP:** 443 31 | Allow<BR>Required | Yes | `*.gov.skypeforbusiness.us, *.gov.teams.microsoft.us, gov.teams.microsoft.us`<BR>`52.127.88.0/21, 104.212.44.0/22, 195.134.228.0/22` | **TCP:** 443, 80--## Microsoft 365 Common and Office Online + +> [!NOTE] +> For Cross-Cloud Anonymous Join to work properly, you must add these endpoints for the cloud of the target meeting to the safe senders list: +> - [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges) +> - [Office 365 U.S. Government DoD endpoints](/microsoft-365/enterprise/microsoft-365-u-s-government-dod-endpoints) ++## Microsoft 365 Common and Office Online ID | Category | ER | Addresses | Ports -- | - | | -- | - |
| includes | Office 365 Worldwide Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/office-365-worldwide-endpoints.md | -<!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> +<!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> <!--Please contact the Office 365 Endpoints team with any questions.--> <!--Worldwide endpoints version 2023053000--> <!--File generated 2023-05-30 08:00:07.1339-->--## Exchange Online ++## Exchange Online ID | Category | ER | Addresses | Ports -- | - | | - | -- ID | Category | ER | Addresses | Ports 8 | Default<BR>Required | No | `*.outlook.com, autodiscover.<tenant>.onmicrosoft.com` | **TCP:** 443, 80 9 | Allow<BR>Required | Yes | `*.protection.outlook.com`<BR>`40.92.0.0/15, 40.107.0.0/16, 52.100.0.0/14, 52.238.78.88/32, 104.47.0.0/17, 2a01:111:f400::/48, 2a01:111:f403::/48` | **TCP:** 443 10 | Allow<BR>Required | Yes | `*.mail.protection.outlook.com`<BR>`40.92.0.0/15, 40.107.0.0/16, 52.100.0.0/14, 104.47.0.0/17, 2a01:111:f400::/48, 2a01:111:f403::/48` | **TCP:** 25--## SharePoint Online and OneDrive for Business + ++## SharePoint Online and OneDrive for Business ID | Category | ER | Addresses | Ports -- | -- | | -- | - ID | Category | ER | Addresses | Ports 36 | Default<BR>Required | No | `g.live.com, oneclient.sfx.ms` | **TCP:** 443, 80 37 | Default<BR>Required | No | `*.sharepointonline.com, spoprod-a.akamaihd.net` | **TCP:** 443, 80 39 | Default<BR>Required | No | `*.svc.ms` | **TCP:** 443, 80--## Skype for Business Online and Microsoft Teams ++## Skype for Business Online and Microsoft Teams ID | Category | ER | Addresses | Ports | - | | - | - ID | Category | ER | Addresses | Ports 127 | Default<BR>Required | No | `*.skype.com` | **TCP:** 443, 80 167 | Default<BR>Required | No | `*.ecdn.microsoft.com` | **TCP:** 443 180 | Default<BR>Required | No | `compass-ssl.microsoft.com` | **TCP:** 443--## Microsoft 365 Common and Office Online + +> [!NOTE] +> For Cross-Cloud Anonymous Join to work properly, you must add these endpoints for the cloud of the target meeting to the safe senders list: +> - [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges) +> - [Office 365 U.S. Government DoD endpoints](/microsoft-365/enterprise/microsoft-365-u-s-government-dod-endpoints) +++## Microsoft 365 Common and Office Online ID | Category | ER | Addresses | Ports | -- | | -- | - |
| lighthouse | M365 Lighthouse Deployment Insights Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-deployment-insights-overview.md | description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthous # Understanding deployment insights in Microsoft 365 Lighthouse -Microsoft 365 Lighthouse provides deployment insights within and across the tenants you manage. Deployment insights are derived from a combination of signals that are either detected by Lighthouse or entered into Lighthouse by a user in the partner tenant. The single view enables you to: +Microsoft 365 Lighthouse provides deployment insights within and across the tenants you manage. Deployment insights are derived from a combination of signals that are either detected by Lighthouse or entered into Lighthouse by a user in the partner tenant. Deployment insights help you: -- Understand the deployment status across all tenants, users, and tasks+- Understand the deployment status across all customer tenants, users, and tasks. -- Review deployment exceptions such as **Dismissed** tasks and **Excluded** users+- Review deployment exceptions such as **Dismissed** tasks and **Excluded** users. - Review regressions such as tasks that change from a **Compliant** or **Dismissed** status to a status of **Not compliant** or **Not licensed**. -- Quantify threats based on user- and task-level deployment progress+- Quantify threats based on user- and task-level deployment progress. -- Prioritize deployment activities based on risk+- Prioritize deployment activities based on risk. -To access Deployment insights, in the left navigation pane in Lighthouse, select┬á**Deployment \> Deployment insights**. +To access deployment insights, in the left navigation pane in Lighthouse, select┬á**Deployment \> Deployment insights**. ## Watch: Deployment insights > [!VIDEO https://www.microsoft.com/videoplayer/embed/RW15vPs] ## Deployment insights page-The Deployment insights page includes the following: +The **Deployment insights** page includes the following: - Tenant progress- - User progress+- Deployment insights based on customer tenants and tasks -- Deployment insights based on tenants and tasks--**Note:** The Deployment insights page measures deployment progress across all tenants that have an Onboarding Status of **Active**. By default, the deployment insights are filtered to display insights for all tenants but can be filtered by tenant tag. +> [!NOTE] +> The **Deployment insights** page measures deployment progress across all customer tenants that have an onboarding status of **Active**. By default, the deployment insights are filtered to display insights for all tenants but can be filtered by tenant tag. :::image type="content" source="../media/m365-lighthouse-deployment-insights-overview/m365-lighthouse-deployment-insights-overview-page.png" alt-text="Screenshot of deployment insights page" lightbox="../media/m365-lighthouse-deployment-insights-overview/m365-lighthouse-deployment-insights-overview-page.png"::: ### Tenant progress -The tenant progress graph measures deployment progress by tenant, reporting the status of each tenantsΓÇÖ deployment plans as either: +The tenant progress graph measures deployment progress by customer tenant, reporting the status of each tenants' deployment plan as one of the following: -- **Complete** ΓÇô the status of all deployment tasks is **Compliant** or **Dismissed**.+- **Complete** ΓÇô The status of all deployment tasks is **Compliant** or **Dismissed**. -- **Not complete** ΓÇô the status of for one or more of the deployment tasks is **Not compliant** or **Not licensed**.+- **Not complete** ΓÇô The status of one or more of the deployment tasks is **Not compliant** or **Not licensed**. ### User progress -The user progress graph measures deployment progress by user, reporting users as either: +The user progress graph measures deployment progress by user, reporting deployment progress status as one of the following: -- **Complete** ΓÇô the status for all deployment tasks is either **Compliant**, **Excluded**, or **Not targeted**.+- **Complete** ΓÇô The status of all deployment tasks is **Compliant**, **Excluded**, or **Not targeted**. -- **Not complete** ΓÇô the status for one or more of the deployment tasks is either **Not compliant** or **Not licensed**.+- **Not complete** ΓÇô The status of one or more of the deployment tasks is either **Not compliant** or **Not licensed**. ### Deployment insights table -The deployment insights table organizes information by tenant and task. +The deployment insights table organizes information by customer tenant and task. -The **Tenants** tab pivot can be filtered by deployment plan status and baseline. It provides the following information for each tenant: +The data on the **Tenants** tab can be filtered by deployment plan status and baseline. It provides the following information for each customer tenant: | **Column** | **Description** | |||-| Tenant | The name of the tenant. | -| Baseline | The baseline that is assigned to the tenant. | -| Deployment plan status | The status of the deployment plan; either **Complete** or **Not complete**. | -| Task progress | The number of total tasks that are in a state of completion; either **Compliant** or **Dismissed**. | +| Tenant | The name of the customer tenant. | +| Baseline | The baseline that's assigned to the customer tenant. | +| Deployment plan status | The status of the deployment plan—either **Complete** or **Not complete**. | +| Task progress | The number of total tasks that are in a state of completion—either **Compliant** or **Dismissed**. | | Dismissed tasks | The number of tasks that have been **Dismissed**. |-| Not licensed tasks | The number of tasks for which the tenant is **Not licensed**. | +| Not licensed tasks | The number of tasks for which the customer tenant is **Not licensed**. | | Regressed tasks | The number of tasks that have regressed from a state of completion (either **Compliant** or **Dismissed**) to a state of either **Not compliant** or **Not licensed**. |-| User progress | The number of users for which all deployment tasks are either **Compliant**, **Excluded**, or **Not targeted**. | +| User progress | The number of users for which all deployment tasks are **Compliant**, **Excluded**, or **Not targeted**. | | Excluded users | The number of users that have a status of **Excluded** for one or more deployment tasks. | | Exclusions | The number of instances of a user having a status of **Excluded** across all deployment tasks. | -To better understand deployment insights, here are a few examples for how different tenant configurations and deployment activities are reflected in the deployment insights table. +To better understand deployment insights, here are a few examples of how different tenant configurations and deployment activities are reflected in the deployment insights table. -In this example, all tenants have 100 users and have been assigned a baseline that includes 10 tasks: +In this example, all customer tenants have 100 users and have been assigned a baseline that includes 10 tasks: - A ΓÇô Complete, with no tasks that have been **Dismissed** and no users that have been **Excluded** - B ΓÇô Complete, with one task that has been **Dismissed** In this example, all tenants have 100 users and have been assigned a baseline th ### Deployment insights details by tenant -Selecting any tenant from the list opens the deployment insights details pane for that tenant, which provides the following information for each tenant: +Selecting any customer tenant from the list opens the deployment insights details pane for that tenant, which provides the following information for each tenant: - Overview - Dismissed tasks - Excluded users - Required licenses -**NOTE**: Deployment insights around dismissed tasks, excluded users, and required licenses are also available from the **Tenant** page. +> [!NOTE] +> Deployment insights for dismissed tasks, excluded users, and required licenses are also available on the **Tenants** page. #### Overview tab -The **Overview** tab provides the status of each deployment task assigned to the tenant with the following information: +The **Overview** tab provides the status of each deployment task assigned to the customer tenant and includes the following information: | **Column** | **Description** | |-||-| Tasks | The name of the task. | -| Task Status | The status of the deployment task. | -| User status | The number of users who have completed the task, who have been excluded from the task, or who haven't been targeted for the task. | +| Task | The name of the task. | +| Task status | The status of the deployment task. | +| User status | The number of users who've completed the task, who've been excluded from the task, or who haven't been targeted for the task. | #### Dismissed tasks tab -The **Dismissed tasks** tab provides details around tasks that have been dismissed from the deployment plan and allows you to reinstate tasks. The tab includes the following information: +The **Dismissed tasks** tab provides details about tasks that have been dismissed from the deployment plan and allows you to reinstate tasks. The tab includes the following information: | **Column** | **Description** | ||--| The **Dismissed tasks** tab provides details around tasks that have been dismiss #### Excluded users tab -The **Excluded users** tab provides details around users that have been excluded from a deployment task. This tab includes the following information: +The **Excluded users** tab provides details about users who've been excluded from a deployment task. This tab includes the following information: | **Column** | **Description** | |--|-|-| Task with excluded users | The name of the task from which one or more users has been excluded. | -| Excluded users | The names of each user that has been excluded. | +| Task with excluded users | The name of the task from which one or more users have been excluded. | +| Excluded users | The names of each user who's been excluded. | #### Required licenses tab -The **Required licenses** tab provides details around deployment tasks for which one or more users requires additional licensing to complete the task. This tab includes the following information: +The **Required licenses** tab provides details about deployment tasks where one or more users require additional licensing to complete the task. This tab includes the following information: | **Column** | **Description** | |-||-| Tasks with not licensed users | The name of the task from which one or more users aren't licensed. | -| Not licensed users | The name of each user who isn't licensed to complete the task. | +| Tasks with not-licensed users | The name of the task for which one or more users aren't licensed. | +| Not-licensed users | The name of each user who isn't licensed to complete the task. | ### Deployment insights table by task -To view deployment insights by task, select the **Tasks** tab. The **Tasks** tab can be filtered by baseline and category. It provides the following information for each tenant: +To view deployment insights by task, select the **Tasks** tab. The data on the **Tasks** tab can be filtered by baseline and category. It provides the following information for each customer tenant: | **Column** | **Description** | ||--| | Task | The name of the task. | | Baseline | The baseline associated with the task. | | Assigned tenants | The number of tenants to which this task has been assigned. |-| Compliant | The number of tenants in which the status of the task is **Compliant**. | -| Not compliant | The number of tenants in which the status of the task is **Not compliant**. | -| Dismissed | The number of tenants in which the status of the task is **Dismissed**. | -| Not licensed | The number of tenants in which the status of the task is **Not licensed**. | +| Compliant | The number of tenants with a task status of **Compliant**. | +| Not compliant | The number of tenants with a task status of **Not compliant**. | +| Dismissed | The number of tenants with a task status of **Dismissed**. | +| Not licensed | The number of tenants with a task status of **Not licensed**. | -Selecting any task from the list opens the deployment insights details pane for that task, which provides the following information: +Select any task from the list to open the deployment insights details pane for that task, which provides the following information: | **Column** | **Description** | |||-| Tenant | The name of the tenant. | +| Tenant | The name of the customer tenant. | | Task status | The deployment status of the task for the tenant. | | Total users | The number of users who are assigned to the task. | | Compliant users | The number of users who are **Compliant**. | Selecting any task from the list opens the deployment insights details pane for | Not licensed users | The number of users who are **Not licensed** to complete the task. | | Not targeted users | The number of users who are **Not targeted** to complete this task. | -## Next Steps +## Next steps -For information on how to manage tenants using deployment insights, see [Manage deployments using insights in Microsoft 365 Lighthouse](m365-lighthouse-manage-tenants-using-deployment-insights.md). +For information on how to manage tenants by using deployment insights, see [Manage deployments using insights in Microsoft 365 Lighthouse](m365-lighthouse-manage-tenants-using-deployment-insights.md). ## Related content |
| security | Admin Submissions Mde | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/admin-submissions-mde.md | description: Learn how to use the unified submissions feature in Microsoft 365 D keywords: antivirus, spam, phish, file, alert, Microsoft Defender for Endpoint, false positive, false negative, blocked file, blocked url, submission, submit, report search.product: eADQiWindows 10XVcnh search.appverid: met150 Previously updated : 06/15/2021 Last updated : 06/5/2023 ms.mktglfcycl: deploy In Microsoft Defender for Endpoint, admins can use the unified submissions featu - The new unified submissions experience is available only in subscriptions that include Microsoft 365 Defender or Microsoft Defender for Endpoint Plan 2. -- To submit files to Microsoft, you need to be a member of one of the following role groups:+- To submit files to Microsoft, you need to be a member of one of the following groups: + - **Organization Management** or **Security Administrator** role groups in [Email & collaboration permissions in the Microsoft 365 Defender portal](../office-365-security/mdo-portal-permissions.md). + - **Global Administrator** or **Security Administrator** roles in [Azure AD permissions](../../admin/add-users/about-admin-roles.md). Membership in these roles give the required permissions _and_ permissions for other features in Microsoft 365. - - **Organization Management** or **Security Administrator** in the [Microsoft 365 Defender portal](../office-365-security/mdo-portal-permissions.md). +- For more information about how you can submit spam, phish, URLs, and email attachments to Microsoft, see [Use the Submissions page to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft](../office-365-security/submissions-admin.md). -- For more information about how you can submit spam, phish, URLs, and email attachments to Microsoft, see [Report messages and files to Microsoft](../office-365-security/submissions-report-messages-files-to-microsoft.md).+- To find the SHA256 hash value of a file in Windows, run the following command in a Command Prompt: `certutil.exe -hashfile "<Path>\<Filename>" SHA256`. -## Report items to Microsoft from the portal +## Submit a file or file hash to Microsoft from the Defender portal -If you have a file that you suspect might be malware or is being incorrectly detected (false positive), you can submit it to Microsoft for analysis using the Microsoft 365 Defender portal at https://security.microsoft.com/. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Actions & submissions** \> **Submissions**. Or, to go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. -### Submit a file or file hash +2. On the **Submissions** page, select the **Files** tab. -1. Open Microsoft 365 Defender at [https://security.microsoft.com](https://security.microsoft.com), click **Actions & submissions**, click **Submissions**, go to **Files** tab, and then select **Add new submission**. +3. On the **Files** tab, select :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Add new submission**. - :::image type="content" source="../../media/unified-admin-submission-new.png" alt-text="Screenshot showing how to add a new submission."::: + :::image type="content" source="../../media/unified-admin-submission-new.png" alt-text="Screenshot showing how to add a new submission."::: -2. Use the **Submit items to Microsoft for review** flyout that appears to submit the **File** or **File hash**. +2. In the **Submit items to Microsoft for review** flyout that opens, select **Files** or **File hash** from the **Select the submission type** dropdown list. -3. In the **Select the submission type** box, select **File** or **File hash** from the drop-down list. + - If you selected **Files**, configure the following options: + - Select **Browse files**. In the dialog that opens, find and select the file, and then select **Open**. Repeat this step as many times as necessary. To remove an entry from the flyout, select :::image type="icon" source="../../media/m365-cc-sc-close-icon.png" border="false"::: next to the entry. + - The maximum total size of all files is 500 MB. + - Use the password 'infected' to encrypt archive files. + - **The file should have been categorized as**: Select one of the following values: + - **Malware** (false negative) + - **Unwanted software** + - **Clean** (false positive) + - **Choose the priority**: Select one of the following values: + - **Low - bulk file or file hash submission** + - **Medium - standard submission** + - **High - needs immediate attention** (max three per day) + - **Notes for Microsoft (optional)**: Enter an optional note. + - **Share feedback and relevant content with Microsoft**: Read the privacy statement and then select this option. -4. When submitting a file, click **Browse files**. In the dialog that opens, find and select the file, and then click **Open**. Note that for **File hash** submissions, you'll either have to copy or type in the file hash. + :::image type="content" source="../../media/unified-admin-submission-file.png" alt-text="Screenshot showing how to submit files."::: -5. In the **This file should have been categorized as** section, choose either **Malware** (false negative), or **Unwanted software**, or **Clean** (false positive). + - If you selected **File hash**, configure the following options: + - In the empty box, enter the file hash value (for example, `2725eb73741e23a254404cc6b5a54d9511b9923be2045056075542ca1bfbf3fe`) and then press the ENTER key. Repeat this step as many times as necessary. To remove an entry from the flyout, select :::image type="icon" source="../../media/m365-cc-sc-close-icon.png" border="false"::: next to the entry. + - **The file should have been categorized as**: Select one of the following values: + - **Malware** (false negative) + - **Unwanted software** + - **Clean** (false positive) + - **Notes for Microsoft (optional)**: Enter an optional note. + - **Share feedback and relevant content with Microsoft**: Read the privacy statement and then select this option. -6. Next, **Choose the priority**. Note that for **File hash** submissions, **Low - bulk file or file hash submission** is the only choice, and is automatically selected. + :::image type="content" source="../../media/unified-admin-submission-file-hash.png" alt-text="Screenshot showing how to submit files hashes."::: - :::image type="content" source="../../media/unified-admin-submission-file.png" alt-text="Screenshot showing how to submit files."::: + When you're finished in the **Submit items to Microsoft for review** flyout, select **Submit**. -7. Click **Submit**. +Back on the **Files** tab of the **Submissions** page, the submission is shown. - If you want to view the details of your submission, select your submission from the **Submissions name** list to open the **Result details** flyout. +To view the details of the submission, select the submission by clicking anywhere in the row other than the check box next to the **Submission name**. The details of the submission are in the details flyout that opens. -## Report items to Microsoft from the Alerts page +## Report items to Microsoft from the Alerts page in the Defender portal -You can also submit a file or file hash directly from the list of alerts on the **Alerts** page. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Incidents & alerts** \> **Alerts**. Or, to go directly to the **Alerts** page, use <https://security.microsoft.com/alerts>. -1. Open the Microsoft 365 Defender at [https://security.microsoft.com](https://security.microsoft.com), click **Incidents & alerts**, and then click **Alerts** to view the list of alerts. +2. On the **Alerts** page, find the alert that contains the file you want to report. For example, you can select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**, and then select **Service sources** \> **Microsoft Defender for Endpoint**. -2. Select the alert you want to report. Note that you are submitting a file that is nestled within the alert. +3. Select the alert from the list by clicking anywhere in the row other than the check box next to the **Alert name** value. -3. Click the ellipses next to **Manage alert** to see additional options. Select **Submit items to Microsoft for review**. +4. In the details flyout that opens, select :::image type="icon" source="../../media/m365-cc-sc-more-actions-icon.png" border="false"::: \> **Submit items to Microsoft for review**. - :::image type="content" source="../../media/unified-admin-submission-alerts-queue.png" alt-text="Screenshot showing how to submit items from an alerts queue."::: + :::image type="content" source="../../media/unified-admin-submission-alerts-queue.png" alt-text="Screenshot showing how to submit items from an alerts queue."::: -4. In the next flyout that opens, select the submission type. +5. The options that are available in the **Submit items to Microsoft for review** flyout that opens are basically same as described in the previous section. - :::image type="content" source="../../media/unified-admin-submission-alert-queue-flyout.png" alt-text="Screenshot showing how to specify a submission type and fill in required fields."::: + The only difference is an **Include alert story** option that you can select to attach a JSON file that helps Microsoft investigate the submission. - If you select **File** as the submission type, upload the file, categorize your submission, and choose the priority. + :::image type="content" source="../../media/unified-admin-submission-alert-queue-flyout.png" alt-text="Screenshot showing how to specify a submission type and fill in required fields."::: - If you select **File Hash** as the submission type, choose the file hashes that are available from the drop-down. You can select multiple file hashes. + When you're finished in the **Submit items to Microsoft for review** flyout, select **Submit**. -5. Click **Submit**. +The submission is available on the **Files** tab of the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=file>. ## Related information |
| security | Advanced Features | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/advanced-features.md | Enabling the Skype for Business integration gives you the ability to communicate ## Office 365 Threat Intelligence connection -This feature is only available if you've an active Office 365 E5 or the Threat Intelligence add-on. For more information, see the Office 365 Enterprise E5 product page. +> [!IMPORTANT] +> This setting was used when Microsoft Defender for Office 365 and Microsoft Defender for Endpoint were in different portals previously. After the convergence of security experiences into a unified portal that is now called Microsoft 365 Defender, these settings are irrelevant and don't have any functionality associated with them. You can safely ignore the status of the control until it is removed from the portal. ++This feature is only available if you have an active subscription for Office 365 E5 or the Threat Intelligence add-on. For more information, see the [Office 365 E5 product page](https://www.microsoft.com/en-us/microsoft-365/enterprise/office-365-e5?activetab=pivot:overviewtab). -When you turn on this feature, you'll be able to incorporate data from Microsoft Defender for Office 365 into Microsoft 365 Defender to conduct a comprehensive security investigation across Office 365 mailboxes and Windows devices. +This feature enables you to incorporate data from Microsoft Defender for Office 365 into Microsoft 365 Defender to conduct a comprehensive security investigation across Office 365 mailboxes and Windows devices. > [!NOTE] > You'll need to have the appropriate license to enable this feature. |
| security | Built In Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/built-in-protection.md | Your notification tells you when built-in protection is coming and when tamper p You can opt out of built-in protection by specifying your own security settings. For example, if you prefer to not have tamper protection turned on automatically for your tenant, you can explicitly opt out. -> [!NOTE] +> [!CAUTION] > **We do not recommend turning tamper protection off**. Tamper protection provides you with better ransomware protection. > You must be a global administrator or security administrator to perform the following procedure. |
| security | Command Line Arguments Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/command-line-arguments-microsoft-defender-antivirus.md | Title: Use the command line to manage Microsoft Defender Antivirus description: Run Microsoft Defender Antivirus scans and configure next-generation protection with a dedicated command-line utility. -keywords: run windows defender scan, run antivirus scan from command line, run windows defender scan from command line, mpcmdrun, defender -ms.sitesec: library ms.localizationpriority: medium Previously updated : 03/13/2023 Last updated : 06/06/2023 In our example, the MpCmdRun utility starts a full antivirus scan on the device. |`-RemoveDynamicSignature [-SignatureSetID]`|Removes dynamic security intelligence.| |`-CheckExclusion -path <path>`|Checks whether a path is excluded.| |`-ValidateMapsConnection`|Verifies that your network can communicate with the Microsoft Defender Antivirus cloud service. This command will only work on Windows 10, version 1703 or higher.|-|`-ResetPlatform`| Revert platform binaries back to the previous installed version of the Defender platform.| -|`-RevertPlatform`|reset platform binaries back to `%ProgramFiles%\Windows Defender`.| +|`-ResetPlatform`| Reset platform binaries back to `%ProgramFiles%\Windows Defender`.| +|`-RevertPlatform`| Revert platform binaries back to the previously installed version of the Defender platform.| ## Common errors in running commands via mpcmdrun.exe |
| security | Configure Extension File Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus.md | Title: Configure and validate exclusions based on extension, name, or location description: Exclude files from Microsoft Defender Antivirus scans based on their file extension, file name, or location. -keywords: exclusions, files, extension, file type, folder name, file name, scans -ms.sitesec: library ms.localizationpriority: medium Previously updated : 11/15/2022 Last updated : 06/06/2023 You can validate that your exclusion lists are working by using PowerShell with In the following PowerShell snippet, replace `test.txt` with a file that conforms to your exclusion rules. For example, if you have excluded the `.testing` extension, replace `test.txt` with `test.testing`. If you are testing a path, ensure you run the cmdlet within that path. ```PowerShell-Invoke-WebRequest "http://www.eicar.org/download/eicar.com.txt" -OutFile "test.txt" +Invoke-WebRequest "https://secure.eicar.org/eicar.com.txt" -OutFile "test.txt" ``` If Microsoft Defender Antivirus reports malware, then the rule is not working. If there is no report of malware and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR test file website](http://www.eicar.org/86-0-Intended-use.html). |
| security | Configure Remediation Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-remediation-microsoft-defender-antivirus.md | You can also use the [`Set-MpPreference` PowerShell cmdlet](/powershell/module/d 5. Select **OK**. -<br/><br/> --|Location|Setting|Description|Default setting (if not configured)| -||||| -|Scan|Create a system restore point|A system restore point will be created each day before cleaning or scanning is attempted|Disabled| -|Scan|Turn on removal of items from scan history folder|Specify how many days items should be kept in the scan history|30 days| -|Root|Turn off routine remediation|You can specify whether Microsoft Defender Antivirus automatically remediates threats, or if it should ask the endpoint user what to do.|Disabled (threats are remediated automatically)| -|Quarantine|Configure removal of items from Quarantine folder|Specify how many days items should be kept in quarantine before being removed|90 days| -|Threats|Specify threat alert levels at which default action should not be taken when detected|Every threat that is detected by Microsoft Defender Antivirus is assigned a threat level (low, medium, high, or severe). You can use this setting to define how all threats for each of the threat levels should be remediated (quarantined, removed, or ignored)|Not applicable| -|Threats|Specify threats upon which default action should not be taken when detected|Specify how specific threats (using their threat ID) should be remediated. You can specify whether the specific threat should be quarantined, removed, or ignored|Not applicable| +|Setting|Description|Default setting (if not configured)| +|||| +|Scan <br/>Create a system restore point.|A system restore point is created each day before cleaning or scanning is attempted. |Disabled| +|Scan<br/>Turn on removal of items from scan history folder.|Specify how many days items should be kept in the scan history.|30 days| +|Root<br/>Turn off routine remediation.|Specify whether Microsoft Defender Antivirus automatically remediates threats, or whether to prompt the user.|Disabled. Threats are remediated automatically.| +|Quarantine<br/>Configure removal of items from Quarantine folder.|Specify how many days items should be kept in quarantine before being removed.|Items are kept in the quarantine folder indefinitely and are not automatically removed. | +|Threats<br/>Specify threat alert levels at which default action should not be taken when detected.|Every threat that is detected by Microsoft Defender Antivirus is assigned a threat level (low, medium, high, or severe). You can use this setting to define how all threats for each of the threat levels should be remediated (quarantined, removed, or ignored). |Not applicable| +|Threats<br/>Specify threats upon which default action should not be taken when detected.|Specify how specific threats (using their threat ID) should be remediated. You can specify whether the specific threat should be quarantined, removed, or ignored.|Not applicable| > [!IMPORTANT] > Microsoft Defender Antivirus detects and remediates files based on many factors. Sometimes, completing a remediation requires a reboot. Even if the detection is later determined to be a false positive, the reboot must be completed to ensure all additional remediation steps have been completed. >-> If you are certain Microsoft Defender Antivirus quarantined a file based on a false positive, you can restore the file from quarantine after the device reboots. See [Restore quarantined files in Microsoft Defender Antivirus](restore-quarantined-files-microsoft-defender-antivirus.md). -> -> To avoid this problem in the future, you can exclude files from the scans. See [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md). +> If you are certain Microsoft Defender Antivirus quarantined a file based on a false positive, you can restore the file from quarantine after the device reboots. See [Restore quarantined files in Microsoft Defender Antivirus](restore-quarantined-files-microsoft-defender-antivirus.md). To avoid this problem in the future, you can exclude files from the scans. See [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md). Also see [Configure remediation-required scheduled full Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md#remed) for more remediation-related settings. |
| security | Deploy Manage Removable Storage Intune | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deploy-manage-removable-storage-intune.md | Go to the Microsoft Intune admin center (<https://endpoint.microsoft.com/>) > ** - **Custom XML** as selected XML file Take a look at the **Overview** -> **Removable storage group**, you can create different group types. Here's a [group example XML file for any removable storage and CD-ROM and Windows portable devices](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Any%20Removable%20Storage%20and%20CD-DVD%20and%20WPD%20Group.xml).+ + To get the GroupId, sign in to the **Microsoft Intune admin center** and select **Groups** > **Copy the Object ID**. - :::image type="content" source="media/any-removable-storage-group.png" alt-text="Screenshot of creating any Removable Storage Group." lightbox="media/any-removable-storage-group.png"::: + :::image type="content" source="media/any-removable-storage-group.png" alt-text="Screenshot of creating any Removable Storage Group." lightbox="media/any-removable-storage-group.png"::: > [!NOTE] > Comments using XML comment notation `<!-- COMMENT -->` can be used in the Rule and Group XML files, but they must be inside the first XML tag, not the first line of the XML file. |
| security | Get Security Baselines Assessment Configurations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-security-baselines-assessment-configurations.md | Title: Security baselines assessment configurations + Title: Get baseline profile configurations description: Provides information about the security baselines assessment configurations that pull "Microsoft Defender Vulnerability Management" data. There are different API calls to get different types of data. In general, each API call contains the requisite data for devices in your organization. keywords: api, apis, export assessment, per device assessment, per machine assessment, vulnerability assessment report, device vulnerability assessment, device vulnerability report, secure configuration assessment, secure configuration report, software vulnerabilities assessment, software vulnerability report, vulnerability report by machine, search.appverid: met150 Last updated 05/02/2022 -# List security baselines assessment configurations +# List configurations in active baseline profiles [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] Last updated 05/02/2022 > Want to experience Microsoft Defender Vulnerability Management? Learn more about how you can sign up to the [Microsoft Defender Vulnerability Management public preview trial](../defender-vulnerability-management/get-defender-vulnerability-management.md). -## 1. Get all security baselines assessment configurations +## 1.API description -This API retrieves a list of all the possible security baselines assessment configurations and settings for all the available benchmarks. +This API retrieves a list of the configurations being assessed in active baseline profiles. ### 1.1 Parameters If successful, this method returns 200 OK with the list of baseline configuratio |Property | Type | Description | |:|:|:|-|Id | String | Unique identifier for the specific configuration in the baseline benchmark. +|uniqueId | String | Identifier for the specific configuration across baseline benchmarks. +|Id | String | Identifier of the specific configuration in the baseline benchmark. |benchmarkName| String | The name of the benchmark.+|benchmarkVersion| String | The version of the benchmark. May contain operating system details. |name | String | The configuration name at it appears in the benchmark. |description | String | The configuration description as it appears in the benchmark. |category | String | The configuration category as it appears in the benchmark. |complianceLevels|String|The compliance level of the benchmark where this configuration appears. |`cce`|Int|The CCE for this configuration as it appears in the benchmark. |rationale |String|The rationale for this configuration as it appears in the benchmark. For STIG benchmark this isn't supplied for this configuration.-|source|String| The registry path or other location used to determine the current device setting. +|source|Array [String]| Array of the registry paths or other locations used to determine the current device setting. +|recommendedValue|Array [String]|Array of the recommended value for each source returned in the ΓÇÿsourceΓÇÖ property array (values returned in the same order as the source property array). |remediation|String| The recommended steps to remediate.+|isCustom|Boolean| True if the configuration is customized, false if not. ## 1.6 Example GET https://api.securitycenter.microsoft.com/api/baselineConfigurations "@odata.context": " https://api-df.securitycenter.microsoft.com/api/$metadata#BaselineConfigurations ", "value": [ {- "id": "1.1.8", - "name": "(L1) Ensure 'Allow importing of payment info' is set to 'Disabled'", - "description": "<p xmlns:xhtml=\"http://www.w3.org/1999/xhtml\">This policy setting controls whether users are able to import payment information from another browser into Microsoft Edge as well as whether payment information is imported on first use.</p>", - "category": "Microsoft Edge", + "id": "9.3.9", + "uniqueId": "CIS_1.4.0-windows_server_2016_9.3.9", + "benchmarkName": "CIS", + "benchmarkVersion": "1.4.0-windows_server_2016", + "name": "(L1) Ensure 'Windows Firewall: Public: Logging: Log dropped packets' is set to 'Yes'", + "description": "<p xmlns:xhtml=\"http://www.w3.org/1999/xhtml\"> Use this option to log when Windows Firewall with Advanced Security discards an inbound packet for any reason. The log records why and when the packet was dropped. Look for entries with the word <span class=\"inline_block\">DROP</span> in the action column of the log. </p>", + "category": "Public Profile", "complianceLevels": [- "Level 1 (L1) - Corporate/Enterprise Environment (general use)", - "Level 2 (L2) - High Security/Sensitive Data Environment (limited functionality)" + "Level 1 - Domain Controller", + "Level 1 - Member Server", + "Level 2 - Domain Controller", + "Level 2 - Member Server" ],- "cce": "", - "rationale": "<p xmlns:xhtml=\"http://www.w3.org/1999/xhtml\">Having payment information automatically imported or allowing users to import payment data from another browser into Microsoft Edge could allow for sensitive data to be imported into Edge.</p>", - "remediation": "<div xmlns:xhtml=\"http://www.w3.org/1999/xhtml\">\r\n <p>\r\n <p>\r\nTo establish the recommended configuration via GP, set the following UI path to <span class=\"inline_block\">Disabled</span></p>\r\n <code class=\"code_block\">Computer Configuration\\Policies\\Administrative Templates\\Microsoft Edge\\Allow importing of payment info\r\n</code>\r\n <p>\r\n <strong>Note:</strong>\r\n This Group Policy path may not exist by default. It is provided by the Group Policy template <span class=\"inline_block\">MSEdge.admx/adml</span>\r\n that can be downloaded from Microsoft <a href=\"https://www.microsoft.com/en-us/edge/business/download\">here</a>\r\n. </p>\r\n <p class=\"bold\">Impact:</p>\r\n <p>\r\n <p>Users will be unable to perform a payment information import from other browsers into Microsoft Edge.</p>\r\n </p>\r\n </p>\r\n</div>", - "benchmarkName": "CIS" -"recommendedValue": [ - "Equals '0'" - ], - "source": [ - "hkey_local_machine\\software\\policies\\microsoft\\windows\\eventlog\\security\\retention" - ] - }, + "cce": "CCE-35116-3", + "rationale": "<p xmlns:xhtml=\"http://www.w3.org/1999/xhtml\">If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users.</p>", + "remediation": "<div xmlns:xhtml=\"http://www.w3.org/1999/xhtml\"> <p> <p> To establish the recommended configuration via GP, set the following UI path to <span class=\"inline_block\">Yes</span> : </p> <code class=\"code_block\">Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Firewall with Advanced Security\\Windows Firewall with Advanced Security\\Windows Firewall Properties\\Public Profile\\Logging Customize\\Log dropped packets </code> <p class=\"bold\">Impact:</p> <p> <p>Information about dropped packets will be recorded in the firewall log file.</p> </p> </p> </div>", + "recommendedValue": [ + "Equals '1'" + ], + "source": [ + "hkey_local_machine\\software\\policies\\microsoft\\windowsfirewall\\publicprofile\\logging\\logdroppedpackets" + ], + "isCustom": false + }, ] } ``` |
| security | Microsoft Defender Antivirus Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates.md | Title: Microsoft Defender Antivirus security intelligence and product updates description: Manage how Microsoft Defender Antivirus receives protection and product updates. ms.localizationpriority: high Previously updated : 05/31/2023 Last updated : 06/06/2023 audience: ITPro You can manage the distribution of updates through one of the following methods: For more information, see [Manage the sources for Microsoft Defender Antivirus protection updates](/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus). -> [!NOTE] -> - Monthly updates are released in phases, resulting in multiple packages visible in your [Window Server Update Services](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). -> - This article lists changes that are included in the broad release channel. [See the latest broad channel release here](https://www.microsoft.com/security/encyclopedia/adlpackages.aspx?action=info). -> - To learn more about the gradual rollout process, and to see more information about the next release, see [Manage the gradual rollout process for Microsoft Defender updates](manage-gradual-rollout.md). -> - To learn more about security intelligence updates, see [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware](https://www.microsoft.com/en-us/wdsi/defenderupdates). -> - If you're looking for a list of Microsoft Defender processes, **[download the mde-urls workbook](https://download.microsoft.com/download/6/b/f/6bfff670-47c3-4e45-b01b-64a2610eaef). -> - Platform updates can be temporarily postponed if other protection features (such as [Endpoint DLP](../../compliance/endpoint-dlp-getting-started.md) or [Device Control](device-control-report.md)) are actively monitoring running processes. Platform updates will be retried after a reboot or when all monitored services are stopped. +### Important points about product updates ++- Monthly updates are released in phases, resulting in multiple packages visible in your [Window Server Update Services](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). ++- This article lists changes that are included in the broad release channel. [See the latest broad channel release here](https://www.microsoft.com/security/encyclopedia/adlpackages.aspx?action=info). ++- To learn more about the gradual rollout process, and to see more information about the next release, see [Manage the gradual rollout process for Microsoft Defender updates](manage-gradual-rollout.md). ++- To learn more about security intelligence updates, see [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware](https://www.microsoft.com/en-us/wdsi/defenderupdates). ++- If you're looking for a list of Microsoft Defender processes, **[download the mde-urls workbook](https://download.microsoft.com/download/6/b/f/6bfff670-47c3-4e45-b01b-64a2610eaef). ++- Platform updates can be temporarily postponed if other protection features (such as [Endpoint DLP](../../compliance/endpoint-dlp-getting-started.md) or [Device Control](device-control-report.md)) are actively monitoring running processes. Platform updates are retried after a reboot or when all monitored services are stopped. ++- In the **Microsoft Endpoint Configuration Manager / Windows Server Update Services** (MECM/WSUS) catalog, the _category_ **Microsoft Defender for Endpoint** includes updates for the MSSense service in [KB5005292](https://www.catalog.update.microsoft.com/Search.aspx?q=KB5005292). KB5005292 includes updates and fixes to the Microsoft Defender for Endpoint **endpoint detection and response** (EDR) sensor. For more information, see [Microsoft Defender for Endpoint update for EDR Sensor](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac) and [What's new in Microsoft Defender for Endpoint on Windows](windows-whatsnew.md). ## Monthly platform and engine versions All our updates contain #### What's new -- **Beginning in May 2023, the Platform and Engine version schema will have a new format**. Here's what the new version format looks like: +- **Beginning in May 2023, the Platform and Engine version schema have a new format**. Here's what the new version format looks like: - Platform: `4.18.23050.1` - Engine: `1.1.23050.63000` - Fixed memory leak in behavior monitoring Platform and engine updates are provided on a monthly cadence. To be fully suppo - **Security and Critical Updates servicing phase** - When running the latest platform version, you're eligible to receive both Security and Critical updates to the anti-malware platform. -- **Technical Support (Only) phase** - After a new platform version is released, support for older versions (N-2) will reduce to technical support only. Platform versions older than N-2 are no longer supported.*--\* Technical support continues to be provided for upgrades from the Windows 10 release version (see [Platform version included with Windows 10 releases](#platform-version-included-with-windows-10-releases)) to the latest platform version. +- **Technical Support (Only) phase** - After a new platform version is released, support for older versions (N-2) reduce to [technical support only](msda-updates-previous-versions-technical-upgrade-support.md). Platform versions older than N-2 are no longer supported. Technical support continues to be provided for upgrades from the Windows 10 release version (see [Platform version included with Windows 10 releases](#platform-version-included-with-windows-10-releases)) to the latest platform version. During the technical support (only) phase, commercially reasonable support incidents are provided through Microsoft Customer Service & Support and Microsoft's managed support offerings (such as Premier Support). If a support incident requires escalation to development for further guidance, requires a nonsecurity update, or requires a security update, customers are asked to upgrade to the latest platform version or an intermediate update (*). - > [!NOTE] > If you are manually deploying Microsoft Defender Antivirus Platform Update, or if you are using a script or a non-Microsoft management product to deploy Microsoft Defender Antivirus Platform Update, make sure that version `4.18.2001.10` is installed from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=4.18.2001.10) before the latest version of Platform Update (N-2) is installed. Updates are released for x86, x64, and ARM64 Windows architecture. For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images). +### 20230604.1 ++- Defender package version: **20230604.1** +- Security intelligence version: **1.391.476.0** +- Engine version: **1.1.23050.3** +- Platform version: **4.18.23050.3** ++#### Fixes ++- None + ### 20230503.1 - Defender package version: **20230503.1** |
| security | Microsoft Defender Endpoint Antivirus Performance Mode | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-antivirus-performance-mode.md | For requirements specific to Dev Drive, see [Set up a Dev Drive on Windows 11](/ ## Manage performance mode -Performance mode is enabled by default when a new Dev Drive is created. To control of the balance between performance and security when protecting a Dev Drive, administrators can choose between these options: --- Real-time protection-- Performance mode (default)-- No antivirus filter attached to Dev Drive. In this scenario, Dev Drive isn't protected by Real-time protection or performance mode.--A Dev Drive is automatically designated as trusted, providing the best possible performance by default. A trusted Dev Drive means that the developer using the volume has high confidence in the security of the content stored there. --Similar to when an administrator chooses to add an exclusion to a Microsoft Defender Antivirus configuration, it's the administrator's responsibility to assess the performance benefits and security risks when using performance mode. As mentioned, security runs in Real-time protection mode when a Dev Drive is untrusted. --> [!NOTE] -> Performance mode can only run on a ΓÇ£trustedΓÇ¥ Dev Drive. --For more information on trusted Dev Drive and to confirm whether a designated Dev Drive is trusted, see: [Set up a Dev Drive on Windows 11](/windows/dev-drive). +Performance mode can only run on a *trusted* Dev Drive and is enabled by default when a new Dev Drive is created. For more information, see [Understanding security risks and trust in relation to Dev Drive](/windows/dev-drive#understanding-security-risks-and-trust-in-relation-to-dev-drive). ## See also |
| security | Prevent Changes To Security Settings With Tamper Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection.md | Title: Protect security settings with tamper protection description: Use tamper protection to prevent malicious apps from changing important security settings.-keywords: malware, defender, antivirus, tamper protection ms.localizationpriority: medium Previously updated : 05/24/2023 Last updated : 06/06/2023 audience: ITPro Tamper protection is part of anti-tampering capabilities that include [standard ## What happens when tamper protection is turned on? -When tamper protection is turned on, tamper-protected settings can't be changed. +When tamper protection is turned on, these tamper-protected settings can't be changed: -- Virus and threat protection is enabled.-- Real-time protection is turned on.-- Behavior monitoring is turned on.-- Antivirus protection, including IOfficeAntivirus (IOAV) is enabled.-- Cloud protection is enabled.+- Virus and threat protection remains enabled. +- Real-time protection remains turned on. +- Behavior monitoring remains turned on. +- Antivirus protection, including IOfficeAntivirus (IOAV) remains enabled. +- Cloud protection remains enabled. - Security intelligence updates occur. - Automatic actions are taken on detected threats. - Notifications are visible in the Windows Security app on Windows devices. |
| security | Run Advanced Query Api | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/run-advanced-query-api.md | Last updated 12/18/2020 **Applies to:** - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)--> [!NOTE] -> For the full available Advanced Hunting API experience across all Microsoft Defenders' products, visit [Use the Microsoft Graph security API - Microsoft Graph | Microsoft Learn](/graph/api/resources/security-api-overview). +> [!WARNING] +> This advanced hunting API is an older version with limited capabilities. A more comprehensive version of the advanced hunting API that can query more tables is already available in the **[Microsoft Graph security API](/graph/api/resources/security-api-overview)**. See **[Advanced hunting using Microsoft Graph security API](/graph/api/resources/security-api-overview#advanced-hunting)** > Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) Last updated 12/18/2020 [!include[Improve request performance](../../includes/improve-request-performance.md)] -> [!NOTE] -> This API can only query tables belonging to Microsoft Defender for Endpoint. Tables belonging to other Microsoft 365 Defender services require the use of the [Microsoft 365 Defender Advanced hunting API](/microsoft-365/security/defender/api-advanced-hunting). + ## Limitations Last updated 12/18/2020 4. The maximal execution time of a single request is 200 seconds. -5. 429 response will represent reaching quota limit either by number of requests or by CPU. Read response body to understand what limit has been reached. +5. `429` response will represent reaching quota limit either by number of requests or by CPU. Read response body to understand what limit has been reached. 6. The maximum query result size of a single request cannot exceed 124 MB. If exceeded, HTTP 400 Bad Request with the message "Query execution has exceeded the allowed result size. Optimize your query by limiting the number of results and try again" will appear. |
| security | Tamper Resiliency | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tamper-resiliency.md | See [Vulnerable Driver blocklist XML](/windows/security/threat-protection/window This list of drivers blocked by the exploited and vulnerable drivers get updated more frequently than the recommended drivers blocklist. ASR rules can run in audit mode first to ensure that there's no impact before applying the rule in block mode. -See([Block abuse of exploited vulnerable signed drivers rule](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference#block-abuse-of-exploited-vulnerable-signed-drivers)). +See [Block abuse of exploited vulnerable signed drivers rule](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference#block-abuse-of-exploited-vulnerable-signed-drivers). ### Block other drivers - Windows Defender Application Control (WDAC) |
| security | Api Advanced Hunting | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/api-advanced-hunting.md | Last updated 02/08/2023 - Microsoft 365 Defender -> [!NOTE] -> **Try our new APIs using MS Graph security API**. Find out more at: [Use the Microsoft Graph security API - Microsoft Graph | Microsoft Learn](/graph/api/resources/security-api-overview?view=graph-rest-1.0&preserve-view=true). +> [!WARNING] +> This advanced hunting API is an older version with limited capabilities. A more comprehensive version of the advanced hunting API is already available in the **[Microsoft Graph security API](/graph/api/resources/security-api-overview)**. See **[Advanced hunting using Microsoft Graph security API](/graph/api/resources/security-api-overview#advanced-hunting)** > [!IMPORTANT] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. The following conditions relate to all queries. 1. Queries explore and return data from the past 30 days. 2. Results can return up to 100,000 rows.-3. You can make up to 45 calls per minute per tenant. -4. Queries are blocked if the tenant has reached 100% until after the next 15-minute cycle. -5. If a single request runs for more than 10 minutes, it will time out and return an error. -6. A `429` HTTP response code indicates that you've reached a quota, either by number of requests sent, or by allotted running time. Read the response body to understand the limit you have reached. +3. You can make up to at least 45 calls per minute per tenant. The number of calls varies per tenant based on its size. +4. Each tenant is allocated CPU resources, based on the tenant size. Queries are blocked if the tenant has reached 100% of the allocated resources until after the next 15-minute cycle. To avoid blocked queries due to excess consumption, follow the guidance in [Optimize your queries to avoid hitting CPU quotas](advanced-hunting-best-practices.md). +5. If a single request runs for more than three minutes, it times out and returns an error. +6. A `429` HTTP response code indicates that you've reached the allocated CPU resources, either by number of requests sent, or by allotted running time. Read the response body to understand the limit you have reached. -> [!NOTE] -> All quotas listed above (for example 15 calls per min) are tenant wide. These quotas are the minimum. ## Permissions |
| security | Virus Initiative Criteria | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/intelligence/virus-initiative-criteria.md | The Microsoft Virus Initiative (MVI) helps organizations develop better-together ## Become a member > [!NOTE]-> The MVI Program is not currently accepting new applications for membership. Please contact MVI@microsoft.com for more information. +> The MVI Program is not currently accepting new applications for membership but will reopen for new member applications on June 1, 2023. Please contact MVI@microsoft.com for more information. You can request membership if you're a representative for an organization that develops and produces antimalware or antivirus technology. |
| security | Anti Spam Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-policies-configure.md | You can configure anti-spam policies in the Microsoft 365 Defender portal or in ⁴ For **High confidence phishing**, the **Move message to Junk Email folder** action has effectively been deprecated. Although you might be able to select that action, high confidence phishing messages are always quarantined (equivalent to selecting **Quarantine message**). ⁵ Users can't release their own messages that were quarantined as high confidence phishing by anti-spam policies, regardless of how the quarantine policy is configured. If the policy allows users to release their own quarantined messages, users are instead allowed to _request_ the release of their quarantined high-confidence phishing messages.+ + - **Intra-Organizational messages to take action on**: Select what types of intra-organizational messages containing malicious or spam-based URLs to take action on. The default setting is to take no action on messages. The action taken on different spam filtering verdicts for intra-org messages is the same as configured above in the message actions section. + The default behavior will be updated in the future to take action on high-confidence phishing messages. Additional details on handling malicious intra-organizational messages are communicated through posts in the Message Center Portal. + - **Retain spam in quarantine for this many days**: Specifies how long to keep the message in quarantine if you selected **Quarantine message** as the action for a spam filtering verdict. After the time period expires, the message is deleted, and isn't recoverable. A valid value is from 1 to 30 days. > [!NOTE] |
| security | Defender For Office 365 Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/defender-for-office-365-whats-new.md | For more information on what's new with other Microsoft Defender security produc - [Use the Microsoft 365 Defender portal to create allow entries for spoofed senders on the Submissions page](tenant-allow-block-list-email-spoof-configure.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-spoofed-senders-on-the-submissions-page): Create allowed spoofed sender entries using the Tenant Allow/Block List. -- [Impersonation allows using admin submission](tenant-allow-block-list-email-spoof-configure.md#about-impersonated-domains-or-senders): Add allows for impersonated senders using the Submissions page in Microsoft 365 Defender.+- [Impersonation allows using admin submission](tenant-allow-block-list-email-spoof-configure.md#about-impersonated-domains-or-senders): Add allows for impersonated senders using the **Submissions** page in Microsoft 365 Defender. -- [View converted admin submission from user reported messages](submissions-admin.md#convert-user-reported-messages-in-the-reporting-mailbox-into-admin-submissions): Configure a reporting mailbox to intercept user-reported messages without sending the messages to Microsoft for analysis.+- [Submit user reported messages to Microsoft for analysis](submissions-admin.md#submit-user-reported-messages-to-microsoft-for-analysis): Configure a reporting mailbox to intercept user-reported messages without sending the messages to Microsoft for analysis. -- [View associated alert for user and admin submissions](submissions-admin.md#view-associated-alert-for-user-and-admin-email-submissions): View the corresponding alert for each user reported phish message and admin email submission.+- View the associated alerts for [user reported messages](submissions-admin.md#actions-for-user-reported-messages-in-defender-for-office-365-plan-2) and [admin submissions](submissions-admin.md#actions-for-admin-submissions-in-defender-for-office-365-plan-2): View the corresponding alert for each user reported phish message and admin email submission. - [Configurable impersonation protection custom users and domains and increased scope within Preset policies](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/configurable-impersonation-protection-and-scope-for-preset/ba-p/3294459): - (Choose to) Apply Preset Strict/Standard policies to entire organization and avoid the hassle of selecting specific recipient users, groups, or domains, thereby securing all recipient users of your organization. |
| security | Mdo Sec Ops Guide | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-sec-ops-guide.md | For more information, see [Reporting an email in Defender for Office 365 - Micro Security team members can do submissions from multiple locations in the Microsoft 365 Defender portal at <https://security.microsoft.com>: -- [Admin submission](submissions-admin.md): Use the Submissions page to submit suspected spam, phishing, URLs, and files to Microsoft.+- [Admin submission](submissions-admin.md): Use the **Submissions** page to submit suspected spam, phishing, URLs, and files to Microsoft. - Directly from Threat Explorer using one of the following message actions: - Report clean - Report phishing - Report malware - Report spam - You can select up to 10 messages to perform a bulk submission. Admin submissions created this way also visible in the Submission portal. + You can select up to 10 messages to perform a bulk submission. Admin submissions created using these methods are visible on the respective tabs on the **Submissions** page. For the short-term mitigation of false negatives, security teams can directly manage block entries for files, URLs, and domains or email addresses in the [Tenant Allow/Block List](tenant-allow-block-list-about.md). |
| security | Mdo Sec Ops Manage Incidents And Alerts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-sec-ops-manage-incidents-and-alerts.md | Last updated 1/31/2023 - [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) - [Microsoft 365 Defender](../defender/microsoft-365-defender.md) -An [incident](/microsoft-365/security/defender/incidents-overview) in Microsoft 365 Defender is a collection of correlated alerts and associated data that define the complete story of an attack. Defender for Office 365 [alerts](/microsoft-365/compliance/alert-policies#default-alert-policies), [automated investigation and response (AIR)](air-about.md#the-overall-flow-of-air), and the outcome of the investigations are natively integrated and correlated on the **Incidents** page in Microsoft 365 Defender at <https://security.microsoft.com/incidents-queue>. We'll refer to this page as the _Incidents queue_. +An [incident](/microsoft-365/security/defender/incidents-overview) in Microsoft 365 Defender is a collection of correlated alerts and associated data that define the complete story of an attack. Defender for Office 365 [alerts](/microsoft-365/compliance/alert-policies#default-alert-policies), [automated investigation and response (AIR)](air-about.md#the-overall-flow-of-air), and the outcome of the investigations are natively integrated and correlated on the **Incidents** page in Microsoft 365 Defender at <https://security.microsoft.com/incidents-queue>. We refer to this page as the _Incidents queue_. -Alerts are created when malicious or suspicious activity affects an entity (for example, email, users, or mailboxes). Alerts provide valuable insights about in-progress or completed attacks. However, an ongoing attack can affect multiple entities, which results in multiple alerts from different sources. Some built-in alerts will automatically trigger AIR playbooks. These playbooks do a series of investigation steps to look for other impacted entities or suspicious activity. +Alerts are created when malicious or suspicious activity affects an entity (for example, email, users, or mailboxes). Alerts provide valuable insights about in-progress or completed attacks. However, an ongoing attack can affect multiple entities, which results in multiple alerts from different sources. Some built-in alerts automatically trigger AIR playbooks. These playbooks do a series of investigation steps to look for other impacted entities or suspicious activity. Watch this short video on how to manage Microsoft Defender for Office 365 alerts in Microsoft 365 Defender. > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWGrL2] -Defender for Office 365 alerts, investigations, and their data are automatically correlated. When a relationship is determined, an incident is created by the system to give security teams visibility for the entire attack. +Defender for Office 365 alerts, investigations, and their data are automatically correlated. When a relationship is determined, the system creates an incident to give security teams visibility for the entire attack. We strongly recommend that SecOps teams manage incidents and alerts from Defender for Office 365 in the Incidents queue at <https://security.microsoft.com/incidents-queue>. This approach has the following benefits: We strongly recommend that SecOps teams manage incidents and alerts from Defende - Related Defender for Office 365 alerts, AIR investigations, and pending actions from investigations are automatically added to incidents. -- If the AIR investigation finds no threat, the related alerts are automatically resolved by the system. If all alerts within an incident are resolved, the incident status also changes to **Resolved**.+- If the AIR investigation finds no threat, the system automatically resolves the related alerts If all alerts within an incident are resolved, the incident status also changes to **Resolved**. - Related evidence and response actions are automatically aggregated on the **Evidence and response** tab of the incident. We strongly recommend that SecOps teams manage incidents and alerts from Defende - Recommended email actions are created only when the latest delivery location of a malicious email is a cloud mailbox. -- Pending email actions are updated based on the latest delivery location. If the email was already remediated by a manual action, the status will reflect that.+- Pending email actions are updated based on the latest delivery location. If the email was already remediated by a manual action, the status reflects that. - Recommended actions are created only for email and email clusters that are determined to be the most critical threats: - Malware We strongly recommend that SecOps teams manage incidents and alerts from Defende Manage incidents on the **Incidents** page in the Microsoft 365 Defender portal at <https://security.microsoft.com/incidents-queue>: - - - - - Manage incidents on the **Incidents** page in Microsoft Sentinel at <https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel>: - - ## Response actions to take Security teams can take wide variety of response actions on email using Defender Defender for Office 365 actions are seamlessly integrated into hunting experiences and the history of actions are visible on the **History** tab in the unified **Action center** at <https://security.microsoft.com/action-center/history>. -The most effective way to take action is to use the built-in integration with Incidents in Microsoft 365 Defender. You can simply approve the actions that were recommended by AIR in Defender for Office 365 on the [Evidence and response](/microsoft-365/security/defender/investigate-incidents#evidence-and-response) tab of an Incident in Microsoft 365 Defender. This method of tacking action is recommended for the following reasons: +The most effective way to take action is to use the built-in integration with Incidents in Microsoft 365 Defender. You can approve the actions that were recommended by AIR in Defender for Office 365 on the [Evidence and response](/microsoft-365/security/defender/investigate-incidents#evidence-and-response) tab of an incident in Microsoft 365 Defender. This method of tacking action is recommended for the following reasons: - You investigate the complete attack story. - You benefit from the built-in correlation with other workloads: Microsoft Defender for Endpoint, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. |
| security | Quarantine Admin Manage Messages Files | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-admin-manage-messages-files.md | In the **Submit to Microsoft for analysis** flyout that opens, configure the fol - **Remove entry after**: The default value is **30 days**, but you can also select **1 day**, **7 days**, or a **Specific date** that's less than 30 days. - **Allow entry note**: Enter an optional note that contains additional information. - - **Should not have been blocked (false negative)**: If you select this option, the following settings appear: + - **Should have been blocked (false negative)**: If you select this option, the following settings appear: - **The email should have been categorized as**: Select **Phish**, **Spam**, or **Spam**. - **Block all email from this sender or domain**: If you select this option, block entries for the **Sender** or **Domain** (you choose) are added to the [Tenant Allow/Block List](tenant-allow-block-list-about.md). - **Remove block entry after**: The default value is **30 days**, but you can also select **1 day**, **7 days**, **90 days**, **Never expire**, or a **Specific date**. In organizations with Microsoft Defender for Office 365 Plan 2 (add-on licenses - :::image type="icon" source="../../medi#how-to-read-the-email-entity-page). -- :::image type="icon" source="../../medi#actions-you-can-take-on-the-email-entity-page).+- :::image type="icon" source="../../medi#actions-you-can-take-on-the-email-entity-page). #### Take action on multiple quarantined email messages |
| security | Reports Email Security | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/reports-email-security.md | The **User reported messages** report shows information about email messages tha On the **Email & collaboration reports** page at <https://security.microsoft.com/emailandcollabreport>, find **User reported messages**, and then select **View details**. Or, to go directly to the report, use <https://security.microsoft.com/reports/userSubmissionReport>. -To go directly to the **Submissions** page in the Defender portal, select **Go to submissions**. +To go directly to the **User reported** tab on the **Submissions** page in the Defender portal, select **Go to submissions**. :::image type="content" source="../../media/user-reported-messages-widget.png" alt-text="The user-reported messages widget on the Email & collaboration reports page." lightbox="../../media/user-reported-messages-widget.png"::: The chart shows the following information: - **Phish** - **Not junk** -The details table below the graph shows the same information and has the same :::image type="icon" source="../../medi#view-user-reported-messages-to-microsoft). --Select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter** to modify the report and the details table by selecting one or more of the following values in the flyout that opens: +The details table below the graph shows the same information and has the same actions that are available on the **User reported** tab on the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=user> -- **Date reported**: **Start time** and **End time**-- **Reported by**-- **Name**-- **Message reported ID**-- **Network Message ID**-- **Teams message ID** (currently in Preview)-- **Sender**-- **Reported reason**- - **No threats** - - **Threats** - - **Spam** -- **Reported from**: **Microsoft and **Third party**-- **Phish simulation**: **Yes** and **No**.-- **Converted to admin submission**: **Yes** and **No**.-- **Message type**:- - **Email** - - **Teams message** (currently in Preview) +- :::image type="icon" source="../../media/m365-cc-sc-customize-icon.png" border="false"::: **Customize columns** +- :::image type="icon" source="../../media/m365-cc-sc-group-icon.png" border="false"::: **Group** +- :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter** +- :::image type="icon" source="../../media/m365-cc-scc-mark-and-notify-icon.png" border="false"::: **Mark as and notify** +- :::image type="icon" source="../../media/m365-cc-sc-submit-user-reported-message-icon.png" border="false"::: **Submit to Microsoft for analysis** -When you're finished configuring the filters, select **Apply**, **Cancel**, or :::image type="icon" source="../../media/m365-cc-sc-clear-filters-icon.png" border="false"::: **Clear filters**. --To group the entries, select **Group** and select one of the following values from the drop-down list: --- **None**-- **Reason**-- **Sender**-- **Reported by**-- **Rescan result**-- **Phish simulation**+For more information, see [View user reported messages to Microsoft](submissions-admin.md#view-user-reported-messages-to-microsoft) and [Admin actions for user reported messages](submissions-admin.md#admin-actions-for-user-reported-messages). :::image type="content" source="../../media/user-reported-messages-report.png" alt-text="The user-reported messages report." lightbox="../../media/user-reported-messages-report.png"::: |
| security | Deploy And Configure The Report Message Add In | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/deploy-and-configure-the-report-message-add-in.md | Last updated 1/31/2023 # Deploy and configure the Report Message add-in to users -The Report Message and Report Phishing add-ins for Outlook make it easy to report phishing to Microsoft and its affiliates for analysis, along with easy triage for admins on the Submissions page at <https://security.microsoft.com/reportsubmission?viewid=user>. +The Report Message and Report Phishing add-ins for Outlook make it easy to report phishing to Microsoft and its affiliates for analysis, along with easy triage for admins on the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=user>. Depending on whether you are licensed for Defender for Office 365, you'll also get added functionality such as alerting & automated investigation and response (AIR), which will remove the burden from your security operations staff. This guide will walk you through configuring the add-in deployment as recommended by the Microsoft Defender for Office 365 team. |
| security | Submissions Admin Review User Reported Messages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-admin-review-user-reported-messages.md | description: Admins can learn how to review messages that were reported by users search.appverid: met150 Previously updated : 5/31/2023 Last updated : 6/6/2023 # Admin review for user reported messages Last updated 5/31/2023 - [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) - [Microsoft 365 Defender](../defender/microsoft-365-defender.md) -In Microsoft 365 organizations with Exchange Online mailboxes and Microsoft Defender for Office 365, admins can send templated messages back to users after an admin has reviewed their reported messages. You can customize the templates for your organization and for the admin verdict. +In Microsoft 365 organizations with Exchange Online mailboxes and Microsoft Defender for Office 365, admins can send templated result messages back to users after they review the user reported messages. Admins can customize the notification message template that's used for the organization. -The feature is designed to give feedback to your users but doesn't change the verdicts of messages in the system. To help Microsoft update and improve its filters, you need to submit messages for analysis using [Admin submission](submissions-admin.md). +The feature is designed to give feedback to users without changing the message verdicts in the system. To help Microsoft update and improve its filters, admins need to [submit user reported messages to Microsoft for analysis](submissions-admin.md#submit-user-reported-messages-to-microsoft-for-analysis) when the user reported settings are configured to send user reported messages to the reporting mailbox only. For more information, see [User reported settings](submissions-user-reported-messages-custom-mailbox.md). -Admins can mark messages and notify users of review results only if the user reported the message as a [false positives or false negatives](submissions-outlook-report-messages.md). +Admins can mark messages and notify users of review results only if the user [reported the message as a false positive or a false negative](submissions-outlook-report-messages.md). ## What do you need to know before you begin? -- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. To go directly to the **User reported** page, use <https://security.microsoft.com/reportsubmission?viewid=user>.+- You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. To go directly to the **User reported** page, use <https://security.microsoft.com/securitysettings/userSubmission>. - You need to be assigned permissions before you can do the procedures in this article. You have the following options: - [Email & collaboration RBAC in the Microsoft 365 Defender portal](mdo-portal-permissions.md): Membership in the **Organization Management** or **Security Administrator** role groups. Admins can mark messages and notify users of review results only if the user rep ## Notify users from within the portal -1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Email & collaboration** \> **Submissions** \> **User reported** tab. Or, to go directly to the **User reported** tab, use <https://security.microsoft.com/reportsubmission?viewid=user>. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Email & collaboration** \> **Submissions**. Or, to go directly to the **Submissions** tab, use <https://security.microsoft.com/reportsubmission>. -2. On the **User reported** tab, find and select the message, select **Mark as and notify**, and then select one of the following values from the dropdown list: +2. On the **Submissions** page, select the **User reported** tab. ++3. On the **User reported** tab, select the user reported message by using either of the following methods: ++ - Select the message from the list by selecting the check box next to the first column, and then select :::image type="icon" source="../../media/m365-cc-scc-mark-and-notify-icon.png" border="false"::: **Mark as and notify**. + - Select the message from the list by clicking anywhere in the row other than the check box. In the details flyout that opens, select :::image type="icon" source="../../media/m365-cc-scc-mark-and-notify-icon.png" border="false"::: **Mark as and notify** or :::image type="icon" source="../../media/m365-cc-sc-more-actions-icon.png" border="false"::: **More options** \> :::image type="icon" source="../../media/m365-cc-scc-mark-and-notify-icon.png" border="false"::: **Mark as and notify**. ++4. In the **Mark as and notify** dropdown list, select one of the following values: - **No threats found** - **Phishing** - **Spam** Admins can mark messages and notify users of review results only if the user rep The reported message is marked as **No threats found**, **Phishing**, or **Spam**, and an email is automatically sent to notify the user who reported the message. +To customize the notification email, see the next section. + ## Customize the messages used to notify users 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **User reported** page at **Settings** \> **Email & collaboration** \> **User reported** tab. Or, to go directly to the **User reported** page, use <https://security.microsoft.com/securitysettings/userSubmission>. |
| security | Submissions Admin | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-admin.md | Last updated 5/25/2023 - [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) - [Microsoft 365 Defender](../defender/microsoft-365-defender.md) -In Microsoft 365 organizations with Exchange Online mailboxes, admins can use the Submissions page in the Microsoft 365 Defender portal to submit email messages, URLs, and attachments to Microsoft for analysis. +In Microsoft 365 organizations with Exchange Online mailboxes, admins can use the **Submissions** page in the Microsoft 365 Defender portal to submit messages, URLs, and attachments to Microsoft for analysis. There are two basic types of admin submissions: -When you submit an email message for analysis, Microsoft does the following checks: +- **Admin-originated submissions**: Admins identify and report messages, attachments, or URLs (entities) by selecting :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Submit to Microsoft for analysis** from the tabs on the **Submissions** page as described in the [Admin-originated submissions](#admin-originated-submissions) section. ++ After the admin reports the entity, an entry appears on the corresponding tab on the **Submissions** page (anywhere except the **User reported** tab). ++- **Admin submission of user reported messages**: The built-in [user reporting experience](submissions-user-reported-messages-custom-mailbox.md) is turned on and configured. User reported messages appear on the **User reported** tab on the **Submissions** page, and admins submit or resubmit the messages to Microsoft from the **User reported** tab. ++ After an admin submits the message, an entry is also created on the corresponding tab on the **Submissions** page (for example, the **Emails** tab). These types of admin submissions are described in the [Admin options for user reported messages](#admin-options-for-user-reported-messages) section. ++When admins submit email messages for analysis, Microsoft does the following checks: - **Email authentication check**: Whether email authentication passed or failed when it was delivered.-- **Policy hits**: Information about any policies or overrides that may have allowed or blocked the incoming email into your tenant, overriding our service filter verdicts.+- **Policy hits**: Information about any policies or overrides that might have allowed or blocked the incoming email into the organization, thus overriding our filtering verdicts. - **Payload reputation/detonation**: Up-to-date examination of any URLs and attachments in the message.-- **Grader analysis**: Review done by human graders in order to confirm whether or not messages are malicious.+- **Grader analysis**: Review done by human graders to confirm whether or not messages are malicious. > [!IMPORTANT]-> In U.S. Government organizations (Microsoft 365 GCC, GCC High, and DoD), admins can use the **Submissions** page in the Microsoft 365 Defender portal to submit messages to Microsoft. The messages are only analyzed for email authentication check and policy check. -> ->Payload reputation/detonation and grader analysis are not done as data is not supposed to leave the tenant boundary for compliance purposes. --For other ways to submit email messages, URLs, attachments and files to Microsoft, see [Report messages and files to Microsoft](submissions-report-messages-files-to-microsoft.md). +> In U.S. Government organizations (Microsoft 365 GCC, GCC High, and DoD), admins can submit messages to Microsoft for analysis, but the messages are analyzed for email authentication and policy checks only. Payload reputation, detonation, and grader analysis aren't done for compliance reasons (data isn't allowed to leave the organization boundary). Watch this short video to learn how to use admin submissions in Microsoft Defender for Office 365 to submit messages to Microsoft for evaluation.+ > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWBLPn] +For more information about how **users** can submit messages and files to Microsoft, see [Report messages and files to Microsoft](submissions-report-messages-files-to-microsoft.md). ++For other ways that **admins** can report messages to Microsoft in the Defender portal, see [Related reporting settings for admins](submissions-report-messages-files-to-microsoft.md#related-reporting-settings-for-admins). + ## What do you need to know before you begin? - You open the Microsoft 365 Defender portal at <https://security.microsoft.com/>. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. -- To submit messages, URLs, and email attachments to Microsoft, you need to have one of following roles:- - **Security Administrator** or **Security Reader** in the [Microsoft 365 Defender portal](mdo-portal-permissions.md). +- You need to be assigned permissions before you can do the procedures in this article. You have the following options: + - [Email & collaboration RBAC in the Microsoft 365 Defender portal](mdo-portal-permissions.md): Membership in the **Security Administrator** or **Security Reader** role groups. + - [Azure AD RBAC](../../admin/add-users/about-admin-roles.md): Membership in the **Security Administrator** or **Security Reader** roles gives users the required permissions _and_ permissions for other features in Microsoft 365. - Note that one of these roles is required to [View user reported messages](#view-user-reported-messages-to-microsoft) as described later in this article. --- Admins can submit messages as old as 30 days if they're still available in the mailbox and haven't been purged by the user or an admin.+- Admins can submit email messages as old as 30 days if they're still available in the mailbox and haven't been purged by the user or an admin. - Admin submissions are throttled at the following rates:- - Maximum submissions in any 15 minutes period: 150 submissions - - Same submissions in a 24 hour period: 3 submissions - - Same submissions in a 15 minute period: 1 submission + - Maximum submissions in any 15-minute period: 150 submissions + - Same submissions in a 24 hour period: Three submissions + - Same submissions in a 15-minute period: One submission ++- A **Files** tab is available on the **Submissions** page only in organizations with Microsoft 365 Defender or Microsoft Defender for Endpoint Plan 2. For information and instructions to submit files from the **Files** tab, see [Submit files in Microsoft Defender for Endpoint](../defender-endpoint/admin-submissions-mde.md). -- For more information about how users can submit messages and files to Microsoft, see [Report messages and files to Microsoft](submissions-report-messages-files-to-microsoft.md).+## Admin-originated submissions -## Report questionable email to Microsoft +> [!TIP] +> The tab where you select select :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Submit to Microsoft for analysis** doesn't particularly matter, as long as you set **Select the submission type** to the correct value. -1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. +### Report questionable email to Microsoft ++1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Actions & submissions** \> **Submissions**. Or, to go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. 2. On the **Submissions** page, verify that the **Emails** tab is selected. -3. On the **Emails** tab, click  **Submit to Microsoft for analysis**. +3. On the **Emails** tab, select :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Submit to Microsoft for analysis**. -4. In the **Submit to Microsoft for analysis** flyout that appears, enter the following information: +4. In the **Submit to Microsoft for analysis** flyout that opens, enter the following information: - **Select the submission type**: Verify the value **Email** is selected. - **Add the network message ID or upload the email file**: Select one of the following options:+ - **Add the email network message ID**: The GUID value is available in the **X-MS-Exchange-Organization-Network-Message-Id** header in the message or in the **X-MS-Office365-Filtering-Correlation-Id** header in quarantined messages. + - **Upload the email file (.msg or .eml)**: Select **Browse files**. In the dialog that opens, find and select the .eml or .msg file, and then select **Open**. - - **Add the email network message ID**: This is a GUID value that's available in the **X-MS-Exchange-Organization-Network-Message-Id** header in the message or in the **X-MS-Office365-Filtering-Correlation-Id** header in quarantined messages. -- - **Upload the email file (.msg or .eml)**: Click **Browse files**. In the dialog that opens, find and select the .eml or .msg file, and then click **Open**. -- - **Choose a recipient who had an issue**: Specify the recipients that you would like to run a policy check against. The policy check will determine if the email bypassed scanning due to user or organization policies or override. + - **Choose a recipient who had an issue**: Specify the recipients to run a policy check against. The policy check determines if the email bypassed scanning due to user or organization policies or override. - **Select a reason for submitting to Microsoft**: Verify **Should have been blocked (False negative)** is selected. - **The email should have been categorized as**: Select **Phish**, **Malware**, or **Spam**. If you're not sure, use your best judgment. - - **Block all emails from this sender or domain**: Select this option to create a block entry for the sender domain or email address in the Tenant Allow/Block List. For more information about the Tenant Allow/Block List, see [Manage your allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md). + - **Block all emails from this sender or domain**: Select this option to create a block entry for the sender domain or email address in the Tenant Allow/Block List. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md). After you select this option, the following settings are available: - By default, **Sender** is selected but you can select **Domain** instead.- - **Remove block entry after**: The default value is **30 days**, but you can select from the following values: - **1 day** - **7 days** Watch this short video to learn how to use admin submissions in Microsoft Defend - **90 days** - **Never expire** - **Specific date**: The maximum value is 90 days from today.- - **Block entry note**: Enter optional information about why you're blocking this email. - When you're finished, click **Submit**, and then click **Done**. + When you're finished in the **Submit to Microsoft for analysis** flyout, select **Submit**, and then select **Done**. :::image type="content" source="../../media/admin-submission-email-block.png" alt-text="Submit a false negative (bad) email to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-email-block.png"::: -After a few moments, the block entry will appear on the **Domains & addresses** tab on the **Tenant Allow/Block List** page. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md). +After a few moments, the block entry is available on the **Domains & addresses** tab on the **Tenant Allow/Block List** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=Sender>. -## Report questionable email attachments to Microsoft +### Report questionable email attachments to Microsoft -1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Actions & submissions** \> **Submissions**. Or, to go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. 2. On the **Submissions** page, select the **Email attachments** tab. -3. On the **Email attachments** tab, click  **Submit to Microsoft for analysis**. +3. On the **Email attachments** tab, select :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Submit to Microsoft for analysis**. -4. On the **Submit to Microsoft for analysis** flyout that appears, enter the following information: +4. On the **Submit to Microsoft for analysis** flyout that opens, enter the following information: - **Select the submission type**: Verify the value **Email attachment** is selected. - - **File**: Click **Browse files** to find and select the file to submit. + - **File**: Select :::image type="icon" source="../../media/m365-cc-sc-import-icon.png" border="false"::: **Browse files** to find and select the file to submit. - **Select a reason for submitting to Microsoft**: Verify **Should have been blocked (False negative)** is selected. - **The email should have been categorized as**: Select **Phish** or **Malware**. If you're not sure, use your best judgment. - - **Block this file**: Select this option to create a block entry for the file in the Tenant Allow/Block List. For more information about the Tenant Allow/Block List, see [Manage your allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md). + - **Block this file**: Select this option to create a block entry for the file in the Tenant Allow/Block List. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md). After you select this option, the following settings are available: After a few moments, the block entry will appear on the **Domains & addresses** - **Block entry note**: Enter optional information about why you're blocking this file. - When you're finished, click **Submit**, and then click **Done**. + When you're finished in the **Submit to Microsoft for analysis** flyout, select **Submit**, and then select **Done**. :::image type="content" source="../../media/admin-submission-file-block.png" alt-text="Submit a false negative (bad) email attachment to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-file-block.png"::: -After a few moments, the block entry will appear on the **Files** tab on the **Tenant Allow/Block List** page. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md). +After a few moments, the block entry is available on the **Files** tab on the **Tenant Allow/Block List** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=FileHash>. -## Report questionable URLs to Microsoft +### Report questionable URLs to Microsoft -1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Actions & submissions** \> **Submissions**. Or, to go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. 2. On the **Submissions** page, select the **URLs** tab. -3. On the **URLs** tab, click  **Submit to Microsoft for analysis**. +3. On the **URLs** tab, select :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Submit to Microsoft for analysis**. -4. In the **Submit to Microsoft for analysis** flyout that appears, enter the following information: +4. In the **Submit to Microsoft for analysis** flyout that opens, enter the following information: - **Select the submission type**: Verify the value **URL** is selected. - - **URL**: Enter the full URL (for example, `https://www.fabrikam.com/marketing.html`), and then select it in the box that appears. You can enter upto 50 URLs at once. + - **URL**: Enter the full URL (for example, `https://www.fabrikam.com/marketing.html`), and then select it in the box that appears. You can enter up to 50 URLs at once. - **Select a reason for submitting to Microsoft**: Verify **Should have been blocked (False negative)** is selected. - **The email should have been categorized as**: Select **Phish** or **Malware**. If you're not sure, use your best judgment. - - **Block this URL**: Select this option to create a block entry for the URL in the Tenant Allow/Block List. For more information about the Tenant Allow/Block List, see [Manage your allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md). + - **Block this URL**: Select this option to create a block entry for the URL in the Tenant Allow/Block List. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md). After you select this option, the following settings are available: After a few moments, the block entry will appear on the **Files** tab on the **T - **Block entry note**: Enter optional information about why you're blocking this URL. - When you're finished, click **Submit**, and then click **Done**. + When you're finished in the **Submit to Microsoft for analysis** flyout, select **Submit**, and then select **Done**. :::image type="content" source="../../media/admin-submission-url-block.png" alt-text="Submit a false negative (bad) URL to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-url-block.png"::: -After a few moments, the block entry will appear on the **URL** tab on the **Tenant Allow/Block List** page. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md). +After a few moments, the block entry is available on the **URL** tab on the **Tenant Allow/Block List** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=Url>. -## Report good email to Microsoft +### Report good email to Microsoft -1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Actions & submissions** \> **Submissions**. Or, to go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. 2. On the **Submissions** page, verify that the **Emails** tab is selected. -3. On the **Emails** tab, click  **Submit to Microsoft for analysis**. +3. On the **Emails** tab, select :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Submit to Microsoft for analysis**. -4. In the **Submit to Microsoft for analysis** flyout that appears, enter the following information: +4. In the **Submit to Microsoft for analysis** flyout that opens, enter the following information: - **Select the submission type**: Verify the value **Email** is selected. - **Add the network message ID or upload the email file**: Select one of the following options:+ - **Add the email network message ID**: The GUID value is available in the **X-MS-Exchange-Organization-Network-Message-Id** header in the message or in the **X-MS-Office365-Filtering-Correlation-Id** header in quarantined messages. + - **Upload the email file (.msg or .eml)**: Select **Browse files**. In the dialog that opens, find and select the .eml or .msg file, and then select **Open**. - - **Add the email network message ID**: This is a GUID value that's available in the **X-MS-Exchange-Organization-Network-Message-Id** header in the message or in the **X-MS-Office365-Filtering-Correlation-Id** header in quarantined messages. -- - **Upload the email file (.msg or .eml)**: Click **Browse files**. In the dialog that opens, find and select the .eml or .msg file, and then click **Open**. -- - **Choose a recipient who had an issue**: Specify the recipient(s) that you would like to run a policy check against. The policy check will determine if the email was blocked due to user or organization policies or overrides. + - **Choose a recipient who had an issue**: Specify the recipients to run a policy check against. The policy check determines if the email was blocked due to user or organization policies or overrides. - **Select a reason for submitting to Microsoft**: Select **Should not have been blocked (False positive)**, and then configure the following settings: - - **Allow emails with similar attributes (URL, sender, etc.)**: Turn on this setting . + - **Allow emails with similar attributes (URL, sender, etc.)**: Turn on this setting :::image type="icon" source="../../media/scc-toggle-on.png" border="false":::. - **Remove allow entry after**: The default value is **30 days**, but you can select from the following values: - **1 day** After a few moments, the block entry will appear on the **URL** tab on the **Ten - **Allow entry note**: Enter optional information about why you're allowing and submitting this email message. - For spoofed senders, any value you enter here is not shown in the allow entry on the **Spoofed senders** tab on the **Tenant Allow/Block List**. + For spoofed senders, any value you enter here isn't shown in the allow entry on the **Spoofed senders** tab on the **Tenant Allow/Block List**. - When you're finished, click **Submit**, and then click **Done**. + When you're finished in the **Submit to Microsoft for analysis** flyout, select **Submit**, and then select **Done**. :::image type="content" source="../../media/admin-submission-email-allow.png" alt-text="Submit a false positive (good) email to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-email-allow.png"::: -After a few moments, the allow entries will appear on the **Domains & addresses**, **Spoofed senders**, **URL**, or **Files** tab on the **Tenant Allow/Block List** page. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md). +After a few moments, the associated allow entries appear on the **Domains & addresses**, **Spoofed senders**, **URL**, or **Files** tab on the **Tenant Allow/Block List** page at <https://security.microsoft.com/tenantAllowBlockList>. > [!IMPORTANT] > > - Allow entries are added during mail flow based on the filters that determined the message was malicious. For example, if the sender email address and a URL in the message were determined to be bad, an allow entry is created for the sender (email address or domain) and the URL. > - If the sender email address is not found to be malicious by our filtering system, submitting the email message to Microsoft won't create an allow entry in the Tenant Allow/Block List. > - When an allowed domain or email address, spoofed sender, URL, or file (_entity_) is encountered again, all filters that are associated with the entity are skipped. For email messages, all other entities are still evaluated by the filtering system before making a decision.-> - During mail flow, if messages from the allowed domain or email address pass other checks in the filtering stack, the messages will be delivered. For example, if a message passes [email authentication checks](email-authentication-about.md), a message from an allowed sender email address will be delivered. -> - By default, allow entries for domains and email addresses exist for 30 days. During those 30 days, Microsoft will learn from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages from those domains or email addresses will be delivered, unless something else in the message is detected as malicious. By default, allow entries for spoofed senders never expire. +> - During mail flow, if messages from the allowed domain or email address pass other checks in the filtering stack, the messages are delivered. For example, if a message passes [email authentication checks](email-authentication-about.md), a message from an allowed sender email address are delivered. +> - By default, allow entries for domains and email addresses exist for 30 days. During those 30 days, Microsoft learns from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages from those domains or email addresses are delivered, unless something else in the message is detected as malicious. By default, allow entries for spoofed senders never expire. > - For messages that were incorrectly blocked by [domain or user impersonation protection](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365), the allow entry for the domain or sender is not created in the Tenant Allow/Block List. Instead, the domain or sender is added to the **Trusted senders and domains** section in the [anti-phishing policy](anti-phishing-policies-mdo-configure.md#use-the-microsoft-365-defender-portal-to-modify-anti-phishing-policies) that detected the message. > - When you override the verdict in the spoof intelligence insight, the spoofed sender becomes a manual allow or block entry that only appears on the **Spoofed senders** tab in the Tenant Allow/Block List. -## Report good email attachments to Microsoft +### Report good email attachments to Microsoft -1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Actions & submissions** \> **Submissions**. Or, to go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. 2. On the **Submissions** page, select the **Email attachments** tab. -3. On the **Email attachments** tab, click  **Submit to Microsoft for analysis**. +3. On the **Email attachments** tab, select :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Submit to Microsoft for analysis**. -4. On the **Submit to Microsoft for analysis** flyout that appears, enter the following information: +4. On the **Submit to Microsoft for analysis** flyout that opens, enter the following information: - **Select the submission type**: Verify the value **Email attachment** is selected. - - **File**: Click **Browse files** to find and select the file to submit. + - **File**: Select **Browse files** to find and select the file to submit. - **Select a reason for submitting to Microsoft**: Select **Should not have been blocked (False positive)**, and then configure the following settings: - - **Allow this file**: Turn on this setting . + - **Allow this file**: Turn on this setting :::image type="icon" source="../../media/scc-toggle-on.png" border="false":::. - **Remove allow entry after**: The default value is **30 days**, but you can select from the following values: - **1 day** After a few moments, the allow entries will appear on the **Domains & addresses* - **Allow entry note**: Enter optional information about why you're allowing and submitting this file. - When you're finished, click **Submit**, and then click **Done**. + When you're finished in the **Submit to Microsoft for analysis** flyout, select **Submit**, and then select **Done**. :::image type="content" source="../../media/admin-submission-file-allow.png" alt-text="Submit a false positive (good) email attachment to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-file-allow.png"::: -After a few moments, the allow entry will appear on the **Files** tab on the **Tenant Allow/Block List** page. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md). +After a few moments, the allow entry is available on the **Files** tab on the **Tenant Allow/Block List** page. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md). -> [!NOTE] +> [!IMPORTANT] >-> - By default, allow entries for files exist for 30 days. During those 30 days, Microsoft will learn from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those files will be delivered, unless something else in the message is detected as malicious. -> - When the file is encountered again during mail flow, [Safe Attachments](safe-attachments-about.md) detonation or file reputation checks and all other file-based filters are overridden. If the filtering system determines that all other entities in the email message are clean, the message will be delivered. +> - By default, allow entries for files exist for 30 days. During those 30 days, Microsoft learns from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those files are delivered, unless something else in the message is detected as malicious. +> - When the file is encountered again during mail flow, [Safe Attachments](safe-attachments-about.md) detonation or file reputation checks and all other file-based filters are overridden. If the filtering system determines that all other entities in the email message are clean, the message are delivered. > - During selection, all file-based filters, including [Safe Attachments](safe-attachments-about.md) detonation or file reputation checks are overridden, allowing user access to the file. -## Report good URLs to Microsoft +### Report good URLs to Microsoft -For URLs reported as false positives, we'll allow subsequent messages that contain variations of the original URL. For example, you use the Submissions page to report the incorrectly blocked URL `www.contoso.com/abc`. If your organization later receives a message that contains the URL (for example but not limited to: `www.contoso.com/abc`, `www.contoso.com/abc?id=1`, `www.contoso.com/abc/def/gty/uyt?id=5`, or `*.contoso.com/abc`), the message won't be blocked based on the URL. In other words, you don't need to report multiple variations of the same URL as good to Microsoft. +For URLs reported as false positives, we allow subsequent messages that contain variations of the original URL. For example, you use the **Submissions** page to report the incorrectly blocked URL `www.contoso.com/abc`. If your organization later receives a message that contains the URL (for example but not limited to: `www.contoso.com/abc`, `www.contoso.com/abc?id=1`, `www.contoso.com/abc/def/gty/uyt?id=5`, or `*.contoso.com/abc`), the message won't be blocked based on the URL. In other words, you don't need to report multiple variations of the same URL as good to Microsoft. -1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Actions & submissions** \> **Submissions**. Or, to go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. 2. On the **Submissions** page, select the **URLs** tab -3. On the **URLs** tab, click  **Submit to Microsoft for analysis**. +3. On the **URLs** tab, select :::image type="icon" source="../../media/m365-cc-sc-create-icon.png" border="false"::: **Submit to Microsoft for analysis**. -4. In the **Submit to Microsoft for analysis** flyout that appears, enter the following information: +4. In the **Submit to Microsoft for analysis** flyout that opens, enter the following information: - **Select the submission type**: Verify the value **URL** is selected. For URLs reported as false positives, we'll allow subsequent messages that conta - **Select a reason for submitting to Microsoft**: Select **Should not have been blocked (False positive)**, and then configure the following settings: - - **Allow this URL**: Turn on this setting . + - **Allow this URL**: Turn on this setting :::image type="icon" source="../../media/scc-toggle-on.png" border="false":::. - **Remove allow entry after**: The default value is **30 days**, but you can select from the following values: - **1 day** For URLs reported as false positives, we'll allow subsequent messages that conta - **Allow entry note**: Enter optional information about why you're allowing and submitting this URL. - When you're finished, click **Submit**, and then click **Done**. + When you're finished in the **Submit to Microsoft for analysis** flyout, select **Submit**, and then select **Done**. :::image type="content" source="../../media/admin-submission-url-allow.png" alt-text="Submit a false positive (good) URL to Microsoft for analysis on the Submissions page in the Defender portal." lightbox="../../media/admin-submission-url-allow.png"::: -After a few moments, the allow entry will appear on the **URL** tab on the **Tenant Allow/Block List** page. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md). +After a few moments, the allow entry is available on the **URL** tab on the **Tenant Allow/Block List** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=Url>. > [!NOTE] >-> - By default, allow entries for URLs exist for 30 days. During those 30 days, Microsoft will learn from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those URLs will be delivered, unless something else in the message is detected as malicious. -> - When the URL is encountered again during mail flow, [Safe Links](safe-links-about.md) detonation or URL reputation checks and all other URL-based filters are overridden. If the filtering system determines that all other entities in the email message are clean, the message will be delivered. +> - By default, allow entries for URLs exist for 30 days. During those 30 days, Microsoft learns from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those URLs are delivered, unless something else in the message is detected as malicious. +> - When the URL is encountered again during mail flow, [Safe Links](safe-links-about.md) detonation or URL reputation checks and all other URL-based filters are overridden. If the filtering system determines that all other entities in the email message are clean, the message are delivered. > - During selection, all URL-based filters, including [Safe Links](safe-links-about.md) detonation or URL reputation checks are overridden, allowing user access to content at the URL. -## View email admin submissions to Microsoft --1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. +### View email admin submissions to Microsoft ++In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Actions & submissions** \> **Submissions**. Or, to go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. ++On the **Submissions** page, verify that the **Emails** tab is selected. ++On the **Emails** tab, you can sort the entries by clicking on an available column header. Select :::image type="icon" source="../../media/m365-cc-sc-customize-icon.png" border="false"::: **Customize columns** to change the columns that are shown. The default values are marked with an asterisk (<sup>\*</sup>): ++- **Submission name**<sup>\*</sup> +- **Sender**<sup>\*</sup> +- **Recipient** +- **Date submitted**<sup>\*</sup> +- **Reason for submitting**<sup>\*</sup> +- **Original verdict**<sup>\*</sup> +- **Status**<sup>\*</sup> +- **Result**<sup>\*</sup> +- **Delivery/Block reason** +- **Submission ID** +- **Network Message ID** +- **Direction** +- **Sender IP** +- **Bulk compliant level (BCL)** +- **Destination** +- **Policy action** +- **Submitted by** +- **Phish simulation** +- **Tags**<sup>\*</sup>: For more information about user tags, see [User tags](user-tags-about.md). +- **Action** ++To group the entries, select :::image type="icon" source="../../media/m365-cc-sc-group-icon.png" border="false"::: **Group** and then select one of the following values: ++- **Reason** +- **Original verdict** +- **Status** +- **Result** +- **Tags** ++To ungroup the entries, select **None**. ++To filter the entries, select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**. The following filters are available in the **Filter** flyout that opens: ++- **Date submitted**: **Start date** and **End date** values. +- **Submission ID**: A GUID value that's assigned to every submission. +- **Network Message ID** +- **Sender** +- **Recipient** +- **Submission name** +- **Submitted by** +- **Reason for submitting**: Any of the following values: + - **Not junk** + - **Phish** + - **Malware** + - **Spam**. +- **Status**: **Pending** and **Completed**. +- **Tags**: **All** or select [user tags](user-tags-about.md) from the dropdown list. ++When you're finished on the **Filter** flyout, select **Apply**. To clear the filters, select :::image type="icon" source="../../media/m365-cc-sc-clear-filters-icon.png" border="false"::: **Clear filters**. ++Use :::image type="icon" source="../../media/m365-cc-sc-download-icon.png" border="false"::: **Export** to export the list of entries to a CSV file. ++### View email attachment admin submissions to Microsoft ++In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. ++On the **Submissions** page, select the **Email attachments** tab. ++On the **Email attachments** tab, you can sort the entries by clicking on an available column header. Select :::image type="icon" source="../../media/m365-cc-sc-customize-icon.png" border="false"::: **Customize columns** to change the columns that are shown. The default values are marked with an asterisk (<sup>\*</sup>): ++- **Attachment filename**<sup>\*</sup> +- **Date submitted**<sup>\*</sup> +- **Reason for submitting**<sup>\*</sup> +- **Status**<sup>\*</sup> +- **Result**<sup>\*</sup> +- **Filter verdict** +- **Delivery/Block reason** +- **Submission ID** +- **Object ID** +- **Policy action** +- **Submitted by** +- **Tags**<sup>\*</sup>: For more information about user tags, see [User tags](user-tags-about.md). +- **Action** ++To group the entries, select :::image type="icon" source="../../media/m365-cc-sc-group-icon.png" border="false"::: **Group** and then select one of the following values: ++- **Reason** +- **Original verdict** +- **Status** +- **Result** +- **Tags** ++To ungroup the entries, select **None**. ++To filter the entries, select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**. The following filters are available in the **Filter** flyout that opens: ++- **Date submitted**: **Start date** and **End date**. +- **Submission ID**: A GUID value that's assigned to every submission. +- **Attachment filename** +- **Submitted by** +- **Reason for submitting**: Any of the following values: + - **Not junk** + - **Phish** + - **Malware** + - **Spam**. +- **Status**: **Pending** and **Completed**. +- **Tags**: **All** or select [user tags](user-tags-about.md) from the dropdown list. ++When you're finished on the **Filter** flyout, select **Apply**. To clear the filters, select :::image type="icon" source="../../media/m365-cc-sc-clear-filters-icon.png" border="false"::: **Clear filters**. ++Use :::image type="icon" source="../../media/m365-cc-sc-download-icon.png" border="false"::: **Export** to export the list of entries to a CSV file. ++### View URLs admin submissions to Microsoft ++In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. ++On the **Submissions** page, select the **URLs** tab. ++On the **URLs** tab, you can sort the entries by clicking on an available column header. Select :::image type="icon" source="../../media/m365-cc-sc-customize-icon.png" border="false"::: **Customize columns** to change the columns that are shown. The default values are marked with an asterisk (<sup>\*</sup>): ++- **URL**<sup>\*</sup> +- **Date submitted**<sup>\*</sup> +- **Reason for submitting**<sup>\*</sup> +- **Status**<sup>\*</sup> +- **Result**<sup>\*</sup> +- **Filter verdict** +- **Delivery/Block reason** +- **Submission ID** +- **Object ID** +- **Policy action** +- **Submitted by** +- **Tags**<sup>\*</sup>: For more information about user tags, see [User tags](user-tags-about.md). +- **Action** -2. On the **Submissions** page, verify that the **Emails** tab is selected. -- - You can sort the entries by clicking on an available column header. -- - Click  **Customize columns** to select the columns that you want to view. The default values are marked with an asterisk (\*): - - **Submission name**<sup>\*</sup> - - **Sender**<sup>\*</sup> - - **Recipient** - - **Date submitted**<sup>\*</sup> - - **Reason for submitting**<sup>\*</sup> - - **Original verdict**<sup>\*</sup> - - **Status**<sup>\*</sup> - - **Result**<sup>\*</sup> - - **Delivery/Block reason** - - **Submission ID** - - **Network Message ID** - - **Direction** - - **Sender IP** - - **Bulk compliant level (BCL)** - - **Destination** - - **Policy action** - - **Submitted by** - - **Phish simulation** - - **Tags**<sup>\*</sup> - - **Action** -- When you're finished, click **Apply**. -- :::image type="content" source="../../media/admin-submission-email-customize-columns.png" alt-text="Customize columns option for email admin submissions." lightbox="../../media/admin-submission-email-customize-columns.png"::: -- - To filter the entries, click  **Filter**. The following values are available in the **Filter** flyout that appears: - - **Date submitted**: **Start date** and **End date** values. - - **Submission ID**: A GUID value that's assigned to every submission. - - **Network Message ID** - - **Sender** - - **Recipient** - - **Submission name** - - **Submitted by** - - **Reason for submitting**: The values are **Not junk**, **Phish**, **Malware**, and **Spam**. - - **Status**: The values are **Pending** and **Completed**. - - **Tags**: The default value is **All** or select a [user tag](user-tags-about.md) from the drop-down list. -- When you're finished, click **Apply**. To clear existing filters, click  **Clear filters** in the **Filter** flyout. -- :::image type="content" source="../../media/admin-submission-email-filters.png" alt-text="Filter options for email admin submissions." lightbox="../../media/admin-submission-email-filters.png"::: -- - To group the entries, click  **Group** and select one of the following values from the dropdown list: - - **None** - - **Reason** - - **Status** - - **Result** - - **Tags** -- - To export the entries, click  **Export**. In the dialog that appears, save the .csv file. --## View email attachment admin submissions to Microsoft --1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. --2. On the **Submissions** page, verify that the **Email attachments** tab is selected. -- - You can sort the entries by clicking on an available column header. -- - Click  **Customize columns** to select the columns that you want to view. The default values are marked with an asterisk (\*): - - **Attachment filename**<sup>\*</sup> - - **Date submitted**<sup>\*</sup> - - **Reason for submitting**<sup>\*</sup> - - **Status**<sup>\*</sup> - - **Result**<sup>\*</sup> - - **Filter verdict** - - **Delivery/Block reason** - - **Submission ID** - - **Object ID** - - **Policy action** - - **Submitted by** - - **Tags**<sup>\*</sup> - - **Action** -- When you're finished, click **Apply**. -- :::image type="content" source="../../media/admin-submission-file-customize-columns.png" alt-text="Customize column options for email attachment admin submissions."::: -- - To filter the entries, click  **Filter**. The following values are available in the **Filter** flyout that appears: - - **Date submitted**: **Start date** and **End date**. - - **Submission ID**: A GUID value that's assigned to every submission. - - **Attachment filename** - - **Submitted by** - - **Reason for submitting**: The values are **Not junk**, **Phish**, **Malware**, and **Spam**. - - **Status**: The values are **Pending** and **Completed**. - - **Tags**: The default value is **All** or select a [user tag](user-tags-about.md) from the drop-down list. -- When you're finished, click **Apply**. -- :::image type="content" source="../../media/admin-submission-file-filters.png" alt-text="Filter options for email attachment admin submissions."::: -- - To group the entries, click  **Group** and select one of the following values from the drop-down list: - - **None** - - **Reason** - - **Status** - - **Result** - - **Tags** -- - To export the entries, click  **Export**. In the dialog that appears, save the .csv file. --## View URLs admin submissions to Microsoft --1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions**. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. --2. On the **Submissions** page, verify that the **URLs** tab is selected. -- - You can sort the entries by clicking on an available column header. -- - Click  **Customize columns** to select the columns that you want to view. The default values are marked with an asterisk (\*): - - **URL**<sup>\*</sup> - - **Date submitted**<sup>\*</sup> - - **Reason for submitting**<sup>\*</sup> - - **Status**<sup>\*</sup> - - **Result**<sup>\*</sup> - - **Filter verdict** - - **Delivery/Block reason** - - **Submission ID** - - **Object ID** - - **Policy action** - - **Submitted by** - - **Tags**<sup>\*</sup> - - **Action** +To group the entries, select :::image type="icon" source="../../media/m365-cc-sc-group-icon.png" border="false"::: **Group** and then select one of the following values: - When you're finished, click **Apply**. +- **Reason** +- **Original verdict** +- **Status** +- **Result** +- **Tags** - :::image type="content" source="../../media/admin-submission-url-customize-columns.png" alt-text="Customize column options for URL admin submissions."::: +To ungroup the entries, select **None**. ++To filter the entries, select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**. The following filters are available in the **Filter** flyout that opens: - - To filter the entries, click  **Filter**. The following values are available in the **Filter** flyout that appears: - - **Date submitted**: **Start date** and **End date**. - - **Submission ID**: A GUID value that's assigned to every submission. - - **URL** - - **Submitted by** - - **Reason for submitting**: The values **Not junk**, **Phish**, **Malware**, and **Spam**. - - **Status**: The values are **Pending** and **Completed**. - - **Tags**: The default value is **All** or select a [user tag](user-tags-about.md) from the drop-down list. +- **Date submitted**: **Start date** and **End date**. +- **Submission ID**: A GUID value that's assigned to every submission. +- **URL** +- **Submitted by** +- **Reason for submitting**: Any of the following values: + - **Not junk** + - **Phish** + - **Malware** + - **Spam**. +- **Status**: **Pending** and **Completed**. +- **Tags**: **All** or select [user tags](user-tags-about.md) from the dropdown list. - When you're finished, click **Apply**. To clear existing filters, click  **Clear filters** in the **Filter** flyout. +When you're finished on the **Filter** flyout, select **Apply**. To clear the filters, select :::image type="icon" source="../../media/m365-cc-sc-clear-filters-icon.png" border="false"::: **Clear filters**. - :::image type="content" source="../../media/admin-submission-url-filters.png" alt-text="Filter options for URL admin submissions."::: +Use :::image type="icon" source="../../media/m365-cc-sc-download-icon.png" border="false"::: **Export** to export the list of entries to a CSV file. - - To group the entries, click  **Group** and select one of the following values from the dropdown list: - - **None** - - **Reason** - - **Status** - - **Result** - - **Tags** +### Admin submission result details - - To export the entries, click  **Export**. In the dialog that appears, save the .csv file. +Messages, email attachments, and URLs that admins submit to Microsoft for analysis are available on the corresponding tabs on the **Submissions** page. -## Admin submission result details --Messages that are submitted in admin submissions are reviewed by Microsoft and results shown in the submissions detail flyout: +When you select an entry on the tab by clicking anywhere in the row other than the check box next to the first column, complete information about the original reported item, the status of the reported item, and the analysis results of the reported item are shown in the details flyout that opens: - If there was a failure in the sender's email authentication at the time of delivery. - Information about any policies or overrides that could have affected or overridden the message verdict from filtering system.-- Current detonation results to see if the URLs or files contained in the message were malicious or not.+- Current detonation results to see if the URLs or files in the message were malicious or not. - Feedback from graders. If an override or policy configuration was found, the result should be available in several minutes. If there wasn't a problem in email authentication or delivery wasn't affected by an override or policy, the detonation and feedback from graders could take up to a day. -## View user reported messages to Microsoft --If you've deployed the [Microsoft Report Message or Report Phishing add-ins](submissions-users-report-message-add-in-configure.md) or if people use the [built-in Report button in Outlook on the web](submissions-outlook-report-messages.md#use-the-built-in-report-button-in-outlook-on-the-web), you can see what users are reporting on the **User reported** tab on the **Submissions** page. --1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to the **Submissions** page at **Actions & submissions** \> **Submissions** \> **User reported** tab. To go directly to the **User reported** tab, use <https://security.microsoft.com/reportsubmission?viewid=user>. --2. On the **User reported** tab, the following settings are available: -- - Click  **Customize columns** to select the columns that you want to view. The default values are marked with an asterisk (\*): - - **Submission name**<sup>\*</sup> - - **Reported by**<sup>\*</sup> - - **Date reported**<sup>\*</sup> - - **Sender**<sup>\*</sup> - - **Reported reason**<sup>\*</sup> - - **Original verdict**<sup>\*</sup> - - **Result**<sup>\*</sup> - - **Message reported ID** - - **Network Message ID** - - **Sender IP** - - **Reported from** - - **Phish simulation** - - **Converted to admin submission** - - **Tags**<sup>\*</sup> - - **Marked as**<sup>\*</sup> - - **Marked by** - - **Date marked** -- When you're finished, click **Apply**. -- - To filter the entries, click  **Filter**. The following values are available in the **Filter** flyout that appears: - - **Date reported**: **Start date** and **End date**. - - **Reported by** - - **Name** - - **Message reported ID** - - **Network Message ID** - - **Sender** - - **Reported reason**: The values are **Not junk**, **Phish**, or **Spam**. - - **Reported from**: The values are **Microsoft** or **Third party**. - - **Phish simulation**: The values are **Yes** or **No**. - - **Converted to admin submission**: The values are **Yes** or **No**. - - **Tags**: The default value is **All** or select a [user tag](user-tags-about.md) from the drop-down list. -- When you're finished, click **Apply**. To clear existing filters, click  **Clear filters** in the **Filter** flyout. -- - To group the entries, click  **Group** and select one of the following values from the dropdown list: - - **None** - - **Reason** - - **Sender** - - **Reported by** - - **Original verdict** - - **Result** - - **Reported from** - - **Phish simulation** - - **Converted to admin submission** - - **Tags** -- - To export the entries, click  **Export**. In the dialog that appears, save the .csv file. -- - To notify users, see [Admin Review for Reported messages](submissions-admin-review-user-reported-messages.md) +### Actions for admin submissions in Defender for Office 365 Plan 2 -> [!NOTE] -> User reported messages that are sent only to the [reporting mailbox](submissions-user-reported-messages-custom-mailbox.md) (not to Microsoft) appear on the **User reported** tab on the **Submissions** page, but the **Result** value for those entries is **Not Submitted to Microsoft** (because these messages aren't analyzed by Microsoft). +In organizations with Microsoft Defender for Office 365 Plan 2 (add-on licenses or included in subscriptions like Microsoft 365 E5), the following actions are available for admin submissions in the details flyout that opens after you select an entry from the list by clicking anywhere in the row other than the check box: ++- :::image type="icon" source="../../medi#how-to-read-the-email-entity-page). ++- :::image type="icon" source="../../medi#actions-you-can-take-on-the-email-entity-page). ++- :::image type="icon" source="../../media/m365-cc-sc-view-alert-icon.png" border="false"::: **View alert**. An alert is triggered when an admin submission is created or updated. Selecting this action takes you to the details of the alert. ++- In the **Result details** section, the following links for [Threat Explorer](threat-explorer-about.md) might also be available, depending on the status and result of the reported item: + - **View this message in Explorer**: **Emails** tab only. + - **Search for similar messages in Explorer**: **Emails** tab only. + - **Search for URL or file**: **Email attachments** or **URL** tabs only. ++## Admin options for user reported messages ++If the [user reported settings](submissions-user-reported-messages-custom-mailbox.md) are turned on and you've deployed supported methods for users to report messages (the [Microsoft Report Message or Report Phishing add-ins](submissions-users-report-message-add-in-configure.md), the [built-in Report button in Outlook on the web](submissions-outlook-report-messages.md#use-the-built-in-report-button-in-outlook-on-the-web), or [supported third-party reporting tools](submissions-user-reported-messages-custom-mailbox.md#options-for-third-party-reporting-tools)), you can see what users are reporting on the **User reported** tab on the **Submissions** page: ++- User reported messages that are sent to Microsoft only or to Microsoft and the [reporting mailbox](submissions-user-reported-messages-custom-mailbox.md) appear on the **User reported** tab. Although these messages have already been reported to Microsoft, admins can resubmit the reported messages. +- User reported messages that are sent only to the reporting mailbox appear on the **User reported** tab with the **Result** value **Not Submitted to Microsoft**. Admins should report these messages to Microsoft for analysis. ++In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Actions & submissions** \> **Submissions**. Or, to go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>. -## Undo user reported messages +On the **Submissions** page, select the **User reported** tab. -Once a user reports a suspicious message that's delivered to the reporting mailbox, to Microsoft, or both, the user or admins can't undo the reported message. The user can recover the messages from their Deleted Items or Junk Email folders. +The following subsections describe the information and actions that are available on the **User reported** tab on the **Submissions** page. -## Convert user reported messages in the reporting mailbox into admin submissions +### View user reported messages to Microsoft -If you've configured the reporting mailbox to intercept user reported messages without sending the messages to Microsoft, admins can find and manually send specific messages to Microsoft for analysis. +On the **User reported** tab, you can sort the entries by clicking on an available column header. Select :::image type="icon" source="../../media/m365-cc-sc-customize-icon.png" border="false"::: **Customize columns** to change the columns that are shown. The default values are marked with an asterisk (<sup>\*</sup>): -On the **User reported** tab at <https://security.microsoft.com/reportsubmission?viewid=user>, select a message from the list, click  **Submit to Microsoft for analysis**, and then select one of the following values from the dropdown list: +- **Name and type**<sup>\*</sup> +- **Reported by**<sup>\*</sup> +- **Date reported**<sup>\*</sup> +- **Sender**<sup>\*</sup> +- **Reported reason**<sup>\*</sup> +- **Original verdict**<sup>\*</sup> +- **Result**<sup>\*</sup> +- **Message reported ID** +- **Network Message ID** +- **Sender IP** +- **Reported from** +- **Phish simulation** +- **Converted to admin submission** +- **Marked as**<sup>\*</sup> +- **Marked by** +- **Date marked** +- **Tags**<sup>\*</sup>: For more information about user tags, see [User tags](user-tags-about.md). -- **Report clean**-- **Report phishing**-- **Report malware**-- **Report spam**-- **Trigger investigation**+To group the entries, select :::image type="icon" source="../../media/m365-cc-sc-group-icon.png" border="false"::: **Group** and then select one of the following values: - :::image type="content" source="../../media/admin-submission-user-reported-submit-button-options.png" alt-text="The New options on the Action button" lightbox="../../media/admin-submission-user-reported-submit-button-options.png"::: +- **Sender** +- **Reported by** +- **Original verdict** +- **Result** +- **Reported from** +- **Converted to admin submission** +- **Tags** -If the message is reported to Microsoft, the **Converted to admin submission** value turns from **no** to **yes**. You can directly access the admin submission by clicking **View the converted admin submission** from the  **More options** menu on the submission flyout of the message. +To ungroup the entries, select **None**. +To filter the entries, select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**. The following filters are available in the **Filter** flyout that opens: -## View associated alert for user and admin email submissions +- **Date reported**: **Start date** and **End date**. +- **Reported by** +- **Name** +- **Message reported ID** +- **Network Message ID** +- **Sender** +- **Reported reason**: The values **Not junk**, **Phish**, and **Spam**. +- **Reported from**: The values **Microsoft** and **Third party**. +- **Phish simulation**: The values **Yes** and **No**. +- **Converted to admin submission**: The values **Yes** and **No**. +- **Tags**: **All** or select [user tags](user-tags-about.md) from the dropdown list. ++When you're finished on the **Filter** flyout, select **Apply**. To clear the filters, select :::image type="icon" source="../../media/m365-cc-sc-clear-filters-icon.png" border="false"::: **Clear filters**. ++Use :::image type="icon" source="../../media/m365-cc-sc-download-icon.png" border="false"::: **Export** to export the list of entries to a CSV file. ++For more information about the actions that are available for messages on the **User reported** tab, see the next subsection. ++### Admin actions for user reported messages ++On the **User reported** tab, actions for user reported messages are available on the tab itself or in the details flyout of a selected entry: ++- Select the message from the list by selecting the check box next to the first column. The following actions are available on the **User reported** tab: + - :::image type="icon" source="../../media/m365-cc-sc-submit-user-reported-message-icon.png" border="false"::: **[Submit to Microsoft for analysis](#submit-user-reported-messages-to-microsoft-for-analysis)** + - :::image type="icon" source="../../media/m365-cc-scc-mark-and-notify-icon.png" border="false"::: **[Mark as and notify](#notify-users-about-admin-submitted-messages-to-microsoft)** ++- Select the message from the list by clicking anywhere in the row other than the check box. The following actions are available in the details flyout that opens<sup>\*</sup>: + - :::image type="icon" source="../../media/m365-cc-sc-submit-user-reported-message-icon.png" border="false"::: **[Submit to Microsoft for analysis](#submit-user-reported-messages-to-microsoft-for-analysis)** + - :::image type="icon" source="../../media/m365-cc-scc-mark-and-notify-icon.png" border="false"::: **[Mark as and notify](#notify-users-about-admin-submitted-messages-to-microsoft)** + - :::image type="icon" source="../../media/m365-cc-sc-view-submission-icon.png" border="false"::: **[View the converted admin submission](#view-converted-admin-submissions)** + - [Actions in Microsoft Defender for Office 365 Plan 2 only](#actions-for-user-reported-messages-in-defender-for-office-365-plan-2): + - :::image type="icon" source="../../media/m365-cc-sc-open-icon.png" border="false"::: **Open email entity** + - :::image type="icon" source="../../media/m365-cc-sc-take-actions-icon.png" border="false"::: **Take actions** + - :::image type="icon" source="../../media/m365-cc-sc-view-alert-icon.png" border="false"::: **View alert** ++ > [!TIP] + > To see details or take action on other user reported messages without leaving the details flyout, use :::image type="icon" source="../../media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout. ++<sup>\*</sup> Depending on the nature and status of the message, some actions might not be available, are available directly at the top of the flyout, or are available under :::image type="icon" source="../../media/m365-cc-sc-more-actions-icon.png" border="false"::: **More actions** at the top of the flyout. ++These actions are described in the following subsections. > [!NOTE]-> The information in this section applies only to Defender for Office 365 Plan 2 or higher. +> After a user reports a suspicious message, the user or admins can't undo the reporting of the message, regardless of where the reported message goes (to the reporting mailbox, to Microsoft, or both). The user can recover the reported message from their Deleted Items or Junk Email folders. ++#### Submit user reported messages to Microsoft for analysis ++After you select the message on the **User reported** tab, use either of the following methods to submit the message to Microsoft: ++- **On the User reported tab**: Select :::image type="icon" source="../../media/m365-cc-sc-submit-user-reported-message-icon.png" border="false"::: **Submit to Microsoft for analysis***. ++- **In the details flyout of the selected message**: Select :::image type="icon" source="../../media/m365-cc-sc-submit-user-reported-message-icon.png" border="false"::: **Submit to Microsoft for analysis** or :::image type="icon" source="../../media/m365-cc-sc-more-actions-icon.png" border="false"::: **More options** \> :::image type="icon" source="../../media/m365-cc-sc-submit-user-reported-message-icon.png" border="false"::: **Submit to Microsoft for analysis** at the top of the flyout. ++In the **Submit to Microsoft for analysis** dropdown list, select one of the following values: ++- **Report clean**: In the dialog that opens, review or configure the following settings: ++ **Allow email with similar attributes (URL, sender, etc.)**: Select this option to add corresponding allow entries in Tenant Allow/Block List. The following settings are available: ++ - **Remove allow entry after**: The default value is **30 days**, but you can select from the following values: + - **1 day** + - **7 days** + - **30 days** + - **Specific date**: The maximum value is 30 days from today. + - **Allow entry note**: Enter optional information about why you're blocking this email. ++ When you're finished in the **Submit message as clean to Microsoft** dialog, select **Submit**. ++- **Report phishing**, **Report malware** or **Report spam**: These selections have the same options in the dialog that opens: ++ **Block all email from this sender or domain**: Select this option to add a sender or domain block entry in Tenant Allow/Block List. The following settings are available: ++ - Select **Sender** or **Domain**. + - **Remove allow entry after**: The default value is **30 days**, but you can select from the following values: + - **1 day** + - **7 days** + - **30 days** + - **Specific date**: The maximum value is 30 days from today. ++ When you're finished in the dialog, select **Submit**. ++- **Trigger investigation**: Defender for Office 365 Plan 2 only. For more information, see [Trigger an investigation](air-about-office.md#example-a-security-administrator-triggers-an-investigation-from-threat-explorer). +++After you submit a user reported message to Microsoft from the **User reported** tab, the value of **Converted to admin submission** turns from **No** to **Yes**, and a corresponding admin submission entry is created on the appropriate tab on the **Submissions** page (for example, the **Emails** tab). ++#### Notify users about admin submitted messages to Microsoft ++After an admin submits a user reported message to Microsoft from the **User reported** tab, admins can use the :::image type="icon" source="../../media/m365-cc-scc-mark-and-notify-icon.png" border="false"::: **Mark as and notify** action to mark these messages as **No threats found**, **Phishing**, or **Spam**, and send templated notification messages to the user who reported the message. ++For more information, see [Notify users from within the portal](submissions-admin-review-user-reported-messages.md#notify-users-from-within-the-portal). ++#### View converted admin submissions ++After an admin submits a user reported message to Microsoft from the **User reported** tab, the value of **Converted to admin submission** is **Yes**. ++If you select one of these messages by clicking anywhere in the row other than the check box next to the name, the details flyout contains :::image type="icon" source="../../media/m365-cc-sc-more-actions-icon.png" border="false"::: **More actions** \> :::image type="icon" source="../../media/m365-cc-sc-view-submission-icon.png" border="false"::: **View the converted admin submission**. ++This action takes you to the corresponding admin submission entry on the appropriate tab (for example, the **Emails** tab). -For each user reported message and admin email submission, a corresponding alert is generated. +#### Actions for user reported messages in Defender for Office 365 Plan 2 -To view the corresponding alert for a user reported phishing message, go to the **User reported** tab at <https://security.microsoft.com/reportsubmission?viewid=user>, and then double-click the message to open the submission flyout. Click  **More options** and then select **View alert**. +In organizations with Microsoft Defender for Office 365 Plan 2 (add-on licenses or included in subscriptions like Microsoft 365 E5), the following actions might also be available in the details flyout of a user reported message on the **User reported** tab: +- :::image type="icon" source="../../medi#how-to-read-the-email-entity-page). -To view the corresponding alert for admin email submissions, go to the **Emails** tab at <https://security.microsoft.com/reportsubmission?viewid=email>, and then double-click the message to open the submission flyout. Select **View alert** on the **Open email entity** option. +- :::image type="icon" source="../../medi#actions-you-can-take-on-the-email-entity-page). +- :::image type="icon" source="../../media/m365-cc-sc-view-alert-icon.png" border="false"::: **View alert**. An alert is triggered when an admin submission is created or updated. Selecting this action takes you to the details of the alert. |
| security | Submissions Error Messages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-error-messages.md | description: Learn about the errors that admins might encounter when they try to search.appverid: met150 Previously updated : 01/12/2023 Last updated : 6/6/2023 # Errors during admin submissions Last updated 01/12/2023 [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] -This article attempts to explain the common error messages that you might receive as you try to [report emails, URLs, and email attachments to Microsoft](submissions-admin.md) +This article attempts to explain the common error messages that you might receive as you try to [report messages, URLs, and email attachments to Microsoft](submissions-admin.md) ## This message didn't pass through our mail flow system, or the message metadata isn't available yet error -If you encounter this error message, then either of the following conditions might have occurred: +You get this error under either of the following conditions: -- You tried to submit an email message that wasn't filtered by Exchange Online Protection (EOP) or Microsoft Defender for Office 365 at the time of delivery.+- Exchange Online Protection (EOP) or Microsoft Defender for Office 365 didn't filter the message. - It's hard for us to determine why the message was missed or delivered when it wasn't filtered by Microsoft's protection stack. + We can't investigate why the message was blocked or delivered, because the Microsoft protection stack never evaluated or acted on the message. -- You tried to submit an email message that was filtered by EOP or Defender for Office 365, but we're still in the process of collecting the required metadata (descriptive data) about the message.+- EOP or Defender for Office 365 filtered the message, but we're still collecting the required metadata (descriptive data) for the message. - If you wait "a while" and submit the message again, the submission will be successful. + If you wait "a while" and submit the message again, the submission is likely to be successful. ## We did not receive the submission, please fix the problem and resubmit If you encounter this error message, then either of the following conditions have occurred: -- You're trying to submit an email that has been deleted or is no longer in the mailbox or quarantine.+- The message was deleted or is no longer available in the mailbox or in quarantine. +- Exchange mail flow rules (also known as transport rules), connectors, or data loss prevention (DLP) rules in your organization prevent the message from reaching us. -- You have Exchange mail flow rules (also known as transport rules), connectors, or data loss prevention (DLP) rules preventing the message from reaching us.--Be sure to check that both of these conditions are false before submitting the message again. +Be sure to investigate and fix both of these possible causes before you resubmit the message. |
| security | Submissions Outlook Report Messages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-outlook-report-messages.md | Last updated 12/05/2022 - [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) - [Microsoft 365 Defender](../defender/microsoft-365-defender.md) -In Microsoft 365 organizations with mailboxes in Exchange Online or in on-premises mailboxes that use hybrid modern authentication, users can report phishing and suspicious emails in Outlook. -Users can report false positives (good email that was blocked or sent to their Junk Email folder) and false negatives (unwanted email or phishing that was delivered to their Inbox) from Outlook on all platforms using free tools from Microsoft. --Admins configure user reported messages to go to a designated reporting mailbox, to Microsoft, or both. For more information, see [User reported settings](submissions-user-reported-messages-custom-mailbox.md). +In Microsoft 365 organizations with mailboxes in Exchange Online or in on-premises mailboxes that use hybrid modern authentication, users can report phishing and suspicious email in Outlook. Users can report false positives (good email that was blocked or sent to their Junk Email folder) and false negatives (unwanted email or phishing that was delivered to their Inbox) from Outlook on all platforms using free tools from Microsoft. Microsoft provides the following tools for users to report good and bad messages: Microsoft provides the following tools for users to report good and bad messages For more information about reporting messages to Microsoft, see [Report messages and files to Microsoft](submissions-report-messages-files-to-microsoft.md). -> [!NOTE] -> Admins in Microsoft 365 organizations with Exchange Online mailboxes use the **Submissions** page in the Microsoft 365 Defender portal to submit messages to Microsoft. For instructions, see [Use the Submissions page to submit suspected spam, phish, URLs, and files to Microsoft](submissions-admin.md). -> -> Admins can view reported messages on the **Submissions** page at <https://security.microsoft.com/reportsubmission> **only** if both of the following settings are configured on the **User reported** page at <https://security.microsoft.com/securitysettings/userSubmission>: -> -> - The toggle on the **User reported** page is **On** . -> - **Use the built-in "Report" button with "Phishing", "Junk", and "Not Junk options** is selected. +Admins configure user reported messages to go to a specified reporting mailbox, to Microsoft, or both. These user reported messages are available on the **User reported** tab on the **Submissions** page in the Microsoft 365 Defender Portal. For more information, see [User reported settings](submissions-user-reported-messages-custom-mailbox.md). ## Use the built-in Report button in Outlook on the web -> [!NOTE] -> -> - The built-in **Report** button is available in Outlook on the web **only** if both of the following settings are configured on the **User reported** page at <https://security.microsoft.com/securitysettings/userSubmission>: -> - The toggle on the **User reported** page is **On** . -> - **Use the built-in "Report" button with "Phishing", "Junk", and "Not Junk options** is selected. -> -> If the toggle is **Off**  or if **Use a non-Microsoft add-in button** is selected, then the **Report** button is not available in Outlook on the web. -> -> - Currently, the **Report** button in Outlook on the web does not honor the **Before a message is reported** and **After a message is reported** settings (notification pop-ups) in the [User reported settings](submissions-user-reported-messages-custom-mailbox.md). -> -> - Built-in reporting in Outlook on the web supports reporting messages from shared mailboxes or other mailboxes by a delegate. -> - Shared mailboxes require Send As or Send On Behalf permission for the user. -> - Other mailboxes require Send As or Send On Behalf permission _and_ Read and Manage permissions for the delegate. +- The built-in **Report** button is available in Outlook on the web *only* if user reporting is turned on *and* the built-in **Report** button in Outlook (not a non-Microsoft add-in button) are configured in the [user reported settings](submissions-user-reported-messages-custom-mailbox.md) at <https://security.microsoft.com/securitysettings/userSubmission>: ++ If user reporting is turned off and a non-Microsoft add-in button is selected, the **Report** button isn't available in Outlook on the web. ++- Currently, the **Report** button in Outlook on the web doesn't honor the before and after notification pop-up options in the user reported settings. ++- Built-in reporting in Outlook on the web supports reporting messages from shared mailboxes or other mailboxes by a delegate. + - Shared mailboxes require Send As or Send On Behalf permission for the user. + - Other mailboxes require Send As or Send On Behalf permission _and_ Read and Manage permissions for the delegate. ### Use the built-in Report button in Outlook on the web to report junk and phishing messages -- You can report a message as junk from the Inbox or any email folder other than Junk Email folder.-- You can report a message as phishing from any email folder.+- Users can report a message as junk from the Inbox or any email folder other than Junk Email folder. +- Users can report a message as phishing from any email folder. -In Outlook on the web, select one or more messages, click **Report**, and then select **Report phishing** or **Report junk** in the dropdown list. +In Outlook on the web, select one or more messages, select **Report**, and then select **Report phishing** or **Report junk** in the dropdown list. > [!div class="mx-imgBorder"]-> :::image type="content" source="../../media/owa-report-junk-phishing.png" alt-text="The results of clicking the Report button after selecting multiple messages in Outlook on the web." lightbox="../../media/owa-report-junk-phishing.png"::: +> :::image type="content" source="../../media/owa-report-junk-phishing.png" alt-text="The results of selecting the Report button after selecting multiple messages in Outlook on the web." lightbox="../../media/owa-report-junk-phishing.png"::: Based on the [User reported settings](submissions-user-reported-messages-custom-mailbox.md) in your organization, the messages are sent to the reporting mailbox, to Microsoft, or both. The following actions are also taken on the reported messages in the mailbox: Based on the [User reported settings](submissions-user-reported-messages-custom- ### Use the built-in Report button in Outlook on the web to report messages that aren't junk -In Outlook on the web, select one or more messages in the Junk Email folder, click **Report**, and then select **Not junk** in the dropdown list. +In Outlook on the web, select one or more messages in the Junk Email folder, select **Report**, and then select **Not junk** in the dropdown list. > [!div class="mx-imgBorder"]-> :::image type="content" source="../../media/owa-report-as-not-junk.png" alt-text="The results of clicking the Report button after selecting multiple messages in the Junk Email folder in Outlook on the web." lightbox="../../media/owa-report-as-not-junk.png"::: +> :::image type="content" source="../../media/owa-report-as-not-junk.png" alt-text="The results of selecting the Report button after selecting multiple messages in the Junk Email folder in Outlook on the web." lightbox="../../media/owa-report-as-not-junk.png"::: Based on the [User reported settings](submissions-user-reported-messages-custom-mailbox.md) in your organization, the messages are sent to the reporting mailbox, to Microsoft, or both. The messages are also moved out of Junk Email to the Inbox. ## Use the Report Message and Report Phishing add-ins in Outlook -> [!NOTE] -> -> - The procedures in this section require the Microsoft Report Message or Report Phishing add-ins to be installed. For more information, see [Enable the Microsoft Report Message or the Report Phishing add-in](submissions-users-report-message-add-in-configure.md) installed. -> - The versions of Outlook that are supported by the Report Message and Report Phishing add-ins are described [here](submissions-users-report-message-add-in-configure.md#what-do-you-need-to-know-before-you-begin). +- The procedures in this section require the Microsoft Report Message or Report Phishing add-ins. For more information, see [Enable the Microsoft Report Message or the Report Phishing add-in](submissions-users-report-message-add-in-configure.md) installed. ++- The versions of Outlook that are supported by the Report Message and Report Phishing add-ins are described [here](submissions-users-report-message-add-in-configure.md#what-do-you-need-to-know-before-you-begin). ### Use the Report Message add-in to report junk and phishing messages in Outlook -- You can report a message as junk from the Inbox or any email folder other than the Junk Email folder.-- You can report a message as phishing from any email folder.+- Users can report a message as junk from the Inbox or any email folder other than the Junk Email folder. +- Users can report a message as phishing from any email folder. 1. In Outlook, do one of the following steps: - Select an email message from the list. - Open a message. 2. Do one of the following steps based on your **Ribbon Layout** configuration in Outlook: - - **Classic Ribbon**: Click **Report Message**, and then select **Junk** or **Phishing** in the dropdown list. + - **Classic Ribbon**: Select **Report Message**, and then select **Junk** or **Phishing** in the dropdown list. > [!div class="mx-imgBorder"]- > :::image type="content" source="../../media/OutlookReportMessage-classic-expanded.png" alt-text="Select a message and then click the Report Message button in the Classic Ribbon in Outlook." lightbox="../../media/OutlookReportMessage-classic-expanded.png"::: + > :::image type="content" source="../../media/OutlookReportMessage-classic-expanded.png" alt-text="Select a message and then select the Report Message button in the Classic Ribbon in Outlook." lightbox="../../media/OutlookReportMessage-classic-expanded.png"::: - - **Simplified Ribbon**: Click  **More commands** \> **Protection** section \> **Report Message** \> select **Junk** or **Phishing**. + - **Simplified Ribbon**: Select :::image type="icon" source="../../media/m365-cc-sc-more-actions-icon.png" border="false"::: **More commands** \> **Protection** section \> **Report Message** \> select **Junk** or **Phishing**. > [!div class="mx-imgBorder"]- > :::image type="content" source="../../media/OutlookReportMessage-simplified-expanded.png" alt-text="Select a message and then click the Report Message button in the Simplified Ribbon in Outlook." lightbox="../../media/OutlookReportMessage-simplified-expanded.png"::: + > :::image type="content" source="../../media/OutlookReportMessage-simplified-expanded.png" alt-text="Select a message and then select the Report Message button in the Simplified Ribbon in Outlook." lightbox="../../media/OutlookReportMessage-simplified-expanded.png"::: -Based on the [User reported settings](submissions-user-reported-messages-custom-mailbox.md) in your organization, the messages are sent to the reporting mailbox, to Microsoft, or both. The following actions are also taken on the reported messages in the mailbox: +Based on the [user reported settings](submissions-user-reported-messages-custom-mailbox.md) in your organization, the messages are sent to the reporting mailbox, to Microsoft, or both. The following actions are also taken on the reported messages in the mailbox: - **Reported as junk**: The messages are moved to the Junk Email folder. - **Reported as phishing**: The messages are deleted. Based on the [User reported settings](submissions-user-reported-messages-custom- 1. In Outlook, open a message in the Junk Email folder. 2. Do one of the following steps based on your **Ribbon Layout** configuration in Outlook: - - **Classic Ribbon**: Click **Report Message**, and then select **Not Junk** in the dropdown list. + - **Classic Ribbon**: Select **Report Message**, and then select **Not Junk** in the dropdown list. > [!div class="mx-imgBorder"]- > :::image type="content" source="../../media/OutlookReportMessage-classic-expanded.png" alt-text="Select a message in the Junk Email folder, and then click the Report Message button in the Classic Ribbon in Outlook." lightbox="../../media/OutlookReportMessage-classic-expanded.png"::: + > :::image type="content" source="../../media/OutlookReportMessage-classic-expanded.png" alt-text="Select a message in the Junk Email folder, and then select the Report Message button in the Classic Ribbon in Outlook." lightbox="../../media/OutlookReportMessage-classic-expanded.png"::: - - **Simplified Ribbon**: Click  **More commands** \> **Protection** section \> **Report Message** \> select **Not Junk**. + - **Simplified Ribbon**: Select :::image type="icon" source="../../media/m365-cc-sc-more-actions-icon.png" border="false"::: **More commands** \> **Protection** section \> **Report Message** \> select **Not Junk**. > [!div class="mx-imgBorder"]- > :::image type="content" source="../../media/OutlookReportMessage-simplified-expanded.png" alt-text="Select a message in the Junk Email folder, and then click the Report Message button in the Simplified Ribbon in Outlook." lightbox="../../media/OutlookReportMessage-simplified-expanded.png"::: + > :::image type="content" source="../../media/OutlookReportMessage-simplified-expanded.png" alt-text="Select a message in the Junk Email folder, and then select the Report Message button in the Simplified Ribbon in Outlook." lightbox="../../media/OutlookReportMessage-simplified-expanded.png"::: -Based on the [User reported settings](submissions-user-reported-messages-custom-mailbox.md) in your organization, the messages are sent to the reporting mailbox, to Microsoft, or both. The messages are also moved out of Junk Email to the Inbox. +Based on the [user reported settings](submissions-user-reported-messages-custom-mailbox.md) in your organization, the messages are sent to the reporting mailbox, to Microsoft, or both. The messages are also moved out of Junk Email to the Inbox. ### Use the Report Phishing add-in to report phishing messages in Outlook -You can report phishing messages from any email folder. +Users can report phishing messages from any email folder. 1. In Outlook, do one of the following steps: - Select an email message from the list. - Open a message. 2. Do one of the following steps based on your **Ribbon Layout** configuration in Outlook: - - **Classic Ribbon**: Click **Report Phishing**. + - **Classic Ribbon**: Select **Report Phishing**. > [!div class="mx-imgBorder"]- > :::image type="content" source="../../media/Outlook-ReportPhishing.png" alt-text="Select a message and then click the Report Phishing button in the Classic Ribbon in Outlook." lightbox="../../media/Outlook-ReportPhishing.png"::: + > :::image type="content" source="../../media/Outlook-ReportPhishing.png" alt-text="Select a message and then select the Report Phishing button in the Classic Ribbon in Outlook." lightbox="../../media/Outlook-ReportPhishing.png"::: - - **Simplified Ribbon**: Click  **More commands** \> **Protection** section \> **Phishing** + - **Simplified Ribbon**: Select :::image type="icon" source="../../media/m365-cc-sc-more-actions-icon.png" border="false"::: **More commands** \> **Protection** section \> **Phishing** > [!div class="mx-imgBorder"]- > :::image type="content" source="../../media/Outlook-ReportPhishing-simplified.png" alt-text="Select a message and then click the Report Phishing button in the Simplified Ribbon in Outlook." lightbox="../../media/Outlook-ReportPhishing-simplified.png"::: + > :::image type="content" source="../../media/Outlook-ReportPhishing-simplified.png" alt-text="Select a message and then select the Report Phishing button in the Simplified Ribbon in Outlook." lightbox="../../media/Outlook-ReportPhishing-simplified.png"::: Based on the [User reported settings](submissions-user-reported-messages-custom-mailbox.md) in your organization, the messages are sent to the reporting mailbox, to Microsoft, or both. The messages are also deleted. |
| security | Submissions Report Messages Files To Microsoft | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-report-messages-files-to-microsoft.md | f1.keywords: Previously updated : 5/31/2023 Last updated : 6/6/2023 audience: ITPro ms.localizationpriority: medium Watch this video that shows more information about the unified submissions exper > [!IMPORTANT] >-> When you report an email entity to Microsoft, everything associated with the message is copied to include then in the continual algorithm reviews. This copy includes the email content, email headers, any attachments, and related data about email routing. +> When you report a message to Microsoft, everything associated with the message is copied and included in the continual algorithm reviews. This copy includes email content, email headers, any attachments, and related data about email routing. > > Microsoft treats your feedback as your organization's permission to analyze all the information to fine tune the message hygiene algorithms. Your message is held in secured and audited data centers in the USA. The submission is deleted as soon as it's no longer required. Microsoft personnel might read your submitted messages and attachments, which is normally not permitted for email in Microsoft 365. However, your email is still treated as confidential between you and Microsoft, and your email or attachments isn't shared with any other party as part of the review process. Watch this video that shows more information about the unified submissions exper |||| |[The built-in Report button](submissions-outlook-report-messages.md#use-the-built-in-report-button-in-outlook-on-the-web)|User|Currently, this method is available only in Outlook on the web (formerly known as Outlook Web App or OWA).| |[The Microsoft Report Message and Report Phishing add-ins](submissions-outlook-report-messages.md#use-the-report-message-and-report-phishing-add-ins-in-outlook)|User|These free add-ins work in Outlook on all available platforms. For installation instructions, see [Enable the Report Message or the Report Phishing add-ins](submissions-users-report-message-add-in-configure.md).|-|[The Submissions page in the Microsoft 365 Defender portal](submissions-admin.md)|Admin|Admins use this method to submit good (false positive) and bad (false negative) entities including user-reported messages to Microsoft for further analysis. Tabs include **Email**, **Email attachments**, **URLs**, and **Files**. Note that **Files** is only available to users with Microsoft Defender for Endpoint P2 license, and Microsoft 365 Defender E5 license.. The Submissions page is available to organizations who have Exchange Online mailboxes as part of a Microsoft 365 subscription (not available in standalone EOP).| +|[The Submissions page in the Microsoft 365 Defender portal](submissions-admin.md)|Admin|Admins can report good (false positives) and bad (false negative) messages, email attachments, and URLs (entities) from the available tabs on the **Submissions** page. <br><br> Admins can also submit user reported messages from the **User reported** tab on the **Submissions** page to Microsoft for analysis. The **Submissions** page is available only in organizations with Exchange Online mailboxes as part of a Microsoft 365 subscription (not available in standalone EOP).| +|Report messages from quarantine|Admin and User|Admins can [submit quarantined messages to Microsoft for analysis](quarantine-admin-manage-messages-files.md#report-email-to-microsoft-for-review-from-quarantine) (false positives and false negatives). <br><br> If users are allowed to [release their own messages from quarantine](quarantine-end-user.md#release-quarantined-email), and [user reported settings](submissions-user-reported-messages-custom-mailbox.md) is configured to allow users to report quarantined messages, users can select **Report message as having no threats** (false positive) when they release a quarantined message.| -[User reported settings](submissions-user-reported-messages-custom-mailbox.md) allow admins to configure whether user reported messages go to a specified reporting mailbox, to Microsoft, or both. Depending on your subscription, user reported messages are available in the following locations in the Microsoft 365 Defender portal: +## Related reporting settings for admins -- [The Submissions page](submissions-admin.md)-- [Automated investigation and response (AIR) results](air-view-investigation-results.md)-- [The User-reported messages report](reports-email-security.md#user-reported-messages-report)-- [Threat Explorer](threat-explorer-views.md)+[User reported settings](submissions-user-reported-messages-custom-mailbox.md) allow admins to configure whether user reported messages go to a specified reporting mailbox, to Microsoft, or both. After this feature is configured, user reported messages appear on the **User reported** tab on the **Submissions** page in the Defender portal. -Admins can use mail flow rules (also known as transport rules) to notify specified email address when users report messages to Microsoft for analysis. For more information, see [Use mail flow rules to see what users are reporting to Microsoft](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-see-what-users-are-reporting-to-microsoft). +User reported messages are also available to admins in the following locations in the Microsoft 365 Defender portal: -Admins can also submit other suspected files to Microsoft for analysis using the sample submission portal at <https://www.microsoft.com/wdsi/filesubmission>. For more information, see [Submit files for analysis](../intelligence/submission-guide.md). +- The [User-reported messages report](reports-email-security.md#user-reported-messages-report) +- [Automated investigation and response (AIR) results](air-view-investigation-results.md) (Defender for Office 365 Plan 2) +- [Threat Explorer](threat-explorer-views.md) (Defender for Office 365 Plan 2) ++In Defender for Office 365 Plan 2, admins can also submit messages from the [Email entity page](mdo-email-entity-page.md#actions-you-can-take-on-the-email-entity-page) and from [Alerts](../defender/investigate-alerts.md) in the Defender portal. ++Admins can use Exchange mail flow rules (also known as transport rules) to receive notifications when users report messages to Microsoft for analysis. For more information, see [Use mail flow rules to see what users are reporting to Microsoft](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-see-what-users-are-reporting-to-microsoft). ++Admins can use the sample submission portal at <https://www.microsoft.com/wdsi/filesubmission> to submit other suspected files to Microsoft for analysis. For more information, see [Submit files for analysis](../intelligence/submission-guide.md). > [!TIP]-> Information is blocked from going outside the organization when data isn't supposed to leave the tenant boundary for compliance purposes (for example, in U.S. Government organizations: Microsoft 365 GCC, GCC High, and DoD). Reporting a message or URL or email attachment to Microsoft from one of these organizations will have the following message in the result details: +> In U.S. Government organizations (Microsoft 365 GCC, GCC High, and DoD), admins can submit messages to Microsoft for analysis. The messages are analyzed for email authentication and policy checks only. Payload reputation, detonation, and grader analysis aren't done for compliance reasons (data isn't allowed to leave the organization boundary). If you report a message, URL, or email attachment to Microsoft from one of these organizations, you get the following message in the result details: >-> **Further investigation needed**. Your tenant doesn't allow data to leave the environment, so nothing was found during the initial scan. You'll need to contact Microsoft support to have this item reviewed. +> **Further investigation needed**. Your tenant doesn't allow data to leave the environment, so nothing was found during the initial scan. You'll need to contact Microsoft support to have this item reviewed. |
| security | Submissions Submit Files To Microsoft | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-submit-files-to-microsoft.md | Title: Submit malware and non-malware to Microsoft for analysis + Title: Submit malware and good files to Microsoft for analysis f1.keywords: - NOCSH Last updated 12/05/2022 - [Microsoft 365 Defender](../defender/microsoft-365-defender.md) > [!NOTE]-> If you're an admin in an organization with Exchange Online mailboxes, we recommend that you use the **Submissions** page in the Microsoft 365 Defender portal. For more information, see [Use the Submissions page to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft](submissions-admin.md). --In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, EOP includes anti-malware protection that's automatically enabled. For more information, see [Anti-malware protection in EOP](anti-malware-protection-about.md). +> If you're an admin in an organization with Exchange Online mailboxes, we recommend that you use the **Submissions** page in the Microsoft 365 Defender portal to submit messages to Microsoft for analysis. For more information, see [Use the Submissions page to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft](submissions-admin.md). You've probably heard the following best practices for years: - Avoid opening messages that look suspicious. - Never open an attachment from someone you don't know.-- Avoid opening attachments in messages that urge you to open or click them.+- Avoid opening attachments in messages that urge you to open them. - Avoid opening files downloaded from the internet unless they're from a verified source. - Don't use anonymous USB drives. -But what can you do if you receive a message with a suspicious attachment or have a suspicious file on your system? Or what if you suspect that your computer or device was infected by an email attachment that made it past our filters or a file you downloaded from the internet? In these cases, you should submit the suspicious attachment or file to Microsoft. Conversely, if an attachment in an email message or file was incorrectly identified as malware or some other threat, you can submit that, too. +But what can you do if you receive a message with a suspicious attachment or have a suspicious file on your system? In these cases, you should submit the suspicious attachment or file to Microsoft. Conversely, if an attachment in an email message or file was incorrectly identified as malware or some other threat, you can submit that, too. ## What do you need to know before you begin? +- All Microsoft 365 organizations that send or receive email include anti-malware protection that's automatically enabled. For more information, see [Anti-malware protection in EOP](anti-malware-protection-about.md). + - Messages with attachments that contain scripts or other malicious executables are considered malware, and you can use the procedures in this article to report them. -- Messages with links to malicious sites are considered spam. For more information about reporting spam and non-spam messages, see [Report messages and files to Microsoft](submissions-report-messages-files-to-microsoft.md).+- Messages with links to malicious sites are considered spam. For more information about reporting spam and good messages, see [Report messages and files to Microsoft](submissions-report-messages-files-to-microsoft.md). - Files that block you from your accessing your system and demand money to open them are considered ransomware. After you've uploaded the file or files, note the **Submission ID** that's creat :::image type="content" source="../../media/EOP-Malware-Protection-Center.png" alt-text="The submission details in the Windows Defender Security Intelligence website" lightbox="../../media/EOP-Malware-Protection-Center.png"::: -After we receive the sample, we'll investigate. If we determine that the sample file is malicious, we'll take corrective action to prevent the malware from going undetected. +After we receive the sample, we'll investigate. If we determine that the sample file is malicious, we take corrective action to prevent the malware from going undetected. If you continue receiving infected messages or attachments, then you should copy the message headers from the email message, and contact Microsoft Customer Service and Support for further assistance. Be sure to have your **Submission ID** ready as well. -## Submit non-malware files to Microsoft +## Submit good files to Microsoft Organizations that have a Microsoft 365 Defender Subscription or Microsoft 365 Defender for Endpoint Plan 2 can submit files using the **Submissions** page in the Microsoft 365 Defender portal. For more information, see [Use admin submission for submitting files in Microsoft Defender for Endpoint](../defender-endpoint/admin-submissions-mde.md). Or, you can go to the Microsoft Security Intelligence page at <https://www.micro You can also submit a file that you believe was incorrectly identified as malware to the website. (Just select **No** for the question **Do you believe this file contains malware?**) -After we receive the sample, we'll investigate. If we determine that the sample file is clean, we'll take corrective action to prevent the file from being detected as malware. +After we receive the sample, we'll investigate. If we determine that the sample file is clean, we take corrective action to prevent the file from being detected as malware. |
| security | Submissions Teams | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-teams.md | To view or configure this setting, you need to be a member of the **Global Admin 1. In the Teams admin center at <https://admin.teams.microsoft.com>, go to **Messaging policies**. Or, to go directly to the **Messaging policies** page, use <https://admin.teams.microsoft.com/policies/messaging>. 2. On the **Messaging policies** page, verify that the **Manage policies** tab is selected, and do either of the following actions to edit the appropriate policy (the **Global (Org-wide) default** policy or a custom policy):- - Click the link in the **Name** column. - - Select the policy by clicking anywhere in the row other than the **Name** column, and then click  **Edit**. + - Select the link in the **Name** column. + - Select the policy by clicking anywhere in the row other than the **Name** column, and then select :::image type="icon" source="../../media/m365-cc-sc-edit-icon.png" border="false"::: **Edit**. -3. In the policy details page that opens, find the **Report a security concern** toggle. By default, it's  **On**. To turn it off, toggle the setting to  **Off**. +3. In the policy details page that opens, find the **Report a security concern** toggle. By default, it's :::image type="icon" source="../../media/scc-toggle-on.png" border="false"::: **On**. To turn it off, toggle the setting to :::image type="icon" source="../../media/scc-toggle-off.png" border="false"::: **Off**. -4. Click **Save**, and then click **Confirm** in the confirmation dialog that opens. +4. Select **Save**, and then select **Confirm** in the confirmation dialog that opens. :::image type="content" source="../../media/submissions-teams-turn-on-off-tac.png" alt-text="Screenshot of the 'Report a security concern' toggle in Messaging policies in the Teams admin center." lightbox="../../media/submissions-teams-turn-on-off-tac.png"::: For more information about user reported message settings in the Defender portal ## How users report messages in Teams -1. In the Microsoft Teams client, hover over the malicious message without selecting it, and then click **... More options** \> **More actions** \> **Report this message**. +1. In the Microsoft Teams client, hover over the malicious message without selecting it, and then select **... More options** \> **More actions** \> **Report this message**. - :::image type="content" source="../../media/submissions-user-report-message-in-teams-client-click-path.png" alt-text="Screenshot of the Click path to report a message in the Microsoft Teams client." lightbox="../../media/submissions-user-report-message-in-teams-client-click-path.png"::: + :::image type="content" source="../../media/submissions-user-report-message-in-teams-client-click-path.png" alt-text="Screenshot of the Select path to report a message in the Microsoft Teams client." lightbox="../../media/submissions-user-report-message-in-teams-client-click-path.png"::: -2. In the **report this message** dialog that opens, verify **Security risk - Spam, phishing, malicious content** is selected, and then click **Report**. +2. In the **report this message** dialog that opens, verify **Security risk - Spam, phishing, malicious content** is selected, and then select **Report**. :::image type="content" source="../../media/submissions-user-report-message-in-teams-client-click-report.png" alt-text="Screenshot of the final dialog to report a message in the Microsoft Teams client." lightbox="../../media/submissions-user-report-message-in-teams-client-click-report.png"::: > [!NOTE] > If [reporting for Microsoft Purview Communication Compliance is turned off](/microsoftteams/communication-compliance#report-a-concern-in-microsoft-teams), users might not have the dropdown list to select **Security risk - Spam, phishing, malicious content**. Instead, they're shown a confirmation pop-up. -3. In the confirmation dialog that opens, click **Close**. +3. In the confirmation dialog that opens, select **Close**. **Notes**: - The reported message remains visible to the user in the Teams client. - Users can report the same message multiple times.-- The message sender is not notified that the message(s) was reported.+- The message sender isn't notified that the message(s) was reported. - Microsoft also sends an email message notification to the user who reported the message from submissions@messaging.microsoft.com with the subject, "You have successfully reported a Teams message as a security risk." If Teams integration is turned on in the Defender portal, admins can customize some elements of the notification message in the **Email sent to user after admin review** on **User reported** page as described in [Options for Microsoft reporting tools](submissions-user-reported-messages-custom-mailbox.md#options-for-microsoft-reporting-tools). > [!IMPORTANT] For more information, see [User reported settings](submissions-user-reported-mes - Regardless of the **Send reported messages to** setting, metadata from the reported Teams message (for example, senders, recipients, reported by, and message details) is available on the **User reported** tab on the **Submissions** page. - Regardless of the **Send reported messages to** setting, the alert policy named **Teams message reported by user as a security risk** generates an alert when a user reports a message in Teams by default. For more information, see [Manage alerts](/microsoft-365/compliance/alert-policies#manage-alerts). - To view the corresponding alert for a user reported message in Teams, go to the **User reported** tab on the **Submission** page, and then double-click the message to open the submission flyout. Click  **More options** and then select **View alert**. + To view the corresponding alert for a user reported message in Teams, go to the **User reported** tab on the **Submission** page, and then double-click the message to open the submission flyout. Select :::image type="icon" source="../../media/m365-cc-sc-more-actions-icon.png" border="false"::: **More options** and then select **View alert**. ## View and triage user reported messages in Teams As previously described, information about user reported messages in Teams is av The availability of Teams messages on the **User reported** tab on the **Submissions** page introduces the following changes to the page: -- Differences in available columns displayed by default (marked with an asterisk (\*)) and when you click  **Customize columns**:+- Differences in available columns displayed by default (marked with an asterisk (\*)) and when you select :::image type="icon" source="../../media/m365-cc-sc-customize-icon.png" border="false"::: **Customize columns**: - **Name and type**<sup>\*</sup> is available (previously named **Submission name**<sup>\*</sup>). - **Teams message ID** is available. -- Differences in available filters when you click  **Filter**:+- Differences in available filters when you select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**: - **Teams message ID** is available. - **Message type** is available. Values are **Email** and **Teams message** -- Differences in available values when you click  **Group**:- - **Reason** is not available. - - **Phish simulation** is not available. +- Differences in available values when you select :::image type="icon" source="../../media/m365-cc-sc-group-icon.png" border="false"::: **Group**: + - **Reason** isn't available. + - **Phish simulation** isn't available. - The **Result** column contains the following information for reported Teams messages based on the [user reported settings](submissions-user-reported-messages-custom-mailbox.md): - **Send reported messages to** \> **Microsoft and my reporting mailbox** or **Microsoft only**: The **Result** column contains values derived from the following analysis: - **Policy hits**: Information about any policies or overrides that may have allowed or blocked the incoming messages, including overrides to our filtering verdicts. The result should be available within several minutes. Otherwise, detonation and feedback from graders could take up to one day. - **Payload reputation/detonation**: Up-to-date examination of any URLs and files in the message. - **Grader analysis**: Review done by human graders in order to confirm whether or not messages are malicious.- - **Send reported messages to** \> **My reporting mailbox only**: The **Result** column value is always **Not submitted to Microsoft**, because the messages were not analyzed by Microsoft. + - **Send reported messages to** \> **My reporting mailbox only**: The **Result** column value is always **Not submitted to Microsoft**, because the messages weren't analyzed by Microsoft. -- Admin submission of Teams messages to Microsoft from the **User reported** tab on the **Submissions** page is basically the same as described in [Convert user reported messages in the reporting mailbox into admin submissions](submissions-admin.md#convert-user-reported-messages-in-the-reporting-mailbox-into-admin-submissions), including the [required permissions and throttling limits](submissions-admin.md#what-do-you-need-to-know-before-you-begin).+- Admin submission of Teams messages to Microsoft from the **User reported** tab on the **Submissions** page is basically the same as described in [Submit user reported messages to Microsoft for analysis](submissions-admin.md#submit-user-reported-messages-to-microsoft-for-analysis), including the [required permissions and throttling limits](submissions-admin.md#what-do-you-need-to-know-before-you-begin). But only the following values are available in **Submit to Microsoft for analysis** for reported Teams messages: |
| security | Submissions User Reported Messages Custom Mailbox | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-user-reported-messages-custom-mailbox.md | User reported settings and the reporting mailbox work with the following message - [The Microsoft Report Message or Report Phishing add-ins](submissions-users-report-message-add-in-configure.md) - [Third-party reporting tools](#options-for-third-party-reporting-tools) -Delivering user reported messages to a reporting mailbox instead of directly to Microsoft allows admins to selectively and manually submit messages to Microsoft from the **Emails** tab on the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=email>. For more information, see [Admin submission](submissions-admin.md). +Delivering user reported messages to a reporting mailbox instead of directly to Microsoft allows admins to selectively and manually submit messages to Microsoft from the **User reported** tab on the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=email>. For more information, see [Admin submission](submissions-admin.md). > [!NOTE] > The _ReportJunkEmailEnabled_ parameter on the [Set-OwaMailboxPolicy](/powershell/module/exchange/set-owamailboxpolicy) cmdlet no longer controls whether user message reporting is enabled or disabled. User reporting of messages is now controlled on the **User reported** page at <https://security.microsoft.com/securitysettings/userSubmission> as described in this article. Before you get started, you need to configure Exchange Online Protection and Def - Create a custom anti-malware policy for the reporting mailbox with the following settings: - - Turn off Zero-hour auto purge (ZAP) for malware (**Protection settings** section \> **Enable zero-hour auto purge for malware** is not selected or `-ZapEnabled $false` in PowerShell). + - Turn off Zero-hour auto purge (ZAP) for malware (**Protection settings** section \> **Enable zero-hour auto purge for malware** isn't selected or `-ZapEnabled $false` in PowerShell). - - Turn off common attachments filtering (**Protection settings** section \> **Enable the common attachments filter** is not selected or `-EnableFileFilter $false` in PowerShell). + - Turn off common attachments filtering (**Protection settings** section \> **Enable the common attachments filter** isn't selected or `-EnableFileFilter $false` in PowerShell). For instructions, see [Create an anti-malware policy](anti-malware-policies-configure.md#use-the-microsoft-365-defender-portal-to-create-anti-malware-policies). -- Verify that the reporting mailbox is not included in the **Standard** or **Strict** preset security policies. For instructions, see [Preset security policies](preset-security-policies.md).+- Verify that the reporting mailbox isn't included in the **Standard** or **Strict** preset security policies. For instructions, see [Preset security policies](preset-security-policies.md). - **Defender for Office 365**: Configure the following additional settings: Before you get started, you need to configure Exchange Online Protection and Def - Create a Safe Attachments policy for the mailbox where Safe Attachments scanning, including Dynamic Delivery, is turned off (**Settings** \> **Safe Attachments unknown malware response** section \> **Off** or `-Enable $false` in PowerShell). For instructions, see [Set up Safe Attachments policies in Microsoft Defender for Office 365](safe-attachments-policies-configure.md). - - Create a Safe Links policy for the reporting mailbox where Safe Links scanning in email is turned off (**URL & click protection settings** \> **On: Safe Links checks a list of known, malicious links when users click links in email** is not selected or `EnableSafeLinksForEmail $false` in PowerShell). For instructions, see [Set up Safe Links policies in Microsoft Defender for Office 365](safe-links-policies-configure.md). + - Create a Safe Links policy for the reporting mailbox where Safe Links scanning in email is turned off (**URL & click protection settings** \> **On: Safe Links checks a list of known, malicious links when users click links in email** isn't selected or `EnableSafeLinksForEmail $false` in PowerShell). For instructions, see [Set up Safe Links policies in Microsoft Defender for Office 365](safe-links-policies-configure.md). - If you have data loss prevention (DLP), exclude the reporting mailbox from DLP. For instructions, see [Creating exceptions in DLP](/microsoft-365/compliance/dlp-conditions-and-exceptions). -After you've verified that the reporting mailbox meets all of these requirements, use the rest of the instructions in this article to identify the reporting mailbox and to configure related settings. +After you verify that the reporting mailbox meets all of these requirements, use the procedures in this article to identify the reporting mailbox and to configure the related settings. ## What do you need to know before you begin? After you've verified that the reporting mailbox meets all of these requirements - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). -- To modify the user reported settings, you need to be a member of one of the following role groups:-- - **Organization Management** or **Security Administrator** in the [Permissions in the Microsoft 365 Defender portal](mdo-portal-permissions.md). --- You need access to Exchange Online PowerShell. If the account that you're trying to use doesn't have access to Exchange Online PowerShell, you'll receive an error that looks like this when specifying the submissions mailbox:-- > Specify an email address in your domain -- For more information about enabling or disabling access to Exchange Online PowerShell, see the following topics: +- You need to be assigned permissions before you can do the procedures in this article. You have the following options: + - [Email & collaboration RBAC in the Microsoft 365 Defender portal](mdo-portal-permissions.md): Membership in the **Organization Management** or **Security Administrator** role groups. + - [Azure AD RBAC](../../admin/add-users/about-admin-roles.md): Membership in the **Global Administrator** or **Security Administrator** roles gives users the required permissions _and_ permissions for other features in Microsoft 365. +- You need access to Exchange Online PowerShell. If your account doesn't have access to Exchange Online PowerShell, you get the following error: *Specify an email address in your domain*. For more information about enabling or disabling access to Exchange Online PowerShell, see the following articles: - [Enable or disable access to Exchange Online PowerShell](/powershell/exchange/disable-access-to-exchange-online-powershell) - [Client Access Rules in Exchange Online](/exchange/clients-and-mobile-in-exchange-online/client-access-rules/client-access-rules) ([until October 2023](https://techcommunity.microsoft.com/t5/exchange-team-blog/deprecation-of-client-access-rules-in-exchange-online/ba-p/3638563)) After you've verified that the reporting mailbox meets all of these requirements 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Settings** \> **Email & collaboration** \> **User reported** tab. To go directly to the **User reported** page, use <https://security.microsoft.com/securitysettings/userSubmission>. -2. On the **User reported** page, what you see and can configure is determined entirely by the toggle at the top of the page: +2. On the **User reported** page, the available settings are determined entirely by the toggle at the top of the page: - **On** :::image type="icon" source="../../media/scc-toggle-on.png":::: The following configurations are supported: - Users in your organization can see and use the built-in **Report** button in Outlook on the web or the Microsoft Report Message or Report Phishing add-ins in virtually all Outlook platforms to report messages. - You can configure user reported messages to go to the reporting mailbox, to Microsoft, or both. - You decide whether users receive **Before a message is reported** and **After a message is reported** pop-ups in Outlook.- - You decide how to customize the feedback email that's sent to users from **Mark and notify** on the **Submissions** page at <https://security.microsoft.com/reportsubmission>. + - You decide how to customize the feedback email that's sent to users from **Mark as and notify** on the **Submissions** page at <https://security.microsoft.com/reportsubmission>. - You decide whether users can report messages from quarantine. You choose this configuration by selecting **Use the built-in "Report" button with "Phishing", "Junk", and "Not Junk options** in the **Outlook report button configuration** section. The available configuration options from this selection are explained in the [Options for Microsoft reporting tools](#options-for-microsoft-reporting-tools) section in this article. When the toggle is **On** :::image type="icon" source="../../media/scc-toggle-on - **My reporting mailbox only**: User reported messages go only to the specified reporting mailbox for an admin or the security operations team to analyze. - In the **Add a mailbox to send reported messages to** box that appears, enter the email address of an existing Exchange Online mailbox to use as the reporting mailbox that holds user reported messages from Microsoft reporting tools. Distribution groups and routing to an external or on-premises mailbox are not allowed. + In the **Add a mailbox to send reported messages to** box that appears, enter the email address of an existing Exchange Online mailbox to use as the reporting mailbox that holds user reported messages from Microsoft reporting tools. Distribution groups and routing to an external or on-premises mailbox aren't allowed. - Messages don't go to Microsoft for analysis unless an admin manually submits the message from the **Emails** tab on the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=email>. + Messages don't go to Microsoft for analysis unless an admin manually submits the message from the **User reported** tab on the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=email>. - **Microsoft and my reporting mailbox**: User reported messages go to Microsoft for analysis and to the reporting mailbox for an admin or security operations team to analyze. - In the **Add a mailbox to send reported messages to** box that appears, enter the email address of an existing Exchange Online mailbox to use as the reporting mailbox. Distribution groups and routing to external or on-premises mailboxes is not allowed. + In the **Add a mailbox to send reported messages to** box that appears, enter the email address of an existing Exchange Online mailbox to use as the reporting mailbox. Distribution groups and routing to external or on-premises mailboxes isn't allowed. > [!IMPORTANT] >- > - If you select **My reporting mailbox only**, the **Result** value of messages entries on the **User reported** tab on the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=user> will be **Not Submitted to Microsoft**, because the messages were not analyzed by Microsoft. - > - In U.S. Government organizations (Microsoft 365 GCC, GCC High, and DoD), the only available selection in the **Send the reported messages to** section is **My reporting mailbox only**. The other two options are grayed out due to compliance reasons. + > - If you select **My reporting mailbox only**, the **Result** value of entries on the **User reported** tab on the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=user> is **Not Submitted to Microsoft**, because the messages were not analyzed by Microsoft. + > - In U.S. Government organizations (Microsoft 365 GCC, GCC High, and DoD), the only available selection in the **Send the reported messages to** section is **My reporting mailbox only**. The other two options are grayed out for compliance reasons (data isn't allowed to leave the organization boundary). > > - If you use [Attack simulation training](attack-simulation-training-get-started.md) or a third-party product to do phishing simulations, and you're sending user reported messages to a reporting mailbox, you need to configure the reporting mailbox as a SecOps mailbox as described in the [Configuration requirements for the reporting mailbox](#configuration-requirements-for-the-reporting-mailbox) section earlier in this article. If you don't, a user reported message might trigger a training assignment by the phishing simulation product. The following settings are also available on the page: - **Show a pop-up message in Outlook to confirm it the user want's to report the message** in the **Before a message is reported** section: This setting controls whether users see a pop-up before they report a message. - If this setting is selected, click **Customize before message** to enter the **Title** and **Message** text in the **Customize text before message is reported** flyout that opens. Use the variable `%type%` to include the submission type (junk, not junk, phishing, etc.). + Select this setting and select **Customize before message** to enter the **Title** and **Message** text in the **Customize text before message is reported** flyout that opens. Use the variable `%type%` to include the submission type (junk, not junk, phishing, etc.). - When you're finished, click **Confirm** to return to the **User reported** page. + When you're finished, select **Confirm** to return to the **User reported** page. - **Show a success pop-up message in Outlook after the user reports** in the **After a message is reported** section: This setting controls whether users see a pop-up after they report a message. - If this setting is selected, click **Customize after message** to enter the **Title** and **Message** text in the **Customize text after message is reported** flyout that opens. Use the variable `%type%` to include the submission type (junk, not junk, phishing, etc.). + Select this setting and select **Customize after message** to enter the **Title** and **Message** text in the **Customize text after message is reported** flyout that opens. Use the variable `%type%` to include the submission type (junk, not junk, phishing, etc.). - When you're finished, click **Confirm** to return to th **User reported** page. + When you're finished, select **Confirm** to return to th **User reported** page. > [!IMPORTANT] > Currently, users who report messages from Outlook on the web using the built-in **Report** button don't get these before or after pop-up messages. The pop-ups work for users who report messages using the Microsoft Report Message and Report Phishing add-ins. The following settings are also available on the page: - **Email sent to user after admin review** section: The following settings are available: - **Specify an Office 365 mailbox to send email notifications from**: Select this option and enter the sender's email address in the box that appears.- - **Replace the Microsoft logo with my company logo**: Select this option to replace the default Microsoft logo that's used in notifications. Before you do this step, you need to follow the instructions in [Customize the Microsoft 365 theme for your organization](../../admin/setup/customize-your-organization-theme.md) to upload your custom logo. This option is not supported if your organization has a custom logo pointing to a URL instead of an uploaded image file. - - **Customize email notification messages**: Click this link to customize the email notification that's sent after an admin reviews and marks a reported message. In the **Customize admin review email notifications** flyout that appears, configure the following settings on the **Phishing**, **Junk** and **No threats found** tabs: + - **Replace the Microsoft logo with my company logo**: Select this option to replace the default Microsoft logo that's used in notifications. Before you do this step, you need to follow the instructions in [Customize the Microsoft 365 theme for your organization](../../admin/setup/customize-your-organization-theme.md) to upload your custom logo. This option isn't supported if your organization has a custom logo pointing to a URL instead of an uploaded image file. + - **Customize email notification messages**: Select this link to customize the email notification that's sent after an admin reviews and marks a reported message. In the **Customize admin review email notifications** flyout that appears, configure the following settings on the **Phishing**, **Junk** and **No threats found** tabs: - **Email body results text**: Enter the custom text to use. You can use different text for **Phishing**, **Junk** and **No threats found**. - **Email footer text**: Enter the custom message footer text to use. The same text is used for **Phishing**, **Junk** and **No threats found**. - When you're finished, click **Confirm** to return to the **User reported** page. + When you're finished, select **Confirm** to return to the **User reported** page. -When you're finished on the **User reported** page, click **Save**. To restore all settings on the page to their immediately previous values, click **Restore**. +When you're finished on the **User reported** page, select **Save**. To restore all settings on the page to their immediately previous values, select **Restore**. ### Options for third-party reporting tools When the toggle is **On** :::image type="icon" source="../../media/scc-toggle-on.png"::: and you've selected **Use a non-Microsoft add-in button**, the following options are available on the **User reported** page: -- **Add a mailbox to send reported messages to** in the **Reported message destinations** section: Enter the email address of an existing Exchange Online mailbox to use as the reporting mailbox that holds user-reported messages from third-party reporting tools. These messages are not submitted to Microsoft.+- **Add a mailbox to send reported messages to** in the **Reported message destinations** section: Enter the email address of an existing Exchange Online mailbox to use as the reporting mailbox that holds user-reported messages from third-party reporting tools. These messages aren't submitted to Microsoft. These user-reported messages appear on the **User reported** tab of the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=user>. The **Result** value for these entries is **Not Submitted to Microsoft**. Messages sent to the reporting mailbox must include the original user reported message as an uncompressed .EML or .MSG attachment. Don't forward the original user-reported message to the reporting mailbox. > [!CAUTION]- > Messages that contain multiple attached messages will be discarded. We support only one attached original message in a user reported message. + > Messages that contain multiple attached messages are discarded. We support only one attached original message in a user reported message. The message formatting requirements are described in the next section. This formatting is optional, but if user reported messages don't follow the prescribed format, they're always identified as phishing. **Let your organization report messages from quarantine** in the **Report from quarantine** section: Verify that this setting is selected to let users report messages from quarantine. Otherwise, uncheck this setting. -When you're finished on the **User reported** page, click **Save**. To restore all settings on the page to their immediately previous values, click **Restore**. +When you're finished on the **User reported** page, select **Save**. To restore all settings on the page to their immediately previous values, select **Restore**. #### Message submission format To specify the reason why the original, attached messages were reported, message - `3|This text in the Subject line is ignored by the system` - `Not Junk:This text in the Subject line is also ignored by the system` - Messages that don't follow this format will not display properly on the **Submissions** page at <https://security.microsoft.com/reportsubmission>. + Messages that don't follow this format aren't displayed properly on the **User reported** tab of the **Submissions** page at <https://security.microsoft.com/reportsubmission>. ## Use Exchange Online PowerShell to configure the reported message settings To view both the policy and the rule at the same time, run the following command Write-Output -InputObject `r`n,"Report Submission Policy",("-"*79); Get-ReportSubmissionPolicy; Write-Output -InputObject `r`n,"Report Submission Rule",("-"*79); Get-ReportSubmissionRule ``` -Remember, if you've never gone to <https://security.microsoft.com/securitysettings/userSubmission> or manually created the report submission policy or the report submission rule in PowerShell, there is no report submission policy or report submission rule, so the **Get-ReportSubmissionPolicy** and **Get-ReportSubmissionRule** cmdlets return nothing. +Remember, if you've never gone to <https://security.microsoft.com/securitysettings/userSubmission> or manually created the report submission policy or the report submission rule in PowerShell, there's no report submission policy or report submission rule, so the **Get-ReportSubmissionPolicy** and **Get-ReportSubmissionRule** cmdlets return nothing. For detailed syntax and parameter information, see [Get-ReportSubmissionPolicy](/powershell/module/exchange/get-reportsubmissionpolicy) and [Get-ReportSubmissionRule](/powershell/module/exchange/get-reportsubmissionrule). Other settings: - **Before a message is reported** section: - **Show a pop-up message in Outlook to confirm if the user wants to report the message** is selected (`-PreSubmitMessageEnabled $true | $false` is available only on **Set-ReportSubmissionPolicy**; the unconfigurable value on **New-ReportSubmissionPolicy** is `$true`).- - **Customize before message** link: Nothing is entered in the **Title** or **Message** boxes in the flyout.(`-EnableCustomizedMsg $false` is the default value). + - **Customize before message** link: Nothing is entered in the **Title** or **Message** boxes in the flyout (`-EnableCustomizedMsg $false` is the default value). - **After a message is reported** section: - **Show a success pop-up message in Outlook after the user reports message** is selected (`-PostSubmitMessageEnabled $true | $false` is available only on **Set-ReportSubmissionPolicy**; the unconfigurable value on **New-ReportSubmissionPolicy** is `$true`). Other settings: > Currently, pop-up messages before or after a user reports a message are supported only by the Microsoft Report Message and Report Phishing add-ins. Users who report messages with the built-in **Report** button in Outlook on the web don't see these pop-ups. - **Email sent to user after admin review** section:- - **Specify an Office 365 mailbox to send email notifications from** is not selected (`-EnableCustomNotificationSender $false` is the default value). - - **Replace the Microsoft logo with my company logo** is not selected (`-EnableOrganizationBranding $false` is the default value). + - **Specify an Office 365 mailbox to send email notifications from** isn't selected (`-EnableCustomNotificationSender $false` is the default value). + - **Replace the Microsoft logo with my company logo** isn't selected (`-EnableOrganizationBranding $false` is the default value). - **Customize email notification messages** link: Nothing is entered in the **Email body results text** or **Email footer text** boxes on the **Phishing**, **Junk**, or **No threats found** tabs in the flyout (`-EnableCustomizedMsg $false` is the default value). - **Report from quarantine** section: **Let your organization report messages from quarantine** is selected (`-DisableQuarantineReportingOption $false` is the default value). Other settings: New-ReportSubmissionPolicy ``` -Because a reporting mailbox isn't use, the report submission rule is not needed or created. +Because a reporting mailbox isn't use, the report submission rule isn't needed or created. #### Use PowerShell to configure the Microsoft integrated reporting experience with report messages to Microsoft and the reporting mailbox New-ReportSubmissionRule -Name DefaultReportSubmissionRule -ReportSubmissionPoli Turning off the Microsoft integrated reporting experiences has the following consequences: - The **Report** button in Outlook on the web and the Microsoft Report Message and Report Phishing add-ins are unavailable in all Outlook platforms.-- Third-party reporting tools still work, but reported messages do not appear on the **Submissions** page in the Microsoft 365 Defender portal.+- Third-party reporting tools still work, but reported messages don't appear on the **Submissions** page in the Microsoft 365 Defender portal. This example creates the report submission policy with the Microsoft integrated reporting experience turned **Off** :::image type="icon" source="../../media/scc-toggle-on.png"::: (`-EnableReportToMicrosoft $false`; `-EnableThirdPartyAddress $false -ReportJunkToCustomizedAddress $false -ReportNotJunkToCustomizedAddress $false -ReportPhishToCustomizedAddress $false` are the default values). Get-ReportSubmissionRule | Disable-ReportSubmissionRule -Confirm:$false ### Use PowerShell to remove the report submission policy and the report submission rule -To start over with the default settings of the report submission policy, you can delete it and recreate it. Removing the report submission policy does not remove the report submission rule, and vice-versa. +To start over with the default settings of the report submission policy, you can delete it and recreate it. Removing the report submission policy doesn't remove the report submission rule, and vice-versa. To remove the report submission policy, run the following command in Exchange Online PowerShell: |
| security | Submissions Users Report Message Add In Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-users-report-message-add-in-configure.md | After the add-in is installed and enabled, users see the following icons based o > - The toggle on the **User reported** page is **On** :::image type="icon" source="../../media/scc-toggle-on.png" border="false":::. > - **Use the built-in "Report" button with "Phishing", "Junk", and "Not Junk options"** is selected. -- Organizations that use URL filtering or a third-party security solutions (for example, a proxy and/or firewall) must be able to reach the following URLs using the HTTPS protocol:+- Organizations that use URL filtering or a third-party security solution (for example, a proxy and/or firewall) must be able to reach the following URLs using the HTTPS protocol: - `ipagave.azurewebsites.net` - `outlook.office.com` Admins in Microsoft 365 Government Community Cloud (GCC) or GCC High need to use > [!NOTE] > It could take up to 24 hours for the add-in to appear in your organization. >-> In U.S. Government organizations (Microsoft 365 GCC, GCC High, and DoD), reported messages aren't sent to Microsoft for analysis. They are sent only to the reporting mailbox that you identify. For more information, see [User reported settings](submissions-user-reported-messages-custom-mailbox.md). +> In U.S. Government organizations (Microsoft 365 GCC, GCC High, and DoD), reported messages aren't sent to Microsoft for analysis. They're sent only to the reporting mailbox that you identify for compliance reasons (data isn't allowed to leave the organization boundary). For more information, see [User reported settings](submissions-user-reported-messages-custom-mailbox.md). 1. In the Microsoft 365 admin center at <https://portal.office365.us/adminportal/home#/Settings/AddIns>, select **Settings** \> **Add-ins** \> **Deploy Add-in** \> **Upload custom apps**. |
| security | Tenant Allow Block List About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-allow-block-list-about.md | These articles contain procedures in the Microsoft 365 Defender Portal and in Po > [!NOTE] > In the Tenant Allow/Block List, block entries take precedence over allow entries. -Use the Submissions page (also known as *admin submission*) at <https://security.microsoft.com/reportsubmission> to create block entries for the following types of items as you report them as false negatives to Microsoft: +Use the **Submissions** page (also known as *admin submission*) at <https://security.microsoft.com/reportsubmission> to create block entries for the following types of items as you report them as false negatives to Microsoft: - **Domains and email addresses**: - Email messages from these senders are marked as *high confidence spam* (SCL = 9). What happens to the messages is determined by the [anti-spam policy](anti-spam-policies-configure.md) that detected the message for the recipient. In the default anti-spam policy and new custom policies, messages that are marked as high confidence spam are delivered to the Junk Email folder by default. In Standard and Strict [preset security policies](preset-security-policies.md), high confidence spam messages are quarantined. By default, block entries for **domains and email addresses**, **files** and **U In most cases, you can't directly create allow entries in the Tenant Allow/Block List: -- **Domains and email addresses**, **files**, and **URLs**: You can't create allow entries directly in the Tenant Allow/Block List. Instead you use the Submissions page at <https://security.microsoft.com/reportsubmission> to report the **email**, **email attachment**, or **URL** to Microsoft as **Should not have been blocked (False positive)**.+- **Domains and email addresses**, **files**, and **URLs**: You can't create allow entries directly in the Tenant Allow/Block List. Instead you use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to report the **email**, **email attachment**, or **URL** to Microsoft as **Should not have been blocked (False positive)**. - **Spoofed senders**:- - If spoof intelligence has already blocked the message as spoofing, use the Submissions page at <https://security.microsoft.com/reportsubmission> to report the **email** to Microsoft as **Should not have been blocked (False positive)**. + - If spoof intelligence has already blocked the message as spoofing, use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to report the **email** to Microsoft as **Should not have been blocked (False positive)**. - You can proactively create an allow entry for a spoofed sender on the **Spoofed sender** tab in the Tenant Allow/Block List before [spoof intelligence](anti-spoofing-spoof-intelligence.md) identifies and blocks the message as spoofing. -The following list describes what happens in the Tenant Allow/Block List when you report something to Microsoft as a false positive on the Submissions page: +The following list describes what happens in the Tenant Allow/Block List when you report something to Microsoft as a false positive on the **Submissions** page: - **Email attachments** and **URLs**: An allow entry is created and the entry appears on the **Files** or **URLs** tab in the Tenant Allow/Block List respectively. - For URLs reported as false positives, we'll allow subsequent messages that contain variations of the original URL. For example, you use the Submissions page to report the incorrectly blocked URL `www.contoso.com/abc`. If your organization later receives a message that contains the URL (for example but not limited to: `www.contoso.com/abc`, `www.contoso.com/abc?id=1`, `www.contoso.com/abc/def/gty/uyt?id=5`, or `*.contoso.com/abc`), the message won't be blocked based on the URL. In other words, you don't need to report multiple variations of the same URL as good to Microsoft. + For URLs reported as false positives, we'll allow subsequent messages that contain variations of the original URL. For example, you use the **Submissions** page to report the incorrectly blocked URL `www.contoso.com/abc`. If your organization later receives a message that contains the URL (for example but not limited to: `www.contoso.com/abc`, `www.contoso.com/abc?id=1`, `www.contoso.com/abc/def/gty/uyt?id=5`, or `*.contoso.com/abc`), the message won't be blocked based on the URL. In other words, you don't need to report multiple variations of the same URL as good to Microsoft. - **Email**: If a message was blocked by the EOP or Defender for Office 365 filtering stack, an allow entry might be created in the Tenant Allow/Block List: - If the message was blocked by [spoof intelligence](anti-spoofing-spoof-intelligence.md), an allow entry for the sender is created, and the entry appears on the **Spoofed senders** tab in the Tenant Allow/Block List. By default, allow entries for domains and email addresses, files, and URLs exist > [!IMPORTANT] > Microsoft does not allow you to create allow entries directly. Unnecessary allow entries expose your organization to malicious email which could have been filtered by the system. >-> Microsoft manages the creation of allow entries from the Submissions page. Allow entries are added during mail flow based on the filters that determined the message was malicious. For example, if the sender email address and a URL in the message were determined to be bad, an allow entry is created for the sender (email address or domain) and the URL. +> Microsoft manages the creation of allow entries from the **Submissions** page. Allow entries are added during mail flow based on the filters that determined the message was malicious. For example, if the sender email address and a URL in the message were determined to be bad, an allow entry is created for the sender (email address or domain) and the URL. > > When the entity is encountered again (during mail flow or time of click), all filters associated with that entity are skipped. > By default, allow entries for domains and email addresses, files, and URLs exist ## What to expect after you add an allow or block entry -After you add an allow entry on the Submissions page or a block entry in the Tenant Allow/Block List, the entry should start working immediately 99.999% of the time. For the rest, it could take up to 24 hours. +After you add an allow entry on the **Submissions** page or a block entry in the Tenant Allow/Block List, the entry should start working immediately 99.999% of the time. For the rest, it could take up to 24 hours. If Microsoft has learned from the allow entry, the entry is removed. You'll get an alert about the removal of the now unnecessary allow entry from the built-in [alert policy](../../compliance/alert-policies.md) named **Removed an entry in Tenant Allow/Block List**). |
| security | Tenant Allow Block List Email Spoof Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure.md | By default, allow entries for domains and email addresses exist for 30 days. Dur #### Use the Microsoft 365 Defender portal to create block entries for domains and email addresses on the Submissions page -When you use the Submissions page at <https://security.microsoft.com/reportsubmission> to submit email messages as **Should have been blocked (False negative)**, you can select **Block all emails from this sender or domain** to add a block entry for the sender email address or domain on the **Domains & addresses** tab in the Tenant Allow/Block List. +When you use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to submit email messages as **Should have been blocked (False negative)**, you can select **Block all emails from this sender or domain** to add a block entry for the sender email address or domain on the **Domains & addresses** tab in the Tenant Allow/Block List. For instructions, see [Submit questionable email to Microsoft](submissions-admin.md#report-questionable-email-to-microsoft). For detailed syntax and parameter information, see [New-TenantAllowBlockListItem ### Use the Microsoft 365 Defender portal to create allow entries for domains and email addresses on the Submissions page -You can't create allow entries for domains and email addresses directly in the Tenant Allow/Block List. Instead, you use the Submissions page at <https://security.microsoft.com/reportsubmission> to submit the message as a false positive, which also adds an allow entry for the sender on the **Domains & addresses** tab in the Tenant Allow/Block List. +You can't create allow entries for domains and email addresses directly in the Tenant Allow/Block List. Instead, you use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to submit the message as a false positive, which also adds an allow entry for the sender on the **Domains & addresses** tab in the Tenant Allow/Block List. For instructions, see [Submit good email to Microsoft](submissions-admin.md#report-good-email-to-microsoft). By default, allow entries for domains and email addresses, files, and URLs exist > [!IMPORTANT] > Microsoft does not allow you to create allow entries directly. Unnecessary allow entries expose your organization to malicious email which could have been filtered by the system. >-> Microsoft manages the creation of allow entries from the Submissions page. Allow entries are added during mail flow based on the filters that determined the message was malicious. For example, if the sender email address and a URL in the message were determined to be bad, an allow entry is created for the sender (email address or domain) and the URL. +> Microsoft manages the creation of allow entries from the **Submissions** page. Allow entries are added during mail flow based on the filters that determined the message was malicious. For example, if the sender email address and a URL in the message were determined to be bad, an allow entry is created for the sender (email address or domain) and the URL. > > When the entity in the allow entry is encountered again (during mail flow or time of click), all filters associated with that entity are skipped. > Only messages from that domain *and* sending infrastructure pair are allowed to You can't create allow entries in the Tenant Allow/Block List for messages that were detected as [domain or sender impersonation protection in Defender for Office 365](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365). -Submitting a message that was incorrectly blocked as impersonation on the Submissions page at <https://security.microsoft.com/reportsubmission> does not add the sender or domain as an allow entry in the Tenant Allow/Block List. +Submitting a message that was incorrectly blocked as impersonation on the **Submissions** page at <https://security.microsoft.com/reportsubmission> does not add the sender or domain as an allow entry in the Tenant Allow/Block List. Instead, the domain or sender is added to the **Trusted senders and domains section** in the [anti-phishing policy](anti-phishing-policies-mdo-configure.md#use-the-microsoft-365-defender-portal-to-modify-anti-phishing-policies) that detected the message. |
| security | Tenant Allow Block List Files Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-allow-block-list-files-configure.md | You have the following options to create block entries for files: ### Use the Microsoft 365 Defender portal to create block entries for files on the Submissions page -When you use the Submissions page at <https://security.microsoft.com/reportsubmission> to submit files as **Should have been blocked (False negative)**, you can select **Block this file** to add a block entry on the **Files** tab in the Tenant Allow/Block List. +When you use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to submit files as **Should have been blocked (False negative)**, you can select **Block this file** to add a block entry on the **Files** tab in the Tenant Allow/Block List. For instructions, see [Submit questionable email attachments to Microsoft](submissions-admin.md#report-questionable-email-attachments-to-microsoft). For detailed syntax and parameter information, see [New-TenantAllowBlockListItem ## Use the Microsoft 365 Defender portal to create allow entries for files on the Submissions page -You can't create allow entries for files directly in the Tenant Allow/Block List. Instead, you use the Submissions page at <https://security.microsoft.com/reportsubmission> to submit the message attachment as a false positive, which also adds an allow entry on the **Files** tab in the Tenant Allow/Block List. +You can't create allow entries for files directly in the Tenant Allow/Block List. Instead, you use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to submit the message attachment as a false positive, which also adds an allow entry on the **Files** tab in the Tenant Allow/Block List. For instructions, see [Submit good email attachments to Microsoft](submissions-admin.md#report-good-email-attachments-to-microsoft). > [!IMPORTANT] > Microsoft does not allow you to create allow entries directly. Unnecessary allow entries expose your organization to malicious email which could have been filtered by the system. >-> Microsoft manages the creation of allow entries from the Submissions page. Allow entries are added during mail flow based on the filters that determined the message was malicious. For example, if the sender email address and a file in the message were determined to be bad, an allow entry is created for the sender (email address or domain) and the file. +> Microsoft manages the creation of allow entries from the **Submissions** page. Allow entries are added during mail flow based on the filters that determined the message was malicious. For example, if the sender email address and a file in the message were determined to be bad, an allow entry is created for the sender (email address or domain) and the file. > > When that entity is encountered again, all filters associated with that entity are overridden. > |
| security | Tenant Allow Block List Urls Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-allow-block-list-urls-configure.md | You have the following options to create block entries for URLs: ### Use the Microsoft 365 Defender portal to create block entries for URLs on the Submissions page -When you use the Submissions page at <https://security.microsoft.com/reportsubmission> to submit URLs as **Should have been blocked (False negative)**, you can select **Block this URL** to add a block entry on the **URLs** tab in the Tenant Allow/Block List. +When you use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to submit URLs as **Should have been blocked (False negative)**, you can select **Block this URL** to add a block entry on the **URLs** tab in the Tenant Allow/Block List. For instructions, see [Submit questionable URLs to Microsoft](submissions-admin.md#report-questionable-urls-to-microsoft). For detailed syntax and parameter information, see [New-TenantAllowBlockListItem ## Use the Microsoft 365 Defender portal to create allow entries for URLs on the Submissions page -You can't create URL allow entries directly in the Tenant Allow/Block List. Instead, you use the Submissions page at <https://security.microsoft.com/reportsubmission> to submit the URL as a false positive, which also adds an allow entry on the **URLs** tab in the Tenant Allow/Block List. +You can't create URL allow entries directly in the Tenant Allow/Block List. Instead, you use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to submit the URL as a false positive, which also adds an allow entry on the **URLs** tab in the Tenant Allow/Block List. For instructions, see [Submit good URLs to Microsoft](submissions-admin.md#report-good-urls-to-microsoft). > [!IMPORTANT] > Microsoft does not allow you to create allow entries directly. Unnecessary allow entries expose your organization to malicious email which could have been filtered by the system. >-> Microsoft manages the allow entry creation process for URLs from the Submissions page. We'll create allow entries for URLs that were determined to be malicious by our filters during mail flow or at time of click. +> Microsoft manages the allow entry creation process for URLs from the **Submissions** page. We'll create allow entries for URLs that were determined to be malicious by our filters during mail flow or at time of click. >-> We allow subsequent messages that contain variations of the original URL. For example, you use the Submissions page to report the incorrectly blocked URL `www.contoso.com/abc`. If your organization later receives a message that contains the URL (for example but not limited to: `www.contoso.com/abc`, `www.contoso.com/abc?id=1`, `www.contoso.com/abc/def/gty/uyt?id=5`, or `*.contoso.com/abc`), the message won't be blocked based on the URL. In other words, you don't need to report multiple variations of the same URL as good to Microsoft. +> We allow subsequent messages that contain variations of the original URL. For example, you use the **Submissions** page to report the incorrectly blocked URL `www.contoso.com/abc`. If your organization later receives a message that contains the URL (for example but not limited to: `www.contoso.com/abc`, `www.contoso.com/abc?id=1`, `www.contoso.com/abc/def/gty/uyt?id=5`, or `*.contoso.com/abc`), the message won't be blocked based on the URL. In other words, you don't need to report multiple variations of the same URL as good to Microsoft. > > When the URL is encountered again, all filters associated with the URL are overridden. > |
| syntex | Create Local Model | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/create-local-model.md | description: Learn how to create a local model on a local SharePoint site with M # Create a model on a local SharePoint site with Microsoft Syntex -<sup>**Applies to:**   ✓ All custom models   |   ✓ All trained models</sup> +<sup>**Applies to:**   ✓ All custom models   |   ✓ All prebuilt models</sup> Microsoft Syntex provides an option to create and train models locally on your own SharePoint site. These models can be used only on the site where they're created. |
| syntex | Manage Library Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/manage-library-settings.md | + + Title: Manage library settings in Microsoft Syntex ++++ Last updated : 06/01/2023+audience: admin +++search.appverid: ++ - enabler-strategic + - m365initiative-syntex +ms.localizationpriority: medium ++description: Learn how to manage settings on a SharePoint document library with Microsoft Syntex. +++# Manage library settings in Microsoft Syntex ++<sup>**Applies to:**   ✓ All custom models   |   ✓ All prebuilt models</sup> ++In Microsoft Syntex, library settings in a SharePoint document library let you see information about the model and also let you configure specific Syntex settings for the library. ++To access library settings from a SharePoint document library, select **Settings**  > **Library settings**. ++ ++## Automatic classification and extraction ++When you apply a model to a library, Syntex automatically adds the content type and updates the default view with the labels you extracted showing as columns. Then, every time you add or edit a document in the library, Syntex processes the document again, classifying the document and extracting text from it. ++By default, Syntex processes a file every time the file is uploaded or edited. If you want Syntex to process new files only and not every time a file is modified, you can enable the setting. ++### To process new files only ++Follow these steps if you want Syntex to process new files only. ++1. On the **Library settings** panel, under **Automatic classification and extraction**, select **New files only**. ++  ++2. Select **Save**. Syntex will now automatically process new files only. ++ Even with this setting selected, you can still select updated files and manually process them using the **Classify and extract** option in the document library. |
| syntex | Syntex Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-overview.md | description: Learn about the capabilities and features in Microsoft Syntex. # Overview of Microsoft Syntex -Microsoft Syntex is a content understanding, processing, and compliance service that uses intelligent document processing, content artificial intelligence (AI), and advanced machine learning to automatically and thoughtfully find, organize, and classify documents in your SharePoint libraries. +</br> - :::column span=""::: - With Syntex, you can automate your content-based processesΓÇöcapturing the information in your business documents and transforming that information into working knowledge for your organization. +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RW15yuU] - Rather than clicking and sorting through hundreds or thousands of files, Syntex extracts, analyzes, and categorizes the data for you. - :::column-end::: - :::column span=""::: -  - :::column-end::: +</br> ++Microsoft Syntex is a content understanding, processing, and compliance service that uses intelligent document processing, content artificial intelligence (AI), and advanced machine learning to automatically and thoughtfully find, organize, and classify documents in your SharePoint libraries. ++With Syntex, you can automate your content-based processesΓÇöcapturing the information in your business documents and transforming that information into working knowledge for your organization. Rather than clicking and sorting through hundreds or thousands of files, Syntex extracts, analyzes, and categorizes the data for you. You can dive deeper into your content to truly understand it, and you can turn the information into meaningful insights that your organization can use to make informed business decisions. |