-You can easily see how people in your business are using Microsoft 365 services. For example, you can identify who is using a service a lot and reaching quotas, or who may not need a Microsoft 365 license at all. Perpetual license model will not be included in the reports.

-

-

-

-

-

-

-

-

-

-

-|**Report**|**Public**|**GCC**|**GCC-High**|**DoD**|**Office 365 operated by 21Vianet**|

-

-

-

-There are circumstances where new users show up as **unknown**. This is usually due to occasional delays in creating user profiles.

-

-

-

-

-

-2. Select **Reports**.

-

-3. Uncheck the statement **Display concealed user, group, and site names in all reports**, and then save your changes.

-

-It'll take a few minutes for these changes to take effect on the reports in the reports dashboard. This setting also applies to the Microsoft 365 usage reports in [Microsoft Graph](/graph/api/resources/report) and [Power BI](/microsoft-365/admin/usage-analytics/usage-analytics) and [the usage reports in Microsoft Teams Admin center](/microsoftteams/teams-analytics-and-reports/teams-reporting-reference). Showing identifiable user information is a logged event in the Microsoft Purview compliance portal audit log.

-

-

-

-[Reports in the Security & Compliance Center](../../compliance/reports-in-security-and-compliance.md) (article)\

-

-

-You can also export the report data into an Excel .csv file by selecting the **Export** link. This exports data of all users and enables you to do simple sorting and filtering for further analysis. If you have less than 2000 users, you can sort and filter within the table in the report itself. If you have more than 2000 users, in order to filter and sort, you'll need to export the data.

-[Smart reports and insights in the Security & Compliance Center](/microsoft-365/security/office-365-security/reports-and-insights-in-security-and-compliance) (article)\

-description: "Sign in to your Microsoft 365 admin account to set some individual user passwords to never expire by using Windows PowerShell."

-This article is for people who set password expiration policy for a business, school, or nonprofit. To complete these steps, you need to sign in with your Microsoft 365 admin account. See [Overview of the Microsoft 365 admin center](/microsoft-365/admin/admin-overview/admin-center-overview?view=o365-worldwide).

-description: "If you're an admin who manages password policy for a business, school, or nonprofit, you can set strong password requirements by using Windows PowerShell."

-You can set the following additional policy settings by using Security & Compliance Center PowerShell cmdlets. For more information, see [Security & Compliance Center PowerShell](/powershell/exchange/scc-powershell).

-description: "Use Windows PowerShell to get details about Basic Mobility and Security devices in your organization."

-This article shows you how to use Windows PowerShell to get details about the devices in your organization that you set up for Basic Mobility and Security.

-### Step 3: Make sure youΓÇÖre able to run PowerShell scripts

-> You can skip this step if youΓÇÖre already set up to run PowerShell scripts.

-A team in Microsoft Teams or a Microsoft 365 group can become ownerless if an owner's account is deleted or disabled in Microsoft 365. Groups and teams require an owner to add or remove members and change group settings.

-Notifications are sent weekly starting within 24 hours of policy creation.

- - Use Windows PowerShell. See this blog post for instructions: [Create Shared Mailboxes with Same Alias at Different Domains](https://www.cogmotive.com/blog/office-365-tips/create-shared-mailboxes-with-same-alias-at-different-domains-in-office-365)

-

- - Name the second shared mailbox something different from the start to get around the error. Then in the admin center, rename the shared mailbox to what you want it to be.

-[Remove a license from a shared mailbox](remove-license-from-shared-mailbox.md) (article)

-| Sev B (High) | The service is usable but in an impaired fashion. The situation has moderate business impact and can be dealt with during business hours. A single user, customer, or service is partially affected. | <ul><li>Send button in Outlook is garbled.</li><li>Setting is impossible from EAC (Exchange admin center) but possible in Windows PowerShell.</li></ul> |

-1. [Connect to Exchange Online using remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-1. [Connect to Exchange Online using remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-1. [Connect to Exchange Online using remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-ISV app licenses are managed by the app vendor. Contact the vendor to add or remove licenses for your account.

-You can apply your company branding to customize the look of your organization's email messages and the encryption portal. You'll need to apply global administrator permissions to your work or school account before you can get started. Once you have these permissions, use the Get-OMEConfiguration and Set-OMEConfiguration Windows PowerShell cmdlets to customize these parts of encrypted email messages:

-You can modify several features within a branding template. You can modify, but not remove, the default template. If you have Advanced Message Encryption, you can also create, modify, and remove custom templates. Use Windows PowerShell to work with one branding template at a time.

-Use Windows PowerShell to modify one branding template at a time. If you have Advanced Message Encryption, you can also create, modify, and remove custom templates.

-1. Using a work or school account that has global administrator permissions in your organization, start a Windows PowerShell session and connect to Exchange Online. For instructions, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-<br>

-****

-|**To customize this feature of the encryption experience**|**Use these commands**|

-|

-1. Using a work or school account that has global administrator permissions in your organization, start a Windows PowerShell session and connect to Exchange Online. For instructions, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-1. Using a work or school account that has global administrator permissions in your organization, start a Windows PowerShell session and connect to Exchange Online. For instructions, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

- <br>

- ****

- |

-1. Using a work or school account that has global administrator permissions in your organization, start a Windows PowerShell session and connect to Exchange Online. For instructions, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-

-|**Color name**|**Color code**|

-1. An admin in your organization creates, configures, and turns on an alert policy by using the **Alert policies** page in the compliance portal or the Microsoft 365 Defender portal. You can also create alert policies by using the [New-ProtectionAlert](/powershell/module/exchange/new-protectionalert) cmdlet in Security & Compliance Center PowerShell.

-4. An admin manages alerts in the compliance center. Managing alerts consists of assigning an alert status to help track and manage any investigation.

-An alert policy consists of a set of rules and conditions that define the user or admin activity that generates an alert, a list of users who trigger the alert if they perform the activity, and a threshold that defines how many times the activity has to occur before an alert is triggered. You also categorize the policy and assign it a severity level. These two settings help you manage alert policies (and the alerts that are triggered when the policy conditions are matched) because you can filter on these settings when managing policies and viewing alerts in the compliance center. For example, you can view alerts that match the conditions from the same category or view alerts with the same severity level.

-

-> You have to be assigned the View-Only Manage Alerts role to view alert policies in the compliance center or Defender portal. You have to be assigned the Manage Alerts role to create and edit alert policies. For more information, see [Permissions in the security and compliance center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md).

- When an activity occurs that matches the conditions of the alert policy, the alert that's generated is tagged with the category defined in this setting. This allows you to track and manage alerts that have the same category setting on the **Alerts** page in the compliance center because you can sort and filter alerts based on category.

-|**eDiscovery search started or exported**|Generates an alert when someone uses the Content search tool in the Security and compliance center. An alert is triggered when the following content search activities are performed: <br><br> <li> A content search is started <li> The results of a content search are exported <li> A content search report is exported <br><br> Alerts are also triggered when the previous content search activities are performed in association with an eDiscovery case. This policy has a **Informational** severity setting. For more information about content search activities, see [Search for eDiscovery activities in the audit log](search-for-ediscovery-activities-in-the-audit-log.md#ediscovery-activities).|Threat management|No|E1/F1/G1, E3/F3/G3, or E5/G5|

-When an activity performed by users in your organization matches the settings of an alert policy, an alert is generated and displayed on the **Alerts** page in the compliance center or the Defender portal. Depending on the settings of an alert policy, an email notification is also sent to a list of specified users when an alert is triggered. For each alert, the dashboard on the **Alerts** page displays the name of the corresponding alert policy, the severity and category for the alert (defined in the alert policy), and the number of times an activity has occurred that resulted in the alert being generated. This value is based on the threshold setting of the alert policy. The dashboard also shows the status for each alert. For more information about using the status property to manage alerts, see [Managing alerts](#manage-alerts).

-> To view the roles that are assigned to each of the default role groups, run the following commands in Security & Compliance Center PowerShell:

-After alerts have been generated and displayed on the **Alerts** page in the compliance center, you can triage, investigate, and resolve them. The same [RBAC permissions](#rbac-permissions-required-to-view-alerts) that give users access to alerts also give them the ability to manage alerts.

-Alerts that are triggered by Office 365 Cloud App Security policies are now displayed on the **Alerts** page in the compliance center. This includes alerts that are triggered by activity policies and alerts that are triggered by anomaly detection policies in Office 365 Cloud App Security. This means you can view all alerts in the compliance center. Office 365 Cloud App Security is only available for organizations with an Office 365 Enterprise E5 or Office 365 US Government G5 subscription. For more information, see [Overview of Defender for Cloud Apps](/cloud-app-security/what-is-cloud-app-security).

-To display only Defender for Cloud Apps alerts in the compliance center or the Defender portal, use the **Source** filter and select **Defender for Cloud Apps**.

-Similar to an alert triggered by an alert policy in the compliance center, you can select a Defender for Cloud Apps alert to display a flyout page with details about the alert. The alert includes a link to view the details and manage the alert in the Defender for Cloud Apps portal and a link to the corresponding Defender for Cloud Apps policy that triggered the alert. See [Monitor alerts in Defender for Cloud Apps](/cloud-app-security/monitor-alerts).

-> Changing the status of a Defender for Cloud Apps alert in the compliance center won't update the resolution status for the same alert in the Defender for Cloud Apps portal. For example, if you mark the status of the alert as **Resolved** in the compliance center, the status of the alert in the Defender for Cloud Apps portal is unchanged. To resolve or dismiss a Defender for Cloud Apps alert, manage the alert in the Defender for Cloud Apps portal.

-To find the GUID, use the [Get-Label](/powershell/module/exchange/get-label) cmdlet from [Security & Compliance Center PowerShell](/powershell/exchange/scc-powershell):

-````powershell

-````

-1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-You can use [Security & Compliance Center PowerShell](/powershell/exchange/scc-powershell) to create and configure auto-labeling policies. This means you can fully script the creation and maintenance of your auto-labeling policies, which also provides a more efficient method of specifying multiple URLs for OneDrive and SharePoint locations.

-Before you run the commands in PowerShell, you must first [connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-3. On the **Permissions & Roles** page, under **Compliance center**, click **Roles**.

-4. On the **Compliance center roles** page, select **eDiscovery Manager**.

-|Case Management <br/> | <br/> | <br/> | <br/> | <br/> |

-|Communication <br/> | <br/> | <br/> | <br/> | <br/> |

-|Compliance Search <br/> | <br/> | <br/> | <br/> | <br/> |

-|Custodian <br/> | <br/> | <br/> | <br/> | <br/> |

-|Export <br/> | <br/> | <br/> | <br/> | <br/> |

-|Hold <br/> | <br/> | <br/> | <br/> | <br/> |

-|Preview <br/> | <br/> | <br/> | <br/> | <br/> |

-|Review <br/> | <br/> | <br/> | <br/> | <br/> |

-|RMS Decrypt <br/> || <br/> |||

-|Search And Purge <br/> | <br/> | <br/> |<br/> | <br/> |

-||||||

- Also as previously stated, you can't make a mail-enabled security group an eDiscovery Administrator by using the **Add-eDiscoveryCaseAdmin** cmdlet in Security & Compliance Center PowerShell. You can only add individual users as eDiscovery Administrators.

-> If you use the **New-UnifiedAuditLogRetentionPolicy** cmdlet, it's possible to create an audit log retention policy for record types or activities that aren't available in the **Create audit retention policy** tool in the dashboard. In this case, you won't be able to edit the policy (for example, change the retention duration or add and remove activities) from the **Audit retention policies** dashboard. You'll only be able to view and delete the policy in the compliance center. To edit the policy, you'll have to use the [Set-UnifiedAuditLogRetentionPolicy](/powershell/module/exchange/set-unifiedauditlogretentionpolicy) cmdlet in Security & Compliance Center PowerShell.>

-You can also use Security & Compliance Center PowerShell to create and manage audit log retention policies. One reason to use PowerShell is to create a policy for a record type or activity that isn't available in the UI.

-1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-Use the [Get-UnifiedAuditLogRetentionPolicy](/powershell/module/exchange/get-unifiedauditlogretentionpolicy) cmdlet in Security & Compliance Center PowerShell to view audit log retention policies.

-Use the [Set-UnifiedAuditLogRetentionPolicy](/powershell/module/exchange/set-unifiedauditlogretentionpolicy) cmdlet in Security & Compliance Center PowerShell to edit an existing audit log retention policy.

-Use the [Remove-UnifiedAuditLogRetentionPolicy](/powershell/module/exchange/remove-unifiedauditlogretentionpolicy) cmdlet in Security & Compliance Center PowerShell to delete an audit log retention policy. It might take up to 30 minutes for the policy to be removed from your organization.

-First, [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-1. In your Security & Compliance Center PowerShell session, enter the path, followed by the characters `.\` and the file name of the script, and then press ENTER to run the script. For example:

-As we mentioned before, many different types of holds can trigger the creation of an inactive mailbox. For this reason, in order to change the hold duration applied to the inactive mailbox, you must first identify what type of holds are affecting it. To do this, you must use Exchange Online PowerShell to identify the types of holds and, if the inactive mailbox is affected by Microsoft 365 retention policies or labels you must also use Security and Compliance Center PowerShell to identify the specific policies.

- - [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell)

-In order to modify the hold duration for a Microsoft 365 retention policy, you must first identify the policy affecting the inactive mailbox by running `Get-RetentionCompliancePolicy` with the associated GUID from the `InPlaceHolds` property on the mailbox in Security and Compliance Center PowerShell.

-As with retention policies, when modifying the hold duration of a Microsoft 365 retention label, you must first identify the policy which publishes the label affecting the content within the inactive mailbox by running `Get-RetentionCompliancePolicy` with the associated GUID from the `InPlaceHolds` property on the mailbox in Security and Compliance Center PowerShell.

-description: "Use the PowerShell script in this article to quickly clone an existing Content Search in the compliance center in Office 365 or Microsoft 365."

-Creating a Content Search in the compliance center in Office 365 or Microsoft 365 that searches many mailboxes or SharePoint and OneDrive for Business sites can take a while. Specifying the sites to search can also be prone to errors if you mistype a URL. To avoid these issues, you can use the Windows PowerShell script in this article to quickly clone an existing Content Search. When you clone a search, a new search (with a different name) is created that contains the same properties (such as the content locations and the search query) as the original search. Then you can edit the new search by changing the keyword query or the date range, and run it.

-

-

-

-

-

-

-

-

-

-

-

-

-

-

-

-

- ```powershell

- # This PowerShell script clones an existing content search in the Security &amp; Compliance Center.

- # Get login credentials from the user

- if(!$UserCredential)

- {

- $UserCredential = Get-Credential

- $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid -Credential $UserCredential -Authentication Basic -AllowRedirection

- if (!$Session)

- {

- Write-Error "Couldn't create a remote PowerShell session."

- return

- }

- Import-PSSession $Session -AllowClobber -DisableNameChecking

- $Host.UI.RawUI.WindowTitle = $UserCredential.UserName + " (Security & Compliance Center)"

- }

- # Ask for the name of the search you want to clone

- $searchName = Read-Host 'Enter the name of the search that you want to clone'

- # Ask for the name of the new search

- $newSearchName = Read-Host 'Enter a name for the new search [leave blank to automatically generate a name]'

- $originalSearch = Get-ComplianceSearch $searchName -EA SilentlyContinue

- # Make sure we have a valid search before continuing

- if(!$originalSearch)

- {

- Write-Error "Couldn't find search: $searchName"

- return

- }

- $searchNameCounter = 1

- # Find a suitable name for the new search

- while(!$newSearchName)

- {

- $newSearchName = $originalSearch.Name + "_" + $searchNameCounter

- $tempSearch = Get-ComplianceSearch $newSearchName -EA SilentlyContinue

- if ($tempSearch)

- {

- $newSearchName = $null

- $searchNameCounter++

- }

- }

- $caseName

- # Determine if the search is part of a case; if so get the case name

- if ($originalSearch.CaseId)

- {

- $searchCase = Get-ComplianceCase $originalSearch.CaseId

- $caseName = $searchCase.Name

- }

- # Need to cast this value as a Boolean the old fashion way

- $allowNotFoundExchangeLocationsEnabled = $false

- if ($originalSearch.AllowNotFoundExchangeLocationsEnabled)

- {

- $allowNotFoundExchangeLocationsEnabled = $true

- }

- $newSearch = New-ComplianceSearch -Name $newSearchName -AllowNotFoundExchangeLocationsEnabled $allowNotFoundExchangeLocationsEnabled -Case $caseName -ContentMatchQuery $originalSearch.ContentMatchQuery -Description $originalSearch.Description -ExchangeLocation $originalSearch.ExchangeLocation -ExchangeLocationExclusion $originalSearch.ExchangeLocationExclusion -Language $originalSearch.Language -SharePointLocation $originalSearch.SharePointLocation -SharePointLocationExclusion $originalSearch.SharePointLocationExclusion -PublicFolderLocation $originalSearch.PublicFolderLocation

- if ($newSearch)

- {

- Write-Host $newSearch.Name "was successfully created" -ForegroundColor Yellow

- }

- ```

-2. Open Windows PowerShell and go to the folder where you saved the script.

-

-

- ```powershell

- .\CloneSearch.ps1

- ```

-4. When prompted for your credentials, enter your email address and password, and then click **OK**.

-

-5. Enter following information when prompted by the script. Type each piece of information and then press **Enter**.

-

- - The name of the existing search.

-

- - The name of the new search.

-

- The script creates the new Content Search, but doesn't start it. This gives you a chance to edit and run the search in the next step. You can view the properties of the new search by running the **Get-ComplianceSearch** cmdlet or by going to the **Content search** or **eDiscovery** page in the compliance center, depending on whether the new search is associated with a case.

-

-## Step 2: Edit and run the cloned search in the compliance center

-After you run the script to clone an existing Content Search, the next step is to go to the compliance center to edit and run the new search. As previously stated, you can edit a search by changing the keyword search query and adding or removing search conditions. For more information, see:

-

-

-

-1. Create and manage audit log retention policies on PowerShell - You can also use Security & Compliance Center PowerShell to [create and manage audit log retention policies](audit-log-retention-policies.md#create-and-manage-audit-log-retention-policies-in-powershell). One reason to use PowerShell is to create a policy for a record type or activity that isn't available in the UI.

-1. Manage eDiscovery (Premium) ΓÇô [learn how to configure eDiscovery (Premium), manage cases by using the Security & Compliance Center, manage a workflow in eDiscovery (Premium), and analyze eDiscovery (Premium) search results](/learn/modules/manage-advanced-ediscovery).

-The Microsoft Compliance Configuration Analyzer (MCCA) is a preview tool that can help you get started with [Microsoft Purview Compliance Manager](compliance-manager.md). MCCA is a PowerShell-based utility that will fetch your organizationΓÇÖs current configurations and validate them against Microsoft 365 recommended best practices. These best practices are based on a set of controls that include key regulations and standards for data protection and data governance.

-An additional resource for understanding MCCA is by visiting the [README instructions on GitHub](https://github.com/OfficeDev/MCCA#overview). This page provides detailed information about prerequisites and gives full installation instructions. You donΓÇÖt need a GitHub account to access this page.

-You can install the MCCA tool using Windows PowerShell. Once you download and install the tool, you donΓÇÖt need to repeat those steps in order to run reports. Each time you open MCCA, it will ask you for your login credentials, and it will generate a new, updated report.

-### Step 1: Install Windows PowerShell

-To begin, you'll need the Exchange Online PowerShell module (v2.0.3 or higher) that's available in the PowerShell gallery. [Get installation instructions](https://www.powershellgallery.com/packages/ExchangeOnlineManagement/2.0.3).

-Your report will then take approximately 2-5 minutes to generate. When itΓÇÖs done, a browser window opens and displays your HTML report. Every time you run the tool, it will ask for your credentials and generate a new report. This report is stored locally in the directory C: \ Users \ *username* \ AppData \ Local \ Microsoft \ MCCA.

-#### Geolocation-based reporting

-2. To specify a certain region, youΓÇÖll run a cmdlet using the numbers from the table below that correspond to the country or region. Enter multiple numbers by separating them with a comma. For example, the cmdlet below will run a customized report for Asia-Pacific and Japan:

- | Input | Country or Region |

- > [!NOTE]

-> The report will always include MCCA supported international sensitive information types such as SWIFT code, credit card number, etc.

-#### Role-based reporting

-#### Solutions Summary section

-

-**Items with the Improvement status**

-Select the dropdown next to the **Improvement** label to the right of the improvement action. YouΓÇÖll see a quick summary and details about your current settings and the recommended improvement actions. The summary includes direct links into Compliance Manager, the applicable solution in the Microsoft Purview compliance portal, and relevant documentation.

-For DLP, thereΓÇÖs a **Remediation Script** button that gives you a pre-generated PowerShell script based on whatΓÇÖs recommended. You can copy and paste it directly in your PowerShell console. It will create a DLP policy in test mode

-**Items with Recommendation status**

-Select the dropdown next to the **Recommendation** label to the right of the improvement action. YouΓÇÖll see a summary of your organizationΓÇÖs current Microsoft 365 environment related to the improvement action, along with recommended best practices.

-To import the TPD, run the following command in Windows PowerShell:

-Previously, you might have used Exchange Online PowerShell to import your custom sensitive information types for DLP. Now your custom sensitive information types can be used in both the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a> and the Compliance center. As part of this improvement, you should use Compliance center PowerShell to import your custom sensitive information types ΓÇö you can't import them from the Exchange PowerShell anymore. Your custom sensitive information types will continue to work just like before; however, it may take up to one hour for changes made to custom sensitive information types in the Compliance center to appear in the Exchange admin center.

-2. [Connect to Compliance center PowerShell](/powershell/exchange/exchange-online-powershell)

-There is a limit of 50 keyword dictionary based sensitive information types that can be created per tenant. To find out how many keyword dictionaries you have in your tenant, connect using the procedures in [Connect to the Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) to connect to your tenant and run this PowerShell script.

-Often when you need to create a large dictionary, it's to use keywords from a file or a list exported from some other source. In this case, you'll create a keyword dictionary containing a list of inappropriate language to screen in external email. You must first [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-## Step 1: Connect to Security & Compliance Center PowerShell

-The first step is to connect to Security & Compliance Center PowerShell for your organization. For step-by-step instructions, see [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-After you've connected to Security & Compliance Center PowerShell, the next step is to create and run the script that collects information about the eDiscovery cases in your organization.

-1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-description: "Learn how to automate Content Search tasks like creating searches and running reports using Security & Compliance Center PowerShell."

- Quickly creating and reporting discovery searches is often an important step in eDiscovery and investigations when you're trying to learn about the underlying data, and the richness and quality of your searches. To help you do this, Security & Compliance Center PowerShell offers a set of cmdlets to automate time-consuming Content Search tasks. These scripts provide a quick and easy way to create a number of searches, and then run reports of the estimated search results that can help you determine the quantity of data in question. You can also use the scripts to create different versions of searches to compare the results each one produces. These scripts can help you to quickly and efficiently identify and cull your data.

-## Step 2: Connect to Security & Compliance Center PowerShell

-The next step is to connect to Security & Compliance Center PowerShell for your organization. For step-by-step instructions, see [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-### Additional label settings with Security & Compliance Center PowerShell

-Additional label settings are available with the [Set-Label](/powershell/module/exchange/set-label) cmdlet from [Security & Compliance Center PowerShell](/powershell/exchange/scc-powershell).

-Before you run the commands in PowerShell, you must first [connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-### Additional label policy settings with Security & Compliance Center PowerShell

-Additional label policy settings are available with the [Set-LabelPolicy](/powershell/module/exchange/set-labelpolicy) cmdlet from [Security & Compliance Center PowerShell](/powershell/exchange/scc-powershell).

-You can now use [Security & Compliance Center PowerShell](/powershell/exchange/scc-powershell) to create and configure all the settings you see in your labeling admin center. This means that in addition to using PowerShell for settings that aren't available in the labeling admin centers, you can now fully script the creation and maintenance of sensitivity labels and sensitivity label policies.

-If you're waiting to see when the policy will take effect, [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) and run the [Get-DlpCompliancePolicy cmdlet](/powershell/module/exchange/get-dlpcompliancepolicy) to see the DistributionStatus.

-1. On your local computer, using a work or school account that has global administrator or compliance admin permissions in your organization, [connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) in a Windows PowerShell window.

-

-1. On your local computer, using a work or school account that has global administrator or compliance admin permissions in your organization, [connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) in a Windows PowerShell window.

-Before you begin, ensure that you've completed the tasks required to set up Azure Key Vault. For information, see [Set up Customer Key](customer-key-set-up.md). You'll complete these steps by remotely connecting to Exchange Online with Windows PowerShell.

-

-1. On your local computer, using a work or school account that has global administrator or Exchange Online admin permissions in your organization, [connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) in a Windows PowerShell window.

-

-

-

-To set up Customer Key for SharePoint Online, OneDrive for Business, and Teams files you complete these steps by remotely connecting to SharePoint Online with Windows PowerShell.

-

-

-

-To create a DEP, you need to remotely connect to SharePoint Online by using Windows PowerShell.

-

-1. On your local computer, using a work or school account that has global administrator permissions in your organization, [Connect to SharePoint Online PowerShell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online?preserve-view=true&view=sharepoint-ps).

-

-

-

-

-

-

-

-1. On your local computer, using a work or school account that has global administrator or compliance admin permissions in your organization, [connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) in a Windows PowerShell window.

- Get-M365DataAtRestEncryptionPolicy

- Get-M365DataAtRestEncryptionPolicy -Identity "Contoso_Global"

-To find out which DEP is currently assigned to your tenant, follow these steps.

-1. On your local computer, using a work or school account that has global administrator or compliance admin permissions in your organization, [connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) in a Windows PowerShell window.

- Get-M365DataAtRestEncryptionPolicyAssignment

-1. On your local computer, using a work or school account that has global administrator or compliance admin permissions in your organization, [connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) in a Windows PowerShell window.

-

-

-

-

-

- Set-Mailbox -Identity <mailbox> -DataEncryptionPolicy $NULL

-> Roll back from Customer Key to Microsoft managed keys isn't supported for SharePoint Online, OneDrive for Business, and Teams files.

-Purging of SharePoint, OneDrive for work or school, and Teams files DEPs is not supported in Customer Key. These multi-workload DEPs are used to encrypt data across multiple workloads across all tenant users. Purging such a DEP would result in data from across multiple workloads becoming inaccessible. If you decide to exit Microsoft 365 services altogether, you could pursue the path of tenant deletion per the documented process. See how to [delete a tenant in Azure Active Directory](/azure/active-directory/enterprise-users/directory-delete-howto).

-To export the XML, you need to [connect to the Security and Compliance Center via Remote PowerShell.](/powershell/exchange/connect-to-scc-powershell).

-2. Store your organization's rules in a variable by typing the following. Storing something in a variable makes it easily available later in a format that works for remote PowerShell commands.

-First, you need to create a new sensitive information type because you can't directly modify the default rules. You can do a wide variety of things with custom sensitive information types, which are outlined in [Create a custom sensitive information type in Security & Compliance Center PowerShell](create-a-custom-sensitive-information-type-in-scc-powershell.md). For this example, we'll keep it simple and only remove corroborative evidence and add keywords to the Credit Card Number rule.

-2. [Connect to the Security and Compliance Center via Remote PowerShell.](/powershell/exchange/connect-to-scc-powershell)

-1. [Connect to the Office 365 Microsoft Purview compliance portal using remote PowerShell](/powershell/exchange/connect-to-scc-powershell).

-1. [Connect to Exchange Online using remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-1. [Connect to the Office 365 Security & Compliance Center PowerShell](/powershell/exchange/office-365-scc/connect-to-scc-powershell/connect-to-scc-powershell).

-Use [Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) to remove an inactive mailbox from an explicit retention policy:

-Run the following command in [Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) to identify the retention policy that is applied to the mailbox. This command will also return any Teams conversation retention policies applied to a mailbox. Use the GUID (not including the `mbx` or `skp` prefix) for the retention policy that you identified in Step 1.

-Organization-wide, Exchange-wide, and Teams-wide retention policies are applied to every mailbox in the organization. They are applied at the organization level (not the mailbox level) and are returned when you run the **Get-OrganizationConfig** cmdlet in Step 1. Run the following command in [Security & Compliance Center PowerShell](/powershell/exchange/exchange-online-powershell) to identify the organization-wide retention policies. Use the GUID (not including the `mbx` prefix) for the organization-wide retention policies that you identified in Step 1.

-Run the following commands in [Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) to identify the hold associated with an eDiscovery case (called *eDiscovery holds*) that's applied to the mailbox. Use the GUID (not including the `UniH` prefix) for the eDiscovery hold that you identified in Step 1. The second command displays the name of the eDiscovery case the hold is associated with; the third command displays the name of the hold.

-Now you're ready to actually delete items in the Recoverable Items folder by using the [New-ComplianceSearch](/powershell/module/exchange/new-compliancesearch) and [New-ComplianceSearchAction](/powershell/module/exchange/new-compliancesearchaction) cmdlets in Security & Compliance Center PowerShell.

-3. Use the **New-ComplianceSearch** cmdlet (in Security & Compliance Center PowerShell) or use the Content search tool in the compliance center to create a content search that returns items from the target user's Recoverable Items folder. You can do this by including the FolderId in the search query for all subfolders that you want to search. For example, the following query returns all messages in the Deletions and eDiscoveryHolds subfolders:

-4. After you've created a content search and validated that it returns the items that you wan to delete, use the `New-ComplianceSearchAction -Purge -PurgeType HardDelete` command (in Security & Compliance Center PowerShell) to permanently delete the items returned by the content search that you created in the previous step. For example, you can run a command similar to the following command:

-| Retention policies in the compliance portal applied to specific mailboxes <br/> | `mbxcdbbb86ce60342489bff371876e7f224` <br/> or <br/> `skp127d7cf1076947929bf136b7a2a8c36f` <br/> |When you run the **Get-Mailbox** cmdlet, the *InPlaceHolds* property also contains GUIDs of retention policies applied to the mailbox. You can identify retention policies because the GUID starts with the `mbx` prefix. If the GUID of the retention policy starts with the `skp` prefix, that indicates that the retention policy is applied to Skype for Business conversations. <br/> To identity the retention policy that's applied to the mailbox, run the following command in Security & Compliance Center PowerShell: <br/> <br/>`Get-RetentionCompliancePolicy <retention policy GUID without prefix> | FL Name`<br/><br/>Be sure to remove the `mbx` or `skp` prefix when you run this command. <br/> |

-|Organization-wide retention policies in the compliance portal <br/> |No value <br/> or <br/> `-mbxe9b52bf7ab3b46a286308ecb29624696` (indicates that the mailbox is excluded from an organization-wide policy) <br/> |Even if the *InPlaceHolds* property is empty when you run the **Get-Mailbox** cmdlet, there still might be one or more organization-wide retention policies applied to the mailbox. <br/> To verify this, you can run the `Get-OrganizationConfig | FL InPlaceHolds` command in Exchange Online PowerShell to get a list of the GUIDs for organization-wide retention policies. The GUID for organization-wide retention policies applied to Exchange mailboxes starts with the `mbx` prefix; for example, `mbxa3056bb15562480fadb46ce523ff7b02`. <br/> To identity the organization-wide retention policy that's applied to the mailbox, run the following command in Security & Compliance Center PowerShell: <br/><br/> `Get-RetentionCompliancePolicy <retention policy GUID without prefix> | FL Name`<br/><br/>If a mailbox is excluded from an organization-wide retention policy, the GUID for the retention policy is displayed in the *InPlaceHolds* property of the user's mailbox when you run the **Get-Mailbox** cmdlet; it's identified by the prefix `-mbx`; for example, `-mbxe9b52bf7ab3b46a286308ecb29624696` <br/> |

-|eDiscovery case hold in the compliance portal <br/> | `UniH7d895d48-7e23-4a8d-8346-533c3beac15d` <br/> |The *InPlaceHolds* property also contains the GUID of any hold associated with an eDiscovery case in the compliance portal that might be placed on the mailbox. You can tell this is an eDiscovery case hold because the GUID starts with the `UniH` prefix. <br/> You can use the `Get-CaseHoldPolicy` cmdlet in Security & Compliance Center PowerShell to get information about the eDiscovery case that the hold on the mailbox is associated with. For example, you can run the command `Get-CaseHoldPolicy <hold GUID without prefix> | FL Name` to display the name of the case hold that's on the mailbox. Be sure to remove the `UniH` prefix when you run this command. <br/><br/> To identity the eDiscovery case that the hold on the mailbox is associated with, run the following commands:<br/><br/>`$CaseHold = Get-CaseHoldPolicy <hold GUID without prefix>`<br/><br/>`Get-ComplianceCase $CaseHold.CaseId | FL Name`

-Currently, you can create a document fingerprint only in [Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-Collecting diagnostic information for eDiscovery (Standard) is cmdlet-based, so you'll have to use Security & Compliance Center PowerShell. The following PowerShell examples will run cmdlets and then save the output to a specified text file. In most support cases, you should only have to run one of these commands.

-To run the following cmdlets, [connect to Security & Compliance Center PowerShell</span>](/powershell/exchange/connect-to-scc-powershell). After you're connected, run one or more of the following commands and be sure to replace placeholders with the actual object names.

-Run the following commands in Security & Compliance Center PowerShell to identify an eDiscovery hold that's applied to the mailbox. Use the GUID (not including the UniH prefix) for the eDiscovery hold that you identified in Step 1.

-To connect to Security & Compliance Center PowerShell, see [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-[Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) and run the following command to identity the Microsoft 365 retention policy (organization-wide or specific location) that's applied to the mailbox. Use the GUID (not including the mbx, skp, or grp prefix or the action suffix) that you identified in Step 1.

-1. [Connect to Exchange Online using remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell)

->To perform the tasks described in this article, you must be assigned an appropriate role, such as one of the following:<br>- Microsoft 365 Enterprise Global Administrator<br>- Global Administrator<br>- Compliance Administrator<br>- IB Compliance Management (this is a new role!)<br><br>To learn more about prerequisites for information barriers, see [Prerequisites (for information barriers policies)](information-barriers-policies.md#step-1-make-sure-prerequisites-are-met).<br><br> Make sure to [connect to the Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

- write-host " Security & Compliance Center PowerShell " -foregroundColor yellow -backgroundcolor darkgreen

-2. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/exchange-online-powershell).

-3. In Security & Compliance Center PowerShell, go to the folder where you saved the script in step 1, and then run the script; for example:

-This article describes the email and document properties that you can search for in email items and Microsoft Teams chat conversations in Exchange Online, and documents stored on SharePoint and OneDrive for Business sites using the eDiscovery search tools in the Microsoft Purview compliance portal. This includes Content search, Microsoft Purview eDiscovery (Standard), and Microsoft Purview eDiscovery (Premium) (eDiscovery searches in eDiscovery (Premium) are called *collections*). You can also use the **\*-ComplianceSearch** cmdlets in Security & Compliance Center PowerShell to search for these properties. The article also describes:

-> eDiscovery searches in the compliance portal and the corresponding **\*-ComplianceSearch** cmdlets in Security & Compliance Center PowerShell use the Keyword Query Language (KQL). For more detailed information, see [Keyword Query Language syntax reference](/sharepoint/dev/general-development/keyword-query-language-kql-syntax-reference).

-To see a list of the sensitive information types that you can search for, go to **Data classifications** \> **Sensitive info types** in the compliance portal. Or you can use the **Get-DlpSensitiveInformationType** cmdlet in Security & Compliance Center PowerShell to display a list of sensitive information types.

- To display the name and ID for the custom sensitive data types in your organization, run the following command in Security & Compliance Center PowerShell:

-Because these capabilities are now available in the [<span class="underline">compliance portal</span>](./microsoft-365-compliance-center.md) and Office 365 Security & Compliance Center PowerShell with improved performance and scalability, you should using these improved cmdlets. These cmdlets include [<span class="underline">\*-ComplianceCase</span>](/powershell/module/exchange/get-compliancecase), [<span class="underline">\*-ComplianceSearch</span>](/powershell/module/exchange/get-compliancesearch), [<span class="underline">\*-CaseHoldPolicy</span>](/powershell/module/exchange/get-caseholdpolicy), [<span class="underline">\*-CaseHoldRule</span>](/powershell/module/exchange/get-caseholdrule), and [<span class="underline">\*-ComplianceSearchAction</span>](/powershell/module/exchange/get-compliancesearchaction).

-The **Search-Mailbox** cmdlet in Exchange Online PowerShell is being retired as originally announced in a warning in the cmdlet output starting back in 2018. The **Search-Mailbox** cmdlet was originally used to search a user's mailbox and purge malicious content. We recommend that you start using the **New-ComplianceSearch** and **New-ComplianceSearchAction** cmdlets in Office 365 Security & Compliance Center PowerShell to search for and purge content. For a built-in security experience, the [<span class="underline">Microsoft 365 security features</span>](../security/index.yml) provide robust threat protection for email and many other Microsoft services.

-When your email users send encrypted messages, recipients of those messages can respond with encrypted replies. You can create mail flow rules to automatically remove encryption from replies so email users in your organization don't have to sign in to the encryption portal to view them. You can use the EAC or Windows PowerShell cmdlets to define these rules. You can decrypt messages that are sent from within your organization or messages that are replies to messages sent from within your organization. You cannot decrypt encrypted messages originating from outside of your organization.

-3. In the >Microsoft 365 admin center, choose **Admin centers** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">**Exchange**</a>.

-As an Exchange Online and Exchange Online Protection administrator, you can customize your encrypted messages. For example, you can add your company's brand and logo, specify an introduction, and add disclaimer text in encrypted messages and in the portal where recipients view your encrypted messages. Using Windows PowerShell cmdlets, you can customize the following aspects of the viewing experience for recipients of encrypted email messages:

-1. Connect to Exchange Online using Remote PowerShell, as described in [Connect to Exchange Online Using Remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

- |To customize this feature of the encryption experience|Use these Windows PowerShell commands|

-1. Connect to Exchange Online using Remote PowerShell, as described in [Connect to Exchange Online Using Remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

- |To revert this feature of the encryption experience back to the default text and image|Use these Windows PowerShell commands|

-Yes. You can use Windows PowerShell cmdlets to customize the default text that appears at the top of encrypted email messages, the disclaimer text, and the logo that you want to use for the email message and the encryption portal. This feature is now available in OMEv2. For details, see [Add branding to encrypted messages](add-your-organization-brand-to-encrypted-messages.md).

-|The maximum number of searches that a single user can start at the same time. This limit is most likely hit when the user tries to start multiple searches by using the **Get-ComplianceSearch \|Start-ComplianceSearch** command in Security & Compliance Center PowerShell.|10|

-Like the previous section that listed scripts for content search scenarios, we've also created some Security & Compliance Center PowerShell scripts to help you manage eDiscovery cases.

-

-

-1. [Connect to Exchange Online Using Remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-

-

-1. Use a work or school account that has global administrator permissions in your organization and start a Windows PowerShell session and connect to Exchange Online. For instructions, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-

-

-1. Use a work or school account that has global administrator permissions in your organization and start a Windows PowerShell session and connect to Exchange Online. For instructions, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-

-

-

-

-1. Use a work or school account that has global administrator permissions in your organization and start a Windows PowerShell session and connect to Exchange Online. For instructions, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-

-

-

-

-

-

-1. Use a work or school account that has global administrator permissions in your organization and start a Windows PowerShell session and connect to Exchange Online. For instructions, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-1. Use a work or school account that has global administrator permissions in your organization and start a Windows PowerShell session and connect to Exchange Online. For instructions, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-

-

-

-1. Using a work or school account that has global administrator permissions in your organization, start a Windows PowerShell session and connect to Exchange Online. For instructions, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-description:

-## Step 1: Connect to Exchange Online PowerShell and Security & Compliance Center PowerShell

-The first step is to connect to Exchange Online PowerShell and Security & Compliance Center PowerShell. You can copy the following script, paste it into a PowerShell window and then run it. You'll be prompted for credentials for the organization that you want to connect to.

-$UserCredential = Get-Credential

-$sccSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid -Credential $UserCredential -Authentication Basic -AllowRedirection

-Import-PSSession $sccSession -DisableNameChecking

-$exoSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection

-Import-PSSession $exoSession -AllowClobber -DisableNameChecking

-You need to run the commands in the following steps in this PowerShell session.

-After you've authenticated, you can get a list of In-Place eDiscovery searches by running the **Get-MailboxSearch** cmdlet. Copy and paste the following command into PowerShell and then run it. A list of searches will be listed with their names and the status of any In-Place Holds.

-$search | FL

-> The duration of the In-Place Hold in this example is indefinite (*ItemHoldPeriod: Unlimited*). This is typical for eDiscovery and legal investigation scenarios. If the hold duration has is different value than indefinite, the reason is likely because the hold is being used to retain content in a retention scenario. Instead of using the eDiscovery cmdlets in Security & Compliance Center PowerShell for retention scenarios, we recommend that you use [New-RetentionCompliancePolicy](/powershell/module/exchange/new-retentioncompliancepolicy) and [New-RetentionComplianceRule](/powershell/module/exchange/new-retentioncompliancerule) to retain content. The result of using these cmdlets will be similar to using **New-CaseHoldPolicy** and **New-CaseHoldRule**, but you'll able to specify a retention period and a retention action, such as deleting content after the retention period expires. Also, using the retention cmdlets don't require you to associate the retention holds with an eDiscovery case.

-

-

-

-

-You can use message expiration on emails that your users send to external recipients who use the OME Portal to access encrypted emails. You force recipients to use the OME portal to view and reply to encrypted emails sent by your organization by using a custom branded template that specifies an expiration date in Windows PowerShell.

-Use a work or school account that has global administrator permissions in your organization, start a Windows PowerShell session and connect to Exchange Online. For instructions, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). Use the Set-IRMConfiguration and New-TransportRule cmdlets to create the policy.

-## Connect to Exchange Online and Security & Compliance Center PowerShell in a single session

-How do you know if this worked? After you run the script, cmdlets from Exchange Online and Security & Compliance PowerShell are imported to your local Windows PowerShell session. If you don't receive any errors, you connected successfully. A quick test is to run Exchange Online and Security & Compliance Center PowerShell cmdlets. For example, you can run and **Get-Mailbox** and **Get-ComplianceSearch**.

-### Create the DLP policy by using PowerShell

-The condition **Document properties contain any of these values** is temporarily not available in the UI of the Security &amp; Compliance Center, but you can still use this condition by using PowerShell. You can use the `New\Set\Get-DlpCompliancePolicy` cmdlets to work with a DLP policy, and use the `New\Set\Get-DlpComplianceRule` cmdlets with the `ContentPropertyContainsWords` parameter to add the condition **Document properties contain any of these values**.

-For more information on these cmdlets, see [Security &amp; Compliance Center cmdlets](/powershell/exchange/exchange-online-powershell).

-1. [Connect to the Security &amp; Compliance Center using remote PowerShell](/powershell/exchange/connect-to-scc-powershell)

-2. Create the policy by using `New-DlpCompliancePolicy`.

-This PowerShell creates a DLP policy that applies to all locations.

-3. Create the two rules described above by using `New-DlpComplianceRule`, where one rule is for the **Low** value, and another rule is for the **High** and **Moderate** values.

- Here is a PowerShell example that creates these two rules. The property name/value pairs are enclosed in quotation marks, and a property name may specify multiple values separated by commas with no spaces, like `"<Property1>:<Value1>,<Value2>","<Property2>:<Value3>,<Value4>"....`

-1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-To use the retention cmdlets, you must first [connect to Office 365 Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell). Then, use any of the following cmdlets:

-If a Microsoft Teams-enabled user has an on-premises mailbox and their user account/identity has been synched to the cloud, Microsoft creates cloud-based storage to associate the on-premises user's 1xN Teams chat data with. Teams chat data for on-premises users is indexed for search. This lets you Use Content search (and searches associated with Microsoft Purview eDiscovery (Standard) and Microsoft Purview eDiscovery (Premium) cases) to search, preview, and export Teams chat data for on-premises users. You can also use **\*ComplianceSearch** cmdlets in Security & Compliance Center PowerShell to search for Teams chat data for on-premises users.

-You can use the **New-ComplianceSearch** cmdlets in Security & Compliance Center PowerShell to search for Teams chat data for on-premises users. As previously explained, you don't have to submit a support request to use PowerShell to search for Teams chat data for on-premises users.

-1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-## Step 1: Connect to Security & Compliance Center PowerShell

-The first step is to connect to Security & Compliance Center PowerShell for your organization. For step-by-step instructions, see [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-To run the following commands to delete messages, be sure that you're [connected to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-Sometimes you have to perform more advanced, complex, and repetitive content search tasks. In these cases, it's easier and faster to use commands in Security & Compliance Center PowerShell. To help make this easier, we've created a number of Security & Compliance Center PowerShell scripts to help you complete complex content search-related tasks.

-The following table lists the cmdlet audit log records that are logged when an administrator or user performs an eDiscovery-related activity by using the compliance center or by running the corresponding cmdlet in Security & Compliance Center PowerShell. The detailed information in the audit log record is different for the cmdlet activities listed in this table and the eDiscovery activities described in the previous section.

-|Allowed computer to sync files|ManagedSyncClientAllowed|User successfully establishes a sync relationship with a site. The sync relationship is successful because the user's computer is a member of a domain that's been added to the list of domains (called the *safe recipients list*) that can access document libraries in your organization. <br/><br/> For more information about this feature, see [Use Windows PowerShell cmdlets to enable OneDrive sync for domains that are on the safe recipients list](/powershell/module/sharepoint-online/).|

-|Blocked computer from syncing files|UnmanagedSyncClientBlocked|User tries to establish a sync relationship with a site from a computer that isn't a member of your organization's domain or is a member of a domain that hasn't been added to the list of domains (called the *safe recipients list)* that can access document libraries in your organization. The sync relationship is not allowed, and the user's computer is blocked from syncing, downloading, or uploading files on a document library. <br/><br/> For information about this feature, see [Use Windows PowerShell cmdlets to enable OneDrive sync for domains that are on the safe recipients list](/powershell/module/sharepoint-online/).|

- You can also search for mailbox activities by using the [Search-MailboxAuditLog](/powershell/module/exchange/search-mailboxauditlog) cmdlet in Exchange Online PowerShell.

-Security & Compliance Center PowerShell provides a number of cmdlets that let you automate time-consuming eDiscovery-related tasks. Currently, creating a Content search in the Microsoft Purview compliance portal to search a large number of custodian content locations takes time and preparation. Before you create a search, you have to collect the URL for each OneDrive for Business site and then add each mailbox and OneDrive for Business site to the search. In future releases, this will be easier to do in the compliance portal. Until then, you can use the script in this article to automate this process. This script prompts you for the name of your organization's MySite domain (for example, **contoso** in the URL `https://contoso-my.sharepoint.com`), a list of user email addresses, the name of the new Content Search, and the search query to use. The script gets the OneDrive for Business URL for each user in the list, and then it creates and starts a Content Search that searches the mailbox and OneDrive for Business site for each user in the list, using the search query that you provide.

-

-

-Go to [Set up the SharePoint Online Management Shell Windows PowerShell environment](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online) and perform Step 1 and Step 2 to install the SharePoint Online Management Shell.

-

-The script in Step 3 will create a Content Search to search the mailboxes and OneDrive accounts for a list of users. You can just type the email addresses in a text file, or you can run a command in Windows PowerShell to get a list of email addresses and save them to a file (located in same folder that you'll save the script to in Step 3).

-

-Here's an [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) command that you can runt to get a list of email addresses for all users in your organization and save it to a text file named `Users.txt`.

-

-

-

-

-

-

-

-

-

- ```powershell

- # This PowerShell script will prompt you for the following information:

- # * Your user credentials

- # * The name of your organization's MySite domain

- # * The pathname for the text file that contains a list of user email addresses

- # * The name of the Content Search that will be created

- # * The search query string

- # The script will then:

- # * Find the OneDrive for Business site for each user in the text file

- # * Create and start a Content Search using the above information

- # Get user credentials

- if (!$credentials)

- {

- $credentials = Get-Credential

- }

- # Get the user's MySite domain name. We use this to create the admin URL and root URL for OneDrive for Business

- $mySiteDomain = Read-Host "What is your organization's MySite domain? For example, 'contoso' for 'https://contoso-my.sharepoint.com'"

- $AdminUrl = "https://$mySiteDomain-admin.sharepoint.com"

- $mySiteUrlRoot = "https://$mySiteDomain-my.sharepoint.com"

- # Get other required information

- $inputfile = read-host "Enter the file name of the text file that contains the email addresses for the users you want to search"

- $searchName = Read-Host "Enter the name for the new search"

- $searchQuery = Read-Host "Enter the search query you want to use"

- $emailAddresses = Get-Content $inputfile | where {$_ -ne ""} | foreach{ $_.Trim() }

- # Connect to Security & Compliance Center PowerShell

- if (!$s -or !$a)

- {

- Import-Module ExchangeOnlineManagement

- Connect-IPPSSession

- }

-

- # Load the SharePoint assemblies from the SharePoint Online Management Shell

- # To install, go to https://go.microsoft.com/fwlink/p/?LinkId=255251

- if (!$SharePointClient -or !$SPRuntime -or !$SPUserProfile)

- {

- $SharePointClient = [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client")

- $SPRuntime = [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client.Runtime")

- $SPUserProfile = [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client.UserProfiles")

- if (!$SharePointClient)

- {

- Write-Error "SharePoint Online Management Shell isn't installed, please install from: https://go.microsoft.com/fwlink/p/?LinkId=255251 and then run this script again"

- return;

- }

- }

- if (!$spCreds)

- {

- $spCreds = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($credentials.UserName, $credentials.Password)

- }

- # Add the path of the User Profile Service to the SPO admin URL, then create a new webservice proxy to access it

- $proxyaddr = "$AdminUrl/_vti_bin/UserProfileService.asmx?wsdl"

- $UserProfileService= New-WebServiceProxy -Uri $proxyaddr -UseDefaultCredential False

- $UserProfileService.Credentials = $credentials

- # Take care of auth cookies

- $strAuthCookie = $spCreds.GetAuthenticationCookie($AdminUrl)

- $uri = New-Object System.Uri($AdminUrl)

- $container = New-Object System.Net.CookieContainer

- $container.SetCookies($uri, $strAuthCookie)

- $UserProfileService.CookieContainer = $container

- Write-Host "Getting each user's OneDrive for Business URL"

- $urls = @()

- foreach($emailAddress in $emailAddresses)

- {

- try

- {

- $prop = $UserProfileService.GetUserProfileByName("i:0#.f|membership|$emailAddress") | Where-Object { $_.Name -eq "PersonalSpace" }

- $url = $prop.values[0].value

- $furl = $mySiteUrlRoot + $url

- $urls += $furl

- Write-Host "-$emailAddress => $furl"

- }

- catch

- {

- Write-Warning "Could not locate OneDrive for $emailAddress"

- }

- }

- Write-Host "Creating and starting the search"

- $search = New-ComplianceSearch -Name $searchName -ExchangeLocation $emailAddresses -SharePointLocation $urls -ContentMatchQuery $searchQuery

- # Finally, start the search and then display the status

- if($search)

- {

- Start-ComplianceSearch $search.Name

- Get-ComplianceSearch $search.Name

- }

-

- ```

-

-

-4. When prompted for your credentials, enter your email address and password, and then click **OK**.

-

-

- - The name of your MySite domain.

-

-

-

-

- The script gets the URLs for each OneDrive for Business site and then creates and starts the search. You can either run the **Get-ComplianceSearch** cmdlet in Security & Compliance Center PowerShell to display the search statistics and results, or you can go to the **Content search** page in the compliance portal to view information about the search.

-In a PowerShell session, you must [connect to Office 365 Security & Compliance Center PowerShell](/powershell/exchange/office-365-scc/connect-to-scc-powershell/connect-to-scc-powershell) to configure the settings for the default sharing link type.

-The configuration settings for the default sharing link type use the PowerShell *AdvancedSettings* parameter with the [Set-Label](/powershell/module/exchange/set-label) and [New-Label](/powershell/module/exchange/new-labelpolicy) cmdlets from [Security & Compliance Center PowerShell](/powershell/exchange/scc-powershell):

-

-

-1. First, [connect to Office 365 Security & Compliance Center PowerShell](/powershell/exchange/office-365-scc/connect-to-scc-powershell/connect-to-scc-powershell).

-2. You now need to synchronize your sensitivity labels to Azure AD. First, [connect to Security & Compliance Center PowerShell](/powershell/exchange/office-365-scc/connect-to-scc-powershell/connect-to-scc-powershell).

-2. If you don't know your label GUID: [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) and get the list of sensitivity labels and their GUIDs.

-1. First, [connect to Security & Compliance Center PowerShell](/powershell/exchange/office-365-scc/connect-to-scc-powershell/connect-to-scc-powershell).

- > ^\* Users can use the Recover Deleted Items tool in Outlook and Outlook on the web (formerly known as Outlook Web App) to recover a deleted item within the deleted item retention period, which by default is 14 days in Exchange Online. An administrator can use Windows PowerShell to increase the deleted item retention period to a maximum of 30 days. For more information, see: [Recover deleted items in Outlook for Windows](https://support.office.com/article/49e81f3c-c8f4-4426-a0b9-c0fd751d48ce) and [Change the deleted item retention period for a mailbox in Exchange Online](/exchange/recipients-in-exchange-online/manage-user-mailboxes/change-deleted-item-retention).

-

-

-A TPD is an XML file that contains information about your organization's rights management settings. For example, the TPD contains information about the server licensor certificate (SLC) used for signing and encrypting certificates and licenses, the URLs used for licensing and publishing, and so on. You import the TPD into your organization by using Windows PowerShell.

-

-

- **To import TPDs from Azure RMS**

-

-1. [Connect to Exchange Online Using Remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-|**Location**|**Key sharing location URL**|

-|:--|:--|

-|North America <br/> |https://sp-rms.na.aadrm.com/TenantManagement/ServicePartner.svc <br/> |

-|European Union <br/> |https://sp-rms.eu.aadrm.com/TenantManagement/ServicePartner.svc <br/> |

-|Asia <br/> |https://sp-rms.ap.aadrm.com/TenantManagement/ServicePartner.svc <br/> |

-|South America <br/> |https://sp-rms.sa.aadrm.com/TenantManagement/ServicePartner.svc <br/> |

-|Office 365 for Government (Government Community Cloud) <br/> This RMS key-sharing location is reserved for customers who have purchased Office 365 for Government SKUs. <br/> |https://sp-rms.govus.aadrm.com/TenantManagement/ServicePartner.svc <br/> |

-

-3. Configure the key-sharing location by running the [Set-IRMConfiguration](/powershell/module/exchange/set-irmconfiguration) cmdlet as follows:

-

-4. Run the [Import-RMSTrustedPublishingDomain](/powershell/module/exchange/import-rmstrustedpublishingdomain) cmdlet with the -RMSOnline switch to import the TPD from Azure Rights Management:

- Where *TPDName* is the name you want to use for the TPD. For example, "Contoso North American TPD".

-6. Run the [Set-IRMConfiguration](/powershell/module/exchange/set-irmconfiguration) cmdlet as follows to disable Azure Rights Management templates from being available in Outlook on the web and Outlook:

-

-

-

-

-

-1. Connect to the [Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-This procedure shows you how to create a file in XML format called a rule package (with Unicode encoding), and then upload it into Microsoft Purview using Compliance center PowerShell cmdlets.

-1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-2. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-In Compliance center PowerShell, modifying a custom sensitive information type requires you to:

-To connect to Compliance Center PowerShell, see [Connect to Compliance Center PowerShell](/powershell/exchange/exchange-online-powershell).

-### Step 1: Export the existing rule package to an XML file

-#### Step 2: Modify the sensitive information type in the exported XML file

-#### Step 3: Import the updated XML file back into the existing rule package

-6. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-In Compliance center PowerShell, there are two methods to remove custom sensitive information types:

-1. [Connect to Compliance center PowerShell](/powershell/exchange/exchange-online-powershell)

-2. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

- |Windows PowerShell|See the [ScheduledTasks](/powershell/module/scheduledtasks/) documentation and the [example PowerShell script](#example-powershell-script-for-task-scheduler) in this article|

-### Example PowerShell script for Task Scheduler

-#### Schedule hashing and upload in a combined step

-#### Schedule hashing and upload as separate steps

-Security & Compliance Center PowerShell provides cmdlets that let you automate time-consuming tasks related to creating and managing eDiscovery cases. Currently, using the Microsoft Purview eDiscovery (Standard) case in the Microsoft Purview compliance portal to place a large number of custodian content locations on hold takes time and preparation. For example, before you create a hold, you have to collect the URL for each OneDrive for Business site that you want to place on hold. Then for each user you want to place on hold, you have to add their mailbox and their OneDrive for Business site to the hold. You can use the script in this article to automate this process.

-

-

-

-

-

-

-

-Go to [Set up the SharePoint Online Management Shell Windows PowerShell environment](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online) and perform Step 1 and Step 2 to install the SharePoint Online Management Shell on your local computer.

-The script in Step 3 will create a hold that's associated with an eDiscovery case, and the add the mailboxes and OneDrive for Business sites of a list of users to the hold. You can just type the email addresses in a text file, or you can run a command in Windows PowerShell to get a list of email addresses and save them to a file (located in same folder that you'll save the script to in Step 3).

-

-Here's a PowerShell command (that you run by using remote PowerShell connected to your Exchange Online organization) to get a list of email addresses for all users in your organization and save it to a text file named HoldUsers.txt.

-

-

-

-

-```powershell

-#script begin

-" "

-write-host "***********************************************"

-write-host " Security & Compliance Center PowerShell " -foregroundColor yellow -backgroundcolor darkgreen

-write-host " eDiscovery (Standard) cases - Add users to a hold " -foregroundColor yellow -backgroundcolor darkgreen

-write-host "***********************************************"

-" "

-# Connect to SCC PowerShell using modern authentication

-if (!$SccSession)

-{

- Import-Module ExchangeOnlineManagement

- Connect-IPPSSession

-}

-# Get the organization's domain name. We use this to create the SharePoint admin URL and root URL for OneDrive for Business.

-""

-$mySiteDomain = Read-Host "Enter the domain name for your SharePoint organization. We use this name to connect to SharePoint admin center and for the OneDrive URLs in your organization. For example, 'contoso' in 'https://contoso-admin.sharepoint.com' and 'https://contoso-my.sharepoint.com'"

-""

-# Connect to PnP Online using modern authentication

-Import-Module PnP.PowerShell

-Connect-PnPOnline -Url https://$mySiteDomain-admin.sharepoint.com -UseWebLogin

-# Load the SharePoint assemblies from the SharePoint Online Management Shell

-# To install, go to https://go.microsoft.com/fwlink/p/?LinkId=255251

-if (!$SharePointClient -or !$SPRuntime -or !$SPUserProfile)

-{

- $SharePointClient = [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client")

- $SPRuntime = [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client.Runtime")

- $SPUserProfile = [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client.UserProfiles")

- if (!$SharePointClient)

- {

- Write-Error "The SharePoint Online Management Shell isn't installed. Please install it from: https://go.microsoft.com/fwlink/p/?LinkId=255251 and then re-run this script."

- return;

- }

-}

-# Get other required information

-do{

-$casename = Read-Host "Enter the name of the case"

-$caseexists = (get-compliancecase -identity "$casename" -erroraction SilentlyContinue).isvalid

-if($caseexists -ne 'True')

-{""

-write-host "A case named '$casename' doesn't exist. Please specify the name of an existing case, or create a new case and then re-run the script." -foregroundColor Yellow

-""}

-}While($caseexists -ne 'True')

-""

-do{

-$holdName = Read-Host "Enter the name of the new hold"

-$holdexists=(get-caseholdpolicy -identity "$holdname" -case "$casename" -erroraction SilentlyContinue).isvalid

-if($holdexists -eq 'True')

-{""

-write-host "A hold named '$holdname' already exists. Please specify a new hold name." -foregroundColor Yellow

-""}

-}While($holdexists -eq 'True')

-""

-$holdQuery = Read-Host "Enter a search query to create a query-based hold, or press Enter to hold all content"

-""

-$holdstatus = read-host "Do you want the hold enabled after it's created? (Yes/No)"

-do{

-""

-$inputfile = read-host "Enter the name of the text file that contains the email addresses of the users to add to the hold"

-""

-$fileexists = test-path -path $inputfile

-if($fileexists -ne 'True'){write-host "$inputfile doesn't exist. Please enter a valid file name." -foregroundcolor Yellow}

-}while($fileexists -ne 'True')

-#Import the list of addresses from the txt file. Trim any excess spaces and make sure all addresses

- #in the list are unique.

- [array]$emailAddresses = Get-Content $inputfile -ErrorAction SilentlyContinue | where {$_.trim() -ne ""} | foreach{ $_.Trim() }

- [int]$dupl = $emailAddresses.count

- [array]$emailAddresses = $emailAddresses | select-object -unique

- $dupl -= $emailAddresses.count

-#Validate email addresses so the hold creation does not run in to an error.

-if($emailaddresses.count -gt 0){

-write-host ($emailAddresses).count "addresses were found in the text file. There were $dupl duplicate entries in the file." -foregroundColor Yellow

-""

-Write-host "Validating the email addresses. Please wait..." -foregroundColor Yellow

-""

-$finallist =@()

-foreach($emailAddress in $emailAddresses)

-{

-if((get-recipient $emailaddress -erroraction SilentlyContinue).isvalid -eq 'True')

-{$finallist += $emailaddress}

-else {"Unable to find the user $emailaddress"

-[array]$excludedlist += $emailaddress}

-}

-""

-#Find user's OneDrive account URL using email address

-Write-Host "Getting the URL for each user's OneDrive for Business site." -foregroundColor Yellow

-""

-$AdminUrl = "https://$mySiteDomain-admin.sharepoint.com"

-$mySiteUrlRoot = "https://$mySiteDomain-my.sharepoint.com"

-$urls = @()

-foreach($emailAddress in $finallist)

-{

-try

-{

-$url=Get-PnPUserProfileProperty -Account $emailAddress | Select PersonalUrl

-$urls += $url.PersonalUrl

- Write-Host "- $emailAddress => $url"

- [array]$ODadded += $url.PersonalUrl

- }catch {

- Write-Warning "Could not locate OneDrive for $emailAddress"

- [array]$ODExluded += $emailAddress

- Continue }

-}

-$urls | FL

-if(($finallist.count -gt 0) -or ($urls.count -gt 0)){

-""

-Write-Host "Creating the hold named $holdname. Please wait..." -foregroundColor Yellow

-if(($holdstatus -eq "Y") -or ($holdstatus -eq "y") -or ($holdstatus -eq "yes") -or ($holdstatus -eq "YES")){

-New-CaseHoldPolicy -Name "$holdName" -Case "$casename" -ExchangeLocation $finallist -SharePointLocation $urls -Enabled $True | out-null

-New-CaseHoldRule -Name "$holdName" -Policy "$holdname" -ContentMatchQuery $holdQuery | out-null

-}

-else{

-New-CaseHoldPolicy -Name "$holdName" -Case "$casename" -ExchangeLocation $finallist -SharePointLocation $urls -Enabled $false | out-null

-New-CaseHoldRule -Name "$holdName" -Policy "$holdname" -ContentMatchQuery $holdQuery -disabled $false | out-null

-}

-""

-}

-else {"No valid locations were identified. Therefore, the hold wasn't created."}

-#write log files (if needed)

-$newhold=Get-CaseHoldPolicy -Identity "$holdname" -Case "$casename" -erroraction SilentlyContinue

-$newholdrule=Get-CaseHoldRule -Identity "$holdName" -erroraction SilentlyContinue

-if(($ODAdded.count -gt 0) -or ($ODExluded.count -gt 0) -or ($finallist.count -gt 0) -or ($excludedlist.count -gt 0) -or ($newhold.isvalid -eq 'True') -or ($newholdrule.isvalid -eq 'True'))

-{

-Write-Host "Generating output files..." -foregroundColor Yellow

-if($ODAdded.count -gt 0){

-"OneDrive Locations" | add-content .\LocationsOnHold.txt

-"==================" | add-content .\LocationsOnHold.txt

-$newhold.SharePointLocation.name | add-content .\LocationsOnHold.txt}

-if($ODExluded.count -gt 0){

-"Users without OneDrive locations" | add-content .\LocationsNotOnHold.txt

-"================================" | add-content .\LocationsNotOnHold.txt

-$ODExluded | add-content .\LocationsNotOnHold.txt}

-if($finallist.count -gt 0){

-" " | add-content .\LocationsOnHold.txt

-"Exchange Locations" | add-content .\LocationsOnHold.txt

-"==================" | add-content .\LocationsOnHold.txt

-$newhold.ExchangeLocation.name | add-content .\LocationsOnHold.txt}

-if($excludedlist.count -gt 0){

-" "| add-content .\LocationsNotOnHold.txt

-"Mailboxes not added to the hold" | add-content .\LocationsNotOnHold.txt

-"===============================" | add-content .\LocationsNotOnHold.txt

-$excludedlist | add-content .\LocationsNotOnHold.txt}

-$FormatEnumerationLimit=-1

-if($newhold.isvalid -eq 'True'){$newhold|fl >.\GetCaseHoldPolicy.txt}

-if($newholdrule.isvalid -eq 'True'){$newholdrule|Fl >.\GetCaseHoldRule.txt}

-}

-}

-else {"The hold wasn't created because no valid entries were found in the text file."}

-""

-#Disconnect from SCC PowerShell and PnPOnline

-Write-host "Disconnecting from SCC PowerShell and PnP Online" -foregroundColor Yellow

-Get-PSSession | Remove-PSSession

-Disconnect-PnPOnline

-Write-host "Script complete!" -foregroundColor Yellow

-""

-#script end

-```

- The script connects to Security & Compliance Center PowerShell, and then creates the new hold in the eDiscovery case and adds the mailboxes and OneDrive for Business for the users in the list. You can go to the case on the **eDiscovery** page in the compliance portal to view the new hold.

-

- Get-PSSession | Remove-PSSession

- # Connect to Security & Compliance Center PowerShell

-

-

-

-

-

-

-

-

-

-

-

-

-

-

-

-

-

-

-

-

-

-

-To use most of the cmdlets for the Microsoft Purview compliance portal, you need to:

-

-1. [Connect to the Microsoft Purview compliance portal using remote PowerShell](/powershell/exchange/connect-to-scc-powershell)

-

-2. Use any of these [Security &amp; Compliance Center cmdlets](/powershell/exchange/exchange-online-powershell)

-

-However, DLP reports need pull data from across Office 365, including Exchange Online. For this reason, the cmdlets for the DLP reports are available in Exchange Online PowershellΓÇönot in Microsoft Purview compliance portal Powershell. Therefore, to use the cmdlets for the DLP reports, you need to:

-

-1. [Connect to Exchange Online using remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell)

-

-2. Use any of these cmdlets for the DLP reports:

-

- - [Get-DlpDetectionsReport](/powershell/module/exchange/get-dlpdetectionsreport)

-

- - [Get-DlpDetailReport](/powershell/module/exchange/get-dlpdetailreport)

- **Complete these tasks in the Microsoft 365 admin center**

- **Complete these tasks in the Exchange admin center**

-1. Hide the third-party data mailbox from the address book and other address lists in your organization; see [Manage user mailboxes](/exchange/recipients-in-exchange-online/manage-user-mailboxes/manage-user-mailboxes). Alternatively, you can run the following PowerShell command:

-The next step is to configure user mailboxes to support third-party data. Complete these tasks by using the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a> or by using the corresponding Windows PowerShell cmdlets.

- |**Message property**|**Mandatory?**|**Description**|**Example value**|

- |:--|:--|:--|:--|

- |**FROM** <br/> |Yes <br/> |The user who originally created or sent the item in the third-party data source. The partner connector attempts to map the user ID from the source item (for example a Twitter handle) to a user account for all participants (users in the FROM and TO fields). A copy of the message will be imported to the mailbox of every participant. If none of the participants from the item can be mapped to a user account, the item will be imported to the third-party archiving mailbox in Microsoft 365. <br/> <br/> The participant who's identified as the sender of the item must have an active mailbox in the organization that the item is being imported to. If the sender doesn't have an active mailbox, the following error is returned:<br/><br/> `One or more messages in the Request failed to be delivered to either From or Sender email address. You will need to resend your entire Request. Error: The request failed. The remote server returned an error: (401) Unauthorized.` | `bob@contoso.com` <br/> |

- |**TO** <br/> |Yes <br/> |The user who received an item, if applicable for an item in the data source. <br/> | `bob@contoso.com` <br/> |

- |**SUBJECT** <br/> |No <br/> |The subject from the source item. <br/> | `"Mega deals with Contoso coming your way! #ContosoHolidayDeals"` <br/> |

- |**DATE** <br/> |Yes <br/> |The date the item was originally created or posted in the customer data source. For example, that date when a Twitter message was tweeted. <br/> | `01 NOV 2015` <br/> |

- |**BODY** <br/> |No <br/> |The contents of the message or post. For some data sources, the contents of this property could be the same as the content for the **SUBJECT** property. During the import process, the partner connector attempts to maintain full fidelity from the content source as possible. If possible files, graphics, or other content from the body of the source item is included in this property. Otherwise, content from the source item is included in the **ATTACHMENT** property. The contents of this property depends on the partner connector and on the capability of the source platform. <br/> | `

- |**ATTACHMENT** <br/> |No <br/> |If an item in the data source (such as a tweet in Twitter or an instant messaging conversation) has an attached file or include images, the partner connect will first attempt to include attachments in the **BODY** property. If that isn't possible, then it's added to the ** ATTACHMENT ** property. Other examples of attachments include Likes in Facebook, metadata from the content source, and responses to a message or post. <br/> | `image.gif` <br/> |

- |**MESSAGECLASS** <br/> |Yes <br/> | This is a multi-value property, which is created and populated by partner connector. The format of this property is `IPM.NOTE.Source.Event`. (This property must begin with `IPM.NOTE`. This format is similar to the one for the `IPM.NOTE.X` message class.) This property includes the following information: <br/><br/>`Source`: Indicates the third-party data source; for example, Twitter, Facebook, or BlackBerry. <br/> <br/> `Event`: Indicates the type of activity that was performed in the third-party data source that produced the items; for example, a tweet in Twitter or a post in Facebook. Events are specific to the data source. <br/> <br/> One purpose of this property is to filter specific items based on the data source where an item originated or based on the type of event. For example, in an eDiscovery search you could create a search query to find all the tweets that were posted by a specific user. <br/> | `IPM.NOTE.Twitter.Tweet` <br/> |

- - [Keyword queries and search conditions for Content Search](keyword-queries-and-search-conditions.md)

-> [!IMPORTANT]

-> The Microsoft 365 Assessment tool and all other PnP components are open-source tools backed by an active community providing support for them. There is no SLA for open-source tool support from official Microsoft support channels.

-## Security & Compliance Center PowerShell cmdlets

-For connection instructions for Security & Compliance Center PowerShell, see [Connect to the Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-When you use PowerShell to manage Microsoft 365, you can have multiple PowerShell sessions open at the same time. You might have different PowerShell windows to manage user accounts, SharePoint Online, Exchange Online, Skype for Business Online, Microsoft Teams, and the Security &amp; Compliance center.

-

-This scenario isn't optimal for managing Microsoft 365, because you can't exchange data among those windows for cross-service management. This article describes how to use a single instance of PowerShell to manage Microsoft 365 accounts, Skype for Business Online, Exchange Online, SharePoint Online, Microsoft Teams, and the Security &amp; Compliance Center.

-

-

-

-

-

-

-

-

-

-

-

- You need to use a 64-bit version of Windows because of the requirements for the Skype for Business Online module and one of the Microsoft 365 modules.

-

-

- - [Skype for Business Online, PowerShell Module](/microsoftteams/teams-powershell-overview)

-

-

-

-

-

-

-

-

- > [!Note]

-

-

-6. Run these commands to connect to the Security &amp; Compliance Center.

-

- > [!Note]

- > To connect to the Security &amp; Compliance Center for Microsoft 365 clouds other than Worldwide, see [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-7. Run these commands to connect to Teams PowerShell (and Skype for Business Online).

-

-

- > [!Note]

-

- > [!Note]

-

-### Azure Active Directory PowerShell for Graph module

-

-#Security & Compliance Center

-### Microsoft Azure Active Directory Module for Windows PowerShell module

-

-Import-Module ExchangeOnlineManagement

-#Security & Compliance Center

-### Azure Active Directory PowerShell for Graph module

-Import-Module ExchangeOnlineManagement

-#Security & Compliance Center

-### Microsoft Azure Active Directory Module for Windows PowerShell module

-To close down the PowerShell window, run this command to remove the active sessions to SharePoint Online and Teams:

-

-Disconnect-SPOService ; Disconnect-MicrosoftTeams

-Commonly, during mergers or divestitures, you need the ability to move your user's Exchange Online mailbox into a new tenant. Cross-tenant mailbox migration allows tenant administrators to use well-known interfaces like Remote PowerShell and MRS to transition users to their new organization.

-1. Create a Remote PowerShell connection to the target Exchange Online tenant.

-3. Create new or edit your existing organization relationship object to your target (destination) tenant from an Exchange Online Remote PowerShell window.

-1. [Connect to Microsoft 365 Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell)

->[!NOTE]

->Testing privileged access management doesn't require the simulated enterprise test environment, which includes a simulated intranet connected to the internet and directory synchronization for an Active Directory Domain Services forest. It's provided here as an option so that you can test privileged access management and experiment with it in an environment that represents a typical organization.

-#### [Step 1: Create an approver's group](../compliance/privileged-access-management-configuration.md#step-1-create-an-approvers-group)

-#### [Step 2: Enable privileged access](../compliance/privileged-access-management-configuration.md#step-2-enable-privileged-access)

-First, connect to Exchange Management PowerShell with the credentials of a user configured with the Exchange Role Management role in your test environment and attempt to create a new Journal rule. The [New-JournalRule](/powershell/module/exchange/new-journalrule) task is not currently defined in a privileged access policy for your organization.

-1. On your local computer, open and sign in to the Exchange Online Remote PowerShell Module at **Microsoft Corporation** > **Microsoft Exchange Online Remote PowerShell Module** using credentials with the Exchange Role Management role for your test environment.

-2. In Exchange Management PowerShell, create a new Journal rule for your organization:

- ```ExchangeManagementPowerShell

-3. View that the new Journal Rule was successfully created in Exchange Management PowerShell.

->[!NOTE]

->If you haven't already completed the Steps 1 and 2 from Phase 2 of this guide, be sure follow the steps to create an approver's group named "Privilege Access Approvers" to enable privileged access in your test environment.

-1. On your local computer, open and sign in to the Exchange Online Remote PowerShell Module at **Microsoft Corporation** > **Microsoft Exchange Online Remote PowerShell Module** using credentials with the Exchange Role Management role for your test environment.

-2. In Exchange Management PowerShell, create a new Journal rule for your organization:

- ```ExchangeManagementPowerShell

-3. View the "Insufficient permissions" error in Exchange Management PowerShell:

- ```ExchangeManagementPowerShell

-1. On your local computer, open and sign in to the Exchange Online Remote PowerShell Module at **Microsoft Corporation** > **Microsoft Exchange Online Remote PowerShell Module** using credentials with the Exchange Role Management role for your test environment.

-2. In Exchange Management PowerShell, create a new Journal rule for your organization:

- ```ExchangeManagementPowerShell

-3. View that the new Journal Rule was successfully created in Exchange Management PowerShell.

-

-

-1. **Exchange On-premises**: Open the Exchange Management Shell and run the following commands:

-```powershell

-Set-OrganizationConfig -OAuth2ClientProfileEnabled $false

-Set-AuthServer -Identity evoSTS -IsDefaultAuthorizationEndpoint $false

-```

-2. **Exchange Online**: [Connect to Exchange Online](/powershell/exchange/connect-to-exchange-online-powershell) with Remote PowerShell. Run the following command to turn your *OAuth2ClientProfileEnabled* flag to 'false':

-```powershell

-Set-OrganizationConfig -OAuth2ClientProfileEnabled:$false

-```

-

-```powershell

-Set-CsOAuthConfiguration -ClientAuthorizationOAuthServerIdentity ""

-```

-2. **Skype for Business Online**: [Connect to Skype for Business Online](manage-skype-for-business-online-with-microsoft-365-powershell.md) with Remote PowerShell. Run the following command to disable Modern Authentication:

-```powershell

-Set-CsOAuthConfiguration -ClientAdalAuthOverride Disallowed

-```

-[Link back to the Modern Authentication overview](hybrid-modern-auth-overview.md) .

-1. [Connect to Exchange Online Using Remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-To use the Exchange Online PowerShell cmdlets, you need to sign in and import the cmdlets into your local Windows PowerShell session. See [Connect to Exchange Online using remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) for instructions.

-To use the Exchange Online PowerShell cmdlets, you need to sign in and import the cmdlets into your local Windows PowerShell session. See [Connect to Exchange Online using remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) for instructions.

-To use the Exchange Online PowerShell cmdlets, you need to sign in and import the cmdlets into your local Windows PowerShell session. See [Connect to Exchange Online using remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) for instructions.

-> [!NOTE]

-> GDAP is currently in [technical preview](/partner-center/announcements/2022-february#6) (public preview) to allow partners to assign granular permissions before GDAP is generally available.

-Currently, DAP is required to onboard customers to Lighthouse. We recommend also establishing GDAP with your customers to enable more secure delegated access. While DAP and GDAP coexist, GDAP will take precedence for customers where both models are in place. Soon, customers with just GDAP (and no DAP) will be able to onboard to Lighthouse.<br><br>

-> [!NOTE]

->GDAP is currently in [technical preview](/partner-center/announcements/2022-february#6) (public preview) to allow partners to assign granular permissions before GDAP is generally available. Check [Known Issues](m365-lighthouse-known-issues.md) if you're having a problem accessing or performing an action in Lighthouse.

-Microsoft 365 Lighthouse supports reprovisioning Cloud PCs that have a provisioning policy. You may need to reprovision a device for a new user or if the device isn't working properly. When a reprovision is triggered, the Cloud PC will be deleted and recreated as a new Cloud PC. All user data, applications, customizations, and the like will be deleted.

-> The current user of the Cloud PC will be signed out immediately and all user data removed.

-4. In the device details pane, select **Device action status** tab.

-*Delegated Admin Privileges (DAP) is required to onboard customers to Lighthouse. We recommend also establishing Granular Delegated Admin Privileges (GDAP) with your customers to enable more secure delegated access. While DAP and GDAP coexist, GDAP will take precedence for customers where both models are in place. Soon, customers with just GDAP (and no DAP) will be able to onboard to Lighthouse.

-*Delegated Admin Privileges (DAP) is required to onboard customers to Lighthouse. We recommend also establishing Granular Delegated Admin Privileges (GDAP) with your customers to enable more secure delegated access. While DAP and GDAP coexist, GDAP will take precedence for customers where both models are in place. Soon, customers with just GDAP (and no DAP) will be able to onboard to Lighthouse.

-| Ineligible - DAP or GDAP is not set up | You don't have DAP or GDAP admin privileges set up with the tenant, which is required by Lighthouse. | Set up DAP or GDAP admin privileges in the Microsoft Partner Center. |

-Microsoft 365 Lighthouse provides connection status between your tenants and Azure Active Directory. When a Cloud PC has a failed network connection, you can view detailed information in Microsoft Endpoint Manager admin center.

-3. From the connection summary area, select **Failed connections**.

-5. From Microsoft Endpoint Manager admin center, select **View details** to learn more about the error.

-To troubleshoot connection issues, see [Troubleshoot on-premises network connection](/windows-365/enterprise/troubleshoot-on-premises-network-connection) article.

-This article is organized by priority of work, starting with protecting those accounts used to administer the most critical services and assets, such as your tenant, e-mail, and SharePoint. It provides a methodical way for approaching security and works together with the following spreadsheet so you can track your progress with stakeholders and teams across your organization: [Microsoft 365 security for BDMs spreadsheet](https://github.com/MicrosoftDocs/microsoft-365-docs/raw/public/microsoft-365/downloads/Microsoft-365-BDM-security-recommendations-spreadsheet.xlsx).

-|Recommendation |E3 |E5 |

-||||

-|Implement Azure Active Directory (Azure AD) Privileged Identity Management (PIM) to apply just-in-time privileged access to Azure AD and Azure resources. You can also discover who has access and review privileged access.| | |

-|Implement privileged access management to manage granular access control over privileged admin tasks in Office 365. | | |

-|Configure and use Privileged Access Workstations (PAW) to administer services. Do not use the same workstations for browsing the Internet and checking email not related to your administrative account.| !|::: |

-|Recommendation |E3 |E5 |

-||||

-|**Setup multi-factor authentication and use recommended conditional access policies, including sign-in risk policies**. Microsoft recommends and has tested a set of policies that work together to protect all cloud apps, including Office 365 and Microsoft 365 services. See [Identity and device access configurations](./office-365-security/microsoft-365-policies-configurations.md). | ||

-|**Protect your email from targeted phishing attacks**. If you've configured one or more custom domains for your Office 365 or Microsoft 365 environment, you can configure targeted anti-phishing protection. Anti-phishing protection, part of Defender for Office 365, can help protect your organization from malicious impersonation-based phishing attacks and other phishing attacks. If you haven't configured a custom domain, you do not need to do this.| ||

-|**Block connections from countries that you don't do business with**. Create an Azure AD conditional access policy to block any connections coming from these countries, effectively creating a geo firewall around your tenant.| ||

-|Recommendation |E3 |E5 |

-||||

-|**Configure Microsoft Defender for Office 365**:<br>*Safe Attachments<br>* Safe Links<br>*Microsoft Defender for Endpoint for SharePoint, OneDrive, and Microsoft Teams<br>* Anti-phishing in Defender for Office 365 protection| | |

-|**Configure Microsoft Defender for Endpoint capabilities**:<br>*Windows Defender Antivirus <br>* Exploit protection <br> *Attack surface reduction <br>* Hardware-based isolation <br>* Controlled folder access | | |

-|**Use Microsoft Defender for Cloud Apps** to discover SaaS apps and begin to use behavior analytics and anomaly detection. | | |

-|Recommendation |E3|E5 |

-||||

-|**Review and optimize your conditional access and related policies to align with your objectives for a zero trust network**. Protecting against known threats includes implementing a set of [recommended policies](./office-365-security/microsoft-365-policies-configurations.md). Review your implementation of these policies to ensure you're protecting your apps and data against hackers who have gained access to your network. The recommended Intune app protection policy for Windows 10 enables Windows Information Protection (WIP). WIP protects against accidental leaks of your organization data through apps and services, like email, social media, and the public cloud. | ||

-|**Disable external email forwarding**. Hackers who gain access to a user's mailbox can steal your mail by setting the mailbox to automatically forward email. This can happen even without the user's awareness. You can prevent this from happening by configuring a mail flow rule.| ||

-|**Disable anonymous external calendar sharing**. By default external anonymous calendar sharing is allowed. [Disable calendar sharing](/exchange/sharing/sharing-policies/modify-a-sharing-policy) to reduce potential leaks of sensitive information.| ||

-|**Configure data loss prevention policies for sensitive data**. Create a Microsoft Purview Data Loss Prevention Policy in the Security &amp; Compliance center to discover and protect sensitive data such as credit card numbers, Social Security numbers and bank account numbers. Microsoft 365 includes many predefined sensitive information types you can use in data loss prevention policies. You can also create your own sensitive information types for sensitive data that is custom to your environment. |||

-|**Implement data classification and information protection policies**. Implement sensitivity labels and use these to classify and apply protection to sensitive data. You can also use these labels in data loss prevention policies. If you are using Azure Information Protection labels, we recommend that you avoid creating new labels in other admin centers.| ||

-|**Protect data in third-party apps and services by using Defender for Cloud Apps**. Configure Defender for Cloud Apps policies to protect sensitive information across third-party cloud apps, such as Salesforce, Box, or Dropbox. You can use sensitive information types and the sensitivity labels you created in Defender for Cloud Apps policies and apply these across your SaaS apps. <br><br>Microsoft Defender for Cloud Apps allows you to enforce a wide range of automated processes. Policies can be set to provide continuous compliance scans, legal eDiscovery tasks, DLP for sensitive content shared publicly, and more. Defender for Cloud Apps can monitor any file type based on more than 20 metadata filters (for example, access level, file type). | ||

-|**Use [Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview) to identify if users store sensitive information on their Windows devices**. | ||

-|**Use [AIP Scanner](/azure/information-protection/deploy-aip-scanner) to identify and classify information across servers and file shares**. Use the AIP reporting tool to view the results and take appropriate actions.| ||

-|Recommendation |E3 |E5 |

-||||

-|Use **Microsoft Defender for Office 365** tools:<br>*Threat investigation and response capabilities<br>* Automated investigation and response | ||

-|Use **Microsoft Defender for Endpoint**:<br> *[Endpoint detection and response](/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) <br>* Automated investigation and remediation Secure score <br>* [Advanced hunting](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview) <br>| ||

-|Use **Microsoft Defender for Cloud Apps** to detect unusual behavior across cloud apps to identify ransomware, compromised users or rogue applications, analyze high-risk usage and remediate automatically to limit the risk to your organization.| |:::image type="content" source="../media/green-check-mark.png" alt-text="The example of green colored check mark" lightbox="../media/green-check-mark.png":::|

-|Use **Microsoft Sentinel** or your current SIEM tool to monitor for threats across your environment. | ||

-|**Deploy [Microsoft Defender for Identity](/azure-advanced-threat-protection/what-is-atp)** to monitor and protect against threats targeted to your on-premises Active Directory environment. | | |

-|Use **Microsoft Defender for Cloud** to monitor for threats across hybrid and cloud workloads. Microsoft Defender for Cloud includes a free tier of capabilities and a standard tier of capabilities that are paid for based on resource hours or transactions.| | |

-Microsoft Defender for Endpoint Device Control Removable Storage Access Control enables you to do the following task:

-|Removable Media Group Creation|Allows you to create reusable removable media group|Step 1 in the section, [Deploying policy via OMA-URI](#deploying-policy-via-oma-uri) | Step 1 in the section, [Deploying policy via Group Policy](#deploying-policy-via-group-policy)|

-|Policy Creation|Allows you to create policy to enforce each removable media group|Step 2 in the section, [Deploying policy via OMA-URI](#deploying-policy-via-oma-uri) | Steps 2 and 3 in the section, [Deploying policy via Group Policy](#deploying-policy-via-group-policy) |

-|Default Enforcement|Allows you to set default access (Deny or Allow) to removable media if there is no policy|Step 3 in the section, [Deploying policy via OMA-URI](#deploying-policy-via-oma-uri) | Step 4 in the section, [Deploying policy via Group Policy](#deploying-policy-via-group-policy) |

-|Enable or Disable Removable Storage Access Control|If you set Disable, it will disable the Removable Storage Access Control policy on this machine| Step 4 in the section, [Deploying policy via OMA-URI](#deploying-policy-via-oma-uri) | Step 5 in the section, [Deploying policy via Group Policy](#deploying-policy-via-group-policy) |

-|Capture file information|Allows you to create policy to capture file information when Write access happens| Steps 2 and 5 in the section, [Deploying policy via OMA-URI](#deploying-policy-via-oma-uri) | Step 2 and 6 in the section, [Deploying policy via Group Policy](#deploying-policy-via-group-policy) |

-## Prepare your endpoints

-## Policy properties

-|**DescriptorIdList**|List the device properties you want to use to cover in the group. For each device property, see [Device Properties](device-control-removable-storage-protection.md) for more detail. All properties are case sensitive. |**PrimaryId**: `RemovableMediaDevices`, `CdRomDevices`, `WpdDevices`<p>**BusId**: For example, USB, SCSI<p>**DeviceId**<p>**HardwareId**<p>**InstancePathId**: InstancePathId is a string that uniquely identifies the device in the system, for example, `USBSTOR\DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07\8735B611&0`. The number at the end (for example &0) represents the available slot and may change from device to device. For best results, use a wildcard at the end. For example, `USBSTOR\DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07\8735B611*`.<p>**FriendlyNameId**<p>**SerialNumberId**<p>**VID**<p>**PID**<p>**VID_PID**<p>`0751_55E0`: match this exact VID/PID pair<p>`_55E0`: match any media with PID=55E0 <p>`0751_`: match any media with VID=0751|

-|**MatchType**|When there are multiple device properties being used in the `DescriptorIDList`, MatchType defines the relationship.|**MatchAll**: Any attributes under the `DescriptorIdList` will be **And** relationship; for example, if administrator puts `DeviceID` and `InstancePathID`, for every connected USB, system will check to see whether the USB meets both values. <p> **MatchAny**: The attributes under the DescriptorIdList will be **Or** relationship; for example, if administrator puts `DeviceID` and `InstancePathID`, for every connected USB, system will do the enforcement as long as the USB has either an identical **DeviceID** or **InstanceID** value. |

-## Common Removable Storage Access Control scenarios

-To help familiarize you with Microsoft Defender for Endpoint Removable Storage Access Control, we have put together some common scenarios for you to follow.

-## Deploying and managing policy via Group Policy

-The Removable Storage Access Control feature enables you to apply policy via Group Policy to either user or device, or both.

-### Licensing

-Before you get started with Removable Storage Access Control, you must confirm your [Microsoft 365 subscription](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans?rtc=2). To access and use Removable Storage Access Control, you must have Microsoft 365 E3 or Microsoft 365 E5.

-### Deploying policy via Group Policy

-1. Combine all groups within `<Groups>` `</Groups>` into one xml file.

- The following image illustrates the example of [Scenario 1: Prevent Write and Execute access to all but allow specific approved USBs](#scenario-1-prevent-write-and-execute-access-to-all-but-allow-specific-approved-usbs).

- :::image type="content" source="images/prevent-write-access-allow-usb.png" alt-text="The configuration settings that allow specific approved USBs on devices" lightbox="images/prevent-write-access-allow-usb.png":::

-2. Combine all rules within `<PolicyRules>` `</PolicyRules>` into one xml file.

- If you want to restrict a specific user, then use SID property into the Entry. If there is no SID in the policy Entry, the Entry will be applied to everyone login instance for the machine.

- If you want to monitor file information for Write access, use the right AccessMask with the right Option (16); here is the example of [Capture file information](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Group%20Policy/Audit%20File%20Information.xml).

- The following image illustrates the usage of SID property, and an example of [Scenario 1: Prevent Write and Execute access to all but allow specific approved USBs](#scenario-1-prevent-write-and-execute-access-to-all-but-allow-specific-approved-usbs).

- :::image type="content" source="images/usage-sid-property.png" alt-text="The code that indicates usage of the SID property attribute" lightbox="images/usage-sid-property.png":::

-3. Save both rule and group XML files on the network share folder and put the network share folder path into the Group Policy setting: **Computer Configuration** \> **Administrative Templates** \> **Windows Components** \> **Microsoft Defender Antivirus** \> **Device Control**: **'Define device control policy groups'** and **'Define device control policy rules'**.

- If you cannot find the policy configuration UX in the Group Policy, you can download the [WindowsDefender.adml](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/WindowsDefender.adml) and [WindowsDefender.admx](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/WindowsDefender.admx) files by selecting **Raw** and then **Save as**.

- - The target machine must be able to access the network share to have the policy. However, once the policy is read, the network share connection is no longer required, even after machine reboot.

- :::image type="content" source="images/device-control.png" alt-text="The Device Control screen" lightbox="images/device-control.png":::

-4. Default enforcement: allows you to set default access (Deny or Allow) to removable media if there is no policy. For example, you only have policy (either Deny or Allow) for RemovableMediaDevices, but do not have any policy for CdRomDevices or WpdDevices, and you set default Deny through this policy, Read/Write/Execute access to CdRomDevices or WpdDevices will be blocked.

- - Once you deploy this setting, you will see **Default Allow** or **Default Deny**.

- - Consider both Disk level and File system level AccessMask when configuring this setting, for example, if you want to Default Deny but allow specific storage, you have to allow both Disk level and File system level access, you have to set AccessMask to 63.

- :::image type="content" source="images/148609579-a7df650b-7792-4085-b552-500b28a35885.png" alt-text="Default Allow or Default Deny PowerShell code":::

-5. Enable or Disable Removable Storage Access Control: you can set this value to temporarily disable Removable Storage Access Control.

- :::image type="content" source="images/148608318-5cda043d-b996-4146-9642-14fccabcb017.png" alt-text="Device Control settings":::

- - Once you deploy this setting, you will see **Enabled** or **Disabled**. Disabled means this machine does not have Removable Storage Access Control policy running.

- :::image type="content" source="images/148609685-4c05f002-5cbe-4aab-9245-83e730c5449e.png" alt-text="Enabled or Disabled device control in PowerShell code":::

-6. Set location for a copy of the file: if you want to have a copy of the file when Write access happens, you have to set the location where system can save the copy.

- Deploy this together with the right AccessMask and Option - see step 2 above.

- :::image type="content" source="../../media/define-device-control-policy-rules.png" alt-text="Group Policy - Set locaiton for file evidence":::

-## Deploying and managing policy via Intune OMA-URI

-The Removable Storage Access Control feature enables you to apply policy via OMA-URI to either user or device, or both.

-### Deploying policy via OMA-URI

-Microsoft Endpoint Manager admin center (<https://endpoint.microsoft.com/>) \> **Devices** \> **Configuration profiles** \> **Create profile** \> **Platform: Windows 10 and later & Profile: Custom**

-1. For each Group, create an OMA-URI rule:

- - OMA-URI:

- `./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups/%7b**GroupGUID**%7d/GroupData`

- For example, for **any removable storage and CD/DVD** group in the sample, the link must be:

- `./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups/%7b9b28fae8-72f7-4267-a1a5-685f747a7146%7d/GroupData`

- - Data Type: String (XML file)

- :::image type="content" source="images/xml-data-type-string.png" alt-text="The Data type field in the Add Row page" lightbox="images/xml-data-type-string.png":::

-2. For each policy, also create an OMA-URI:

- - OMA-URI:

- `./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules/%7b**PolicyRuleGUID**%7d/RuleData`

- For example, for the **Block Write and Execute Access but allow approved USBs** rule in the sample, the link must be:

- `./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules/%7bc544a991-5786-4402-949e-a032cb790d0e%7d/RuleData`

- - Data Type: String (XML file)

- If you want to monitor file information for Write access, use the right AccessMask with the right Option (16); here is the example of [Capture file information](https://github.com/microsoft/mdatp-devicecontrol/blob/main/Removable%20Storage%20Access%20Control%20Samples/Intune%20OMA-URI/Audit%20File%20Information.xml).

-3. Default enforcement: allows you to set default access (Deny or Allow) to removable media if there is no policy. For example, you only have policy (either Deny or Allow) for RemovableMediaDevices, but do not have any policy for CdRomDevices or WpdDevices, and you set default Deny through this policy, Read/Write/Execute access to CdRomDevices or WpdDevices will be blocked.

- - OMA-URI: `./Vendor/MSFT/Defender/Configuration/DefaultEnforcement`

- - Data Type: Int

- `DefaultEnforcementAllow = 1`

- `DefaultEnforcementDeny = 2`

- - Once you deploy this setting, you will see **Default Allow** or **Default Deny**

- - Consider both Disk level and File system level AccessMask when configuring this setting, for example, if you want to Default Deny but allow specific storage, you have to allow both Disk level and File system level access, you have to set AccessMask to 63.

- :::image type="content" source="images/148609590-c67cfab8-8e2c-49f8-be2b-96444e9dfc2c.png" alt-text="Default Enforcement Allow PowerShell code":::

-4. Enable or Disable Removable Storage Access Control: you can set this value to temporarily disable Removable Storage Access Control.

- - OMA-URI: `./Vendor/MSFT/Defender/Configuration/DeviceControlEnabled`

- - Data Type: Int

- `Disable: 0`

- `Enable: 1`

- - Once you deploy this setting, you will see **Enabled** or **Disabled**

- **Disabled** means this machine does not have Removable Storage Access Control policy running

- :::image type="content" source="images/148609770-3e555883-f26f-45ab-9181-3fb1ff7a38ac.png" alt-text="Removeable Storage Access Control in PowerShell code":::

-5. Set the location for a copy of the file: if you want to have a copy of the file when Write access happens, you have to set the location where the system can save the copy.

- - OMA-URI: `./Vendor/MSFT/Defender/Configuration/DataDuplicationRemoteLocation

- - Data Type: String

- You have to deploy this together with the right AccessMask and the right Option - see step 2 above.

- :::image type="content" source="../../media/device-control-oma-uri-edit-row.png" alt-text="Set locaiton for file evidence":::

-## Deploying and managing policy by using Intune user interface

-(*Coming soon!*) This capability will be available in the Microsoft Endpoint Manager admin center (<https://endpoint.microsoft.com/>). Go to **Endpoint Security** > **Attack Surface Reduction** > **Create Policy**. Choose **Platform: Windows 10 and later** with **Profile: Device Control**.

-3. If you are deploying and managing the policy via Group Policy, please make sure combine all PolicyRule into one XML file within a parent node called PolicyRules and all Group into one XML file within a parent node called Groups; if you manage through Intune, keep one PolicyRule one XML file, same thing, one Group one XML file.

-If still not working, you may want to contact us and share support cab by running cmd with administrator: "%programfiles%\Windows Defender\MpCmdRun.exe" -GetFiles

->

->These actions are not currently supported for macOS and Linux. Use live response to run the action. For more information on live response, see [Investigate entities on devices using live response](live-response.md)

->[!IMPORTANT]

-> - This action is available for devices on Windows 10, version 1709 or later, Windows 11, and Windows Server 2016.

->[!NOTE]

->The notification is not available on Windows Server 2016 and Windows Server 2012 R2.

-> - Isolating devices from the network is not currently supported for macOS and Linux. Use live response to run the action. For more information on live response, see [Investigate entities on devices using live response](live-response.md).

-1. Go to the **Device inventory** page and select the device to contain

-2. Select **Contain device** from the actions menu in the device flyout

->It can take up to 5 minutes for the details about a newly contained device to reach Microsoft Defender for Endpoint onboarded devices.

-> [!Important]

->

->

->

-After you contain a device, if the behavior isn't as expected, verify the Base Filtering Engine(BFE) service is enabled on the Defender for Endpoint onboarded devices.

-1. Select the device from the **Device inventory** or open the device page

-2. Select **Release from containment** from the action menu

-This action will restore this device's connection to the network.

-##### Example 2: Collect a performance recording for Remote PowerShell session

-New-MpPerformanceRecording -RecordTo:.\Defender-scans.etl -Seconds 60

-Specifies that output of performance recording should be machine readable and readily convertible to serialization formats like JSON (for example, via Convert-to-JSON command). This is recommended for users interested in batch processing with other data processing systems.

-|Threat Intelligence and Analytics team|Data sources are properly feeding the threat intelligence engines.|Threat Intelligence Analyst/Engineer|Data feed requirements established, threat intelligence triggers from approved sources|Microsoft Defender for Identity, Microsoft Defender for Endpoint|Threat Intelligence team did not use automation script to link Microsoft 365 Defender API with threat intel engines|Add Microsoft 365 Defender as data sources to threat engines <BR> <BR> Update use case run book|N|

-|Monitoring team|Data sources are properly feeding the monitoring dashboards|Tier 1,2 SOC AnalystΓÇôMonitoring & Alerts|Workflow for reporting Security & Compliance Center Secure Score|[Alerts in Security & Compliance Center](/microsoft-365/security/office-365-security/alerts) <br><br> Secure Score monitoring|No mechanism for SOC analysts to report successful new phishing variant detection to improve Secure Score <br><br> [Reporting in Security & Compliance Center](/microsoft-365/security/office-365-security/reports-and-insights-in-security-and-compliance)|Add a process for tracking Secure Score improvement to Reporting workflows|N|

-|Monitoring Teams|Threat and vulnerability status is reported via company intranet portal|Tier 2 SOC analyst|Auto-generated reports from Microsoft 365 Defender showing remediation progress of assets|[Alerts in Security & Compliance Center](/microsoft-365/security/office-365-security/alerts) <br><br> Secure Score monitoring|No views or dashboard reports being communicated to asset owners regarding threat and vulnerability status of assets.|Create automation script to populate status of high risk and critical asset vulnerability remediation to the organization.|N|

-For information on the latest phishing attacks, techniques, and trends, you can read these entries on the [Microsoft Security blog](https://www.microsoft.com/security/blog/product/windows/):

-## View admin submissions to Microsoft

-2. On the **Submissions** page, verify that the **Emails**, **URL**, or **Email attachment** tab is selected.

-## Security & Compliance Center PowerShell procedures for SecOps mailboxes in the advanced delivery policy

-In Security & Compliance Center PowerShell, the basic elements of SecOps mailboxes in the advanced delivery policy are:

-## Security & Compliance Center PowerShell procedures for third-party phishing simulations in the advanced delivery policy

-In Security & Compliance Center PowerShell, the basic elements of third-party phishing simulations in the advanced delivery policy are:

-If you find any evidence of either of these attacks, remediation is simple, just delete the rule or form from the mailbox. You can do this with the Outlook client or using remote PowerShell to remove rules.

-There are two remote PowerShell cmdlets you can use to remove or disable dangerous rules. Just follow the steps.

-1. Connect to the Exchange server using remote PowerShell. Follow the steps in [Connect to Exchange servers using remote PowerShell](/powershell/exchange/connect-to-exchange-servers-using-remote-powershell).

-1. Follow the steps in [Connect to Exchange Online using PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-## Use Security & Compliance Center PowerShell to give another user access to the Security & Compliance Center

-1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell).

-|**Organization Management**<sup>1</sup>|Members can control permissions for accessing features in the Security & Compliance Center, and also manage settings for device management, data loss prevention, reports, and preservation. <p> Users who are not global administrators must be Exchange administrators to see and take action on devices that are managed by Basic Mobility and Security for Microsoft 365 (formerly known as Mobile Device Management or MDM). <p> Global admins are automatically added as members of this role group, but you won't see them in the output of the [Get-RoleGroupMember](/powershell/module/exchange/get-rolegroupmember) cmdlet in [Security & Compliance Center PowerShell](/powershell/module/exchange/get-rolegroupmember).|Audit Logs <p><p> Case Management <p> Communication Compliance Admin <p> Communication Compliance Case Management <p> Compliance Administrator <p> Compliance Search <p> Data Connector Admin <p> Device Management <p> DLP Compliance Management <p> Hold <p> IB Compliance Management <p> Insider Risk Management Admin <p> Manage Alerts <p> Organization Configuration <p> Quarantine <p> RecordManagement <p> Retention Management <p> Role Management <p> Search And Purge <p> Security Administrator <p> Security Reader <p> Sensitivity Label Administrator <p> Sensitivity Label Reader <p> Service Assurance View <p> Tag Contributor <p> Tag Manager <p> Tag Reader <p> View-Only Audit Logs <p> View-Only Device Management <p> View-Only DLP Compliance Management <p> View-Only IB Compliance Management <p> View-Only Case <p> View-Only Manage Alerts <p> View-Only Recipients <p> View-Only Record Management <p> View-Only Retention Management|

-1. [Connect to an Exchange Online Remote PowerShell session](/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/connect-to-exchange-online-powershell).

-If you'd rather use PowerShell to create the same alert policy as described in the previous section, [connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) and run the following command:

-1. [Connect to Security & Compliance Center PowerShell](/powershell/exchange/connect-to-scc-powershell) and run the following command:

-To set the default file and folder sharing link for the organization

-To set the default file and folder sharing link for a specific site

-To create a DLP rule

-When you allow anonymous users to upload files, you're at an increased risk of someone uploading a malicious file. In Microsoft 365, you can use the *Safe Attachments* feature in Defender for Office 365 to automatically scan uploaded files and quarantine files that are found to be unsafe.

-To turn on safe attachments

-1. Open the [ATP Safe Attachments page](https://protection.office.com/safeattachmentv2) in the Security and Compliance admin center.

-2. Click **Global settings**.

-3. Turn on ATP for SharePoint, OneDrive, and Microsoft Teams.

- 

-4. Optionally turn on Safe Documents as well, and then click **Save**

-See [ATP for SharePoint, OneDrive, and Microsoft Teams](../security/office-365-security/mdo-for-spo-odb-and-teams.md) and [Turn on ATP for SharePoint, OneDrive, and Microsoft Teams](../security/office-365-security/turn-on-mdo-for-spo-odb-and-teams.md) for additional guidance.

-Before you can run the PowerShell cmdlets, download and install a module that will let you talk to your organization. Check out [Connect to Exchange Online using remote PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).

-|-|Baseline (Public)|Baseline (Private)|Sensitive|Highly sensitive|

-[Alert policies in the security and compliance center](../compliance/alert-policies.md)

-In my role, I focus on helping customers arrive at the best technical solution to address their unique set of business goals. Officially, I focus on Identity, Security, Privacy, and Compliance. I love the fact that these touch everything we do. It gives me an opportunity to be involved with most projects. This keeps me busy and enjoying this role.

-When you learn to swim it's better to start in the pool and not in the middle of the ocean. I'm not trying to be technically accurate with this diagram. It's a model to discuss some basic concepts.

-Some additional concepts that I find many customers (and Microsoft employees) are confused about or have questions about include the following:

-Azure AD doesn't solve for lack of governance in your identity world! [Identity governance](/azure/active-directory/governance/identity-governance-overview) should be a critical element independent of any cloud decisions. Governance requirements change over time, which is why it is a program and not a tool.

-This type of whiteboard drawing illustrates where security policies are applied within the flow of an authentication request. In this example, policies enforced through Active Directory Federation Service (AD FS) are applied to the first service request, but not subsequent service requests. This is at least one reason to move security controls to the cloud as much as possible.

-Azure AD has detailed [audit and reporting](/azure/active-directory/reports-monitoring/) capabilities. However, this is usually not the only source of information needed to make security decisions. See more discussion on this in the delegation section.

-Today, I find many customer IT groups are structured around "products." It's logical for an on-premises world since you need an expert for each specific product. However, I am totally happy that I don't have to debug an Active Directory or Exchange database ever again as these services have moved to the cloud. Automation (which cloud kind of is) removes certain repetitive manual jobs (look what happened to factories). However, these are replaced with more complex requirements to understand cross-services interaction, impact, business needs, and so on. If you are willing to [learn](/learn/), there are great opportunities enabled by cloud transformation. Before jumping into technology, I often talk to customers about managing change in IT skills and team structures.

-To all SharePoint fan-people and developers, please stop asking "How can I do XYZ in SharePoint online?" Use [Power Automate](/power-automate/) (or Flow) for workflow, it is a much more powerful platform. Use [Azure Bot Framework](/azure/bot-service/) to create a better UX for your 500-K item list. Start using [Microsoft Graph](https://developer.microsoft.com/graph/) instead of CSOM. [Microsoft Teams](/MicrosoftTeams/Teams-overview) includes SharePoint but also a world more. There are many other examples I can list. There's a vast and wonderful universe out there. Open the door and [start exploring]().

-There are many other people and process implications. In my opinion, this is a critical and under-discussed area. Perhaps more in another article.

-Some customers choose to go with more than one tenant. This should be a very careful decision and almost always business reason driven! Some examples include the following:

-In most large organizations, separation of duties and role-based access control (RBAC) is a necessary reality. I am going to apologize ahead of time. This is not as simple as some customers want it to be. Customer, legal, compliance, and other requirements are different and sometimes conflicting around the world. Simplicity and flexibility are often on opposite sides of each other. Don't get me wrong, we can do a better job at this. There have been (and will be) significant improvements over time. Visit your local [Microsoft Technology Center](https://www.microsoft.com/mtc) to work out the model that fits your business requirements without reading 379230 docs! Here, I'll focus on what you should think about and not why it is this way. Below are five different areas to plan for and some of the common questions I've encountered.

-There's a long and growing list of [built-in roles](/azure/active-directory/roles/permissions-reference). Each role consists of a list of role permissions grouped together to allow specific actions to be performed. You can see these permissions in the "Description" tab inside each role. Alternatively you can see a more human readable version of these in the Microsoft 365 Admin Center. The definitions for built-in roles cannot be modified. I generally, group these into three categories:

-It is not possible to delegate everything (although the gap is decreasing), which means the Global admin role would need to be used sometimes. Configuration-as-code and automation should be considered instead of people membership of this role.

-The ability to create [custom roles](/azure/active-directory/users-groups-roles/roles-custom-overview) is a common question. This is limited in Azure AD today (see below) but will grow in capabilities over time. I think of these as applicable to functions in Azure AD and may not span "down" the hierarchy model (discussed above). Whenever I deal with "custom," I tend to go back to my principal of "simple is better."

-Another common question is ability to scope roles to a subset of a directory. One example is something like "Helpdesk Administrator for users in EU only." [Administrative Units](/azure/active-directory/users-groups-roles/directory-administrative-units) (AU) are intended to address this. Like above, I think of these as applicable to functions in Azure AD and may not span "down." Of course, certain roles don't make sense to scope (global admins, service admins, and so on).

-Today, all these roles require direct membership (or dynamic assignment if you use [Azure AD PIM](/azure/active-directory/privileged-identity-management/)). This means customers must manage these directly in Azure AD and these cannot be based on a security group membership. I'm not a fan of creating scripts to manage these as it would need to run with elevated rights. I generally recommend API integration with process systems like ServiceNow or using partner governance tools like Saviynt. There's engineering work going on to address this over time.

-I mentioned [Azure AD PIM](/azure/active-directory/privileged-identity-management/) a few times. There's a corresponding Microsoft Identity Manager (MIM) [Privileged Access Management](/microsoft-identity-manager/pam/privileged-identity-management-for-active-directory-domain-services) (PAM) solution for on-premises controls. You might also want to look at [Privileged Access Workstations](/windows-server/identity/securing-privileged-access/privileged-access-workstations) (PAWs) and [Azure AD Identity Governance](/azure/active-directory/governance/identity-governance-overview). There are various third-party tools as well, which can enable just-in-time, just-enough, and dynamic role elevation. This is usually part of a larger discussion for securing an environment.

-### Security and Compliance Center (SCC)

-[Permissions in the Office 365 Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md) are a collection of "role groups", which are separate and distinct from Azure AD roles. This can be confusing because some of these role groups have the same name as Azure AD roles (for example, Security Reader), yet they can have different membership. I prefer the use of Azure AD roles. Each role group consists of one or more "roles" (see what I mean about reusing the same word?) and have members from Azure AD, which are email enabled objects. Also, you can create a role group with the same name as a role, which may or may not contain that role (avoid this confusion).

-In a sense, these are an evolution of the Exchange role groups model. However, Exchange Online has its own [role group management](/exchange/permissions-exo) interface. Some role groups in Exchange Online are locked and managed from Azure AD or the Security & Compliance Center, but others might have the same or similar names and are managed in Exchange Online (adding to the confusion). I recommend you avoid using the Exchange Online user interface unless you need scopes for Exchange management.

-You can't create custom roles. Roles are defined by services created by Microsoft and will grow as new services are introduced. This is similar in concept to [roles defined by applications](/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps) in Azure AD. When new services are enabled, often new role groups need to be created in order to grant or delegate access to these (for example, [insider risk management](../compliance/insider-risk-management-configure.md).

-These role groups also require direct membership and cannot contain Azure AD groups. Unfortunately, today these role groups aren't supported by Azure AD PIM. Like Azure AD roles, I tend to recommend management of these through APIs or a partner governance product like Saviynt, or others.

-Security & Compliance Center roles span Microsoft 365 and you can't scope these role groups to a subset of the environment (like you can with administrative units in Azure AD). Many customers ask how they can subdelegate. For example, "create a DLP policy only for EU users." Today, if you have rights to a specific function in the Security & Compliance Center, you have rights to everything covered by this function in the tenant. However, many policies have capabilities to target a subset of the environment (for example, "make these [labels](../compliance/create-sensitivity-labels.md#publish-sensitivity-labels-by-creating-a-label-policy) available only to these users"). Proper governance and communication are a key component to avoid conflicts. Some customers choose to implement a "configuration as code" approach to address subdelegation in the Security & Compliance Center. Some specific services support subdelegation (see below).

-It's worth noting that controls currently managed through the Security & Compliance Center (protection.office.com) are in the process of being migrated to two separate admin portals: security.microsoft.com and compliance.microsoft.com. Change is the only constant!

-As stated earlier, many customers are looking to achieve a more granular delegation model. A common example: ΓÇ£Manage XYZ service only for Division X users and locationsΓÇ¥ (or some other dimension). The ability to do this depends on each service and is not consistent across services and capabilities. In-addition, each service may have a separate and unique RBAC model. Instead of discussing all of these (it will take forever), I am adding relevant links for each service. This is not a complete list, but it will get you started.

-Office 365 has a [unified audit log](../compliance/search-the-audit-log-in-security-and-compliance.md). ItΓÇÖs a very [detailed log](/office/office-365-management-api/office-365-management-activity-api-schema), but donΓÇÖt read too much into the name. It may not contain everything you want or need for your security and compliance needs. Also, some customers are really interested in [Audit (Premium)](../compliance/advanced-audit.md).

-Examples of Microsoft 365 logs that are accessed through other APIs include the following:

-I am often asked if there's a way to separate high-privilege roles between Azure AD, Azure, and SaaS (ex.: Global Administrator for Office 365 but not Azure). Not really. Multi-tenant architecture is needed if complete administrative separation is required, but that adds significant [complexity](https://aka.ms/multi-tenant-user) (see above). All these services are part of the same security/identity boundary (look at the hierarchy model above).

-It's important to understand relationships between various services in the same tenant. I am working with many customers that are building business solutions that span Azure, Office 365, and Power Platform (and often also on-premises and third-party cloud services). One common example:

-3. After all components are approved, assemble these into a unified deliverable(s) (Azure)

-[Microsoft Graph API](/azure/active-directory/develop/microsoft-graph-intro) is your best friend for these. Not impossible, but significantly more complex to design a solution spanning [multiple tenants](/azure/active-directory/develop/single-and-multi-tenant-apps).

-Started as a short summary, ended-up longer than I expected. I hope you are now ready to venture into a deep see of creating delegation model for your organization. This conversation is very common with customers. There's no one model that works for everyone. Waiting for a few planned improvements from Microsoft engineering before documenting common patterns we see across customers. In the meantime, you can work with your Microsoft account team to arrange a visit to the nearest [Microsoft Technology Center](https://www.microsoft.com/mtc). See you there!

-## Auditing and Alert Policies in the Security and Compliance Center

-[Insider risk management](../compliance/insider-risk-management.md) is a feature of the Microsoft Purview compliance portal to help you minimize internal risk by enabling you to detect, investigate, and take action on risky activities in your organization.

-If you have set up a retention policy for groups in the Security and Compliance center, the expiration policy works seamlessly with retention policy. When a group expires, the group's mailbox conversations and files in the group site are retained in the retention container for the specific number of days defined in the retention policy. Users will not see the group, or its content, after expiration however.

-# Step 1: Create a Test Base account

-If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin.

-## Enter details for test base account

-1. Search for **'Test Base'** in the Azure portal.

-

-2. Click **'Create'** to create a Test Base account.

-

-3. Read through the ```Terms of Use``` then select the checkbox to confirm your satisfaction with the ```Terms of Use```.

-

-4. Fill in the correct information under the following requirements:

- - Subscription: Resource Group

- - Instance Details: Name.

-**Currently, Test Base only supports Standard Pricing tier.**

-

-5. Finally, click on ```Review + Create``` to validate and enable your newly created account.

-## Next steps

-Advance to the next article to get started with Step 2: **Learn how upload your package.**

-> [!div class="nextstepaction"]

-> [Next step](uploadapplication.md)

-<!

-Add button for next page