| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Compare Groups | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/create-groups/compare-groups.md | Microsoft 365 Groups can be accessed through mobile apps such as Outlook for iOS Group members can send as or send on behalf of the group email address if this has been [enabled by the administrator](../../solutions/allow-members-to-send-as-or-send-on-behalf-of-group.md). -Microsoft 365 Groups don't support nesting with other Microsoft 365 Groups or with distribution or security groups. +Microsoft 365 groups support nesting through [dynamic groups in Azure Active Directory](/azure/active-directory/enterprise-users/groups-dynamic-rule-member-of). Microsoft 365 Groups can be added to one of the three SharePoint groups (Owners, Members, or Visitors) to give people permissions to the site. |
| admin | Idle Session Timeout Web Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/idle-session-timeout-web-apps.md | When a user reaches the idle timeout session you've set, they'll get a notificat ## Turn on Idle session timeout -If you aren't a Microsoft 365 or Office 365 global admin, you won't see the **Security & privacy** tab. +You must be a member of the Global admin, Security admin, Application admin or Cloud Application admin roles to see the idle session timeout setting. 1. In the Microsoft 365 admin center, select **Org Settings** **->** [Security & privacy](https://go.microsoft.com/fwlink/p/?linkid=2072756) tab and select **Idle session timeout**. |
| commerce | Understand Your Invoice2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/understand-your-invoice2.md | Your bill or invoice provides a summary of charges for your subscription and inc ## How often and when am I billed? -Depending on the billing frequency you chose when you bought your subscription, you receive an invoice either monthly, quarterly, semi-annually, or annually. The amount of time since the last invoice date is called the *Billing Period* and is on page one of the invoice. This time represents the date range during which charges accrue for the current invoice. If you made a change to your subscription outside of this date range, like adding or removing licenses, the associated charges appear on the invoice for the next billing period. +Depending on the billing frequency you chose when you bought your subscription, you receive an invoice either monthly or annually. The amount of time since the last invoice date is called the *Billing Period* and is on page one of the invoice. This time represents the date range during which charges accrue for the current invoice. If you made a change to your subscription outside of this date range, like adding or removing licenses, the associated charges appear on the invoice for the next billing period. Starting on page two of the invoice, you see the charges grouped by their *Service Period*. The service period is the date range during which you're charged to use the service. |
| commerce | Allowselfservicepurchase Powershell | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/subscriptions/allowselfservicepurchase-powershell.md | The following table lists the available products and their **ProductId**. | Windows 365 Business | CFQ7TTC0J203 | | Windows 365 Business with Windows Hybrid Benefit | CFQ7TTC0HX99 | | Microsoft 365 F3 | CFQ7TTC0LH05 |+| Dynamics 365 Marketing | CFQ7TTC0LH3N | +| Dynamics 365 Marketing Attach | CFQ7TTC0LHWP | +| Dynamics 365 Marketing Additional Application | CFQ7TTC0LHVK | +| Dynamics 365 Marketing Additional Non-Prod Application | CFQ7TTC0LHWM | *These IDs have changed. If you previously blocked products using the old IDs, they are automatically blocked using the new IDs. No additional work is required. |
| commerce | Understand Proposal Workflow | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/understand-proposal-workflow.md | -A proposal is a formal offer from Microsoft for your organization to buy Microsoft products and services. You work directly with a Microsoft representative to determine the specific products, services, and terms for your proposal. +A proposal is a formal offer from Microsoft for your organization to buy Microsoft products and services. Proposals represent large orders that your organizationΓÇÖs procurement or IT department place with Microsoft. -A Microsoft representative drafts a proposal that contains the items that you and your representative discussed. The representative sends you an email that has a link to the Azure marketplace portal. The site contains the proposal prepared specifically for you and your organization. +Before the proposal workflow begins, your procurement department works directly with a designated Microsoft representative to determine the specific products and services your organization needs. Next, your Microsoft representative drafts a proposal and sends your procurement department an email with a link to accept the proposal in the Azure marketplace portal. The site contains the proposal prepared specifically for you and your organization. -After you receive the notification email, follow the link to the proposal site. After you sign in to the site, you can start the proposal review process. +After you follow the link and sign in to the proposal site, you can start the proposal review process. After you complete the proposal review and check out, you receive an invoice for the purchased products as per the billing plan you selected. To learn how billing works for proposals, see [Understand invoicing](#understand-invoicing) below. ## Prerequisites for buying items with a proposal The Microsoft Customer Agreement (MCA) lets an organization buy Microsoft produc ## Permissions needed to sign an agreement or pay for items -You must be a billing account owner or billing account contributor to successfully sign an agreement or buy products and services. If youΓÇÖre a Global admin but donΓÇÖt have one of those roles, you can assign the roles to yourself. If youΓÇÖre not a Global admin, ask your Global admin or billing account owner to assign one of the roles to you. +You must be a billing account owner or billing account contributor to successfully sign an agreement or buy products and services. If youΓÇÖre a Global admin but donΓÇÖt have one of those roles, you can assign the roles to yourself. If youΓÇÖre not a Global admin, ask your Global admin, or billing account owner to assign one of the roles to you. The billing account owner and billing account contributor roles are assigned by using either of the following methods. For more information about billing account roles, see [Understand access to bill If this is a new billing account, and no one has accepted an agreement, you automatically become the billing account owner, provided you: - Are the person named in the proposal- **or** + or - Are already an [Azure Active Directory global admin](/azure/active-directory/roles/permissions-reference#global-administrator) for your organization ## What is the overall workflow? The overall proposal workflow looks like this: - You review the proposal, accept the MCA if needed, and finish the checkout process. > [!IMPORTANT] > You must have the authority to sign an MCA on behalf of your organization. If you don't have that authority, then someone who does must do this step.-- After checkout is finished, you're given additional links to set up your products and services.+- After checkout is finished, you're given more links to set up your products and services. ## Proposal terms The following table contains terms and definitions that appear in your proposal ||| | Billing account | An account used to manage your account settings, invoices, payment methods, and products. | | Billing profile | Information about your organization that lets you customize what items are included on your invoice, and how you pay for your invoices. The billing profile includes the billing account name, the payment methods used for the specific billing profile, contact information, invoice settings, and permissions that let you change the billing profile, pay bills, and buy products and services. |-| Existing agreements | Any agreement that your organization already has in place with Microsoft. This can include, but is not limited to, an Enterprise Agreement, Microsoft Product & Services Agreement, or Microsoft Customer Agreement. | +| Existing agreements | Any agreement that your organization already has in place with Microsoft. The agreements can include, but aren't limited to, an Enterprise Agreement, Microsoft Product & Services Agreement, or Microsoft Customer Agreement. | | Microsoft Customer Agreement (MCA) | An agreement that outlines the terms and conditions of the account held by your organization with Microsoft. | | Microsoft representative | An authorized Microsoft representative who prepares a proposal for you and your organization. | | Organization | A legal entity that uses Microsoft products, technologies, or services. | After you sign in, the first thing you do is review your organization's informat The **Your organization** section displays the billing account associated with it. The billing account information is either pulled from an existing billing account or created for you by the Microsoft representative. If your organization is an affiliate of another organization, you also see a **Lead organization** section with the name and address of that organization. -If this is the first time your organization is establishing a commercial relationship with Microsoft, and you haven't yet signed an MCA, if the information under **Your organization** or **Lead organization** is incorrect, contact the representative to make changes for you. After you've accepted an MCA, you can review and change your organization's address and contact information on the [Billing accounts](https://go.microsoft.com/fwlink/p/?linkid=2084771) page in the Microsoft 365 admin center. If your organization name changes, open a service request to have it updated. [Learn how to open a service request](../admin/get-help-support.md). +If this order is the first time your organization is establishing a commercial relationship with Microsoft, and you haven't yet signed an MCA, if the information under **Your organization** or **Lead organization** is incorrect, contact the representative to make changes for you. After you've accepted an MCA, you can review and change your organization's address and contact information on the [Billing accounts](https://go.microsoft.com/fwlink/p/?linkid=2084771) page in the Microsoft 365 admin center. If your organization name changes, open a support request to have it updated. [Learn how to open a support request](../admin/get-help-support.md). ### Your information The checkout page contains the following sections: This section shows the billing account used for the proposal. If you need to change any information, select the **Edit** link. You can also use the **Edit** link to add your organization's Tax ID. The Tax ID must be related to the country listed in the **Sold to** section. If you have a tax exemption, you must open a support ticket to request tax-exempt status. To learn more about Tax IDs, and how to apply for tax-exempt status, see-[Tax information](billing-and-payments/tax-information.md). +[Microsoft 365 tax information](billing-and-payments/tax-information.md). ### Billed to For information about billing profiles, see [Manage billing profiles](billing-an ### Proposal items in this order -This section shows a list of all items included in the proposal. The list can include one or more of the following categories: +This section shows a list of all items included in the proposal, which can include one or more of the following categories: - **Supplemental terms** A list of any amendments to the MCA that contain terms for your organization. For example, this list might include HIPAA or GDPR terms. - **Purchase now** A list of items that you pay for during checkout at the end of the proposal acceptance workflow. - **Discounts (applied to future charges)** A list of discounts that you receive as part of the proposal.-- **Included** A list of items included as part of the proposal package at no additional charge. Some of these items might have a cost associated with them in the future.+- **Included** A list of items included as part of the proposal package at no extra charge. Some of these items might have a cost associated with them in the future. > [!NOTE] > Your proposal might include subscriptions with a future start date. For more information, see [Understand invoicing for future start dates](billing-and-payments/future-start-date.md). If you're an existing Azure customer with an Enterprise Agreement, and you're si ## Understand invoicing -After you check out and complete your order, an initial invoice is sent within 24-48 hours. After that, you receive invoices around the 5th of every month. The monthly invoice contains charges from the previous month. If you have any credits for your account, they're deducted from your billing profile's monetary credits, and applied to your invoice balance. The remaining balance after credits are applied is the balance due. You have 30 days from the billing date to pay the invoice. +After you check out and complete your order, an initial invoice is sent within 24-48 hours. After that, you receive invoices around the fifth of every month. The monthly invoice contains charges from the previous month. If you have any credits for your account, they're deducted from your billing profile's monetary credits, and applied to your invoice balance. The remaining balance after credits are applied is the balance due. You have 30 days from the billing date to pay the invoice. Payment instructions for where to send check or wire transfers are included in the PDF copy of your invoice. To view or download your invoice, see [View your bill or invoice](billing-and-payments/view-your-bill-or-invoice.md). |
| compliance | Communication Compliance Investigate Remediate | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-investigate-remediate.md | The following table outlines filter details:  -### Using near and exact duplicate analysis --Communication compliance policies automatically scan and pre-group near and exact message duplicates without any additional configuration steps. This view allows you to quickly act on similar messages one-by-one or as a group, reducing the message investigation burden for reviewers. As duplicates are detected, the **Near Duplicates** and/or the **Exact Duplicates** controls are displayed in the remediation action toolbar. This view isn't available if near or exact duplicates aren't found. --#### To remediate duplicates --1. Sign into the [Microsoft Purview compliance portal](https://compliance.microsoft.com) using credentials for an admin account in your Microsoft 365 organization. --2. In the Microsoft Purview compliance portal, go to **Communication compliance**. --3. Select the **Policies** tab and then select a policy for investigation, double-click to open the **Policy** page. --4. On the **Policy** page, select either the **Pending** or **Resolved** tab to display duplicate messages. --5. Select the **Near Duplicates** or **Exact Duplicates** controls to open the duplicates details page. --6. Select one or more messages to remediation action controls for these messages. --7. Select **Resolve**, **Notify**, **Escalate**, or **Download** to apply the action to the selected duplicate messages as the default filter. --8. Select **Close** after completing the remediation actions on the messages. - ## Remediate alerts No matter where you start to review alerts or the filtering you configure, the next step is to take action to remediate the alert. Start your alert remediation using the following workflow on the **Policy** or **Alerts** pages. |
| compliance | Communication Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance.md | Built-in remediation workflows allow you to quickly identify and take action on - **Flexible remediation workflow**: New remediation workflow helps you quickly take action on policy matches, including new options to escalate messages to other reviewers and to send email notifications to users with policy matches. - **Conversation policy matching**: Messages in conversations are grouped by policy matches to give you more visibility about how conversations relate to your communication policies. For example, conversation policy matching in the *Pending Alerts* view will automatically show all messages in a Teams channel that have matches for your Inappropriate Content policy. Other messages in the conversation that don't match the Inappropriate Content policy wouldn't be displayed. - **Keyword highlighting**: Terms matching policy conditions are highlighted in the message text view to help reviewers quickly locate and remediate policy alerts.-- **Exact and near duplicate detection**: In addition to scanning for exact terms matching communication compliance policies, near duplicate detection groups textually similar terms and messages together to help speed up your review process. - **Optical character recognition (OCR) (preview)**: Scan, detect, and investigate printed and handwritten text within images embedded or attached to email or Microsoft Teams chat messages. - **New filters**: Investigate and remediate policy alerts faster with message filters for several fields, including sender, recipient, date, domains, and many more. - **Improved message views**: Investigation and remediation actions are now quicker with new message source and text views. Message attachments are now viewable to provide complete context when taking remediation actions. |
| compliance | Keyword Queries And Search Conditions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/keyword-queries-and-search-conditions.md | The following table lists the contact properties that are indexed and that you c |Surname|The name in the **Last** name property.| |Title|The title in the **Job title** property.| -## Searchable sensitive data types +<!--## Searchable sensitive data types You can use eDiscovery search tools in the compliance portal to search for sensitive data, such as credit card numbers or social security numbers, that is stored in documents on SharePoint and OneDrive for Business sites. You can do this by using the `SensitiveType` property and the name (or ID) of a sensitive information type in a keyword query. For example, the query `SensitiveType:"Credit Card Number"` returns documents that contain a credit card number. The query `SensitiveType:"U.S. Social Security Number (SSN)"` returns documents that contain a U.S. social security number. To see a list of the sensitive information types that you can search for, go to For more information about creating queries using the `SensitiveType` property, see [Form a query to find sensitive data stored on sites](form-a-query-to-find-sensitive-data-stored-on-sites.md). -### Limitations for searching sensitive data types +<!--### Limitations for searching sensitive data types - To search for custom sensitive information types, you have to specify the ID of the sensitive information type in the `SensitiveType` property. Using the name of a custom sensitive information type (as shown in the example for built-in sensitive information types in the previous section) will return no results. Use the **Publisher** column on the **Sensitive info types** page in the compliance center (or the **Publisher** property in PowerShell) to differentiate between built-in and custom sensitive information types. Built-in sensitive data types have a value of `Microsoft Corporation` for the **Publisher** property. For more information about creating queries using the `SensitiveType` property, Then you can use the ID in the `SensitiveType` search property to return documents that contain the custom sensitive data type; for example, `SensitiveType:7e13277e-6b04-3b68-94ed-1aeb9d47de37` -- You can't use sensitive information types and the `SensitiveType` search property to search for sensitive data at-rest in Exchange Online mailboxes. This includes 1:1 chat messages, 1:N group chat messages, and team channel conversations in Microsoft Teams because all of this content is stored in mailboxes. However, you can use data loss prevention (DLP) policies to protect sensitive email data in transit. For more information, see [Learn about data loss prevention](dlp-learn-about-dlp.md) and [Search for and find personal data](/compliance/regulatory/gdpr).+- You can't use sensitive information types and the `SensitiveType` search property to search for sensitive data at-rest in Exchange Online mailboxes. This includes 1:1 chat messages, 1:N group chat messages, and team channel conversations in Microsoft Teams because all of this content is stored in mailboxes. However, you can use data loss prevention (DLP) policies to protect sensitive email data in transit. For more information, see [Learn about data loss prevention](dlp-learn-about-dlp.md) and [Search for and find personal data](/compliance/regulatory/gdpr).--> ## Search operators |
| compliance | Overview Ediscovery 20 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/overview-ediscovery-20.md | f1.keywords: Previously updated : 04/08/2022 Last updated : 07/08/2022 audience: Admin At a high level, here's how eDiscovery (Premium) supports the EDRM workflow: ## Subscriptions and licensing -Licensing for eDiscovery (Premium) requires the appropriate organization subscription and per-user licensing. +For information regarding what licenses provide the rights for a user to benefit from eDiscovery (Premium) please see [Microsoft 365 guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#microsoft-purview-ediscovery) and see the "eDiscovery and auditing" section in theΓÇ»[Microsoft 365 Comparison table](https://go.microsoft.com/fwlink/?linkid=2139145). -- **Organization subscription:** To access eDiscovery (Premium) in the Microsoft Purview compliance portal, your organization must have one of the following:-- - Microsoft 365 E5 or Office 365 E5 subscription - - - Microsoft 365 E3 subscription with E5 Compliance add-on -- - Microsoft 365 E3 subscription with E5 eDiscovery and Audit add-on -- - Microsoft 365 Education A5 or Office 365 Education A5 subscription -- If you don't have an existing Microsoft 365 E5 plan and want to try eDiscovery (Premium), you can [add Microsoft 365](/office365/admin/try-or-buy-microsoft-365) to your existing subscription or [sign up for a trial](https://www.microsoft.com/microsoft-365/enterprise) of Microsoft 365 E5. --- **Per-user licensing:** To add a user as a custodian in an Advance eDiscovery case, that user must be assigned one of the following licenses, depending on your organization subscription:-- - Microsoft 365: Users must be assigned one of the following: - - - Microsoft 365 E5 license, an E5 Compliance add-on license, or an E5 eDiscovery and Audit add-on -- - Microsoft 365 Frontline users must be assigned an F5 Compliance or F5 Security & Compliance add-on -- - Microsoft 365 Education users must be assigned an A5 license -- - Office 365: Users must be assigned an Office 365 E5 or Office 365 Education A5 license. --For information about licensing, download and see the "eDiscovery and auditing" section in the [Microsoft 365 Comparison table](https://go.microsoft.com/fwlink/?linkid=2139145). --For information about how to assign licenses, see [Assign licenses to users](/microsoft-365/admin/manage/assign-licenses-to-users). --> [!NOTE] -> Users only need an E5 or A5 license (or the appropriate add-on license) to be added as custodians to an eDiscovery (Premium) case. IT admins, eDiscovery managers, lawyers, paralegals, or investigators who use eDiscovery (Premium) to manage cases and review case data don't need an E5, A5, or add-on license. +For information about how to assign licenses, seeΓÇ»[Assign licenses to users](/microsoft-365/admin/manage/assign-licenses-to-users). ## Get started with eDiscovery (Premium) |
| compliance | Retention Policies Teams | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention-policies-teams.md | When the retention policy is to retain and then delete: For the two paths in the diagram: -1. **If a chat or channel message is edited or deleted** by a user during the retention period, the original message is copied (if edited) or moved (if deleted) to the SubstrateHolds folder. The message is stored there for at least 1 day. When the retention period expires, the message is permanently deleted the next time the timer job runs (typically between 1-7 days). +1. **If a chat or channel message is edited or deleted** by a user during the retention period, the original message is copied (if edited) or moved (if deleted) to the SubstrateHolds folder. When a user deletes a Teams message, although the message disappears from the Teams app, the message doesn't go into the SubstrateHolds folder for 21 days. The message is stored in the SubstrateHolds folder for at least 1 day. When the retention period expires, the message is permanently deleted the next time the timer job runs (typically between 1-7 days). 2. **If a chat or channel message is not deleted** by a user and for current messages after editing, the message is moved to the SubstrateHolds folder after the retention period expires. This action typically takes between 1-7 days from the expiry date. When the message is in the SubstrateHolds folder, it's stored there for at least 1 day, and then the message is permanently deleted the next time the timer job runs (typically between 1-7 days). When the retention policy is retain-only, or delete-only, the content's paths ar ### Content paths for retain-only retention policy -1. **If a chat or channel message is edited or deleted** by a user during the retention period: The original message is copied (if edited) or moved (if deleted) to the SubstrateHolds folder, and retained there for at least 1 day. If the retention policy is configured to retain forever, the item remains there. If the retention policy has an end date for the retention period and it expires, the message is permanently deleted the next time the timer job runs (typically between 1-7 days). +1. **If a chat or channel message is edited or deleted** by a user during the retention period: The original message is copied (if edited) or moved (if deleted) to the SubstrateHolds folder. When a user deletes a Teams message, although the message disappears from the Teams app, the message doesn't go into the SubstrateHolds folder for 21 days. The message is stored in the SubstrateHolds folder for at least 1 day. If the retention policy is configured to retain forever, the item remains there. If the retention policy has an end date for the retention period and it expires, the message is permanently deleted the next time the timer job runs (typically between 1-7 days). 2. **If the chat or channel message is not modified or deleted** by a user and for current messages after editing during the retention period: Nothing happens before and after the retention period; the message remains in its original location. ### Content paths for delete-only retention policy -1. **If the chat or channel message is edited or deleted** by a user during the retention period: The original message is copied (if edited) or moved (if deleted) to the SubstrateHolds folder. The message is retained there for at least 1 day and permanently deleted the next time the timer job runs (typically between 1-7 days). +1. **If the chat or channel message is edited or deleted** by a user during the retention period: The original message is copied (if edited) or moved (if deleted) to the SubstrateHolds folder. When a user deletes a Teams message, although the message disappears from the Teams app, the message doesn't go into the SubstrateHolds folder for 21 days. The message is stored in the SubstrateHolds folder for at least 1 day and permanently deleted the next time the timer job runs (typically between 1-7 days). 2. **If a chat or channel message is not deleted** by a user during the retention period: At the end of the retention period, the message is moved to the SubstrateHolds folder. This action typically takes between 1-7 days from the expiry date. The message is retained there for at least 1 day and then permanently deleted the next time the timer job runs (typically between 1-7 days). Retention outcomes: - On day 5, the message is copied to the SubstrateHolds folder where it can still be searched with eDiscovery tools for a minimum of 7 years from day 1 (the retention period). - For the current (edited) message:- - On day 30, the message moves to the SubstrateHolds folder where it can still be searched with eDiscovery tools for a minimum of 7 years from day 1 (the retention period). + - On day 30, the message is no longer displayed in the Teams app and moves to the SubstrateHolds folder after 21 days where it continues to be searchable with eDiscovery tools for a minimum of 7 years from day 1 (the retention period). -If the user had deleted the current message after the specified retention period, instead of within the retention period, the message would still be moved to the SubstrateHolds folder. However, now the retention period has expired, the message would be permanently deleted after the minimum of 1 day and then typically within 1-7 days. +If the user had deleted the current message after the specified retention period, instead of within the retention period, the message would still be moved to the SubstrateHolds folder after 21 days. However, now the retention period has expired, the message would be permanently deleted there after the minimum of 1 day and then typically within 1-7 days. ##### Example 2: Retain for 30 days and then delete |
| compliance | Retention | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention.md | Title: "Learn about retention policies & labels to automatically retain or delete content" + Title: "Learn about retention policies & labels to retain or delete" f1.keywords: - NOCSH -description: Learn about retention policies and retention labels that help you to retain what you need and delete what you don't. +description: Learn about retention policies and retention labels to retain what you need and delete what you don't. # Learn about retention policies and retention labels |
| compliance | Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels.md | When you create a sensitivity label, you're asked to configure the label's scope - Which label settings you can configure for that label - Where the label will be visible to users -This scope configuration lets you have sensitivity labels that are just for documents and emails and can't be selected for containers. And similarly, sensitivity labels that are just for containers and can't be selected for documents and emails. You can also select the scope for Microsoft Purview Data Map assets: +This scope configuration lets you have sensitivity labels that are just for items such as documents and emails, and can't be selected for containers. And similarly, sensitivity labels that are just for containers and can't be selected for documents and emails. You can also select the scope for schematized data assets for Microsoft Purview Data Map:  |
| includes | Microsoft 365 Content Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-365-content-updates.md | +## Week of July 04, 2022 +++| Published On |Topic title | Change | +|||--| +| 7/4/2022 | [Identify the available PowerShell cmdlets for retention](/microsoft-365/compliance/retention-cmdlets?view=o365-21vianet) | modified | +| 7/4/2022 | [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-21vianet) | modified | +| 7/5/2022 | [Microsoft 365 Defender portal](/microsoft-365/security/defender/microsoft-365-defender-portal?view=o365-21vianet) | added | +| 7/5/2022 | [Enable Microsoft Defender for IoT integration in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/enable-microsoft-defender-for-iot-integration?view=o365-21vianet) | modified | +| 7/5/2022 | [Security recommendations](/microsoft-365/security/defender-vulnerability-management/tvm-security-recommendation?view=o365-21vianet) | modified | +| 7/5/2022 | [What is Microsoft 365 Defender?](/microsoft-365/security/defender/microsoft-365-defender?view=o365-21vianet) | modified | +| 7/5/2022 | [Onboard Microsoft Defender for IoT with Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/enable-microsoft-defender-for-iot-integration?view=o365-21vianet) | modified | +| 7/5/2022 | [Data Loss Prevention policy reference](/microsoft-365/compliance/dlp-policy-reference?view=o365-21vianet) | modified | +| 7/5/2022 | [Use network protection to help prevent connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection?view=o365-21vianet) | modified | +| 7/5/2022 | Infographic: Help protect your campaign | removed | +| 7/5/2022 | Bump up security protection for your campaign or business | removed | +| 7/5/2022 | [Setup overview for Microsoft 365 for Campaigns](/microsoft-365/business-premium/m365-campaigns-setup?view=o365-21vianet) | modified | +| 7/5/2022 | Sign in to Microsoft 365 | removed | +| 7/5/2022 | Sign up for Microsoft 365 for Campaigns | removed | +| 7/5/2022 | How these security recommendations affect your users | removed | +| 7/5/2022 | Customize sign-in page with a privacy and consent notice | removed | +| 7/5/2022 | [How Microsoft 365 Business Premium helps your business](/microsoft-365/business-premium/m365bp-secure-users?view=o365-21vianet) | modified | +| 7/5/2022 | [Configure privacy settings in Microsoft Whiteboard](/microsoft-365/whiteboard/configure-privacy-settings?view=o365-21vianet) | added | +| 7/5/2022 | [Manage GDPR data subject requests in Microsoft Whiteboard](/microsoft-365/whiteboard/gdpr-requests?view=o365-21vianet) | added | +| 7/5/2022 | [Microsoft 365 Business Premium overview](/microsoft-365/business-premium/index?view=o365-21vianet) | modified | +| 7/5/2022 | [Collaborate and share securely in Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-collaborate-share-securely?view=o365-21vianet) | modified | +| 7/5/2022 | [Set Up unmanaged devices overview](/microsoft-365/business-premium/m365bp-devices-overview?view=o365-21vianet) | modified | +| 7/5/2022 | [About Intune admin roles in the Microsoft 365 admin center](/microsoft-365/business-premium/m365bp-intune-admin-roles-in-the-mac?view=o365-21vianet) | modified | +| 7/5/2022 | [Maintain environment](/microsoft-365/business-premium/m365bp-maintain-environment?view=o365-21vianet) | modified | +| 7/5/2022 | [Protect your administrator accounts in Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-protect-admin-accounts?view=o365-21vianet) | modified | +| 7/5/2022 | [Set up and secure managed devices](/microsoft-365/business-premium/m365bp-protect-devices?view=o365-21vianet) | modified | +| 7/5/2022 | [Protect email Overview](/microsoft-365/business-premium/m365bp-protect-email-overview?view=o365-21vianet) | modified | +| 7/5/2022 | [Protect unmanaged Windows PCs and Macs in Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-protect-pcs-macs?view=o365-21vianet) | modified | +| 7/5/2022 | [Security incident management](/microsoft-365/business-premium/m365bp-security-incident-management?view=o365-21vianet) | modified | +| 7/5/2022 | [A security operations guide for Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-security-incident-quick-start?view=o365-21vianet) | modified | +| 7/5/2022 | [Increase security in Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-security-overview?view=o365-21vianet) | modified | +| 7/5/2022 | [Welcome to Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-setup-overview?view=o365-21vianet) | modified | +| 7/5/2022 | [Deploy Microsoft Defender for Endpoint on Linux manually](/microsoft-365/security/defender-endpoint/linux-install-manually?view=o365-21vianet) | modified | +| 7/5/2022 | [Submit malware and non-malware to Microsoft for analysis](/microsoft-365/security/office-365-security/submitting-malware-and-non-malware-to-microsoft-for-analysis?view=o365-21vianet) | modified | +| 7/6/2022 | [Microsoft 365 feature descriptions](/microsoft-365/admin/m365-feature-descriptions?view=o365-21vianet) | added | +| 7/6/2022 | [Assess the Microsoft 365 Active Users report](/microsoft-365/admin/activity-reports/active-users-ww?view=o365-21vianet) | modified | +| 7/6/2022 | [Microsoft 365 admin center email activity reports](/microsoft-365/admin/activity-reports/email-activity-ww?view=o365-21vianet) | modified | +| 7/6/2022 | [Microsoft 365 admin center email apps usage reports](/microsoft-365/admin/activity-reports/email-apps-usage-ww?view=o365-21vianet) | modified | +| 7/6/2022 | [Microsoft 365 admin center forms activity reports](/microsoft-365/admin/activity-reports/forms-activity-ww?view=o365-21vianet) | modified | +| 7/6/2022 | [Microsoft Dynamics 365 customer voice activity reports](/microsoft-365/admin/activity-reports/forms-pro-activity-ww?view=o365-21vianet) | modified | +| 7/6/2022 | [Microsoft 365 admin center mailbox usage reports](/microsoft-365/admin/activity-reports/mailbox-usage?view=o365-21vianet) | modified | +| 7/6/2022 | [Microsoft 365 admin center apps usage reports](/microsoft-365/admin/activity-reports/microsoft365-apps-usage-ww?view=o365-21vianet) | modified | +| 7/6/2022 | [Microsoft 365 OneDrive for Business usage reports](/microsoft-365/admin/activity-reports/onedrive-for-business-usage-ww?view=o365-21vianet) | modified | +| 7/6/2022 | [Microsoft 365 admin center Yammer activity reports](/microsoft-365/admin/activity-reports/yammer-activity-report-ww?view=o365-21vianet) | modified | +| 7/6/2022 | [Microsoft 365 admin center Yammer device usage reports](/microsoft-365/admin/activity-reports/yammer-device-usage-report-ww?view=o365-21vianet) | modified | +| 7/6/2022 | [Microsoft 365 admin center Yammer groups activity reports](/microsoft-365/admin/activity-reports/yammer-groups-activity-report-ww?view=o365-21vianet) | modified | +| 7/6/2022 | [Microsoft 365 Business Premium overview](/microsoft-365/business-premium/index?view=o365-21vianet) | modified | +| 7/6/2022 | [Apply encryption using sensitivity labels](/microsoft-365/compliance/encryption-sensitivity-labels?view=o365-21vianet) | modified | +| 7/6/2022 | [Learn about the default labels and policies to protect your data](/microsoft-365/compliance/mip-easy-trials?view=o365-21vianet) | modified | +| 7/6/2022 | [Protect macOS security settings with tamper protection](/microsoft-365/security/defender-endpoint/tamperprotection-macos?view=o365-21vianet) | modified | +| 7/6/2022 | [Investigate alerts in Microsoft 365 Defender](/microsoft-365/security/defender/investigate-alerts?view=o365-21vianet) | modified | +| 7/7/2022 | [Get started with communication compliance](/microsoft-365/compliance/communication-compliance-configure?view=o365-21vianet) | modified | +| 7/7/2022 | [Plan for communication compliance](/microsoft-365/compliance/communication-compliance-plan?view=o365-21vianet) | modified | +| 7/7/2022 | [Communication compliance policies](/microsoft-365/compliance/communication-compliance-policies?view=o365-21vianet) | modified | +| 7/7/2022 | [Communication compliance](/microsoft-365/compliance/communication-compliance-solution-overview?view=o365-21vianet) | modified | +| 7/7/2022 | [Learn about communication compliance](/microsoft-365/compliance/communication-compliance?view=o365-21vianet) | modified | +| 7/7/2022 | [Start retention when an event occurs](/microsoft-365/compliance/event-driven-retention?view=o365-21vianet) | modified | +| 7/7/2022 | [Learn about sensitivity labels](/microsoft-365/compliance/sensitivity-labels?view=o365-21vianet) | modified | +| 7/7/2022 | [Manage multifactor authentication in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-manage-mfa?view=o365-21vianet) | modified | +| 7/7/2022 | [Case study - Contoso configures an inappropriate text policy](/microsoft-365/compliance/communication-compliance-case-study?view=o365-21vianet) | modified | +| 7/7/2022 | [Create and manage communication compliance policies](/microsoft-365/compliance/communication-compliance-policies?view=o365-21vianet) | modified | +| 7/7/2022 | [Microsoft Defender for Office 365 trial playbook](/microsoft-365/security/office-365-security/trial-playbook-defender-for-office-365?view=o365-21vianet) | modified | +| 7/7/2022 | [Manage GDPR data subject requests in Microsoft Whiteboard](/microsoft-365/whiteboard/gdpr-requests?view=o365-21vianet) | modified | +| 7/8/2022 | [Delete a model in Microsoft SharePoint Syntex](/microsoft-365/contentunderstanding/delete-a-model) | added | +| 7/8/2022 | [Migrating servers from Microsoft Monitoring Agent to the unified solution](/microsoft-365/security/defender-endpoint/application-deployment-via-mecm?view=o365-21vianet) | added | +| 7/8/2022 | [Cancel your business subscription](/microsoft-365/commerce/subscriptions/cancel-your-subscription?view=o365-21vianet) | modified | +| 7/8/2022 | [Microsoft Purview solutions trial playbook](/microsoft-365/compliance/compliance-easy-trials-compliance-playbook?view=o365-21vianet) | modified | +| 7/8/2022 | [Office TLS certificate changes](/microsoft-365/compliance/encryption-office-365-tls-certificates-changes?view=o365-21vianet) | modified | +| 7/8/2022 | [Switch to Microsoft Defender for Endpoint - Setup](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2?view=o365-21vianet) | modified | ++ ## Week of June 27, 2022 | 6/10/2022 | [Create and publish retention labels by using PowerShell](/microsoft-365/compliance/bulk-create-publish-labels-using-powershell?view=o365-21vianet) | modified | | 6/10/2022 | [Manage jobs in eDiscovery (Premium)](/microsoft-365/compliance/managing-jobs-ediscovery20?view=o365-21vianet) | modified | | 6/10/2022 | [Microsoft Defender for Endpoint Device Control Removable Storage Access Control, removable storage media](/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control?view=o365-21vianet) | modified |---## Week of May 30, 2022 ---| Published On |Topic title | Change | -|||--| -| 5/31/2022 | [Detecting human-operated ransomware attacks with Microsoft 365 Defender](/microsoft-365/security/defender/playbook-detecting-ransomware-m365-defender?view=o365-21vianet) | added | -| 5/31/2022 | [Responding to ransomware attacks](/microsoft-365/security/defender/playbook-responding-ransomware-m365-defender?view=o365-21vianet) | added | -| 5/31/2022 | [Learn about retention for Yammer](/microsoft-365/compliance/retention-policies-yammer?view=o365-21vianet) | modified | -| 5/31/2022 | [Mailbox utilization service alerts](/microsoft-365/enterprise/microsoft-365-mailbox-utilization-service-alerts?view=o365-21vianet) | modified | -| 5/31/2022 | [MRS service alerts](/microsoft-365/enterprise/microsoft-365-mrs-source-delays-service-alerts?view=o365-21vianet) | modified | -| 5/31/2022 | [Compare Microsoft Defender Vulnerability Management offerings](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-capabilities?view=o365-21vianet) | modified | -| 5/31/2022 | [Creating and Testing Binary Files on Test Base](/microsoft-365/test-base/testapplication?view=o365-21vianet) | modified | -| 6/1/2022 | [What's new in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-whats-new?view=o365-21vianet) | added | -| 6/1/2022 | [Differences between document understanding and form processing models](/microsoft-365/contentunderstanding/difference-between-document-understanding-and-form-processing-model) | modified | -| 6/1/2022 | [Licensing for SharePoint Syntex](/microsoft-365/contentunderstanding/syntex-licensing) | modified | -| 6/1/2022 | [Compare Microsoft Defender Vulnerability Management offerings](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-capabilities?view=o365-21vianet) | modified | -| 6/1/2022 | [End-user notifications for Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-end-user-notifications?view=o365-21vianet) | modified | -| 6/1/2022 | [Payload automations for Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-payload-automations?view=o365-21vianet) | modified | -| 6/1/2022 | [Payloads for Attack simulation training](/microsoft-365/security/office-365-security/attack-simulation-training-payloads?view=o365-21vianet) | modified | -| 6/1/2022 | [User reported message settings](/microsoft-365/security/office-365-security/user-submission?view=o365-21vianet) | modified | -| 6/1/2022 | [Connect Microsoft Defender for Office 365 to Microsoft Sentinel](/microsoft-365/security/office-365-security/step-by-step-guides/connect-microsoft-defender-for-office-365-to-microsoft-sentinel?view=o365-21vianet) | added | -| 6/1/2022 | [Ensuring you always have the optimal security controls with preset security policies](/microsoft-365/security/office-365-security/step-by-step-guides/ensuring-you-always-have-the-optimal-security-controls-with-preset-security-policies?view=o365-21vianet) | added | -| 6/1/2022 | [How to configure quarantine permissions and policies](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-configure-quarantine-permissions-with-quarantine-policies?view=o365-21vianet) | added | -| 6/1/2022 | [(False Negatives) How to handle malicious emails that are delivered to recipients using Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-negatives-in-microsoft-defender-for-office-365?view=o365-21vianet) | added | -| 6/1/2022 | [(False Positives) How to handle legitimate emails getting blocked from delivery using Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-positives-in-microsoft-defender-for-office-365?view=o365-21vianet) | added | -| 6/1/2022 | [How to prioritize and manage Automated Investigations and Response (AIR).](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-prioritize-and-manage-automated-investigations-and-response-air?view=o365-21vianet) | added | -| 6/1/2022 | [How to prioritize, Manage, Investigate & Respond to Incidents in Microsoft 365 Defender](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-prioritize-manage-investigate-and-respond-to-incidents-in-microsoft-365-defender?view=o365-21vianet) | added | -| 6/1/2022 | [How to run attack simulations for your team](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-run-attack-simulations-for-your-team?view=o365-21vianet) | added | -| 6/1/2022 | [How to setup automated attacks and training within Attack simulation training](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-setup-attack-simulation-training-for-automated-attacks-and-training?view=o365-21vianet) | added | -| 6/1/2022 | [Optimize and correct security policies with configuration analyzer](/microsoft-365/security/office-365-security/step-by-step-guides/optimize-and-correct-security-policies-with-configuration-analyzer?view=o365-21vianet) | added | -| 6/1/2022 | [Protect your c-suite with Priority account protection in Microsoft Defender for Office 365 Plan 2](/microsoft-365/security/office-365-security/step-by-step-guides/protect-your-c-suite-with-priority-account-protection?view=o365-21vianet) | added | -| 6/1/2022 | [Search for emails and remediate threats using Threat Explorer in Microsoft 365 Defender](/microsoft-365/security/office-365-security/step-by-step-guides/search-for-emails-and-remediate-threats?view=o365-21vianet) | added | -| 6/1/2022 | [About the Exchange Administrator role](/microsoft-365/admin/add-users/about-exchange-online-admin-role?view=o365-21vianet) | modified | -| 6/2/2022 | [Clone an existing package](/microsoft-365/test-base/clonepackage?view=o365-21vianet) | added | -| 6/2/2022 | [Create device security policies in Basic Mobility and Security](/microsoft-365/admin/basic-mobility-security/create-device-security-policies?view=o365-21vianet) | modified | -| 6/2/2022 | [Wipe a mobile device in Basic Mobility and Security](/microsoft-365/admin/basic-mobility-security/wipe-mobile-device?view=o365-21vianet) | modified | -| 6/2/2022 | [Test your application on Test Base](/microsoft-365/test-base/testoverview?view=o365-21vianet) | modified | -| 6/2/2022 | [Redirecting accounts from Microsoft Defender for Identity to Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-mdi-redirection?view=o365-21vianet) | added | -| 6/2/2022 | [Learn about trainable classifiers](/microsoft-365/compliance/classifier-learn-about?view=o365-21vianet) | modified | -| 6/2/2022 | [eDiscovery (Premium) limits](/microsoft-365/compliance/limits-ediscovery20?view=o365-21vianet) | modified | -| 6/2/2022 | [What's new in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-whats-new?view=o365-21vianet) | modified | -| 6/2/2022 | [Data move general FAQ](/microsoft-365/enterprise/data-move-faq?view=o365-21vianet) | added | -| 6/2/2022 | Data move general FAQ | removed | -| 6/2/2022 | [During and after your data move](/microsoft-365/enterprise/during-and-after-your-data-move?view=o365-21vianet) | modified | -| 6/2/2022 | [IPv6 support in Microsoft 365 services](/microsoft-365/enterprise/ipv6-support?view=o365-21vianet) | modified | -| 6/2/2022 | [Moving core data to new Microsoft 365 datacenter geos](/microsoft-365/enterprise/moving-data-to-new-datacenter-geos?view=o365-21vianet) | modified | -| 6/2/2022 | [Microsoft 365 data locations](/microsoft-365/enterprise/o365-data-locations?view=o365-21vianet) | modified | -| 6/2/2022 | [How to request your data move](/microsoft-365/enterprise/request-your-data-move?view=o365-21vianet) | modified | -| 6/2/2022 | [Configure and validate exclusions based on extension, name, or location](/microsoft-365/security/defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus?view=o365-21vianet) | modified | -| 6/2/2022 | [Get started with troubleshooting mode in Microsoft Defender for Endpoint (preview)](/microsoft-365/security/defender-endpoint/enable-troubleshooting-mode?view=o365-21vianet) | modified | -| 6/2/2022 | [Microsoft Defender Antivirus event IDs and error codes](/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-21vianet) | modified | -| 6/3/2022 | [Communication compliance policies](/microsoft-365/compliance/communication-compliance-policies?view=o365-21vianet) | modified | -| 6/3/2022 | [Microsoft Defender for Business frequently asked questions](/microsoft-365/security/defender-business/mdb-faq?view=o365-21vianet) | modified | -| 6/3/2022 | [Learn about trainable classifiers](/microsoft-365/compliance/classifier-learn-about?view=o365-21vianet) | modified | -| 6/3/2022 | [Use file plan to manage retention labels](/microsoft-365/compliance/file-plan-manager?view=o365-21vianet) | modified | -| 6/3/2022 | [Case study - Contoso configures an inappropriate text policy](/microsoft-365/compliance/communication-compliance-case-study?view=o365-21vianet) | modified | -| 6/3/2022 | [Plan for communication compliance](/microsoft-365/compliance/communication-compliance-plan?view=o365-21vianet) | modified | -| 6/3/2022 | [Adjust scheduling preferences for Scheduler for Microsoft 365 Overview](/microsoft-365/scheduler/scheduler-preferences?view=o365-21vianet) | modified | -| 6/3/2022 | [Setup overview for Microsoft 365 for Campaigns](/microsoft-365/business-premium/m365-campaigns-setup?view=o365-21vianet) | added | -| 6/3/2022 | [Work with a Microsoft partner](/microsoft-365/business-premium/m365bp-ms-partner?view=o365-21vianet) | added | -| 6/3/2022 | [Threats detected by Microsoft Defender Antivirus](/microsoft-365/business-premium/m365bp-threats-detected-defender-av?view=o365-21vianet) | added | -| 6/3/2022 | [Microsoft Defender for Business Premium trial playbook](/microsoft-365/business-premium/m365bp-trial-playbook-microsoft-business-premium?view=o365-21vianet) | added | -| 6/3/2022 | [Use Microsoft Teams for collaboration](/microsoft-365/business-premium/create-teams-for-collaboration?view=o365-21vianet) | modified | -| 6/3/2022 | [Sign in to Microsoft 365](/microsoft-365/business-premium/m365-campaigns-sign-in?view=o365-21vianet) | modified | -| 6/3/2022 | [Increase threat protection for Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-increase-protection?view=o365-21vianet) | modified | -| 6/3/2022 | [Edit or set application protection settings for Windows devices](/microsoft-365/business-premium/m365bp-protection-settings-for-windows-10-devices?view=o365-21vianet) | modified | -| 6/3/2022 | [Secure Windows devices](/microsoft-365/business-premium/m365bp-secure-windows-devices?view=o365-21vianet) | modified | -| 6/3/2022 | [Welcome to Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-setup-overview?view=o365-21vianet) | modified | -| 6/3/2022 | [Set up Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-setup?view=o365-21vianet) | modified | -| 6/3/2022 | [Validate app protection settings on Android or iOS devices](/microsoft-365/business-premium/m365bp-validate-settings-on-android-or-ios?view=o365-21vianet) | modified | -| 6/3/2022 | [Validate app protection settings for Windows 10 PCs](/microsoft-365/business-premium/m365bp-validate-settings-on-windows-10-pcs?view=o365-21vianet) | modified | -| 6/3/2022 | Setup overview for Microsoft 365 for Campaigns | removed | |
| lighthouse | M365 Lighthouse Users Page Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-users-page-overview.md | description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthous # Overview of the Users page in Microsoft 365 Lighthouse -Microsoft 365 Lighthouse lets you manage users across customer tenant accounts by selecting **Users** in the left navigation pane to open the Users page. From this page, you can search for users and assess and act on the security state of your user accounts. You can also view insights into risky users and the status of multifactor authentication and self-service password reset. +Microsoft 365 Lighthouse lets you manage users across customer tenant accounts by selecting any of the links under **Users** in the left navigation pane. From Users page, you can search for users and assess and act on the security state of your user accounts. You can also view insights into risky users and the status of multifactor authentication and self-service password reset. ## Search users tab -From the Search users tab, you can quickly search across tenants for specific users and perform basic user management actions such as resetting an account password. +From the Search users tab, you can quickly search across tenants for specific users and perform common user management tasks like updating user account information, resetting passwords, assigning licenses, and managing a user's groups, mailbox, or OneDrive. :::image type="content" source="../media/m365-lighthouse-users-page-overview/users-search-users-tab.png" alt-text="Screenshot of the Search users tab."::: |
| security | TOC | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/TOC.md | ## [Overview]() ### [What is Microsoft Defender for Endpoint?](microsoft-defender-endpoint.md) +### [Trial playbook: Get the most out of your trial](defender-endpoint-trial-playbook.md) ### [Compare Defender for Endpoint plans](defender-endpoint-plan-1-2.md) ### [Minimum requirements](minimum-requirements.md) ### [What's new in Microsoft Defender for Endpoint?](whats-new-in-microsoft-defender-endpoint.md) |
| security | Configure Block At First Sight Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus.md | This article describes an antivirus/antimalware feature known as "block at first Block at first sight is a threat protection feature of next-generation protection that detects new malware and blocks it within seconds. Block at first sight is enabled when certain security settings are enabled. These settings include: -- Cloud-delivered protection;+- [Cloud protection](cloud-protection-microsoft-defender-antivirus.md); - A specified sample submission timeout (such as 50 seconds); and - A file-blocking level of high. You can confirm that block at first sight is enabled on individual client device > - If the prerequisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. > - Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. -## Validate block at first sight is working --To validate that the feature is working, download the [Block at first sight sample file](https://demo.wd.microsoft.com/Page/BAFS). To download the file, you will need an account in Azure AD that has either the Security Administrator or Global Administrator role assigned. --To validate that cloud-enabled protection is working, follow the guidance in [Validate connections between your network and the cloud](configure-network-connections-microsoft-defender-antivirus.md#validate-connections-between-your-network-and-the-cloud). --> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. - ## Turn off block at first sight > [!CAUTION] |
| security | Configure Extension File Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus.md | You can define exclusions for Microsoft Defender Antivirus that apply to [schedu - [Exclusions for files that are opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) > [!IMPORTANT]-> Microsoft Defender Antivirus exclusions don't apply to other Microsoft Defender for Endpoint capabilities, such as [attack surface reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction) and [controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders). Files that you exclude using the methods described in this article can still trigger EDR alerts and other detections. -> To exclude files broadly, add them to the Microsoft Defender for Endpoint [custom indicators](/microsoft-365/security/defender-endpoint/manage-indicators). +> Microsoft Defender Antivirus exclusions don't apply to other Microsoft Defender for Endpoint capabilities, such as [attack surface reduction (ASR) rules](attack-surface-reduction.md) and [controlled folder access](controlled-folders.md). Files that you exclude using the methods described in this article can still trigger endpoint detection and response (EDR) alerts and other detections. +> To exclude files broadly, add them to the Microsoft Defender for Endpoint [custom indicators](manage-indicators.md). ## Before you begin See [Recommendations for defining exclusions](configure-exclusions-microsoft-def To exclude certain files from Microsoft Defender Antivirus scans, you modify your exclusion lists. Microsoft Defender Antivirus includes many automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations. > [!NOTE]-> Exclusions apply to Potentially Unwanted Apps (PUA) detections as well. -> +> Exclusions apply to [potentially unwanted apps (PUA) detections](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) as well. > Automatic exclusions apply only to Windows Server 2016 and later. These exclusions are not visible in the Windows Security app and in PowerShell. The following table lists some examples of exclusions based on file extension and folder location. You can use the asterisk `*`, question mark `?`, or environment variables (such > - You can only use a maximum of six wildcards per entry. > - You cannot use a wildcard in place of a drive letter. > - An asterisk `*` in a folder exclusion stands in place for a single folder. Use multiple instances of `\*\` to indicate multiple nested folders with unspecified names.-> - Currently, Microsoft Endpoint Configuration Manager does not support wildcard characters (such as `*` or `?`). The following table describes how the wildcards can be used and provides some examples. |
| security | Configure Network Connections Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-network-connections-microsoft-defender-antivirus.md | To ensure Microsoft Defender Antivirus cloud-delivered protection works properly > [!IMPORTANT] > This article contains information about configuring network connections only for Microsoft Defender Antivirus. If you are using Microsoft Defender for Endpoint (which includes Microsoft Defender Antivirus), see [Configure device proxy and Internet connectivity settings for Defender for Endpoint](configure-proxy-internet.md). --> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. - ## Allow connections to the Microsoft Defender Antivirus cloud service The Microsoft Defender Antivirus cloud service provides fast, and strong protection for your endpoints. It's optional to enable the cloud-delivered protection service. Microsoft Defender Antivirus cloud service is recommended, because it provides important protection against malware on your endpoints and network. For more information, see [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) for enabling service with Intune, Microsoft Endpoint Configuration Manager, Group Policy, PowerShell cmdlets, or individual clients in the Windows Security app. |
| security | Controlled Folders | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/controlled-folders.md | Controlled folder access is especially useful in helping to protect your documen The [protected folders](#review-controlled-folder-access-events-in-windows-event-viewer) include common system folders (including boot sectors), and you can [add more folders](customize-controlled-folders.md#protect-additional-folders). You can also [allow apps](customize-controlled-folders.md#allow-specific-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders. -You can use [audit mode](audit-windows-defender.md) to evaluate how controlled folder access would impact your organization if it were enabled. You can also visit the Windows Defender Test ground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. --> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. +You can use [audit mode](audit-windows-defender.md) to evaluate how controlled folder access would impact your organization if it were enabled. Controlled folder access is supported on the following versions of Windows: |
| security | Defender Endpoint Plan 1 2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2.md | The following table summarizes what's included in each Defender for Endpoint pla > [!IMPORTANT] > The standalone versions of Defender for Endpoint Plan 1 and Plan 2 do not include server licenses. To onboard servers, such as endpoints running Windows Server or Linux, you'll need Defender for Servers Plan 1 or Plan 2 as part of the [Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction) offering. To learn more. see [Overview of Microsoft Defender for Servers](/azure/defender-for-cloud/defender-for-servers-introduction). +Microsoft Defender for Endpoint Plan 1 is available as a standalone user subscription license for commercial and education customers. It's also included as part of Microsoft 365 E3/A3. ++Microsoft Defender for Endpoint Plan 2, which was previously called Microsoft Defender for Endpoint, is available as a standalone license and as part of the following plans: ++- Windows 11 Enterprise E5/A5 +- Windows 10 Enterprise E5/A5 +- Microsoft 365 E5/A5/G5 (which includes Windows 10 or Windows 11 Enterprise E5) +- Microsoft 365 E5/A5/G5/F5 Security +- Microsoft 365 F5 Security & Compliance + ## Mixed licensing scenarios Suppose that your organization is using a mix of Microsoft endpoint security subscriptions, such as Defender for Endpoint Plan 1 and Defender for Endpoint Plan 2. **Currently, the highest functional Microsoft endpoint security subscription sets the experience for your tenant**. In this example, your tenant experience would be Defender for Endpoint Plan 2 for all users. However, **you can contact support and request an override for your tenant exper - [Get started with Microsoft Security (trial offers)](https://www.microsoft.com/security/business/get-started/start-free-trial) -- [Microsoft Defender for Business](../defender-business/mdb-overview.md) (endpoint protection for small and medium-sized businesses)+- [Microsoft Defender for Business](../defender-business/mdb-overview.md) (endpoint protection for small and medium-sized businesses) |
| security | Defender Endpoint Trial Playbook | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-trial-playbook.md | + + Title: Trial playbook - Microsoft Defender for Endpoint +description: Use this guide to get the most of your 90-day free trial. See how Defender for Endpoint can help prevent, detect, investigate, and respond to advanced threats. +search.appverid: MET150 ++++audience: ITPro + Last updated : 07/07/2022+ms.technology: mde +ms.localizationpriority: medium ++f1.keywords: NOCSH +++# Trial playbook: Microsoft Defender for Endpoint ++Welcome to the Microsoft Defender for Endpoint Plan 2 trial playbook! ++This playbook is a simple guide to help you make the most of your free trial. Using the suggested steps in this article from the Microsoft Defender team, you'll learn how Defender for Endpoint can help you to prevent, detect, investigate, and respond to advanced threats. ++## What is Defender for Endpoint? ++[Defender for Endpoint](microsoft-defender-endpoint.md) is an enterprise endpoint security platform that uses the following combination of technology built into Windows and Microsoft's robust cloud service: ++- **Endpoint behavioral sensors**: Embedded in Windows, these sensors collect and process behavioral signals from the operating system and send sensor data to your private, isolated, cloud instance of Defender for Endpoint. ++- **Cloud security analytics**: Using big data, device learning, and unique Microsoft optics across the Windows ecosystem, enterprise cloud products (such as Microsoft 365), and online assets, behavioral signals are translated into insights, detections, and recommended responses to advanced threats. ++- **Threat intelligence**: Generated by Microsoft hunters and security teams, and augmented by threat intelligence provided by partners, threat intelligence enables Defender for Endpoint to identify attacker tools, techniques, and procedures, and generate alerts when they're observed in collected sensor data. ++<center><h2>Microsoft Defender for Endpoint</center></h2> +<table> +<tr> +<td><a href="microsoft-defender-endpoint.md#tvm"><center><img src="images/logo-mdvm.png" alt="Vulnerability Management"> <br><b> Core Defender Vulnerability Management</b></center></a></td> +<td><a href="microsoft-defender-endpoint.md#asr"><center><img src="images/asr-icon.png" alt="Attack surface reduction"><br><b>Attack surface reduction</b></center></a></td> +<td><center><a href="microsoft-defender-endpoint.md#ngp"><img src="images/ngp-icon.png" alt="Next-generation protection"><br> <b>Next-generation protection</b></a></center></td> +<td><center><a href="microsoft-defender-endpoint.md#edr"><img src="images/edr-icon.png" alt="Endpoint detection and response"><br> <b>Endpoint detection and response</b></a></center></td> +<td><center><a href="microsoft-defender-endpoint.md#ai"><img src="images/air-icon.png" alt="Automated investigation and remediation"><br> <b>Automated investigation and remediation</b></a></center></td> +<td><center><a href="microsoft-defender-endpoint.md#mte"><img src="images/mte-icon.png" alt="Microsoft Threat Experts"><br> <b>Microsoft Threat Experts</b></a></center></td> +</tr> +<tr> +<td colspan="7"> +<a href="microsoft-defender-endpoint.md#apis"><center><b>Centralized configuration and administration, APIs</a></b></center></td> +</tr> +<tr> +<td colspan="7"><a href="microsoft-defender-endpoint.md#mtp"><center><b>Microsoft 365 Defender</a></center></b></td> +</tr> +</table> +<br> ++**Let's get started!** ++## Set up your trial ++1. [Confirm your license state](#step-1-confirm-your-license-state). +2. [Set up role-based access control and grant permissions to your security team](#step-2-set-up-role-based-access-control-and-grant-permissions-to-your-security-team). +3. [Visit the Microsoft 365 Defender portal](#step-3-visit-the-microsoft-365-defender-portal). +4. [Onboard endpoints using any of the supported management tools](#step-4-onboard-endpoints-using-any-of-the-supported-management-tools). +5. [Configure capabilities](#step-5-configure-capabilities). +6. [Experience Microsoft Defender for Endpoint through simulated attacks](#step-6-experience-microsoft-defender-for-endpoint-through-simulated-attacks). +7. [Set up the Microsoft Defender for Endpoint evaluation lab](#step-7-set-up-the-microsoft-defender-for-endpoint-evaluation-lab). ++## Step 1: Confirm your license state ++To make sure your Defender for Endpoint subscription is properly provisioned, you can check your license state in either the Microsoft 365 admin center ([https://admin.microsoft.com](https://admin.microsoft.com)) or Azure Active Directory ([https://portal.azure.com](https://portal.azure.com/#blade/Microsoft_AAD_IAM/LicensesMenuBlade/Products)). ++[Check your license state](production-deployment.md#check-license-state). ++## Step 2: Set up role-based access control and grant permissions to your security team ++Microsoft recommends using the concept of least privileges. Defender for Endpoint uses built-in roles within Azure Active Directory. [Review the different roles that are available](/azure/active-directory/roles/permissions-reference) and choose appropriate roles for your security team. Some roles may need to be applied temporarily and removed after the trial has been completed. ++Use [Privileged Identity Management](/azure/active-directory/active-directory-privileged-identity-management-configure) to manage your roles to provide extra auditing, control, and access review for users with directory permissions. ++Defender for Endpoint supports two ways to manage permissions: ++- Basic permissions management: Set permissions to either full access or read-only. Users with Global Administrator or Security Administrator roles in Azure Active Directory have full access. The Security reader role has read-only access and doesn't grant access to view machines/device inventory. +- Role-based access control (RBAC): Set granular permissions by defining roles, assigning Azure AD user groups to the roles, and granting the user groups access to device groups. For more information, see [Manage portal access using role-based access control](rbac.md). ++## Step 3: Visit the Microsoft 365 Defender portal ++The Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) is where you can access your Defender for Endpoint capabilities. ++1. [Review what to expect](../defender/microsoft-365-defender-portal.md) in the Microsoft 365 Defender portal. ++2. Go to [https://security.microsoft.com](https://security.microsoft.com) and sign in. ++3. In the navigation pane, see the **Endpoints** section to access your capabilities. ++## Step 4: Onboard endpoints using any of the supported management tools ++This section outlines the general steps you to onboard devices (endpoints). ++1. [Watch this video](https://www.microsoft.com/videoplayer/embed/RE4bGqr) for a quick overview of the onboarding process and learn about the available tools and methods. ++2. Review your [device onboarding tool options](onboarding.md) and select the most appropriate option for your environment. ++## Step 5: Configure capabilities ++After onboarding devices (endpoints), you'll configure the various capabilities, such as endpoint detection and response, next-generation protection, and attack surface reduction. ++Use [this table](onboarding.md) to choose components to configure. We recommend configuring all available capabilities, but you're able to skip the ones that don't apply. ++## Step 6: Experience Microsoft Defender for Endpoint through simulated attacks ++You might want to experience Defender for Endpoint before you onboard more than a few devices to the service. To do this, you can run controlled attack simulations on a few test devices. After running the simulated attacks, you can review how Defender for Endpoint surfaces malicious activity and explore how it enables an efficient response. ++To run any of the provided simulations, you need at least [one onboarded device](onboard-configure.md). ++1. Access the tutorials. In the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), in the navigation pane, under **Endpoints**, choose **Tutorials**. ++2. Read the walkthrough document provided with each attack scenario. Each document includes OS and application requirements and detailed instructions that are specific to an attack scenario. ++3. [Run a simulation](attack-simulations.md). ++## Step 7: Set up the Microsoft Defender for Endpoint evaluation lab ++The Microsoft Defender for Endpoint evaluation lab is designed to eliminate the complexities of device and environment configuration so that you can focus on evaluating the capabilities of the platform, running simulations, and seeing the prevention, detection, and remediation features in action. Using the simplified set-up experience in evaluation lab, you can focus on running your own test scenarios and the pre-made simulations to see how Defender for Endpoint performs. ++- [Watch the video overview](https://www.microsoft.com/videoplayer/embed/RE4qLUM) of the evaluation lab +- [Get started with the lab](evaluation-lab.md) +++## See also ++- [Defender for Endpoint technical documentation](microsoft-defender-endpoint.md) +- [Microsoft Security technical content library](https://www.microsoft.com/security/content-library/Home/Index) +- [Defender for Endpoint demonstration](https://cdx.transform.microsoft.com/experience-detail/d5eca65d-13a3-464d-9171-c24cf9dd6050) + |
| security | Deployment Vdi Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus.md | -> [!NOTE] -> The Defender for Endpoint demo site at `demo.wd.microsoft.com` is deprecated and will be removed in the future. - This guide describes how to configure your VMs for optimal protection and performance, including how to: - [Set up a dedicated VDI file share for security intelligence updates](#set-up-a-dedicated-vdi-file-share) This guide describes how to configure your VMs for optimal protection and perfor - [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline) - [Apply exclusions](#exclusions) -You can also download the whitepaper [Microsoft Defender Antivirus on Virtual Desktop Infrastructure](https://demo.wd.microsoft.com/Content/wdav-testing-vdi-ssu.pdf), which looks at the new shared security intelligence update feature, alongside performance testing and guidance on how you can test antivirus performance on your own VDI. - For more information on Microsoft Remote Desktop Services and VDI support, see [Azure Virtual Desktop Documentation](/azure/virtual-desktop). For Azure-based virtual machines, see [Install Endpoint Protection in Microsoft Defender for Cloud](/azure/defender-for-cloud/endpoint-protection-recommendations-technical). |
| security | Detect Block Potentially Unwanted Apps Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md | You can enable PUA protection with [Microsoft Intune](/mem/intune/protect/device You can also use PUA protection in audit mode to detect potentially unwanted applications without blocking them. The detections are captured in the Windows event log. -> [!TIP] -> Visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com/Page/UrlRep) to confirm that the feature is working, and see it in action. --> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. - PUA protection in audit mode is useful if your company is conducting an internal software security compliance check and you'd like to avoid any false positives. ### Use Intune to configure PUA protection |
| security | Evaluate Controlled Folder Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/evaluate-controlled-folder-access.md | It is especially useful in helping protect against [ransomware](https://www.micr This article helps you evaluate controlled folder access. It explains how to enable audit mode so you can test the feature directly in your organization. -> [!TIP] -> You can also visit the Microsoft Defender for Endpoint demo scenario website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. --> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. - ## Use audit mode to measure impact Enable the controlled folder access in audit mode to see a record of what *would* have happened if it was fully enabled. Test how the feature will work in your organization to ensure it doesn't affect your line-of-business apps. You can also get an idea of how many suspicious file modification attempts generally occur over a certain period of time. |
| security | Evaluate Exploit Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/evaluate-exploit-protection.md | Last updated In audit, you can see how mitigation works for certain apps in a test environment. This shows what *would* have happened if you enabled exploit protection in your production environment. This way, you can verify that exploit protection doesn't adversely affect your line-of-business apps, and see which suspicious or malicious events occur. -> [!TIP] -> You can also visit the Microsoft Defender demo scenarios website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how exploit protection works. --> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. - ## Enable exploit protection for testing You can set mitigations in a testing mode for specific programs by using the Windows Security app or Windows PowerShell. |
| security | Evaluate Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/evaluate-microsoft-defender-antivirus.md | -Use this guide to determine how well Microsoft Defender Antivirus protects you from viruses, malware, and potentially unwanted applications. --> [!TIP] ->You can also visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work: -> -> - Cloud-delivered protection -> - Fast learning (including Block at first sight) -> - Potentially unwanted application blocking --> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. --It explains the important next-generation protection features of Microsoft Defender Antivirus available for both small and large enterprises, and how they increase malware detection and protection across your network. +Use this guide to determine how well Microsoft Defender Antivirus protects you from viruses, malware, and potentially unwanted applications. It explains the important next-generation protection features of Microsoft Defender Antivirus available for both small and large enterprises, and how they increase malware detection and protection across your network. You can choose to configure and evaluate each setting independently, or all at once. We have grouped similar settings based upon typical evaluation scenarios, and include instructions for using PowerShell to enable the settings. |
| security | Evaluate Network Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/evaluate-network-protection.md | Last updated This article helps you evaluate network protection by enabling the feature and guiding you to a testing site. The sites in this evaluation article aren't malicious. They're specially created websites that pretend to be malicious. The site will replicate the behavior that would happen if a user visited a malicious site or domain. -> [!TIP] -> You can also visit the Microsoft Defender demo scenarios website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how other protection features work. --> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. - ## Enable network protection in audit mode Enable network protection in audit mode to see which IP addresses and domains would have been blocked. You can make sure it doesn't affect line-of-business apps, or get an idea of how often blocks occur. |
| security | Evaluation Lab | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/evaluation-lab.md | Automated investigation settings will be dependent on tenant settings. It will b > In the **Simulator status** column, you can hover over the information icon to know the installation status of an agent. -## Add a domain controller (Preview) --> [!IMPORTANT] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +## Add a domain controller Add a domain controller to run complex scenarios such as lateral movement and multistage attacks across multiple devices. |
| security | Import Export Exploit Protection Emet Xml | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/import-export-exploit-protection-emet-xml.md | Exploit protection helps protect devices from malware that use exploits to sprea You use the Windows Security app or PowerShell to create a set of mitigations (known as a configuration). You can then export this configuration as an XML file and share it with multiple devices on your network. Then, they all have the same set of mitigation settings. -The [Evaluation Package](https://demo.wd.microsoft.com/Page/EP) contains a sample configuration file (name *ProcessMitigation.xml* (Selfhost v4) you can use to see how the XML structure looks. The sample file also contains settings that have been converted from an [Enhanced Mitigation Experience Toolkit (no longer supported)](/lifecycle/products/enhanced-mitigation-experience-toolkit-emet) configuration. You can open the file in a text editor (such as Notepad) or import it directly into exploit protection and review the settings in the Windows Security app. --> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. - ## Create and export a configuration file Before you export a configuration file, you need to ensure you have the correct settings. First, configure exploit protection on a single, dedicated device. See [Customize exploit protection](customize-exploit-protection.md) for more information about configuring mitigations. |
| security | Microsoft Defender Antivirus Windows | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows.md | If you're using a non-Microsoft antivirus/antimalware product on your device, yo The following table describes what to expect when Microsoft Defender Antivirus is in active mode, passive mode, or disabled. -<br/><br/> - | Mode | What happens | ||| | Active mode | In active mode, Microsoft Defender Antivirus is used as the primary antivirus app on the device. Files are scanned, threats are remediated, and detected threats are listed in your organization's security reports and in your Windows Security app. | To learn more, see [Microsoft Defender Antivirus compatibility](microsoft-defend ## Check the state of Microsoft Defender Antivirus on your device -If you want to check the state of Microsoft Defender Antivirus on your device, you can use one of several methods, such as the Windows Security app or Windows PowerShell. +You can use one of several methods, such as the Windows Security app or Windows PowerShell, to check the state of Microsoft Defender Antivirus on your device. -### Use the Windows Security app to check status of Microsoft Defender Antivirus +### Use the Windows Security app to check the status of Microsoft Defender Antivirus -1. On your Windows device, select the Start menu, and begin typing `Security`. Then open the Windows Security app in the results. +1. On your Windows device, select the **Start** menu, and begin typing `Security`. Then open the Windows Security app in the results. 2. Select **Virus & threat protection**. -3. Under **Virus & threat protection settings**, choose **Manage settings**. +3. Under **Who's protecting me?**, choose **Manage Providers**. -You'll see the name of your antivirus/antimalware solution on the settings page. +You'll see the name of your antivirus/antimalware solution on the security providers page. -### Use PowerShell to check status of Microsoft Defender Antivirus +### Use PowerShell to check the status of Microsoft Defender Antivirus -1. Select the Start menu, and begin typing `PowerShell`. Then open Windows PowerShell in the results. +1. Select the **Start** menu, and begin typing `PowerShell`. Then open Windows PowerShell in the results. 2. Type `Get-MpComputerStatus`. You'll see the name of your antivirus/antimalware solution on the settings page. ## Get your antivirus/antimalware platform updates -It's important to keep Microsoft Defender Antivirus, or any antivirus/antimalware solution, up to date. Microsoft releases regular updates to help ensure that your devices have the latest technology to protect against new malware and attack techniques. To learn more, see [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md). +It's important to keep Microsoft Defender Antivirus (or any antivirus/antimalware solution) up to date. Microsoft releases regular updates to help ensure that your devices have the latest technology to protect against new malware and attack techniques. To learn more, see [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md). > [!TIP] > If you're looking for Antivirus related information for other platforms, see: |
| security | Next Generation Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/next-generation-protection.md | Microsoft Defender for Endpoint includes next-generation protection to reinforce > Next-generation protection is included in both Microsoft Defender for Endpoint Plan 1 and Plan 2. [Learn more about Defender for Endpoint Plan 1 and Plan 2](defender-endpoint-plan-1-2.md) > Next-generation protection is also included in Microsoft Defender for Business and Microsoft 365 Business Premium. [Compare security features in Microsoft 365 plans for small and medium-sized businesses](../defender-business/compare-mdb-m365-plans.md). -## Try a demo! --Visit the [Microsoft Defender for Endpoint demo website](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following protection features are working and explore them using demo scenarios: --- Cloud-delivered protection-- Block at first sight (BAFS) protection-- Potentially unwanted applications (PUA) protection--> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. - ## Configure next-generation protection services For information on how to configure next-generation protection services, see [Configure Microsoft Defender Antivirus features](configure-microsoft-defender-antivirus-features.md). |
| security | Onboard Downlevel | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/onboard-downlevel.md | The following steps are required to enable this integration: Review the following details to verify minimum system requirements: -- Install the [February 2018 monthly update rollup](https://support.microsoft.com/help/4074598/windows-7-update-kb4074598)+- Install the [February 2018 monthly update rollup](https://support.microsoft.com/help/4074598/windows-7-update-kb4074598) - Direct download link from the Windows Update catalog is available [here](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4074598) ++- Install the [March 12, 2019 (or later) Servicing stack update](https://support.microsoft.com/topic/servicing-stack-update-for-windows-7-sp1-and-windows-server-2008-r2-sp1-march-12-2019-b4dc0cff-d4f2-a408-0cb1-cb8e918feeba) - Direct download link from the Windows Update catalog is available [here](https://www.catalog.update.microsoft.com/search.aspx?q=4490628) ++- Install the [SHA-2 code signing support update](https://support.microsoft.com/topic/sha-2-code-signing-support-update-for-windows-server-2008-r2-windows-7-and-windows-server-2008-september-23-2019-84a8aad5-d8d9-2d5c-6d78-34f9aa5f8339) - Direct download link from the Windows Update catalog is available [here](https://www.catalog.update.microsoft.com/search.aspx?q=kb4474419) > [!NOTE] > Only applicable for Windows Server 2008 R2, Windows 7 SP1 Enterprise, and Windows 7 SP1 Pro. - Install the [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/help/3080149/update-for-customer-experience-and-diagnostic-telemetry) -- Install either [.NET framework 4.5](https://www.microsoft.com/download/details.aspx?id=30653) (or later) or [KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework)+- Install [Microsoft .Net Framework 4.5.2 or later](https://www.microsoft.com/en-US/download/details.aspx?id=42642) > [!NOTE]- > Only applicable for Windows Server 2008 R2, Windows 7 SP1 Enterprise, and Windows 7 SP1 Pro. - > - > Don't install .NET Framework 4.0.x, since it will negate the above installation. - > > Installation of .NET 4.5 might require you to restart your computer after installation. - Meet the Azure Log Analytics agent minimum system requirements. For more information, see [Collect data from computers in you environment with Log Analytics](/azure/log-analytics/log-analytics-concept-hybrid#prerequisites) |
| security | Overview Attack Surface Reduction | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction.md | Use Defender for Endpoint to get greater details for each event. These details a You can enable audit mode using Group Policy, PowerShell, and configuration service providers (CSPs). -> [!TIP] -> You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work. --> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. - | Audit options | How to enable audit mode | How to view events | |||| | Audit applies to all events | [Enable controlled folder access](enable-controlled-folders.md) | [Controlled folder access events](evaluate-controlled-folder-access.md#review-controlled-folder-access-events-in-windows-event-viewer) | |
| security | Prevent Changes To Security Settings With Tamper Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection.md | If your organization uses Microsoft Endpoint Manager (MEM) you can turn tamper p ### Requirements for managing tamper protection in Endpoint Manager -- Your devices must be [onboarded to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboarding). - You must have appropriate [permissions](/microsoft-365/security/defender-endpoint/assign-portal-access) assigned, such as global admin, security admin, or security operations. - Your organization uses [Microsoft Endpoint Manager to manage devices](/mem/endpoint-manager-getting-started). (Microsoft Endpoint Manager (MEM) licenses are required; MEM is included in Microsoft 365 E3/E5, Enterprise Mobility + Security E3/E5, Microsoft 365 Business Premium, Microsoft 365 F1/F3, Microsoft 365 Government G3/G5, and corresponding education licenses.) - Your Windows devices must be running Windows 11 or Windows 10 [1709](/lifecycle/announcements/revised-end-of-service-windows-10-1709), [1803](/lifecycle/announcements/windows-server-1803-end-of-servicing), [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), or later. (For more information about releases, see [Windows 10 release information](/windows/release-health/release-information).) |
| security | Switch To Mde Phase 3 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/switch-to-mde-phase-3.md | To verify that your onboarded devices are properly connected to Defender for End |Operating system|Guidance| |||-|Windows 10 or later<br/><br/>Windows Server 2022<br/><br/>Windows Server 2019<br/><br/>Windows Server, version 1803, or later<br/><br/>Windows Server 2016<br/><br/>Windows Server 2012 R2|See [Run a detection test](run-detection-test.md).<br/><br/>Visit the Defender for Endpoint demo scenarios site (<https://demo.wd.microsoft.com>) and try one or more of the scenarios. For example, try the **Cloud-delivered protection** demo scenario.| +|Windows 10 or later<br/><br/>Windows Server 2022<br/><br/>Windows Server 2019<br/><br/>Windows Server, version 1803, or later<br/><br/>Windows Server 2016<br/><br/>Windows Server 2012 R2|See [Run a detection test](run-detection-test.md).| |macOS (see [System requirements](microsoft-defender-endpoint-mac.md)|Download and use the DIY app at <https://aka.ms/mdatpmacosdiy>. <br/><br/> For more information, see [Defender for Endpoint on macOS](microsoft-defender-endpoint-mac.md).| |Linux (see [System requirements](microsoft-defender-endpoint-linux.md#system-requirements))|1. Run the following command, and look for a result of **1**: `mdatp health --field real_time_protection_enabled`.<br/><br/>2. Open a Terminal window, and run the following command: `curl -o ~/Downloads/eicar.com.txt https://www.eicar.org/download/eicar.com.txt`.<br/><br/>3. Run the following command to list any detected threats: `mdatp threat list`.<br/><br/>For more information, see [Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md).| -> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. - ## Confirm that Microsoft Defender Antivirus is in passive mode on your endpoints Now that your endpoints have been onboarded to Defender for Endpoint, your next step is to make sure Microsoft Defender Antivirus is running in passive mode. You can use one of several methods, as described in the following table: To get help with uninstalling your non-Microsoft solution, contact their technic ## Make sure Defender for Endpoint is working correctly -Now that you have onboarded to Defender for Endpoint, and you have uninstalled your former non-Microsoft solution, your next step is to make sure that Defender for Endpoint working correctly. One good way to perform this task is by visiting the Defender for Endpoint demo scenarios site ([https://demo.wd.microsoft.com](https://demo.wd.microsoft.com)). Try one or more of the demo scenarios on that page, including at least the following: --- Cloud-delivered protection+Now that you have onboarded to Defender for Endpoint, and you have uninstalled your former non-Microsoft solution, your next step is to make sure that Defender for Endpoint working correctly. -- Potentially Unwanted Applications (PUA)+1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) and sign in. -- Network Protection (NP)+2. In the navigation pane, choose **Endpoints** > **Device inventory**. There, you'll be able to see protection status for devices. -> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. +To learn more, see [Device inventory](machines-view-overview.md). ## Next steps |
| security | Troubleshoot Asr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-asr.md | If these prerequisites have all been met, proceed to the next step to test the r ## Use audit mode to test the rule -You can visit the Windows Defender Test ground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm attack surface reduction rules are generally working for pre-configured scenarios and processes on a device, or you can use audit mode, which enables rules for reporting only. --> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. - Follow these instructions in [Use the demo tool to see how attack surface reduction rules work](evaluate-attack-surface-reduction.md) to test the specific rule you're encountering problems with. 1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to **Audit mode** (value: **2**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md). Audit mode allows the rule to report the file or process, but will still allow it to run. |
| security | Troubleshoot Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus.md | The tables list: - [Microsoft Defender Antivirus client error codes](#error-codes) - [Internal Microsoft Defender Antivirus client error codes (used by Microsoft during development and testing)](#internal-error-codes) -> [!TIP] -> You can also visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working: -> - Cloud-delivered protection -> - Fast learning (including Block at first sight) -> - Potentially unwanted application blocking --> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. <a id="windows-defender-av-ids"></a> ## Microsoft Defender Antivirus event IDs |
| security | Use | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/use.md | - Title: Overview of Microsoft Defender Security Center -description: Learn about the features on Microsoft Defender Security Center, including how alerts work, and suggestions on how to investigate possible breaches and attacks. -keywords: dashboard, alerts queue, manage alerts, investigation, investigate alerts, investigate devices, submit files, deep analysis, high, medium, low, severity, ioc, ioa -search.product: eADQiWindows 10XVcnh -ms.sitesec: library -ms.pagetype: security --------# Overview of Microsoft Defender Security Center ----**Applies to:** -- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/?linkid=2154037)-- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)---> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-usewdatp-abovefoldlink) --Microsoft Defender Security Center is the portal where you can access Microsoft Defender for Endpoint capabilities. --Use the **Defender Vulnerability Management** dashboard to expand your visibility on the overall security posture of your organization. You'll see devices that require attention and recommendations that can help you reduce the attack surface in your organization. --Use the **Threat analytics** dashboard to continually assess and control risk exposure to Spectre and Meltdown. --## Microsoft Defender for Endpoint interactive guide -In this interactive guide, you'll learn how to investigate threats to your organization with Microsoft Defender for Endpoint. You'll see how Microsoft Defender for Endpoint can help you identify suspicious activities, investigate risks to your organization, and remediate threats. --[Check out the interactive guide](https://aka.ms/MSDE-IG) --### In this section --Topic | Description -:|: -[Portal overview](portal-overview.md) | Understand the portal layout and area descriptions. -[View the Defender Vulnerability Management dashboard](../defender-vulnerability-management/tvm-dashboard-insights.md) | The **Defender Vulnerability Management dashboard** lets you view exposure and Microsoft Secure Score for Devices side-by-side with top security recommendations, software vulnerability, remediation activities, and exposed devices. -[View the Threat analytics dashboard and take recommended mitigation actions](threat-analytics.md) | The **Threat analytics** dashboard helps you continually assess and control risk exposure to threats. Use the charts to quickly identify devices for the presence or absence of mitigations. |
| security | View Incidents Queue | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/view-incidents-queue.md | On the top navigation you can: - Batch-select the incidents to assign - Navigate between pages - Apply filters+- Customize and apply date ranges :::image type="content" source="images/atp-incident-queue.png" alt-text="The Incidents queue" lightbox="images/atp-incident-queue.png"::: |
| security | Whats New In Microsoft Defender Endpoint | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint.md | For more information on Microsoft Defender for Endpoint on other operating syste - [What's new in Defender for Endpoint on iOS](ios-whatsnew.md) - [What's new in Defender for Endpoint on Linux](linux-whatsnew.md) ++## July 2022 ++++ ## June 2022 - [Defender for Servers Plan 2 now integrates with MDE unified solution](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/defender-for-servers-plan-2-now-integrates-with-mde-unified/ba-p/3527534)<br>You can now start deploying the modern, unified solution for Windows Server 2012 R2 and 2016 to servers covered by Defender for Servers Plan 2 using a single button. ## May 2022 - [Tamper protection for macOS (preview)](tamperprotection-macos.md)<br>Tamper protection helps prevent unauthorized removal of Microsoft Defender for Endpoint on macOS. -- [Add domain controller devices - Evaluation lab enhancement (preview)](evaluation-lab.md#add-a-domain-controller-preview)<br>Add a domain controller to run complex scenarios such as lateral movement and multistage attacks across multiple devices.+- [Add domain controller devices - Evaluation lab enhancement (preview)](evaluation-lab.md#add-a-domain-controller)<br>Add a domain controller to run complex scenarios such as lateral movement and multistage attacks across multiple devices. ## April 2022 - [Updated onboarding and feature parity for Windows Server 2012 R2 and Windows Server 2016)](configure-server-endpoints.md)<br/> The new unified solution package is now generally available and makes it easier to onboard servers by removing dependencies and installation steps. In addition, this unified solution package comes with many new feature improvements. |
| security | Export Incidents Queue | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/export-incidents-queue.md | + + Title: Export incidents queue to CSV files +description: Learn about the newly introduced Export button to migrate incidents queue-related data to CSV files +keywords: incident, queue, export, csv +search.product: eADQiWindows 10XVcnh +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +++ms.localizationpriority: medium ++audience: ITPro ++ - M365-security-compliance + - m365initiative-m365-defender +++search.appverid: + - MOE150 + - MET150 +ms.technology: m365d +++# Export incidents queue to CSV files ++++**Applies to:** +- Microsoft 365 Defender ++The **Export** feature allows you to export the data in the incident queue that is displayed according to the applied filters and time ranges. It's available in the form of a button named **Export**, as displayed in the following screenshot: +++When you click the **Export** button, the data is exported to a CSV file. You can apply various filters and time ranges to the incidents queue (not just in the context of exporting the data, but in a generic context). When you select **Export**, whichever filters and/or time ranges are applied to the incidents queue, such data is exported to the CSV file. ++Once you export the incidents queue-related data onto the CSV file, you can analyze the data and filter it further, based on your requirements. ++For example, for the data on the CSV file, you can apply filters to view the following data: +- Data regarding how many high-severity incidents you had in the last 30 days. +- Data regarding who is your most productive analyst. ++If you have thoughts or suggestions about the new **Export** feature (the **Export** button) for the incident queue, contact Microsoft team or send your feedback through the Microsoft 365 Defender portal. |
| security | Microsoft 365 Security Center Mdi | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-center-mdi.md | + + Title: Microsoft Defender for Identity in Microsoft 365 Defender +description: Learn about changes from the Microsoft Defender for Identity to Microsoft 365 Defender +keywords: Getting started with Microsoft 365 Defender, Microsoft Defender for Identity, NDI +ms.mktglfcycl: deploy +ms.localizationpriority: medium +f1.keywords: +- NOCSH +++ Last updated : 07/06/2022+audience: ITPro ++search.appverid: +- MOE150 +- MET150 ++- M365-security-compliance ++++# Microsoft Defender for Identity in Microsoft 365 Defender +++**Applies to:** ++- [Microsoft 365 Defender](microsoft-365-defender.md) +- [Microsoft Defender for Identity](/defender-for-identity/) ++Microsoft Defender for Identity is now part of Microsoft 365 Defender. The Microsoft 365 Defender portal allows security admins to perform their security tasks in one location. This will simplify workflows, and add the functionality of the other Microsoft 365 Defender services. Microsoft 365 Defender will be the home for monitoring and managing security across your Microsoft identities, data, devices, apps, and infrastructure. ++Microsoft Defender for Identity contributes identity focused information into the incidents and alerts that Microsoft 365 Defender presents. This information is key to providing context and correlating alerts from the other products within Microsoft 365 Defender. ++## Quick reference ++The table below lists the changes in navigation between Microsoft Defender for Identity and Microsoft 365 Defender. ++| **Defender for** Identity | **Microsoft 365 Defender** | +| -- | | +| Timeline | Microsoft 365 Defender Alerts/Incidents queue | +| Reports | Will remain in the [classic Defender for Identity portal](/defender-for-identity/classic-workspace-portal). <br> Customized reports can be created in the Microsoft 365 Defender portal using [Advanced hunting](#advanced-hunting-new). | +| User page | Microsoft 365 Defender User page | +| Device page | Microsoft 365 Defender Device page | +| Group page | Microsoft 365 Defender groups side pane | +| Alert page | Microsoft 365 Defender Alert page | +| Search | Microsoft 365 Defender Search | +| Health center | Settings -> Identities -> Sensors | +| Entity Activities | Advanced hunting | +| Settings | Settings -> Identities | +| Users and accounts | Assets -> Identities | +| Identity security posture | [Microsoft Defender for Identity's security posture assessments](/defender-for-identity/security-assessment) | +| Onboarding a new Workspace | Settings -> Identities (automatically) | ++## What's changed ++### Defender for Identity settings ++To access the Microsoft Defender for Identity configuration settings, in [Microsoft 365 Defender](https://security.microsoft.com), go to **Settings** and then **Identities**. ++### Defender for Identity security posture ++All the identity security posture management assessments that were previously accessible in Defender for Cloud Apps are now available in Microsoft Secure Score, which can be found at <https://security.microsoft.com/securescore> in the [Microsoft 365 Defender portal](https://security.microsoft.com). For more information, see [Microsoft Defender for Identity's security posture assessments](/defender-for-identity/security-assessment). ++### Global search ++Global search in Microsoft 365 Defender (using the search bar at the top of the page) allows security teams to look for any entity being monitored by Microsoft 365 Defender, be it identity, endpoint, Office 365 data, and more. Results can be interacted with directly from the search drop-down, or security teams can choose to select **All users** or **All devices** to see all entities associated with that search term. ++### Onboarding and administration ++The onboarding process is now automatic for new customers, with no need to manually configure a workspace. Additionally, all the admin features are available under the **Identities** menu in Microsoft 365 DefenderΓÇÖs Settings. ++### Alerting and incident correlation ++Defender for Identity alerts are now included in Microsoft 365 DefenderΓÇÖs alert queue, making them available to the auto incident correlation feature. This ensures that all alerts are available in one place, and that the scope of a breach can be determined quicker than before. For more information, see [Defender for Identity security alerts in Microsoft 365 Defender](/defender-for-identity/manage-security-alerts). ++### Advanced hunting (new) ++You can now proactively search for threats and malicious activity by using advanced hunting queries. These powerful queries can be used to locate and review threat indicators and entities for both known and potential threats. ++Custom detection rules can be built from advanced hunting queries to help you proactively watch for events that might be indicative of breach activity and misconfigured devices. For more information, see [Proactively hunt for threats with advanced hunting in Microsoft 365 Defender](advanced-hunting-overview.md). ++### Alert exclusions (updated) ++The alert interface is more user friendly, including adding a useful search function. Additionally, it now includes global exclusions. This means that any entity can be excluded from all alerts generated by Defender for Identity, helping with any testing scenarios you may have. For more information, see [Configure Defender for Identity detection exclusions in Microsoft 365 Defender](/defender-for-identity/exclusions). ++### Entity profiles ++Defender for Identity data is now included in the Microsoft 365 User and Device entity profiles. ++### Remediation actions (new) ++Defender for Identity remediation actions, such as disabling accounts or requiring password resets, can now be taken from the Microsoft 365 Defender User page. For more information, see [Remediation actions in Microsoft Defender for Identity](/defender-for-identity/remediation-actions). ++### Lateral movement paths ++In addition to the **Lateral movement paths** tab on the user page, lateral movement paths can also be discovered via the **Advanced hunting** feature and the Lateral Movement paths security assessment. For more information, see [Microsoft Defender for Identity Lateral Movement Paths (LMPs)](/defender-for-identity/understand-lateral-movement-paths). ++## Related videos ++- [New for Microsoft Defender for Identity](https://www.microsoft.com/videoplayer/embed/RE4HcEU) ++## Related information ++- [Microsoft 365 Defender](microsoft-365-defender.md) |
| security | Microsoft Secure Score Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-secure-score-whats-new.md | ms.technology: m365d [!INCLUDE [Microsoft 365 Defender rebranding](../includes/microsoft-defender.md)] -To make Microsoft Secure Score a better representative of your security posture, we have made some changes. To learn about planned changes, see [What's coming in Microsoft Secure Score?](microsoft-secure-score-whats-coming.md) +To make Microsoft Secure Score a better representative of your security posture, we continue to add new features and improvement actions. ++The more improvement actions you take, the higher your Secure Score will be. For more information, see [Microsoft Secure Score](microsoft-secure-score.md). Microsoft Secure Score can be found at https://security.microsoft.com/securescore in the [Microsoft 365 Defender portal](microsoft-365-defender-portal.md). +## June 2022 ++- New Microsoft Defender for Endpoint and Microsoft Defender Vulnerability Management recommendations are now available as a Secure Score improvement actions: ++ - Disallow offline access to shares + - Remove share write permission set to **Everyone** + - Remove shares from the root folder + - Set folder access-based enumeration for shares + - Update Microsoft Defender for Endpoint core components ++- A new Microsoft Defender for Identity recommendation is available as a Secure Score improvement action: ++ - Resolve unsecure domain configurations ++- A new [app governance](/defender-cloud-apps/app-governance-manage-app-governance) recommendation is now available as a Secure Score improvement action: ++ - Regulate apps with consent from priority accounts ++- New Salesforce and ServiceNow recommendations are now available as Secure Score improvement actions for Microsoft Defender for Cloud Apps customers. For more information, see [SaaS Security Posture Management overview](https://aka.ms/saas_security_posture_management). ++>[!Note] +>Salesforce and ServiceNow controls are now available in public preview. + ## April 2022 - Turn on user authentication for remote connections |
| security | Configure Your Spam Filter Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-your-spam-filter-policies.md | Creating a custom anti-spam policy in the Microsoft 365 Defender portal creates > > Manually blocking domains by adding the domains to the blocked domains list isn't dangerous, but it can increase your administrative workload. For more information, see [Create block sender lists in EOP](create-block-sender-lists-in-office-365.md). >- > There will be times when our filters will miss a message, you don't agree with the filtering verdict, or it takes time for our systems to catch up to it. In these cases, the allow list and block list are available to override the current filtering verdicts. But, you should use these lists sparingly and temporarily: longs lists can become unmanageable, and our filtering stack should be doing what it's supposed to be doing. If you're going to keep an allowed domain for an extended period of time, you should tell the sender to verify that their domain is authenticated and set to DMARC reject if it's not. + > There will be times when our filters will miss a message, you don't agree with the filtering verdict, or it takes time for our systems to catch up to it. In these cases, the allow list and block list are available to override the current filtering verdicts. But, you should use these lists sparingly and temporarily: longs lists can become unmanageable, and our filtering stack should be doing what it's supposed to be doing. If you're going to keep an allowed domain for an extended period of time, you should tell the sender to verify that their domain is authenticated and set to DMARC reject appropriately. The steps to add entries to any of the lists are the same: |
| security | Report Junk Email Messages To Microsoft | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/report-junk-email-messages-to-microsoft.md | Title: Report spam, non-spam, and phishing messages to Microsoft + Title: Report spam, non-spam, phishing, suspicious emails and files to Microsoft f1.keywords: - NOCSH search.appverid: ms.assetid: c31406ea-2979-4fac-9288-f835269b9d2f - M365-security-compliance-description: Admins can learn about the different ways to report good and bad messages, URLs, email attachments, and admins to Microsoft for analysis. +description: How do I report a suspicious email or file to Microsoft? Report messages, URLs, email attachments and files to Microsoft for analysis. Learn to report spam email and phishing emails. ms.technology: mdo ms.prod: m365-security -# Report items to Microsoft +# How do I report a suspicious email or file to Microsoft? [!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)] ms.prod: m365-security - [Microsoft Defender for Office 365 plan 1 and plan 2](defender-for-office-365.md) - [Microsoft 365 Defender](../defender/microsoft-365-defender.md) -In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, users and admins have several different methods for reporting email messages, URLs, and email attachments to Microsoft. - +Wondering what to do with suspicious emails or files? In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, *users* and *admins* have different ways to report a suspicious email message, URL, or email attachment to Microsoft. + In addition, Microsoft 365 organizations with Microsoft Defender for Endpoint admins also have several methods for reporting files. Watch this video that shows more information about the unified submissions experience. > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE50HhM] +## Report a suspicious email to Microsoft + |Method|Description| ||| |[Use the Submissions portal to submit suspected spam, phish, URLs, and email attachments to Microsoft](admin-submission.md)|The recommended reporting method for admins in organizations with Exchange Online mailboxes (not available in standalone EOP).| |
| security | Tenant Allow Block List | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/tenant-allow-block-list.md | The Tenant Allow/Block List in the Microsoft 365 Defender portal gives you a way This article describes how to configure entries in the Tenant Allow/Block List in the Microsoft 365 Defender portal or in PowerShell (Exchange Online PowerShell for Microsoft 365 organizations with mailboxes in Exchange Online; standalone EOP PowerShell for organizations without Exchange Online mailboxes). +> [!NOTE] +> The ["Block the following URLs" list in Safe Links policies](safe-links.md#block-the-following-urls-list-for-safe-links) is in the process of being deprecated. You can now manage block URL entries in the Tenant Allow/Block List. We'll attempt to migrate existing entries from the "Block the following URLs" list to block URL entries in the Tenant Allow/Block List. Messages containing the blocked URL will be quarantined. + ## What do you need to know before you begin? - You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>. |
| solutions | Create Secure Guest Sharing Environment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/create-secure-guest-sharing-environment.md | Title: "Create a secure guest sharing environment" + Title: "Create a more secure guest sharing environment" -description: Learn about available options to create a secure guest sharing environment in Microsoft 365, providing guest access for improved collaboration. +description: Learn about available options to create a more secure guest sharing environment in Microsoft 365, providing guest access for improved collaboration. -# Create a secure guest sharing environment +# Create a more secure guest sharing environment -In this article, we'll walk through a variety of options for creating a secure guest sharing environment in Microsoft 365. These are examples to give you an idea of the options available. You can use these procedures in different combinations to meet the security and compliance needs of your organization. +In this article, we'll walk through a variety of options for creating a more secure guest sharing environment in Microsoft 365. These are examples to give you an idea of the options available. You can use these procedures in different combinations to meet the security and compliance needs of your organization. This article includes: |
| solutions | Microsoft 365 Groups Expiration Policy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/microsoft-365-groups-expiration-policy.md | If you have set up a retention policy for groups in the Microsoft Purview compli ## How and when a group owner learns if their groups are going to expire -Group owners will only be notified via email. If the group was created via Planner, SharePoint, or any other app, the expiration notifications will always come via email. If the group was created via Teams, the group owner will receive a notification to renew through the activity section. It's not recommended that you enable expiration on a group if your group owner doesn't have a valid email address. +If the group was created via Planner, SharePoint, or any other app, the expiration notifications will always come via email. +If the group was created via Teams, the group owner will receive an email and a notification to renew through the activity section. It's not recommended that you enable expiration on a group if your group owner doesn't have a valid email address. 30 days before the group expires, the group owners (or the email addresses that you specified for groups that don't have an owner) will receive an email allowing them to easily renew the group. If they don't renew it, they'll receive another renewal email 15 days before expiration. If they still haven't renewed it, they will receive one more email notification the day before expiration. |
| whiteboard | Gdpr Requests | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/gdpr-requests.md | This article provides information about how to export, transfer, or delete perso ## Export a whiteboard -### On Windows 10 +### On Windows -On Windows 10, do the following steps: +On Windows, do the following steps: 1. Select the **More** (**...**) button for the whiteboard that you want to export. To delete a whiteboard, do the following steps: 2. Select **Delete**. +To delete a whiteboard file in OneDrive for Business, do the following steps: ++1. Navigate to the Whiteboards folder in OneDrive. ++2. Right-click the whiteboard file you want to delete. ++3. Select **Delete**. + >[!WARNING] > This will permanently delete the selected whiteboard.- |