| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| compliance | Alert Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/alert-policies.md | The table also indicates the Office 365 Enterprise and Office 365 US Government | Default alert policy | Description | Category | Automated investigation | Enterprise subscription | |:--|:--|:--|:--|:--|-|**A potentially malicious URL click was detected**|Generates an alert when a user protected by [Safe Links](../security/office-365-security/safe-links.md) in your organization clicks a malicious link. This event is triggered when URL verdict changes are identified by Microsoft Defender for Office 365 or when users override the Safe Links pages (based on your organization's Microsoft 365 for business Safe Links policy). This alert policy has a **High** severity setting. For Defender for Office 365 P2, E5, G5 customers, this alert automatically triggers [automated investigation and response in Office 365](../security/office-365-security/office-365-air.md). For more information on events that trigger this alert, see [Set up Safe Links policies](../security/office-365-security/set-up-safe-links-policies.md).|Threat management|Yes|E5/G5 or Defender for Office 365 P2 add-on subscription| +|**A user clicked through to a potentially malicious URL**|Generates an alert when a user protected by [Safe Links](/microsoft-365/security/office-365-security/safe-links) in your organization clicks a malicious link. This event is triggered when user clicks on a URL (which is identified as malicious or pending validation) and overrides the Safe Links warning page (based on your organization's Microsoft 365 for business Safe Links policy) to continue to the URL hosted page / content. This alert policy has a **High** severity setting. For Defender for Office 365 P2, E5, G5 customers, this alert automatically triggers [automated investigation and response in Office 365](/microsoft-365/security/office-365-security/office-365-air). For more information on events that trigger this alert, see [Set up Safe Links policies](/microsoft-365/security/office-365-security/set-up-safe-links-policies).|Threat management|Yes|E5/G5 or Defender for Office 365 P2 add-on subscription| |**Admin Submission result completed**|Generates an alert when an [Admin Submission](../security/office-365-security/admin-submission.md) completes the rescan of the submitted entity. An alert will be triggered every time a rescan result is rendered from an Admin Submission. These alerts are meant to remind you to [review the results of previous submissions](https://compliance.microsoft.com/reportsubmission), submit user reported messages to get the latest policy check and rescan verdicts, and help you determine if the filtering policies in your organization are having the intended impact. This policy has a **Informational** severity setting.|Threat management|No|E1/F1, E3/F3, or E5| |**Admin triggered manual investigation of email**|Generates an alert when an admin triggers the manual investigation of an email from Threat Explorer. For more information, see [Example: A security administrator triggers an investigation from Threat Explorer](../security/office-365-security/automated-investigation-response-office.md#example-a-security-administrator-triggers-an-investigation-from-threat-explorer). This alert notifies your organization that the investigation was started. The alert provides information about who triggered it and includes a link to the investigation. This policy has an **Informational** severity setting.|Threat management|Yes|E5/G5 or Microsoft Defender for Office 365 P2 add-on subscription| |**Admin triggered user compromise investigation**|Generates an alert when an admin triggers the manual user compromise investigation of either an email sender or recipient from Threat Explorer. For more information, see [Example: A security administrator triggers an investigation from Threat Explorer](../security/office-365-security/automated-investigation-response-office.md#example-a-security-administrator-triggers-an-investigation-from-threat-explorer), which shows the related manual triggering of an investigation on an email. This alert notifies your organization that the user compromise investigation was started. The alert provides information about who triggered it and includes a link to the investigation. This policy has a **Medium** severity setting.|Threat management|Yes|E5/G5 or Microsoft Defender for Office 365 P2 add-on subscription| |
| compliance | Ediscovery Decryption | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery-decryption.md | Prior to this new capability, only the content of an email message protected by ## Supported encryption technologies -For Exchange, Microsoft eDiscovery tools support items encrypted with Microsoft encryption technologies. These technologies are Azure Rights Management (Azure RMS)<sup>3</sup> and Microsoft Purview Information Protection (specifically sensitivity labels). For more information about Microsoft encryption technologies, see [Encryption](encryption.md). Content encrypted by S/MIME or third-party encryption technologies isn't supported. For example, previewing or exporting content encrypted with non-Microsoft technologies isn't supported. +For Exchange, Microsoft eDiscovery tools support items encrypted with Microsoft encryption technologies. These technologies are Azure Rights Management (Azure RMS)<sup>3</sup> and Microsoft Purview Information Protection (specifically sensitivity labels). For more information about Microsoft encryption technologies, see [Encryption](encryption.md) and the various [email encryption](email-encryption.md#comparing-email-encryption-options-available-in-office-365) options available. Content encrypted by S/MIME or third-party encryption technologies isn't supported. For example, previewing or exporting content encrypted with non-Microsoft technologies isn't supported. > [!NOTE] > The decryption of email messages sent with an [Microsoft Purview Message Encryption custom branding template](add-your-organization-brand-to-encrypted-messages.md) is not supported by Microsoft eDiscovery tools. When using an OME custom branding template, email messages are delivered to the OME portal instead of the recipient's mailbox. Therefore, you won't be able to use eDiscovery tools to search for encrypted messages because those messages are never received by the recipient's mailbox. Any rights-protected (RMS-protected) email messages included in the results of a ## Notes -<sup>1</sup> Encrypted files located on a local computer and cloud attachments copied to an email message aren't decrypted and indexed for eDiscovery. +<sup>1</sup> Encrypted files located on a local computer and copied to an email message arenΓÇÖt decrypted and indexed for eDiscovery. For eDiscovery (Premium), encrypted email and attachments in recipient mailbox needs to be advanced indexed to be decrypted. For more information about advanced indexing, see [Advanced indexing of custodian data](indexing-custodian-data.md). <sup>2</sup> Only items labeled within SharePoint online service will be decrypted, everything else is unsupported including labeling or encrypting in the client before upload, legacy doc library RMS templates or settings, SMIME or any other standard etc. See [Enable sensitivity labels for Office files](sensitivity-labels-sharepoint-onedrive-files.md). |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | The numbers listed are the minimum Office application versions required for each |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | Yes | |[Different settings for default label and mandatory labeling](#outlook-specific-options-for-default-label-and-mandatory-labeling) | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.43+ <sup>\*</sup> | 4.2111+ | 4.2111+ | Yes | |[PDF support](#pdf-support) | Under review| Under review | Under review | Under review | Under review |-|[Apply S/MIME protection](#configure-a-label-to-apply-smime-protection-in-outlook) | Under review | Rolling out: 16.61+ <sup>\*</sup> | Rolling out: 4.2208+ | Rolling out: 4.2203+ | Under review | +|[Apply S/MIME protection](#configure-a-label-to-apply-smime-protection-in-outlook) | Under review | Rolling out: 16.61+ <sup>\*</sup> | Rolling out: 4.2226+ | Rolling out: 4.2203+ | Under review | **Footnotes:** |
| compliance | Set Up New Message Encryption Capabilities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/set-up-new-message-encryption-capabilities.md | For more information, see: ### Manually activating Azure Rights Management -If you disabled Azure RMS, or if it was not automatically activated for any reason, you can activate it manually in the: +If you disabled Azure RMS, or if it was not automatically activated for any reason, you can activate it manually. -- **Microsoft 365 admin center**: See [How to activate Azure Rights Management from the admin center](/azure/information-protection/activate-office365) for instructions.-- **Azure portal**: See [How to activate Azure Rights Management from the Azure portal](/azure/information-protection/activate-azure) for instructions.+For instructions, see [How to activate or confirm the status of the protection service](/azure/information-protection/activate-service#how-to-activate-or-confirm-the-status-of-the-protection-service). ## Configure management of your Azure Information Protection tenant key |
| security | Compare Mdb M365 Plans | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/compare-mdb-m365-plans.md | Defender for Business is also available as a standalone subscription, and is als |Email protection|Yes <br/>[Email scanning with Microsoft Defender Antivirus](../defender-endpoint/configure-advanced-scan-types-microsoft-defender-antivirus.md)|Yes <ul><li>[Exchange Online Protection](../office-365-security/exchange-online-protection-overview.md)</li><li>[Email scanning with Microsoft Defender Antivirus](../defender-endpoint/configure-advanced-scan-types-microsoft-defender-antivirus.md)</li></ul>| |Antispam protection|Yes<br/>For devices|Yes <ul><li>For devices</li><li>For Microsoft 365 email content, such as messages and attachments</li></ul>| |Antimalware protection|Yes<br/>For devices|Yes<ul><li>For devices</li><li>For Microsoft 365 email content, such as messages and attachments</li></ul>|-|[Next-generation protection](../defender-endpoint/microsoft-defender-antivirus-in-windows-10.md) <br/> (antivirus and antimalware protection)|Yes<br/>Microsoft Defender Antivirus is included in Windows 10 and later|Yes <ul><li>Microsoft Defender Antivirus is included in Windows 10 and later</li><li>Next-generation protection policies for onboarded devices</li></ul>| +|[Next-generation protection](../defender-endpoint/microsoft-defender-antivirus-in-windows-10.md) <br/> (antivirus and antimalware protection for onboarded devices)|Yes |Yes | |[Attack surface reduction](../defender-endpoint/overview-attack-surface-reduction.md) <br/>(ASR rules in Windows 10 or later and firewall protection)|Yes|Yes| |[Endpoint detection and response](../defender-endpoint/overview-endpoint-detection-response.md) <br/>(behavior-based detection and manual response actions)|Yes|Yes| |[Automated investigation and response](../defender-endpoint/automated-investigations.md)|Yes|Yes| |
| security | Configure Server Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-server-endpoints.md | You can use the [installer script](server-migration.md#installer-script) to help ``` > [!NOTE]- > If you need to troubleshoot agent installation issues, add '-etl -log' to the install.ps1 script parameters. - > + > The recommended execution policy setting is `Allsigned`. This requires importing the script's signing certificate into the Local Computer Trusted Publishers store if the script is running as SYSTEM on the endpoint. - Replace \\servername-or-dfs-space\share-name with the UNC path, using the file server's fully qualified domain name (FQDN), of the shared *install.ps1* file. The installer package md4ws.msi must be placed in the same directory. Also ensure that the permissions of the UNC path allow read access to the computer account that's installing the platform. + Replace \\servername-or-dfs-space\share-name with the UNC path, using the file server's fully qualified domain name (FQDN), of the shared *install.ps1* file. The installer package md4ws.msi must be placed in the same directory. Ensure that the permissions of the UNC path allow write access to the computer account that is installing the package, to support creation of log files. If you wish to disable the creation of log files (not recommended), you can use the -noETL -noETW parameters. For scenarios where you want Microsoft Defender Antivirus to co-exist with non-Microsoft antimalware solutions, add the $Passive parameter to set passive mode during installation. |
| security | Defender Endpoint Plan 1 2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2.md | -# Compare Microsoft Defender for Endpoint plans +# Compare Microsoft endpoint security plans -Microsoft Defender for Endpoint is an enterprise endpoint security platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats. Defender for Endpoint provides advanced threat protection that includes antivirus, antimalware, ransomware mitigation, and more, together with centralized management and reporting. You can choose from the following options for Microsoft Defender for Endpoint: +Microsoft endpoint security plans, such as Microsoft Defender for Endpoint and Microsoft 365 Defender, were designed to help enterprise organizations prevent, detect, investigate, and respond to advanced threats. Microsoft Defender for Business and Microsoft 365 Business Premium provide similar capabilities, optimized for small and medium-sized businesses. These plans provide advanced threat protection with antivirus and antimalware protection, ransomware mitigation, and more, together with centralized management and reporting. ++This article helps clarify what's included in the following plans: - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender Vulnerability Management](../defender-vulnerability-management/index.yml) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)+- [Microsoft Defender for Business](../defender-business/mdb-overview.md) +- [Microsoft 365 Business Premium](../../business-premium/index.md) -You can use this article to help clarify what protection is provided by the different features available in Defender for Endpoint Plan 1, Defender for Endpoint Plan 2, the new Defender Vulnerability Management add-on, and Microsoft 365 Defender. +> [!IMPORTANT] +> This article provides a summary of threat protection capabilities in Microsoft endpoint security plans; however, it's not intended to be a service description or licensing contract document. For more detailed information, see [Microsoft 365 licensing guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance). -## Compare Defender for Endpoint plans +## Compare Microsoft endpoint security plans -The following table summarizes what's included in each Defender for Endpoint plan. +The following table summarizes what's included in Microsoft endpoint security plans. | Plan | What's included | |:|:|-| [Defender for Endpoint Plan 1](defender-endpoint-plan-1.md) | <ul><li>[Next-generation protection](defender-endpoint-plan-1.md#next-generation-protection) (includes antimalware and antivirus)</li><li>[Attack surface reduction](defender-endpoint-plan-1.md#attack-surface-reduction)</li><li> [Manual response actions](defender-endpoint-plan-1.md#manual-response-actions)</li><li>[Centralized management](defender-endpoint-plan-1.md#centralized-management)</li><li>[Security reports](defender-endpoint-plan-1.md#reporting)</li><li>[APIs](defender-endpoint-plan-1.md#apis)</li><li>[Support for Windows 10, iOS, Android OS, and macOS devices](defender-endpoint-plan-1.md#cross-platform-support)</li></ul>| -| [Defender for Endpoint Plan 2](microsoft-defender-endpoint.md) | All of the Defender for Endpoint Plan 1 capabilities, plus:<ul><li>[Device discovery](device-discovery.md)</li><li>[Device inventory](machines-view-overview.md)</li><li>[Core Defender Vulnerability Management capabilities](../defender-vulnerability-management/defender-vulnerability-management-capabilities.md)</li><li>[Threat Analytics](threat-analytics.md)</li><li>[Automated investigation and response](automated-investigations.md)</li><li>[Advanced hunting](advanced-hunting-overview.md)</li><li>[Endpoint detection and response](overview-endpoint-detection-response.md)</li><li>[Microsoft Threat Experts](microsoft-threat-experts.md)</li><li>Support for [Windows](configure-endpoints.md) (client and server) and [non-Windows platforms](configure-endpoints-non-windows.md) (macOS, iOS, Android, and Linux)</li></ul> | -| [Defender Vulnerability Management add-on](../defender-vulnerability-management/defender-vulnerability-management-capabilities.md) | Additional Defender Vulnerability Management capabilities for Defender for Endpoint Plan 2:<ul><li>[Security baselines assessment](../defender-vulnerability-management/tvm-security-baselines.md)</li><li>[Block vulnerable applications](../defender-vulnerability-management/tvm-block-vuln-apps.md)</li><li>[Browser extensions](../defender-vulnerability-management/tvm-browser-extensions.md)</li><li>[Digital certificate assessment](../defender-vulnerability-management/tvm-certificate-inventory.md)</li><li>[Network share analysis](../defender-vulnerability-management/tvm-network-share-assessment.md)</li><li>Support for [Windows](configure-endpoints.md) (client and server) and [non-Windows platforms](configure-endpoints-non-windows.md) (macOS, iOS, Android, and Linux)</li></ul> | | [Microsoft 365 Defender](../defender/microsoft-365-defender.md) | Services include: <ul><li>[Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)</li><li>[Microsoft Defender Vulnerability Management](../defender-vulnerability-management/defender-vulnerability-management.md)</li><li>[Microsoft Defender for Office 365](../office-365-security/overview.md)</li><li>[Microsoft Defender for Identity](/defender-for-identity/)</li><li>[Microsoft Defender for Cloud Apps](/cloud-app-security/)</li></ul>|+| [Defender for Endpoint Plan 1](defender-endpoint-plan-1.md) <sup>[[1](#fn1)]</sup> | <ul><li>[Next-generation protection](defender-endpoint-plan-1.md#next-generation-protection) (includes antimalware and antivirus)</li><li>[Attack surface reduction](defender-endpoint-plan-1.md#attack-surface-reduction)</li><li> [Manual response actions](defender-endpoint-plan-1.md#manual-response-actions)</li><li>[Centralized management](defender-endpoint-plan-1.md#centralized-management)</li><li>[Security reports](defender-endpoint-plan-1.md#reporting)</li><li>[APIs](defender-endpoint-plan-1.md#apis)</li><li>[Support for Windows 10, iOS, Android OS, and macOS devices](defender-endpoint-plan-1.md#cross-platform-support)</li></ul>| +| [Defender for Endpoint Plan 2](microsoft-defender-endpoint.md) <sup>[[2](#fn2)]</sup> | All of the Defender for Endpoint Plan 1 capabilities, plus:<ul><li>[Device discovery](device-discovery.md)</li><li>[Device inventory](machines-view-overview.md)</li><li>[Core Defender Vulnerability Management capabilities](../defender-vulnerability-management/defender-vulnerability-management-capabilities.md)</li><li>[Threat Analytics](threat-analytics.md)</li><li>[Automated investigation and response](automated-investigations.md)</li><li>[Advanced hunting](advanced-hunting-overview.md)</li><li>[Endpoint detection and response](overview-endpoint-detection-response.md)</li><li>[Microsoft Threat Experts](microsoft-threat-experts.md)</li><li>Support for [Windows](configure-endpoints.md) (client and server) and [non-Windows platforms](configure-endpoints-non-windows.md) (macOS, iOS, Android, and Linux)</li></ul> | +| [Defender Vulnerability Management add-on](../defender-vulnerability-management/defender-vulnerability-management-capabilities.md) | Additional Defender Vulnerability Management capabilities for Defender for Endpoint Plan 2:<ul><li>[Security baselines assessment](../defender-vulnerability-management/tvm-security-baselines.md)</li><li>[Block vulnerable applications](../defender-vulnerability-management/tvm-block-vuln-apps.md)</li><li>[Browser extensions](../defender-vulnerability-management/tvm-browser-extensions.md)</li><li>[Digital certificate assessment](../defender-vulnerability-management/tvm-certificate-inventory.md)</li><li>[Network share analysis](../defender-vulnerability-management/tvm-network-share-assessment.md)</li><li>Support for [Windows](configure-endpoints.md) (client and server) and [non-Windows platforms](configure-endpoints-non-windows.md) (macOS, iOS, Android, and Linux)</li></ul> | +| [Defender for Business](../defender-business/mdb-overview.md) <sup>[[3](#fn3)]</sup> <br/>and<br/>[Microsoft 365 Business Premium](../../business-premium/index.md) | [Services optimized for small and medium-sized businesses](../defender-business/compare-mdb-m365-plans.md) include: <ul><li>Email protection</li><li>Antispam protection</li><li>Antimalware protection</li><li>Next-generation protection</li><li>Attack surface reduction</li><li>Endpoint detection and response</li><li>Automated investigation and response </li><li>Threat & vulnerability management</li><li>Centralized reporting</li><li>APIs (for integration with custom apps or reporting solutions)</li><li>[Integration with Microsoft 365 Lighthouse](../defender-business/mdb-lighthouse-integration.md)</li></ul> | -> [!IMPORTANT] -> The standalone versions of Defender for Endpoint Plan 1 and Plan 2 do not include server licenses. To onboard servers, such as endpoints running Windows Server or Linux, you'll need Defender for Servers Plan 1 or Plan 2 as part of the [Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction) offering. To learn more. see [Overview of Microsoft Defender for Servers](/azure/defender-for-cloud/defender-for-servers-introduction). --Microsoft Defender for Endpoint Plan 1 is available as a standalone user subscription license for commercial and education customers. It's also included as part of Microsoft 365 E3/A3. +(<a id="fn1">1</a>) Microsoft Defender for Endpoint Plan 1 is available as a standalone subscription for commercial and education customers. It's also included as part of Microsoft 365 E3/A3. -Microsoft Defender for Endpoint Plan 2, which was previously called Microsoft Defender for Endpoint, is available as a standalone license and as part of the following plans: +(<a id="fn2">2</a>) Microsoft Defender for Endpoint Plan 2, which was previously called Microsoft Defender for Endpoint, is available as a standalone subscription. It's also included as part of the following plans: - Windows 11 Enterprise E5/A5 - Windows 10 Enterprise E5/A5 Microsoft Defender for Endpoint Plan 2, which was previously called Microsoft De - Microsoft 365 E5/A5/G5/F5 Security - Microsoft 365 F5 Security & Compliance +(<a id="fn3">3</a>) Microsoft Defender for Business is available as a standalone subscription for small and medium-sized businesses. It's also included as part of Microsoft 365 Business Premium. These plans feature advanced security capabilities with a simplified setup and configuration experience. ++## Options for onboarding servers ++The standalone versions of Defender for Business, Defender for Endpoint Plan 1 and 2, and Microsoft 365 Business Premium do not include server licenses. To onboard servers, choose from the following options: ++- **Defender for Servers Plan 1 or Plan 2** as part of the [Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction) offering. To learn more. see [Overview of Microsoft Defender for Servers](/azure/defender-for-cloud/defender-for-servers-introduction). ++- **Microsoft Defender for Business servers (preview)** for small and medium-sized businesses. See [How to get Microsoft Defender for Business servers (preview)](../defender-business/get-defender-business-servers.md). + ## Mixed licensing scenarios Suppose that your organization is using a mix of Microsoft endpoint security subscriptions, such as Defender for Endpoint Plan 1 and Defender for Endpoint Plan 2. **Currently, the highest functional Microsoft endpoint security subscription sets the experience for your tenant**. In this example, your tenant experience would be Defender for Endpoint Plan 2 for all users. |
| security | Mac Whatsnew | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-whatsnew.md | ms.technology: mde > Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) -## 101.71.18 (20.122052.17118.0) +For more information on Microsoft Defender for Endpoint on other operating systems: +- [What's new in Microsoft Defender for Endpoint on Linux](linux-whatsnew.md) +- [What's new in Microsoft Defender for Endpoint on iOS](ios-whatsnew.md)</br> ++<details> + <summary>Jun-2022 (Build: 101.71.18 | Release version: 20.122052.17118.0)</summary> ++ Released: **Jul 7, 2022**<br/> + Published: **Jul 7, 2022**<br/> + Build: **101.71.18**<br/> + Release version: **20.122052.17118.0**<br/> ++**What's new** - `mdatp connectivity test` was extended with an extra URL that the product requires to function correctly. The new URL is [https://go.microsoft.com/fwlink/?linkid=2144709](https://go.microsoft.com/fwlink/?linkid=2144709). - Up until now, the product log level wasn't persisted between product restarts. Starting from this version, there's a new command-line tool switch that persists the log level. The new command is `mdatp log level persist --level <level>`. ms.technology: mde - Performance improvements for file copy operations and built-in macOS applications - Bug fixes -## 101.70.19 (20.122051.17019.0) +<br/> +</details> ++<details> + <summary>Jun-2022 (Build: 101.70.19 | Release version: 20.122051.17019.0)</summary> ++ Released: **Jun 14, 2022**<br/> + Published: **Jun 14, 2022**<br/> + Build: **101.70.19**<br/> + Release version: **20.122051.17019.0**<br/> ++**What's new** - Fixed a bug where threat-related notifications were not always presented to the end user. - Performance improvements & other bug fixes -## 101.70.18 (20.122042.17018.0) +<br/> +</details> +++<details> + <summary>Jun-2022 (Build: 101.70.18 | Release version: 20.122042.17018.0)</summary> ++ Released: **Jun 2, 2022**<br/> + Published: **Jun 2, 2022**<br/> + Build: **101.70.18**<br/> + Release version: **20.122042.17018.0**<br/> ++**What's new** - Fixed a bug where the installation package was sometimes hanging indefinitely during product updates - Fixed a bug where the product sometimes was incorrectly detecting files inside the quarantine folder - Performance improvements & other bug fixes -## 101.66.54 (20.122041.16654.0) +<br/> +</details> ++<details> + <summary>May-2022 (Build: 101.66.54 | Release version: 20.122041.16654.0) </summary> ++ Released: **May 11, 2022**<br/> + Published: **May 11, 2022**<br/> + Build: **101.66.54**<br/> + Release version: **20.122041.16654.0**<br/> +++**What's new** - Addressed an issue where `mdatp diagnostic real-time-protection-statistics` was not printing the correct process path in some cases. - Bug fixes -## 101.64.15 (20.122032.16415.0) +<br/> +</details> ++<details> + <summary>Apr-2022 (Build: 101.64.15 | Release version: 20.122032.16415.0)</summary> ++ Released: **Apr 26, 2022**<br/> + Published: **Apr 26, 2022**<br/> + Build: **101.64.15**<br/> + Release version: **20.122032.16415.0**<br/> ++**What's new** - Fixed a regression introduced in version 101.61.69 where the status menu icon was sometimes showing an error icon, even though no action was required from the end user - Improved the `conflicting_applications` field in `mdatp health` to show only the most recent 10 processes and also to include the process names. This makes it easier to identify which processes are potentially conflicting with Microsoft Defender for Endpoint for Mac. - Fixed a bug in `mdatp device-control removable-media policy list` where vendor ID and product ID were displayed as decimal instead of hexadecimal - Performance improvements & other bug fixes -## 101.61.69 (20.122022.16169.0) +<br/> +</details> ++<details> + <summary>Mar-2022 (Build: 101.61.69 | Release version: 20.122022.16169.0) </summary> ++ Released: **Mar 25, 2022**<br/> + Published: **Mar 25, 2022**<br/> + Build: **101.61.69**<br/> + Release version: **20.122022.16169.0**<br/> ++**What's new** - Bug fixes -## 101.60.91 (20.122021.16091.0) +<br/> +</details> ++<details> + <summary>Mar-2022 (Build: 101.60.91 | Release version: 20.122021.16091.0)</summary> ++ Released: **Mar 8, 2022**<br/> + Published: **Mar 8, 2022**<br/> + Build: **101.60.91**<br/> + Release version: **20.122021.16091.0**<br/> ++**What's new** - This version contains a security update for [CVE-2022-23278](https://msrc-blog.microsoft.com/2022/03/08/guidance-for-cve-2022-23278-spoofing-in-microsoft-defender-for-endpoint/) -## 101.59.50 (20.122021.15950.0) +<br/> +</details> ++<details> + <summary>Feb-2022 (Build: 101.59.50 | Release version: 20.122021.15950.0) </summary> ++ Released: **Feb 28, 2022**<br/> + Published: **Feb 28, 2022**<br/> + Build: **101.59.50**<br/> + Release version: **20.122021.15950.0**<br/> ++**What's new** - This version adds support for macOS 12.3. Starting with macOS 12.3, [Apple is removing Python 2.7](https://developer.apple.com/documentation/macos-release-notes/macos-12_3-release-notes). There will be no Python version preinstalled on macOS by default. **ACTION NEEDED**: - Users must update Microsoft Defender for Endpoint for Mac to version 101.59.50 (or newer) prior to updating their devices to macOS Monterey 12.3 (or newer). This minimal version 101.59.50 is a prerequisite to eliminating Python-related issues with Microsoft Defender for Endpoint for Mac on macOS Monterey. - For remote deployments, existing MDM setups must be updated to Microsoft Defender for Endpoint for Mac version 101.59.50 (or newer). Pushing via MDM an older Microsoft Defender for Endpoint for Mac version to macOS Monterey 12.3 (or newer) will result in an installation failure. -## 101.59.10 (20.122012.15910.0) +<br/> +</details> ++<details> + <summary>Feb-2022 (Build: 101.59.10 | Release version: 20.122012.15910.0)</summary> ++ Released: **Feb 22, 2022**<br/> + Published: **Feb 22, 2022**<br/> + Build: **101.59.10**<br/> + Release version: **20.122012.15910.0**<br/> ++**What's new** - The command-line tool now supports restoring quarantined files to a location other than the one where the file was originally detected. This can be done through `mdatp threat quarantine restore --id [threat-id] --path [destination-folder]`. - Extended device control to handle devices connected over Thunderbolt 3 - Improved the handling of device control policies containing invalid vendor IDs and product IDs. Prior to this version, if the policy contained one or more invalid IDs, the entire policy was ignored. Starting from this version, only the invalid portions of the policy are ignored. Issues with the policy are surfaced through `mdatp device-control removable-media policy list`. - Bug fixes -## 101.56.62 (20.121122.15662.0) +<br/> +</details> -- Bug fixes+<details> + <summary>Feb-2022 (Build: 101.56.62 | Release version: 20.121122.15662.0)</summary> ++ Released: **Feb 7, 2022**<br/> + Published: **Feb 7, 2022**<br/> + Build: **101.56.62**<br/> + Release version: **20.121122.15662.0**<br/> ++**What's new** ++- Bug fixes ++<br/> +</details> -## 101.56.35 (20.121121.15635.0) +<details> + <summary> Jan-2022 (Build: 101.56.35 | Release version: 20.121121.15635.0)</summary> ++ Released: **Jan 30, 2022**<br/> + Published: **Jan 30, 2022**<br/> + Build: **101.56.35**<br/> + Release version: **20.121121.15635.0**<br/> ++**What's new** - The application has been renamed from "Microsoft Defender ATP" to "Microsoft Defender". End users will observe the following changes:- - The application installation path has been changed from `/Application/Microsoft Defender ATP.app` to `/Applications/Microsoft Defender.app`. - - Within the user experience, occurrences of "Microsoft Defender ATP" have been replaced with "Microsoft Defender" +- The application installation path has been changed from `/Application/Microsoft Defender ATP.app` to `/Applications/Microsoft Defender.app`. +- Within the user experience, occurrences of "Microsoft Defender ATP" have been replaced with "Microsoft Defender" - Resolved an issue where some VPN applications could not connect due to the network content filter that is distributed with Microsoft Defender for Endpoint for Mac - Addressed an issue discovered in macOS 12.2 beta 2 where the installation package could not be opened due to a change in the operating system (OS) that prevents installation of packages with certain characteristics. While it appears that this OS change is not included in the final release of macOS 12.2, it is likely that it will be reintroduced in a future macOS version. As such, we encourage all enterprise administrators to refresh the Microsoft Defender for Endpoint package in their management console to this product version (or a newer version). - Addressed an issue seen on some M1 devices where the product was stuck with invalid antimalware definitions and could not successfully update to a working set of definitions. - `mdatp health` output has been extended with an additional attribute called `full_disk_access_enabled` that can be used to determine whether Full Disk Access has been granted to all components of Microsoft Defender for Endpoint for Mac. - Performance improvements & bug fixes -## 101.54.16 (20.121111.15416.0) +<br/> +</details> ++<details> + <summary>Jan-2022 (Build: 101.54.16 | Release version: 20.121111.15416.0) </summary> ++ Released: **Jan 12, 2022**<br/> + Published: **Jan 12, 2022**<br/> + Build: **101.54.16**<br/> + Release version: **20.121111.15416.0**<br/> ++**What's new** - macOS 10.14 (Mojave) is no longer supported - After a product setting stops being managed by the administrator through MDM, it now reverts to the value it had before it was managed (the value configured locally by the end user or, if no such local value was explicitly provided, the default value used by the product). Prior to this change, after a setting stopped being managed, its managed value persisted and was still used by the product. - Performance improvements & bug fixes+ +<br/> +</details> -## 101.49.25 (20.121092.14925.0) +<details><summary>2021 releases </summary><blockquote> + <details><summary>(Build: 101.49.25 | Release version: 20.121092.14925.0)</summary> -- Added a new switch to the command-line tool to control whether archives are scanned during on-demand scans. This can be configured through `mdatp config scan-archives --value [enabled/disabled]`. By default, this is set to `enabled`.-- Bug fixes+ Build:ΓÇ»**101.49.25**<br/> + Release version:ΓÇ»**20.121092.14925.0** <br/> -## 101.47.27 (20.121082.14727.0) +**What's new** -- Fix for a system freeze occurring on shutdown on macOS Mojave and macOS Catalina+- Added a new switch to the command-line tool to control whether archives are scanned during on-demand scans. This can be configured throughΓÇ»`mdatp config scan-archives --value [enabled/disabled]`. By default, this is set toΓÇ»enabled. +- Bug fixes -## 101.43.84 (20.121082.14384.0) +<br/> +</details> + +<details><summary>(Build: 101.47.27 | Release version: 20.121082.14727.0)</summary> -- Candidate build for macOS 12 (Monterey)-- Bug fixes+ Build:ΓÇ»**101.47.27**<br/> + Release version:ΓÇ»**20.121082.14727.0** <br/> -## 101.41.10 (20.121072.14110.0) +**What's new** +- Fix for a system freeze occurring on shutdown on macOS Mojave and macOS Catalina. -- Added new switches to the command-line tool:- - Control degree of parallelism for on-demand scans. This can be configured through `mdatp config maximum-on-demand-scan-threads --value [number-between-1-and-64]`. By default, a degree of parallelism of `2` is used. - - Control whether scans after security intelligence updates are enabled or disabled. This can be configured through `mdatp config scan-after-definition-update --value [enabled/disabled]`. By default, this is set to `enabled`. -- Changing the product log level now requires elevation-- Performance improvements & bug fixes+<br/> +</details> -## 101.40.84 (20.121071.14084.0) +<details><summary>(Build: 101.43.84 | Release version: 20.121082.14384.0)</summary> -- M1 chip native support-- Performance improvements & bug fixes+ Build:ΓÇ»**101.43.84**<br/> + Release version:ΓÇ»**20.121082.14384.0** <br/> -## 101.37.97 (20.121062.13797.0) +**What's new** +- Candidate build for macOS 12 (Monterey) +- Bug fixes -- Performance improvements & bug fixes+<br/> +</details> -## 101.34.28 (20.121061.13428.0) +<details><summary>(Build: 101.41.10 | Release version: 20.121072.14110.0)</summary> -- Bug fixes+ Build:ΓÇ»**101.41.10**<br/> + Release version:ΓÇ»**20.121072.14110.0** <br/> -## 101.34.27 (20.121052.13427.0) +**What's new** +- Added new switches to the command-line tool: + - Control degree of parallelism for on-demand scans. This can be configured throughΓÇ»`mdatp config maximum-on-demand-scan-threads --value [number-between-1-and-64]`. By default, a degree of parallelism ofΓÇ»2ΓÇ»is used. + - Control whether scans after security intelligence updates are enabled or disabled. This can be configured throughΓÇ»`mdatp config scan-after-definition-update --value [enabled/disabled]`. By default, this is set toΓÇ»enabled. +- Changing the product log level now requires elevation. +- Performance improvements & bug fixes -- Bug fixes+<br/> +</details> ++<details><summary>(Build: 101.40.84 | Release version: 20.121071.14084.0)</summary> ++ Build:ΓÇ»**101.40.84**<br/> + Release version:ΓÇ»**20.121071.14084.0** <br/> ++**What's new** +- M1 chip native support +- Performance improvements & bug fixes ++<br/> +</details> ++<details><summary>(Build: 101.37.97 | Release version: 20.121062.13797.0)</summary> ++ Build:ΓÇ»**101.37.97**<br/> + Release version:ΓÇ»**20.121062.13797.0** <br/> ++**What's new** +- Performance improvements & bug fixes ++<br/> +</details> ++<details><summary>(Build: 101.34.28 | Release version: 20.121061.13428.0)</summary> ++ Build:ΓÇ»**101.34.28**<br/> + Release version:ΓÇ»**20.121061.13428.0** <br/> ++**What's new** +- Bug fixes -## 101.34.20 (20.121051.13420.0) +<br/> +</details> -- [Device control for macOS](mac-device-control-overview.md) is now in general availability-- Addressed an issue where a quick scan could not be started from the status menu on macOS 11 (Big Sur)-- Other bug fixes+<details><summary>(Build: 101.34.27 | Release version: 20.121052.13427.0)</summary> -## 101.32.69 (20.121042.13269.0) + Build:ΓÇ»**101.34.27**<br/> + Release version:ΓÇ»**20.121052.13427.0** <br/> +**What's new** +- Bug fixes ++<br/> +</details> ++<details><summary>(Build: 101.34.20 | Release version: 20.121051.13420.0)</summary> ++ Build:ΓÇ»**101.34.20**<br/> + Release version:ΓÇ»**20.121051.13420.0** <br/> ++**What's new** +- [Device control for macOS](mac-device-control-overview.md)ΓÇ»is now in general availability. +- Addressed an issue where a quick scan could not be started from the status menu on macOS 11 (Big Sur). +- Other bug fixes ++<br/> +</details> ++<details><summary>(Build: 101.32.69 | Release version: 20.121042.13269.0)</summary> ++ Build:ΓÇ»**101.32.69**<br/> + Release version:ΓÇ»**20.121042.13269.0** <br/> ++**What's new** - Addressed an issue where concurrent access to the keychain from Microsoft Defender for Endpoint and other applications can lead to keychain corruption. -## 101.29.64 (20.121042.12964.0) +<br/> +</details> -- Starting with this version, threats detected during on-demand antivirus scans triggered through the command-line client are automatically remediated. Threats detected during scans triggered through the user interface still require manual action.-- `mdatp diagnostic real-time-protection-statistics` now supports two additional switches:- - `--sort`: sorts the output descending by total number of files scanned - - `--top N`: displays the top N results (only works if `--sort` is also specified) -- Performance improvements (specifically for when YARN is used) & bug fixes+<details><summary>(Build: 101.29.64 | Release version: 20.121042.12964.0)</summary> -## 101.27.50 (20.121022.12750.0) + Build:ΓÇ»**101.29.64**<br/> + Release version:ΓÇ»**20.121042.12964.0** <br/> -- Fix to accommodate for Apple certificate expiration for macOS Catalina and earlier. This fix restores Threat & Vulnerability Management (TVM) functionality.+**What's new** +- Starting with this version, threats detected during on-demand antivirus scans triggered through the command-line client are automatically remediated. Threats detected during scans triggered through the user interface still require manual action. +- `mdatp diagnostic real-time-protection-statistics`ΓÇ»now supports two additional switches: + - `--sort`: sorts the output descending by total number of files scanned + - `--top N`: displays the top N results (only works ifΓÇ»`--sort`ΓÇ»is also specified) +- Performance improvements (specifically for when `YARN` is used) & bug fixes -## 101.25.69 (20.121022.12569.0) +<br/> +</details> -- Microsoft Defender for Endpoint on macOS is now available in preview for US Government customers. For more information, see [Microsoft Defender for Endpoint for US Government customers](gov.md).-- Performance improvements (specifically for the situation when the XCode Simulator app is used) & bug fixes.+<details><summary>(Build: 101.27.50 | Release version: 20.121022.12750.0)</summary> -## 101.23.64 (20.121021.12364.0) + Build:ΓÇ»**101.27.50**<br/> + Release version:ΓÇ»**20.121022.12750.0** <br/> -- Added a new option to the command-line tool to view information about the last on-demand scan. To view information about the last on-demand scan, run `mdatp health --details antivirus`-- Performance improvements & bug fixes+**What's new** +- Fix to accommodate for Apple certificate expiration for macOS Catalina and earlier. This fix restores Threat & Vulnerability Management (TVM) functionality. -## 101.22.79 (20.121012.12279.0) +<br/> +</details> -- Performance improvements & bug fixes+<details><summary>(Build: 101.25.69 | Release version: 20.121022.12569.0)</summary> -## 101.19.88 (20.121011.11988.0) + Build:ΓÇ»**101.25.69**<br/> + Release version:ΓÇ»**20.121022.12569.0** <br/> -- Performance improvements & bug fixes+**What's new** +- Microsoft Defender for Endpoint on macOS is now available in preview for US Government customers. For more information, seeΓÇ»[Microsoft Defender for Endpoint for US Government customers](gov.md) . +- Performance improvements (specifically for the situation when the XCode Simulator app is used) & bug fixes. ++<br/> +</details> ++<details><summary>(Build: 101.23.64 | Release version: 20.121021.12364.0)</summary> ++ Build:ΓÇ»**101.23.64**<br/> + Release version:ΓÇ»**20.121021.12364.0** <br/> ++**What's new** +- Added a new option to the command-line tool to view information about the last on-demand scan. To view information about the last on-demand scan, runΓÇ»`mdatp health --details antivirus`. +- Performance improvements & bug fixes ++<br/> +</details> ++</details> ++<details><summary>Prior releases </summary><blockquote> +<details><summary>(Build: 101.22.79 | Release version: 20.121012.12279.0)</summary> -## 101.19.48 (20.120121.11948.0) + Build: **101.22.79** <br> + Release version: **20.121012.12279.0**<br> +**What's new** +- Performance improvements & bug fixes ++<br/> +</details> ++<details><summary>(Build: 101.19.88 | Release version: 20.121011.11988.0)</summary> ++ Build:**101.19.88**<br> + Release version: **20.121011.11988.0**<br> ++**What's new** +- Performance improvements & bug fixes ++<br/> +</details> ++<details><summary>(Build: 101.19.48 | Release version: 20.120121.11948.0)</summary> ++ Build: **101.19.48**<br> + Release version: **20.120121.11948.0**<br> ++**What's new** > [!NOTE]-> The old command-line tool syntax has been deprecated with this release. For information on the new syntax, see [Resources](mac-resources.md#configuring-from-the-command-line). +> The old command-line tool syntax has been deprecated with this release. For information on the new syntax, seeΓÇ»[Resources](mac-resources.md#configuring-from-the-command-line). +- Added a new command-line switch to disable the network extension:ΓÇ»`mdatp system-extension network-filter disable`. This command can be useful to troubleshoot networking issues that could be related to Microsoft Defender for Endpoint on Mac. +- Performance improvements & bug fixes -- Added a new command-line switch to disable the network extension: `mdatp system-extension network-filter disable`. This command can be useful to troubleshoot networking issues that could be related to Microsoft Defender for Endpoint on Mac-- Performance improvements & bug fixes+<br/> +</details> -## 101.19.21 (20.120101.11921.0) +<details><summary>(Build: 101.19.21 | Release version: 20.120101.11921.0)</summary> -- Bug fixes+ Build: **101.19.21**<br> + Release version: **20.120101.11921.0** <br> -## 101.15.26 (20.120102.11526.0) +**What's new** +- Bug fixes -- Improved the reliability of the agent when running on macOS 11 Big Sur-- Added a new command-line switch (`--ignore-exclusions`) to ignore AV exclusions during custom scans (`mdatp scan custom`)+<br/> +</details> ++<details><summary>(Build: 101.15.26 | Release version: 20.120102.11526.0)</summary> ++ Build: **101.15.26**<br> + Release version: **20.120102.11526.0**<br> ++**What's new** +- Improved the reliability of the agent when running on macOS 11 Big Sur. +- Added a new command-line switch (`--ignore-exclusions`) to ignore AV exclusions during custom scans (`mdatp scan custom`). - Performance improvements & bug fixes -## 101.13.75 (20.120101.11375.0) +<br/> +</details> -- Removed conditions when Microsoft Defender for Endpoint was triggering a macOS 11 (Big Sur) bug that manifests into a kernel panic-- Fixed a memory leak in the Endpoint Security system extension when running on mac 11 (Big Sur)-- Bug fixes+<details><summary>(Build: 101.13.75 | Release version: 20.120101.11375.0)</summary> -## 101.10.72 + Build: **101.13.75**<br> + Release version: **20.120101.11375.0**<br> -- Bug fixes+**What's new** +- Removed conditions when Microsoft Defender for Endpoint was triggering a macOS 11 (Big Sur) bug that manifests into a kernel panic. +- Fixed a memory leak in the Endpoint Security system extension when running on mac 11 (Big Sur). +- Bug fixes -## 101.09.61 +<br/> +</details> -- Added a new managed preference for [disabling the option to send feedback](mac-preferences.md#show--hide-option-to-send-feedback)-- Status menu icon now shows a healthy state when the product settings are managed. Previously, the status menu icon was displaying a warning or error state, even though the product settings were managed by the administrator-- Performance improvements & bug fixes+<details><summary>(Build: 101.10.72)</summary> -## 101.09.50 + Build: **101.10.72** <br> -- This product version has been validated on macOS Big Sur 11 beta 9+**What's new** +- Bug fixes -- The new syntax for the `mdatp` command-line tool is now the default one. For more information on the new syntax, see [Resources for Microsoft Defender for Endpoint on macOS](mac-resources.md#configuring-from-the-command-line)+<br/> +</details> - > [!NOTE] - > The old command-line tool syntax will be removed from the product on **January 1st, 2021**. +<details><summary>(Build: 101.09.61)</summary> -- Extended `mdatp diagnostic create` with a new parameter (`--path [directory]`) that allows the diagnostic logs to be saved to a different directory-- Performance improvements & bug fixes+ Build: **101.09.61**<br> -## 101.09.49 +**What's new** +- Added a new managed preference forΓÇ»[disabling the option to send feedback](mac-preferences.md#show--hide-option-to-send-feedback). +- Status menu icon now shows a healthy state when the product settings are managed. Previously, the status menu icon was displaying a warning or error state, even though the product settings were managed by the administrator. +- Performance improvements & bug fixes -- User interface improvements to differentiate exclusions that are managed by the IT administrator versus exclusions defined by the local user-- Improved CPU utilization during on-demand scans-- Performance improvements & bug fixes+<br/> +</details> -## 101.07.23 +<details><summary>(Build: 101.09.50)</summary> -- Added new fields to the output of `mdatp --health` for checking the status of passive mode and the EDR group ID+ Build: **101.09.50**<br> - > [!NOTE] - > `mdatp --health` will be replaced with `mdatp health` in a future product update. +**What's new** +- This product version has been validated on macOS Big Sur 11 beta 9. +- The new syntax for theΓÇ»mdatpΓÇ»command-line tool is now the default one. For more information on the new syntax, seeΓÇ»[Resources for Microsoft Defender for Endpoint on macOS](mac-resources.md#configuring-from-the-command-line). +> [!NOTE] +> The old command-line tool syntax will be removed from the product onΓÇ»**January 1st, 2021**. +- ExtendedΓÇ»`mdatp diagnostic create`ΓÇ»with a new parameter (`--path [directory]`) that allows the diagnostic logs to be saved to a different directory. +- Performance improvements & bug fixes -- Fixed a bug where automatic sample submission was not marked as managed in the user interface-- Added new settings for controlling the retention of items in the antivirus scan history. You can now [specify the number of days to retain items in the scan history](mac-preferences.md#antivirus-scan-history-retention-in-days) and [specify the maximum number of items in the scan history](mac-preferences.md#maximum-number-of-items-in-the-antivirus-scan-history)-- Bug fixes+<br/> +</details> ++<details><summary>(Build: 101.09.49)</summary> ++ Build: **101.09.49**<br> ++**What's new** +- User interface improvements to differentiate exclusions that are managed by the IT administrator versus exclusions defined by the local user. +- Improved CPU utilization during on-demand scans. +- Performance improvements & bug fixes ++<br/> +</details> ++<details><summary>(Build: 101.07.23)</summary> ++ Build: **101.07.23**<br> ++**What's new** +- Added new fields to the output ofΓÇ»`mdatp --health`ΓÇ»for checking the status of passive mode and the EDR group ID. +> [!NOTE] +> `mdatp --health`ΓÇ»will be replaced withΓÇ»`mdatp health`ΓÇ»in a future product update. +- Fixed a bug where automatic sample submission was not marked as managed in the user interface. +- Added new settings for controlling the retention of items in the antivirus scan history. You can nowΓÇ»[specify the number of days to retain items in the scan history](mac-preferences.md#antivirus-scan-history-retention-in-days)ΓÇ»andΓÇ»[specify the maximum number of items in the scan history](mac-preferences.md#maximum-number-of-items-in-the-antivirus-scan-history). +- Bug fixes -## 101.06.63 +<br/> +</details> -- Addressed a performance regression introduced in version `101.05.17`. The regression was introduced with the fix to eliminate the kernel panics some customers have observed when accessing SMB shares. We have reverted this code change and are investigating alternative ways to eliminate the kernel panics.+<details><summary>(Build: 101.06.63)</summary> -## 101.05.17 + Build: **101.06.63**<br> +**What's new** +- Addressed a performance regression introduced in versionΓÇ»`101.05.17`. The regression was introduced with the fix to eliminate the kernel panics some customers have observed when accessing SMB shares. We have reverted this code change and are investigating alternative ways to eliminate the kernel panics. ++<br/> +</details> ++<details><summary>(Build: 101.05.17)</summary> ++ Build: **101.05.17**<br> ++**What's new** > [!IMPORTANT]-> We are working on a new and enhanced syntax for the `mdatp` command-line tool. The new syntax is currently the default in the Insider Fast and Insider Slow update channels. We encourage you to famliliarize yourself with this new syntax. -> -> We will continue supporting the old syntax in parallel with the new syntax and will provide more communication around the deprecation plan for the old syntax in the upcoming months. +> We are working on a new and enhanced syntax for theΓÇ»`mdatp`ΓÇ»command-line tool. The new syntax is currently the default in the Insider Fast and Insider Slow update channels. We encourage you to famliliarize yourself with this new syntax. +> We will continue supporting the old syntax in parallel with the new syntax and will provide more communication around the deprecation plan for the old syntax in the upcoming months. +- Addressed a kernel panic that occurred sometimes when accessing SMB file shares. +- Performance improvements & bug fixes -- Addressed a kernel panic that occurred sometimes when accessing SMB file shares-- Performance improvements & bug fixes+<br/> +</details> -## 101.05.16 +<details><summary>(Build: 101.05.16)</summary> -- Improvements to quick scan logic to significantly reduce the number of scanned files-- Added [autocompletion support](mac-resources.md#how-to-enable-autocompletion) for the command-line tool-- Bug fixes+ Build: **101.05.16**<br> -## 101.03.12 +**What's new** +- Improvements to quick scan logic to significantly reduce the number of scanned files. +- AddedΓÇ»[autocompletion support](mac-resources.md#how-to-enable-autocompletion)ΓÇ»for the command-line tool. +- Bug fixes -- Performance improvements & bug fixes+<br/> +</details> -## 101.01.54 +<details><summary>(Build: 101.03.12)</summary> -- Improvements around compatibility with Time Machine-- Accessibility improvements-- Performance improvements & bug fixes+ Build: **101.03.12**<br> -## 101.00.31 +**What's new** +- Performance improvements & bug fixes -- Improved [product onboarding experience for Intune users](/mem/intune/apps/apps-advanced-threat-protection-macos)-- Antivirus [exclusions now support wildcards](mac-exclusions.md#supported-exclusion-types)-- Added the ability to trigger antivirus scans from the macOS contextual menu. You can now right-click a file or a folder in Finder and select **Scan with Microsoft Defender for Endpoint**-- In-place product downgrades are now explicitly disallowed by the installer. If you need to downgrade, first uninstall the existing version and reconfigure your device-- Other performance improvements & bug fixes+<br/> +</details> -## 100.90.27 +<details><summary>(Build: 101.01.54)</summary> -- You can now [set an update channel](mac-updates.md#set-the-channel-name) for Microsoft Defender for Endpoint on macOS that is different from the system-wide update channel-- New product icon-- Other user experience improvements-- Bug fixes+ Build: **101.01.54**<br> ++**What's new** +- Improvements around compatibility with Time Machine +- Accessibility improvements +- Performance improvements & bug fixes ++<br/> +</details> ++<details><summary>(Build: 101.00.31)</summary> ++ Build: **101.00.31** <br> ++**What's new** +- ImprovedΓÇ»[product onboarding experience for Intune users](/mem/intune/apps/apps-advanced-threat-protection-macos) +- AntivirusΓÇ»[exclusions now support wildcards](mac-exclusions.md#supported-exclusion-types) +- Added the ability to trigger antivirus scans from the macOS contextual menu. You can now right-click a file or a folder in Finder and selectΓÇ»**Scan with Microsoft Defender for Endpoint**. +- In-place product downgrades are now explicitly disallowed by the installer. If you need to downgrade, first uninstall the existing version and reconfigure your device. +- Other performance improvements & bug fixes ++<br/> +</details> ++<details><summary>(Build: 100.90.27)</summary> ++ Build: **100.90.27** <br> ++**What's new** +- You can nowΓÇ»[set an update channel](mac-updates.md#set-the-channel-name)ΓÇ»for Microsoft Defender for Endpoint on macOS that is different from the system-wide update channel. +- New product icon +- Other user experience improvements +- Bug fixes -## 100.86.92 +<br/> +</details> -- Improvements around compatibility with Time Machine-- Addressed an issue where the product was sometimes not cleaning all files under `/Library/Application Support/Microsoft/Defender` during uninstallation-- Reduced the CPU utilization of the product when Microsoft products are updated through Microsoft AutoUpdate-- Other performance improvements & bug fixes+<details><summary>(Build: 100.86.92)</summary> -## 100.86.91 + Build: **100.86.92**<br> +**What's new** +- Improvements around compatibility with Time Machine +- Addressed an issue where the product was sometimes not cleaning all files underΓÇ»`/Library/Application Support/Microsoft/Defender`ΓÇ»during uninstallation. +- Reduced the CPU utilization of the product when Microsoft products are updated through Microsoft AutoUpdate. +- Other performance improvements & bug fixes ++<br/> +</details> ++<details><summary>(Build: 100.86.91)</summary> ++ Build: **100.86.91**<br> ++**What's new** > [!CAUTION] > To ensure the most complete protection for your macOS devices and in alignment with Apple stopping delivery of macOS native security updates to OS versions older than [current - 2], MDATP for Mac deployment and updates will no longer be supported on macOS Sierra [10.12]. MDATP for Mac updates and enhancements will be delivered to devices running versions Catalina [10.15], Mojave [10.14], and High Sierra [10.13]. > > If you already have MDATP for Mac deployed to your Sierra [10.12] devices, please upgrade to the latest macOS version to eliminate risks of losing protection. -- Performance improvements & bug fixes+- Performance improvements & bug fixes -## 100.83.73 +<br/> +</details> -- Added more controls for IT administrators around [management of exclusions](mac-preferences.md#exclusion-merge-policy), [management of threat type settings](mac-preferences.md#threat-type-settings-merge-policy), and [disallowed threat actions](mac-preferences.md#disallowed-threat-actions)-- When Full Disk Access is not enabled on the device, a warning is now displayed in the status menu+<details><summary>(Build: 100.83.73)</summary> ++ Build: **100.83.73**<br> ++**What's new** +- Added more controls for IT administrators aroundΓÇ»[management of exclusions](mac-preferences.md#exclusion-merge-policy),ΓÇ»[management of threat type settings](mac-preferences.md#threat-type-settings-merge-policy), andΓÇ»[disallowed threat actions](mac-preferences.md#disallowed-threat-actions). +- When Full Disk Access is not enabled on the device, a warning is now displayed in the status menu. - Performance improvements & bug fixes+ +<br/> +</details> -## 100.82.60 +<details><summary>(Build: 100.82.60)</summary> + Build: **100.82.60** <br> ++**What's new** - Addressed an issue where the product fails to start following a definition update. -## 100.80.42 +<br/> +</details> ++<details><summary>(Build: 100.80.42)</summary> + Build: **100.80.42**<br> ++**What's new** - Bug fixes -## 100.79.42 +<br/> +</details> -- Fixed an issue where Microsoft Defender for Endpoint on Mac was sometimes interfering with Time Machine-- Added a new switch to the command-line utility for testing the connectivity with the backend service+<details><summary>(Build: 100.79.42)</summary> ++ Build: **100.79.42**<br> +**What's new** +- Fixed an issue where Microsoft Defender for Endpoint on Mac was sometimes interfering with Time Machine. +- Added a new switch to the command-line utility for testing the connectivity with the backend service + ```bash mdatp connectivity test ```--- Added ability to view the full threat history in the user interface (can be accessed from the **Protection history** view)+- Added ability to view the full threat history in the user interface (can be accessed from theΓÇ»**Protection history**ΓÇ»view). - Performance improvements & bug fixes -## 100.72.15 +<br/> +</details> -- Bug fixes+<details><summary>(Build: 100.72.15)</summary> ++ Build: **100.72.15**<br> ++**What's new** +- Bug fixes ++<br/> +</details> -## 100.70.99 +<details><summary>(Build: 100.70.99)</summary> + Build: **100.70.99**<br> ++**What's new** - Addressed an issue that impacts the ability of some users to upgrade to macOS Catalina when real-time protection is enabled. This sporadic issue was caused by Microsoft Defender for Endpoint locking files within Catalina upgrade package while scanning them for threats, which led to failures in the upgrade sequence. -## 100.68.99 +<br/> +</details> -- Added the ability to configure the antivirus functionality to run in [passive mode](mac-preferences.md#enforcement-level-for-antivirus-engine)-- Performance improvements & bug fixes+<details><summary>(Build: 100.68.99)</summary> -## 100.65.28 + Build: **100.68.99**<br> -- Added support for macOS Catalina+**What's new** +- Added the ability to configure the antivirus functionality to run inΓÇ»[passive mode](mac-preferences.md#enforcement-level-for-antivirus-engine). +- Performance improvements & bug fixes - > [!CAUTION] - > macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender for Endpoint is not able to fully protect your device. - > - > The mechanism for granting this consent depends on how you deployed Microsoft Defender for Endpoint: - > - > - For manual deployments, see the updated instructions in the [Manual deployment](mac-install-manually.md#how-to-allow-full-disk-access) topic. - > - For managed deployments, see the updated instructions in the [JAMF-based deployment](mac-install-with-jamf.md) and [Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles) topics. +<br/> +</details> -- Performance improvements & bug fixes+<details><summary>(Build: 100.65.28)</summary> ++ Build: **100.65.28**<br> ++**What's new** +- Added support for macOS Catalina. +> [!CAUTION] +> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender for Endpoint is not able to fully protect your device. +> +> The mechanism for granting this consent depends on how you deployed Microsoft Defender for Endpoint: +> +> - For manual deployments, see the updated instructions in theΓÇ»[Manual deploymentΓÇ»topic](mac-install-manually.md#how-to-allow-full-disk-access). +> - For managed deployments, see the updated instructions in theΓÇ»[JAMF-based deployment](mac-install-with-jamf.md)ΓÇ»andΓÇ»[Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles) topics. ++- Performance improvements & bug fixes ++<br/> +</details> ++<br/><br/> +</details> |
| security | Troubleshoot Performance Issues | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/troubleshoot-performance-issues.md | If the previous step doesn't solve the problem, you can collect more information Process Monitor (ProcMon) is an advanced monitoring tool that can show real-time processes. You can use this to capture the performance issue as it is occurring. -1. Download [Process Monitor v3.60](/sysinternals/downloads/procmon) to a folder like `C:\temp`. +1. Download [Process Monitor v3.89](/sysinternals/downloads/procmon) to a folder like `C:\temp`. 2. To remove the file's mark of the web: 1. Right-click **ProcessMonitor.zip** and select **Properties**. |
| security | Advanced Hunting Fileprofile Function | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-fileprofile-function.md | The `FileProfile()` function is an enrichment function in [advanced hunting](adv | `Issuer` | `string` | Information about the issuing certificate authority (CA) | | `SignerHash` | `string` | Unique hash value identifying the signer | | `IsCertificateValid` | `boolean` | Whether the certificate used to sign the file is valid |-| `IsRootSignerMicrosoft` | `boolean` | Indicates whether the signer of the root certificate is Microsoft | +| `IsRootSignerMicrosoft` | `boolean` | Indicates whether the signer of the root certificate is Microsoft and the file is built-in to Windows OS | | `SignatureState` | `string` | State of the file signature: SignedValid - the file is signed with a valid signature, SignedInvalid - the file is signed but the certificate is invalid, Unsigned - the file is not signed, Unknown - information about the file cannot be retrieved | `IsExecutable` | `boolean` | Whether the file is a Portable Executable (PE) file | | `ThreatName` | `string` | Detection name for any malware or other threats found | |
| security | Enable The Report Message Add In | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/enable-the-report-message-add-in.md | After the add-in is installed and enabled, you'll see the following icons: > :::image type="content" source="../../media/microsoft-365-admin-center-report-phishing-edit.png" alt-text="The Report Phishing flyout." lightbox="../../media/microsoft-365-admin-center-report-phishing-edit.png"::: 3. To remove the add-in, select **Remove app** under **Actions** in the same flyout.++## Get the Report Message or the Report Phishing add-ins for the GCC and GCCH users ++If you're a Government Community Cloud High (GCCH) or a Government Community Cloud (GCC) admin, use the following steps to get the Report Message or the Report Phishing add-ins for your organization. Note that if you're an individual user, you can't get the add-in using Microsoft AppSource. ++> [!NOTE] +> It could take up to 24 hours for the add-in to appear in your organization. ++1. In the Microsoft 365 admin center, go to **Settings** \> **Add-ins**, and select **Deploy Add-In**. ++2. The **Deploy a new add-in** flyout opens. Click **Next**, and then select **Upload custom apps**. ++3. Select **I have a URL for the manifest file**. Use the following URLs to get the [Report Message](https://ipagave.azurewebsites.net/ReportMessageManifest/ReportMessageAzure.xml) and the [Report Phishing](https://ipagave.azurewebsites.net/ReportMessageManifest/ReportPhishingAzure.xml) add-ins. ++4. Choose which users will have access to the add-in and select a deployment method, and then select **Deploy**. ++5. To fully configure the settings, see [User reported message settings](user-submission.md). ++## Use the Report Message or the Report Phishing add-ins ++You can use the Report Message or the Report Phishing add-ins to submit false positives (good email that was blocked or sent to junk folder) and false negatives (unwanted email or phish that was delivered to the inbox) in Outlook. For more information, see [Report false positives and false negatives in Outlook](report-false-positives-and-false-negatives.md). |
| security | Manage Tenant Allow Block List | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/manage-tenant-allow-block-list.md | This article describes how to configure entries in the Tenant Allow/Block List i - File hashes = 64 - URL = 250 -- An entry should be active within 30 minutes.+- An entry should be active within 30 minutes, but it might take up to 24 hours for the entry to be active. - By default, entries in the Tenant Allow/Block List will expire after 30 days. You can specify a date or set them to never expire (for block type of entries). |
| security | Quarantine Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-policies.md | For new organizations or older organizations that never had end-user spam notifi 1. In the [Microsoft 365 Defender portal](https://security.microsoft.com), go to **Email & collaboration** \> **Policies & Rules** \> **Threat policies** \> **Quarantine policies** in the **Rules** section. Or, to go directly to the **Quarantine policies** page, use <https://security.microsoft.com/quarantinePolicies>. + :::image type="content" source="../../medio-quarantine-policy-page.png"::: + 2. On the **Quarantine policies** page, click  **Add custom policy**. 3. The **New policy** wizard opens. On the **Policy name** page, enter a brief but unique name in the **Policy name** box. You'll need to identify and select the quarantine policy by name in upcoming steps. When you're finished, click **Next**. The global settings for quarantine policies allow you to customize the quarantin 4. When you're finished, click **Save**. + :::image type="content" source="../../medio-quarantine-policy-quarantine-notification-settings.png"::: + ## View quarantine policies in the Microsoft 365 Defender portal 1. In the Microsoft 365 Defender portal, go to **Email & collaboration** \> **Policies & rules** \> **Threat policies** \> **Quarantine policies** in the **Rules** section. Or, to go directly to the **Quarantine policies** page, use <https://security.microsoft.com/quarantinePolicies>. |
| security | Assess The Impact Of Security Configuration Changes With Explorer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/assess-the-impact-of-security-configuration-changes-with-explorer.md | + + Title: Assess the impact of security configuration changes with Explorer +description: Examples and walkthrough of using Explorer to determine the impact of a security control (configuration) change in Microsoft Defender for Office 365 +search.product: +search.appverid: +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +++ms.localizationpriority: medium ++audience: ITPro +++ms.technology: mdo +++# Assess the impact of security configuration changes with Explorer ++Before you make change(s) to your security configuration, such as policies or transport rules, itΓÇÖs important to understand the impact of the change(s) so that you can plan and ensure *minimal* disruption to your organization. ++This step-by-step guide will take you through assessing a change, and exporting the impacted emails for assessment. The procedure can be applied to many different changes, by altering the criteria (filters) you use in explorer. ++## What you'll need ++- Microsoft Defender for Office 365 Plan 2 (included as part of E5). +- Sufficient permissions (Security reader minimum required to assess via Threat Explorer). +- 5-10 minutes to perform the steps below. ++## Assess changing normal confidence phish delivery location to quarantine (from the Junk email folder) ++1. **Login** to the security portal and navigate to Explorer (underneath *Email & Collaboration* on the left nav) <https://security.microsoft.com/threatexplorer>. +1. Select **Phish** from the top tab selection (*All email* is the default view). +1. Press the **filter** button (defaulted to *Sender*) and select **Phish confidence level**. +1. Select the **Phish confidence level** of **Normal**. +1. Add an additional **filter** of **Original delivery location** set as **Junk folder**. +1. Press **Refresh**. Explorer is now filtered to show all the mail that is detected as *high confidence phish* and gets delivered to the Junk folder due to the settings in the anti-spam policy. +1. If you wish to pivot the data displayed in the chart, you can do by using the **data slicer top left of the chart (defaulted to *Delivery action*)**, selecting useful data such as **Sender IP**, or **Sender domain** to spot trends and top affected senders. +1. Below the chart section, where the affected emails are displayed, select **Export email list**, which will generate a CSV for offline analysis. **This is a list of the emails which would be quarantined if the phish action was changed to Quarantine (recommended change for both standard and strict presets)**. ++## Assess removing a sender / domain override removal ++1. **Login** to the security portal and navigate to **Explorer** (underneath Email & Collaboration on the left nav) <https://security.microsoft.com/threatexplorer>. +1. Select **All email** if not already selected. +1. Press the **filter** button (defaulted to *Sender*) and add either a sender or sender domain filter, then add the entry where you wish to assess the impact of removal. +1. Expand the date range to the maximum & press **Refresh** You should now see mail listed if the sender / sending domain is still active in messaging your organization. If *not* you may need to tweak the filter, or alternatively you no longer receive mail from that domain / sender and can remove the entry safely. +1. If mail is listed, this means the entry is still an active sender. Pivot the data in the chart using the data slicer (defaulted to *Delivery action*) to **Detection technology**. +1. The chart should refresh, and if it now displays no data, this means we have not detected any threats on any of the mail previously shown, which indicates an override is not needed, as there is no detection to override. +1. If there is data displayed when the data is sliced by **Detection technology**, this means removing the override *would* have impact on this sender / domain due to the protection stack taking action. +1. You should investigate the mail further to assess if it is truly malicious and the entry can be removed, or if it is a *false positive* and should be remediated so it is no longer incorrectly detected as a threat (authentication is the biggest cause of false positives). ++### Further reading ++Consider using secure presets [Ensuring you always have the optimal security controls with preset security policies](/microsoft-365/security/office-365-security/step-by-step-guides/ensuring-you-always-have-the-optimal-security-controls-with-preset-security-policies) ++You can also manage email authentication issues with spoof intelligence [Spoof intelligence insight](/microsoft-365/security/office-365-security/learn-about-spoof-intelligence) ++Learn more about email authentication [Email Authentication in Exchange Online Protection](/microsoft-365/security/office-365-security/email-validation-and-authentication) |
| security | Deploy And Configure The Report Message Add In | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/deploy-and-configure-the-report-message-add-in.md | + + Title: Deploy and configure the report message add-in +description: The steps to deploy and configure Microsoft's phish reporting add-in(s) aimed at security administrators +search.product: +search.appverid: +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +++ms.localizationpriority: medium ++audience: ITPro +++ms.technology: mdo +++# Deploy and configure the report message add-in to users. ++The Report message and report phishing add-in for Outlook makes it easy to report phishing to Microsoft and its affiliates for analysis, along with easy triage for admins in the [submissions portal](https://security.microsoft.com/reportsubmission?viewid=user). ++Depending on whether you are licensed for Defender for Office 365, you'll also get added functionality such as alerting & automated investigation and response (AIR), which will remove the burden from your security operations staff. This guide will walk you through configuring the add-in deployment as recommended by the Microsoft Defender for Office 365 team. ++## Choose between which add-in to deploy ++- The Report Phishing add-in provides the option to report only phishing messages +- The Report Message add-in provides the option to report junk, not junk (false positive), and phishing messages +++## What you'll need ++- Exchange Online Protection (some features require Defender for Office 365 Plan 2) +- Sufficient permissions (Global admin for add-in deployment, security admin for customisation) +- 5-10 minutes to perform the steps below ++## Deploy the add-in for users ++1. **Login** to the Microsoft 365 admin center. https://admin.microsoft.com. +1. On the left nav, press **Show All** then expand **Settings** and select **Integrated Apps**. +1. On the page that loads, press **Get Apps**. +1. In the page that appears, in the top right Search box, enter **Report Message** or **Report Phishing**, and then select **Search**. +1. Press **Get it now** on your chosen app within the search results (publisher is **Microsoft Corporation**). +1. On the flyout that appears, select who to deploy the add-in to. If testing you may wish to use a specific group, otherwise configure it for the **entire organisation** ΓÇô when youΓÇÖve made a selection press **Next**. +1. Review the permissions, information and capabilities then press **Next**. +1. Press **Finish deployment** (it can take 12-24 hours for the add-in to appear automatically in Outlook clients). ++## Configure the add-in for users +1. **Login** to the Microsoft Security portal at https://security.microsoft.com. +2. On the left nav, under **Email & collaboration**, select **Policies & rules**. +3. Select **Threat policies**. +4. Select **User reported message settings** underneath the **Others** heading. +5. Ensure **Microsoft Outlook Report Message button** is toggled to **On**. +6. Under **Send the reported messages to** choose **Microsoft** (Recommended). +7. Ensure **Let users choose if they want to report** is unchecked and **Always report the message** is selected. +8. Press **Save**. ++## Optional steps ΓÇô configure notifications ++1. On the configuration page from the earlier steps, underneath the **User reporting experience**, configure the before and after reporting pop-ups title and body if desired. The end users will see the before reporting pop up if **Ask me before reporting** is also enabled. +2. If you wish for notifications to come from an internal organisational mailbox, select **Specify Office 365 email address to use as sender** and search for a valid mailbox in your organisation to send the notifications from. +3. Press **Customize notifications** to set up the text sent to reporting users after admin reviews a reported message using Mark & Notify, configure the **Phishing**, **Junk** & **No threats** found options. +4. On the **Footer** tab, select the global footer to be sent for notifications, along with your organisationΓÇÖs logo if appropriate. +++### Further reading +Learn more about user reported message settings [User reported message settings - Office 365 | Microsoft Docs](../user-submission.md) ++Enable the report message or report phishing add-in [Enable the Report Message or the Report Phishing add-ins - Office 365 | Microsoft Docs](../enable-the-report-message-add-in.md) |
| security | How To Enable Dmarc Reporting For Microsoft Online Email Routing Address Moera And Parked Domains | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/how-to-enable-dmarc-reporting-for-microsoft-online-email-routing-address-moera-and-parked-domains.md | + + Title: How to enable DMARC Reporting for Microsoft Online Email Routing Address (MOERA) and parked Domains +description: The steps to configure DMARC for MOERA and parked domains. +search.product: +search.appverid: +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +++ms.localizationpriority: medium ++audience: ITPro +++ms.technology: mdo +++# How to enable DMARC Reporting for Microsoft Online Email Routing Address (MOERA) and parked Domains ++Best practice for domain email security protection is to protect yourself from spoofing using Domain-based Message Authentication, Reporting, and Conformance (DMARC). If you havenΓÇÖt already enabled DMARC for your domains, that should be the first step, detailed here: [Domain-based Message Authentication, Reporting, and Conformance (DMARC)](/microsoft-365/security/office-365-security/use-dmarc-to-validate-email) ++This guide is designed to help you configure DMARC for the domains not covered in the above guide, both your Microsoft Online Email Routing Address (MOERA) aka contosocorp.onmicrosoft.com and parked domains which you may not be using for email yet, but could be leveraged by attackers until protected. ++## What youΓÇÖll need ++- Microsoft 365 admin centre and access to your DNS provider hosting your domains +- Sufficient permissions as Global Admin to make the appropriate changes in the Microsoft 365 Admin Center +- 10 Minutes to complete the following steps ++## Activate DMARC for MOERA Domain ++1. Login to the [Microsoft 365 Admin Center](https://admin.microsoft.com). +1. On the left-hand navigation, select **Show All**. +1. Expand Settings and press **Domains**. +1. Select your tenant domain (contoso.onmicrosoft.com). +1. On the page that loads, select **DNS records**. +1. Select **+ Add record**. +1. A flyout will appear on the right, ensure that the selected Type is **TXT (Text)**. +1. Add _dmarc as TXT name. +1. Add your specific DMARC value. +1. Press **Save**. ++## Active DMARC for parked domains ++1. Check if SPF is already configured for your parked domain, following this guide: [Set up SPF to help prevent spoofing - Office 365 | Microsoft Docs](/microsoft-365/security/office-365-security/set-up-spf-in-office-365-to-help-prevent-spoofing#how-to-handle-subdomains) +1. Contact your DNS Domain provider. +1. Ask to add this DMARC txt record with your appropriate email addresses `v=DMARC1; p=reject; rua=mailto:d@rua.contoso.com;ruf=mailto:d@ruf.contoso.com`. ++## Next Steps ++Wait until the DNS changes are propagated and try to spoof the configured domains. Check if the attempt is blocked based in the DMARC record, and you receive a DMARC report. ++## More Information ++[Set up SPF to help prevent spoofing - Office 365 | Microsoft Docs](/microsoft-365/security/office-365-security/set-up-spf-in-office-365-to-help-prevent-spoofing) +[Use DMARC to validate email, setup steps - Office 365 | Microsoft Docs](/microsoft-365/security/office-365-security/use-dmarc-to-validate-email) |