Docs update tracker

Updates from: 07/15/2023 04:13:48

Category	Microsoft Docs article	Related commit history on GitHub	Change details
compliance	Audit Log Search	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/audit-log-search.md	Here's the process for searching the audit log in Microsoft 365. > [!TIP] > If you're using the maximum date range of 90 days, select the current time for the Start date. Otherwise, you'll receive an error saying that the start date is earlier than the end date. If you've turned on auditing within the last 90 days, the maximum date range can't start before the date that auditing was turned on. - 2. Activities: Select the drop-down list to display the activities that you can search for. User and admin activities are organized into groups of related activities. You can select specific activities or you can select the activity group name to select all activities in the group. You can also select a selected activity to clear the selection. After you run the search, only the audit log entries for the selected activities are displayed. Selecting Show results for all activities displays results for all activities performed by the selected user or group of users.<br/><br/>Over 100 user and admin activities are logged in the audit log. Select the Audited activities tab at the article of this article to see the descriptions of every activity in each of the different services. + 2. Activities: Select the drop-down list to display the activities that you can search for. User and admin activities are organized into groups of related activities. You can select specific activities or you can select the activity group name to select all activities in the group. You can also select a selected activity to clear the selection. After you run the search, only the audit log entries for the selected activities are displayed. Selecting Show results for all activities displays results for all activities performed by the selected user or group of users.<br/><br/>Over 100 user and admin activities are logged in the audit log. See the [Audit log activities](audit-log-activities.md) article to see the descriptions of every activity in each of the different services. 3. Users: Select in this box and then select one or more users to display search results for. The audit log entries for the selected activity performed by the users you select in this box are displayed in the list of results. Leave this box blank to return entries for all users (and service accounts) in your organization.
compliance	Audit New Search	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/audit-new-search.md	f1.keywords: Previously updated : 06/12/2023 Last updated : 07/13/2023 audience: Admin # Audit New Search -Your organization requires access to critical audit log event data to gain insight and further investigate user activities. Previously, your search jobs in the Microsoft Purview compliance portal UI were limited in their ability to create concurrent audit search jobs and review historical search jobs. These critical audit search jobs also had a dependency on the browser window remaining open in order to complete. +Your organization requires access to critical audit log event data to gain insight and further investigate user activities. Previously, your search jobs in the Microsoft Purview compliance portal were limited to creating concurrent audit search jobs and reviewing historical search jobs. These critical audit search jobs also had a dependency on the browser window remaining open in order to complete. The Audit New Search builds upon the existing search functionalities and includes the following key improvements: -- Search jobs initiated via the compliance portal UI no longer require the web browser window to remain open in order to complete. These jobs will continue to run even after the browser window is closed.-- Completed search jobs are now stored for 30 days, giving customers the ability to reference historical audit searches. These search jobs are presented in the UI, listing the search name, search job status, progress %, Number of results, Creation Time, and Searched by. +- Search jobs initiated via the compliance portal no longer require the web browser window to remain open in order to complete. These jobs will continue to run even after the browser window is closed. +- Completed search jobs are now stored for 30 days, giving you the ability to reference historical audit searches. - Each admin Audit account user can have a maximum of 10 concurrent search jobs in progress with a maximum of one unfiltered search job. [!INCLUDE [purview-preview](../includes/purview-preview.md)] -## Information to get started +## Before you begin -View the available Microsoft Purview Audit documentation as the search job creation and export experiences have many parallels with the current search experience: +- Review the following Microsoft Purview Audit articles for activity detail information. Search job creation and export functionality are highly dependent the nuances of the audit log data. -- [Search the audit log in the Microsoft Purview compliance portal](audit-log-search.md) (note that PowerShell isn't yet compatible with Audit Search V2)-- [Detailed properties in the audit log](audit-log-detailed-properties.md)-- [Export, configure, and view audit log records](audit-log-export-records.md) + - [Audit log activities](audit-log-search.md) + - [Detailed properties in the audit log](audit-log-detailed-properties.md) + - [Export, configure, and view audit log records](audit-log-export-records.md) -Additional information: --- Searching via an EXO PowerShell session using the Search-UnifiedAuditLog cmdlet isn't compatible with the New Search at this time.-- Search jobs can take in the following criteria: Date Range, Time Range, Search Job Name, Activities, Users, Files, Folders, and Sites.-- Searching and filtering using date, time, search name, activities, and users are all fully functional-- Audit Log data is stored for the defined retention period, regardless of a search job being deleted +- Searching via an Exchange Online PowerShell session using the [Search-UnifiedAuditLog](/powershell/module/exchange/search-unifiedauditlog) cmdlet isn't currently compatible with the New Search. ## Get started with audit new search -Follow the below steps to test and validate the Audit New Search experience: +Complete the following steps to get started with the Audit New Search: -1. Sign into the [Microsoft Purview compliance portal](https://compliance.microsoft.com) -2. Select the Audit tab on the left panel of the homepage to navigate to the Audit tool -3. Select New Search tab at the top of the Audit page +1. Sign into the [Microsoft Purview compliance portal](https://compliance.microsoft.com). +2. Select the Audit tab on the left panel of the homepage to navigate to the Audit tool. +3. Select New Search tab at the top of the Audit page. ![Audit New Search overview in Microsoft Purview.](../media/audit-search/audit-new-search.png) -4. Test different search jobs in the Audit New Search tool using various search criteria. -Some examples of different searches include the following criteria. Explore these different search methods while performing searches on the audit log. +4. On the New Search tab, configure the following search criteria as applicable: + + 1. Start date and End date: The last seven days are selected by default. Select a date and time range to display the events that occurred within that period. The date and time are presented in Coordinated Universal Time (UTC). The maximum date range that you can specify is 90 days. An error is displayed if the selected date range is greater than 90 days. + + > [!TIP] + > If you're using the maximum date range of 90 days, select the current time for the Start date. Otherwise, you'll receive an error saying that the start date is earlier than the end date. If you've turned on auditing within the last 90 days, the maximum date range can't start before the date that auditing was turned on. + + 2. Keyword Search: Enter a keyword or phrase to search for in the audit log. The keyword or phrase is searched for in the audit log or in the file, folder, or sites (if specified) for the search. To search for text that contains special characters, replace the special characters with an asterisk(\) in your keyword search. For example, to search for test_search_document, use test\search\document. + + > [!IMPORTANT] + > Terms entered in the Keyword Search* field are only searched within indexed content (content within the Audit common schema). Audit data content in the audit log isn't searched for these keywords. + + 3. Admin Units (preview): Select the drop-down list to display the [administrative units](/microsoft-365/compliance/microsoft-365-compliance-center-permissions#administrative-units-preview) you want the audited activities scoped to for your search. You can select one or more administrative units to scope your search to. Leave this box blank to return entries for all administrative units in your organization. + + 4. Activities - friendly names: Select the drop-down list to display the friendly names for audited activities that you can search for. Friendly names for user and admin activities are organized into groups of related activities. Using friendly names, you can select specific audited activities or you can select the activity group name to select all activities in the group. You can also select a selected activity to clear the selection. To search for a friendly name for the activities in the list, use the search box above the list. + + 5. Activities - operations names (preview): Enter the exact operation names to search for audited activities to include in your search results. You can enter one or more operation names, separated by commas. This search criterion is similar to previous searches only available in PowerShell and provides greater flexibility helping you find the data that you need. + + > [!IMPORTANT] + > Operation names must be entered exactly as they are named. If operation names are entered incorrectly, no results are returned. + + For example, to search for all activities related to enabling and disabling information barriers for a SharePoint site in your organization, you would: + + - Review the [audit activities](/microsoft-365/compliance/audit-log-activities) article to find the exact operation name for the information barriers activities you want to search for. In this [example](/microsoft-365/compliance/audit-log-activities#information-barriers-activities), the operation names are SPOIBIsEnabled and SPOIBIsDisabled. + - Enter SPOIBIsEnabled,SPOIBIsDisabled in operation search field. We recommend copying and pasting the operation names directly from the article to the operation search field to ensure that they're entered correctly and without typos. + + 6. Record types: Select the drop-down list to display the record types for audited activities that you can search for. You can select one or more record types to search for. To search for a record type in the list, use the search box above the list.<br><br> Specific [record types](/microsoft-365/compliance/audit-log-search#microsoft-365-services-that-support-auditing) are associated with specific Microsoft services and applications. For example, if you wanted to scope your search for specific record types associated with sensitivity labels in Microsoft Purview Information Protection (MIP), you could select the MIPLabel, MipAutoLabelExchangeItem, MipAutoLabelSharePointItem, and MipAutoLabelSharePointPolicyLocation record types from the list. + + 7. Search name: Enter in a custom name for your search job. This name is used to identify your search job in the search job history. If you don't enter a name, the search job is automatically named using a combination of the date and time defined for the search and other defined search criteria values. + + 8. Users: Select this field and choose the names one or more users to display search results for. The audit log entries for the selected activity performed by the users you select in this box are displayed in the list of results. Leave this box blank to return entries for all users (and service accounts) in your organization. + + 9. File, folder, or site: Enter some or all of a file or folder name to search for activity related to the file of folder that contains the specified keyword. This search criterion returns all related results for corresponding file, folders, and sites. You can also specify a URL of a file or folder. If you use a URL, be sure the type the full URL path or if you type a portion of the URL, don't include any special characters or spaces (however, using the wildcard character (\) is supported). Leave this box blank to return entries for all files and folders in your organization. + +5. Select Search* to start your search job. A maximum of 10 search jobs can be run in parallel for one user account. If a user requires more than 10 search jobs, they must wait for an In progress job to finish or delete a search job. - - Search across different time frames. - - One day - - Week - - Month - - Several Months - - Search across selected users - - Scoping the search using the activities field - - Adding a specific file, folder, or site - - Scoping the search using administrative units +## Search job dashboard - > [!IMPORTANT] - > Terms entered in the Keyword Search field are only searched within indexed content (content within the Audit common schema). Audit data content in the audit log isn't searched for these keywords. +Active and completed search jobs are displayed in the search job dashboard. The dashboard displays the following information for each search job: - > [!NOTE] - > To search for text that contain special characters, replace the special characters with an asterisk(\) in your keyword search. For example, to search for test_search_document, use test\search\document. +- Search name: The name of the search job. The full search name for a job can be seen by hovering the cursor over the search job name. +- Job status: The status of the search job. The status can be Queued, In Progress, or Completed. +- Progress (%): The percentage of the search job that has been completed. +- Search time: The total running time that elapsed to complete the search job. +- Total results: The total number of results returned by the search job. +- Creation time: The date and time the search job was created in UTC. +- Search performed by: The user account that created the search job. -5. Initiate another 2-9 searches in the compliance portal. A maximum of 10 search jobs can be run in parallel in one account. -6. Explore the search job history and select different search jobs to get their corresponding data from the search job results. Results can be sorted by their creation time by selecting the corresponding button at the top of the table. +![Results of a Audit New Search overview in Microsoft Purview.](../media/audit-search/audit-new-search-columns.png) - ![Results of a Audit New Search overview in Microsoft Purview.](../media/audit-search/audit-new-search-columns.png) +Delete search jobs by selecting the job and then selecting Delete* on the command bar. Deleting a search job doesn't delete the backend data associated with search. It only deletes the search job definition and the associated search result. -7. Select a search job to see the results of the job displayed in a line-item format. Explore the various functionalities in the UI, including: +To copy the search criteria for an existing search job, select the job and then select Copy this search on the command bar. The search criteria are copied to the search page and you can modify the search criteria as needed for a new search. - - Referencing the complete search query at the top of the page, which includes all search criteria entered when completing the original search - - Selecting various results for more information in the fly-out window - - Filtering across the search job using IP address, User, Activity, Date, Item, and Details. - - Exporting both unfiltered and filtered searches - - Sorting the results by clicking the corresponding buttons on the top of the table including Date, IP Address (when applicable), User, Activity, Item, and Detail (when applicable). +## Search job details dashboard - ![Sorting results of a Audit New Search overview in Microsoft Purview.](../media/audit-search/audit-new-search-result-details.png) +To view details about a search job, select the search job. The total number of items in the job is included at the top of the dashboard. The total result number deducts duplicates, which is why it might be less than the number of items in the search job dashboard. -## Audit search job overview +![Search job item detail dashboard.](../media/audit-search/audit-search-job-details-dashboard.png) -- Search jobs can take in the following criteria: Date Range, Time Range, Search Job Name, Activities, Users, Files, Folders, and Sites.-- File, folder, or site search text box will return all related results for corresponding file, folders, and sites-- The search jobs runs at the bottom of the search page. - - Search jobs can be Queued, In Progress, and Completed - - A maximum of 10 In Progress search jobs can be completed simultaneously per user -- Full search names for jobs can be seen by hovering the cursor over the search job-- Search jobs display the Search Name, Status, Progress %, Number of results, creation time, and searched by +The search job details dashboard displays following information about the individual items gathered in the search job results: -## Audit search results overview +- Date (UTC): The date and time the activity occurred. +- IP Address: The IP address of the device that was used to perform the activity. +- User: The user account that performed the activity. +- Record type: The record type associated with the activity. +- Activity: The friendly name of the activity that was performed. +- Item: The name of the file, folder, or site that the activity was acted on. +- Admin Units (preview): The admin unit that the user account that performed the activity belongs to. +- Details: Additional details about the activity. -- Search results are displayed in a line-item once a search job is selected-- The search query is displayed on the top of the search job results page for reference and the total number of items - > [!NOTE] - > The total result number deducts duplicates, which is why it might be less than the number of items in the main Audit search window -- Information about the date, IP Address, User, Activity, and Item can be found in the search job results page for each item-- Select an activity to see a fly-out window with more details about the activity-- The filtering feature for search job results can help to parse through results.-- Export all search job items to a .csv file as needed. Export supports results up to 50 KB for Audit (Standard) and up to 500 KB (500,000 rows) for Audit (Premium). +You can sort the search job items using the column headers or create a custom filter using the filter pane. Use the filter to filter the search job items for specific values for any of the dashboard column criteria. To export all search job items to a .csv file, select Export on the command bar. Export supports results up to 50 KB for Audit (Standard) and up to 500 KB (500,000 rows) for Audit (Premium). -## Frequently asked questions +Select a specific activity to see more details about the activity in a fly-out window. The fly-out window displays the additional information about the activity. -- Is there a maximum number of search jobs per user? - There's a maximum of 10 In progress search jobs per user. If a user requires more than 10 search jobs, they must wait for an In progress job to finish or delete a search job. We would appreciate your feedback on this limit. -- Does deletion of a search job delete the back-end data? - No, the deletion of the search job will only delete the search job definition and the associated search result. +![Search job item details.](../media/audit-search/audit-new-search-result-details.png)
compliance	Create Apply Retention Labels	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-apply-retention-labels.md	When you use a standard retention label as your default label for an Outlook fol - If you move an item with a default retention label from one folder to another folder with a different default retention label: The item gets the new default retention label. -- If you move an item with a default retention label from one folder to another folder with no default retention label: The old default retention label is removed. +- If you move an item with a default retention label from one folder to another folder with no default retention label: The old default retention label is removed [unless the new folder is the Deleted Items folder](/exchange/reference/retention-deleted-items). When labels are applied that aren't standard retention labels but mark items as [records (or regulatory records)](records-management.md#records), these labels can only be manually changed or removed.
compliance	Dlp Configure Endpoint Settings	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-configure-endpoint-settings.md	f1.keywords: Previously updated : 06/02/2023 Last updated : 07/14/2023 audience: ITPro f1_keywords: To access these settings, from the Microsoft Purview compliance portal, navigate ## Endpoint DLP Windows 10/11 and macOS settings The following table describes the supported endpoint settings for Windows 10/11 and macOS. -\|Setting \|Windows 10, 1809 and later, Windows 11 \|macOS (three latest released versions) \|Notes \| -\|\|\|\|\| -\|Advanced classification \| Supported \| Supported (preview)\|Advanced classification enables these features for macOS (preview): - [Document Fingerprinting](document-fingerprinting.md) </br>- [Exact data match based sensitive information types](sit-learn-about-exact-data-match-based-sits.md#learn-about-exact-data-match-based-sensitive-information-types) </br>- [Trainable classifiers](classifier-learn-about.md) </br>- [Learn about named entities](named-entities-learn.md) \| -\|File path exclusions \|Supported \|Supported \|macOS includes a recommended list of exclusions that is on by default \| -\|Network share coverage and exclusions \| Supported \|Not Supported\| -\|Restricted apps \|Supported \|Supported \| \| -\|Restricted app groups \|Supported \|Supported (preview)\| -\|Unallowed Bluetooth apps \|Supported \|Supported \| \| -\|Browser and domain restrictions to sensitive items \|Supported \|Supported \| \| -\|Additional settings for Endpoint DLP \|Supported \|Supported \|Only the default business justifications are supported for macOS devices \| -\|Always audit file activity for devices \|Supported \|Supported \| \| -\|Printer groups\| Supported \|Not Supported\| \| -\|Removable USB device groups\| Supported \| Not Supported \| \| -\|Auto-quarantine file from unallowed apps \| Supported \| Supported (preview)\| \| -\|Network share groups \| Supported \| Not Supported \| \| -\|VPN settings \| Supported \| Not Supported \| \| -\|Business justification in policy tips \| Supported \| Supported (preview)\| \| -\|Notification customization\|Supported \| Supported (preview)\| -\|Archive file\| Supported \| Not supported\| \| -\|File type and File extension \|Supported \| Not supported\| \| -\| \| \| \| \| +\|Setting \|Sub setting \|Windows 10, 1809 and later, Windows 11 \|macOS (three latest released versions) \|Notes \| +\|\|\|\|\|\| +\|Advanced classification scanning and protection\|Allocated bandwidth limits \| Supported \| Supported \|Advanced classification enables these features for macOS (preview): - [Document Fingerprinting](document-fingerprinting.md) </br>- [Exact data match based sensitive information types](sit-learn-about-exact-data-match-based-sits.md#learn-about-exact-data-match-based-sensitive-information-types) </br>- [Trainable classifiers](classifier-learn-about.md) </br>- [Learn about named entities](named-entities-learn.md) \| +\|File path exclusions for Windows \| n/a \|Supported \|n/a \| \| +\|File path exclusions for Mac\|n/a \|n/a\| Supported\|macOS includes a recommended list of exclusions that is on by default \| +\|Setup evidence collection for file activities on devices\| Set evidence cache on device \| Supported (preview)\| Not supported\| \| +\|Network share coverage and exclusions \| n/a \| Supported \|Not Supported\| \| +\|Restricted apps and app groups \|Restricted app groups \|Supported \|Supported (preview) \| \| +\|Restricted apps and app groups \|Restricted apps \|Supported \| Supported \| \| +\|Restricted apps and app groups \|Auto-quarantine settings\| Supported \| Supported (preview)\| \| +\|Unallowed Bluetooth apps \|n/a \|Supported \|Supported \| \| +\|Browser and domain restrictions to sensitive data \| Unallowed browsers \|Supported \|Supported \| \| +\|Browser and domain restrictions to sensitive data \| Service domains \| Supported \| Supported\| \| +\|Browser and domain restrictions to sensitive data \| Sensitive service domain groups \| Supported \| Not supported\| \| +\|Additional settings for Endpoint DLP \| Business justification in policy tips \|Supported \|Supported (preview) \|Only the default business justifications are supported for macOS devices \| +\|Always audit file activity for devices \| n/a \|Supported \|Supported \| \| +\|Printer groups \| n/a\| Supported \|Not supported\| \| +\|Removable USB device groups \|n/a \| Supported \| Not supported \| \| +\|Network share groups \|n/a \| Supported \| Not supported \| \| +\|VPN settings \|n/a \| Supported \| Not supported \| \| + +### Other settings + +\|Setting \| Windows 10/11 \| macOS (three latest released versions)\| +\|-\|\|-\| +\|Archive file\| Supported \| Not supported \| +\|File type and File extension \|Supported \| Not supported\| ## Advanced classification scanning and protection To find the full path of Mac apps: 3. Make a note of the full path name, including the name of the app. -### Protect sensitive data from cloud synchronization apps - -To prevent sensitive items from being synced to the cloud by cloud sync apps such as onedrive.exe, add the cloud sync app to the Restricted apps list. +### Auto-quarantine -> [!NOTE] -> When an unallowed cloud-sync app tries to access an item that is protected by a blocking DLP policy, DLP may generate repeated notifications. You can avoid these repeated notifications by enabling the Auto-quarantine option under Restricted apps. - -#### Auto-quarantine +To prevent sensitive items from being synced to the cloud by cloud sync apps such as onedrive.exe, add the cloud sync app to the Restricted apps list with Auto-quarantine + +When enabled, Auto-quarantine is triggered when a restricted app attempts to access a DLP-protected sensitive item. Auto-quarantine moves the sensitive item to an admin-configured folder. If configured to do so, autoquarrantine can leave a placeholder (`.txt`) file in place of the original. You can configure the text in the placeholder file to tell users the new location of the item, and other pertinent information. -When enabled, Auto-quarantine is triggered when a restricted app attempts to access a DLP-protected sensitive item. Auto-quarantine moves the sensitive item to an admin-configured folder. If configured to do so, autoquarrantine can leave a placeholder (.txt) file in place of the original. You can configure the text in the placeholder file to tell users the new location of the item, and other pertinent information. +Use this when an unallowed cloud-sync app tries to access an item that is protected by a blocking DLP policy, DLP may generate repeated notifications. You can avoid these repeated notifications by enabling Auto-quarantine. You can use also auto-quarantine to prevent an endless chain of DLP notifications for the user and admins. For more information, see [Scenario 4: Avoid looping DLP notifications from cloud synchronization apps with auto-quarantine](endpoint-dlp-using.md#scenario-4-avoid-looping-dlp-notifications-from-cloud-synchronization-apps-with-auto-quarantine) You can use also auto-quarantine to prevent an endless chain of DLP notification To prevent people from transferring files protected by your policies via specific Bluetooth apps, add those apps to the Restricted apps list. -### Browser and domain restrictions to sensitive data +## Browser and domain restrictions to sensitive data Restrict sensitive files that match your policies from being shared with unrestricted cloud service domains. For macOS devices, you must add the full file path. To find the full path of Mac 3. Make sure to make a note of the full path name, including the name of the app. -#### Service domains +### Service domains You can control whether sensitive files that are protected by your policies can be uploaded to specific service domains. > [!NOTE] > The Service domains setting only applies to files uploaded using Microsoft Edge, or using instances of Google Chrome or Mozilla Firefox that have the [Microsoft Purview Chrome Extension](dlp-chrome-learn-about.md) installed. -##### Allow +#### Allow When the Service domains list is set to Allow, DLP policies aren't applied when a user attempts to upload a sensitive file to any of the domains on the list. If a user attempts to upload a sensitive file with credit card numbers to contos In contrast, if a user attempts to upload a sensitive file with credit card numbers to wingtiptoys.com (which isn't on the Restricted apps list), the policy is applied and the user activity is blocked. Additionally, an event is generated, as is an alert. -##### Block +#### Block When the Service domains list is set to Block, DLP policies are applied when a user attempts to upload a sensitive file to any of the domains on the Restricted apps list. For example: You can configure up to 50 domains under Sensitive Service domains. -### Sensitive service domains +### Sensitive service domain groups When you list a website in Sensitive service domains, you can `audit`, `block with override`, or fully `block` user activity when users attempt to take any of the following actions: Let's look at an example. Say you want your DLP policy to block printing of cont 1. Add other printers as needed. 1. Select Save and then Close. -## Removable storage device groups +## Removable USB device groups Use this setting to define groups of removable storage devices, such as USB thumb drives, that you want to assign policy actions to that are different from the global printing actions. For example, say you want your DLP policy to block items with engineering specifications from being copied to removable storage devices, except for designated USB-connected hard drives that are used to back up data for offsite storage. You can assign these policy actions to the group in a DLP policy: - `Block with` override (blocks the action, but the user can override) - `Block` (blocks no matter what) -### Create a Removable storage device group +### Create a removable USB device group 1. Open [Microsoft Purview compliance portal](https://compliance.microsoft.com) > Data loss prevention > Endpoint DLP settings > Removable storage device groups. 2. Select Create removable storage device group.
compliance	Dlp Osp Get Started	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-osp-get-started.md	f1.keywords: Previously updated : 07/13/2023 Last updated : 07/14/2023 audience: ITPro f1_keywords: This RegKey allows you to specify the wait on send behavior on your Outlook cl Enabled: The email message is checked when the Send is clicked but before the message is actually sent. You can set a time limit on how long to wait for DLP policy evaluation to complete (T value in seconds). If the policy evaluation doesn't complete in the specified time a Send anyway button appears allowing the user to bypass the presend check. The T value range is 0 to 9999 seconds. > [!IMPORTANT] -> If the T value is greater than 9999, it will be replaced with 1000 and the Send Anyway button will not appear. This holds the message until the policy evalution completes with no option for user override. The duration to complete the evaluation can vary depending on factors such as internet speed, content length, and the number of defined policies. Some users may encounter policy evaluation messages more frequently than others depending on what policies are deployed on their mailbox. +> If the T value is greater than 9999, it will be replaced with 10000 and the Send Anyway button will not appear. This holds the message until the policy evalution completes with no option for user override. The duration to complete the evaluation can vary depending on factors such as internet speed, content length, and the number of defined policies. Some users may encounter policy evaluation messages more frequently than others depending on what policies are deployed on their mailbox. To learn more about configuring and using GPO see, [Administer Group Policy in an Azure Active Directory Domain Services managed domain](/azure/active-directory-domain-services/manage-group-policy).
compliance	Ediscovery Close Reopen Delete Cases	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery-close-reopen-delete-cases.md	f1.keywords: Previously updated : 03/27/2023 Last updated : 07/10/2023 audience: Admin This article describes how to close, reopen, delete, or upgrade a Microsoft Purv [!INCLUDE [purview-preview](../includes/purview-preview.md)] -## Upgrade a case to eDiscovery (Premium) (preview) +## Upgrade a case to eDiscovery (Premium) After working with an existing eDiscovery (Standard) case, you may need the additional case functionality provided with eDiscovery (Premium) cases. This work may include the need for more robust collections and review set functionality.
compliance	Ediscovery Create Holds	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery-create-holds.md	f1.keywords: Previously updated : 05/31/2023 Last updated : 07/14/2023 audience: Admin When you create a hold, you have the following options to scope the content that To create an eDiscovery hold that's associated with a eDiscovery (Standard) case: 1. Go to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">Microsoft Purview compliance portal</a> and sign in using the credentials for user account with the appropriate eDiscovery permissions.- 2. In the left navigation pane, select Show all, and then select eDiscovery > Core.- 3. On the eDiscovery (Standard) page, select the name of the case that you want to create the hold in.- 4. On the Home page for the case, select the Hold tab. - 5. On the Hold page, select Create.- 6. On the Name your hold wizard page, give the hold a name and add an optional description, and then select Next. The name of the hold must be unique in your organization.- 7. On the Choose locations wizard page, choose the content locations that you want to place on hold. You can place mailboxes, sites, and public folders on hold. ![Choose the content locations to place on hold.](../media/eDiscoveryHoldLocations.png) 1. Exchange mailboxes: Set the toggle to On and then select Choose users, groups, or teams to specify the mailboxes to place on hold. Use the search box to find user mailboxes and distribution groups (to place a hold on the mailboxes of group members) to place on hold. You can also place a hold on the associated mailbox for a Microsoft Team, Microsoft 365 group, and Viva Engage Group. For more information about the application data that is preserved when a mailbox is placed on hold, see [Content stored in mailboxes for eDiscovery](ediscovery-what-is-stored-in-a-mailbox.md). - 2. SharePoint sites: Set the toggle to On and then select Choose sites to specify SharePoint sites and OneDrive accounts to place on hold. Type the URL for each site that you want to place on hold. You can also add the URL for the SharePoint site for a Microsoft Team, Microsoft 365 group or a Viva Engage Group. + > [!IMPORTANT] + > When you select a distribution list to be placed on hold, the hold is placed on each of the member mailboxes in the distribution list when the policy is created. Subsequent changes in the distribution list do not change or update the holds or the policy. + + 2. SharePoint sites: Set the toggle to On and then select Choose sites to specify SharePoint sites and OneDrive accounts to place on hold. Type the URL for each site that you want to place on hold. You can also add the URL for the SharePoint site for a Microsoft Team, Microsoft 365 group or a Yammer Group. 3. Exchange public folders: Set the toggle to On to put all public folders in your Exchange Online organization on hold. You can't choose specific public folders to put on hold. Leave the toggle switch off if you don't want to put a hold on public folders. To create an eDiscovery hold that's associated with a eDiscovery (Standard) case > When adding Exchange mailboxes or SharePoint sites to a hold, you must explicitly add at least one content location to the hold. In other words, if you set the toggle to On for mailboxes or sites, you must select specific mailboxes or sites to add to the hold. Otherwise, the eDiscovery hold will be created but no mailboxes or sites will be added to the hold. 8. When finished adding locations to the hold, select Next.- 9. To create a query-based hold using keywords or conditions, complete the following steps. To preserve all content in the specified content locations, select Next. ![Create a query-based hold with keyword and conditions.](../media/eDiscoveryHoldQuery.png) 1. In the box under Keywords, type a query to preserve only the content that matches the query criteria. You can specify keywords, email message properties, or site properties, such as file names. You can also use more complex queries that use a Boolean operator, such as AND, OR, or NOT.- 2. Select Add condition to add one or more conditions to narrow the query for the hold. Each condition adds a clause to the KQL search query that is created and run when you create the hold. For example, you can specify a date range so that email or site documents that were created within the date ranged are preserved. A condition is logically connected to the keyword query (specified in the Keywords box) and other conditions by the AND operator. That means items have to satisfy both the keyword query and the condition to be preserved. For more information about creating a search query and using conditions, see [Keyword queries and search conditions for eDiscovery](ediscovery-keyword-queries-and-search-conditions.md). 10. After configuring a query-based hold, select Next.- 11. Review your settings (and edit them if necessary), and then select Submit. > [!NOTE] To create an eDiscovery hold that's associated with a eDiscovery (Standard) case Keep the following things in mind when you place a query-based eDiscovery hold on documents located in SharePoint sites: -- A query-based hold initially preserves all documents in a site for a short period of time after they're deleted. That means when a document is deleted, it will be moved to the Preservation Hold library even if it doesn't match the criteria of the query-based hold. However, deleted documents that don't match a query-based hold will be removed by a timer job that processes the Preservation Hold library. The timer job runs periodically and compares all documents in the Preservation Hold library to your query-based eDiscovery holds (and other types of holds and retention policies). The timer job deletes the documents that don't match a query-based hold and preserves the documents that do. +- A query-based hold initially preserves all documents in a site for a short period of time after they're deleted. That means when a document is deleted, it is moved to the Preservation Hold library even if it doesn't match the criteria of the query-based hold. However, deleted documents that don't match a query-based hold will be removed by a timer job that processes the Preservation Hold library. The timer job runs periodically and compares all documents in the Preservation Hold library to your query-based eDiscovery holds (and other types of holds and retention policies). The timer job deletes the documents that don't match a query-based hold and preserves the documents that do. - Query-based holds shouldn't be used to perform targeted preservation, like preserving documents in a specific folder or site or by using other location-based hold criteria. Doing so may have unintended results. We recommend using non-location based hold criteria such as keywords, date ranges, or other document properties to preserve site documents. ## Search locations on eDiscovery hold Teams is built on Microsoft 365 groups. Therefore, placing Microsoft 365 groups Keep the following things in mind when placing both Teams and Microsoft 365 groups on an eDiscovery hold: - As previously explained, to place content located in Teams and Microsoft 365 groups on hold, you have to specify the mailbox and SharePoint site that associated with a group or team.- - Run the Get-UnifiedGroup cmdlet in [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) to view properties for Teams and Microsoft 365 groups. This is a good way to get the URL for the site that's associated with a Team or Microsoft 365 group. For example, the following command displays selected properties for a Microsoft 365 group named Senior Leadership Team: ```text Keep the following things in mind when placing both Teams and Microsoft 365 grou > To run the Get-UnifiedGroup cmdlet, you have to be assigned the View-Only Recipients role in Exchange Online or be a member of a role group that's assigned the View-Only Recipients role. - When a user's mailbox is searched, any Team or Microsoft 365 group that the user is a member of won't be searched. Similarly, when you place a Team or Microsoft 365 group on eDiscovery hold, only the group mailbox and group site are placed on hold. The mailboxes and OneDrive for Business sites of group members aren't placed on hold unless you explicitly add them to the eDiscovery hold. So if you have to place a Team or Microsoft 365 group on hold for a legal reason, consider adding the mailboxes and OneDrive accounts of team or group members on the same hold.- - To get a list of the members of a Team or Microsoft 365 group, you can view the properties on the <a href="https://go.microsoft.com/fwlink/p/?linkid=2052855" target="_blank">Groups</a> page in the Microsoft 365 admin center. Alternatively, you can run the following command in Exchange Online PowerShell: ```powershell After a mailbox, SharePoint site, or OneDrive account is removed from an eDiscov - Mailboxes: A delay hold is placed on a mailbox the next time the Managed Folder Assistant processes the mailbox and detects that an eDiscovery hold was removed. Specifically, a delay hold is applied to a mailbox when the Managed Folder Assistant sets one of the following mailbox properties to True: - DelayHoldApplied: This property applies to email-related content (generated by people using Outlook and Outlook on the web) that's stored in a user's mailbox.- - - DelayReleaseHoldApplied: This property applies to cloud-based content (generated by non-Outlook apps such as Microsoft Teams, Microsoft Forms, and Microsoft Viva Engage) that's stored in a user's mailbox. Cloud data generated by a Microsoft app is typically stored in a hidden folder in a user's mailbox. + - DelayReleaseHoldApplied: This property applies to cloud-based content (generated by non-Outlook apps such as Microsoft Teams, Microsoft Forms, and Microsoft Yammer) that's stored in a user's mailbox. Cloud data generated by a Microsoft app is typically stored in a hidden folder in a user's mailbox. When a delay hold is placed on the mailbox (when either of the previous properties is set to True), the mailbox is still considered to be on hold for an unlimited hold duration, as if the mailbox was on Litigation Hold. After 30 days, the delay hold expires, and Microsoft 365 will automatically attempt to remove the delay hold (by setting the DelayHoldApplied or DelayReleaseHoldApplied property to False) so that the hold is removed. After either of these properties are set to False, the corresponding items that are marked for removal are purged the next time the mailbox is processed by the Managed Folder Assistant.
compliance	Ediscovery Managing Holds	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery-managing-holds.md	f1.keywords: Previously updated : 05/31/2023 Last updated : 07/14/2023 audience: Admin In some cases, you may have a set of custodians that you've identified and have To view the custodian hold policy: 1. In the Microsoft Purview compliance portal, select eDiscovery > Premium to display the list of cases in your organization.- 2. Go to the Sources tab to add custodians within your case. To learn how you can add and place custodians on hold within an eDiscovery (Premium) case, see [Add Custodians to a case](ediscovery-add-custodians-to-case.md). If you have already added custodians and placed them on hold, go to step 3.- 3. Go to the Holds tab and select CustodianHold\<HoldId>.- 4. On the flyout page, you can perform actions like apply a query to your custodian-based hold. For more information about creating a hold query and using conditions, see [Keyword queries and search conditions for Content Search](ediscovery-keyword-queries-and-search-conditions.md). ## Manage non-custodial holds When you create a hold, you have the following options to scope the content that To create a non-custodial hold for an eDiscovery (Premium) case: 1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077149" target="_blank">compliance portal</a>, select eDiscovery > Premium to display the list of cases in your organization. - 2. Select Open next to the case that you want to create the holds in. - 3. From the home page for the case, select the Holds tab. - 4. On the Holds tab, select Create. - 5. On the Name your hold page, give the hold a name. The name of the hold must be unique in your organization.- 6. (Optional) In the Description box, add a description of the hold. - 7. Select Next. - 8. Choose the content locations that you want to place on hold. You can place mailboxes, sites, and public folders on hold. - 1. Exchange email - select Choose users, groups, or teams and then select Choose users, groups, or teams again to specify mailboxes to place on hold. Use the search box to find user mailboxes and distribution groups (to place a hold on the mailboxes of group members) to place on hold. You can also place a hold on the associated mailbox for a Microsoft 365 group or a Microsoft Team. Select the user, group, team check box, select Choose, and then select Done. + 1. Exchange email: Select Choose users, groups, or teams and then select Choose users, groups, or teams again to specify mailboxes to place on hold. Use the search box to find user mailboxes and distribution groups (to place a hold on the mailboxes of group members) to place on hold. You can also place a hold on the associated mailbox for a Microsoft 365 group or a Microsoft Team. Select the user, group, team check box, select Choose, and then select Done. > [!NOTE] > When you select Choose users, groups, or teams to specify mailboxes to place on hold, the mailbox picker that's displayed is empty. This is by design to enhance performance. To add people to this list, type a name (a minimum of 3 characters) in the search box. - 1. SharePoint Sites - select Choose sites and then select Choose sites again to specify SharePoint and OneDrive for Business sites to place on hold. Type the URL for each site that you want to place on hold. You can also add the URL for the SharePoint site for a Microsoft 365 group or a Microsoft Team. Select Choose, and then select Done. + > [!IMPORTANT] + > When you select a distribution list to be placed on hold, the hold is placed on each of the member mailboxes in the distribution list when the policy is created. Subsequent changes in the distribution list do not change or update the holds or the policy. + + 1. SharePoint Sites: Select Choose sites and then select Choose sites again to specify SharePoint and OneDrive for Business sites to place on hold. Type the URL for each site that you want to place on hold. You can also add the URL for the SharePoint site for a Microsoft 365 group or a Microsoft Team. Select Choose, and then select Done. > [!NOTE] > The URL for a user's OneDrive account includes their user principal name (UPN) (for example, `https://alpinehouse-my.sharepoint.com/personal/sarad_alpinehouse_onmicrosoft_com`). In the rare case that a person's UPN is changed, their OneDrive URL will also change to incorporate the new UPN. If a user's OneDrive account is part of a non-custodial hold and their UPN is changed, you need to update the hold and point to the new OneDrive URL. If the URL for the OneDrive site changes, previously placed holds on the site remain effective and content is preserved. For more information, see [How UPN changes affect the OneDrive URL](/onedrive/upn-changes). - 1. Exchange public folders - Move the toggle switch to the All position to put all public folders in your Exchange Online organization on hold. You can't choose specific public folders to put on hold. Leave the toggle switch set to None if you don't want to put a hold on public folders. + 1. Exchange public folders: Move the toggle switch to the All position to put all public folders in your Exchange Online organization on hold. You can't choose specific public folders to put on hold. Leave the toggle switch set to None if you don't want to put a hold on public folders. 9. When you're done adding content locations to the hold, select Next. - 10. To create a query-based hold with conditions, complete the following. Otherwise, just select Next. - In the box under Keywords, type a search query in the box so that only the content that meets the search criteria is placed on hold. You can specify keywords, message properties, or document properties, such as file names. You can also use more complex queries that use a Boolean operator, such as AND, OR, or NOT. If you leave the keyword box empty, then all content located in the specified content locations will be placed on hold. To create a non-custodial hold for an eDiscovery (Premium) case: For more information about creating a search query and using conditions, see [Keyword queries and search conditions for Content Search](/microsoft-365/compliance/ediscovery-keyword-queries-and-search-conditions). 11. After configuring a query-based hold, select Next.- 12. Review your settings, and then select Create this hold. > [!NOTE]
compliance	Import Insider Risk Indicators	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/import-insider-risk-indicators.md	+ + Title: "Set up a connector to import third-party insider risk detections (preview)" +description: "Administrators can set up a data connector to import pre-processed aggregated detections and use them in Microsoft Purview Insider Risk Management. This lets you extend your detections to third-party workloads such as Salesforce or Dropbox and use them alongside the built-in detections of insider risk management." +f1.keywords: +- NOCSH +++ Last updated : 07/14/2023 +audience: Admin ++ +ms.localizationpriority: medium +search.appverid: +- MET150 + +- tier3 +- purview-compliance +- data-connectors +++ +# Set up a connector to import third-party insider risk detections (preview) + +You can set up a connector in the Microsoft Purview compliance portal to extend the Microsoft Purview Insider Risk Management solution to include third-party (non-Microsoft) detections. For example, you might want to extend your detections to include Salesforce and Dropbox activities and use them alongside the built-in detections provided by insider risk management, which is focused on Microsoft services like SharePoint Online and Exchange Online. + +To bring your own detections to the insider risk management solution, you import pre-processed, aggregated detections from security information and event management (SIEM) solutions such as Microsoft Sentinel or Splunk. You'll import a sample file into the Insider Risk Indicators connector wizard. The connector wizard analyzes the sample file and configures the required schema for insider risk management. + +> [!NOTE] +> Currently, you cannot import "raw" detection signals into insider risk management. You can only import pre-processed aggregations as a file. + +## Overall process + +Bringing your own detections to insider risk management is a three-step process: + +1. In Microsoft Purview, create the Insider Risk Indicators (preview) connector as described in this article. +2. In the insider risk management solution, [create custom indicators](insider-risk-management-settings-policy-indicators.md#custom-indicators). +3. In the insider risk management solution, [use the custom indicators in policies as triggers or indicators and define thresholds](insider-risk-management-configure.md#step-6-required-create-an-insider-risk-management-policy). + +When user activity crosses the threshold value that you specify for the policy, the user is brought into scope of the insider risk management policy and is scored for risk. An alert is generated and analysts can investigate the alert using custom indicator details. + +> [!NOTE] +> You can only use custom indicators with the Data theft and Data leaks templates. + +## Before you begin + +1. Determine the scenarios and data you want to import to Microsoft 365. This helps you determine how many CSV files and Insider Risk Indicator connectors you need to create and how to structure the CSV files. The imported data is determined by the types of triggers and indicators you want to create. See [Determining how many CSV files to prepare for indicator data](#determining-how-many-csv-files-to-prepare-for-indicator-data). +2. Determine how to retrieve or export the data from your internal system and add it to the CSV files that you prepare in Step 2. The script that you run in Step 4 uploads the data in the CSV files to the insider risk management solution. +3. *Assign the Data Connector Admin* role. This role is required to add connectors on the Data connectors** page in the compliance portal, so the user who creates the connector in Step 3 must be assigned this role. This role is added by default to multiple role groups. For a list of these role groups, see [Roles in Microsoft Defender for Office 365 and Microsoft Purview compliance](../security/office-365-security/scc-permissions.md#roles-in-microsoft-defender-for-office-365-and-microsoft-purview-compliance). Alternatively, an admin in your organization can create a custom role group, assign the Data Connector Admin role to the custom role group, and then add the appropriate users as members. For guidance, see [Create a custom Microsoft Purview role group](microsoft-365-compliance-center-permissions.md#create-a-custom-microsoft-purview-role-group). +4. *Add the webhook.ingestion.office.com* domain to your firewall allowlist for your organization*. The script that you run in Step 4 won't work if you don't add this domain to the allowlist. + +> [!IMPORTANT] +> The sample script that you run in Step 4 uploads your data to the Microsoft cloud so that it can be used by the insider risk management solution. This sample script isn't supported under any Microsoft standard support program or service. The sample script is provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample script and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages. + +### Determining how many CSV files to prepare for indicator data + +In Step 3, you have the choice of preparing separate CSV files that contain data for each indicator or you can prepare a single CSV file that contains data for two or more indicators. + +Here are some guidelines to help you determine how many CSV files to prepare: + +- If the insider risk management policy you want to implement requires multiple indicators, consider using a single CSV file that contains the data for all the indicators. As a general rule, the number of connectors that you need to create is determined by the services in a CSV file. For example, if a CSV file contains all the services required to support your insider risk management implementation, you only need one connector. Having fewer CSV files allows you to have fewer connectors to create and manage. If you have two separate CSV files that each contain a single service, you'll have to create two connectors. + +- The method for generating or collecting the data may determine the number of CSV files. For example, if the different types of data used to configure a connector are located in a single system in your organization, you may be able to export the data to a single CSV file. But if data is distributed across different systems, it might be easier to export data to different CSV files. How you retrieve or export data from your systems may determine the number of CSV files you'll need. + +## Step 1: Create an app in Azure Active Directory + +The first step is to create and register a new app in Azure Active Directory (Azure AD) for the connector that you create in Step 3. Creating this app allows Azure AD to authenticate the connector when it runs and attempts to access your organization. This app is also used to authenticate the script that you run in Step 4 to upload your data to the Microsoft cloud. When you create the Azure AD app, be sure to save the following information: + +- Azure AD application ID (app ID or client ID) +- Azure AD application secret (client secret) +- Tenant ID (directory ID) + +The above values are used in Steps 3 and 4. For step-by-step instructions on creating an app in Azure AD, see [Register an application with the Microsoft identity platform](/azure/active-directory/develop/quickstart-register-app). + +## Step 2: Prepare CSV file(s) with your insider risk indicators data + +The next step is to prepare a CSV file that contains the indicator data that the connector imports to Microsoft 365. This data is used by the insider risk management solution. You can import data for the following scenarios: + +- Create a trigger that, when activated, brings a user into scope for a policy. [Example 1 below](import-insider-risk-indicators.md#example-1-prepare-a-csv-file-for-a-simple-trigger-that-brings-a-user-into-scope-for-a-policy) shows how to prepare a CSV file for a 'home-grown' trigger that predicts the probability of an employee leaving an organization. +- Create a policy indicator that monitors user activities. [Example 2 below](import-insider-risk-indicators.md#example-2-prepare-a-single-csv-file-to-create-multiple-policy-indicators) shows how to prepare a single CSV file for multiple indicators (one for Dropbox and one for Salesforce). + +For each scenario, you need to provide the corresponding indicator data in one or more CSV files. See [Determining how many CSV files to use for indicator data](#determining-how-many-csv-files-to-prepare-for-indicator-data). + +After you create the CSV file with the required indicator data, store it on the local computer that you run the script on in Step 4. You should also implement an update strategy to make sure that the CSV file always contains the most current information so that whenever you run the script, the most current indicator data is uploaded to the Microsoft cloud and accessible to the insider risk management solution. + +> [!IMPORTANT] +> The column names described in the following sections are examples, not required parameters. You can use any column names in your CSV files. However, the column names that you use in a CSV file must be mapped to a data type when you create the connector in Step 3. Also note that the sample CSV files in the following sections are shown in NotePad. It's much easier to view and edit CSV files in Microsoft Excel. + +### Example 1: Prepare a CSV file for a simple trigger that brings a user into scope for a policy + +This example shows how to structure a CSV file to create a 'home-grown' trigger that could be used to predict the probability of an employee leaving an organization. This example uses the following sample data: + +```text +UPN,PredictionTime,PredictionScore,ModelInfo +sarad@contoso.com,2023-04-20T05:52:56.962686Z,6,Model accuracy: 67%, Model name: LeaverPrediction_M1 +sarad@contoso.com,2023-04-24T05:52:56.962686Z,9,Model accuracy: 67%, Model name: LeaverPrediction_M1 +sarad@contoso.com,2023-04-24T05:52:56.962686Z,3,Model accuracy: 67%, Model name: LeaverPrediction_M1 +``` + +The following table describes each column in the CSV file. + +\| Column \| Description \| +\|--\|--\| +\| UPN \| Mandatory email address field used to identify the user. \| +\| Prediction Time \| Mandatory field that displays the date/time that the activity occurred. \| +\| Prediction Score \| Risky activity score. This field is used for the trigger threshold setting. Only Number* fields can be used for threshold settings. \| +\| Model Info \| Extra field used to track information about the prediction model. \| + +> [!NOTE] +> Only the email address and date/time fields are mandatory. All other fields are optional but can be helpful for the analyst or investigator in decision making when they triage alerts (these fields appear in the Activity explorer and in alerts and cases). + +When you create the connector in Step 3, you'll use the data in the `PredictionScore` field as a threshold value for the trigger. If a user crosses the threshold value that you set later in the policy, the user is brought into the scope of the policy. + +### Example 2: Prepare a single CSV file to create multiple policy indicators + +This example shows how to create multiple policy indicators (one for Dropbox and one for Salesforce) from a single CSV file. This example uses the following sample data: + +```text +UPN,Display_Name,Alert_Severity,Alert_Count,Aggregation_Date,Source_Workload,AdditionalInfo_Salesforce,AdditionalInfo_Dropbox +sarad@contoso.com,Salesforce - Sensitive report downloaded and emailed externally,High,10,2023-04-24T05:52:56.962686Z,Salesforce,text,text +sarad@contoso.com,Salesforce - Anomalous download of sales lead reports,Medium,6,2023-04-24T05:52:56.962686Z,Salesforce,text,text +bradh@contoso.com,Salesforce - Printing sales reports,Low,50,2023-04-24T05:52:56.962686Z,Salesforce,text,text +bradh@contoso.com,Salesforce - Excessive modifications to sensitive reports,Medium,3,2023-04-24T05:52:56.962686Z,Salesforce,text,text +sarad@contoso.com,Dropbox - Sensitive files saved to personal Dropbox,High,14,2023-04-24T05:52:56.962686Z,Dropbox,text,text +bradh@contoso.com,Dropbox - Anomalous file copy activity,Medium,5,2023-04-24T05:52:56.962686Z,Dropbox,text,text +``` + +The following table describes each column in the CSV file. + +\| Column \| Description \| +\|--\|--\| +\| UPN \| Mandatory email address field used to identify the user. \| +\| Display Name \| Name of the risky activity. \| +\| Alert Severity \| Severity categories: Low, Medium, and High. \| +\| Alert Count \| Number of incidences of each activity. Data in this field is used for the indicator threshold setting. \| +\| Aggregation Date \| Mandatory field that displays the date/time that the activity occurred. \| +\| Source Workload \| This is the key field for the multiple indicators scenario. You'll select this field for the Source column field when you create the connector, and the values in this field (Dropbox and Salesforce) will be used in the Related values in source column field in the connector. \| +\| Additional Info Salesforce \| Any additional info that you want to note about the Salesforce indicator \| +\| Additional Info Dropbox \| Any additional info that you want to note about the Dropbox indicator \| + +See the example below to see how this CSV file is used when creating the data connector. + +## Step 3: Create the Insider Risk Indicators connector + +The next step is to create a connector in the compliance portal. After you run the script in Step 4, the connector that you create imports the data from the CSV file and uploads it to your Microsoft 365 organization. + +> [!NOTE] +> Before you create a connector, make sure that you have a list of the scenarios and the corresponding CSV column names for each scenario. + +### Example 1: Create a connector file for a simple trigger + +1. Go to the compliance portal, and then select Data connectors. +2. On the Data connectors page, select Insider Risk Indicators (preview). +3. On the Insider Risk Indicators (preview) page, select Add connector. +4. Review the terms of service, and then select Accept if you want to continue creating the connector. +5. On the Authentication page, complete the following: + 1. Enter a name for the connector. + 2. Paste the Azure AD application ID for the Azure app that you created in Step 1. + 3. Select Next. +6. On the Sample file page: + 1. Select Upload sample file, and then select the CSV file that you want to upload. + 2. In the Source column list, select None (Single source). + 3. In the Verify sample data and data type section, review each field to make sure that the right data types have been assigned to each field. If a field will be used later as a threshold value, make sure that it has a Number data type. For example, in this scenario, the `PredictionScore` field is used as a threshold value and the data type is set appropriately to Number. + +7. Select Next. +8. On the Data mapping page: + + 1. Enter the values for Event time (UTC time) and Microsoft 365 user email address based on the appropriate values from the CSV file. These are mandatory fields for the connector. + 2. In the Default field, use the list to select each field you want to include from the CSV file. For example, select a Number field to use later as a threshold value for the indicator or select other fields to use as supporting information. + +8. Select Next. +9. On the Finish page, review all the information, and if everything looks OK, select Finish. +10. Copy the job ID for the connector. You'll need it for the next step. +11. [Go to Step 4 to run the script that uploads the data to Microsoft 365](#step-4-run-the-sample-script-to-upload-your-data). + +### Example 2: Create a connector that includes multiple policy indicators + +This example shows how to set up a single connector to create multiple policy indicators (Salesforce and Dropbox). You could create two separate connectors (one for Salesforce and one for Dropbox), but creating a single connector that works for both can reduce overall file maintenance. + +1. Go to the compliance portal, and then select Data connectors. +2. On the Data connectors page, select Insider Risk Indicators (preview). +3. On the Insider Risk Indicators (preview) page, select Add connector. +4. Review the terms of service, and then select Accept if you want to continue creating the connector. +5. On the Authentication page, do the following: + 1. Enter a name for the connector. + 2. Paste the Azure AD application ID for the Azure app that you created in Step 2. + 3. Select Next. +6. On the Sample file page: + 1. Select Upload sample file, and then select the CSV file that you want to upload. + 2. In the Source column list, select the column to use as the source. In the example CSV file, the source column is `SourceWorkload`, since it stores the values for the two separate workloads (Salesforce and Dropbox). + 3. In the Related values in source column field, enter the related values. For this example, enter 'Salesforce,Dropbox'. Don't include spaces between values. + + > [!IMPORTANT] + > Make sure that the values you enter in the Related values in source column field match the values in the Source column list. The connector fails if the column values don't match. + + 4. In the Verify sample data and data type section, review each field to make sure that the right data types have been assigned for each field. If a field will be used later as a threshold value, make sure that it has a Number data type. For example, in this example scenario, the `AlertCount` field is used as a threshold value and the data type is set appropriately to Number. + 5. Select Next. +7. On the Data mapping page: + + 1. Enter the values for Event time (UTC time) and Microsoft 365 user email address based on the appropriate values from the CSV file. These fields are mandatory and common to both indicators you're creating for this example. + 2. Select the columns from your sample file that you want to map to the two workloads, Salesforce and Dropbox. + + > [!TIP] + > You could use the same process described above to create multiple policy indicators based on severity levels. For example, you could use a single connector to create separate Low, Medium, and High indicators. In the Source column list in that case, you would select the field that holds the values for the separate workloads (Low, Medium, High), enter those workload values in the Related values in source column field, and then map the appropriate fields in the Data mapping page. + +8. Select Next. +9. On the Finish page, review all the information, and if everything looks correct, select Finish. +10. Copy the job ID for the connector. You'll need it for the next step. +11. Go to the next step (Step 4) to run the script that uploads the data to Microsoft 365. + +## Step 4: Run the sample script to upload your data + +> [!IMPORTANT] +> You must add the webhook.ingestion.office.com domain to your firewall allowlist for your organization. If this domain is blocked, the script won't run. + +The last step in setting up a connector is to run a sample script that uploads the data in the CSV file. When you run the script, the connector that you created in Step 3 imports the data to your Microsoft 365 organization where it can be accessed by the insider risk management solution. After you run the script, consider scheduling a task to run it automatically on a daily basis so the most current data is uploaded to the Microsoft cloud. See [Schedule the script to run automatically](#optional-step-6-schedule-the-script-to-run-automatically). + +To run the sample script: + +1. Go to the window that you left open from the previous step to access the GitHub site with the sample script. Alternatively, open the bookmarked site or use the URL that you copied. You can also access the script at [https://github.com/microsoft/m365-compliance-connector-sample-scripts/blob/main/sample_script.ps1](https://github.com/microsoft/m365-compliance-connector-sample-scripts/blob/main/sample_script.ps1). + +2. Select the Raw button to display the script in text view. + +3. Copy all the lines in the sample script, and save them to a text file. + +4. Modify the sample script for your organization, if necessary. + +5. Save the text file as a Windows PowerShell script file by using a filename suffix of `.ps1`; for example, `HRConnector.ps1`. Alternatively, you can use the GitHub filename for the script, which is `upload_termination_records.ps1`. + +6. Open a command prompt on your local computer, and then go to the directory where you saved the script. + +7. Run the following command to upload the data in the CSV file to the Microsoft cloud; for example: + + ```powershell + .\HRConnector.ps1 -tenantId <tenantId> -appId <appId> -appSecret <appSecret> -jobId <jobId> -filePath '<filePath>' + ``` + + The following table describes the parameters to use with this script and their required values. The information you obtained in the previous steps is used in the values for these parameters. + + \| Parameter \| Description \| + \| :-\|:-\| + \| `tenantId` \| This is the ID for your Microsoft 365 organization that you obtained in Step 1. You can also obtain the tenant ID for your organization on the Overview blade in the Azure AD admin center. This is used to identify your organization. \| + \| `appId` \| This is the Azure AD application ID for the app that you created in Azure AD in Step 1. This is used by Azure AD for authentication when the script attempts to access your Microsoft 365 organization. \| \| + \| `appSecret` \| This is the Azure AD application secret for the app that you created in Azure AD in Step 1. This is also used for authentication. \| + \| `jobId` \| This is the job ID for the connector that you created in Step 3. This is used to associate the data that is uploaded to the Microsoft cloud with the connector. \| + \| `filePath` \| This is the file path for the file (stored on the same system as the script) that you created in Step 1. Try to avoid spaces in the file path; otherwise use single quotation marks. \| + + Here's an example of the syntax for the connector script using actual values for each parameter: + + ```powershell + .\HRConnector.ps1 -tenantId d5723623-11cf-4e2e-b5a5-01d1506273g9 -appId 29ee526e-f9a7-4e98-a682-67f41bfd643e -appSecret MNubVGbcQDkGCnn -jobId b8be4a7d-e338-43eb-a69e-c513cd458eba -filePath 'C:\Users\contosoadmin\Desktop\Data\insider_risk_indicator_data.csv' + ``` + + If the upload is successful, the script displays the Upload Successful message. + + > [!NOTE] + > If you have problems running the previous command because of execution policies, see [About Execution Policies](/powershell/module/microsoft.powershell.core/about/about_execution_policies) and [Set-ExecutionPolicy](/powershell/module/microsoft.powershell.security/set-executionpolicy) for guidance about setting execution policies. + +## Step 5: Monitor the connector + +After you create the connector and run the script to upload your data, view the connector and upload status in the compliance portal. If you schedule the script to run automatically regularly, you can view the current status after the last time the script ran. + +1. Go to the compliance portal and select Data connectors. + +2. Select the Connectors tab, and select the connector to display the flyout page. This page contains the properties and information about the connector. + +3. Under Progress, select the Download log link to open (or save) the status log for the connector. This log contains information about each time the script runs and uploads the data from the CSV file to the Microsoft cloud. + + The `RecordsSaved` field indicates the number of rows in the CSV file that uploaded. For example, if the CSV file contains four rows, the value of the `RecordsSaved` field is 4 if the script successfully uploaded all the rows in the CSV file. + +If you've haven't run the script in Step 4, a link to download the script is displayed under Last import. You can download the script and then follow the steps to run the script. + +## (Optional) Step 6: Schedule the script to run automatically + +To make sure the latest data from your organization is available to the insider risk management solution, schedule the script to run automatically on a recurring basis, such as once a day. This requires that you update the data in the CSV file on a similar (if not the same) schedule so that it contains the latest information. The goal is to upload the most current data so that the connector can make it available to the insider risk management solution. + +You can use the Task Scheduler app in Windows to automatically run the script every day. + +1. On your local computer, select the Windows Start button and type Task Scheduler. +2. Select the Task Scheduler app. +3. In the Actions section, select Create Task. +4. On the General tab, enter a descriptive name for the scheduled task. For example, HR Connector Script. You can also add an optional description. +5. Under Security options, complete the following: + + 1. Determine whether to run the script only when you're logged on to the computer or when you're logged on or not. + 1. Make sure that the Run with the highest privileges check box is selected. + +6. Select the Triggers tab, select New and complete the following: + + 1. Under Settings, select the Daily option, and choose a date and time to run the script for the first time. The script runs every day at the same specified time. + 1. Under Advanced settings, make sure that the Enabled check box is selected. + 1. Select OK. + +7. Select the Actions tab, select New and complete the following: + + 1. In the Action dropdown list, make sure that Start a program is selected. + 1. In the Program/script box, select Browse, and then go to the following location and select it so the path is displayed in the box: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`. + 1. In the Add arguments (optional) box, paste the same script command that you ran in Step 4. For example, `.\HRConnector.ps1 -tenantId "d5723623-11cf-4e2e-b5a5-01d1506273g9" -appId "c12823b7-b55a-4989-faba-02de41bb97c3" -appSecret "MNubVGbcQDkGCnn" -jobId "e081f4f4-3831-48d6-7bb3-fcfab1581458" -filePath "C:\Users\contosoadmin\Desktop\Data\insider_risk_indicator_data.csv"` + + 1. In the Start in (optional) box, paste the folder location of the script that you ran in Step 4. For example, `C:\Users\contosoadmin\Desktop\Scripts`. + 1. Select OK to save the settings for the new action. + +8. In the Create Task window, select OK to save the scheduled task. You might be prompted to enter your user account credentials. + + The new task is displayed in the Task Scheduler Library. The last time the script ran and the next time it's scheduled to run are displayed. Double click the task to edit it. + + You can also verify the last time the script ran on the flyout page of the corresponding connector in the compliance portal. + +## (Optional) Step 7: Upload data using Power Automate templates + +You can upload the CSV data using Power Automate templates and define triggers. For example, you can configure a Power Automate template to trigger when new connector files are available in SharePoint or OneDrive locations. You can also streamline this process by storing confidential information like the Azure AD application secret (created in Step 1) in Azure Key Vault and using it with Power Automate for authentication. + +Complete the following steps to automatically upload data when new files become available on OneDrive for Business: + +1. Download the ImportHRDataforIRM.zip package from the [GitHub site](https://github.com/microsoft/m365-compliance-connector-sample-scripts/blob/main/ImportHRDataforIRM.zip). +2. In [Power Automate](https://make.preview.powerautomate.com), go to My flows. +3. Select Import and upload the ImportHRDataforIRM.zip package. +4. After the package is uploaded, update the content (name and OneDrive for Business connection) and select Import. +5. Select Open flow and update the parameters. The following table describes the parameters to use in this Power Automate flow and their required values. The information you obtained in the previous steps is used in the values for these parameters. + + \| Parameter \| Description \| + \|:-\|:-\| + \| `appId` \| This is the Azure AD application ID for the app that you created in Azure AD in Step 1. This is used by Azure AD for authentication when the script attempts to access your Microsoft 365 organization. \| + \| `appSecret` \| This is the Azure AD application secret for the app that you created in Azure AD in Step 1. This is used for authentication. \| + \| `fileLocation` \| This is the OneDrive for Business location where Power Automate monitors for 'new file created' activities to trigger this flow. \| + \| `jobId` \| Identifier for the connector created in Step 3. This is used to associate the data uploaded to the Microsoft cloud with the connector. \| + \| `tenantId` \| Identifier for your Microsoft 365 organization obtained in Step 1. You can also obtain the tenant ID for your organization on the Overview blade in the Azure AD admin center. This is used to identify your organization. \| + \| `URI` \| Verify that the value for this parameter is https://webhook.ingestion.office.com/api/signals \| + +6. Select Save. +7. Go to Flow overview and select Turn on. +8. Test the flow manually by uploading a new file to your OneDrive for Business folder and verify that it runs successfully. This may take a few minutes after the upload before the flow is triggered. +9. You can now monitor the connector as described in Step 5. + +If needed, you can update the flow to create triggers based on file availability and modification events on SharePoint and other data sources supported by Power Automate flows. + +## Next steps + +- [Create custom indicators in insider risk management](insider-risk-management-settings-policy-indicators.md#custom-indicators) +- [Use the custom indicators in policies as triggers or indicators and define thresholds](insider-risk-management-configure.md#step-6-required-create-an-insider-risk-management-policy)
compliance	Insider Risk Management Activities	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-activities.md	f1.keywords: Previously updated : 06/30/2023 Last updated : 07/14/2023 audience: itpro - tier1 The User activity chart is one of the most powerful tools for internal risk The Activity explorer provides risk investigators and analysts with a comprehensive analytics tool that provides detailed information about alerts. With the Activity explorer, reviewers can quickly review a timeline of detected potentially risky activity and identify and filter all risk activities associated with alerts. -To filter alerts on the Activity explorer for column information, select the Filter control. You can filter alerts by one or more attributes listed in the details pane for the alert. Activity explorer also supports customizable columns to help investigators and analysts focus the dashboard on the information most important to them. +To use the Activity explorer: + +1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com), go to Insider risk management and select the Alerts tab. +2. On the Alerts dashboard, select the alert you want to triage. +3. On the Alerts detail pane, select Open expanded view. +4. On the page for the selected alert, select the Activity explorer tab. + +When reviewing activities in the Activity explorer, investigators and analysts can select a specific activity and open the activity details pane. The pane displays detailed information about the activity that investigators and analysts can use during the alert triage process. Detailed information may provide context for the alert and assist with identifying the full scope of the risk activity that triggered the alert. + +When selecting an activity's events from the activity timeline, the number of activities displayed in the explorer might not match the number of activity events listed in the timeline. Examples of why this difference may occur: + +- Cumulative exfiltration detection: Cumulative exfiltration detection analyzes event logs, but applies a model that includes de-duplicating similar activities to compute cumulative exfiltration risk. Additionally, there may also be a difference in the number of potentially risky activities displayed in the Activity explorer if you have made changes to your existing policy or settings. For example, if you modify allowed/unallowed domains or add new file type exclusions after a policy has been created and potentially risky activity matches have occurred, the cumulative exfiltration detection activities will differ from the results before the policy or settings changes. Cumulative exfiltration detection activity totals are based on the policy and settings configuration at the time of computation and don't include activities prior to the policy and settings changes. +- Emails to external recipients: Potentially risky activity for emails sent to external recipients is assigned a risk score based on the number of emails sent, which may not match the activity event logs. + +![Insider risk management activity explorer details.](../media/insider-risk-activity-explorer-details.png) + +### Filter alerts in the Activity explorer + +To filter alerts in the Activity explorer for column information, select Filter. You can filter alerts by one or more attributes listed in the details pane for the alert. Activity explorer also supports customizable columns to help investigators and analysts focus the dashboard on the information most important to them. Use the Activity scope, Risk factor, and Review status filters to display and sort activities and insights for the following areas. Use the Activity scope, Risk factor, and Review status filters to display ![Insider risk management activity explorer overview](../media/insider-risk-activity-explorer.png) -To use the Activity explorer, complete the following steps: +#### Save a view of a filter to reuse later -1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com), go to Insider risk management and select the Alerts tab. -2. On the Alerts dashboard, select the alert you want to triage. -3. On the Alerts detail pane, select Open expanded view. -4. On the page for the selected alert, select the Activity explorer tab. +If you create a filter and customize columns for the filter, you can save a view of your changes so that you or others can quickly filter for the same changes again later. When you save a view, you save both the filters and columns. When you load the view, it will load both saved filters and columns. -When reviewing activities in the Activity explorer, investigators and analysts can select a specific activity and open the activity details pane. The pane displays detailed information about the activity that investigators and analysts can use during the alert triage process. Detailed information may provide context for the alert and assist with identifying the full scope of the risk activity that triggered the alert. +1. Create a filter and customize columns. + > [!TIP] + > If you want to start over at any point, select Reset filters. To change columns that you've customized, select Reset columns. +2. When you have the filter the way you want it, select Save this view, enter a name for the view, and then select Save. + > [!NOTE] + > The maximum length for a view name is 40 characters and you can't use any special characters. +3. To reuse the view of the filter later, select Views, and then select the view you want to open from the Recommended views tab (shows the most-used views) or the Custom views tab (the most frequently used filters are displayed at the top of the list). -When selecting an activity's events from the activity timeline, the number of activities displayed in the explorer might not match the number of activity events listed in the timeline. Examples of why this difference may occur: --- Cumulative exfiltration detection: Cumulative exfiltration detection analyzes event logs, but applies a model that includes de-duplicating similar activities to compute cumulative exfiltration risk. Additionally, there may also be a difference in the number of potentially risky activities displayed in the Activity explorer if you have made changes to your existing policy or settings. For example, if you modify allowed/unallowed domains or add new file type exclusions after a policy has been created and potentially risky activity matches have occurred, the cumulative exfiltration detection activities will differ from the results before the policy or settings changes. Cumulative exfiltration detection activity totals are based on the policy and settings configuration at the time of computation and don't include activities prior to the policy and settings changes.-- Emails to external recipients: Potentially risky activity for emails sent to external recipients is assigned a risk score based on the number of emails sent, which may not match the activity event logs.- -![Insider risk management activity explorer details.](../media/insider-risk-activity-explorer-details.png) +When you select a view this way, it will reset all the existing filters and replace them with the view that you selected. ## Create a case for an alert
compliance	Insider Risk Management Browser Support	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-browser-support.md	f1.keywords: Previously updated : 02/21/2023 Last updated : 07/14/2023 audience: itpro - purview-compliance In Microsoft Purview Insider Risk Management, browser signal detection is used for: -- The [Risky browser usage template](/microsoft-365/compliance/insider-risk-management-policy-templates#risky-browser-usage-preview) +- The following templates: + - [Data theft by departing users](insider-risk-management-policy-templates.md#data-theft-by-departing-users) + - [Data leaks](insider-risk-management-policy-templates.md#data-leaks) + - [Risky browser usage (preview)](/microsoft-365/compliance/insider-risk-management-policy-templates#risky-browser-usage-preview) - [Forensic evidence](/microsoft-365/compliance/insider-risk-management-forensic-evidence#capturing-options) -## Risky browser usage template +## Browsers and templates -Web browsers are often used by users to access both sensitive and non-sensitive files within an organization. Insider risk management allows your organization to detect and act on browser exfiltration signals for all non-executable files viewed in [Microsoft Edge](https://www.microsoft.com/edge) and [Google Chrome](https://www.google.com/chrome) browsers. With these signals, analysts and investigators can quickly act when any of the following risk activities are performed by in-scope policy users when using these browsers: +Web browsers are often used by users to access both sensitive and non-sensitive files within an organization. Insider risk management allows your organization to detect and act on browser exfiltration signals for all non-executable files viewed in [Microsoft Edge](https://www.microsoft.com/edge) and [Google Chrome](https://www.google.com/chrome) browsers. With these signals, analysts and investigators can quickly act when any of the following risky activities are performed by in-scope policy users when using these browsers: - Files copied to personal cloud storage - Files printed to local or network devices - Files transferred or copied to a network share - Files copied to USB devices-- Browsing risky websites - Browsing potentially risky websites Signals for these events are detected in Microsoft Edge using built-in browser capabilities and using the Microsoft Compliance Extension add-on. In Google Chrome, customers use the Microsoft Compliance Extension for signal detection. The following table summarizes identified risk activities and extension support \| Files printed to local or network devices \| Native \| Extension \| \| Files transferred or copied to a network share \| Extension \| Extension \| \| Files copied to USB devices \| Extension \| Extension \| -\| Browsing risky websites \| Extension \| Extension \| +\| Browsing potentially risky websites \| Extension \| Extension \| + +The following table summarizes activities by template: + +\| Detected activities \| Data theft by departing users \| Data leaks \|Risky browser usage\| +\| -- \| --\| --\|--\| +\| Files copied to personal cloud storage \| Yes \| Yes \|No\| +\| Files printed to local or network devices \| Yes\| Yes \|No\| +\| Files transferred or copied to a network share \| Yes \| Yes \|No\| +\| Files copied to USB devices \| Yes \| Yes \|No\| +\| Browsing potentially risky websites \| No \| No \| Yes\| [!INCLUDE [purview-preview](../includes/purview-preview.md)]
compliance	Insider Risk Management Configure	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-configure.md	f1.keywords: Previously updated : 07/11/2023 Last updated : 07/14/2023 audience: itpro - highpri After reviewing the analytics insights, choose the insider risk policies and con Most insider risk management policies have prerequisites that must be configured for policy indicators to generate relevant activity alerts. Configure the appropriate prerequisites depending on the policies you plan to configure for your organization. +### Configure Insider Risk Indicator (preview) connector + +You can extend insider risk management by importing detections for non-Microsoft (third-party) workloads. For example, you might want to extend your detections to include Salesforce and Dropbox activities and use them alongside the built-in detections provided by the insider risk management solution, which is focused on Microsoft services like SharePoint Online and Exchange Online. + +To bring your own detections to the insider risk management solution, you import pre-processed, aggregated detections from security information and event management (SIEM) solutions such as Microsoft Sentinel or Splunk. You do this by importing a sample file into the Insider Risk Indicators connector wizard. The connector wizard analyzes the sample file and configures the required schema. + +> [!NOTE] +> Currently, you cannot import "raw" detection signals into insider risk management. You can only import pre-processed aggregations as a file. + +You can use a custom indicator as: + +- A trigger used to bring a user into the scope of a policy. +- A policy indicator used to score the user for risk. + +See the [Insider Risk Indicator connector](import-insider-risk-indicators.md) article for step-by-step guidance to configure the Insider Risk Indicator connector for your organization. After you've configured the HR connector, return to these configuration steps. + ### Configure Microsoft 365 HR connector Insider risk management supports importing user and log data imported from 3rd-party risk management and human resources platforms. The Microsoft 365 Human Resources (HR) data connector allows you to pull in human resources data from CSV files, including user termination dates, last employment dates, performance improvement plan notifications, performance review actions, and job level change status. This data helps drive alert indicators in insider risk management policies and is an important part of configuring full risk management coverage in your organization. If you configure more than one HR connector for your organization, insider risk management will automatically pull indicators from all HR connectors. OCR settings do not apply to forensic evidence clips in insider risk management. Insider risk management policies include assigned users and define which types of risk indicators are configured for alerts. Before potentially risky activities can trigger alerts, a policy must be configured. Use the policy wizard to create new insider risk management policies. +> [!NOTE] +> To create a custom trigger or indicator for a non-Microsoft workload, see [Custom indicators](insider-risk-management-settings-policy-indicators.md#custom-indicators). + 1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com), go to Insider risk management and select the Policies tab. 2. Select Create policy to open the policy wizard. 3. On the Policy template page, choose a policy category and then select the template for the new policy. These templates are made up of conditions and indicators that define the risk activities you want to detect and investigate. Review the template prerequisites, triggering events, and detected activities to confirm this policy template fits your needs.
compliance	Insider Risk Management Settings Policy Indicators	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-settings-policy-indicators.md	f1.keywords: Previously updated : 07/11/2023 Last updated : 07/14/2023 audience: itpro - highpri Insider risk management uses different types of events and indicators to collect Certain policy indicators and sequences may also be used for customizing triggering events for specific policy templates. When configured in the policy wizard for the General data leaks or Data leaks by priority users templates, these indicators or sequences allow more flexibility and customization for your policies and when users are in-scope for a policy. Also, you can define risk management activity thresholds for these triggering indicators for more fine-grained control in a policy. -## Policy indicator categories +## Define the insider risk policy indicators that are enabled in all insider risk policies + +1. Select the Settings button, and then select Policy indicators. +2. Select one or more policy indicators. + The indicators selected on the Policy indicators settings page can't be individually configured when creating or editing an insider risk policy in the policy wizard. + + > [!NOTE] + > It may take several hours for new manually added users to appear in the Users dashboard. Activities for the previous 90 days for these users may take up to 24 hours to display. To view activities for manually added users, select the user on the Users dashboard and open the User activity tab in the details pane.## Two types of policy indicators: built-in indicators and custom indicators -Policy indicators are segmented into the following areas. You can choose the indicators to activate and customize indicator event limits for each indicator level when creating an insider risk policy: +## Built-in indicators vs. custom indicators -### Office indicators +Policy indicators are organized into two tabs: + +- Built-in indicators: Insider risk management includes many built-in indicators for various scenarios that you can use right away in your policies. Choose the indicators that you want to activate, and then customize indicator thresholds for each indicator level when you create an insider risk policy. The built-in indicators are described in more detail below. +- Custom indicators: Use custom indicators together with the [Insider Risk Indicators (preview) connector](import-insider-risk-indicators.md) to bring non-Microsoft detections to insider risk management. For example, you might want to extend your detections to include Salesforce and Dropbox and use them alongside the built-in detections provided by the insider risk management solution, which is focused on Microsoft workloads (SharePoint Online and Exchange Online, for example). [Learn more about creating a custom indicator](#custom-indicators) + +### Built-in indicators + +Insider risk management includes the following built-in indicators. + +#### Office indicators These include policy indicators for SharePoint sites, Microsoft Teams, and email messaging. -### Device indicators +#### Device indicators These include policy indicators for activity such as sharing files over the network or with devices. Indicators include activities involving all file types, excluding executable (.exe) and dynamic link library (.dll) file activity. If you select Device indicators, activity is processed for devices with Windows 10 Build 1809 or higher and macOS (three latest released versions) devices. For both Windows and macOS devices, you must first [onboard devices to the compliance portal](#step-2-onboard-devices). Device indicators also include browser signal detection to help your organization detect and act on exfiltration signals for non-executable files viewed, copied, shared, or printed in Microsoft Edge and Google Chrome. For more information on configuring Windows devices for integration with insider risk, see [Enable device indicators and onboard Windows devices](#enable-device-indicators-and-onboard-windows-devices) in this article. For more information on configuring macOS devices for integration with insider risk, see [Enable device indicators and onboard macOS devices](#enable-device-indicators-and-onboard-macos-devices) in this article. For more information about browser signal detection, see [Learn about and configure insider risk management browser signal detection](insider-risk-management-browser-support.md). -### Microsoft Defender for Endpoint indicators (preview) +#### Microsoft Defender for Endpoint indicators (preview) These include indicators from Microsoft Defender for Endpoint related to unapproved or malicious software installation or bypassing security controls. To receive alerts in insider risk management, you must have an active Defender for Endpoint license and insider risk integration enabled. For more information on configuring Defender for Endpoint for insider risk management integration, see [Configure advanced features in Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/advanced-features\#share-endpoint-alerts-with-microsoft-compliance-center). -### Health record access indicators +#### Health record access indicators These include policy indicators for patient medical record access. For example, attempted access to patient medical records in your electronic medical records (EMR) system logs can be shared with insider risk management healthcare policies. To receive these types of alerts in insider risk management, you must have a healthcare-specific data connector and the [HR data connector](import-hr-data.md) configured. -### Physical access indicators +#### Physical access indicators These include policy indicators for physical access to sensitive assets. For example, attempted access to a restricted area in your physical badging system logs can be shared with insider risk management policies. To receive these types of alerts in insider risk management, you must have priority physical assets enabled in insider risk management and the [Physical badging data connector](import-physical-badging-data.md) configured. To learn more about configuring physical access, see the [Priority physical access section](insider-risk-management-settings-priority-physical-assets.md) in this article. -### Microsoft Defender for Cloud Apps indicators +#### Microsoft Defender for Cloud Apps indicators These include policy indicators from shared alerts from Defender for Cloud Apps. Automatically enabled anomaly detection in Defender for Cloud Apps immediately starts detecting and collating results, targeting numerous behavioral anomalies across your users and the machines and devices connected to your network. To include these activities in insider risk management policy alerts, select one or more indicators in this section. To learn more about Defender for Cloud Apps analytics and anomaly detection, see [Get behavioral analytics and anomaly detection](/cloud-app-security/anomaly-detection-policy). -### Risky browsing indicators (preview) +#### Risky browsing indicators (preview) These include policy indicators for user browsing activity related to websites that are considered malicious or risky and pose potential insider risk that may lead to a security or compliance incident. Risky browsing activity refers to users who visit potentially risky websites, such as those associated with malware, pornography, violence, and other unallowed activities. To include these risk management activities in policy alerts, select one or more indicators in this section. To learn about configuring browser exfiltration signals, see [Insider risk management browser signal detection](insider-risk-management-browser-support.md). -### Cumulative exfiltration detection (preview) +#### Cumulative exfiltration detection (preview) Detects when a user's exfiltration activities across all exfiltration channels over the last 30 days exceeds organization or peer group norms. For example, if a user is in a sales role and communicates regularly with customers and partners outside of the organization, their external email activity will likely be much higher than the organization's average. However, the user's activity may not be unusual compared to the user's teammates, or others with similar job titles. A risk score is assigned if the user's cumulative exfiltration activity is unusual and exceeds organization or peer group norms. > [!NOTE] > Peer groups are defined based on organization hierarchy, access to shared SharePoint resources, and job titles in Azure AD. If you enable cumulative exfiltration detection, your organization is agreeing to share Azure AD data with the compliance portal, including organization hierarchy and job titles. If your organization does not use Azure AD to maintain this information, then detection may be less accurate. -### Risk score boosters +#### Risk score boosters These include raising the risk score for activity for the following reasons: - Activity that is above the user's usual activity for that day: Scores are boosted if the detected activity deviates from the user's typical behavior. These include raising the risk score for activity for the following reasons: In some cases, you may want to limit the insider risk policy indicators that are applied to insider risk policies in your organization. You can turn off the policy indicators for specific areas by disabling them from all insider risk policies in global settings. Triggering events can only be modified for policies created from the Data leaks or Data leaks by priority users templates. Policies created from all other templates don't have customizable triggering indicators or events. -## Define the insider risk policy indicators that are enabled in all insider risk policies +### Custom indicators -1. Select the Settings button, and then select Policy indicators. -2. Select one or more policy indicators. - The indicators selected on the Policy indicators settings page can't be individually configured when creating or editing an insider risk policy in the policy wizard. +Use the Custom Indicators tab to create a custom indicator to use as a trigger or as a policy indicator in your policies. + +> [!NOTE] +> Before you can create a custom indicator to import third-party indicator data, you must [create an Insider Risk Indicators connector](import-insider-risk-indicators.md) (preview). + +1. In Settings, select Policy indicators and select the Custom Indicators tab. +2. Select Add custom indicator. +3. Enter an indicator name and a description (optional). +4. In the Data connector list, select the Insider Risk Indicator connector that you created previously. + + When you select a data connector: + + - The name of the source column that you selected when you created the connector is displayed in the Source column from mapping file field. If you didnΓÇÖt select a source column when you created the connector, None appears in this field and you donΓÇÖt need to make a selection. + - In the Values in source column list, select the value that you want to assign to the custom indicator. These are the values that are related to the source column that you specified when you created the connector. For example, if you created a single connector that includes data for two indicators (Salesforce and Dropbox), you would see those values in the list. + +5. If you want to use a column to set threshold values, in the Data from mapping file list, select the column that you want to use for the threshold setting; otherwise, select the Use only as a triggering event without any thresholds option. > [!NOTE] - > It may take several hours for new manually-added users to appear in the Users dashboard. Activities for the previous 90 days for these users may take up to 24 hours to display. To view activities for manually added users, select the user on the Users dashboard and open the User activity tab in the details pane. + > Only fields that have a Number data type appear in the Data from mapping file list, since a Number data type is required to set a threshold value. The data type is specified when you set up the connector. + +6. Select Add indicator. The indicator is added to the Custom Indicators list. + +Now you can [use the custom indicator](insider-risk-management-configure.md#step-6-required-create-an-insider-risk-management-policy) in any Data theft or Data leaks policies that you create or edit. + +- If you're using the custom indicator as a trigger, select your custom trigger on the Triggers page when you create or edit the policy. +- If you're using the custom indicator as a policy indicator, select your custom indicator on the Indicators page when you create or edit the policy. + +> [!NOTE] +> After selecting your custom trigger or indicator, make sure to set a custom threshold (it's not recommended that you use the default thresholds). You can't set trigger thresholds on a custom indicator if you selected the Use only as a triggering event without any thresholds option. + +After adding the custom indicator to your policies, the triggers and insights generated based on the custom indicators appear in the Alerts dashboard, Activity explorer, and User timeline. ## Enable device indicators and onboard Windows devices In this deployment scenario, you'll enable devices that haven't been onboarded y > [!NOTE] > While it usually takes about 60 seconds for device onboarding to be enabled, please allow up to 30 minutes before engaging with Microsoft support. -3. Select Device management to open the Devices list. The list will be empty until you onboard devices. +3. Select Device management to open the Devices list. The list is empty until you onboard devices. 4. Select Onboarding to begin the onboarding process. 5. Select the way you want to deploy to these devices from the Deployment method list, and then select download package. 6. Follow the appropriate procedures in [Onboarding tools and methods for Windows machines](/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints). This link takes you to a landing page where you can access Microsoft Defender for Endpoint procedures that match the deployment package you selected in step 5: When you're done and the endpoint device is onboarded, it should be visible in t ### If devices are already onboarded to Microsoft Defender for Endpoint -If Microsoft Defender for Endpoint is already deployed and endpoint devices are reporting in, the endpoint devices will appear in the managed devices list. You can continue to onboard new devices into insider risk management to expand coverage by going to [Step 2: Onboarding devices](#step-2-onboard-devices). +If Microsoft Defender for Endpoint is already deployed and endpoint devices are reporting in, the endpoint devices appear in the managed devices list. You can continue to onboard new devices into insider risk management to expand coverage by going to [Step 2: Onboarding devices](#step-2-onboard-devices). 1. Open the [Microsoft Purview compliance portal](https://compliance.microsoft.com). 2. Open the compliance portal settings page, and then select Enable device monitoring. If Microsoft Defender for Endpoint is already deployed and endpoint devices are - Onboard Windows machines using a local script - Onboard non-persistent virtual desktop infrastructure (VDI) machines -When you're done and endpoint devices are onboarded, they should be visible under the Devices tab and the endpoint devices will start reporting audit activity logs to insider risk management. +When you're done and endpoint devices are onboarded, they should be visible under the Devices tab and the endpoint devices start reporting audit activity logs to insider risk management. > [!NOTE] > This experience is under license enforcement. Without the required license, data will not be visible or accessible. These settings effectively mean: - If there are 20-29 SharePoint events that take place after a triggering event, the risk score is inherently higher and alert severity levels would tend to be at a medium level. - If there are 30 or more SharePoint events that take place after a triggering event, the risk score is inherently higher and alert severity levels would tend to be at a high level. -Another option for policy thresholds is to assign the policy triggering event to risk management activity that is above the typical daily number of users. Instead of being defined by specific threshold settings, each threshold is dynamically customized for anomalous activities detected for in-scope policy users. If threshold activity for anomalous activities is supported for an individual indicator, you can select Activity is above user's usual activity for the day in the policy wizard for that indicator. If this option isn't listed, anomalous activity triggering isn't available for the indicator. If the Activity is above user's usual activity for the day option is listed for an indicator, but is not selectable, you need to enable this option in Insider risk settings > Policy indicators. +Another option for policy thresholds is to assign the policy triggering event to risk management activity that is above the typical daily number of users. Instead of being defined by specific threshold settings, each threshold is dynamically customized for anomalous activities detected for in-scope policy users. If threshold activity for anomalous activities is supported for an individual indicator, you can select Activity is above user's usual activity for the day in the policy wizard for that indicator. If this option isn't listed, anomalous activity triggering isn't available for the indicator. If the Activity is above user's usual activity for the day option is listed for an indicator, but isn't selectable, you need to enable this option in Insider risk settings > Policy indicators. ### Use real-time analytics (preview) to manage alert volume You can use real-time analytics if you want to take advantage of a guided (data- - A. A gauge that shows the approximate number of scoped users whose activities from the past 10 days exceeded the lowest daily thresholds for at least one of the selected indicators in the policy. This gauge can help you estimate the number of alerts that might be generated if all users included in the policy were being assigned risk scores. - B. A list of the top five indicators sorted by the number of users exceeding the lowest daily thresholds. If your policies are generating a lot of alerts, these are the indicators you might want to focus on to reduce "noise."-- C. An insight for each indicator, displayed below the thresholds. The insight shows the approximate number of users whose activities from the past 10 days exceeded the currently specified low thresholds for this indicator. For example, if the low threshold setting for Downloading content from SharePoint is set to 100, the insight shows the number of users in the policy who performed more than 100 download activities on an average in the past 10 days. If you adjust the threshold setting to 200, the insight will update in real time to show you the number of users whose activity exceeded levels that exceeded the new thresholds. This helps you quickly configure the appropriate thresholds for each indicator and achieve the highest level of alert effectiveness before activating your policies. +- C. An insight for each indicator, displayed below the thresholds. The insight shows the approximate number of users whose activities from the past 10 days exceeded the currently specified low thresholds for this indicator. For example, if the low threshold setting for Downloading content from SharePoint is set to 100, the insight shows the number of users in the policy who performed more than 100 download activities on an average in the past 10 days. If you adjust the threshold setting to 200, the insight updates in real time to show you the number of users whose activity exceeded levels that exceeded the new thresholds. This helps you quickly configure the appropriate thresholds for each indicator and achieve the highest level of alert effectiveness before activating your policies. ![Insider risk management real-time analytics](../media/insider-risk-management-real-time-analytics.png)
compliance	Sensitivity Labels Aip	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-aip.md	The AIP client supports many customizations by using [PowerShell advanced settin However, you might find you don't need to use PowerShell to configure the supported settings because they're included in the standard configuration from the Microsoft Purview compliance portal. For example, UI configuration to choose label colors, and turn off mandatory labeling for Outlook. Check the available configurations in [Manage sensitivity labels in Office apps](sensitivity-labels-office-apps.md). > [!NOTE] -> The AIP add-in used PowerShell advanced settings for [oversharing popup messages in Outlook](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#implement-pop-up-messages-in-outlook-that-warn-justify-or-block-emails-being-sent). When you use built-in labeling, the equivalent of this configuration is now detailed in [Get started with oversharing pop ups](dlp-osp-get-started.md). +> The AIP add-in used PowerShell advanced settings for [oversharing popup messages in Outlook](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#implement-pop-up-messages-in-outlook-that-warn-justify-or-block-emails-being-sent). When you use built-in labeling, the equivalent of this configuration is now available as a [DLP policy configuration](dlp-osp-get-started.md). ## Features not planned to be supported by built-in labeling for Office apps
compliance	Sensitivity Labels Office Apps	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md	f1.keywords: Previously updated : 07/12/2023 Last updated : 07/14/2023 audience: Admin To use the Office built-in labeling client with Office on the web for documents When you label a document or email, the label is stored as metadata that includes your tenant and a label GUID. When a labeled document or email is opened by an Office app that supports sensitivity labels, this metadata is read and only if the user belongs to the same tenant, the label displays in their app. For example, for built-in labeling for Word, PowerPoint, and Excel, the label name displays on the status bar. -This implementation means that if you share documents with another organization that uses different label names, each organization can apply and see their own label applied to the document. +This implementation means that if you share documents with another organization that uses different label names, each organization can apply and see their own label applied to the document. + +> [!NOTE] +> Two exceptions where another organization can't apply their own sensitivity labels: +> - Using Office for the web, external users connect to your SharePoint sites or OneDrive locations and don't see their sensitivity labels because the site is owned by another organization. +> - Using co-authoring from desktop or mobile apps, external users [won't be able to apply their own sensitivity labels that are configured to apply encryption](https://support.microsoft.com/topic/you-can-t-apply-your-own-protected-sensitivity-label-to-this-file-3e592e7f-5498-481a-b930-c1259924e9ab). The same is true for email (and labeled calendar events) sent by Outlook. However, email clients other than Outlook might not retain the label metadata in the email headers. For example, users replying or forwarding from another organization that doesn't use Outlook will likely result in the original email label no longer visible to the original organization because the label metadata hasn't been retained. If that label applied encryption, the encryption persists to protect the contents.
compliance	Sensitivity Labels Versions	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-versions.md	The numbers listed are the minimum Office application versions required for each \|[Display label color](sensitivity-labels-office-apps.md#label-colors) \|Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2303+ <br /><br> Semi-Annual Enterprise Channel: 2302+ \|16.71+ \|Rolling out: 4.2316.0+ \|4.2316.0+ \|Under review \| \|[Default sublabel for parent label](sensitivity-labels-office-apps.md#specify-a-default-sublabel-for-a-parent-label)\|Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ \|Under review \|Under review \|Under review \|Under review \| \|[Scope labels to files or emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails) \|Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ \|Rolling out: 16.70+ <sup>\*</sup> \| Rolling out: 4.2309+ \|Rolling out: 4.2309+ \|Yes \| -\|[Get started with oversharing pop ups](dlp-osp-get-started.md)\|Current Channel: 2305+ <br /><br> Monthly Enterprise Channel: 2307+ <br /><br> Semi-Annual Enterprise Channel: 2302+ \|Under review \|Under review \|Under review \|Under review \| +\|[Preventing oversharing as DLP policy tip](dlp-osp-get-started.md)\|Current Channel: 2305+ <br /><br> Monthly Enterprise Channel: 2307+ <br /><br> Semi-Annual Enterprise Channel: 2302+ \|Under review \|Under review \|Under review \|Under review \| \|[Label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments) \|Current Channel: 2302+ <br /><br> Monthly Enterprise Channel: 2302+ <br /><br> Semi-Annual Enterprise Channel: 2302+ \|Under review \|Under review \|Under review \|Under review \| \|[Double Key Encryption (DKE)](encryption-sensitivity-labels.md#double-key-encryption) \|Preview: [Current Channel (Preview)](https://office.com/insider) \|Under review \|Under review \|Under review\| Under review \|
compliance	Sensitivity Labels	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels.md	f1.keywords: Previously updated : 07/11/2023 Last updated : 07/14/2023 audience: Admin For more label policy configurations, see [Manage sensitivity labels for Office After you create a label policy that assigns new sensitivity labels to users and groups, users start to see those labels in their Office apps. Allow up to 24 hours for the latest changes to replicate throughout your organization. -There's no limit to the number of sensitivity labels that you can create and publish, with one exception: If the label applies encryption that specifies the users and permissions, there's a maximum of 500 labels per tenant supported with this configuration. However, as a best practice to lower admin overheads and reduce complexity for your users, try to keep the number of labels to a minimum. Real-world deployments have proved effectiveness to be noticeably reduced when users have more than five main labels or more than five sublabels per main label. +There's no limit to the number of sensitivity labels that you can create and publish, with one exception: If the label applies encryption that specifies the users and permissions, there's a maximum of 500 labels per tenant supported with this configuration. However, as a best practice to lower admin overheads and reduce complexity for your users, try to keep the number of labels to a minimum. + +> [!TIP] +> Real-world deployments have proved effectiveness to be noticeably reduced when users have more than five main labels or more than five sublabels per main label. You might also find that some applications can't display all your labels when too many are published to the same user. ### Label policy priority (order matters)
compliance	Whats New	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md	Whether it be adding new solutions to the [Microsoft Purview compliance portal]( ### Data lifecycle management and records management - General availability (GA): Auto-labeling retention policies for [cloud attachments](apply-retention-labels-automatically.md#auto-apply-labels-to-cloud-attachments) that are shared via Viva Engage are now in general availability. +- Rolling out: A [default retention label for Outlook](create-apply-retention-labels.md#default-labels-for-sharepoint-and-outlook) is always retained when an item is moved to the Deleted Items folder. ### Data loss prevention Whether it be adding new solutions to the [Microsoft Purview compliance portal]( - General availability (GA): For labeling built into Windows, macOS, iOS, and Android, auditing actions for sensitivity labels include encryption details such as a change in the encryption status and settings, and the Rights Management owner. - In preview: The ability to [scope labels to files and emails](sensitivity-labels-office-apps.md#scope-labels-to-just-files-or-emails), so that, for example, a sensitivity label is visible to users in Outlook but not in Word, Excel, or PowerPoint. This configuration can be used as a parity feature for the AIP add-in, which could be disabled per app. - In preview: As a parity feature for the AIP add-in, built-in labeling for Windows supports [label inheritance from email attachments](sensitivity-labels-office-apps.md#configure-label-inheritance-from-email-attachments).-- In preview: Prevent oversharing of labeled emails as a DLP policy tip using [Get started with oversharing pop ups](dlp-osp-get-started.md). This DLP policy configuration is an equivalent for the AIP add-in with PowerShell advanced settings that implement pop-up messages in Outlook that warn, justify, or block emails being sent. +- In preview: Prevent [oversharing of labeled emails as a DLP policy tip](dlp-osp-get-started.md). This DLP policy configuration is an equivalent for the AIP add-in with PowerShell advanced settings that implement pop-up messages in Outlook that warn, justify, or block emails being sent. - In preview: Preview versions of Outlook for Mac now support [label colors](sensitivity-labels-office-apps.md#label-colors) but don't yet support the sensitivity bar. - In preview: For mandatory labeling, Outlook for Android in the Beta Channel supports a setting that you can configure with Microsoft Intune to [prompt users to select a sensitivity label when they first compose an email](sensitivity-labels-office-apps.md#for-outlook-mobile-change-when-users-are-prompted-for-a-label) instead of when they send it. - In preview: Now rolling out in preview to SharePoint and Teams, users can select and change a sensitivity label from the details pane from these apps when [sensitivity labels are enabled for Office files in SharePoint and OneDrive](sensitivity-labels-sharepoint-onedrive-files.md).
enterprise	Cross Tenant Sharepoint Migration Step5	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/cross-tenant-sharepoint-migration-step5.md	Get-SPOCrossTenantCompatibilityStatus -PartnerCrossTenantHostURL https://m365x12 \|Incompatible\|No\| > [!NOTE] -> We recommend waiting a period of 24 hours. If your tenants are still reporting as incompatible, contact support. +> We recommend waiting a period of 48 hours. If your tenants are still reporting as incompatible, contact support. > > We recommend performing the compatibility status check on a frequent basis and prior to starting ANY instances of cross tenant migrations. If the tenants are not compatible, this can result in cross-tenant migrations failing.
enterprise	O365 Data Locations	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/o365-data-locations.md	See the following links to understand how you can determine current workload dat - Viva Insights ΓÇô Advanced, Mgr, Leader [Data Location](m365-dr-workload-other.md#viva-insights--advanced-mgr-leader) - Viva Insights ΓÇô Personal [Data Location](m365-dr-workload-other.md#viva-insights--personal) - Viva Learning [Data Location](m365-dr-workload-other.md#viva-learning) +- Viva Pulse [Data Location](/viva/pulse/get-started/data-residency-for-viva-pulse) +- Yammer [Data Location](m365-dr-workload-other.md#viva-engage) - Viva Engage [Data Location](m365-dr-workload-other.md#viva-engage) - Office for mobile [Data Location](m365-dr-workload-other.md#office-for-mobile) - OneNote Services [Data Location](m365-dr-workload-other.md#onenote-services)
security	Mac Install With Intune	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-install-with-intune.md	In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2 ### Onboarding blob -This profile contains a license information for Microsoft Defender for Endpoint. Without license information, Microsoft Defender for Endpoint will report that it is not licensed. +This profile contains a license information for Microsoft Defender for Endpoint. Without license information, Microsoft Defender for Endpoint will report that it isn't licensed. 1. Select Create Profile under Configuration Profiles. 1. Select Platform=macOS, Profile type=Templates. Template name=Custom. Click Create. This profile contains a license information for Microsoft Defender for Endpoint. > [!div class="mx-imgBorder"] > :::image type="content" source="images/mdatp-6-systemconfigurationprofiles-1.png" alt-text="The Custom Configuration Profile creation page" lightbox="images/mdatp-6-systemconfigurationprofiles-1.png"::: -1. Choose a name for the profile, e.g., "Defender for Cloud or Endpoint onboarding for macOS". Click Next. +1. Choose a name for the profile, for example, "Defender for Cloud or Endpoint onboarding for macOS". Click Next. > [!div class="mx-imgBorder"] > :::image type="content" source="images/mdatp-6-systemconfigurationprofiles-2.png" alt-text="The Custom Configuration Profile name field" lightbox="images/mdatp-6-systemconfigurationprofiles-2.png"::: -1. Choose a name for the configuration profile name, e.g., "Defender for Endpoint onboarding for macOS". +1. Choose a name for the configuration profile name, for example, "Defender for Endpoint onboarding for macOS". 1. Choose a [deployment channel](/mem/intune/fundamentals/whats-new#new-deployment-channel-setting-for-custom-device-configuration-profiles-on-macos-devices). 1. Select intune/WindowsDefenderATPOnboarding.xml that you extracted from the onboarding package above as configuration profile file.
security	Mac Support License	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-support-license.md	Last updated 12/18/2020 ## No license found -While deploying [Microsoft Defender for Endpoint on macOS](microsoft-defender-endpoint-mac.md), an error message with an X on top of the Microsoft Defender for Endpoint on macOS shield may appear. +When [Microsoft Defender for Endpoint on macOS](microsoft-defender-endpoint-mac.md) is being deployed, an error message with an x on top of the Microsoft Defender for Endpoint on macOS shield appears. -Click the X symbol and an Action Needed prompt should pop up. Clicking the Action Needed prompt will bring up the following licensing error message: +Select the x symbol. +### Message -### Message: +When you select the x symbol, you'll see options as shown in the following screenshot: -No license found -Looks like your organization does not have a license for Microsoft 365 Enterprise subscription. +When you select Action needed, you'll get the error message as shown in the following screenshot: -Contact your administrator for help. +You'll encounter this message in a different way: If you're using the terminal to enter mdatp health without the double quotes, the message as shown in the following screenshot is displayed: -Or if you type "mdatp health" in the terminal without the double quotes, you might see the following warning: -### Message: -ATTENTION: No license found. Contact your administrator for help.\ -healthy: false\ -health_issues: ["missing license"]\ -licensed: false -### Cause: +### Cause -You deployed and/or installed the Microsoft Defender for Endpoint on macOS package ("Download installation package"), but might not have run the configuration script ("Download onboarding package") that contains the license settings. +1. You've deployed and/or installed the Microsoft Defender for Endpoint on macOS package [Download installation packages](mac-install-manually.md#download-installation-and-onboarding-packages), but might not have run the configuration script [Download the onboarding package](mac-install-with-intune.md#download-the-onboarding-package) that contains the license settings. For information on troubleshooting in this scenario, see [For not running the configuration script](#for-not-running-the-configuration-script). +1. You can also encounter this error message when the Microsoft Defender for Endpoint on macOS agent isn't up to date. For information on troubleshooting in this scenario, see [For Microsoft Defender for Endpoint on macOS not being up to date](#for-microsoft-defender-for-endpoint-on-macos-not-being-up-to-date). -You can also encounter this error when the Microsoft Defender for Endpoint on macOS agent isn't up to date or if you have not assigned a license to the user. +1. You can also encounter this error message if you haven't assigned a license to the user. For information on troubleshooting in this scenario, see [For not assigning a license to the user](#for-not-assigning-a-license-to-the-user). +### Solutions +#### For not running the configuration script -### Solution: -Depending on the deployment management tool used, please follow the instructions to onboard the package (register the license) as documented here: +This section describes the troubleshooting measures when the error/warning message is caused by non-execution of the configuration script that contains the license settings after you have deployed and/or installed the Microsoft Defender for Endpoint on macOS package. -\|Management\|Onboarding instructions (License deployment instructions)\| -\|-\|-\| -\|Intune\|[Onboarding blob](/microsoft-365/security/defender-endpoint/mac-install-with-intune?view=o365-worldwide#onboarding-blob&preserve-view=true)\| -\|JamF\|[Onboarding package](/microsoft-365/security/defender-endpoint/mac-jamfpro-policies?view=o365-worldwide#step-1-get-the-microsoft-defender-for-endpoint-onboarding-package&preserve-view=true)\| -\|Other MDM\|[License settings](/microsoft-365/security/defender-endpoint/mac-install-with-other-mdm?view=o365-worldwide#license-settings&preserve-view=true)\| -\|Manual installation\| Go thru [Download onboarding package](/microsoft-365/security/defender-endpoint/mac-install-manually?view=o365-worldwide#download-installation-and-onboarding-packages&preserve-view=true) and go thru the registration of the license according to [client-configuration](/microsoft-365/security/defender-endpoint/mac-install-manually?view=o365-worldwide#client-configuration&preserve-view=true)\| +Depending on the deployment management tool used, follow the tool-specific instructions to onboard the package (register the license) as described in the following table: ->[!TIP] +\|Management \|License deployment instructions (Onboarding instructions) \| +\|\|\| +\|Intune \| [Download the onboarding package](mac-install-with-intune.md#download-the-onboarding-package) \| +\|JamF \| [Step 1: Get the Microsoft Defender for Endpoint onboarding package](mac-jamfpro-policies.md#step-1-get-the-microsoft-defender-for-endpoint-onboarding-package) \| +\|Other MDM \| [License settings](mac-install-with-other-mdm.md#license-settings) \| +\|Manual installation \| [Download installation and onboarding packages](mac-install-manually.md#download-installation-and-onboarding-packages); and [Client configuration](mac-install-manually.md#client-configuration) \| + +> [!NOTE] > If the onboarding package runs correctly, the licensing information will be located in `/Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist`. -For scenarios where Microsoft Defender for Endpoint on macOS isn't up to date, you'll need to [update](/microsoft-365/security/defender-endpoint/mac-updates?view=o365-worldwide&preserve-view=true) the agent. +#### For Microsoft Defender for Endpoint on macOS not being up to date + +For scenarios where Microsoft Defender for Endpoint on macOS isn't up to date, you'll need to [update](mac-updates.md) the agent. + +#### For not assigning a license to the user + +1. In the Microsoft 365 Defender portal (security.microsoft.com): + 1. Select Settings. The Settings screen appears. + 1. Select Endpoints. + + :::image type="content" source="images/endpoints-option-on-settings-screen.png" alt-text="Screenshot of the Settings screen on which the Endpoints option is listed." lightbox="images/endpoints-option-on-settings-screen.png"::: + + The Endpoints screen appears. + + :::image type="content" source="images/endpoints-screen.png" alt-text="Screenshot of the Endpoints page." lightbox="images/endpoints-screen.png"::: + + 1. Select Licenses. + + :::image type="content" source="images/selecting-licenses-option-from-endpoints-screen.png" alt-text="Screenshot of the Endpoints page from which the Licenses options can be selected." lightbox="images/selecting-licenses-option-from-endpoints-screen.png"::: + + 1. Select View and purchase licenses in the Microsoft 365 admin center. The following screen in the Microsoft 365 admin center portal appears: + + :::image type="content" source="images/m365-admin-center-purchase-assign-licenses.png" alt-text="Screenshot of the Microsoft 365 admin center portal page from which licenses can be purchased and assigned." lightbox="images/m365-admin-center-purchase-assign-licenses.png"::: + + 1. Check the checkbox of the license you want to purchase from Microsoft, and select it. The screen displaying detail of the chosen license appears: + + :::image type="content" source="images/resultant-screen-of-selecting-preferred-license.png" alt-text="Screenshot of the product page from which you can select the option of assigning the purchased license." lightbox="images/resultant-screen-of-selecting-preferred-license.png"::: + + 1. Select the Assign licenses link. -To assign a license to the end-user, do the following: -1. In the Microsoft 365 Defender portal (security.microsoft.com), click on Settings -> Endpoints -> Licenses. -1. Select your license. -1. Click Assign licenses. -1. Enter the name and email address of the person being assigned. -1. Check the box for "Microsoft Defender for Endpoint" and click Assign. + + :::image type="content" source="images/assign-licenses-link.png" alt-text="Screenshot of the product page from which you can select the Assign licenses link." lightbox="images/assign-licenses-link.png"::: -If the licensing issues have been resolved, when you run "mdatp health," you should see the following results:\ -healthy: true\ -health_issues: []\ -licensed: true + The following screen appears: + + :::image type="content" source="images/screen-containing-option-to-assign-licenses.png" alt-text="Screenshot of the page containing the + Assign licenses option." lightbox="images/screen-containing-option-to-assign-licenses.png"::: + + 1. Select + Assign licenses. + 1. Enter the name or email address of the person to whom you want to assign this license. + + The following screen appears, displaying the details of the chosen license assignee and a list of options. + + :::image type="content" source="images/assignee-details-and-options.png" alt-text="Screenshot of the page displaying the assignee's details and a list of options." lightbox="images/assignee-details-and-options.png"::: + + 1. Check the checkboxes for Microsoft 365 Advanced Auditing, Microsoft 365 Defender, and Microsoft Defender for Endpoint. + 1. Select Save. + +On implementing these solution-options (either of them), if the licensing issues have been resolved, and then you run mdatp health, you should see the following results: + ## Sign in with your Microsoft account -![Sign in with your Microsoft account to get started](images/mac-consumer-login.png) -### Message: +### Message Sign in with your Microsoft account to get started. -Create new account or Switch to enterprise app +Create new account or Switch to enterprise app. -### Cause: +### Cause -You downloaded and installed [Microsoft Defender for individuals on macOS](https://www.microsoft.com/en-us/microsoft-365/microsoft-defender-for-individuals) on top of previously installed Microsoft Defender for Endpoint. +You've downloaded and installed [Microsoft Defender for individuals on macOS](https://www.microsoft.com/en-us/microsoft-365/microsoft-defender-for-individuals) on top of previously installed Microsoft Defender for Endpoint. -### Solution: +### Solution -Click Switch to enterprise app to switch to Enterprise experience. +Select Switch to enterprise app to switch to Enterprise experience. -You can also suppress switching to experience for Individuals on MDM enrolled machines by including userInterface/consumerExperience into Defender's settings: +You can also suppress switching to experience for Individuals on MDM-enrolled machines by including userInterface/consumerExperience in the Defender's settings: ```json <key>userInterface</key> You can also suppress switching to experience for Individuals on MDM enrolled ma <string>disabled</string> </dict> ```+ +## Recommended content + +- [Manual deployment for Microsoft Defender for Endpoint on macOS](mac-install-manually.md): Install Microsoft Defender for Endpoint on macOS manually from the command line. +- [Set up the Microsoft Defender for Endpoint on macOS policies in Jamf Pro](mac-jamfpro-policies.md): Learn how to set up the Microsoft Defender for Endpoint on macOS policies in Jamf Pro. +- [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md): Learn how to install, configure, update, and use Microsoft Defender for Endpoint on Mac. +- [Deploying Microsoft Defender for Endpoint on macOS with Jamf Pro](mac-install-with-jamf.md): Learn how to deploy Microsoft Defender for Endpoint on macOS with Jamf Pro.
security	Mac Whatsnew	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-whatsnew.md	Apple has fixed an issue on macOS [Ventura upgrade](<https://developer.apple.com Microsoft Defender for Endpoint no longer supports macOS Catalina (10.15) as Apple ended support for Catalina (10.15) in December 2022. </br> -### June-2023 (Build: 101.98.84 \| Release version: 20.123042.19884.0) +### Jul-2023 (Build: 101.23052.0004 \| Release version: 20.123052.4.0) + +\| Build: \| 101.23052.0004 \| +\|--\|--\| +\| Release version: \| 20.123052.4.0 \| +\| Engine version: \| 1.1.20100.7 \| +\| Signature version: \| 1.391.2163.0 \| + +##### What's new + +- Client version schema change +- Fix: Defender does not start on a machine with certain versions of Edge due to directory permission issue +- Bug and performance fixes + +### Jun-2023 (Build: 101.98.84 \| Release version: 20.123042.19884.0) \| Build: \| 101.98.84 \| \|--\|--\|
security	Microsoft Defender Antivirus Updates	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates.md	Title: Microsoft Defender Antivirus security intelligence and product updates description: Manage how Microsoft Defender Antivirus receives protection and product updates. ms.localizationpriority: high Previously updated : 07/11/2023 Last updated : 07/14/2023 audience: ITPro -+ All our updates contain - Serviceability improvements - Integration improvements (Cloud, [Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-defender)) -### June-2023 (Platform: 4.18.23060.x \| Engine: 1.1.23060.1005) +### June-2023 (Platform: 4.18.x.x \| Engine: 1.1.23060.1005) - Security intelligence update version: 1.393.71.0-- Release date: July 10, 2023 (Engine) / July 19, 2023 (Platform)-- Platform: 4.18.23060.x (final version number coming soon) +- Release date: July 10, 2023 (Engine) / (Platform release date is pending) +- Platform: 4.18.x.x (platform version number is pending) - Engine: 1.1.23060.1005 - Support phase: Security and Critical Updates ### What's new -- Improved output for [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus) if scan results fail to retrieve-- Extended management options for configuring security intelligence updates with [Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-windows), [Group Policy](use-group-policy-microsoft-defender-antivirus.md), and [PowerShell](/powershell/module/defender/set-mppreference)-- Improved the [unified agent](/microsoft-365/security/defender-endpoint/update-agent-mma-windows#upgrade-to-the-new-unified-agent-for-defender-for-endpoint) installation process to handle [MsMpEng.exe debugger](/microsoft-365/security/defender-endpoint/troubleshooting-mode-scenarios#scenario-2-high-cpu-usage-due-to-windows-defender-msmpengexe) extensions, if present-- Fixed an issue pertaining to showing the exclusions list with PowerShell ([Get-MpPreference](/powershell/module/defender/get-mppreference)) on systems managed by Intune-- Fixed warn notifications for two [attack surface reduction (ASR) rules](attack-surface-reduction.md) ([Block Office applications from injecting code into other processes](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference#block-office-applications-from-injecting-code-into-other-processes) and [Block credential stealing from the Windows local security authority subsystem](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference#block-credential-stealing-from-the-windows-local-security-authority-subsystem))-- Fixed an issue with running `Update-MpSignature -UpdateSource:MMPC` when using a nonelevated PowerShell console. (See [Update-MpSignature](/powershell/module/defender/update-mpsignature).)+ - Fixed an issue with [ASR rules deployed via Intune](/mem/intune/protect/endpoint-security-asr-policy) to display accurately in the Microsoft 365 Defender portal - Fixed a performance issue when building and validating Defender cache - Improved performance by removing redundant exclusion checks
security	Professional Services	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/professional-services.md	Managed security services that assist organizations to detect threats early and \|[Managed Microsoft XDR](https://go.microsoft.com/fwlink/?linkid=2202846)\|Quorum Cyber\|Quorum Cyber's Managed Microsoft XDR, a solution designed to enable customers to unleash the power of Microsoft security to reduce cyber risk and maximize return of investment in security.\| \|[SecureShield365](https://go.microsoft.com/fwlink/?linkid=2209718)\|Patriot Consulting\|SecureShield365 includes a full deployment of all Microsoft 365 Defender products including Intune plus 12 months of support. Microsoft XDR including Sentinel, Defender for Cloud, and MDR are available options.\| \|[Open Systems MDR+](https://go.microsoft.com/fwlink/?linkid=2208895)\|Open Systems\|Built for Microsoft security customers, MDR+ combines certified experts, exemplary processes, and seamless technology to deliver tailored, 24x7 protection while reducing attack surfaces and MTTR.\| -\|[Kroll](https://www.kroll.com/en)\|Kroll\|Kroll provides proprietary data, technology and insights to help our clients stay ahead of complex demands related to risk, governance and growth. Our solutions deliver a powerful competitive advantage, enabling faster, smarter and more sustainable decisions. With 5,000 experts around the world, we create value and impact for our clients and communities.\| +\|[Kroll](https://www.kroll.com/en/services/cyber-risk/managed-security/kroll-responder)\|Kroll\|Kroll provides proprietary data, technology and insights to help our clients stay ahead of complex demands related to risk, governance and growth. Our solutions deliver a powerful competitive advantage, enabling faster, smarter and more sustainable decisions. With 5,000 experts around the world, we create value and impact for our clients and communities.\| ## Respond
security	Attack Simulation Training Faq	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-faq.md	A: Currently, there are 40+ localized payloads available in 29+ languages: Engli That being said, you can create your own payload in the language of your choice using the custom payload authoring experience. We also strongly recommend that you harvest existing payloads that were used to target users in a specific geography. In other words, let the attackers localize the content for you. +### Q: How many training videos are available? + +A: Currently, there are more than 85 training modules available in the content library. + ### Q: How can I switch to other languages for my admin portal and training experience? A: In Microsoft 365 or Office 365, language configuration is specific and centralized for each user account. For instructions on how to change your language setting, see [Change your display language and time zone in Microsoft 365 for Business](https://support.microsoft.com/office/6f238bff-5252-441e-b32b-655d5d85d15b).
security	Protect Against Threats	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/protect-against-threats.md	The following procedure describes how to configure the default anti-phishing pol - Actions section: Select Edit actions and configure the following settings in the flyout that opens: - Message actions section: Configure the following settings: - If a message is detected as user impersonation<sup>\</sup>: Select Quarantine the message. Select nothing in the Apply quarantine policy* box that appears to use the default [quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy) that applies to messages that are quarantined by user impersonation protection. - - If a message is detected as domain impersonation<sup>\</sup>: Select nothing in the Apply quarantine policy* box that appears to use the default [quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy) that applies to messages that are quarantined by user domain impersonation protection. + - If a message is detected as domain impersonation<sup>\</sup>: Select Quarantine the message. Select nothing in the Apply quarantine policy* box that appears to use the default [quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy) that applies to messages that are quarantined by user domain impersonation protection. - If mailbox intelligence detects an impersonated user<sup>\</sup>: Select Move the message to the recipients' Junk Email folders* (Standard) or Quarantine the message (Strict). Select nothing in the Apply quarantine policy box that appears to use the default [quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy) that applies to messages that are quarantined by mailbox intelligence protection. - If the message is detected as spoof by spoof intelligence: Select Move the message to the recipients' Junk Email folders (Standard) or Quarantine the message (Strict). Select nothing in the Apply quarantine policy box that appears to use the default [quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy) that applies to messages that are quarantined by spoof intelligence protection. - Safety tips & indicators section: Configure the following settings:
security	Reducing Attack Surface In Microsoft Teams	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/reducing-attack-surface-in-microsoft-teams.md	Users can store their files in potentially unsupported third party storage provi ## Disabling Third-party & custom apps -Applications are a very useful part of Microsoft teams, but it's recommended to maintain a list of allowed apps rather than allowing all apps by default. +Applications are a very useful part of Microsoft Teams, but it's recommended to maintain a list of allowed apps rather than allowing all apps by default. 1. Login to the Teams admin center at: <https://admin.teams.microsoft.com/>. 2. On the left-hand navigation, expand Teams apps and then choose Permission Policies. You can reduce the attack surface by ensuring people outside your organization c 2. On the left-hand navigation, expand Meetings and then choose Meeting Policies. 3. If you've assigned any custom or built-in policies to users, you'll need to do these steps for each of them if appropriate, otherwise select Global (Org-wide default). 4. Under the Content sharing heading, ensure External participants can give or request control is set to off. -5. Under the Participants & guests heading, ensure Automatically admit people is set to Invited users only. -6. Ensure Dial-in users can bypass the lobby is set to off. -7. Ensure Let anonymous people join a meeting is set to off. -8. Set Chat in meetings to "Turn it on for everyone but anonymous users". -9. Press Save. +6. Under the Meeting join & lobby heading, ensure People dialing in can bypass the lobby is set to off. +7. Ensure Anonymous users can join a meeting is set to off. +8. Under the Meeting engagement heading, Set Meeting chat to "On for everyone but anonymous users". +9. Select Save. 10. You need to change this setting for each policy. ## Configure meeting settings (Restrict presenters) You can reduce the risk of unwanted or inappropriate content being shared during 1. Login to the Teams admin center at: <https://admin.teams.microsoft.com/>. 2. On the left-hand navigation, expand Meetings and then choose Meeting Policies. 3. If you've assigned any custom or built-in policies to users, you'll need to do these steps for each of them if appropriate, otherwise select Global (Org-wide default). -4. Under the Participants & guests heading, toggle who can present in meetings to Organizers, but users can override. -5. Press Save. +4. Under the Content sharing heading, set Who can present to Only organizers and co-organizers. +5. Select Save. 6. You need to change this setting for each policy. -## Disable open federation +## Limit domains for external access -Open federation allows your users to communicate externally in Microsoft teams, allowing external organizations to start a conversation with your users and vice versa, which is useful for collaboration, but also for attackers to directly communicate with your organization if they know a victims email address. +External access allows your users to communicate externally in Teams, allowing external organizations to start a conversation with your users and vice versa, which is useful for collaboration, but also for attackers to directly communicate with your organization if they know a victim's email address. [Learn more](/microsoftteams/manage-external-access) (detailed documentation) 1. Login to the Teams admin center at: <https://admin.teams.microsoft.com/>. 2. On the left-hand navigation, expand Users and then choose External access. 3. Under the Teams and Skype for Business users in external organizations heading, select the Choose which external domains your users have access to dropdown and set this to Allow only specific external domains. -4. Enter any external domains users should be able to communicate with by pressing Allow domains, using the flyout, and pressing Done when finished. -5. Press Save. +4. Enter any external domains users should be able to communicate with by selecting Allow domains, using the flyout, and selecting Done when finished. +5. Select Save. + +Note that external organizations must also allow your organization's domain for external access to work. ## Learn More
security	Submissions Teams	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-teams.md	User reporting of messages in Teams is made of two separate settings: - In the Teams admin center: On by default and controls whether users are able to report messages from Teams. When this setting is turned off, users can't report messages within Teams, so the corresponding setting in the Microsoft 365 Defender portal is irrelevant. -- In the Microsoft 365 Defender portal: On by default. If user reporting of messages is turned on in the Teams admin center, it also needs to be turned on the Defender portal for user reported messages to show up correctly. +- In the Microsoft 365 Defender portal: On by default for new tenants. Existing tenants need to enable it. If user reporting of messages is turned on in the Teams admin center, it also needs to be turned on the Defender portal for user reported messages to show up correctly. ### Turn off or turn on user reporting in the Teams admin center The value of this setting is meaningful only if message reporting is turned on i 2. On the User reported settings page, go to the Microsoft Teams section for the Monitor reported messages in Microsoft Teams setting. - As previously described, this setting is turned on by default, and you typically leave it turned on if message reporting is also turned on in Teams admin center. + As previously described, this setting is turned on by default for new tenants, and existing tenants need to enable it. You typically leave it turned on if message reporting is also turned on in Teams admin center. :::image type="content" source="../../media/submissions-teams-turn-on-off-defender-portal.png" alt-text="Screenshot of the 'Monitor reported messages in Microsoft Teams' setting in the Microsoft 365 Defender portal." lightbox="../../media/submissions-teams-turn-on-off-defender-portal.png":::
security	Try Microsoft Defender For Office 365	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/try-microsoft-defender-for-office-365.md	A: See [Extend your trial](/microsoft-365/commerce/try-or-buy-microsoft-365#exte ### Q: What happens to my data after the trial expires? -A: After your trial expires, yo have access to your trial data (data from features in Defender for Office 365 that you didn't have previously) for 30 days. After this 30 day period, all policies and data that were associated with the Defender for Office 365 trial are deleted. +A: After your trial expires, you have access to your trial data (data from features in Defender for Office 365 that you didn't have previously) for 30 days. After this 30 day period, all policies and data that were associated with the Defender for Office 365 trial are deleted. ### Q: How many times can I use the Defender for Office 365 trial in my organization?
syntex	Create A Form Processing Model	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/create-a-form-processing-model.md	Title: Train a structured document processing model in Microsoft Syntex + Title: Train a structured or freeform document processing model in Microsoft Syntex Previously updated : 10/12/2022 Last updated : 07/13/2023 audience: admin - m365initiative-syntex ms.localizationpriority: medium -description: Learn how to train a structured document processing model in Microsoft Syntex. +description: Learn how to train a structured or freeform document processing model in Microsoft Syntex. -# Train a structured document processing model in Microsoft Syntex +# Train a structured or freeform document processing model in Microsoft Syntex <! -</br> - -> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4GnhN] - -</br> -- Using [AI Builder](/ai-builder/overview)ΓÇöa feature in Microsoft Power AppsΓÇöSyntex users can create a [structured document processing](form-processing-overview.md) model directly from a SharePoint document library. > -Follow the instructions in [Create a model in Syntex](create-syntex-model.md) to create a structured document processing model in a content center. Or, follow the instructions in [Create a model on a local SharePoint site](create-local-model.md) to create the model on a local site. Then use this article to train your model. +Follow the instructions in [Create a model in Syntex](create-syntex-model.md) to create a structured or freeform document processing model in a content center. Or, follow the instructions in [Create a model on a local SharePoint site](create-local-model.md) to create the model on a local site. Then use this article to train your model. ![Diagram of the workflow to train an AI Builder model.](../media/content-understanding/train-aib-model.png) -To train a structured document processing model, follow these steps: +To train a structured or freeform document processing model, follow these steps: - [Step 1: Add and analyze documents](#step-1-add-and-analyze-documents) - [Step 2: Tag fields and tables](#step-2-tag-fields-and-tables) To train a structured document processing model, follow these steps: ## Step 1: Add and analyze documents -After you create your structured document processing model, the Choose information to extract page opens. Here you list all pieces of information that you want the AI model to extract from your documents, such as Name, Address, or Amount. +After you create your structured or freeform document processing model, the Choose information to extract page opens. Here you list all pieces of information that you want the AI model to extract from your documents, such as Name, Address, or Amount. > [!NOTE] > When you look for example files to use, see the [document processing model input document requirements and optimization tips](/ai-builder/form-processing-model-requirements). To run the flow: > [!IMPORTANT] > The information in this section doesn't apply to the latest release of Syntex. It is left as reference only for the form processing models that were created in previous releases. In the latest release, you no longer need to configure the flows to process existing files. -Two flows are available to process a selected file or batch of files in a library where a structured document processing model has been applied. +Two flows are available to process a selected file or batch of files in a library where a structured or freeform document processing model has been applied. - Extract info from an image or PDF file with a document processing model ΓÇö Use to extract text from a selected image or PDF file by running a document processing model. Supports a single selected file at a time, and supports only PDF files and image files (.png, .jpg, and .jpeg). To run the flow, select a file, and then select Automate > Extract info. Two flows are available to process a selected file or batch of files in a librar > [!NOTE] > The Extract info from an image or PDF file with a document processing model flow is automatically available for a library with a document processing model associated. The Extract info from files with a document processing model flow is a template that must be added to the library if required. -## See also - -[Create a model in Microsoft Syntex](create-syntex-model.md) - -[Power Automate documentation](/power-automate/) - -[Training: Improve business performance with AI Builder](/training/paths/improve-business-performance-ai-builder/?source=learn)
syntex	Create Syntex Model	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/create-syntex-model.md	Use the Freeform selection method to create a [freeform document processing 5. When you're ready to create the model, select Create. -6. You're now ready to [train the model](train-freeform-document-processing-model.md). +6. You're now ready to [train the model](create-a-form-processing-model.md). > [!NOTE] > When published, this model type is available for reuse by others who do not own the model. Currently, this model can be edited and shared for editing only by the model owner.
syntex	Form Processing Overview	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/form-processing-overview.md	Title: Overview of structured document processing in Microsoft Syntex + Title: Overview of structured and freeform document processing in Microsoft Syntex Previously updated : 10/12/2022 Last updated : 07/13/2023 audience: admin - enabler-strategic - m365initiative-syntex ms.localizationpriority: medium -description: Learn how to use AI Builder to create structured document processing models in Microsoft Syntex. +description: Learn how to use AI Builder to create structured or freeform document processing models in Microsoft Syntex. -# Overview of structured document processing in Microsoft Syntex +# Overview of structured and freeform document processing in Microsoft Syntex </br> description: Learn how to use AI Builder to create structured document processin Use the structured document processing model ([layout method](create-syntex-model.md#train-a-custom-model)) to automatically identify field and table values. It works best for structured or semi-structured documents, such as forms and invoices. -## Introduction to structured models +Use the freeform document processing model ([freeform selection method](create-syntex-model.md#train-a-custom-model)) to automatically extract information from unstructured and freeform documents, such as letters and contracts. -Microsoft Syntex uses Microsoft Power Apps [AI Builder](/ai-builder/form-processing-model-overview) document processing (formerly known as form processing) to create structured document processing models within SharePoint document libraries. +## Introduction to structured and freeform models + +Microsoft Syntex uses Microsoft Power Apps [AI Builder](/ai-builder/form-processing-model-overview) document processing (formerly known as form processing) to create structured and freeform document processing models within SharePoint document libraries. <! ![AI Builder.](../media/content-understanding/ai-builder.png) > -You can use AI Builder document processing to create structured document processing models that use machine learning technology to identify and extract key-value pairs and table data from structured or semi-structured documents, such as forms and invoices. +You can use AI Builder document processing to create structured or freeform document processing models that use machine learning technology to identify and extract key-value pairs and table data from structured or semi-structured documents, such as forms and invoices, and unstructured or freeform documents, such as contracts and correspondence. -Organizations often receive invoices in large quantities from various sources, such as mail, fax, and email. Processing these documents and manually entering them into a database can take a considerable amount of time. By using AI to extract the text, key-value pairs, and tables from your documents, Syntex automates this process. +Organizations often receive invoices in large quantities from various sources, such as mail, fax, and email. Processing these documents and manually entering them into a database can take a considerable amount of time. By using AI to extract the text, key-value pairs, and tables from your documents, Syntex automates this process. > [!NOTE] > For more ideas about how to use these models in your organization, see [Get started driving adoption](adoption-getstarted.md) and [Scenarios and use cases](adoption-scenarios.md). -For example, you can create a structured document processing model that identifies all documents that are uploaded to the document library. From each document, you can then extract and display specific data that is important to you. +For example, you can create a structured or freeform document processing model that identifies all documents that are uploaded to the document library. From each document, you can then extract and display specific data that is important to you. ![Screenshot showing the document library view.](../media/content-understanding/doc-lib-done.png) You use example files to train your model and define the information to be extracted from your form. The layout of your document is learned by training your model. You only need five form documents to get started. Syntex will analyze your example files for key-value pairs, and you can also manually identify ones that might not have been detected. AI builder lets you test the accuracy of your model on your example files. -You can only create a structured document processing model in SharePoint document libraries for which it's enabled. If it has been enabled, you're able to see the Classify and extract option in your document library. +You can only create a structured or freeform document processing model in SharePoint document libraries for which it's enabled. If it has been enabled, you're able to see the Classify and extract option in your document library. ![Screenshot showing the AI Builder model.](../media/content-understanding/create-ai-builder-model2.png)
syntex	Model Types Overview	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/model-types-overview.md	This model type is the best option for English documents in PDF or image files w When you create a freeform document processing model, use the Freeform selection method option. -For more information, see [Overview of freeform document processing](freeform-document-processing-overview.md). +For more information, see [Overview of structured and freeform document processing](form-processing-overview.md). ### Structured document processing This model type supports the widest range of languages and is trained to underst When you create a structured document processing model, use the Layout method option. -For more information, see [Overview of structured document processing](form-processing-overview.md). +For more information, see [Overview of structured and freeform document processing](form-processing-overview.md). ## Prebuilt models
syntex	Prebuilt Model Contract	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/prebuilt-model-contract.md	To rename an extractor from the Extractors panel: - If you're ready to apply the model to a library, in the document area, select Next. On the Add to library panel, choose the library to which you want to add the model, and then select Add. -## Change the view in a document library - -For information about how to set the default view and how to change the view of a document library, see [Choose the view in a document library](choose-library-view.md). -
syntex	Prebuilt Model Invoice	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/prebuilt-model-invoice.md	To rename an extractor from the Extractors panel: - To save changes and return to the model home page, on the Extractors panel, select Save and exit. - If you're ready to apply the model to a library, in the document area, select Next. On the Add to library panel, choose the library to which you want to add the model, and then select Add.- -## Change the view in a document library - -For information about how to set the default view and how to change the view of a document library, see [Choose the view in a document library](choose-library-view.md). - -<! ->
syntex	Prebuilt Model Receipt	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/prebuilt-model-receipt.md	To rename an extractor from the Extractors panel: - To save changes and return to the model home page, on the Extractors panel, select Save and exit. - If you're ready to apply the model to a library, in the document area, select Next. On the Add to library panel, choose the library to which you want to add the model, and then select Add.- -## Change the view in a document library - -For information about how to set the default view and how to change the view of a document library, see [Choose the view in a document library](choose-library-view.md).
syntex	Syntex Overview	https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-overview.md	Instead of having to create a new document processing model from scratch, you ca Both structured and freeform models use Microsoft Power Apps AI Builder to create and train models within Syntex. -Learn more about [structured models](form-processing-overview.md) and [freeform models](freeform-document-processing-overview.md) in Microsoft Syntex. +[Learn more about structured and freeform models in Microsoft Syntex.](form-processing-overview.md) ### Unstructured document processing