| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| includes | Defender Threat Intelligence Content Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/defender/includes/defender-threat-intelligence-content-updates.md | +<!-- This file is generated automatically each week. Changes made to this file will be overwritten.--> ++++## Week of June 20, 2022 +++| Published On |Topic title | Change | +|||--| +| 6/23/2022 | [Defender Threat Intelligence](/defender-threat-intelligence/index) | modified | |
| index | Index | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/defender/index.md | + + Title: Defender Threat Intelligence +description: Defender Threat Intelligence +search.appverid: MET150 +++++ms.technology: m365d +ms.localizationpriority: medium +f1.keywords: CSH +++# Welcome to Defender-Threat-Intelligence! |
| threat-intelligence | Index | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/defender/threat-intelligence/index.md | + + Title: Defender Threat Intelligence +description: Defender Threat Intelligence +search.appverid: MET150 +++++ms.technology: m365d +ms.localizationpriority: medium +f1.keywords: CSH +++# Welcome to Defender-Threat-Intelligence! |
| compliance | Ediscovery Graph Connector | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery-graph-connector.md | + + Title: "Microsoft Purview eDiscovery Graph connectors" +f1.keywords: +- NOCSH +++ Last updated : 07/15/2022+audience: Admin ++++- m365-security-compliance +- m365solution-ediscovery +- m365initiative-compliance +- m365solution-overview +ms.localizationpriority: medium +search.appverid: +- SPO160 +- MOE150 +- MET150 +description: "Microsoft 365 customers can perform eDiscovery searches on content ingested for enterprise search." +++# Use Graph connectors with eDiscovery (Premium) ++Microsoft 365 customers can perform eDiscovery searches on content ingested for enterprise search. This will help organizations improve their compliance posture to external content sources by bringing them within the purview of Microsoft compliance solutions. ++With Graph connectors, you can enable content from external data sources to be available to Microsoft Purview eDiscovery premium solution. Learn more about establishing Graph Connectors for your organization here: [Microsoft Graph connectors overview for Microsoft Search](/microsoftsearch/connectors-overview). ++## Add Graph Connector as a data source within a case ++Once Graph Connectors are established for an organization and eDiscovery is enabled, the option to add the Graph Connector data source to the case will be available under non-Microsoft 365 locations. Only the connectors that have been established and enabled will be available to the eDiscovery manager for inclusion in a case. +++## Collect Graph Connectors content ++Upon adding Graph Connectors content as a data source this content is then available for search and collection. Within the collection wizard, select the Graph Connector content as a non-custodial data source, use conditions such as date range, keywords and more to search across the connected content to collect only the content of interest. Upon completion of the wizard get estimates for the amount of content that contains hits to your search criteria, and commit the collection to the review set. ++## Review content ++Once collected to a review set, eDiscovery managers can review content from Graph Connectors to understand more about the content and work to assess if the information is critical and relevant to the case. ++## Export content ++Once validated that the content collected into review is the correct content, this content is then available for export from the review set directly. Select export options and submit the export job for the Connectors content to be exported from the review set. |
| compliance | Overview Ediscovery 20 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/overview-ediscovery-20.md | audience: Admin ms.localizationpriority: medium-+ - m365-security-compliance - m365solution-aed - m365initiative-compliance - m365solution-overview+search.appverid: - MOE150 - MET150 description: "Learn about the eDiscovery (Premium) solution in Microsoft Purview. This article provides an overview of eDiscovery (Premium) in Microsoft Purview, a tool to help you manage internal and external investigations. It also frames the business reasons for using eDiscovery (Premium) to manage your legal investigations." At a high level, here's how eDiscovery (Premium) supports the EDRM workflow: - **Collection.** After you identified (and preserved) the data sources relevant to the investigation, you can use the built-in search tool in eDiscovery (Premium) search for and collect live data from the custodial data sources (and non-custodial data sources, if applicable) that may be relevant to the case. -- **Processing.** After you've collected all data relevant to the case, the next step is process it for further review and analysis. In eDiscovery (Premium), the in-place data that you identified in the collection phase is copied to an Azure Storage location (called a *review set*), which provides you with a static view of the case data. +- **Processing.** After you've collected all data relevant to the case, the next step is process it for further review and analysis. In eDiscovery (Premium), the in-place data that you identified in the collection phase is copied to an Azure Storage location (called a *review set*), which provides you with a static view of the case data. - **Review.** After data has been added to a review set, you can view specific documents and run additional queries to reduce the data to what is most relevant to the case. Also, can annotate and tag specific documents. At a high level, here's how eDiscovery (Premium) supports the EDRM workflow: ## Subscriptions and licensing -For information regarding what licenses provide the rights for a user to benefit from eDiscovery (Premium) please see [Microsoft 365 guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#microsoft-purview-ediscovery) and see the "eDiscovery and auditing" section in theΓÇ»[Microsoft 365 Comparison table](https://go.microsoft.com/fwlink/?linkid=2139145). +For information regarding what licenses provide the rights for a user to benefit from eDiscovery (Premium) please see [Microsoft 365 guidance for security & compliance](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#microsoft-purview-ediscovery) and see the "eDiscovery and auditing" section in the [Microsoft 365 Comparison table](https://go.microsoft.com/fwlink/?linkid=2139145). -For information about how to assign licenses, seeΓÇ»[Assign licenses to users](/microsoft-365/admin/manage/assign-licenses-to-users). +For information about how to assign licenses, see [Assign licenses to users](/microsoft-365/admin/manage/assign-licenses-to-users). ## Get started with eDiscovery (Premium) |
| compliance | Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels.md | For these pages that have unavailable options, select **Next** to continue. Or, ### Label priority (order matters) -When you create your sensitivity labels in the Microsoft Purview compliance center, they appear in a list on the **Sensitivity** tab on the **Labels** page. In this list, the order of the labels is important because it reflects their priority. You want your most restrictive sensitivity label, such as Highly Confidential, to appear at the **bottom** of the list, and your least restrictive sensitivity label, such as Public, to appear at the **top**. +When you create your sensitivity labels in the Microsoft Purview compliance portal, they appear in a list on the **Sensitivity** tab on the **Labels** page. In this list, the order of the labels is important because it reflects their priority. You want your most restrictive sensitivity label, such as Highly Confidential, to appear at the **bottom** of the list, and your least restrictive sensitivity label, such as Public, to appear at the **top**. You can apply just one sensitivity label to an item such as a document, email, or container. If you set an option that requires your users to provide a justification for changing a label to a lower classification, the order of this list identifies the lower classifications. However, this option does not apply to sublabels that share the priority of their parent label. There is no limit to the number of sensitivity labels that you can create and pu ### Label policy priority (order matters) -You make your sensitivity labels available to users by publishing them in a sensitivity label policy that appears in a list on the **Sensitivity policies** tab on the **Label policies** page. Just like sensitivity labels (see [Label priority (order matters)](#label-priority-order-matters)), the order of the sensitivity label policies is important because it reflects their priority. The label policy with lowest priority is shown at the **top**, and the label policy with the highest priority is shown at the **bottom**. +You make your sensitivity labels available to users by publishing them in a sensitivity label policy that appears in a list on the **Label policies** page. Just like sensitivity labels (see [Label priority (order matters)](#label-priority-order-matters)), the order of the sensitivity label policies is important because it reflects their priority: The label policy with lowest priority is shown at the top of the list with the **lowest** order number, and the label policy with the highest priority is shown at the bottom of the list with the **highest** order number. A label policy consists of: A label policy consists of: - The users and groups that will be assigned the policy with labels. - The scope of the policy and policy settings for that scope (such as default label for files and emails). -You can include a user in multiple label policies, and the user will get all the sensitivity labels and settings from those policies. If there is a conflict in settings from multiple policies, the settings from the policy with the highest priority (lowest position) is applied. In other words, the highest priority wins for each setting. +You can include a user in multiple label policies, and the user will get all the sensitivity labels and settings from those policies. If there is a conflict in settings from multiple policies, the settings from the policy with the highest priority (highest order number) is applied. In other words, the highest priority wins for each setting. -If you're not seeing the label or label policy setting behavior that you expect for a user or group, check the order of the sensitivity label policies. You might need to move the policy down. To reorder the label policies, select a sensitivity label policy > choose the ellipsis on the right > **Move down** or **Move up**. +If you're not seeing the label policy setting behavior that you expect for a user or group, check the order of the sensitivity label policies. You might need to move the policy down. To reorder the label policies, select a sensitivity label policy > choose the Actions ellipsis for that entry > **Move down** or **Move up**. For example:  +From our screenshot example that shows three label policies, all users are assigned the standard label policy, so it's appropriate that it has the lowest priority (lowest order number of 0). Only users in the IT department are assigned the second policy that has the order number 1. For these users, if there are any conflicts in settings between their policy and the standard policy, the settings from their policy wins because it has a higher order number. ++Similarly for users in the legal department, who are assigned the third policy with distinct settings. It's likely that these users will have more stringent settings, so it's appropriate that their policy has the highest order number. It's unlikely that a user from the legal department will be in a group that's also assigned to the policy for the IT department. But if they are, the order number 2 (highest order number) ensures that the settings from the legal department always take priority if there's a conflict. + > [!NOTE]-> Remember: When there is a conflict of settings for a user who has multiple policies assigned, the setting from the policy with the highest priority (lowest position) is applied. +> Remember: If there is a conflict of settings for a user who has multiple policies assigned to them, the setting from the assigned policy with the highest order number is applied. ## Sensitivity labels and Azure Information Protection |
| contentunderstanding | Create An Extractor | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/create-an-extractor.md | You need to create an extractor for each entity in the document that you want to  > [!NOTE]- > For extractors with the column type **Single line of text**, the maximum character limit is 255. Any characters that you select exceeding the limit get truncated. To select greater than 255 characters, choose the **Multiple Lines of Text** column type when creating the extractor. + > For extractors with the column type **Single line of text**, the maximum character limit is 255. Any characters that you select exceeding the limit get truncated. To select greater than 255 characters, choose the **Multiple lines of text** column type when creating the extractor. + > + >By default, **Multiple lines of text** columns are created with a limit to the amount of text that can be added. In this case, extracted text might appear truncated. If this occurs, the column setting **Allow unlimited length in document libraries** can be used to remove the limit. 3. When you're done, select **Create**. |
| includes | Microsoft 365 Content Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-365-content-updates.md | +## Week of July 11, 2022 +++| Published On |Topic title | Change | +|||--| +| 7/11/2022 | [Understand the proposal workflow](/microsoft-365/commerce/understand-proposal-workflow?view=o365-21vianet) | modified | +| 7/11/2022 | [Investigate and remediate communication compliance alerts](/microsoft-365/compliance/communication-compliance-investigate-remediate?view=o365-21vianet) | modified | +| 7/11/2022 | [Overview of the eDiscovery (Premium) solution in Microsoft Purview](/microsoft-365/compliance/overview-ediscovery-20?view=o365-21vianet) | modified | +| 7/11/2022 | [Learn about retention for Teams](/microsoft-365/compliance/retention-policies-teams?view=o365-21vianet) | modified | +| 7/11/2022 | Overview of Microsoft Defender Security Center | removed | +| 7/11/2022 | [Trial playbook - Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/defender-endpoint-trial-playbook?view=o365-21vianet) | added | +| 7/11/2022 | [Export incidents queue to CSV files](/microsoft-365/security/defender/export-incidents-queue?view=o365-21vianet) | added | +| 7/11/2022 | [Microsoft Defender for Identity in Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-center-mdi?view=o365-21vianet) | added | +| 7/11/2022 | [Report spam, non-spam, phishing, and suspicious emails to Microsoft](/microsoft-365/security/office-365-security/report-junk-email-messages-to-microsoft?view=o365-21vianet) | modified | +| 7/11/2022 | [Enable block at first sight to detect malware in seconds](/microsoft-365/security/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus?view=o365-21vianet) | modified | +| 7/11/2022 | [Evaluate Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/evaluate-microsoft-defender-antivirus?view=o365-21vianet) | modified | +| 7/11/2022 | [Overview of next-generation protection in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/next-generation-protection?view=o365-21vianet) | modified | +| 7/11/2022 | [Onboard previous versions of Windows on Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboard-downlevel?view=o365-21vianet) | modified | +| 7/11/2022 | [Switch to Microsoft Defender for Endpoint - Onboard](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-3?view=o365-21vianet) | modified | +| 7/11/2022 | [What's new in Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score-whats-new?view=o365-21vianet) | modified | +| 7/11/2022 | [Manage GDPR data subject requests in Microsoft Whiteboard](/microsoft-365/whiteboard/gdpr-requests?view=o365-21vianet) | modified | +| 7/11/2022 | [Compare Microsoft Defender for Endpoint plans](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2?view=o365-21vianet) | modified | +| 7/11/2022 | [Microsoft Defender Antivirus in Windows](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows?view=o365-21vianet) | modified | +| 7/12/2022 | [Learn how to mitigate the Log4Shell vulnerability in Microsoft Defender for Endpoint - threat and vulnerability management](/microsoft-365/security/defender-vulnerability-management/tvm-manage-log4shell-guidance?view=o365-21vianet) | renamed | +| 7/12/2022 | [Microsoft 365 feature descriptions](/microsoft-365/admin/m365-feature-descriptions?view=o365-21vianet) | modified | +| 7/12/2022 | [Unassign licenses from users](/microsoft-365/admin/manage/remove-licenses-from-users?view=o365-21vianet) | modified | +| 7/12/2022 | [Block potentially unwanted applications with Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus?view=o365-21vianet) | modified | +| 7/12/2022 | [Microsoft Defender Antivirus compatibility with other security products](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility?view=o365-21vianet) | modified | +| 7/12/2022 | [Understand and use attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction?view=o365-21vianet) | modified | +| 7/12/2022 | [Microsoft 365 Health Dashboard](/microsoft-365/admin/manage/health-dashboard-overview?view=o365-21vianet) | added | +| 7/12/2022 | Admin training video library # < 60 chars | removed | +| 7/12/2022 | [What's new in Microsoft Purview risk and compliance solutions](/microsoft-365/compliance/whats-new?view=o365-21vianet) | modified | +| 7/12/2022 | [Microsoft Threat Experts](/microsoft-365/security/defender-endpoint/microsoft-threat-experts?view=o365-21vianet) | modified | +| 7/12/2022 | [Microsoft Threat Experts in Microsoft 365 Defender overview](/microsoft-365/security/defender/microsoft-threat-experts?view=o365-21vianet) | modified | +| 7/12/2022 | [Spoof intelligence insight](/microsoft-365/security/office-365-security/learn-about-spoof-intelligence?view=o365-21vianet) | modified | +| 7/13/2022 | [Get Microsoft Defender for Business servers](/microsoft-365/security/defender-business/get-defender-business-servers?view=o365-21vianet) | added | +| 7/13/2022 | [Microsoft Defender for Business preview features](/microsoft-365/security/defender-business/mdb-preview?view=o365-21vianet) | added | +| 7/13/2022 | [Onboard your organization's devices to Microsoft Defender for Business](/microsoft-365/business-premium/m365bp-onboard-devices-mdb?view=o365-21vianet) | modified | +| 7/13/2022 | [Decryption in eDiscovery](/microsoft-365/compliance/ediscovery-decryption?view=o365-21vianet) | modified | +| 7/13/2022 | [Compare security features in Microsoft 365 plans for small and medium-sized businesses](/microsoft-365/security/defender-business/compare-mdb-m365-plans?view=o365-21vianet) | modified | +| 7/13/2022 | [Get Microsoft Defender for Business](/microsoft-365/security/defender-business/get-defender-business?view=o365-21vianet) | modified | +| 7/13/2022 | [View and edit your security settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-configure-security-settings?view=o365-21vianet) | modified | +| 7/13/2022 | [Device groups in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-create-edit-device-groups?view=o365-21vianet) | modified | +| 7/13/2022 | [Microsoft Defender for Business frequently asked questions](/microsoft-365/security/defender-business/mdb-faq?view=o365-21vianet) | modified | +| 7/13/2022 | [Firewall in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-firewall?view=o365-21vianet) | modified | +| 7/13/2022 | [Visit the Microsoft 365 Defender portal](/microsoft-365/security/defender-business/mdb-get-started?view=o365-21vianet) | modified | +| 7/13/2022 | [Manage devices in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-manage-devices?view=o365-21vianet) | modified | +| 7/13/2022 | [Understand next-generation protection configuration settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-next-gen-configuration-settings?view=o365-21vianet) | modified | +| 7/13/2022 | [Onboard devices to Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-onboard-devices?view=o365-21vianet) | modified | +| 7/13/2022 | [What is Microsoft Defender for Business?](/microsoft-365/security/defender-business/mdb-overview?view=o365-21vianet) | modified | +| 7/13/2022 | [Microsoft Defender for Business and Microsoft partner resources](/microsoft-365/security/defender-business/mdb-partners?view=o365-21vianet) | modified | +| 7/13/2022 | [Reports in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-reports?view=o365-21vianet) | modified | +| 7/13/2022 | [Requirements for Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-requirements?view=o365-21vianet) | modified | +| 7/13/2022 | [Review remediation actions in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-review-remediation-actions?view=o365-21vianet) | modified | +| 7/13/2022 | [Assign roles and permissions in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-roles-permissions?view=o365-21vianet) | modified | +| 7/13/2022 | [Set up and configure Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-setup-configuration?view=o365-21vianet) | modified | +| 7/13/2022 | [The simplified configuration process in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-simplified-configuration?view=o365-21vianet) | modified | +| 7/13/2022 | [Microsoft Defender for Business troubleshooting](/microsoft-365/security/defender-business/mdb-troubleshooting?view=o365-21vianet) | modified | +| 7/13/2022 | [Tutorials and simulations in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-tutorials?view=o365-21vianet) | modified | +| 7/13/2022 | [Use setup wizard in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-use-wizard?view=o365-21vianet) | modified | +| 7/13/2022 | [View or edit policies in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-view-edit-create-policies?view=o365-21vianet) | modified | +| 7/13/2022 | [View and manage incidents in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-view-manage-incidents?view=o365-21vianet) | modified | +| 7/13/2022 | [Microsoft Defender for Business trial playbook](/microsoft-365/security/defender-business/trial-playbook-defender-business?view=o365-21vianet) | modified | +| 7/13/2022 | [Configure and manage Microsoft Threat Experts capabilities](/microsoft-365/security/defender-endpoint/configure-microsoft-threat-experts?view=o365-21vianet) | modified | +| 7/13/2022 | [Configure and manage Microsoft Threat Experts capabilities through Microsoft 365 Defender](/microsoft-365/security/defender/configure-microsoft-threat-experts?view=o365-21vianet) | modified | +| 7/13/2022 | [Configure global settings for Safe Links settings in Defender for Office 365](/microsoft-365/security/office-365-security/configure-global-settings-for-safe-links?view=o365-21vianet) | modified | +| 7/13/2022 | [Migrate to Microsoft Defender for Office 365 Phase 2: Setup](/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365-setup?view=o365-21vianet) | modified | +| 7/13/2022 | [Protect against threats in Microsoft Defender for Office 365, Anti-malware, Anti-Phishing, Anti-spam, Safe links, Safe attachments, Zero-hour auto purge (ZAP), MDO security configuration](/microsoft-365/security/office-365-security/protect-against-threats?view=o365-21vianet) | modified | +| 7/13/2022 | [Complete Safe Links overview for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/safe-links?view=o365-21vianet) | modified | +| 7/13/2022 | [Set up Safe Links policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/set-up-safe-links-policies?view=o365-21vianet) | modified | +| 7/13/2022 | [Learn about communication compliance](/microsoft-365/compliance/communication-compliance?view=o365-21vianet) | modified | +| 7/13/2022 | Secure Windows 10 computers | removed | +| 7/13/2022 | [Paying for your subscription](/microsoft-365/commerce/billing-and-payments/pay-for-your-subscription?view=o365-21vianet) | modified | +| 7/13/2022 | Microsoft 365 Security for Business Decision Makers (BDMs) | removed | +| 7/13/2022 | [Understand and use attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction?view=o365-21vianet) | modified | +| 7/13/2022 | [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-21vianet) | modified | +| 7/14/2022 | [Microsoft Defender for Business frequently asked questions](/microsoft-365/security/defender-business/mdb-faq?view=o365-21vianet) | modified | +| 7/14/2022 | [Compare Microsoft Defender for Endpoint plans](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2?view=o365-21vianet) | modified | +| 7/14/2022 | [Enable the Report Message or the Report Phishing add-ins](/microsoft-365/security/office-365-security/enable-the-report-message-add-in?view=o365-21vianet) | modified | +| 7/14/2022 | [Assess the impact of security configuration changes with Explorer](/microsoft-365/security/office-365-security/step-by-step-guides/assess-the-impact-of-security-configuration-changes-with-explorer?view=o365-21vianet) | added | +| 7/14/2022 | [Deploy and configure the report message add-in](/microsoft-365/security/office-365-security/step-by-step-guides/deploy-and-configure-the-report-message-add-in?view=o365-21vianet) | added | +| 7/14/2022 | [What's new in Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-whatsnew?view=o365-21vianet) | modified | +| 7/14/2022 | [How to enable DMARC Reporting for Microsoft Online Email Routing Address (MOERA) and parked Domains](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-enable-dmarc-reporting-for-microsoft-online-email-routing-address-moera-and-parked-domains?view=o365-21vianet) | renamed | +| 7/15/2022 | [Enable pay-as-you-go for your subscription in the Microsoft 365 admin center](/microsoft-365/commerce/subscriptions/manage-pay-as-you-go-services?view=o365-21vianet) | added | +| 7/15/2022 | [Block user sign-in in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-block-user-signin?view=o365-21vianet) | modified | +| 7/15/2022 | [Manage self-service password reset in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-manage-sspr?view=o365-21vianet) | modified | +| 7/15/2022 | [Mitigate threats in Microsoft 365 Lighthouse with Microsoft Defender Antivirus](/microsoft-365/lighthouse/m365-lighthouse-mitigate-threats?view=o365-21vianet) | modified | +| 7/15/2022 | [Reset a user password in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-reset-user-password?view=o365-21vianet) | modified | +| 7/15/2022 | [View and manage risky users in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-view-manage-risky-users?view=o365-21vianet) | modified | +| 7/15/2022 | [Set up and configure the Moodle plugin](/microsoft-365/lti/moodle-plugin-configuration?view=o365-21vianet) | modified | +| 7/15/2022 | [Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](/microsoft-365/security/defender-endpoint/android-intune?view=o365-21vianet) | modified | +| 7/15/2022 | [Investigate data loss incidents with Microsoft 365 Defender](/microsoft-365/security/defender/investigate-dlp?view=o365-21vianet) | modified | +| 7/15/2022 | [Virtual appointments with Microsoft Teams and the Bookings app](/microsoft-365/frontline/bookings-virtual-visits?view=o365-21vianet) | added | +| 7/15/2022 | [Manage the join experience for Teams virtual appointments on browsers](/microsoft-365/frontline/browser-join?view=o365-21vianet) | added | +| 7/15/2022 | [Deploy teams at scale for frontline workers in Microsoft Teams](/microsoft-365/frontline/deploy-teams-at-scale?view=o365-21vianet) | added | +| 7/15/2022 | [Virtual appointments with Teams - Integration into Cerner EHR](/microsoft-365/frontline/ehr-admin-cerner?view=o365-21vianet) | added | +| 7/15/2022 | [Virtual appointments with Teams - Integration into Epic EHR](/microsoft-365/frontline/ehr-admin-epic?view=o365-21vianet) | added | +| 7/15/2022 | [Microsoft Teams EHR connector Virtual Appointments report](/microsoft-365/frontline/ehr-connector-report?view=o365-21vianet) | added | +| 7/15/2022 | [Choose your scenarios for Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-choose-scenarios?view=o365-21vianet) | added | +| 7/15/2022 | [Corporate communications with frontline workers](/microsoft-365/frontline/flw-corp-comms?view=o365-21vianet) | added | +| 7/15/2022 | [Learn where to start with a frontline deployment](/microsoft-365/frontline/flw-deploy-overview?view=o365-21vianet) | added | +| 7/15/2022 | [Manage mobile devices for frontline workers](/microsoft-365/frontline/flw-devices?view=o365-21vianet) | added | +| 7/15/2022 | [Understand frontline worker user types and licensing](/microsoft-365/frontline/flw-licensing-options?view=o365-21vianet) | added | +| 7/15/2022 | [Provide initial and ongoing training to help onboard your frontline workers](/microsoft-365/frontline/flw-onboarding-training?view=o365-21vianet) | added | +| 7/15/2022 | [Use the Frontline Worker onboarding wizard to get your frontline workforce up and running](/microsoft-365/frontline/flw-onboarding-wizard?view=o365-21vianet) | added | +| 7/15/2022 | [Get started with Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-overview?view=o365-21vianet) | added | +| 7/15/2022 | [Start with a pilot deployment of Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-pilot?view=o365-21vianet) | added | +| 7/15/2022 | [Set up Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-setup-microsoft-365?view=o365-21vianet) | added | +| 7/15/2022 | [Frontline team collaboration](/microsoft-365/frontline/flw-team-collaboration?view=o365-21vianet) | added | +| 7/15/2022 | [Manage the Frontline Trial in Teams](/microsoft-365/frontline/flw-trial?view=o365-21vianet) | added | +| 7/15/2022 | [Engage your frontline employees and focus on wellbeing](/microsoft-365/frontline/flw-wellbeing-engagement?view=o365-21vianet) | added | +| 7/15/2022 | [Managers - Get your team started with Microsoft 365 for frontline workers](/microsoft-365/frontline/get-up-and-running?view=o365-21vianet) | added | +| 7/15/2022 | [Message delegation](/microsoft-365/frontline/hc-delegates?view=o365-21vianet) | added | +| 7/15/2022 | [Manage shift-based access for frontline workers in Teams](/microsoft-365/frontline/manage-shift-based-access-flw?view=o365-21vianet) | added | +| 7/15/2022 | [Secure Messaging for healthcare organizations using Microsoft Teams](/microsoft-365/frontline/messaging-policies-hc?view=o365-21vianet) | added | +| 7/15/2022 | [Tailor Teams apps for your frontline workers](/microsoft-365/frontline/pin-teams-apps-based-on-license?view=o365-21vianet) | added | +| 7/15/2022 | [Manage schedule owners for shift management](/microsoft-365/frontline/schedule-owner-for-shift-management?view=o365-21vianet) | added | +| 7/15/2022 | [Use PowerShell to connect Shifts to Blue Yonder Workforce Management](/microsoft-365/frontline/shifts-connector-blue-yonder-powershell-setup?view=o365-21vianet) | added | +| 7/15/2022 | [Use PowerShell to manage your Shifts connection to Blue Yonder Workforce Management](/microsoft-365/frontline/shifts-connector-powershell-manage?view=o365-21vianet) | added | +| 7/15/2022 | [Use the Shifts connector wizard to connect Shifts to Blue Yonder Workforce Management](/microsoft-365/frontline/shifts-connector-wizard?view=o365-21vianet) | added | +| 7/15/2022 | [Shifts connectors](/microsoft-365/frontline/shifts-connectors?view=o365-21vianet) | added | +| 7/15/2022 | [Shifts for frontline workers](/microsoft-365/frontline/shifts-for-teams-landing-page?view=o365-21vianet) | added | +| 7/15/2022 | [Simplify business processes for frontline teams](/microsoft-365/frontline/simplify-business-processes?view=o365-21vianet) | added | +| 7/15/2022 | [Changing from a Microsoft 365 E plan to a Microsoft F plan](/microsoft-365/frontline/switch-from-enterprise-to-frontline?view=o365-21vianet) | added | +| 7/15/2022 | [Microsoft 365 for Financial Services](/microsoft-365/frontline/teams-for-financial-services?view=o365-21vianet) | added | +| 7/15/2022 | [Microsoft 365 for Manufacturing](/microsoft-365/frontline/teams-for-manufacturing?view=o365-21vianet) | added | +| 7/15/2022 | [Microsoft 365 for Retail](/microsoft-365/frontline/teams-for-retail-landing-page?view=o365-21vianet) | added | +| 7/15/2022 | [Get started with Microsoft 365 for healthcare organizations](/microsoft-365/frontline/teams-in-hc?view=o365-21vianet) | added | +| 7/15/2022 | [Help your clients and customers use virtual appointments](/microsoft-365/frontline/virtual-appointments-toolkit?view=o365-21vianet) | added | +| 7/15/2022 | [Virtual appointments with Microsoft Teams](/microsoft-365/frontline/virtual-appointments?view=o365-21vianet) | added | +| 7/15/2022 | [Microsoft Teams Virtual Visits usage report](/microsoft-365/frontline/virtual-visits-usage-report?view=o365-21vianet) | added | +| 7/15/2022 | [Set up and configure the Moodle LMS plugins](/microsoft-365/lti/moodle-plugin-configuration?view=o365-21vianet) | modified | +| 7/15/2022 | [Onboard non-persistent virtual desktop infrastructure (VDI) devices](/microsoft-365/security/defender-endpoint/configure-endpoints-vdi?view=o365-21vianet) | modified | +| 7/15/2022 | [Onboard devices without Internet access to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboard-offline-machines?view=o365-21vianet) | modified | ++ ## Week of July 04, 2022 | 6/17/2022 | Manage your allows in the Tenant Allow/Block List | removed | | 6/17/2022 | Manage your blocks in the Tenant Allow/Block List | removed | | 6/17/2022 | Modify and remove entries in the Tenant Allow/Block List | removed |---## Week of June 06, 2022 ---| Published On |Topic title | Change | -|||--| -| 6/6/2022 | [Add a domain to Microsoft 365](/microsoft-365/admin/setup/add-domain?view=o365-21vianet) | modified | -| 6/6/2022 | [Configure Microsoft Defender for Endpoint on Android features](/microsoft-365/security/defender-endpoint/android-configure?view=o365-21vianet) | modified | -| 6/6/2022 | [Uploading a pre-built zip package](/microsoft-365/test-base/uploadapplication?view=o365-21vianet) | added | -| 6/6/2022 | [Understand your usage cost](/microsoft-365/test-base/usagecost?view=o365-21vianet) | added | -| 6/6/2022 | [Compare different device and app data protection methods](/microsoft-365/admin/devices/choose-device-security?view=o365-21vianet) | modified | -| 6/6/2022 | Upload your package | removed | -| 6/6/2022 | [Manage and monitor priority accounts](/microsoft-365/admin/setup/priority-accounts?view=o365-21vianet) | added | -| 6/6/2022 | [Upgrade distribution lists to Microsoft 365 Groups in Exchange Online](/microsoft-365/admin/manage/upgrade-distribution-lists?view=o365-21vianet) | modified | -| 6/6/2022 | [Insider risk management policies](/microsoft-365/compliance/insider-risk-management-policies?view=o365-21vianet) | modified | -| 6/6/2022 | [Learn about insider risk management](/microsoft-365/compliance/insider-risk-management?view=o365-21vianet) | modified | -| 6/6/2022 | [Microsoft cloud architecture models - enterprise resource planning](/microsoft-365/solutions/cloud-architecture-models?view=o365-21vianet) | modified | -| 6/6/2022 | [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-21vianet) | modified | -| 6/6/2022 | [Use network protection to help prevent connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection?view=o365-21vianet) | modified | -| 6/7/2022 | [Take response actions on a device in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/respond-machine-alerts?view=o365-21vianet) | modified | -| 6/7/2022 | [Quick tasks for getting started with compliance in Microsoft Purview](/microsoft-365/compliance/compliance-quick-tasks?view=o365-21vianet) | modified | -| 6/7/2022 | [Use PowerShell to perform a staged migration to Microsoft 365](/microsoft-365/enterprise/use-powershell-to-perform-a-staged-migration-to-microsoft-365?view=o365-21vianet) | modified | -| 6/7/2022 | [What's new in Microsoft Purview](/microsoft-365/compliance/whats-new?view=o365-21vianet) | modified | -| 6/7/2022 | [Create a Microsoft 365 Group with a specific preferred data location](/microsoft-365/enterprise/multi-geo-add-group-with-pdl?view=o365-21vianet) | modified | -| 6/7/2022 | [SharePoint Server 2007 end of support roadmap](/microsoft-365/enterprise/sharepoint-2007-end-of-support?view=o365-21vianet) | modified | -| 6/7/2022 | [View email security reports](/microsoft-365/security/office-365-security/view-email-security-reports?view=o365-21vianet) | modified | -| 6/8/2022 | [Microsoft Defender for Office 365 step-by-step guides and how to use them](/microsoft-365/security/office-365-security/step-by-step-guides/step-by-step-guide-overview?view=o365-21vianet) | added | -| 6/8/2022 | [Assign eDiscovery permissions in the Microsoft Purview compliance portal](/microsoft-365/compliance/assign-ediscovery-permissions?view=o365-21vianet) | modified | -| 6/8/2022 | [Manage audit log retention policies](/microsoft-365/compliance/audit-log-retention-policies?view=o365-21vianet) | modified | -| 6/8/2022 | [Change the hold duration for an inactive mailbox](/microsoft-365/compliance/change-the-hold-duration-for-an-inactive-mailbox?view=o365-21vianet) | modified | -| 6/8/2022 | [Clone a Content Search](/microsoft-365/compliance/clone-a-content-search?view=o365-21vianet) | modified | -| 6/8/2022 | [Create and publish sensitivity labels](/microsoft-365/compliance/create-sensitivity-labels?view=o365-21vianet) | modified | -| 6/8/2022 | [Delete items in the Recoverable Items folder](/microsoft-365/compliance/delete-items-in-the-recoverable-items-folder-of-mailboxes-on-hold?view=o365-21vianet) | modified | -| 6/8/2022 | [Create a DLP policy to protect documents](/microsoft-365/compliance/protect-documents-that-have-fci-or-other-properties?view=o365-21vianet) | modified | -| 6/8/2022 | [Modify a custom sensitive information type using PowerShell](/microsoft-365/compliance/sit-modify-a-custom-sensitive-information-type-in-powershell?view=o365-21vianet) | modified | -| 6/8/2022 | [Use a script to add users to a hold in a eDiscovery (Standard) case](/microsoft-365/compliance/use-a-script-to-add-users-to-a-hold-in-ediscovery?view=o365-21vianet) | modified | -| 6/8/2022 | [View the reports for data loss prevention](/microsoft-365/compliance/view-the-dlp-reports?view=o365-21vianet) | modified | -| 6/8/2022 | [Connect to all Microsoft 365 services in a single PowerShell window](/microsoft-365/enterprise/connect-to-all-microsoft-365-services-in-a-single-windows-powershell-window?view=o365-21vianet) | modified | -| 6/8/2022 | [View an enterprise Cloud PC failed network connection in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-view-failed-network-connections?view=o365-21vianet) | modified | -| 6/8/2022 | [Configure the delivery of third-party phishing simulations to users and unfiltered messages to SecOps mailboxes](/microsoft-365/security/office-365-security/configure-advanced-delivery?view=o365-21vianet) | modified | -| 6/8/2022 | [Creating a Test Base Account](/microsoft-365/test-base/createaccount?view=o365-21vianet) | modified | -| 6/8/2022 | [Microsoft 365 admin center activity reports](/microsoft-365/admin/activity-reports/activity-reports?view=o365-21vianet) | modified | -| 6/8/2022 | [Microsoft 365 admin center groups reports](/microsoft-365/admin/activity-reports/office-365-groups-ww?view=o365-21vianet) | modified | -| 6/8/2022 | [Add your brand to encrypted messages](/microsoft-365/compliance/add-your-organization-brand-to-encrypted-messages?view=o365-21vianet) | modified | -| 6/8/2022 | [Microsoft 365 alert policies](/microsoft-365/compliance/alert-policies?view=o365-21vianet) | modified | -| 6/8/2022 | [Microsoft Compliance Configuration Analyzer for Compliance Manager](/microsoft-365/compliance/compliance-manager-mcca?view=o365-21vianet) | modified | -| 6/8/2022 | [Manage Customer Key](/microsoft-365/compliance/customer-key-manage?view=o365-21vianet) | modified | -| 6/8/2022 | [Legacy information for Office 365 Message Encryption](/microsoft-365/compliance/legacy-information-for-message-encryption?view=o365-21vianet) | modified | -| 6/8/2022 | [Manage Office 365 Message Encryption](/microsoft-365/compliance/manage-office-365-message-encryption?view=o365-21vianet) | modified | -| 6/8/2022 | [Migrate legacy eDiscovery searches and holds to the Microsoft Purview compliance portal](/microsoft-365/compliance/migrate-legacy-ediscovery-searches-and-holds?view=o365-21vianet) | modified | -| 6/8/2022 | [Use Content Search for a list of users on the mailbox & OneDrive for Business site](/microsoft-365/compliance/search-the-mailbox-and-onedrive-for-business-for-a-list-of-users?view=o365-21vianet) | modified | -| 6/8/2022 | [Set up Azure Rights Management for the previous version of Message Encryption](/microsoft-365/compliance/set-up-azure-rms-for-previous-version-message-encryption?view=o365-21vianet) | modified | -| 6/8/2022 | [Work with a partner to archive third-party data](/microsoft-365/compliance/work-with-partner-to-archive-third-party-data?view=o365-21vianet) | modified | -| 6/8/2022 | [Privileged access management for your Microsoft 365 for enterprise test environment](/microsoft-365/enterprise/privileged-access-microsoft-365-enterprise-dev-test-environment?view=o365-21vianet) | modified | -| 6/8/2022 | [Removing or disabling Hybrid Modern Authentication from Skype for Business and Exchange](/microsoft-365/enterprise/remove-or-disable-hybrid-modern-authentication-from-skype-for-business-and-excha?view=o365-21vianet) | modified | -| 6/8/2022 | [Microsoft 365 Lighthouse frequently asked questions (FAQs)](/microsoft-365/lighthouse/m365-lighthouse-faq?view=o365-21vianet) | modified | -| 6/8/2022 | [Microsoft 365 Security for Business Decision Makers (BDMs)](/microsoft-365/security/microsoft-365-security-for-bdm?view=o365-21vianet) | modified | -| 6/8/2022 | [Microsoft Defender for Endpoint Device Control Removable Storage Access Control, removable storage media](/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control?view=o365-21vianet) | modified | -| 6/8/2022 | [Take response actions on a device in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/respond-machine-alerts?view=o365-21vianet) | modified | -| 6/8/2022 | [Performance analyzer for Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/tune-performance-defender-antivirus?view=o365-21vianet) | modified | -| 6/8/2022 | [Best practices for unauthenticated sharing](/microsoft-365/solutions/best-practices-anonymous-sharing?view=o365-21vianet) | modified | -| 6/8/2022 | [Microsoft 365 enterprise resource planning - Security architecture](/microsoft-365/solutions/identity-design-principles?view=o365-21vianet) | modified | -| 6/9/2022 | [Attack surface reduction rules reference](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-21vianet) | modified | -| 6/9/2022 | [Troubleshoot issues and find answers on FAQs related to Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-troubleshoot?view=o365-21vianet) | modified | -| 6/9/2022 | [Creating a Test Base Account](/microsoft-365/test-base/createaccount?view=o365-21vianet) | modified | -| 6/9/2022 | [Stay informed of upcoming changes to Microsoft Defender for Office 365 using the message center](/microsoft-365/security/office-365-security/step-by-step-guides/stay-informed-with-message-center?view=o365-21vianet) | added | -| 6/9/2022 | [Domains Frequently Asked Questions](/microsoft-365/admin/setup/domains-faq?view=o365-21vianet) | modified | -| 6/9/2022 | [Microsoft Defender for Endpoint on Android](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-android?view=o365-21vianet) | modified | -| 6/9/2022 | [Onboard Windows multi-session devices in Azure Virtual Desktop](/microsoft-365/security/defender-endpoint/onboard-windows-multi-session-device?view=o365-21vianet) | modified | -| 6/9/2022 | [Top 20 most-viewed admin help articles this month # < 60 chars](/microsoft-365/admin/top-m365-admin-articles?view=o365-21vianet) | modified | -| 6/9/2022 | [Manage sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-21vianet) | modified | -| 6/10/2022 | [Share calendars with external users](/microsoft-365/admin/manage/share-calendars-with-external-users?view=o365-21vianet) | modified | -| 6/10/2022 | [Understand subscriptions and licenses in Microsoft 365 for business](/microsoft-365/commerce/licenses/subscriptions-and-licenses?view=o365-21vianet) | modified | -| 6/10/2022 | [Set up Microsoft Purview Message Encryption](/microsoft-365/compliance/set-up-new-message-encryption-capabilities?view=o365-21vianet) | modified | -| 6/10/2022 | [Troubleshooting mode scenarios in Microsoft Defender for Endpoint (preview)](/microsoft-365/security/defender-endpoint/troubleshooting-mode-scenarios?view=o365-21vianet) | modified | -| 6/10/2022 | [(False Negatives) How to handle malicious emails that are delivered to recipients using Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-negatives-in-microsoft-defender-for-office-365?view=o365-21vianet) | modified | -| 6/10/2022 | [(False Positives) How to handle legitimate emails getting blocked from delivery using Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-positives-in-microsoft-defender-for-office-365?view=o365-21vianet) | modified | -| 6/10/2022 | [Set up and configure the Moodle plugin for Open LMS](/microsoft-365/lti/open-lms-plugin-configuration?view=o365-21vianet) | added | -| 6/10/2022 | [Integrate Microsoft Teams classes and meetings with Open LMS](/microsoft-365/lti/open-lms-teams-classes-and-meetings?view=o365-21vianet) | added | -| 6/10/2022 | [Microsoft 365 network connectivity test tool](/microsoft-365/enterprise/office-365-network-mac-perf-onboarding-tool?view=o365-21vianet) | modified | -| 6/10/2022 | [Network connectivity in the Microsoft 365 Admin Center](/microsoft-365/enterprise/office-365-network-mac-perf-overview?view=o365-21vianet) | modified | -| 6/10/2022 | [Set preferences for Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/linux-preferences?view=o365-21vianet) | modified | -| 6/10/2022 | [Troubleshoot onboarding issues related to Security Management for Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/troubleshoot-security-config-mgt?view=o365-21vianet) | modified | -| 6/10/2022 | [Preset security policies](/microsoft-365/security/office-365-security/preset-security-policies?view=o365-21vianet) | modified | -| 6/10/2022 | [What is Microsoft 365 for business](/microsoft-365/admin/admin-overview/what-is-microsoft-365-for-business?view=o365-21vianet) | modified | -| 6/10/2022 | [Create and publish retention labels by using PowerShell](/microsoft-365/compliance/bulk-create-publish-labels-using-powershell?view=o365-21vianet) | modified | -| 6/10/2022 | [Manage jobs in eDiscovery (Premium)](/microsoft-365/compliance/managing-jobs-ediscovery20?view=o365-21vianet) | modified | -| 6/10/2022 | [Microsoft Defender for Endpoint Device Control Removable Storage Access Control, removable storage media](/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control?view=o365-21vianet) | modified | |
| security | TOC | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/TOC.md | ## [Overview]() ### [What is Microsoft Defender for Endpoint?](microsoft-defender-endpoint.md) ### [Trial playbook: Get the most out of your trial](defender-endpoint-trial-playbook.md) -### [Compare Defender for Endpoint plans](defender-endpoint-plan-1-2.md) +### [Compare Microsoft endpoint security plans](defender-endpoint-plan-1-2.md) ### [Minimum requirements](minimum-requirements.md) ### [What's new in Microsoft Defender for Endpoint?](whats-new-in-microsoft-defender-endpoint.md) ### [Preview features](preview.md) |
| security | Defender Endpoint Plan 1 2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2.md | Title: Compare Microsoft Defender for Endpoint plans -description: Compare Defender for Endpoint Plan 1 to Plan 2. Learn about the differences between the plans and select the plan that suits your organization's needs. -keywords: Defender for Endpoint, advanced threat protection, endpoint protection + Title: Compare Microsoft endpoint security plans +description: Compare Microsoft endpoint security plans, such as Defender for Endpoint Plan 1 to Defender for Endpoint Plan 2. Learn about the differences between the plans and select the plan that suits your organization's needs. +keywords: Defender for Endpoint, advanced threat protection, endpoint protection, endpoint security, device security, cybersecurity search.appverid: MET150 The following table summarizes what's included in Microsoft endpoint security pl The standalone versions of Defender for Business, Defender for Endpoint Plan 1 and 2, and Microsoft 365 Business Premium do not include server licenses. To onboard servers, choose from the following options: -- **Defender for Servers Plan 1 or Plan 2** as part of the [Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction) offering. To learn more. see [Overview of Microsoft Defender for Servers](/azure/defender-for-cloud/defender-for-servers-introduction).-+- **Microsoft Defender for Servers Plan 1 or Plan 2** as part of the [Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction) offering. To learn more. see [Overview of Microsoft Defender for Servers](/azure/defender-for-cloud/defender-for-servers-introduction). - **Microsoft Defender for Business servers (preview)** for small and medium-sized businesses. See [How to get Microsoft Defender for Business servers (preview)](../defender-business/get-defender-business-servers.md). ## Mixed licensing scenarios However, **you can contact support and request an override for your tenant exper ## See also - [Get started with Microsoft Security (trial offers)](https://www.microsoft.com/security/business/get-started/start-free-trial)-+- [Microsoft Defender for Endpoint](microsoft-defender-endpoint.md) - [Microsoft Defender for Business](../defender-business/mdb-overview.md) (endpoint protection for small and medium-sized businesses) |
| security | Microsoft Threat Experts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-threat-experts.md | See [Configure Microsoft Threat Experts capabilities](/microsoft-365/security/de ## Endpoint attack notification -Endpoint attack notification provides proactive hunting for the most important threats to your network, including human adversary intrusions, hands-on-keyboard attacks, or advanced attacks like cyber-espionage. These notifications show up as a new alert. The managed hunting service includes: +Endpoint Attack Notifications (previously referred to as Microsoft Threat Experts - Targeted Attack Notification) provides proactive hunting for the most important threats to your network, including human adversary intrusions, hands-on-keyboard attacks, or advanced attacks like cyber-espionage. These notifications show up as a new alert. The managed hunting service includes: - Threat monitoring and analysis, reducing dwell time and risk to the business - Hunter-trained artificial intelligence to discover and prioritize both known and unknown attacks |
| security | Configure Microsoft Threat Experts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/configure-microsoft-threat-experts.md | If you already have Microsoft Defender for Endpoint and Microsoft 365 Defender, 2. Select **Apply**. - :::image type="content" source="../../media/mte/mte-collaboratewithmte.png" alt-text=" The Microsoft Threat Experts settings page in the Microsoft 365 Defender portal" lightbox="../../media/mte/mte-collaboratewithmte.png"::: - 3. Enter your email address so that Microsoft can contact you about your application. :::image type="content" source="../../media/mte/mte-apply.png" alt-text="The Microsoft Threat Experts application page in the Microsoft 365 Defender portal" lightbox="../../media/mte/mte-apply.png"::: If you're already a Microsoft Defender for Endpoint customer, you can contact yo ## Consult a Microsoft threat expert about suspicious cybersecurity activities in your organization -You can contact Microsoft Threat Experts from inside the Microsoft 365 Defender portal. Experts can help you understand complex threats and targeted attack notifications. Partner with experts for further details about alerts and incidents, or advice on handling compromise. Gain insight into the threat intelligence context described by your portal dashboard. +You can contact Microsoft Threat Experts from inside the Microsoft 365 Defender portal. Experts can help you understand complex threats and Endpoint Attack Notifications. Partner with experts for further details about alerts and incidents, or advice on handling compromise. Gain insight into the threat intelligence context described by your portal dashboard. > [!NOTE] > |
| security | Defender Experts Report | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/defender-experts-report.md | + + Title: Understand the Defender Experts for Hunting report in Microsoft 365 Defender ++description: The Defender Experts for Hunting service publishes monthly reports to help you understand all the threats the hunting service surfaced in your environment +keywords: analyst report, defender experts report, detections, defender expert notification, hunting, notifications, threat categories, hunting reports +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++audience: ITPro ++- M365-security-compliance +++++# Understand the Defender Experts for Hunting report in Microsoft 365 Defender +++**Applies to:** ++- Microsoft 365 Defender +++Microsoft Defender Experts for Hunting layers human intelligence and expert-trained technology to help Microsoft 365 Defender customers understand the significant threats they face. It showcases how Defender ExpertΓÇÖs threat hunting skills, thorough understanding of the threat landscape, and knowledge of emerging threats can help you identify, prioritize, and address those threats in your environment. ++The Defender Experts for Hunting service publishes monthly reports to help you understand all the threats the hunting service surfaced in your environment, alongside the alerts generated by your Microsoft 365 Defender products. ++To view the latest report in your Microsoft 365 Defender portal, go to **Reports**, select **Defender Experts** > **Defender Experts for Hunting report**. ++## Scan the Defender Experts for Hunting report to know what to prioritize ++Each section of the report is designed to provide more insights about the threats our Defender Experts found in your environment. The reports include the sections described in the following table: ++| Report section | Description | +|--|--| +| Hunted and triaged | The total number of potential cybersecurity issues found in your environment. | +| Investigated | The number of cybersecurity issues that need further analysis to determine their nature and extent. | +| Notified (View notification) | The number of Defender Experts Notifications the Defender Experts sent. These notifications are related to the investigated possible threat activities in your environment that must be prioritized based on urgency and impact. | +| MITRE ATT&CK tactics observed | The number of attack tactics and techniques observed in your environment and mapped according to the [MITRE ATT&CK framework](https://attack.mitre.org/). This section visualizes how many attacks reached each tactic so you can take appropriate actions like reviewing those that progressed further first. | +| Threat categories observed | The categories depict the most significant threats and risks observed in your environment. The most critical categories are highlighted to help you further assess and evaluate your security posture based on the threats' known characteristics, behavior, and potential impact. It also enables you to focus and prioritize urgent tasks to address. | ++Refer to the following screenshot of a sample report: ++ ++## View Defender Experts Notifications ++A Defender Experts Notification describes the significant threat activity Defender Experts for Hunting observed in your environment and provides recommendations to remediate and defend your organization. ++The Defender Experts for Hunting reports provide you with the total number of Defender Experts Notifications our Defender Experts have sent for your chosen time. To view these notifications, click **View notification** beside **Notified**. ++This link redirects you to the Microsoft 365 Defender incidents page. Defender Expert for Hunting alerts or Defender Experts Notifications are labeled with **Defender Experts**. ++> [!NOTE] +> The **View notification** link only appears if the value displayed in **Notified** is at least 1. ++## Identify potential attack entry points and other security weak spots ++The MITRE ATT&CK tactics represent adversary goalsΓÇöwhat theyΓÇÖre trying to achieve in each attack phase. The **MITRE ATT&CK tactics observed** section of the report tracks the progression of attack against the phase they reached: ++1. Reconnaissance +2. Resource Development +3. Initial access +4. Execution +3. Persistence +4. Privilege escalation +5. Defense evasion +6. Credential access +7. Discovery +8. Lateral movement +9. Collection +10. Command and control +11. Exfiltration +12. Impact ++Signals from Microsoft 365 Defender and investigations by Defender Experts for Hunting help identify these tactics, represented in the bar chart. This chart helps you visualize where the surge is and provides you with the information you need to plan the corresponding containment and remediation actions. ++## Know and understand the prevalent threats in your environment ++Threat categories help identify and organize security threats into classes to assess and evaluate their impact and develop strategies to prevent or mitigate these threats to your environment. The **Threat categories observed** section of the report shows a bar chart with significant risks and threats detected in your environment, helping you understand the breadth and scope of your exposure. ++Among the various threat categories available, the following categories are carefully chosen because they are not covered under the purview of MITRE ATT&CK framework: ++- Ransomware +- Malware +- Weaponization +- Exploit +- Delivery ++You can prioritize remediation based on the most impacted category, as depicted in the bar graph. |
| security | Microsoft Secure Score Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-secure-score-whats-new.md | To make Microsoft Secure Score a better representative of your security posture, The more improvement actions you take, the higher your Secure Score will be. For more information, see [Microsoft Secure Score](microsoft-secure-score.md). -Microsoft Secure Score can be found at https://security.microsoft.com/securescore in the [Microsoft 365 Defender portal](microsoft-365-defender-portal.md). +Microsoft Secure Score can be found at <https://security.microsoft.com/securescore> in the [Microsoft 365 Defender portal](microsoft-365-defender-portal.md). ## June 2022 Microsoft Secure Score can be found at https://security.microsoft.com/securescor - Set folder access-based enumeration for shares - Update Microsoft Defender for Endpoint core components -- A new Microsoft Defender for Identity recommendation is available as a Secure Score improvement action:+- A new Microsoft Defender for Identity recommendation is available as a Secure Score improvement action: - Resolve unsecure domain configurations -- A new [app governance](/defender-cloud-apps/app-governance-manage-app-governance) recommendation is now available as a Secure Score improvement action:+- A new [app governance](/defender-cloud-apps/app-governance-manage-app-governance) recommendation is now available as a Secure Score improvement action: - Regulate apps with consent from priority accounts - New Salesforce and ServiceNow recommendations are now available as Secure Score improvement actions for Microsoft Defender for Cloud Apps customers. For more information, see [SaaS Security Posture Management overview](https://aka.ms/saas_security_posture_management). ->[!Note] ->Salesforce and ServiceNow controls are now available in public preview. +> [!NOTE] +> Salesforce and ServiceNow controls are now available in public preview. ## April 2022 |
| security | Microsoft Threat Experts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-threat-experts.md | Microsoft Threat Experts ΓÇô Experts on Demand lets you get expert advice about If you already have Microsoft Defender for Endpoint and Microsoft 365 Defender, you can apply for Endpoint Attack Notifications through their Microsoft 365 Defender portal. Go to **Settings > Endpoints > General > Advanced features > Endpoint Attack Notifications**, and select **Apply**. See [Configure Microsoft Threat Experts capabilities](./configure-microsoft-threat-experts.md) for a full description. - Once your application is approved, you'll start receiving endpoint attack notifications whenever Threat Experts detect a threat to your environment. ## Subscribe to Microsoft Threat Experts - Experts on Demand You can also contact Microsoft threat experts from directly inside the Microsoft The option to **Consult a threat expert** is available in several places throughout the portal: - <i>**Device page actions menu**</i><BR>-- - <i>**Device inventory page flyout menu**</i><BR>-- - <i>**Alerts page flyout menu**</i><BR>-- - <i>**Incidents page actions menu**</i><BR>-- - <i>**Incidents inventory page**</i><BR> - > [!NOTE] > If you have Premier Support subscription mapped to your Microsoft Defender for Office 365 license, you can track the status of your Experts on Demand cases through Microsoft Services Hub. |
| security | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/whats-new.md | For more information on what's new with other Microsoft Defender security produc You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter). +## July 2022 +- (Preview) Microsoft Defender Experts for Hunting public preview participants can now look forward to receiving monthly reports to help them understand the threats the hunting service surfaced in their environment, along with the alerts generated by their Microsoft 365 Defender products. For details, refer to [Understand the Defender Experts for Hunting report in Microsoft 365 Defender](defender-experts-report.md). + ## June 2022 - (Preview) The [DeviceTvmInfoGathering](advanced-hunting-devicetvminfogathering-table.md) and [DeviceTvmInfoGatheringKB](advanced-hunting-devicetvminfogatheringkb-table.md) tables are now available in the advanced hunting schema. Use these tables to hunt through assessment events in Defender Vulnerability Management including the status of various configurations and attack surface area states of devices. |
| whiteboard | Configure Privacy Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/configure-privacy-settings.md | -> This article is currently in development. +> If your users want to learn more about default privacy settings and how diagnostic data is collected, direct them to [Microsoft Whiteboard privacy and compliance](https://support.microsoft.com/office/privacy-and-compliance-ed9f0de9-71be-44c2-837d-e0f448660be1). +If you are the Microsoft Whiteboard administrator for your organization, you can control the following: ++- What level of diagnostic data is collected and sent to Microsoft about the Whiteboard client software running on the userΓÇÖs device. ++- Whether optional connected experiences in Whiteboard are available to your users. ++To configure the level of diagnostic data, sign in to the [Microsoft 365 admin center](https://docs.microsoft.com/microsoft-365/admin/admin-overview/admin-center-overview?view=o365-worldwide) with your administrator account. From the admin center home page, go to **Show all > Settings > Org settings > Whiteboard**. ++To configure the availability of optional connected experiences, use the [Office cloud policy service](https://docs.microsoft.com/deployoffice/admincenter/overview-office-cloud-policy-service) in the [Microsoft 365 Apps admin center](https://config.office.com). Sign in with your administrator account and go to **Customization > Policy Management**. The policy you want to configure is named: **Allow the use of additional optional connected experiences in Office**. ++## Diagnostic data setting for your organization ++You can choose the level of [diagnostic data](https://support.microsoft.com/office/privacy-and-compliance-ed9f0de9-71be-44c2-837d-e0f448660be1#diagnostic_data)that is collected and sent to Microsoft about the Whiteboard client software running on devices in your organization. Optional diagnostic data will be sent to Microsoft, unless you change the setting in the Microsoft 365 admin center. If you choose to send optional diagnostic data, required diagnostic data is also included. ++In addition to **Required** or **Optional**, there is also a choice of **Neither**. If you choose that option, no diagnostic data about Whiteboard client software running on the userΓÇÖs device is sent to Microsoft. This option, however, significantly limits MicrosoftΓÇÖs ability to detect, diagnose, and remediate problems that your users may encounter while using Whiteboard. ++Your users wonΓÇÖt be able to change the diagnostic data level for their devices if they are signed in to Whiteboard with their organizational credentials (sometimes referred to as a work or school account). But if they are signed in to Whiteboard with a Microsoft account, such as a personal outlook.com email address, then they can change the diagnostic data level on their devices by going to **Settings > Privacy and security**. ++## Optional connected experiences setting for your organization ++You can choose whether to make [optional connected experiences](https://support.microsoft.com/office/privacy-and-compliance-ed9f0de9-71be-44c2-837d-e0f448660be1?storagetype=live#optional) in Whiteboard available to your users. These connected experiences will be available to your users unless you change the setting in the Microsoft 365 admin center. ++These connected experiences are different because they are not covered by your organizationΓÇÖs commercial agreement with Microsoft. Optional connected experiences are offered by Microsoft directly to your users and are governed by the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement) instead of the [Online Services Terms](https://www.microsoft.com/licensing/product-licensing/products). ++Even if you choose to make these optional connected experiences available to your users, your users have the option to turn them off as a group by going to **Settings > Privacy and security**. Your users only have this choice if they are signed in to Whiteboard with their organizational credentials (sometimes referred to as a work or school account), not if they are signed in with a Microsoft account, such as a personal outlook.com email address. ++## Required diagnostic data events collected by Whiteboard ++The following are the required diagnostic data events collected by Whiteboard, including a list of data fields in each event. ++**Intentional.CanvasObject.Ink.DrawFirstStroke** ++Collected the first-time ink is added to a board in Microsoft Whiteboard. This information is critical to catch errors associated with adding ink to a board. Microsoft is using this data to diagnose the issue in order to guarantee Microsoft Whiteboard is running as expected. ++- **Action** ΓÇô type of ink stroke +- **Source** ΓÇô input method for ink stroke ++**Intentional.SurfSide.ActivationProtocol.LoadFromUri** ++Collected every time when Microsoft Whiteboard is launched by a call from another application or process. This information is critical to catch if Whiteboard does not launch when properly invoked by another application or process. Microsoft is using this data to diagnose the issue in order to guarantee Microsoft Whiteboard is running as expected. ++- **ApplicationExecutionState** ΓÇô execution state of app when activation protocol happens +- **IsSignedIn** ΓÇô user is authentication status +- **Kind** ΓÇô application or process which is launching Whiteboard ++**Intentional.Whiteboard.Init.DisplayWhiteboard** ++Collected the first time Microsoft Whiteboard is actually displayed on a client per a session. This information is critical to catch launching issues. Microsoft is using this data to diagnose the issue in order to guarantee Microsoft Whiteboard is running as expected. ++- **IsPrelaunched** ΓÇô prelaunch status +- **IsProtocolActivation** ΓÇô application launch type ++**Intentional.Whiteboard.Init.StartApp** ++Collected every time when Microsoft Whiteboard launches after the previous state ended without crashing. This information is critical to catch crashing issues. Microsoft is using this data to diagnose the issue in order to guarantee Microsoft Whiteboard is running as expected. ++- **First Start** ΓÇô first time app was launched on client ++**Intentional.Whiteboard.KeyCategory.UseCategory** ++Collected every time a feature is used for the first time (and the first time only) per user/session/whiteboard in Microsoft Whiteboard. This information is critical to make sure the key categories are used. Microsoft is using this data to diagnose the issue in order to guarantee Microsoft Whiteboard is running as expected. ++- **CategoryName** ΓÇô Name of the key category ++**Intentional.Whiteboard.KeyFeature.UseFeature** ++Collected every time a feature is used for the first time (and the first time only) per user/session/whiteboard in Microsoft Whiteboard. This information is critical to make sure the features are called and used. Microsoft is using this data to diagnose the issue in order to guarantee Microsoft Whiteboard is running as expected. ++- **FeatureName** ΓÇô Name of the key feature ++**Intentional.Whiteboard.SafeBoot.StartApp** ++Collected every time when Microsoft Whiteboard launches after the previous state ended in a crash. This information is critical to catch crashing issues. Microsoft is using this data to diagnose the issue in order to guarantee Microsoft Whiteboard is running as expected. ++- **First Start** ΓÇô first time app was launched on client ++**Intentional.Whiteboard.Scrub.LoadSettings** ++Collected every time when Microsoft Whiteboard launches. This information is critical to catch errors associated with user configured settings. Microsoft is using this data to diagnose the issue in order to guarantee Microsoft Whiteboard is running as expected. ++- **ActivePen** ΓÇô pen mode state +- **CollectFullTelemetryWithoutSignIn** ΓÇô full telemetry collection without sign in enablement +- **DefaultWhiteboardBackgroundColor** ΓÇô default board background color +- **DefaultWhiteboardBackgroundPattern** ΓÇô default board background pattern +- **FlightStatus** ΓÇô flight status +- **InkToShape** ΓÇô ink to shape enablement +- **InkToTable** ΓÇô ink to table enablement +- **SignInEnabled** ΓÇô user sign-in enablement +- **SharingWithoutSignInEnabled** ΓÇô sharing board enablement +- **ToolbarLocation** ΓÇô default toolbar location on screen +- **TeamSettingsSource** ΓÇô Teams settings enablement |