| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Get Help Support | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/get-help-support.md | search.appverid: - MET150 - MOE150 description: "Learn how to get online or phone support for your Microsoft 365 for business subscription. You must be an admin for a business subscription to get support." Previously updated : 11/08/2022 Last updated : 07/25/2023 # Get support for Microsoft 365 for business Check out this video and others on our [YouTube channel](https://go.microsoft.co Need to speak to someone right away? Admins, have your account details ready when you call Support. > [!IMPORTANT]-> You must be an admin for a business subscription to use these support methods. If you're not a business admin, please use [this support page](https://support.microsoft.com/contactus). +> You must be an admin for a business subscription to use these support methods. [Find out more about admin roles for the Microsoft 365 admin center](add-users/about-admin-roles.md). If you're not a business admin, please use [this support page](https://support.microsoft.com/contactus). Start by [checking the current health of your services](../enterprise/view-service-health.md). You can view detailed information about current and past issues on the <a href="https://go.microsoft.com/fwlink/p/?linkid=842900" target="_blank">Service health dashboard</a>. If you're experiencing an issue that isn't listed, you can get support in one of the following ways: ## Online support -Save time by starting your service request online. We'll help you find a solution or connect you to technical support. +Save time by starting your service request online. We can help you find a solution or connect you to technical support. > [!IMPORTANT] > You must have bought at least one subscription through Microsoft to access Microsoft support. If you bought all your subscriptions through a partner, contact your partner for support. Save time by starting your service request online. We'll help you find a solutio ## Phone support -In most countries or regions, billing support for Microsoft 365 for business products and services is provided in English from 9 AM-5 PM, Monday through Friday. Local language support varies by country or region. +In most countries/regions, billing support for Microsoft 365 for business products and services is provided in English from 9 AM-5 PM, Monday through Friday. Local language support varies by country/region. Technical support is provided in English 24 hours a day, 7 days a week, and in some cases, in local languages as noted. |
| business-premium | M365bp Mdb Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/business-premium/m365bp-mdb-whats-new.md | This article lists new features in the latest release of [Microsoft 365 Business - **Security summary reports** are rolling out. Use these reports to view threats that were prevented by Defender for Business, Microsoft Secure Score status, and recommendations for improving security. See [Reports in Microsoft Defender for Business](../security/defender-business/mdb-reports.md). -- **Streaming API (preview) is now available for Defender for Business**. For partners or customers looking to build their own security operations center, the Defender for Endpoint streaming API is now in preview for Defender for Business and Microsoft 365 Business Premium. The API supports streaming of device file, registry, network, sign-in events and more to Azure Event Hub, Azure Storage, and Microsoft Sentinel to support advanced hunting and attack detection. See the [Microsoft 365 streaming API guide](../security/defender/streaming-api.md). +- **Streaming API (preview) is now available for Defender for Business**. For partners or customers looking to build their own security operations center, the Defender for Endpoint streaming API is now in preview for Defender for Business and Microsoft 365 Business Premium. The API supports streaming of device file, registry, network, sign-in events and more to Azure Event Hub, Azure Storage, and Microsoft Sentinel to support advanced hunting and attack detection. See [Use the streaming API (preview) with Microsoft Defender for Business](../security/defender-business/mdb-streaming-api.md). - **Managed detection and response integration with Blackpoint Cyber**. This solution is ideal for customers who donΓÇÖt have the resources to invest in an in-house security operations center and for partners who want to augment their IT team with security experts to investigate, triage, and remediate the alerts generated by Defender for Business and Business Premium. [Learn more bout Blackpoint Cyber](https://aka.ms/BlackpointMSFT). |
| frontline | Schedule Owner For Shift Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/schedule-owner-for-shift-management.md | In this example, we assign a policy named ScheduleOwnerPolicy to a user named re Grant-CsTeamsShiftsPolicy -Identity remy@contoso.com -PolicyName ScheduleOwnerPolicy ``` +### Example 3 ++In this example, we assign a policy named ScheduleOwnerPolicy to a group specified by its object id. ++```powershell +Grant-CsTeamsShiftsPolicy -Group 83d3ca56-50e9-46fb-abd4-4f66939188f8 -PolicyName ScheduleOwnerPolicy +``` + ## Related articles -- [Manage the Shifts app for your organization in Teams](/microsoftteams/expand-teams-across-your-org/shifts/manage-the-shifts-app-for-your-organization-in-teams?bc=/microsoft-365/frontline/breadcrumb/toc.json&toc=/microsoft-365/frontline/toc.json)+- [Manage the Shifts app for your organization in Teams](/microsoftteams/expand-teams-across-your-org/shifts/manage-the-shifts-app-for-your-organization-in-teams?bc=/microsoft-365/frontline/breadcrumb/toc.json&toc=/microsoft-365/frontline/toc.json) |
| security | Mdb Streaming Api | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-streaming-api.md | + + Title: Use the streaming API (preview) with Microsoft Defender for Business +description: The Defender for Endpoint streaming API is now in preview for Defender for Business and Microsoft 365 Business Premium. Stream of device file, registry, network, sign-in events, and other data to Azure Event Hub, Azure Storage, and Microsoft Sentinel to support advanced hunting and attack detection. +++ Last updated : 07/25/2023++++ms.localizationpriority: medium ++- SMB +- m365-security +- m365solution-mdb-setup +- highpri +- tier1 ++search.appverid: MET150 +f1.keywords: NOCSH +audience: ITPro +++# Use the streaming API (preview) with Microsoft Defender for Business ++If your organization has a Security Operations Center (SOC), the ability to use the [Microsoft Defender for Endpoint streaming API](../defender-endpoint/raw-data-export.md) is now in [preview](mdb-preview.md) for [Defender for Business](mdb-overview.md) and [Microsoft 365 Business Premium](../../business-premium/index.md). The API enables you to stream data, such as device file, registry, network, sign-in events, and more to one of the following ++- [Microsoft Sentinel](#use-the-streaming-api-with-microsoft-sentinel-preview), a scalable, cloud-native solution that provides security information and event management (SIEM) and security orchestration, automation, and response (SOAR) capabilities. +- [Azure Event Hubs](#use-the-streaming-api-with-event-hubs-preview), a modern big data streaming platform and event ingestion service that can seamlessly integrate with other Azure and Microsoft services, such as Stream Analytics, Power BI, and Event Grid, along with outside services like Apache Spark. +- [Azure Storage](/azure/storage/common/storage-introduction), Microsoft's cloud storage solution for modern data storage scenarios, with highly available, massively scalable, durable, and secure storage for a variety of data objects in the cloud. ++With the streaming API, you can now use [advanced hunting](../defender/advanced-hunting-overview.md) and [attack detection](../defender-endpoint/overview-endpoint-detection-response.md) with Defender for Business and Microsoft 365 Business Premium. The streaming API enables SOCs to view more data about devices, understand better how an attack occurred, and take steps to improve device security. ++## Use the streaming API with Microsoft Sentinel (preview) ++> [!NOTE] +> [Microsoft Sentinel](/azure/sentinel/overview) is a paid service. Several plans and pricing options are available. See [Microsoft Sentinel pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/). ++1. Make sure that Defender for Business is set up and configured, and that devices are already onboarded. See [Set up and configure Microsoft Defender for Business](mdb-setup-configuration.md). ++2. Make sure that the tenant is set up to receive preview features. See [Microsoft Defender for Business preview features](mdb-preview.md). ++3. Create a Log Analytics workspace that you'll use with Sentinel. See [Create a Log Analytics workspace](/azure/azure-monitor/logs/quick-create-workspace?tabs=azure-portal). ++4. Onboard to Microsoft Sentinel. See [Quickstart: Onboard Microsoft Sentinel](/azure/sentinel/quickstart-onboard). ++5. Enable the Microsoft 365 Defender connector. See [Connect data from Microsoft 365 Defender to Microsoft Sentinel](/azure/sentinel/connect-microsoft-365-defender?tabs=MDE). +++## Use the streaming API with Event Hubs (preview) ++> [!NOTE] +> [Azure Event Hubs](/azure/event-hubs/event-hubs-about) requires an Azure subscription. Before you begin, make sure to create an [event hub](/azure/event-hubs/) in your tenant. Then, sign in to the [Azure portal](https://ms.portal.azure.com/), go to **Subscriptions** > **Your subscription** > **Resource Providers** > **Register to Microsoft.insights**. +> ++1. Go to the [Microsoft 365 Defender portal](https://security.microsoft.com) and sign in as a ***Global Administrator*** or ***Security Administrator***. ++2. Go to the [Data export settings page](https://security.microsoft.com/interoperability/dataexport). ++3. Select **Add data export settings**. ++4. Choose a name for your new settings. ++5. Choose **Forward events to Azure Event Hubs**. ++6. Type your **Event Hubs name** and your **Event Hubs ID**. ++ > [!NOTE] + > Leaving the Event Hubs name field empty creates an event hub for each category in the selected namespace. If you're not using a Dedicated Event Hubs Cluster, keep in mind that there's a limit of 10 Event Hubs namespaces. ++ To get your **Event Hubs ID**, go to your Azure Event Hubs namespace page in the [Azure portal](https://ms.portal.azure.com/). On the **Properties** tab, copy the text under **ID**. ++7. Choose the events you want to stream and then select **Save**. ++### The schema of events in Azure Event Hubs ++Here's what the schema of events in Azure Event Hubs looks like: ++```json +{ + "records": [ + { + "time": "<The time WDATP received the event>" + "tenantId": "<The Id of the tenant that the event belongs to>" + "category": "<The Advanced Hunting table name with 'AdvancedHunting-' prefix>" + "properties": { <WDATP Advanced Hunting event as Json> } + } + ... + ] +} +``` ++Each event hub message in Azure Event Hubs contains a list of records. Each record contains the event name, the time Defender for Business received the event, the tenant to which it belongs (you get events from your tenant only), and the event in JSON format in a property called "**properties**". For more information about the schema, see [Proactively hunt for threats with advanced hunting in Microsoft 365 Defender](../defender/advanced-hunting-overview.md). ++## Use the streaming API with Azure Storage (preview) ++Azure Storage requires an Azure subscription. Before you begin, make sure to create a [Storage account](/azure/storage/common/storage-account-overview) in your tenant. Then, sign in to your [Azure tenant](https://ms.portal.azure.com/), and go to **Subscriptions** > **Your subscription** > **Resource Providers** > **Register to Microsoft.insights**. ++### Enable raw data streaming ++1. Go to the [Microsoft 365 Defender portal](https://security.microsoft.com) and sign in as a ***Global Administrator*** or ***Security Administrator***. ++2. Go to [Data export settings page](https://security.microsoft.com/settings/mtp_settings/raw_data_export) in Microsoft 365 Defender. ++3. Select **Add data export settings**. ++4. Choose a name for your new settings. ++5. Choose **Forward events to Azure Storage**. ++6. Type your **Storage Account Resource ID**. In order to get your **Storage Account Resource ID**, go to your Storage account page in the [Azure portal](https://ms.portal.azure.com/). Then, on the **Properties** tab, copy the text under **Storage account resource ID**. ++7. Choose the events you want to stream and then select **Save**. ++### The schema of events in Azure Storage account ++A blob container is created for each event type. The schema of each row in a blob is the following JSON file: ++ ```json + { + "time": "<The time WDATP received the event>" + "tenantId": "<Your tenant ID>" + "category": "<The Advanced Hunting table name with 'AdvancedHunting-' prefix>" + "properties": { <WDATP Advanced Hunting event as Json> } + } + ``` ++Each blob contains multiple rows. Each row contains the event name, the time Defender for Business received the event, the tenant to which it belongs (you get events from your tenant only), and the event in JSON format properties. For more information about the schema of Microsoft Defender for Endpoint events, see [Proactively hunt for threats with advanced hunting in Microsoft 365 Defender](../defender/advanced-hunting-overview.md). ++## See also ++- [Raw Data Streaming API](../defender-endpoint/raw-data-export.md) in Defender for Endpoint |
| security | Deployment Strategy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/deployment-strategy.md | - Title: Identify Defender for Endpoint architecture and deployment method -description: Select the best Microsoft Defender for Endpoint deployment strategy for your environment -keywords: deploy, plan, deployment strategy, cloud native, management, on prem, evaluation, onboarding, local, group policy, gp, endpoint manager, mem, intune -search.product: eADQiWindows 10XVcnh --ms.sitesec: library -ms.pagetype: security ----- - m365-security - - tier1 -- Previously updated : 12/18/2020---# Identify Defender for Endpoint architecture and deployment method --**Applies to:** --- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037)-- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)-- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)--> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-secopsdashboard-abovefoldlink) --You've already completed steps to set up your Microsoft Defender for Endpoint deployment and assigned roles and permissions for Defender for Endpoint. Next, plan for onboarding your devices by identifying your architecture and choosing your deployment method. --We understand that every enterprise environment is unique, so we've provided several options to give you the flexibility in choosing how to deploy the service. Deciding how to onboard endpoints to the Defender for Endpoint service comes down to two important steps: ---## Step 1: Identify your architecture --Depending on your environment, some tools are better suited for certain architectures. Use the table below to decide which Defender for Endpoint architecture best suits your organization. --|Architecture |Description | -||| -|**Cloud-native**| We recommend using Microsoft Intune to onboard, configure, and remediate endpoints from the cloud for enterprises that don't have an on-premises configuration management solution or are looking to reduce their on-premises infrastructure. | -|**Co-management**| For organizations that host both on-premises and cloud-based workloads we recommend using Microsoft's ConfigMgr and Intune for their management needs. These tools provide a comprehensive suite of cloud-powered management features, as well as unique co-management options to provision, deploy, manage, and secure endpoints and applications across an organization. | -|**On-premise**|For enterprises that want to take advantage of the cloud-based capabilities of Microsoft Defender for Endpoint while also maximizing their investments in Configuration Manager or Active Directory Domain Services, we recommend this architecture.| -|**Evaluation and local onboarding**|We recommend this architecture for SOCs (Security Operations Centers) that are looking to evaluate or run a Microsoft Defender for Endpoint pilot, but don't have existing management or deployment tools. This architecture can also be used to onboard devices in small environments without management infrastructure, such as a DMZ (Demilitarized Zone).| --## Step 2: Select deployment method --Once you have determined the architecture of your environment and have created an inventory as outlined in the [requirements section](../defender-endpoint/mde-planning-guide.md#requirements), use the table below to select the appropriate deployment tools for the endpoints in your environment. This will help you plan the deployment effectively. --|Endpoint|Deployment tool| -||| -|**Windows**|[Local script (up to 10 devices)](configure-endpoints-script.md) <br> [Group Policy](configure-endpoints-gp.md) <br> [Microsoft Intune/ Mobile Device Manager](configure-endpoints-mdm.md) <br> [Microsoft Configuration Manager](configure-endpoints-sccm.md) <br> [VDI scripts](configure-endpoints-vdi.md)| -|**Windows servers<br>Linux servers** | [Integration with Microsoft Defender for Cloud](azure-server-integration.md) -|**macOS**|[Local script](mac-install-manually.md) <br> [Microsoft Intune](mac-install-with-intune.md) <br> [JAMF Pro](mac-install-with-jamf.md) <br> [Mobile Device Management](mac-install-with-other-mdm.md)| -|**Linux servers**|[Local script](linux-install-manually.md) <br> [Puppet](linux-install-with-puppet.md) <br> [Ansible](linux-install-with-ansible.md) <br> [Chef](linux-deploy-defender-for-endpoint-with-chef.md)<br> [Saltstack](linux-install-with-saltack.md)| -|**Android**|[Microsoft Intune](android-intune.md)| -|**iOS**|[Microsoft Intune](ios-install.md) <br> [Mobile Application Manager](ios-install-unmanaged.md) | -->[!Note] -> For devices that aren't managed by Microsoft Intune or Microsoft Configuration Manager, you can use the Security Management for Microsoft Defender for Endpoint to receive security configurations for Microsoft Defender directly from Intune. --## Next step --After choosing your Defender for Endpoint architecture and deployment method continue to [Step 4 - Onboard devices](onboarding.md). |
| security | Mac Resources | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-resources.md | If you can reproduce a problem, increase the logging level, run the system for s If an error occurs during installation, the installer will only report a general failure. The detailed log will be saved to `/Library/Logs/Microsoft/mdatp/install.log`. If you experience issues during installation, send us this file so we can help diagnose the cause.+For further troubleshooting installation issues, please review [Troubleshoot installation issues for Microsoft Defender for Endpoint on macOS](mac-support-install.md) ## Uninstalling > [!NOTE]-> Before uninstalling Microsoft Defender for Endpoint on macOS, please offboard per [Offboard non-Windows devices](/microsoft-365/security/defender-endpoint/configure-endpoints-non-windows?view=o365-worldwide#offboard-non-windows-devices&preserve-view=true). +> Before uninstalling Microsoft Defender for Endpoint on macOS, please offboard per [Offboard non-Windows devices](configure-endpoints-non-windows.md). There are several ways to uninstall Microsoft Defender for Endpoint on macOS. Note that while centrally managed uninstall is available on JAMF, it is not yet available for Microsoft Intune. Important tasks, such as controlling product settings and triggering on-demand s |Group|Scenario|Command| ||||+|Configuration|Turn on/off antivirus passive mode|`mdatp config passive-mode --value [enabled/disabled]`| |Configuration|Turn on/off real-time protection|`mdatp config real-time-protection --value [enabled/disabled]`| |Configuration|Turn on/off cloud protection|`mdatp config cloud --value [enabled/disabled]`| |Configuration|Turn on/off product diagnostics|`mdatp config cloud-diagnostic --value [enabled/disabled]`| |Configuration|Turn on/off automatic sample submission|`mdatp config cloud-automatic-sample-submission --value [enabled/disabled]`|-|Configuration|Add a threat name to the allowed list|`mdatp threat allowed add --name [threat-name]`| -|Configuration|Remove a threat name from the allowed list|`mdatp threat allowed remove --name [threat-name]`| -|Configuration|List all allowed threat names|`mdatp threat allowed list`| -|Configuration|Turn on PUA protection|`mdatp threat policy set --type potentially_unwanted_application -- action block`| -|Configuration|Turn off PUA protection|`mdatp threat policy set --type potentially_unwanted_application -- action off`| -|Configuration|Turn on audit mode for PUA protection|`mdatp threat policy set --type potentially_unwanted_application -- action audit`| -|Configuration|Turn on/off antivirus passive mode|`mdatp config passive-mode --value [enabled/disabled]`| +|Configuration|Turn on/audit/off PUA protection|`mdatp threat policy set --type potentially_unwanted_application -- action [block/audit/off`| +|Configuration|Add/remove an antivirus exclusion for a process|`mdatp exclusion process [add/remove] --path [path-to-process]`or `mdatp exclusion process [add\|remove] --name [process-name]`| +|Configuration|Add/remove an antivirus exclusion for a file|`mdatp exclusion file [add/remove] --path [path-to-file]`| +|Configuration|Add/remove an antivirus exclusion for a directory|`mdatp exclusion folder [add/remove] --path [path-to-directory]`| +|Configuration|Add/remove an antivirus exclusion for a file extension|`mdatp exclusion extension [add/remove] --name [extension]`| +|Configuration|List all antivirus exclusions|`mdatp exclusion list`| |Configuration|Configure degree of parallelism for on-demand scans|`mdatp config maximum-on-demand-scan-threads --value [numerical-value-between-1-and-64]`| |Configuration|Turn on/off scans after security intelligence updates|`mdatp config scan-after-definition-update --value [enabled/disabled]`| |Configuration|Turn on/off archive scanning (on-demand scans only)|`mdatp config scan-archives --value [enabled/disabled]`| |Configuration|Turn on/off file hash computation|`mdatp config enable-file-hash-computation --value [enabled/disabled]`|-|Configuration|Turn on/off data loss prevention|`mdatp config data_loss_prevention --value [enabled/disabled]`| -|Diagnostics|Change the log level|`mdatp log level set --level [error/warning/info/verbose]`| -|Diagnostics|Generate diagnostic logs|`mdatp diagnostic create --path [directory]`| -|Health|Check the product's health|`mdatp health`| -|Health|Check for a specific product attribute|`mdatp health --field [attribute: healthy/licensed/engine_version...]`| |Protection|Scan a path|`mdatp scan custom --path [path] [--ignore-exclusions]`| |Protection|Do a quick scan|`mdatp scan quick`| |Protection|Do a full scan|`mdatp scan full`| |Protection|Cancel an ongoing on-demand scan|`mdatp scan cancel`| |Protection|Request a security intelligence update|`mdatp definitions update`|+|Configuration|Add a threat name to the allowed list|`mdatp threat allowed add --name [threat-name]`| +|Configuration|Remove a threat name from the allowed list|`mdatp threat allowed remove --name [threat-name]`| +|Configuration|List all allowed threat names|`mdatp threat allowed list`| +|Protection history|Print the full protection history|`mdatp threat list`| +|Protection history|Get threat details|`mdatp threat get --id [threat-id]`| +|Quarantine management|List all quarantined files|`mdatp threat quarantine list`| +|Quarantine management|Remove all files from the quarantine|`mdatp threat quarantine remove-all`| +|Quarantine management|Add a file detected as a threat to the quarantine|`mdatp threat quarantine add --id [threat-id]`| +|Quarantine management|Remove a file detected as a threat from the quarantine|`mdatp threat quarantine remove --id [threat-id]`| +|Quarantine management|Restore a file from the quarantine|`mdatp threat quarantine restore --id [threat-id] --path [destination-folder]`| +|Network Protection Configuration|Configure the Network Protection enforcement level|`mdatp config network-protection enforcement-level --value [Block/Audit/Disabled]`| +|Network Protection management|Check Network protection has been started successfully|`mdatp health --field network_protection_status`| +|Device Control management|Is Device Control enabled, and what is the Default Enforcement?|`mdatp device-control policy preferences list`| +|Device Control management|What Device Control policy is enabled?|`mdatp device-control policy rules list`| +|Device Control management|What Device Control policy groups are enabled?|`mdatp device-control policy groups list`| +|Configuration|Turn on/off data loss prevention|`mdatp config data_loss_prevention --value [enabled/disabled]`| +|Diagnostics|Change the log level|`mdatp log level set --level [error/warning/info/verbose]`| +|Diagnostics|Generate diagnostic logs|`mdatp diagnostic create --path [directory]`| +|Health|Check the product's health|`mdatp health`| +|Health|Check for a specific product attribute|`mdatp health --field [attribute: healthy/licensed/engine_version...]`| +|EDR|EDR list exclusions (root)|`mdatp edr exclusion list [processes|paths|extensions|all]`| |EDR|Set/Remove tag, only GROUP supported|`mdatp edr tag set --name GROUP --value [name]`| |EDR|Remove group tag from device|`mdatp edr tag remove --tag-name [name]`| |EDR|Add Group ID|`mdatp edr group-ids --group-id [group]`| |
| security | Raw Data Export | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/raw-data-export.md | Last updated 12/18/2020 - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) + > [!NOTE] > For the full data streaming experience available, please visit [Stream Microsoft 365 Defender events | Microsoft Learn](/microsoft-365/security/defender/streaming-api).+> If you're using Microsoft Defender for Business, see [Use the streaming API (preview) with Microsoft Defender for Business](../defender-business/mdb-streaming-api.md). > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-configuresiem-abovefoldlink) |
| security | Run Analyzer Macos Linux | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/run-analyzer-macos-linux.md | If using a terminal download using the command: 2. Verify the download > [!NOTE]- > The current SHA256 hash of 'XMDEClientAnalyzerBinary.zip' that is downloaded from the above link is: 'C94E3D630730E5A2B605FD295BD81D93997888F4CB2B2694076FCFDE85876C13' + > The current SHA256 hash of 'XMDEClientAnalyzerBinary.zip' that is downloaded from the above link is: '4CCCDC7D5ABA67D576D8B1DB8C8286AAD8F09668B6DAE46968ECB297B8424042' ```console- echo 'C94E3D630730E5A2B605FD295BD81D93997888F4CB2B2694076FCFDE85876C13 XMDEClientAnalyzerBinary.zip' | sha256sum -c + echo '4CCCDC7D5ABA67D576D8B1DB8C8286AAD8F09668B6DAE46968ECB297B8424042 XMDEClientAnalyzerBinary.zip' | sha256sum -c ``` 3. Extract the contents of <i>XMDEClientAnalyzerBinary.zip</i> on the machine. When using a terminal, unzip the file using one of the following commands based 2. Verify the download ```console- echo '1A8004C89E8B75FF892AAC66F1B1D07F3C7030720070A1A1E677A099A9ADC32E XMDEClientAnalyzer.zip' | sha256sum -c + echo '4C1E100E41D0E9C0FFDA11BD7FC373C7F16E082440BA78EE0DBDD757C3C4C10C XMDEClientAnalyzer.zip' | sha256sum -c ``` 3. Extract the contents of XMDEClientAnalyzer.zip on the machine.\ |
| security | Streaming Api | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/streaming-api.md | Title: Stream Microsoft 365 Defender events description: Learn how to configure Microsoft 365 Defender to stream Advanced Hunting events to Event Hubs or Azure storage account keywords: raw data export, streaming API, API, Event hubs, Azure storage, storage account, Advanced Hunting, raw data sharing -search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium Last updated 02/08/2023 > [!NOTE] > **Try our new APIs using MS Graph security API**. Find out more at: [Use the Microsoft Graph security API - Microsoft Graph | Microsoft Learn](/graph/api/resources/security-api-overview?view=graph-rest-1.0&preserve-view=true).+> If you're using Microsoft Defender for Business, see [Use the streaming API (preview) with Microsoft Defender for Business](../defender-business/mdb-streaming-api.md). [!include[Prerelease information](../../includes/prerelease.md)] |
| solutions | Collaborate Guests Cross Cloud | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-guests-cross-cloud.md | Title: Collaborate with guests from other Microsoft 365 cloud environments + Title: Collaborate with guests from other Microsoft 365 cloud environments (Preview) recommendations: false description: Learn how to enable guest invitations between Microsoft 365 cloud environments (such as commercial and DoD). -# Collaborate with guests from other Microsoft 365 cloud environments +# Collaborate with guests from other Microsoft 365 cloud environments (Preview) Microsoft 365 organizations have one of several tenant types and are located in one of three Microsoft clouds: |
| syntex | Import Term Set Skos | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/import-term-set-skos.md | We recommend keeping your import files to less than 20,000 terms. Larger files c 4. If you want to download a sample file to use as a template, click **sample-metadata.ttl** to get a sample file that uses the SKOS-based format. -5. Create the import file that contains the term sets & terms you wish to import. -+1. Create the import file that contains the term sets and terms you want to import. 6. Under **File format**, select **SKOS (*.ttl)**. 7. Click **Browse** and navigate to and add your import file. On successful import of the file, a success message will be displayed, and the t [Introduction to managed metadata](/sharepoint/managed-metadata) [Import term sets (site level)](https://support.microsoft.com/office/168fbc86-7fce-4288-9a1f-b83fc3921c18)+ |