| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| compliance | Add Your Organization Brand To Encrypted Messages | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/add-your-organization-brand-to-encrypted-messages.md | audience: Admin ms.localizationpriority: medium Previously updated : 10/14/2022 Last updated : 07/04/2023 search.appverid: - MET150 - MOE150-description: Learn how Microsoft 365 global administrators can apply your organization's branding to encrypted email messages & contents of the encryption portal. +description: Learn how Microsoft 365 global administrators can apply your organization's branding to encrypted email messages & the contents of the encryption portal. # Add your organization's brand to your Microsoft Purview Message Encryption encrypted messages -Apply your company branding to customize the look of your organization's email messages and the encryption portal. You'll need to apply global administrator permissions to your work or school account before you can get started. Use the Get-OMEConfiguration and Set-OMEConfiguration cmdlets in Exchange Online PowerShell to customize these parts of encrypted email messages: +Apply your company branding to customize the look of your organization's email messages and the encryption portal. You need to apply global administrator permissions to your work or school account before you can get started. You customize branding in one of two ways, using Exchange Online PowerShell or Microsoft Purview Data Loss Prevention (DLP) policies. ++For more information about using Microsoft Purview Data Loss Prevention (DLP) policies to add customized branding to encrypted messages, see these resources. ++- [Exchange location actions](dlp-policy-reference.md#exchange-location-actions) for details on this action. +- [Design a data loss prevention policy](dlp-policy-design.md) if you're new to DLP and want to learn more about what goes into preparing to create a DLP policy. +- [Create and Deploy data loss prevention policies](dlp-create-deploy-policy.md) for examples on how to create and deploy a DLP policy. ++The rest of this article describes using Exchange Online PowerShell. ++Use the Get-OMEConfiguration and Set-OMEConfiguration cmdlets in Exchange Online PowerShell to customize these parts of encrypted email messages: - Introductory text - Disclaimer text If you'd like more control, use Microsoft Purview Advanced Message Encryption to - Whether you want to allow emails to be revoked - Whether you want emails sent to external recipients to expire after a specified number of days. -Once you've created the templates, apply them to encrypted emails sent from your online mailbox by using Exchange mail flow rules. If you have Microsoft Purview Advanced Message Encryption, you can revoke any email that you've branded. +Once you've created the templates, apply them to encrypted emails sent from your online mailbox by using Exchange mail flow rules. If you have Microsoft Purview Advanced Message Encryption, you can revoke any email that you have branded. [!INCLUDE [purview-preview](../includes/purview-preview.md)] To remove a custom branding template: > [!IMPORTANT] > Third-party applications that scan and modify mail can prevent branding from being applied correctly. -After you've either modified the default template or created new branding templates, you can create Exchange mail flow rules to apply your custom branding based on certain conditions. Most importantly, the email must be encrypted. Such a rule will apply custom branding to mail sent from your online mailbox in the following scenarios: +After you've either modified the default template or created new branding templates, you can create Exchange mail flow rules to apply your custom branding based on certain conditions. Most importantly, the email must be encrypted. Such a rule applies custom branding to mail sent from your online mailbox in the following scenarios: - If the email was manually encrypted by the end user using Outlook or Outlook on the web, formerly Outlook Web App - If the email was automatically encrypted by an Exchange mail flow rule or Microsoft Purview Data Loss Prevention policy -To ensure Microsoft Purview Message Encryption applies your custom branding, set up a mail flow rule to encrypt your messages. The priority of the encryption rule should be higher than the branding rule so that the encryption rule is processed first. By default, if you create the encryption rule before the branding rule, then the encryption rule will have a higher priority. For information, see [Define mail flow rules to encrypt email messages in Office 365](define-mail-flow-rules-to-encrypt-email.md). For information on setting the priority of a mail flow rule, see [Manage mail flow rules](/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules#set-the-priority-of-a-mail-flow-rule). +To ensure Microsoft Purview Message Encryption applies your custom branding, set up a mail flow rule to encrypt your messages. The priority of the encryption rule should be higher than the branding rule so that the encryption rule is processed first. By default, if you create the encryption rule before the branding rule, then the encryption rule has a higher priority. For information, see [Define mail flow rules to encrypt email messages in Office 365](define-mail-flow-rules-to-encrypt-email.md). For information on setting the priority of a mail flow rule, see [Manage mail flow rules](/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules#set-the-priority-of-a-mail-flow-rule). 1. In a web browser, using a work or school account that has been granted global administrator permissions, [sign in to Office 365](https://support.office.com/article/b9582171-fd1f-4284-9846-bdd72bb28426#ID0EAABAAA=Web_browser). To ensure Microsoft Purview Message Encryption applies your custom branding, set 7. If you've already defined a mail flow rule to apply encryption, skip this step. Otherwise, to configure the mail flow rule to apply encryption, from **Do the following**, select **Modify the message security**, and then select **Apply Office 365 Message Encryption and rights protection**. Select a Rights Management Service (RMS) template from the list and then select **add action**. - The list of templates includes default templates and options and any custom templates you create. If the list is empty, ensure that you have set up Microsoft Purview Message Encryption. For instructions, see [Set up Microsoft Purview Message Encryption](set-up-new-message-encryption-capabilities.md). For information about the default templates, see [Configuring and managing templates for Azure Information Protection](/information-protection/deploy-use/configure-policy-templates). For information about the **Do Not Forward** option, see [Do Not Forward option for emails](/information-protection/deploy-use/configure-usage-rights#do-not-forward-option-for-emails). For information about the **Encrypt Only** option, see [Encrypt Only option for emails](/information-protection/deploy-use/configure-usage-rights#encrypt-only-option-for-emails). + The list of templates includes default templates and options and any custom templates you create. If the list is empty, ensure that you have set up Microsoft Purview Message Encryption. For instructions, see [Set up Microsoft Purview Message Encryption](set-up-new-message-encryption-capabilities.md). For information about the default templates, see [Configuring and managing templates for Azure Information Protection](/information-protection/deploy-use/configure-policy-templates). For information about the **Do Not Forward** option, see the [Do Not Forward option for emails](/information-protection/deploy-use/configure-usage-rights#do-not-forward-option-for-emails). For information about the **Encrypt Only** option, see [Encrypt Only option for emails](/information-protection/deploy-use/configure-usage-rights#encrypt-only-option-for-emails). 8. From **Do the following**, select **Modify the message security** \> **Apply custom branding to OME messages**. Next, from the drop-down, select a branding template. |
| compliance | Apply Sensitivity Label Automatically | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/apply-sensitivity-label-automatically.md | Finally, you can use simulation mode to provide an approximation of the time nee 4. For the page **Name your auto-labeling policy**: Provide a unique name, and optionally a description to help identify the automatically applied label, locations, and conditions that identify the content to label. -5. For the page **Assign admin units**: This configuration is currently in preview. If your organization is using [administrative units in Azure Active Directory](/azure/active-directory/roles/administrative-units), auto-labeling policies for Exchange and OneDrive can be automatically restricted to specific users by selecting administrative units. If your account has been [assigned administrative units](microsoft-365-compliance-center-permissions.md#administrative-units-preview), you must select one or more administrative units. +5. For the page **Assign admin units**: If your organization is using [administrative units in Azure Active Directory](/azure/active-directory/roles/administrative-units), auto-labeling policies for Exchange and OneDrive can be automatically restricted to specific users by selecting administrative units. If your account has been [assigned administrative units](microsoft-365-compliance-center-permissions.md#administrative-units-preview), you must select one or more administrative units. If you don't want to restrict the policy by using administrative units, or your organization hasn't configured administrative units, keep the default of **Full directory**. |
| compliance | Create Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-sensitivity-labels.md | f1.keywords: Previously updated : 06/10/2023 Last updated : 07/05/2023 audience: Admin To check your label's configuration, including advanced settings, use the follow > [!IMPORTANT] > If you select a sublabel, make sure you also select its parent label. -4. For the **Assign admin units**: This configuration is currently in preview. If your organization is using [administrative units in Azure Active Directory](/azure/active-directory/roles/administrative-units), the label policy can be automatically restricted to specific users by selecting administrative units. If your account has been [assigned administrative units](microsoft-365-compliance-center-permissions.md#administrative-units-preview), you must select one or more administrative units. +4. For the **Assign admin units**: If your organization is using [administrative units in Azure Active Directory](/azure/active-directory/roles/administrative-units), the label policy can be automatically restricted to specific users by selecting administrative units. If your account has been [assigned administrative units](microsoft-365-compliance-center-permissions.md#administrative-units-preview), you must select one or more administrative units. If you don't want to restrict the policy by using administrative units, or your organization hasn't configured administrative units, keep the default of **Full directory**. |
| compliance | Get Started With Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/get-started-with-sensitivity-labels.md | f1.keywords: Previously updated : 06/08/2023 Last updated : 07/05/2023 audience: Admin These permissions are required only to create and configure sensitivity labels a ## Support for administrative units -Now in preview, sensitivity labels support [administrative units that have been configured in Azure Active Directory](/azure/active-directory/roles/administrative-units): +Sensitivity labels support [administrative units that have been configured in Azure Active Directory](/azure/active-directory/roles/administrative-units): - You can assign administrative units to members of role groups that are used with Microsoft Purview Information Protection. Edit these role groups and select individual members, and then the **Assign admin units** option to select administrative units from Azure Active Directory. These administrators are now restricted to managing just the users in those administrative units. |
| compliance | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md | f1.keywords: Previously updated : 07/03/2023 Last updated : 07/05/2023 audience: Admin Whether it be adding new solutions to the [Microsoft Purview compliance portal]( [!INCLUDE [purview-preview](../includes/purview-preview.md)] +## July 2023 ++### Sensitivity labels ++- **General availability (GA)**: [Support for administrative units](get-started-with-sensitivity-labels.md#support-for-administrative-units). + ## June 2023 ### Data lifecycle management and records management Whether it be adding new solutions to the [Microsoft Purview compliance portal]( ### Insider risk management -- **New Alert ID field and Case ID field**: New static ID fields make it easier to search for alerts, and track and share alerts between admins+- **New Alert ID field and Case ID field**: New static ID fields make it easier to search for alerts, and track and share alerts between admins. - **Assign an alert feature**: Ability to [assign an alert to a specific admin](insider-risk-management-activities.md#assign-an-alert) makes it easier for admins to prioritize and triage alerts.-- Update to clarify that there's [no limit on the number of users for forensic evidence policies](insider-risk-management-policy-templates.md#policy-template-limits) +- Update to clarify that there's [no limit on the number of users for forensic evidence policies](insider-risk-management-policy-templates.md#policy-template-limits). ### Sensitivity labels |
| frontline | Pin Teams Apps Based On License | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/pin-teams-apps-based-on-license.md | With the tailored frontline app experience, your frontline workers get the most Apps are pinned to the app bar, which is the bar at the bottom of the Teams mobile clients (iOS and Android) and on the side of the Teams desktop client. The following apps are pinned for users who have an [F license](https://www.microsoft.com/microsoft-365/enterprise/frontline#office-SKUChooser-0dbn8nt): -- [Viva Connections](https://support.microsoft.com/office/your-intranet-is-now-in-microsoft-teams-8b4e7f76-f305-49a9-b6d2-09378476f95b) ([rolling out](#viva-connections-rolling-out))+- [Viva Connections](#viva-connections) [Learn what Viva Connections is](https://support.microsoft.com/office/your-intranet-is-now-in-microsoft-teams-8b4e7f76-f305-49a9-b6d2-09378476f95b) - [Activity](https://support.microsoft.com/office/explore-the-activity-feed-in-teams-91c635a1-644a-4c60-9c98-233db3e13a56) - [Chat](https://support.microsoft.com/office/get-started-with-chat-0b506ce2-eb6d-4fca-9668-e56980ba755e) - [Teams](https://support.microsoft.com/office/teams-and-channels-in-microsoft-teams-c6d0e61d-a61e-44a6-a972-04f2a8fa4155) The feature is off. | The frontline worker gets the apps defined in the global > [!NOTE] > You can't change the apps or order of apps in the tailored frontline app experience. For now, if you want to make changes, you can set up your own custom experience. To do this, first turn off the feature. Then, [create a custom app setup policy](/microsoftteams/teams-app-setup-policies), and [assign it to users or groups](/microsoftteams/assign-policies-users-and-groups). -### Viva Connections (rolling out) --> [!NOTE] ->The Frontline Viva Connections experience is currently rolling out. For the details on the rollout refer to the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=99706). +### Viva Connections Viva Connections is part of the tailored apps experience. Frontline users who see the tailored app experience will have Viva Connections pinned in the first position on both mobile and desktop. |
| lighthouse | M365 Lighthouse Alerts Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-alerts-overview.md | + + Title: "Overview of the Alerts page in Microsoft 365 Lighthouse" +f1.keywords: NOCSH ++++ Last updated : 06/30/2023+audience: Admin +++ms.localizationpriority: medium ++- Tier1 +- scotvorg +- M365-subscription-management +- Adm_O365 ++- AdminSurgePortfolib +- M365-Lighthouse +search.appverid: MET150 +description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn how to view alerts in Lighthouse." +++# Overview of the Alerts page in Microsoft 365 Lighthouse ++As an MSP provider, you need to monitor and respond to the security issues of your customers efficiently and effectively. Microsoft 365 Lighthouse introduces alerts, a powerful tool that gives you a consolidated view of all the high priority detections and alerts across your customers. You can see a prioritized list of the most urgent issues that require your attention and take immediate action to resolve them. You can also enable push alerts to your existing support systems and flows, so you never miss a critical alert that needs your intervention. ++To help you get started, Lighthouse provides a default set of alerting rules based on best practices and recommendations. You can use these rules as they are or modify them according to your preferences and needs. You can also create rules from scratch for more control and flexibility. ++## Alerts tab ++The **Alerts** tab provides a consolidated view of potential security issues across all your customers. The tab contains two sections: ++- **Alert resolution rate** – a graph that displays historical information about alerts and their status over time. ++- **Alert report** – a table of current alerts that can be filtered by alert type, severity, status, and assigned to. ++From the table, you can select any alert to see more detailed information, including: ++- Alert description +- Affected tenant(s) +- Rule that triggered the alert +- Alert type +- Time stamp (First detected, last updated) +- Impacted entity ++You can update the severity and status of the alert and assign the alert to a specific user to resolve. From the **Comments and history** tab, you have a complete history of the alert. You can also add additional comments to the alert as needed. ++### Alert Types ++Lighthouse defines six alert types. ++- Non-compliant +- Device without antivirus protection +- Variance detection +- Risky user +- Security incident +- Active threat on device ++The **Alerts** tab also includes the following options: ++- **Export:** Select to export alert data to an Excel comma-separated values (.csv) file. +- **Refresh:** Select to retrieve the most current alert data. +- **Search:** Enter keywords to locate a specific alert in the list. +++## Alert rules tab ++The **Alert rules** tab lets you create and edit alert rules. Lighthouse provides six default alert rules that are automatically applied to all customers. You can edit existing rules or create your own custom rules. Select **Create alert rule**, and Lighthouse will guide you step by step in creating your first alert rule. ++The Alert rules tab also includes the following options: ++- **Create alert rule:** Select to create a new alert. +- **Edit alert rule:** Select to edit an existing alert rule. +- **Delete:** Select to delete an alert rule from the list. +- **Search:** Enter keywords to locate a specific alert rule in the list. +++## Related content ++[Create and manage alert rules](m365-lighthouse-alerts-overview.md) (article)\ +[Overview of the Threat management page in Microsoft 365 Lighthouse](m365-lighthouse-threat-management-page-overview.md) (article)\ +[Mitigate threats in Microsoft 365 Lighthouse with Microsoft Defender Antivirus](m365-lighthouse-mitigate-threats.md) (article)\ +[Overview of the Device security page in Microsoft 365 Lighthouse](m365-lighthouse-device-security-overview.md) (article)\ +[Overview of the Vulnerability management page in Microsoft 365 Lighthouse](m365-lighthouse-vulnerability-management-page-overview.md) (article) |
| lighthouse | M365 Lighthouse Create Manage Alert Rules | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-create-manage-alert-rules.md | + + Title: "Create and manage alert rules in Microsoft 365 Lighthouse" +f1.keywords: NOCSH ++++ Last updated : 06/30/2023+audience: Admin +++ms.localizationpriority: medium ++- Tier1 +- scotvorg +- M365-subscription-management +- Adm_O365 ++- AdminSurgePortfolib +- M365-Lighthouse +search.appverid: MET150 +description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthouse, learn how to create alert rules." +++# Create and manage alert rules in Microsoft 365 Lighthouse ++Alert rules allow you to configure high priority alerts from various data sources, such as Risky Users, Microsoft Defender for Business, Microsoft Defender Antivirus, Device Compliance, and more. Lighthouse supports the creation of six alert types: ++- Non-compliant +- Device without antivirus protection +- Variance detection +- Risky user +- Security incident +- Active threat on device ++## Before you begin ++You must be a Global Administrator to create and manage alert rules. ++## Create a new alert rule ++1. In the left navigation pane in Lighthouse, select **Alerts**. +2. On the **Alerts** page, select **Alerts rules** tab. +3. Select **Create alert rule**. The alert rules wizard opens. +4. From the **Set up the basics** page, configure the following basic information: + 1. Name of the alert + 2. Alert type + 3. Description of the alert +5. Select **Next**. +6. From the **Settings** page, configure alert settings. The number of settings vary based on the alert type you choose. +7. Select **Next**. +8. From the **Tenants** page, select which tenants to monitor. +9. From the **Recipients** page, select who should receive email notification when this alert is triggered. You can send notifications to users, security groups, or ticketing system. +10. Review the information and then select **Create alert rule**. ++## Edit an existing alert rule ++1. In the left navigation pane in Lighthouse, select **Alerts**. +2. On the **Alerts** page, select **Alerts rules** tab. +3. From the list, select an alert rule you want to edit. +4. Select **Edit alert rule**. The alert rules wizard opens. +5. Step through each page and edit any settings as needed. +6. Review your changes and then select **Edit alert rule**. ++## Delete an alert rule ++1. In the left navigation pane in Lighthouse, select **Alerts**. +2. On the **Alerts** page, select **Alerts rules** tab. +3. From the list, select an alert rule you want to delete. +4. Select **Delete**. +5. In the confirmation window, select **Delete**. ++## Related content ++[Overview of the Alerts page in Microsoft 365 Lighthouse](m365-lighthouse-alerts-overview.md) (article) |
| lighthouse | M365 Lighthouse Manage Mfa | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-manage-mfa.md | description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthous # Manage multifactor authentication in Microsoft 365 Lighthouse -Azure Active Directory (Azure AD) Multi-Factor Authentication (MFA) helps safeguard access to data and applications, providing another layer of security by using a second form of authentication. The Multifactor Authentication page provides detailed information on the status of MFA enablement across your tenants. Select any tenant in the list to see more details for that tenant, including which Conditional Access policies requiring MFA are already configured and which users haven't yet registered for MFA. +Microsoft 365 Lighthouse allows you to manage multifactor authentication (MFA) settings across all tenants. The Multifactor Authentication page provides detailed information on the status of MFA enablement and the ability to take action on specific users. -For small- and medium-sized business (SMB) customers, Microsoft recommends enabling [security defaults](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults) at a minimum. For more complex scenarios, you can use [Conditional Access](/azure/active-directory/conditional-access/overview) to configure specific policies. +For small- and medium-sized business (SMB) customers, Microsoft recommends enabling [security defaults](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults) at a minimum. For more complex scenarios, you can use [Conditional Access](/azure/active-directory/conditional-access/overview) to configure specific policies. ## Before you begin -The following conditions must be met before a tenant will appear in the list: +The customer tenant must be active within Microsoft 365 Lighthouse. To determine if a tenant is active, see [Microsoft 365 Lighthouse tenant list overview](m365-lighthouse-tenant-list-overview.md). -- The customer tenant must have an Azure AD Premium license for each user. For more information on which licenses support MFA, see [Features and licenses for Azure AD Multi-Factor Authentication](/azure/active-directory/authentication/concept-mfa-licensing).+## Notify users who aren't registered for MFA -- The customer tenant must be active within Microsoft 365 Lighthouse. To learn how to determine if a tenant is active, see [Microsoft 365 Lighthouse tenant list overview](/microsoft-365/lighthouse/m365-lighthouse-tenant-list-overview).+1. In the left navigation pane in Lighthouse, select **Users** \> **Multifactor authentication**. -## Enable MFA for a tenant +2. Select the tenant that contains the user(s) that you want to notify. -1. In the left navigation pane in Lighthouse, select **Users** > **Multifactor authentication**. +3. Select **Users not registered for MFA** tab. -2. On the **Multifactor Authentication** page, look for a tenant currently not using MFA, and then select that tenant to open the tenant details pane. +4. Select the tenant containing the user(s) you want to notify. -3. On the **MFA enablement** tab, under **MFA with Security defaults**, select **Enable Security defaults**. +5. Select **Create email**. -4. Select **Save changes**. + Your default email application creates a sample email addressed to each selected user. -To enable MFA through Conditional Access, see [Tutorial: Secure user sign-in events with Azure AD Multi-Factor Authentication](/azure/active-directory/authentication/tutorial-enable-azure-mfa). +6. Edit the notification email if needed. -## Notify users who aren't registered for MFA +7. Send the email. -1. In the left navigation pane in Lighthouse, select **Users** > **Multifactor authentication**. +> [!TIP] +> Select the **Admin**, **Guest**, or **Members** counts to filter the list by type. If any user accounts in the list are emergency access or service accounts for which you don't want to require MFA, select those user accounts and then select **Exclude users**. The excluded user accounts will no longer appear in the list of users not registered for MFA. -2. On the **Multifactor Authentication** page, look for tenants with users not registered for MFA, and then select the tenant to open the tenant details pane. +> [!NOTE] +> Lighthouse opens your default email client and prepopulates the email message with instructions to register for MFA. All the selected users will be included on the BCC line. If you prefer to individually email users, you can select the email icon next to the username. +> +> If you want to use a different email account, you can export the list of users to a file. You can also download sample email templates you can customize with your company branding. ++## Exclude users from MFA registration ++1. In the left navigation pane in Lighthouse, select **Users \> Multifactor authentication**. ++2. Select the tenant containing the user(s) you want to exclude. 3. Select **Users not registered for MFA** tab. -4. Select all other users in the list who need to register for MFA, and then select **Create email**. +4. Select the user(s) that you want to exclude. -> [!TIP] -> Select the **Admin**, **Guest**, or **Members** counts to filter the list by type. If any of the user accounts in the list are emergency access accounts or service accounts for which you don't want to require MFA, select those user accounts, and then select **Exclude users**. The excluded user accounts will no longer appear in the list of users not registered for MFA. +5. Select **Exclude users**. ++6. In the **Exclude users** pane, select **Save changes** to save the changes in both Lighthouse and the tenant. > [!NOTE]-> If any shared mailbox accounts or inactive user accounts appear in the list of users not registered for MFA, we recommend that you block signin for those accounts so they'll no longer appear in this list. +> Ensure that the **Microsoft 365 Lighthouse - MFA Exclusions** security group is excluded from the tenant’s Conditional Access policies that require MFA and from the applicable deployment tasks in the tenant’s deployment plan in Lighthouse. ++## Block sign-in for users not registered for MFA -Lighthouse opens your default email client and prepopulates the email message with instructions to register for MFA. All the selected users will be included on the BCC line. If you prefer to individually email users, you can select the email icon next to the username. +1. In the left navigation pane in Lighthouse, select **Users \> Multifactor authentication**. +2. Select the tenant that contains the user(s) you want to block. +3. Select **Users not registered for MFA** tab. +4. Select the user(s) that you want to block. +5. Select **Block sign-in**. +6. In the **Manage sign-in status** pane, select **Block users from signing in**. +7. Select **Save**. ++> [!NOTE] +> Ensure If any shared mailbox accounts or inactive user accounts appear in the list of users not registered for MFA, we recommend you block sign-in for those accounts to remove them from the list. -If you want to use a different email account, you can export the list of users to a file. You can also download sample email templates that you can customize with your company branding. +Blocking a user prevents anyone from signing in as this user and is a good idea when you think their password or username may be compromised. Blocking a user immediately stops any new sign-ins for that account. The account will be automatically signed out from all Microsoft services within 60 minutes if the account is signed in. This won't stop the account from receiving mail and doesn't delete any account data. ++## Remove a user from the Excluded users group ++1. In the left navigation pane in Lighthouse, select **Users \> Multifactor authentication**. +2. Select the tenant that contains the user(s) you want to remove. +3. Select **Exclude users** tab. +4. Select the user(s) that you want to remove. +5. Select **Remove**. +6. In the confirmation message, select **Remove**. ++> [!NOTE] +> The excluded users listed in Lighthouse will reflect the current membership **Microsoft 365 Lighthouse - MFA exclusions** security group but will not confirm that the group has been excluded from the tenant’s Conditional Access policies that require MFA or from the applicable deployment tasks in the tenant’s deployment plan in Lighthouse. ## Next steps -Once MFA is enabled, you can enable Azure Active Directory (Azure AD) self-service password reset (SSPR). SSPR gives users the ability to change or reset their password with no administrator or help desk involvement. For more information, see [Manage self-service password reset in Microsoft 365 Lighthouse](m365-lighthouse-manage-sspr.md). +Once MFA is enabled, you can enable Azure Active Directory (Azure AD) self-service password reset (SSPR). SSPR allows users to change or reset passwords without administrator or help desk involvement. For more information, see Manage self-service password reset in Microsoft 365 Lighthouse. For more information, see [Manage self-service password reset in Microsoft 365 Lighthouse](m365-lighthouse-manage-sspr.md). ## Related content -[Plan an Azure Active Directory Multi-Factor Authentication deployment](/azure/active-directory/authentication/howto-mfa-getstarted) (article)\ -[What are security defaults?](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults) (article)\ -[What is Conditional Access?](/azure/active-directory/conditional-access/overview) (article)\ -[Learn how to convert users from per-user MFA to Conditional Access](/azure/active-directory/authentication/howto-mfa-getstarted#convert-users-from-per-user-mfa-to-conditional-access-based-mfa) (article) +[Overview of multifactor authentication in Lighthouse](m365-lighthouse-mfa-overview.md) (article)\ +[Plan an Azure Active Directory Multi-Factor Authentication deployment](/azure/active-directory/authentication/howto-mfa-getstarted) (article)\ +[What are security defaults?](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults) (article)\ +[What is Conditional Access?](/azure/active-directory/conditional-access/overview) (article)\ +[Learn how to convert users from per-user MFA to Conditional Access](/azure/active-directory/authentication/howto-mfa-getstarted#convert-users-from-per-user-mfa-to-conditional-access-based-mfa) (article) |
| lighthouse | M365 Lighthouse Mfa Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-mfa-overview.md | + + Title: "Overview of the Multifactor authentication page in Microsoft 365 Lighthouse" +f1.keywords: NOCSH ++++ Last updated : 06/30/2023+audience: Admin +++ms.localizationpriority: medium ++- Tier1 +- scotvorg +- M365-subscription-management +- Adm_O365 ++- AdminSurgePortfolio +- M365-Lighthouse +search.appverid: MET150 +description: "For Managed Service Providers (MSPs), learn more about multifactor authentication in Microsoft 365 Lighthouse." +++# Overview of the Multifactor authentication page in Microsoft 365 Lighthouse ++Multifactor authentication (MFA) in Azure Active Directory (Azure AD) helps protect your customer tenants against breaches due to lost or stolen credentials by using a second form of authentication to provide an extra layer of security. ++There are several ways to enable MFA: ++- **Conditional Access policies (Recommended)** – Enable conditional access policies for tenants with Azure AD Premium licensing. ++- **Security defaults** – Enable security defaults for tenants without Azure AD Premium licensing. ++- **Per-user MFA** – It isn't recommended to enable MFA on a per-user basis unless the tenant doesn't have Azure AD Premium licensing and you don't want to use security defaults. ++The **Multifactor authentication** page provides detailed information on the status of MFA enablement across your customer tenants and recommended actions to enhance your customers’ security. Select any tenant in the list to see more details about that tenant, including which Conditional Access policies requiring MFA are already configured and which users still need to register for MFA. ++## Multifactor Authentication page ++The Multifactor Authentication page includes the following: ++- MFA enforcement +- MFA registration +- MFA insights +- MFA insights by tenant +++## MFA enforcement ++The MFA enforcement graph measures MFA enforcement progress by tenant, reporting the enforcement status of MFA for each tenant as either: ++- **Conditional Access policy enablement** – one or more policies requiring MFA is enabled. +- **Security defaults** – Security defaults are enabled. +- **No MFA detected** - No Conditional Access policies that require MFA are enabled, and Security defaults have been disabled. ++> [!NOTE] +> The detection of a Conditional Access policy that requires MFA with a deployment state of enabled does not mean that all targeted users will be required to authenticate with MFA. An assessment of a tenant's conditional access policies in Microsoft 365 Lighthouse or the tenant's Azure Active Directory portal is needed to confirm the tenant is secure. ++## MFA registration ++The MFA registration graph measures MFA registration progress by user, reporting the registration status of MFA for each user as either: ++- **Registered** – the user has registered for MFA. +- **Not registered for MFA** – the user hasn't registered for MFA. +- **Excluded from MFA** – the user has been excluded from MFA registration in Lighthouse. +- **Data unavailable due to missing license** – the user is a member of a tenant for which data is unavailable due to a missing license. ++> [!NOTE] +> The exclusion of a user from MFA registration in Lighthouse does not automatically result in the user’s exclusion from the applicable deployment task in Lighthouse or from a Conditional Access policy configured in the tenant. To ensure that the user is excluded from the applicable deployment task in Lighthouse and from Conditional Access policies configured in the tenant, see [Manage multifactor authentication](m365-lighthouse-manage-mfa.md). ++## MFA insights ++The MFA insights table can be filtered by MFA enablement method and availability of MFA registration progress. ++The table provides the following information for each tenant: ++|Column |Description | +|--|--| +|Tenant | The name of the tenant. | +|Total users | The number of users in the tenant. | +|Users excluded from MFA registration | The number of users that have been excluded from MFA registration in Lighthouse. | +|Registration progress | The number of users not excluded from MFA registration in Lighthouse that have registered. <br> **NOTE:** The number of Registered users may include users excluded from MFA registration in Lighthouse. | +|MFA enablement method | The MFA enablement method employed by the tenant. | +|Recommended actions | The actions that are recommended to optimize the security of the tenant. | +|Last refreshed | The date at which the data was last refreshed. | ++### Recommended actions ++Recommended actions are determined for each tenant based on MFA enablement, licensing, and registration progress. ++| **MFA enablement** | **Licensing** | **Registration progress** | **Recommended actions** | +|--|--|--|| +| Conditional Access policy enabled | With Azure AD Premium | Complete | Assess deployment | +| | | Not complete | Assess deployment, complete MFA registration | +| Security defaults | With Azure AD Premium | Complete | Deploy Conditional Access | +| | | Not complete | Deploy Conditional Access, complete MFA registration | +| | Without Azure AD Premium | Data unavailable due to missing license | | +| No MFA detected | With Azure AD Premium | Complete | Deploy Conditional Access | +| | | Not complete | Enable security defaults, complete MFA registration | +| | Without Azure AD Premium | Data unavailable due to missing license | | ++## MFA insights by tenant ++Selecting any tenant from the list opens the MFA insights details pane for that tenant, which provides the following information for each tenant: ++- MFA enablement method +- Conditional access policies +- Users not registered for MFA +- Excluded users +++## MFA enablement method tab ++The tab provides tenant-specific details around the tenant’s MFA enablement method, links to additional information, and the next steps that should be taken to optimize tenant security. ++If the tenant’s MFA enablement status is **No MFA detected**, Lighthouse prompts you to enable security defaults by selecting the **Use security defaults** box. ++## Conditional access policies tab ++The tab lists, links to, and reports the state of each Conditional Access policy detected in the tenant that requires MFA. You can use the links provided to view or edit the detected policy as needed to optimize tenant security. ++## Users not registered for MFA tab ++The tab provides recommended actions for managing MFA registration and lists the user accounts that have already been enabled for MFA but still need to register using their allowed verification options to be capable of using MFA. ++The users not registered for MFA table can be exported, refreshed, or filtered by admins, members, and guest users, and it allows you to select user accounts to email, exclude, or block. ++## Excluded users tab ++The **Excluded users** tab lists the user accounts that are part of the **Microsoft 365 Lighthouse - MFA exclusions** security group and have been excluded from the MFA report. You can export and refresh the list and remove users from the excluded users list. ++## Related content ++[Manage multifactor authentication in Lighthouse](m365-lighthouse-manage-mfa.md) (article)\ +[Plan an Azure Active Directory Multi-Factor Authentication deployment](/azure/active-directory/authentication/howto-mfa-getstarted) (article)\ +[What are security defaults?](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults) (article)\ +[What is Conditional Access?](/azure/active-directory/conditional-access/overview) (article)\ +[Learn how to convert users from per-user MFA to Conditional Access](/azure/active-directory/authentication/howto-mfa-getstarted#convert-users-from-per-user-mfa-to-conditional-access-based-mfa) (article) |
| security | Configure Advanced Scan Types Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-advanced-scan-types-microsoft-defender-antivirus.md | Title: Configure scanning options for Microsoft Defender Antivirus description: You can configure Microsoft Defender Antivirus to scan email storage files, back-up or reparse points, network files, and archived files (such as .zip files). -keywords: advanced scans, scanning, email, archive, zip, rar, archive, reparse scanning -ms.pagetype: security -ms.sitesec: library ms.localizationpriority: medium For details on configuring Microsoft Configuration Manager (current branch), see ### Settings and locations -|Policy item and location|Default setting (if not configured)|PowerShell `Set-MpPreference` parameter or WMI property for `MSFT_MpPreference` class| +|Policy item and location|Default setting <br/>(if not configured)|PowerShell `Set-MpPreference` parameter <br/>or WMI property for `MSFT_MpPreference` class| ||||-|Email scanning <p> **Scan** \> **Turn on e-mail scanning**<p>See [Email scanning limitations](#email-scanning-limitations) (in this article)|Disabled|`-DisableEmailScanning`| -| Script scanning | Enabled | This policy setting allows you to configure script scanning. If you enable or do not configure this setting, script scanning will be enabled. <p>See [Defender/AllowScriptScanning](/windows/client-management/mdm/policy-csp-defender) | -|Scan [reparse points](/windows/win32/fileio/reparse-points) <p> **Scan** \> **Turn on reparse point scanning**|Disabled|Not available <p>See [Reparse points](/windows/win32/fileio/reparse-points)| -|Scan mapped network drives <p> **Scan** \> **Run full scan on mapped network drives**|Disabled|`-DisableScanningMappedNetworkDrivesForFullScan`| -|Scan archive files (such as .zip or .rar files). <p> **Scan** \> **Scan archive files**|Enabled|`-DisableArchiveScanning` <p>The [extensions exclusion list](configure-extension-file-exclusions-microsoft-defender-antivirus.md) will take precedence over this setting.| -|Scan files on the network <p> **Scan** \> **Scan network files**|Enabled|`-DisableScanningNetworkFiles`| -|Scan packed executables <p> **Scan** \> **Scan packed executables**|Enabled|Not available| -|Scan removable drives during full scans only <p> **Scan** \> **Scan removable drives**|Disabled|`-DisableRemovableDriveScanning`| +|Email scanning <br/> **Scan** \> **Turn on e-mail scanning**<br/>See [Email scanning limitations](#email-scanning-limitations) (in this article)|Disabled|`-DisableEmailScanning`| +| Script scanning | Enabled | This policy setting allows you to configure script scanning. If you enable or do not configure this setting, script scanning is enabled. <br/><br/>See [Defender/AllowScriptScanning](/windows/client-management/mdm/policy-csp-defender) | +|Scan [reparse points](/windows/win32/fileio/reparse-points) <br/> **Scan** \> **Turn on reparse point scanning**|Disabled|Not available <br/>See [Reparse points](/windows/win32/fileio/reparse-points)| +|Scan mapped network drives<br/>**Scan** \> **Run full scan on mapped network drives**|Disabled|`-DisableScanningMappedNetworkDrivesForFullScan`| +|Scan archive files (such as .zip or .rar files). <br/>**Scan** \> **Scan archive files**|Enabled|`-DisableArchiveScanning` <br/><br/>The [extensions exclusion list](configure-extension-file-exclusions-microsoft-defender-antivirus.md) will take precedence over this setting.| +|Scan files on the network <br/>**Scan** \> **Scan network files**|Enabled|`-DisableScanningNetworkFiles`| +|Scan packed executables<br/>**Scan** \> **Scan packed executables**|Enabled|Not available <br/><br/>Scan packed executables were removed from the following templates:<br/>- Administrative Templates (.admx) for Windows 11 2022 Update (22H2)<br/>- Administrative Templates (.admx) for Windows 11 October 2021 Update (21H2)| +|Scan removable drives during full scans only<br/>**Scan** \> **Scan removable drives**|Disabled|`-DisableRemovableDriveScanning`| |Specify the level of subfolders within an archive folder to scan <p>**Scan** \> **Specify the maximum depth to scan archive files**|0|Not available|-|Specify the maximum CPU load (as a percentage) during a scan. <p> **Scan** \> **Specify the maximum percentage of CPU utilization during a scan**|50|`-ScanAvgCPULoadFactor` <p>**NOTE**: The maximum CPU load is not a hard limit, but is guidance for the scanning engine to not exceed the maximum on average. Manually run scans will ignore this setting and run without any CPU limits.| -|Specify the maximum size (in kilobytes) of archive files that should be scanned. <p> **Scan** \> **Specify the maximum size of archive files to be scanned**|No limit|Not available <p>The default value of 0 applies no limit| -|Configure low CPU priority for scheduled scans <p> **Scan** \> **Configure low CPU priority for scheduled scans**|Disabled|Not available| +|Specify the maximum CPU load (as a percentage) during a scan. <p> **Scan** \> **Specify the maximum percentage of CPU utilization during a scan**|50|`-ScanAvgCPULoadFactor`<br/><br/> The maximum CPU load is not a hard limit, but is guidance for the scanning engine to not exceed the maximum on average. Manual scans ignore this setting and run without any CPU limits.| +|Specify the maximum size (in kilobytes) of archive files that should be scanned.<br/>**Scan** \> **Specify the maximum size of archive files to be scanned**|No limit|Not available <br/><br/>The default value of 0 applies no limit| +|Configure low CPU priority for scheduled scans<br/>**Scan** \> **Configure low CPU priority for scheduled scans**|Disabled|Not available| > [!NOTE]-> If real-time protection is turned on, files are scanned before they are accessed and executed. The scanning scope includes all files, including files on mounted removable media, such as USB drives. If the device performing the scan has real-time protection or on-access protection turned on, the scan will also include network shares. +> If real-time protection is turned on, files are scanned before they are accessed and executed. The scanning scope includes all files, including files on mounted removable media, such as USB drives. If the device performing the scan has real-time protection or on-access protection turned on, the scan also includes network shares. ## Use PowerShell to configure scanning options -For more information on how to use PowerShell with Microsoft Defender Antivirus, see +For more information on how to use PowerShell with Microsoft Defender Antivirus, see the following articles: - [Manage Microsoft Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-microsoft-defender-antivirus.md) - [Microsoft Defender Antivirus cmdlets](/powershell/module/defender/) Email scanning enables scanning of email files used by Outlook and other mail cl PST files used by Outlook 2003 or older (where the archive type is set to non-unicode) are also scanned, but Microsoft Defender Antivirus cannot remediate threats that are detected inside PST files. -If Microsoft Defender Antivirus detects a threat inside an email message, it will show you the following information to assist you in identifying the compromised email, so you can remediate the threat manually: +If Microsoft Defender Antivirus detects a threat inside an email message, the following information is displayed to assist you in identifying the compromised email so you can remediate the threat manually: - Email subject - Attachment name If Microsoft Defender Antivirus detects a threat inside an email message, it wil On any OS, only the network drives that are mapped at system level, are scanned. User-level mapped network drives aren't scanned. User-level mapped network drives are those that a user maps in their session manually and using their own credentials. -> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) --## See also --- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md)-- [Configure and run on-demand Microsoft Defender Antivirus scans](run-scan-microsoft-defender-antivirus.md)-- [Configure scheduled Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md)-- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) |
| security | Next Generation Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/next-generation-protection.md | Title: Overview of next-generation protection in Microsoft Defender for Endpoint description: Get an overview of next-generation protection in Microsoft Defender for Endpoint. Reinforce the security perimeter of your network by using next-generation protection designed to catch all types of emerging threats. -keywords: Microsoft Defender Antivirus, windows defender, antimalware, virus, malware, threat, detection, protection, security -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: high Microsoft Defender for Endpoint includes next-generation protection to reinforce - [Cloud-delivered protection](cloud-protection-microsoft-defender-antivirus.md), which includes near-instant detection and blocking of new and emerging threats. - [Dedicated protection and product updates](microsoft-defender-antivirus-updates.md), which includes updates related to keeping Microsoft Defender Antivirus up to date. -> [!TIP] -> Next-generation protection is included in both Microsoft Defender for Endpoint Plan 1 and Plan 2. [Learn more about Defender for Endpoint Plan 1 and Plan 2](defender-endpoint-plan-1-2.md) -> Next-generation protection is also included in Microsoft Defender for Business and Microsoft 365 Business Premium. [Compare security features in Microsoft 365 plans for small and medium-sized businesses](../defender-business/compare-mdb-m365-plans.md). --## Configure next-generation protection services +Next-generation protection is included in both [Defender for Endpoint Plan 1 and Plan 2](defender-endpoint-plan-1-2.md). Next-generation protection is also included in Microsoft Defender for Business and Microsoft 365 Business Premium (See [Security features in Microsoft 365 plans for small and medium-sized businesses](../defender-business/compare-mdb-m365-plans.md)). -For information on how to configure next-generation protection services, see [Configure Microsoft Defender Antivirus features](configure-microsoft-defender-antivirus-features.md). +To configure next-generation protection services, see [Configure Microsoft Defender Antivirus features](configure-microsoft-defender-antivirus-features.md). -> [!NOTE] -> Configuration and management is largely the same in Windows Server as in Windows clients. However, there are some differences. +If you're looking for antivirus-related information for other platforms, see one of the following articles: -> [!TIP] -> If you're looking for Antivirus related information for other platforms, see: -> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) -> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) -> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) -> - [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) -> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) -> - [Configure Defender for Endpoint on Android features](android-configure.md) -> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) +- [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) +- [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md) +- [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos) +- [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) +- [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) +- [Configure Defender for Endpoint on Android features](android-configure.md) +- [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md) > [!TIP] > **Performance tip** Due to a variety of factors (examples listed below) Microsoft Defender Antivirus, like other antivirus software, can cause performance issues on endpoint devices. In some cases, you might need to tune the performance of Microsoft Defender Antivirus to alleviate those performance issues. Microsoft's **Performance analyzer** is a PowerShell command-line tool that helps determine which files, file paths, processes, and file extensions might be causing performance issues; some examples are: For information on how to configure next-generation protection services, see [Co > - top scans per file per process > > You can use the information gathered using Performance analyzer to better assess performance issues and apply remediation actions. -> See: [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md). +> See [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md). ++ |
| security | Web Content Filtering | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/web-content-filtering.md | Before trying out this feature, make sure you meet the requirements described in | Requirement | Description | |:|:|-| Subscription | Your subscription must include one of the following:<br/>- [Windows 10/11 Enterprise E5](/windows/deployment/deploy-enterprise-licenses)<br/>- [Microsoft 365 E5](https://www.microsoft.com/microsoft-365/enterprise/e5?activetab=pivot%3aoverviewtab)<br/>- Microsoft 365 E5 Security<br/>- [Microsoft 365 E3](https://www.microsoft.com/microsoft-365/enterprise/e3?activetab=pivot%3aoverviewtab)<br/>- [Microsoft Defender for Endpoint Plan 1 or Plan 2](../defender/eval-defender-endpoint-overview.md)<br/>- [Microsoft Defender for Business](../defender-business/mdb-overview.md)<br/>- [Microsoft 365 Business Premium](https://www.microsoft.com/microsoft-365/business/microsoft-365-business-premium)| +| Subscription | Your subscription must include one of the following:<br/>- [Windows 10/11 Enterprise E5](/windows/deployment/deploy-enterprise-licenses)<br/>- [Microsoft 365 E5](https://www.microsoft.com/microsoft-365/enterprise/e5?activetab=pivot%3aoverviewtab)<br/>- Microsoft 365 A5<br/>- Microsoft 365 E5 Security<br/>- [Microsoft 365 E3](https://www.microsoft.com/microsoft-365/enterprise/e3?activetab=pivot%3aoverviewtab)<br/>- [Microsoft Defender for Endpoint Plan 1 or Plan 2](../defender/eval-defender-endpoint-overview.md)<br/>- [Microsoft Defender for Business](../defender-business/mdb-overview.md)<br/>- [Microsoft 365 Business Premium](https://www.microsoft.com/microsoft-365/business/microsoft-365-business-premium)| | Portal access | You must have access to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. | | Operating system | Your organization's devices must be running one of the following operating systems with the [latest antivirus/antimalware updates](microsoft-defender-antivirus-updates.md): <br/>- Windows 11<br/>- Windows 10 Anniversary Update (version 1607) or later <br/>- For information on MacOS availability, see [Network Protection for MacOS](network-protection-macos.md)<br/>- For information on Linux availability, see [Network Protection for Linux](network-protection-linux.md)| | Related protection | [Windows Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview) and [network protection](network-protection.md) must be enabled on your organization's devices. | Policies can be deployed to block any of the following parent or child categorie **Child abuse images**: Sites that include child abuse images or pornography. -**Criminal activity**: Sites that give instruction on, advice about or promotion of illegal activities. +**Criminal activity**: Sites that give instruction on, advice about, or promotion of illegal activities. **Hacking**: Sites that provide resources for illegal or questionable use of computer software or hardware, including sites that distribute copyrighted material that has been cracked. |
| security | Attack Simulation Training Training Campaigns | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-training-campaigns.md | On the **Target users** page, select who receives the Training campaign. Use the The number of results appears in the **Selected (0/x) users** label. > [!NOTE]+ > Only Microsoft 365 groups are eligible to be selected. + > > Clicking the **Add filters** button clears and replaces any results the **User list** section with the **Filter users by categories**. When you have a list of users or groups in the **User list** section, select some or all of the results by selecting the round check box next to the **Name** column. The number of selected results appears in the **Selected (y/x) users** label. |
| security | Skip Filtering Phishing Simulations Sec Ops Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/skip-filtering-phishing-simulations-sec-ops-mailboxes.md | If your MX record doesn't point to Microsoft 365, the IP address in the `Authent > [!NOTE] > If you're using the [Built-in protection preset security policy](preset-security-policies.md#profiles-in-preset-security-policies) or your custom Safe Links policies have the setting **Do not rewrite URLs, do checks via SafeLinks API only** enabled, time of click protection doesn't treat phishing simuation links in email as threats in Outlook on the web, Outlook for iOS and Android, Outlook for Windows v16.0.15317.10000 or later, and Outlook for Mac v16.74.23061100 or later. If you're using older versions of Outlook, consider disabling the **Do not rewrite URLs, do checks via SafeLinks API only** setting in custom Safe Links policies.-> -> By design, Safe Links sends a `HEAD` request to all URLs in the email message to determine what to do with the URL. Some phishing simulation vendors might show these `HEAD` requests as user clicks, so you might see two user clicks for a URL. This problem isn't an issue with Defender for Office 365. Ask your phishing simulation vendor to fix this problem by ignoring `HEAD` requests. 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Advanced delivery** in the **Rules** section. Or, to go directly to the **Advanced delivery** page, use <https://security.microsoft.com/advanceddelivery>. |