+> [!NOTE]

+> Metric counts include Teams client built-in features, but don't include changes to chat and channel through service integration, such as Teams app posts or replies and emails in the channel.

+You can view the user activity in the Teams report by choosing the **User activity** tab.

+

+|Metric|Mapped metric in Export|Definition|

+|:--|:--|:--|

+|User name <br/> |User Principal Name|The email address of the user. You can display the actual email address or make this field anonymous. <br/> |

+|Tenant name <br/> |Tenant Display Name|The name of an internal or external tenant where a user belongs. <br/> <br/> If a user belongs to an external tenant, corresponding data metrics (for example, post messages, reply messages, etc.) are calculated based on their interactions in shared channels of the adminΓÇÖs tenant. Interactions done by the user in their own tenant (outside of shared channels of the given tenant) are not considered for the admin usage report of given tenant. |

+|Is external <br/> |Is External|Indicates if the user is an external user or not. <br/> |

+|Shared channel tenant names <br/> |Shared Channel Tenant Display Names|The names of internal or external tenants of shared channels where the user participated. <br/> |

+|Channel messages <br/> |Team Chat Message Count|The number of unique messages that the user posted in a team chat during the specified time period. This includes original posts and replies. <br/> |

+|Posts <br/> |Post Messages|The number of post messages in all channels during the specified time period. A post is the original message in a teams chat.<br/> |

+|Replies <br/> |Reply Messages|The number of replied messages in all channels during the specified time period. <br/> |

+|Urgent messages <br/> |Urgent Messages|The number of urgent messages during the specified time period. <br/> |

+|Chat messages <br/> |Private Chat Message Count|The number of unique messages that the user posted in a private chat during the specified time period. <br/> |

+|Total meetings <br/> |Meeting Count|The number of online meetings that the user participated in during the specified time period. <br/> |

+|1:1 calls <br/> |Call Count|The number of 1:1 calls that the user participated in during the specified time period. <br/> |

+|Last activity date (UTC) <br/> |Last Activity Date|The last date that the user participated in a Microsoft Teams activity.<br/> |

+|Meetings participated ad hoc <br/> |Ad Hoc Meetings Attended Count|The number of ad hoc meetings a user participated in during the specified time period. <br/> |

+|Meetings organized ad hoc <br/> |Ad Hoc Meetings Organized Count|The number of ad hoc meetings a user organized during the specified time period. <br/>|

+|Total organized meetings <br/> |Meetings Organized Count|The sum of one-time scheduled, Recurring, ad hoc and unclassified meetings a user organized during the specified time period. <br/> |

+|Total participated meetings <br/> |Meetings Attended Count|The sum of the one-time scheduled, recurring, ad hoc and unclassified meetings a user participated in during the specified time period. <br/> |

+|Meetings organized scheduled one-time <br/> |Scheduled One-time Meetings Organized Count|The number of one-time scheduled meetings a user organized during the specified time period. <br/> |

+|Meetings organized scheduled recurring <br/> |Scheduled Recurring Meetings Organized Count|The number of recurring meetings a user organized during the specified time period. <br/> |

+|Meetings participated scheduled one-time <br/> |Scheduled One-time Meetings Attended Count|The number of the one-time scheduled meetings a user participated in during the specified time period. <br/> |

+|Meetings participated scheduled recurring <br/> |Scheduled Recurring Meetings Attended Count|The number of the recurring meetings a user participated in during the specified time period. <br/> |

+|Is licensed <br/> |Is Licensed|Selected if the user is licensed to use Teams. <br/>|

+|Other activity <br/>|Has Other Action|The User is active but has performed other activities than exposed action types offered in the report (sending or replying to channel messages and chat messages, scheduling or participating in 1:1 calls and meetings). Examples actions are when a user changes the Teams status or the Teams status message or opens a Channel Message post but does not reply. <br/>|

+|Audio Duration| - |The sum of the audio duration of a user used during the specified time period and formatted by ISO 8601 - Wikipedia |

+|Video Duration| - |The sum of the video duration of a user used during the specified time period and formatted by ISO 8601 - Wikipedia |

+|Screen Share Duration| - |The sum of the screen share duration of a user used during the specified time period and formatted by ISO 8601 - Wikipedia |

+|Audio Duration In Seconds|Audio Time (Min)|The sum of the audio duration of a user used during the specified time period |

+|Video Duration In Seconds|Video Time (Min)|The sum of the video duration of a user used during the specified time period |

+|Screen Share Duration In Seconds|Screen Share Time (Min)|The sum of the screen share duration of a user used during the specified time period |

+> [!NOTE]

+> Metric counts include Teams client built-in features, but don't include changes to chat and channel through service integration, such as Teams app posts or replies and emails in the channel.

+[Microsoft Teams usage activity report](../activity-reports/microsoft-teams-usage-activity.md)

+1. On the **Mobile Device Details** page, under **Mobile devices**, select the mobile device, select **Wipe company data**, and then select **Block access**.

+Connect-MgGraph -Scopes "User.ReadWrite.All","Group.ReadWrite.All"

+description: "Learn to verify your domain and set up DNS records for email, Teams, and other services at Namecheap for Microsoft."

+### Add the two required CNAME records for Teams

+If you get this error message it means that you need to add the alias in your on-premises Active Directory. Open Azure Active Directory and select the user account you would like to edit. Select **Properties** > **Attribute Editor** > **Proxyaddresses** and add the required alias, then wait for it to sync to Azure Active directory.

+ A user who tries to access the store will see the following message: **Office store not available. Unfortunately, your organization has disabled access to the Office Store. Please contact your administrator to get access to the store.**

+|Allow users to include screenshots and attachments when they submit feedback to Microsoft|On|Allows users to choose relevant files, screen recordings and screenshots to help Microsoft better understand and troubleshoot their feedback.|

+|Allow Microsoft to follow up on feedback submitted by users|On|Determines if user can share contact info with feedback/survey for followup by Microsoft. Also allows users to get notified of feedback status changes. Users can manage communications settings in the feedback portal.|

+|Allow users to include log files and content samples when feedback is submitted to Microsoft|On|Allows users to include Microsoft generated files such as additional log files and content samples when relevant to feedback they are submitting. Examples may include [Microsoft 365 Copilot](https://blogs.microsoft.com/blog/2023/03/16/introducing-microsoft-365-copilot-your-copilot-for-work/) prompt and response interactions.|

+- Detractors are unhappy customers who are unlikely to recommend your product or service. For example, 1-3 on the 5 point scale.

+- Passives are customers that are satisfied with the service but not enough to recommend your product or service. For example, 4 on the 5 point scale.

+- Promoters- Happy customers that are loyal, enthusiastic and are likely to recommend your product or service. For example, 5 on the 5 point scale.

+>

+> This app is only supported in English.

+ For example, if a staff member has a team meeting or a personal appointment scheduled for 3pm on a Wednesday, Bookings will show that staff member as unavailable to be booked in that time slot. That time will appear as busy or tentative in the Bookings Page view, as shown in the below example.

+ :::image type="content" source="media/bookings-busy-tentative-view-2.png" alt-text="A view of a Bookings Page.":::

+ > [!IMPORTANT]

+ > We highly recommend leaving this setting on (it is turned on by default) to avoid double-bookings and to optimize the availability of your staff members.

+ > Bookings supports up to 100 staff members in a Bookings Page.

+- [Set up Bookings with me](https://support.microsoft.com/office/bookings-with-me-setup-and-sharing-ad2e28c4-4abd-45c7-9439-27a789d254a2)

+1. On the **Basic details** section, enter your business name, address, and phone number you would like to use for your booking page.

+ Title: "Understand your invoice for your Microsoft MCA billing account"

+f1.keywords:

+- 'MACBillingAccountsAddBillingProfileInvoices'

+description: "Learn how to interpret the charges on your invoice for your Microsoft business subscription with an MCA billing account."

+# Understand your invoice for your Microsoft MCA billing account

+This article only applies to customers with a Microsoft Customer Agreement (MCA) billing account type. If you have a Microsoft Online Services Agreement (MOSA) billing account type, see [Understand your invoice for your Microsoft MOSA billing account](understand-your-invoice2.md). [Find out what type of billing account you have](../manage-billing-accounts.md#view-my-billing-accounts).

+The invoice for your Microsoft business subscription provides a summary of the charges and instructions for how to pay your bill. You can [view your online invoice](view-your-bill-or-invoice.md) in the Microsoft 365 admin center. You can also download a copy of your invoice in the Portable Document Format (.PDF) to send via email. If you want to receive the invoice .PDF as an attachment in the email notification, see [Receive your organization's invoices as email attachments](manage-billing-notifications.md#receive-your-organizations-invoices-as-email-attachments).

+## Before you begin

+- [Find out what type of billing account you have](../manage-billing-accounts.md#view-my-billing-accounts).

+- You must have an MCA billing account type and have the billing account owner or contributor role, or the billing profile owner or contributor role to do the tasks in this article.

+> [!NOTE]

+> If you're the person who signed up for the subscription, youΓÇÖre automatically a billing account owner.

+Depending on the billing frequency that you chose when you bought your subscription, you receive an invoice monthly, every three months, every six months, or annually. The amount of time since the last invoice date is called the *Billing Period* and is shown on page one of the invoice, above the Billing Summary section. This time period represents the date range during which charges accrue for the current invoice. If you made a change to your subscription outside of this date range, like adding or removing licenses, the associated charges appear on the invoice for the next billing period.

+> [!NOTE]

+> You can only change the billing frequency for a subscription when you buy, upgrade, or renew a subscription.

+At the end of each billing period, you receive an email that says your new invoice is ready to view or download in the Microsoft 365 admin center. If you have more than one billing profile, you receive an invoice for each billing profile. For more information, see [View your invoice in the Microsoft 365 admin center](view-your-bill-or-invoice.md).

+## Overview of the invoice .PDF

+Your invoice is a .PDF that contains at least three pages. Page one contains general information about the invoice. An invoice summary section indicates the billing profile that is used to pay for the products and services contained in the invoice, the invoice number, and the invoice date. A billing summary section contains the totals for all charges on the invoice, any credits or sales tax, the invoice total, and payment instructions, if applicable. For details about what this information looks like in your invoice, see [Understand page one of your invoice](#understand-page-one-of-your-invoice).

+Page two of the invoice contains a section summary, and details by section. If you have multiple products or services that are paid for with the same billing profile, the section details might continue for several pages. For details about what this information looks like in your invoice, see [Understand page two of your invoice](#understand-page-two-of-your-invoice).

+The last page of the invoice contains payment instructions. For details about what this information looks like in your invoice, see [Understand the last invoice page](#understand-the-last-invoice-page).

+## Understand page one of your invoice

+The top of the first page of your invoice identifies who's accountable for payment, where the bill is sent to, and a summary of charges. The following table explains the fields shown at the top of page one.

+| Sold to |The billing account that identifies the name and address of the legal entity responsible for payment. This information is managed on the <a href="https://go.microsoft.com/fwlink/p/?linkid=2084771" target="_blank">Billing accounts</a> page, where you can find the account agreement and manage roles and permissions. |

+| Bill to |Identifies who receives the invoice. This information is managed on the <a href="https://go.microsoft.com/fwlink/p/?linkid=2103629" target="_blank">Billing profiles</a> page. The billing profile is also shown on the online invoice page, in the **Invoice summary** section. To learn more about billing profiles, see [Understand your Microsoft business billing profile](manage-billing-profiles.md). |

+| Billing Profile |The name of the billing profile used to define invoice properties like **Bill to**, **PO number**, and payment terms. This information is managed on the <a href="https://go.microsoft.com/fwlink/p/?linkid=2103629" target="_blank">Billing profiles</a> page. For more information about billing profiles, see [Understand your Microsoft business billing profile](manage-billing-profiles.md). |

+### Billing Summary

+The **Billing Summary** shows the summary of charges since the previous billing period, any credits that were applied, tax, and the total amount due. The following table explains the fields shown in the Billing Summary of your invoice.

+### Understand page two of your invoice

+The charges for your invoice start on page two and show the cost broken down by product or service. If you have multiple products or services that are paid for with the same billing profile, the section details might continue for several pages. For Azure customers, the charges might be organized by invoice section. For more information about how invoice sections are used with Azure products, see

+[Invoice sections](/azure/billing/billing-mca-overview#invoice-sections) in [Get started with your Microsoft Customer Agreement billing account](/azure/billing/billing-mca-overview). Within each product order, cost is itemized by service family. The following table explains the fields shown on the charges pages in your invoice.

+Line item details vary depending on the type of product you're charged for. For example, for Azure products, the amount of Azure credits applied is shown. Seat-based products show a unit price and quantity. The invoice details show the products purchased, discount or credits that were applied, tax rate and amount, and the line item totals.

+- **Payment instructions**&mdash;The bottom of the invoice contains instructions for how to pay your bill.

+- **Publisher information**&mdash;If you have third-party services in your bill, the name and address of each publisher is listed at the bottom of your invoice.

+## View or download your invoice

+Invoices are available online in the Microsoft 365 admin center. A link to your online invoice is available from your PDF invoice, and from the email notification you receive. [Learn how to view or download your invoice from the Microsoft 365 admin center](view-your-bill-or-invoice.md).

+The online invoice is expandable so that you can view the charges on your invoice and see more details about each item. The online invoice includes:

+### When is my invoice available?

+### How do I pay the amount due on my invoice?

+Payment instructions depend on your payment method and are provided at the bottom of the invoice PDF. If your payment method is a credit or debit card, it's automatically charged within 10 days of the invoice date. If your payment method is by wire transfer, see the information under **Payment Instructions** in the PDF.

+Azure prepayment is available as a payment method only for eligible Azure products and services.

+[View your invoice in the Microsoft 365 admin center](view-your-bill-or-invoice.md) (article)\

+[Understand your invoice for your Microsoft MOSA billing account](understand-your-invoice2.md) (article)\

+[Payment options for your Microsoft business subscription](pay-for-your-subscription.md) (article)\

+[How to pay for your Microsoft business subscription with a billing profile](pay-for-subscription-billing-profile.md)\

+[Manage payment methods for Microsoft business accounts](manage-payment-methods.md) (article)\

+[Billing information for Microsoft 365 for business in Mexico](mexico-billing-info.md) (article)\

+[Minecraft: Education Edition payment options](/education/windows/school-get-minecraft) (article)

+ Title: "Understand your invoice for your Microsoft MOSA billing account"

+- 'UnderstandBillInvoiceM365'

+description: "Learn how to interpret the charges on your invoice for your Microsoft business subscription with an MOSA billing account."

+# Understand your invoice for your Microsoft MOSA billing account

+This article only applies to customers with a Microsoft Online Services Agreement (MOSA) billing account type. If you have a Microsoft Customer Agreement (MCA) billing account type, see [Understand your invoice for your MCA account](understand-your-invoice.md). [Find out what type of billing account you have](../manage-billing-accounts.md#view-my-billing-accounts).

+The invoice for your Microsoft business subscription provides a summary of the charges and instructions for how to pay your bill. You can [view your online invoice](view-your-bill-or-invoice.md) in the Microsoft 365 admin center. You can also download a copy of your invoice in the Portable Document Format (.PDF) to send via email. If you want to receive the invoice .PDF as an attachment in the email notification, see [Receive your organization's invoices as email attachments](manage-billing-notifications.md#receive-your-organizations-invoices-as-email-attachments).

+## Before you begin

+You must be a Global or Billing admin to do the steps described in this article. For more information, see [About admin roles in the Microsoft 365 admin center](../../admin/add-users/about-admin-roles.md).

+## Watch: Understand your invoice

+Depending on the billing frequency that you chose when you bought your subscription, you receive an invoice either monthly or annually. The amount of time since the last invoice date is called the *Billing Period* and shown on page one of the invoice. This time period represents the date range during which charges accrue for the current invoice. If you made a change to your subscription outside of this date range, like adding or removing licenses, the associated charges appear on the invoice for the next billing period.

+> [!NOTE]

+> You can change the billing frequency for a subscription by following the steps in [Change the billing frequency for your Microsoft business subscription](change-payment-frequency.md).

+At the end of each billing period, you receive an email that says your new invoice is ready to view or download in the Microsoft 365 admin center. If you have more than one order, you receive an invoice for each order. For more information, see [View your invoice in the Microsoft 365 admin center](view-your-bill-or-invoice.md).

+- You added or removed licenses from your subscription. Licenses changed mid-term are reflected on the next invoice. You might see a credit and rebill for the previous service period to account for this change. For details about what the information looks like in your invoice, see [Understand page two of your invoice](#understand-page-two-of-your-invoice).

+Your invoice is a .PDF that contains at least two pages. Page one of your invoice contains the billing summary, which includes general information about the invoice, order, amount due, and payment instructions, if applicable. For details about what this information looks like in your invoice, see [Understand page one of your invoice](#understand-page-one-of-your-invoice).

+Page two of your invoice contains details about the billing activity for each subscription during the service period. For details about what this information looks like in your invoice, see [Understand page two of your invoice](#understand-page-two-of-your-invoice).

+## Understand the invoice header

+Finally, the header includes the **Due Date** for payment of the invoice, and shows the total amount due. If you pay for your subscription with a credit or debit card, we charge your card the day after the invoice date.

+## Understand the invoice footer

+The footer appears at the bottom of every invoice page and includes Microsoft business center address. Based on your country/region, the footer might include other information like the phone number to call for billing or technical support, a link to online self-help articles, and the address and tax ID for Microsoft in your country/region.

+## Understand page one of your invoice

+Three addresses appear at the top of the first page of your invoice. The **Sold-To** address is the name and address of the organization that bought the subscription. The **Bill-To** address is the address of your billing department. **Service Usage Address** is the address where the service is used. Usually, these addresses are the same. However, depending on the size and configuration of your organization, these addresses might be different.

+**Due Date** is the date when the invoice payment is due. If your subscription is paid with a credit or debit card, we charge your card the day after the Invoice Date.

+If you chose "invoice" as your subscription payment method, page one contains the **Electronic Funds Transfer** section that shows the Microsoft bank account information for electronic payments (wire transfer, ACH, SEPA, and so on). Usually, your bank has a reference field that you complete when you send a payment. Make sure that you reference the invoice number in that field.

+In some countries/regions, the invoice has a **Support** section that includes instructions on how to view past invoices in the Microsoft 365 admin center. It also includes a link to self-help articles, and for some countries/regions, the support phone number.

+## Understand page two of your invoice

+The product name for your subscription is at the top of page two of your invoice. Below the product name is the formula that explains how the charges are calculated. If you have more than one product in your order, you see a separate section for each product and the associated charges.

+1. Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank>Microsoft 365 admin center</a>.

+ - If youΓÇÖre using the **Simplified view**, select **Subscriptions**.

+ - If youΓÇÖre using the **Dashboard view**, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page.

+2. Select the subscription that you want to change.

+3. On the subscription details page, in the **Subscription and payment settings** section, under **Payment method**, select **Edit invoice**.

+4. At the bottom of the **Edit details for paying by invoice** pane, enter your PO number, then select **Save**.

+If you're a Microsoft 365 global admin, you can use a diagnostic tool that runs within the Microsoft 365 admin center to research unexpected charges from Microsoft that appear on your credit or debit card statement.

+Select the following **Run Tests: Unknown Charge** link to open the diagnostic tool in the Microsoft 365 admin center.

+[View your invoice in the Microsoft 365 admin center](view-your-bill-or-invoice.md) (article)\

+[Understand your invoice for your Microsoft MCA billing account](understand-your-invoice.md) (article) \

+[Payment options for your Microsoft business subscription](pay-for-your-subscription.md) (article) \

+[How to pay for your Microsoft business subscription with a billing profile](pay-for-subscription-billing-profile.md) \

+[Manage payment methods for Microsoft business accounts](manage-payment-methods.md) (article) \

+ Title: "View your invoice in the Microsoft 365 admin center"

+search.appverid: MET150, GEA150

+description: "Learn how to find your invoice or billing statement for a Microsoft business subscription in the Microsoft 365 admin center."

+# View your invoice in the Microsoft 365 admin center

+You can view your invoice for your Microsoft business subscription in the Microsoft 365 admin center. If you need help with interpreting the charges that you see on your invoice, [find out what type of billing account you have](../manage-billing-accounts.md#view-my-billing-accounts), then see either [Understand your invoice for your Microsoft MCA billing account](understand-your-invoice.md) or [Understand your invoice for your Microsoft MOSA billing account](understand-your-invoice2.md) for a detailed walkthrough of the billing statement.

+> [!IMPORTANT]

+> Microsoft 365 services doesnΓÇÖt provide payment receipts. For credit or debit card payments, use the invoice and your credit or debit card billing statement to match your payment.

+You must be a Global or Billing admin to do the steps described in this article. For more information, see [About admin roles in the Microsoft 365 admin center](../../admin/add-users/about-admin-roles.md).

+## View your bill or invoice

+1. Go to the Microsoft 365 admin center.

+ - If you're using the **Simplified view**, select **Subscriptions**, then select **View invoices**.

+ - If you're using the **Dashboard view**, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2102895" target="_blank">Bills & payments</a> page.

+2. Select an invoice from the list to view the details online. If you donΓÇÖt see any invoices, change the date range.

+3. To download the .PDF version of your invoice, select **Download PDF**.

+> [!NOTE]

+> The online version of your invoice looks different from the .PDF version that you download.

+If you want to receive a copy of your invoice in email, see [Manage billing notifications and invoice attachments](manage-billing-notifications.md).

+If you're a Microsoft 365 global admin and you have a Microsoft Online Services Agreement (MOSA) billing account type, you can use a diagnostic tool to research unexpected charges in your invoice. The tool runs within the Microsoft 365 admin center, and lets you investigate charges from Microsoft that appear on your credit or debit card statement. [Find out what type of billing account you have](../manage-billing-accounts.md#view-my-billing-accounts).

+Select the following **Run Tests: Unknown Charge** link to open the diagnostic tool in the Microsoft 365 admin center.

+[Understand your invoice for your Microsoft MCA billing account](understand-your-invoice.md) (article)\

+[Understand your invoice for your Microsoft MOSA billing account](understand-your-invoice2.md) (article)\

+[Payment options for your Microsoft business subscription](pay-for-your-subscription.md) (article)\

+[How to pay for your Microsoft business subscription with a billing profile](pay-for-subscription-billing-profile.md)\

+[Manage payment methods](manage-payment-methods.md) (article)\

+[Billing information for Microsoft 365 for business in Mexico](mexico-billing-info.md) (article)\

+This article only applies to canceling **Dynamics 365**, **Intune**, **Power Platform**, **Windows 365**, **Microsoft Defender for Business**, and **Microsoft 365 for business** subscriptions. If you have an Azure subscription, see [Cancel your Azure subscription](/azure/cost-management-billing/manage/cancel-azure-subscription). If you have Microsoft 365 Family or Personal, see [Cancel a Microsoft 365 subscription](https://support.microsoft.com/office/cancel-a-microsoft-365-subscription-46e2634c-c64b-4c65-94b9-2cc9c960e91b?OCID=M365_DocsCancel_Link).

+- **Quality of Experience**. The percentage of audio streams for which Quality of Experience (QoE) telemetry was received by the Teams service. Data can be received up to 3 days after call completion. If the rate drops, investigate your network configuration to ensure that the Microsoft Teams telemetry URLs are not being blocked.

+- **UDP Stream Establishment**. The percentage of audio streams established over UDP (User Datagram Protocol). Real-time media established over UDP is more efficient and provides better call quality. If the rate drops, investigate your network configuration to ensure that the ports and protocols required by Microsoft Teams are not being blocked.

+1. In the left navigation pane in Lighthouse, select **Tenants**.

+1. In the left navigation pane in Lighthouse, select **Tenants**.

+You can use a local script to onboard Windows client devices. When you run the onboarding script on a device, it creates a trust with Azure Active Directory (if that trust doesn't already exist), enrolls the device in Microsoft Intune (if it isn't already enrolled), and then onboards the device to Defender for Business. If you're not currently using Intune, the local script method is the recommended onboarding method for Defender for Business customers.

+When you run the local script on Mac, it creates a trust with Azure Active Directory (if that trust doesn't already exist), enrolls the Mac in Microsoft Intune (if it isn't already enrolled), and then onboards the Mac to Defender for Business. We recommend that you onboard up to 10 devices at a time using this method.

+9. You're prompted to allow installation of a driver from Microsoft (either *System Extension Blocked* or *Installation is on hold*, or both). You must allow the driver installation. Select **Open Security Preferences** or **Open System Preferences** > **Security & Privacy**, and then select **Allow**.

+> 1. Defender for Business has finished provisioning. In the [Microsoft 365 Defender portal](https://security.microsoft.com), go to **Assets** > **Devices**.<br/>- If you see a message that says, "Hang on! We're preparing new spaces for your data and connecting them," then Defender for Business hasn't finished provisioning. This process is happening now, and it can take up to 24 hours to complete. <br/>- If you see a list of devices, or you're prompted to onboard devices, it means Defender for Business provisioning has completed.

+| Android | 1. On the device, go to the Google Play store.<br/><br/>2. If you haven't already done so, download and install the Microsoft Authenticator app. Sign in, and register your device in the Microsoft Authenticator app. <br/><br/>3. In the Google Play store, search for the Microsoft Defender app, and install it. <br/><br/>4. Open the Microsoft Defender app, sign in, and complete the onboarding process. |

+- The list of built-in exclusions in Windows is kept up-to-date as the threat landscape changes. This article lists some, but not all, of the built-in and automatic exclusions.

+The list of built-in exclusions in Windows is kept up-to-date as the threat landscape changes.

+The list of built-in exclusions in Windows is kept up-to-date as the threat landscape changes. To learn more about these exclusions, see [Microsoft Defender Antivirus exclusions on Windows Server: Built-in exclusions](configure-server-exclusions-microsoft-defender-antivirus.md#built-in-exclusions).

+### July-2023 (Platform: 4.18.23070.1004 | Engine: 1.1.23070.1005)

+

+- Security intelligence update version: **1.395.30.0**

+- Released: **August 9, 2023 (Engine and Platform)**

+- Platform: **4.18.23070.1004**

+- Engine: **1.1.23070.1005**

+- Support phase: **Security and Critical Updates**

+### What's new

+

+- Improved output for [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus) if scan results fail to retrieve

+- Extended management options for configuring security intelligence updates with Intune, Group Policy, and PowerShell

+- Extended management options for disabling IOAV scans over the network using Intune, Group Policy, and PowerShell. The new setting is `ApplyDisableNetworkScanningToIOAV` for [Set-MpPreference](/powershell/module/defender/set-mppreference).

+- Improved the Unified agent installation process to handle [MsMpEng.exe](troubleshooting-mode-scenarios.md#scenario-2-high-cpu-usage-due-to-windows-defender-msmpengexe) debugger extensions, if present

+- Fixed an issue pertaining to showing the exclusions list with PowerShell [Get-MpPreference](/powershell/module/defender/get-mppreference) on systems managed by Intune

+- Fixed warn notifications for two attack surface reduction (ASR) rules ([Block Office applications from injecting code into other processes](attack-surface-reduction-rules-reference.md#block-office-applications-from-injecting-code-into-other-processes) and [Block credential stealing from the Windows local security authority subsystem](attack-surface-reduction-rules-reference.md#block-credential-stealing-from-the-windows-local-security-authority-subsystem))

+- Fixed an issue with running `Update-MpSignature -UpdateSource:MMPC` when using a nonelevated PowerShell console (see [Update-MpSignature](/powershell/module/defender/update-mpsignature))

+- Fixed an issue with [ASR rules deployed via Intune](enable-attack-surface-reduction.md#intune) to display accurately in the Microsoft 365 Defender portal

+- Fixed [tamper protection management](prevent-changes-to-security-settings-with-tamper-protection.md) for customers who have Microsoft 365 E3 or [Defender for Endpoint Plan 1](defender-endpoint-plan-1.md)

+- Improved installation and uninstallation logic on Server SKUs using the modern, unified agent (see [Defender for Endpoint onboarding Windows Server](onboard-windows-server.md))

+- Fixed an issue where `AntivirusSignatureLastUpdated` was incorrect when executing [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus)

+- Addressed a deadlock caused by Microsoft Defender Antivirus in rare cases

+- Added `ProcessId` to ASR Warn exclusion events (see [ASR rules configuration summary card](attack-surface-reduction-rules-report.md#asr-rules-configuration-summary-card))

+- Fixed an issue where values specified in [ThreatSeverityDefaultAction](/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction) weren't honored intermittently

+- Improved error reporting in the [modern, unified agent installer](configure-server-endpoints.md#new-windows-server-2012-r2-and-2016-functionality-in-the-modern-unified-solution)

+- Fixed the overriding logic in the ASR rule [Block all Office applications from creating child processes](attack-surface-reduction-rules-reference.md#block-all-office-applications-from-creating-child-processes) configured in warn mode

+- Added support for scanning Zstandard (Zstd) containers/archives

+

+### Known issues

+

+- None

+*Microsoft has released a platform update (**4.18.23050.9**) for the May 2023 release.*

+- Fixed a performance issue when building and validating the Microsoft Defender Antivirus cache

+*Microsoft released a platform update (**4.18.23050.5**) for the May 2023 release, followed by [an additional update](#may-2023-update-platform-418230509).*

+- Removed Image File Execution Options (IFEO) debugger value during installation, which can be used to prevent service starts

+## April-2023 (Platform: 4.18.2304.8 | Engine: 1.1.20300.3)

+- Security intelligence update version: **1.387.2997.0**

+- Release date: **May 2, 2023 (Engine) / May 2, 2023 (Platform)**

+- Platform: **4.18.2304.8**

+- Engine: **1.1.20300.3**

+- Support phase: **Technical upgrade support (only)**

+### What's new

+- **Beginning in May 2023, the Platform and Engine version schema have a new format**. Here's what the new version format looks like:

+ - Platform: `4.18.23050.1`

+ - Engine: `1.1.23050.63000`

+- Fixed memory leak in behavior monitoring

+- Improved resiliency of signature loading and platform updates

+- Quarantine and restore support for [WMI](use-wmi-microsoft-defender-antivirus.md)

+- Fixed attack surface reduction (ASR) rule output with [Get-MpPreference](/powershell/module/defender/get-mppreference)

+- Fixed MSERT to only use release engine version

+- Improved the enforcement of exclusions

+- Added support for enabling real-time protection and signature updates during OOBE

+- Fixed localization for Defender events

+- Deprecated real-time signature delivery setting

+- Updated missing setting (ValidateMapsConnection) in [MpCmdRun.exe](command-line-arguments-microsoft-defender-antivirus.md)

+- Fixed abandoned threats in the Windows Security app

+- Fixed a service-hang issue that caused invalid outputs to display in [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus)

+### Known issues

+- None

+> If you are running the Microsoft 365 Defender preview program you can now experience the new Microsoft Defender 365 Unified role-based access control (RBAC) model. For more information, see [Microsoft Defender 365 Unified role-based access control (RBAC)](../defender/manage-rbac.md).

+ The following permissions are required:

+ For Microsoft 365 Defender Unified role-based access control (RBAC):

+ - Add file collection permission in Microsoft 365 Defender Unified (RBAC)

+

+ For Microsoft Defender for Endpoint role-based access control (RBAC):

+ - **Defender Vulnerability Management** - View Defender Vulnerability Management data in the portal

+ - **Defender Vulnerability Management - Exception handling** - Create new exceptions and manage active exceptions

+ - **Defender Vulnerability Management - Remediation handling** - Submit new remediation requests, create tickets, and manage existing remediation activities

+ - **Defender Vulnerability Management - Application handling** - Apply immediate mitigation actions by blocking vulnerable applications, as part of the remediation activity and manage the blocked apps and perform unblock actions

+ - **Defender Vulnerability Management ΓÇô Manage security baselines assessment profiles** - Create and manage profiles so you can assess if your devices comply to security industry baselines.

+> [!NOTE]

+> You can now control access and grant granular permissions for Microsoft Defender Vulnerability Management as part of the Microsoft 365 Defender Unified RBAC model. For more information, see [Microsoft Defender 365 Unified role-based access control (RBAC)](../defender/manage-rbac.md).

+- **Defender Vulnerability Management** - View Defender Vulnerability Management data in the portal

+- **Defender Vulnerability Management - Exception handling** - Create new exceptions and manage active exceptions

+- **Defender Vulnerability Management - Remediation handling** - Submit new remediation requests, create tickets, and manage existing remediation activities

+- **Defender Vulnerability Management - Application handling** - Apply immediate mitigation actions by blocking vulnerable applications, as part of the remediation activity and manage the blocked apps and perform unblock actions

+**Defender Vulnerability Management ΓÇô Manage security baselines assessment profiles** - Create and manage profiles so you can assess if your devices comply to security industry baselines.

+### Microsoft Defender Vulnerability Management permissions are now integrated with Microsoft 365 Defender Unified role-based access control (RBAC)

+You can now control access and grant granular permissions for Microsoft Defender Vulnerability Management as part of the Microsoft 365 Defender Unified RBAC model. For more information, see [Microsoft Defender 365 Unified role-based access control (RBAC)](../defender/manage-rbac.md). You can add the new permissions to a custom role by selecting them from the **Security posture** permissions group when creating the role. For more information, see [Create custom roles with Microsoft 365 Defender Unified RBAC](../defender/create-custom-rbac-roles.md).

+### Microsoft Defender Vulnerability Management Standalone is now Generally Available

+To learn more about what's included in Microsoft Defender Vulnerability Management plans, see [Compare Microsoft Defender Vulnerability Management plans and capabilities](defender-vulnerability-management-capabilities.md).

+- [Microsoft Defender Vulnerability Management](https://go.microsoft.com/fwlink/?linkid=2229011)

+### Server coverage

+Defender Experts for XDR also covers serversΓÇöwhether on premises or on a hyperscale cloud service providerΓÇöthat have Defender for Endpoint deployed on them with a Microsoft Defender for Server license. For Defender Experts coverage, a server is considered as a user account for billing. The service doesnΓÇÖt cover Microsoft Defender for Cloud.

+[Learn more about specific hardware and software requirements](/microsoft-365/security/defender-endpoint/minimum-requirements).

+### Server coverage

+Defender Experts for XDR also covers serversΓÇöwhether on premises or on a hyperscale cloud service providerΓÇöthat have Defender for Endpoint deployed on them with a Microsoft Defender for Server license. For Defender Experts coverage, a server is considered as a user account for billing. The service doesnΓÇÖt cover Microsoft Defender for Cloud.

+[Learn more about specific hardware and software requirements](/microsoft-365/security/defender-endpoint/minimum-requirements).

+### Ask Defender Experts

+This article describes how existing roles and permissions in Microsoft Defender for Endpoint, Microsoft Defender Vulnerability Management and Microsoft Defender for Office 365 (Exchange Online Protection), Microsoft Defender for Identity, and Azure Active Directory roles map to the roles and permission in the Microsoft 365 Defender Unified RBAC model.

+- [Microsoft Defender Vulnerability Management](https://go.microsoft.com/fwlink/?linkid=2229011)

+1. [Map Defender for Endpoint and Defender Vulnerability Management permissions](#map-defender-for-endpoint-and-defender-vulnerability-management-permissions-to-the-microsoft-365-defender-rbac-permissions)

+### Map Defender for Endpoint and Defender Vulnerability Management permissions to the Microsoft 365 Defender RBAC permissions

+|Defender for Endpoint and Defender Vulnerability Management permissions|Microsoft 365 Defender Unified RBAC permission|

+|View data - Defender Vulnerability Management|Security posture \ Posture management \ Vulnerability management (read)|

+|Active remediation actions - Defender Vulnerability Management - Exception handling|Security posture \ Posture management \ Exception handling (manage)|

+|Active remediation actions - Defender Vulnerability Management - Remediation handling|Security posture \ posture management \ Remediation handling (manage)|

+|Active remediation actions - Defender Vulnerability Management - Application handling|Security posture \ Posture management \ Application handling (manage)|

+|Defender Vulnerability management ΓÇô Manage security baselines assessment profiles|Security posture \ posture management \ Security baselines assessment (manage)|

+Use this table to learn about the permissions assigned by default for each workload (Defender for Endpoint, Defender Vulnerability Management, Defender for Office and Defender for Identity) in Microsoft 365 Defender Unified RBAC to each global Azure Active Directory role.

+|Global administrator|Security operations \ Security data \ Security data basics (read)</br>Security operations \ Security data \ Alerts (manage) </br>Security operations \ Security data \ Response (manage)</br>Security posture \ Posture management \ Secure Score (read) </br> Security posture \ Posture management \ Secure Score (manage)</br>Authorization and settings \ Authorization \ (All permissions)</br>Authorization and settings \ Security settings \ (All permissions)</br>Authorization and settings \ System settings \ (All permissions) |_**Defender for Endpoint and Defender Vulnerability Management permissions only permissions**_ </br>Security operations \ Basic live response (manage)</br>Security operations \ Advanced live response (manage) </br> Security operations \ Security data \ File collection (manage) </br>Security posture \ Posture management \ Vulnerability management (read)</br>Security posture \ Posture management \ Exception handling (manage)</br>Security posture \ Posture management \ Remediation handling (manage)</br>Security posture \ Posture management \ Application handling (manage)</br>Security posture \ Posture management \ Security baseline assessment (manage)</br></br> _**Defender for Office only permissions**_ </br> Security operations \ Security data \ Email quarantine (manage)</br>Security operations \ Security data \ Email advanced actions (manage)</br>Security operations \ Raw data (Email & collaboration) \ Email message headers (read)|

+|Global reader|Security operations \ Security data \ Security data basics (read)</br>Security posture \ Posture management \ Secure Score (read) </br>|_**Defender for Endpoint and Defender Vulnerability Management permissions only permissions**_ </br>Security posture \ Posture management \ Vulnerability management (read)</br></br> _**Defender for Office only permissions**_ </br> Security operations \ Security data \ Response (manage)</br>Security operations \ Raw data (Email & collaboration) \ Email message headers (read)</br>Authorization and settings \ Authorization \ (read) </br></br>_**Defender for Office and Defender for Identity only permissions**_ </br>Authorization and settings \ Security settings \ (read)</br>Authorization and settings \ System settings \ (read)|

+|Security reader|Security operations \ Security data \ Security data basics (read)</br>Security posture \ Posture management \ Secure Score (read) </br>|_**Defender for Endpoint and Defender Vulnerability Management permissions only permissions**_ </br>Security posture \ Posture management \ Vulnerability management (read)</br></br> _**Defender for Office only permissions**_ </br> Security operations \ Security data \ Response (manage)</br>Security operations \ Raw data (Email & collaboration) \ Email message headers (read) </br></br>_**Defender for Office and Defender for Identity only permissions**_ </br>Authorization and settings \ Security settings \ (read)</br>Authorization and settings \ System settings \ (read)|

+|Security operator|Security operations \ Security data \ Security data basics (read)</br>Security operations \ Security data \ Alerts (manage) </br>Security operations \ Security data \ Response (manage)</br>Security posture \ Posture management \ Secure Score (read)</br>Authorization and settings \ Security settings \ (All permissions)|_**Defender for Endpoint and Defender Vulnerability Management permissions only permissions**_</br>Security operations \ Security data \ Basic live response (manage)</br>Security operations \ Security data \ Advanced live response (manage)</br> Security operations \ Security data \ File collection (manage) </br>Security posture \ Posture management \ Vulnerability management (read)</br>Security posture \ Posture management \ Exception handling (manage)</br>Security posture \ Posture management \ Remediation handling (manage)</br></br>_**Defender for Office only permissions**_ </br>Security operations \ Raw data (Email & collaboration) \ Email message headers (read)</br>Authorization and settings \ System settings \ (All permissions)</br></br>_**Defender for Identity only permissions**_ </br>Authorization and settings \ System settings \ (read)|

+- [Microsoft Defender Vulnerability Management](https://go.microsoft.com/fwlink/?linkid=2229011)

+- [Microsoft Defender Vulnerability Management](https://go.microsoft.com/fwlink/?linkid=2229011)

+Permissions for managing the organization's security posture and performing vulnerability management.

+|Vulnerability management|Read|View Defender Vulnerability Management data for the following: software and software inventory, weaknesses, missing KBs, advanced hunting, security baselines assessment, and devices.|

+|Exception handling|Manage|Create security recommendation exceptions and manage active exceptions in Defender Vulnerability Management.|

+|Remediation handling|Manage|Create remediation tickets, submit new requests, and manage remediation activities in Defender Vulnerability Management.|

+|Application handling|Manage|Manage vulnerable applications and software, including blocking and unblocking them in Defender Vulnerability Management.|

+- [Microsoft Defender Vulnerability Management](https://go.microsoft.com/fwlink/?linkid=2229011)

+- [Microsoft Defender Vulnerability Management](https://go.microsoft.com/fwlink/?linkid=2229011)

+- [Microsoft Defender Vulnerability Management](https://go.microsoft.com/fwlink/?linkid=2229011)

+|Microsoft Defender Vulnerability Management | Centralized permissions management for all Defender Vulnerability Management capabilities.|

+|Microsoft Defender for Office 365|Support for all scenarios that were controlled by **Exchange Online Protection roles** (EOP), configured in the Microsoft 365 Defender portal under **Permissions** \> **Email & collaboration roles**. </br></br> **Note:** Scenarios that adhere to Exchange Online roles are not impacted by this new model and will still be managed by Exchange Online. The Microsoft 365 Defender RBAC model will initially be available for organizations with Microsoft Defender for Office Plan 2 licenses only. This capability is not available to users on trial licenses.|

+### Microsoft Defender Vulnerability Management permissions are now integrated with Microsoft 365 Defender Unified role-based access control (RBAC)

+You can now control access and grant granular permissions for Microsoft Defender Vulnerability Management as part of the Microsoft 365 Defender Unified RBAC model. For more information, see [Microsoft Defender 365 Unified role-based access control (RBAC)](../defender/manage-rbac.md). You can add the new permissions to a custom role by selecting them from the **Security posture** permissions group when creating the role. For more information, see [Create custom roles with Microsoft 365 Defender Unified RBAC](./create-custom-rbac-roles.md).

+### Microsoft Secure Score permissions integration with Microsoft 365 Defender Unified role-based access control (RBAC) is now in Public Preview

+You can control access and grant granular permissions for the Microsoft Secure Score experience as part of the Microsoft 365 Defender Unified RBAC model. For more information, see [Manage permissions with Microsoft 365 Defender Unified role-based access control(RBAC)](./microsoft-secure-score.md#manage-permissions-with-microsoft-365-defender-unified-role-based-access-controlrbac).

+### A new file collection permission in Microsoft 365 Defender Unified RBAC is now in Public Preview

+You can now assign a new granular permission in Microsoft 365 Defender Unified RBAC that allows users to collect or download files for analysis. This permission enables Microsoft Defender for Endpoint users download files directly from the file page and during a live response investigation in the live response console. You can add the new permission to a custom role by selecting it from the **Security operations** permissions group when creating the role. For more information, see [Create custom roles with Microsoft 365 Defender Unified RBAC](./create-custom-rbac-roles.md).

+ - **Default**: This is the default value. This value is the same as selecting **High confidence phishing messages**.

+

+ > [!NOTE]

+ > Currently, in U.S. Government organizations (Microsoft 365 GCC, GCC High, and DoD), the value **Default** is the same as selecting **None**.

+ The priority order matters if you have the same recipient intentionally or unintentionally included in multiple policies, because *only* the first policy of that type (anti-spam, anti-malware, anti-phishing, etc.) is applied to that recipient, regardless of how many other policies that the recipient is included in. There's never a merging or combining of the settings in multiple policies for the recipient. The recipient is unaffected by the settings of the remaining policies of that type.

+For example, the group named "Contoso Executives" is included in the following policies:

+## Appendix

+It's important to understand how user allows and blocks, tenant allows and blocks, and filtering stack verdicts in EOP and Defender for Office 365 compliment or contradict each other.

+- For information about filtering stacks and how they're combined, see [Step-by-step threat protection in Microsoft Defender for Office 365](protection-stack-microsoft-defender-for-office365.md).

+- After the filtering stack determines a verdict, only then are tenant policies and their configured actions evaluated.

+- If the same email address or domain exists in a user's Safe Senders list and Blocked Senders list, the Safe Senders list takes precedence.

+- If the same entity (email address, domain, spoofed sending infrastructure, file, or URL) exists in an allow entry and a block entry in the Tenant Allow/Block List, the block entry takes precedence.

+### User allows and blocks

+Entries in a user's _safelist collection_ (the Safe Senders list, the Safe Recipients list, and the Blocked Senders list on each mailbox) are able to override some filtering stack verdicts as described in the following table:

+|Filtering stack verdict|User's Safe Senders/Recipients list|User's Blocked Senders list|

+||||

+|Malware|**Filter wins**: Email quarantined|**Filter wins**: Email quarantined|

+|High confidence phishing|**Filter wins**: Email quarantined|**Filter wins**: Email quarantined|

+|Phishing|**User wins**: Email delivered to user's Inbox|**Tenant wins**: The applicable anti-spam policy determines the action|

+|High confidence spam|**User wins**: Email delivered to user's Inbox|**User wins**: Email delivered to user's Junk Email folder|

+|Spam|**User wins**: Email delivered to user's Inbox|**User wins**: Email delivered to user's Junk Email folder|

+|Bulk|**User wins**: Email delivered to user's Inbox|**User wins**: Email delivered to user's Junk Email folder|

+|Not spam|**User wins**: Email delivered to user's Inbox|**User wins**: Email delivered to user's Junk Email folder|

+For more information about the safelist collection and anti-spam settings on user mailboxes, see [Configure junk email settings on Exchange Online mailboxes](configure-junk-email-settings-on-exo-mailboxes.md).

+### Tenant allows and blocks

+Tenant allows and blocks are able to override some filtering stack verdicts as described in the following tables:

+- [Advanced delivery policy](skip-filtering-phishing-simulations-sec-ops-mailboxes.md) (skip filtering for designated SecOps mailboxes and phishing simulation URLs):

+ |Filtering stack verdict|Advanced delivery policy allow|

+ |||

+ |Malware|**Tenant wins**: Email delivered to mailbox|

+ |High confidence phishing|**Tenant wins**: Email delivered to mailbox|

+ |Phishing|**Tenant wins**: Email delivered to mailbox|

+ |High confidence spam|**Tenant wins**: Email delivered to mailbox|

+ |Spam|**Tenant wins**: Email delivered to mailbox|

+ |Bulk|**Tenant wins**: Email delivered to mailbox|

+ |Not spam|**Tenant wins**: Email delivered to mailbox|

+- [Enhanced Filtering for Connectors](/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) (skip listing):

+ |Filtering stack verdict|Enhanced Filtering|

+ |||

+ |Malware|**Filter wins**: Email quarantined|

+ |High confidence phishing|**Tenant wins**: Email delivered to mailbox|

+ |Phishing|**Tenant wins**: Email delivered to mailbox|

+ |High confidence spam|**Tenant wins**: Email delivered to mailbox|

+ |Spam|**Tenant wins**: Email delivered to mailbox|

+ |Bulk|**Tenant wins**: Email delivered to mailbox|

+ |Not spam|**Tenant wins**: Email delivered to mailbox|

+- IP Allow List and IP Block List in [connection filter policies](connection-filter-policies-configure.md):

+ |Filtering stack verdict|IP Allow List|IP Block List|

+ ||||

+ |Malware|**Filter wins**: Email quarantined|**Filter wins**: Email quarantined|

+ |High confidence phishing|**Filter wins**: Email quarantined|**Filter wins**: Email quarantined|

+ |Phishing|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Email silently dropped|

+ |High confidence spam|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Email silently dropped|

+ |Spam|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Email silently dropped|

+ |Bulk|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Email silently dropped|

+ |Not spam|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Email silently dropped|

+- [Exchange mail flow rules](/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules) (also known as transport rules):

+ |Filtering stack verdict|Mail flow rule allows|Mail flow rule blocks|

+ ||||

+ |Malware|**Filter wins**: Email quarantined|**Filter wins**: Email quarantined|

+ |High confidence phishing|**Filter wins**: Email quarantined except in complex routing|**Filter wins**: Email quarantined|

+ |Phishing|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Phishing action in the applicable anti-spam policy|

+ |High confidence spam|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Email delivered to user's Junk Email folder|

+ |Spam|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Email delivered to user's Junk Email folder|

+ |Bulk|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Email delivered to user's Junk Email folder|

+ |Not spam|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Email delivered to user's Junk Email folder|

+- Allow and block settings in [anti-spam policies](anti-spam-policies-configure.md):

+ - Allowed sender and domain list.

+ - Blocked sender and domain list.

+ - Block messages from specific countries or in specific languages.

+ - Block messages based on [Advanced Spam Filter (ASF) settings](anti-spam-policies-asf-settings-about.md).

+ |Filtering stack verdict|Anti-spam policy allows|Anti-spam policy blocks|

+ ||||

+ |Malware|**Filter wins**: Email quarantined|**Filter wins**: Email quarantined|

+ |High confidence phishing|**Filter wins**: Email quarantined|**Filter wins**: Email quarantined|

+ |Phishing|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Phishing action in the applicable anti-spam policy|

+ |High confidence spam|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Email delivered to user's Junk Email folder|

+ |Spam|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Email delivered to user's Junk Email folder|

+ |Bulk|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Email delivered to user's Junk Email folder|

+ |Not spam|**Tenant wins**: Email delivered to mailbox|**Tenant wins**: Email delivered to user's Junk Email folder|

+- [Allow entries in the Tenant Allow/Block List](tenant-allow-block-list-about.md#allow-entries-in-the-tenant-allowblock-list):

+ |Filtering stack verdict|Email address/domain|

+ |||

+ |Malware|**Filter wins**: Email quarantined|

+ |High confidence phishing|**Filter wins**: Email quarantined|

+ |Phishing|**Tenant wins**: Email delivered to mailbox|

+ |High confidence spam|**Tenant wins**: Email delivered to mailbox|

+ |Spam|**Tenant wins**: Email delivered to mailbox|

+ |Bulk|**Tenant wins**: Email delivered to mailbox|

+ |Not spam|**Tenant wins**: Email delivered to mailbox|

+- [Block entries in the Tenant Allow/Block List](tenant-allow-block-list-about.md#block-entries-in-the-tenant-allowblock-list):

+ |Filtering stack verdict|Email address/domain|Spoof|File|URL|

+ ||||||

+ |Malware|**Filter wins**: Email quarantined|**Filter wins**: Email quarantined|**Tenant wins**: Email quarantined|**Filter wins**: Email quarantined|

+ |High confidence phishing|**Tenant wins**: Email quarantined|**Filter wins**: Email quarantined|**Tenant wins**: Email quarantined|**Tenant wins**: Email quarantined|

+ |Phishing|**Tenant wins**: Email quarantined|**Tenant wins**: Spoof action in the applicable anti-phishing policy|**Tenant wins**: Email quarantined|**Tenant wins**: Email quarantined|

+ |High confidence spam|**Tenant wins**: Email quarantined|**Tenant wins**: Spoof action in the applicable anti-phishing policy|**Tenant wins**: Email quarantined|**Tenant wins**: Email quarantined|

+ |Spam|**Tenant wins**: Email quarantined|**Tenant wins**: Spoof action in the applicable anti-phishing policy|**Tenant wins**: Email quarantined|**Tenant wins**: Email quarantined|

+ |Bulk|**Tenant wins**: Email quarantined|**Tenant wins**: Spoof action in the applicable anti-phishing policy|**Tenant wins**: Email quarantined|**Tenant wins**: Email quarantined|

+ |Not spam|**Tenant wins**: Email quarantined|**Tenant wins**: Spoof action in the applicable anti-phishing policy|**Tenant wins**: Email quarantined|**Tenant wins**: Email quarantined|

+### User and tenant settings conflict

+The following table describes how conflicts are resolved if an email is affected by both user allow/block settings and tenant allow/block settings:

+|Type of tenant allow/block|User's Safe Senders/Recipients list|User's Blocked Senders list|

+||||

+|Block entries in the Tenant Allow/Block List for: <ul><li>Email addresses and domains</li><li>Files</li><li>URLs</li></ul>|**Tenant wins**: Email quarantined|**Tenant wins**: Email quarantined|

+|Block entries for spoofed senders in the Tenant Allow/Block List|**Tenant wins**: Spoof intelligence action in the applicable anti-phishing policy|**Tenant wins**: Spoof intelligence action in the applicable anti-phishing policy|

+|Advanced delivery policy|**User wins**: Email delivered to mailbox|**Tenant wins**: Email delivered to mailbox|

+|Block settings in anti-spam policies|**User wins**: Email delivered to mailbox|**User wins**: Email delivered to user's Junk Email folder|

+|Allows by: <ul><li>Mail flow rules</li><li>IP Allow List (connection filter policy)</li><li>Allowed sender and domain list (anti-spam policies)</li><li>Tenant Allow/Block List</li></ul>|**User wins**: Email delivered to mailbox|**User wins**: Email delivered to user's Junk Email folder|

+ Title: Microsoft Defender for Office 365 Plan 2 support for Microsoft Teams

+description: Admins can learn about Microsoft Teams features in Microsoft Defender for Office 365 Plan 2.

+# Microsoft Defender for Office 365 Plan 2 support for Microsoft Teams

+With the increased use of collaboration tools like Microsoft Teams, the possibility of malicious attacks using chat messages has also increased. Microsoft Defender for Office 365 already provides time of click protection for URLs and files in Teams messages through [Safe Links for Microsoft Teams](safe-links-about.md#safe-links-settings-for-microsoft-teams) and [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](safe-attachments-for-spo-odfb-teams-about.md).

+In Microsoft 365 E5 and Defender for Office 365 Plan 2, we've extended Teams protection with a set of capabilities that are designed to disrupt the attack chain:

+- **Report suspicious Teams messages**: Users can report malicious Teams messages. Depending on the reported message settings in the organization, the reported messages go to the specified reporting mailbox, to Microsoft, or both. For more information, see [User reported settings in Teams](submissions-teams.md).

+- **Zero-hour auto protection (ZAP) for Teams**: ZAP is an existing email protection feature that detects and neutralizes spam, phishing, and malware messages after delivery by moving the messages to the Junk Email folder or quarantine.

+ ZAP for Teams quarantines messages in Teams chats or channels that are found to be malware or high confidence phishing. For more information, see [Zero-hour auto purge (ZAP) in Microsoft Teams](zero-hour-auto-purge.md#zero-hour-auto-purge-zap-in-microsoft-teams).

+ Instructions to configure ZAP for Teams protection are in the next section.

+- **Teams messages in quarantine**: As with email messages that are identified as malware or high confidence phishing, only admins are able to manage Teams messages that are quarantined by ZAP for Teams by default. For more information, see [Manage quarantined Teams messages](quarantine-admin-manage-messages-files.md#use-the-microsoft-365-defender-portal-to-manage-microsoft-teams-quarantined-messages).

+- The **Teams Message Entity Panel** is a single place to store all Teams message metadata for immediate SecOps review. Any threats coming from Teams chats, group chats, meeting chats, and other channels can be found in one place as soon as they're assessed. For more information, see [Teams Message Entity Panel for Microsoft Teams](teams-message-entity-panel.md).

+- **Attack simulation training using Teams messages**: To ensure users are resilient to phishing attacks in Microsoft Teams, admins can configure phishing simulations using Teams messages instead of email messages. For more information, see [Microsoft Teams in Attack simulation training](attack-simulation-training-teams.md).

+## Configure ZAP for Teams protection in Defender for Office 365 Plan 2

+1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to **Settings** \> **Email & collaboration** \> **Microsoft Teams protection**. Or, to go directly to the **Microsoft Teams protection** page, use <https://security.microsoft.com/securitysettings/teamsProtectionPolicy>.

+2. On the **Microsoft Teams protection** page, verify the toggle in the **Zero-hour auto purge (ZAP)** section:

+ - **Turn on ZAP for Teams**: Verify the toggle is **On** :::image type="icon" source="../../media/scc-toggle-on.png" border="false":::.

+ - **Turn off ZAP for Teams**: Slide the toggle to **Off** :::image type="icon" source="../../media/scc-toggle-off.png" border="false":::.

+ > [!NOTE]

+ > Before August 22, 2023, even if the toggle is **On**, do the following steps to activate ZAP for Teams protection:

+ >

+ > 1. Slide the toggle to **Off** :::image type="icon" source="../../media/scc-toggle-off.png" border="false":::, select **Save** at the bottom of the page, and then select **OK** in the confirmation dialog that opens.

+ > 2. Slide the toggle to **On** :::image type="icon" source="../../media/scc-toggle-on.png" border="false":::, select **Save** at the bottom of the page, and then select **OK** in the confirmation dialog that opens.

+ >

+ > Before August 22, 2023, run the following command in [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) to verify that ZAP for Teams protection is turned on: `Get-TeamsProtectionPolicy | Format-List ZapEnabled`. The value True means ZAP for Teams is turned on. The value False means ZAP for Teams is turned off.

+ >

+ > After August 22, 2023, ZAP for Teams protection is turned on and functional by default (**On** on the **Microsoft Teams protection** page means ZAP for Teams is turned on, so there's no need to confirm in PowerShell).

+3. When the toggle is **On** :::image type="icon" source="../../media/scc-toggle-on.png" border="false":::, use the remaining settings on the page to customize ZAP for Teams protection:

+ - **Quarantine policies** section: You can select the existing quarantine policy to use for messages that are quarantined by ZAP for Teams protection as **Malware** or **High confidence phishing**. Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. For more information, see [Anatomy of a quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy).

+ > [!NOTE]

+ > Quarantine notifications are disabled in the policy named AdminOnlyAccessPolicy. To notify recipients that have messages quarantined as malware or high confidence phishing, create or use an existing quarantine policy where quarantine notifications are turned on. For instructions, see [Create quarantine policies in the Microsoft 365 Defender portal](quarantine-policies.md#step-1-create-quarantine-policies-in-the-microsoft-365-defender-portal).

+ - **Exclude these participants** section: Specify the **Users**, **Groups**, or **Domains** to exclude from ZAP for Teams protection. Exclusions matter for message _recipients_, not message _senders_. For more information, see [Zero-hour auto purge (ZAP) in Microsoft Teams](zero-hour-auto-purge.md#zero-hour-auto-purge-zap-in-microsoft-teams).

+ > [!IMPORTANT]

+ > Unlike all other security policies in Exchange Online Protection and Defender for Office 365, multiple different types of exceptions for ZAP for Teams protection use OR logic instead of AND. The message is excluded from ZAP for Teams protection for recipients that match _any_ of the specified filters. For example, you configure exclusions with the following values:

+ >

+ > - Users: romain@contoso.com

+ > - Groups: Executives

+ >

+ > The user romain@contoso.com and members of the Executives group are excluded from ZAP for Teams protection.

+4. When you're finished on the **Microsoft Teams protection** page, select **Save**.

+### Use Exchange Online PowerShell to configure ZAP for Teams protection

+If you'd rather use [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell) to configure ZAP for Microsoft Teams, the following cmdlets are involved:

+- The Teams protection policy (**\*-TeamsProtectionPolicy** cmdlets) turns ZAP for Teams on and off and specifies the quarantine policies to use for malware and high confidence phishing detections.

+- The Teams protection policy rule (**\*-TeamsProtectionPolicyRule** cmdlets) identifies the Teams protection policy and specifies any exceptions for ZAP for Teams protection (users, groups, or domains).

+**Notes**:

+- There's only one Teams protection policy in an organization. By default, that policy is named Teams Protection Policy.

+- Using the **New-TeamsProtectionPolicy** cmdlet is meaningful only if there's no Teams protection policy in the organization (the **Get-TeamsProtectionPolicy** cmdlet returns nothing). You can run the cmdlet without error, but no new Teams protection policies are created if one already exists.

+- You can't remove an existing Teams protection policy or Teams protection policy rule (there's no **Remove-TeamsProtectionPolicy** or **Remove-TeamsProtectionPolicyRule** cmdlet).

+- By default, there's no Teams protection policy rule (the **Get-TeamsProtectionPolicyRule** cmdlet returns nothing). Specifying quarantine policies or exceptions for ZAP for Teams in the Defender portal creates the rule automatically. Or, you can use the **New-TeamsProtectionPolicyRule** cmdlet to create the rule in PowerShell if it doesn't already exist.

+#### Use PowerShell to view the Teams protection policy and Teams protection policy rule

+To view the important values in Teams protection policy and Teams protection policy rule, run the following commands:

+```powershell

+Get-TeamsProtectionPolicy | Format-List Name,ZapEnabled,HighConfidencePhishQuarantineTag,MalwareQuarantineTag

+Get-TeamsProtectionPolicyRule | Format-List Name,TeamsProtectionPolicy,ExceptIfSentTo,ExceptIfSentToMemberOf,ExceptIfRecipientDomainIs

+```

+For detailed syntax and parameter information, see [Get-TeamsProtectionPolicy](/powershell/module/exchange/get-teamsprotectionpolicy) and [Get-TeamsProtectionPolicyRule](/powershell/module/exchange/get-teamsprotectionpolicyrule).

+#### Use PowerShell to modify the Teams protection policy

+To modify the Teams protection policy, use the following syntax:

+Set-TeamsProtectionPolicy -Identity "Teams Protection Policy" [-ZapEnabled <$true | $false>] [-HighConfidencePhishQuarantineTag "<QuarantinePolicyName>"] [-MalwareQuarantineTag "<QuarantinePolicyName>"]

+This example enables ZAP for Teams and changes the quarantine policy that's used for high confidence phishing detections:

+```powershell

+Set-TeamsProtectionPolicy -Identity "Teams Protection Policy" -ZapEnabled $true -HighConfidencePhishQuarantineTag AdminOnlyWithNotifications

+```

+For detailed syntax and parameter information, see [Set-TeamsProtectionPolicy](/powershell/module/exchange/set-teamsprotectionpolicy).

+#### Use PowerShell to create the Teams protection policy rule

+By default, there's no Teams protection policy rule, because there are no default exceptions for ZAP for Teams.

+To create a new Teams protection policy rule, use the following syntax:

+```powershell

+New-TeamsProtectionPolicyRule -Name "Teams Protection Policy Rule" -TeamsProtectionPolicy "Teams Protection Policy" [-ExceptIfSentTo <UserEmail1,UserEmail2,...UserEmailN>] [-ExceptIfSentToMemberOf <GroupEmail1,GroupEmail2,...GroupEmailN>] [-ExceptIfRecipientDomainIs <Domain1,Domain2,...DomainN>]

+```

+> [!IMPORTANT]

+> As explained previously in this article, multiple exception types (users, groups, and domains) use OR logic, not AND.

+This example creates the Teams protection policy rule with members of the group named Research excluded from ZAP for Teams protection.

+```powershell

+New-TeamsProtectionPolicyRule -Name "Teams Protection Policy Rule" -TeamsProtectionPolicy "Teams Protection Policy" -ExceptIfSentToMemberOf research@contoso.onmicrosoft.com

+```

+For detailed syntax and parameter information, see [New-TeamsProtectionPolicyRule](/powershell/module/exchange/new-teamsprotectionpolicyrule).

+#### Use PowerShell to modify the Teams protection policy rule

+If the Teams protection policy rule already exists (the **Get-TeamsProtectionPolicyRule** cmdlet returns output), use the following syntax to modify the rule:

+```powershell

+Set-TeamsProtectionPolicyRule -Identity "Teams Protection Policy Rule" [-ExceptIfSentTo <UserEmailAddresses | $null>] [-ExceptIfSentToMemberOf <GroupEmailAddresses | $null>] [-ExceptIfRecipientDomainIs <Domains | $null>]

+```

+**Notes**:

+- For information about the syntax for adding, removing, and replacing all values for the _ExceptIfSentTo_, _ExceptIfSentToMemberOf_, and _ExceptIfRecipientDomainIs_ parameters, see the parameter descriptions in [Set-TeamsProtectionPolicyRule](/powershell/module/exchange/set-teamsprotectionpolicyrule).

+- To empty the _ExceptIfSentTo_, _ExceptIfSentToMemberOf_, or _ExceptIfRecipientDomainIs_ parameters, use the value `$null`.

+This example modifies the existing Teams protection policy rule by excluding recipients in the domains research.contoso.com and research.contoso.net from ZAP for Teams protection.

+Set-TeamsProtectionPolicyRule -Identity "Teams Protection Policy Rule" -ExceptIfRecipientDomainIs research.contoso.com,research.contoso.net

+For detailed syntax and parameter information, see [Set-TeamsProtectionPolicyRule](/powershell/module/exchange/set-teamsprotectionpolicyrule).

+This article introduces you to your new Microsoft Defender for Office 365 security properties in the Cloud. Whether you're part of a Security Operations Center, you're a Security Administrator new to the space, or you want a refresher, let's get started.

+Every Office 365 subscription comes with security capabilities. The goals and available actions depend on the focus of these different subscriptions. In Office 365 security, there are three main security services (or products) tied to your subscription type:

+1. Exchange Online Protection (EOP).

+1. Microsoft Defender for Office 365 Plan 1 (Defender for Office P1).

+1. Microsoft Defender for Office 365 Plan 2 (Defender for Office P2).

+The core of Office 365 security is EOP protection. Microsoft Defender for Office 365 P1 contains EOP. Defender for Office 365 P2 contains P1 and EOP. The structure is cumulative. That's why, when configuring this product, you should start with EOP and work up to Defender for Office 365.

+If you have an Office 365 E3 or virtually any subscription with Exchange Online mailboxes, you definitely have EOP. You can most likely purchase Defender for Office 365 as an add-on subscription. If you have Office 365 E5, you already have Defender for Office 365 P2.

+> If your subscription is neither Office 365 E3 or E5, you can use [this page](https://www.microsoft.com/microsoft-365/exchange/advance-threat-protection#coreui-contentrichblock-x07wids) to see if you can upgrade to Microsoft Defender for Office 365 (check the end of the page for the fine-print).

+What makes adding Microsoft Defender for Office 365 plans an advantage to pure EOP threat management can be difficult to tell at first glance. To determine if an upgrade path is right for your organization, let's look at the capabilities of each product when it comes to:

+- Preventing and detecting threats

+- Investigating

+- Responding

+The capabilities of **Exchange Online Protection** are summarized in the following table:

+|Technologies include:<ul><li>Spam</li><li>Phishing</li><li>Malware</li><li>Bulk mail</li><li>Spoof intelligence</li><li>Quarantine</li><li>False positives and false negative reporting by admin submissions and user reported messages</li><li>Allow and block entries in the Tenant Allow/Block List for: <ul><li>Domains and email addresses</li><li>Spoof</li><li>URLs</li><li>Files</li></ul></li></ul>|<ul><li>Audit log search</li><li>Message Trace</li><li>Email security reports</li></ul>|<ul><li>Zero-hour auto purge (ZAP)</li><li>Refinement and testing of entries in the Tenant Allow/Block List</li></ul>|

+If you evaluate and ultimately purchase **Microsoft Defender for Office 365 P1**, you get these additional capabilities over EOP:

+|<ul><li>Safe Attachments in email</li><li>Safe Attachments for SharePoint, OneDrive, and Microsoft Teams</li><li>Safe Links in email, Office clients, and Teams</li><li>Advanced anti-phishing thresholds in anti-phishing policies</li><li>User, domain, and mailbox intelligence impersonation protection in anti-phishing policies</li><li>Alerts, and SIEM integration API for alerts</li></ul>|<ul><li>SIEM integration API for detections</li><li>**Real-time detections**</li><li>URL trace</li><li>Specific Defender for Office 365 reports</li></ul>|<li>Same</li></ul>

+Microsoft Defender for Office 365 P1 also adds **Real-time detections** for investigations. The presence of **Real-time detections** as a selection in the Microsoft 365 Defender portal means you have Defender for Office 365 P1.

+If you evaluate and ultimately purchase **Microsoft Defender for Office 365 P2**, you get these additional capabilities over EOP and Defender for Office 365 P1:

+|<ul><li>Attack simulation training</li>|<li>**Threat Explorer**</li><li>Threat Trackers</li><li>Campaign views</li>|<li>Automated Investigation and Response (AIR)</li><li>AIR from Threat Explorer</li><li>AIR for compromised users</li><li>SIEM Integration API for Automated Investigations</li>

+So, Microsoft Defender for Office 365 P2 expands on the ***investigation and response*** side of the house, and adds a new hunting strength: Automation.

+> EOP and Microsoft Defender for Office 365 are also different when it comes to end-users. In EOP and Defender for Office 365 P1, the focus is *awareness*. The [Microsoft Report Message and Report Phishing add-ins](submissions-users-report-message-add-in-configure.md) are available for users to report messages that they find suspicious.

+>

+> In Defender for Office 365 P2 (which contains everything in EOP and P1), the focus shifts to *further training* for end-users. The Security Operations Center has access to a powerful *Threat Simulator* tool, and the end-user metrics it provides.

+This quick-reference helps you understand what capabilities come with each Microsoft Defender for Office 365 subscription. When combined with your knowledge of EOP features, it can help business decision makers determine what Microsoft Defender for Office 365 is best for their needs.

+|Prevent and detect capabilities: <ul><li>[Safe Attachments](safe-attachments-about.md), including [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](safe-attachments-for-spo-odfb-teams-about.md)</li><li>[Safe Links](safe-links-about.md)</li><li>[Advanced phishing thresholds and impersonation protection](anti-phishing-policies-about.md#exclusive-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)</li><li>[Real-time detections](threat-explorer-about.md)</li></ul>|Everything in Defender for Office 365 Plan 1 capabilities <br/><br/> plus <br/><br/> Prevent and detect capabilities: <ul><li>[Attack simulation training](attack-simulation-training-simulations.md)</li></ul> <br/> Automate, investigate, and respond capabilities: <ul><li>[Threat Trackers](threat-trackers.md)</li><li>[Threat Explorer](threat-explorer-about.md)</li><li>[Automated investigation and response](air-about.md)</li><li>[Proactively hunt for threats with advanced hunting in Microsoft 365 Defender](../defender/advanced-hunting-overview.md)</li><li>[Investigate incidents in Microsoft 365 Defender](../defender/investigate-incidents.md)</li><li>[Investigate alerts in Microsoft 365 Defender](../defender/investigate-alerts.md)</li></ul>|

+- Microsoft Defender for Office 365 Plan 1 and Defender for Office 365 Plan 2 are each available as an add-on for certain subscriptions. To learn more, see [Feature availability across Microsoft Defender for Office 365 plans](/office365/servicedescriptions/office-365-advanced-threat-protection-service-description#feature-availability-across-advanced-threat-protection-atp-plans).

+- [Safe Documents](safe-documents-in-e5-plus-security-about.md) is available to users with the Microsoft 365 A5 or Microsoft 365 E5 Security licenses (not included in Microsoft Defender for Office 365 plans).

+- If your current subscription doesn't include Microsoft Defender for Office 365 Plan 2, you can [try Microsoft Defender for Office 365](try-microsoft-defender-for-office-365.md) free for 90 days. Or, [contact sales to start a trial](https://info.microsoft.com/ww-landing-M365SMB-web-contact.html).

+> ***Insider tip***. You can use the Microsoft Learn table of contents to learn about EOP and Microsoft Defender for Office 365. Navigate back to this page, [Office 365 Security overview](index.yml), and you'll notice that table of contents organization in the side-bar. It begins with Deployment (including migration) and then continues into prevention, detection, investigation, and response.

+>

+> This structure is divided so that **Security Administration** topics are followed by **Security Operations** topics. If you're a new member of either job role, use the link in this tip, and your knowledge of the table of contents, to help learn the space. Remember to use *feedback links* and *rate articles* as you go. Feedback helps us improve what we offer you.

+If you're a Security Admin, you may need to configure DKIM or DMARC for your mail. You may want to roll out 'Strict' security presets for your priority users, or look for what's new in the product. Or if you're with Security Ops, you may want to use Real-time detections or Threat Explorer to investigate and respond, or train end-user detection with Attack Simulator. Either way, here are some additional recommendations for what to look at next:

+|Messages quarantined by Safe Attachments policies in Defender for Office 365 (malware messages).|30 days|No||

+|Messages in chats and channels quarantined by zero-hour auto protection (ZAP) for Microsoft Teams in Defender for Office 365|30 days|No|

+|**Intra-Organizational messages to take action on** (_IntraOrgFilterState_)|**Default** (Default)|**Default** (Default)|**Default** (Default)|The value **Default** is the same as selecting **High confidence phishing messages**. Currently, in U.S. Government organizations (Microsoft 365 GCC, GCC High, and DoD), the value **Default** is the same as selecting **None**.|

+### Zero-hour auto purge (ZAP) considerations for Safe Attachments in Microsoft Defender for Office 365

+> ZAP for Microsoft Teams is available only to customers with Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2 subscriptions. To configure ZAP for Teams protection, see [Microsoft Defender for Office 365 Plan 2 support for Microsoft Teams](mdo-support-teams-about.md).

+> ZAP for Teams is available for internal Teams messages that are identified as malware or high confidence phishing. Currently, external messages aren't supported.

+> Currently, ZAP for Teams is supported only for Teams chats, shared channels, and standard channels.

+Teams is different than email, because everyone in a Teams chat receives the same copy of the message at the same time (there's no message bifurcation). When ZAP for Teams protection blocks a message, the message is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP occurs up to 48 hours after delivery.

+Exclusions for ZAP for Teams protection matter for message _recipients_, not message _senders_.

+ZAP for Teams protection is able to take action on messages for _all_ recipients in a chat if _any_ recipients in the chat aren't excluded from ZAP for Teams protection. Only when _all_ recipients in a chat are excluded from ZAP for Teams protection will ZAP not take action on a message. These scenarios are illustrated in the following table:

+|Scenario|Result|

+|||

+|Group chat with Recipients A, B, C, and D. <br/><br/> Recipients A, B, C, and D are excluded from ZAP for Teams protection.|ZAP won't block messages sent to the group chat.|

+|Group chat with Recipients A, B, C, and D. <br/><br/> Only recipients A, B, and C are excluded from ZAP for Teams protection.|ZAP is able to block messages sent to the group chat for all recipients.|

+|Group chat with Recipients A, B, C, and D. <br/><br/> Recipients A, B, C, and D aren't excluded from ZAP for Teams protection. <br/><br/> Sender X is excluded from ZAP for Teams protection and sends a message to the group chat.|ZAP is able to block messages sent to the group chat for all recipients.|

+For messages that are identified as high confidence phishing after delivery, ZAP for Teams protection blocks and quarantines the message. To set the quarantine policy that's used for high confidence phishing detections in ZAP for Teams, see [Microsoft Defender for Office 365 Plan 2 support for Microsoft Teams](mdo-support-teams-about.md).

+For messages that are identified as malware, ZAP for Teams protection blocks and quarantines the message. To set the quarantine policy that's used for malware detections in ZAP for Teams, see [Microsoft Defender for Office 365 Plan 2 support for Microsoft Teams](mdo-support-teams-about.md).

+### How to see if ZAP blocked a Teams message

+Currently, only admins can view and manage messages that were quarantined by ZAP for Teams protection. For more information, see [Use the Microsoft 365 Defender portal to manage Microsoft Teams quarantined messages](quarantine-admin-manage-messages-files.md#use-the-microsoft-365-defender-portal-to-manage-microsoft-teams-quarantined-messages).

+There are no special licensing requirements for ZAP for malware, spam, and phishing. ZAP works on all mailboxes hosted in Exchange Online. ZAP doesn't work in on-premises mailboxes that are protected by standalone EOP.

+ZAP for Teams protection requires Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2 licenses.

+ Title: Create, review, and sign signature requests using Microsoft Syntex eSignature (Preview)

+audience: enabler

+search.appverid:

+ - enabler-strategic

+ - m365initiative-syntex

+ms.localizationpriority: medium

+description: Learn how to use Microsoft Syntex eSignature to send electronic signature requests to people inside and outside of your organization.

+# Create, review, and sign signature requests using Microsoft Syntex eSignature (Preview)

+> [!NOTE]

+> This feature is currently in limited preview and subject to change.

+Microsoft Syntex eSignature simplifies the process of signing and sharing documents, while providing the security and compliance of Microsoft 365.

+With Syntex eSignature, you can quickly and securely send documents for signature to people both inside and outside of your organization. You'll also have a digital audit trail, which can be used to verify the authenticity of documents and transactions.

+## Before you begin

+Before you can use Syntex eSignature, an admin must [set up the Syntex eSignature service](esignature-setup.md) in the Microsoft 365 admin center.

+You must be signed in to SharePoint Online by using your work email address.

+> [!NOTE]

+> For this preview, Syntex eSignature is available for PDF documents only at this time.

+## Create a signature request

+1. From a SharePoint document library, open the document for which you want to start the Syntex eSignature process.

+2. In the document viewer, select **More options** (...), and then select **Get signatures**.

+ 

+3. On the **Syntex eSignature** panel, add up to 10 internal or external recipients you want to sign the document, and then select **Next**.

+ 

+4. On the **Add form fields** panel, drag and drop the **Signature**, **Initials**, and **Date** fields to the appropriate locations in the document for each recipient. Each form field can be marked either as required or not required.

+ 

+5. Select **Next** to progress to the next stage. At least one required signature field is needed for each recipient. Up to 50 fields (total) can be added to the document.

+6. On the **Review request** panel, enter a title for the request, add an optional message, and review the details on the panel to make sure it's correct. Then select **Send**.

+ 

+ Once sent, the status of the request is set to **In progress** and recipients are able to add their signatures.

+### Unable to create a request

+If you aren't able to create a signature request, check the PDF viewer settings or the collaboration settings.

+#### PDF settings from the PDF viewer

+The PDF viewer is opened by selecting a PDF file from SharePoint Online. The ability to request signatures won't be available if the PDF is viewed in any other way (for example, in Microsoft Edge). If PDF files are opened in any other way, the **Get signatures** option isn't available.

+#### Collaboration settings

+Syntex eSignature is an extension of SharePoint document storage and management service. Therefore, all existing access, sharing, and data loss prevention policies that are already applied at the tenant level, SharePoint site and library level, or folder and file level might affect whether a request can be started from a document in SharePoint and who it can be sent to. Some of the scenarios that might affect the signature request process are:

+- The document has a sensitivity label applied that restricts access or sharing. This event limits who can start signature request with that document or the recipients that it can be sent to, depending on the label settings and the user's role.

+- The document is stored in a library or folder that has unique permissions or sharing settings. This event might override the default settings of the SharePoint site or tenant and either allow or block certain users from initiating or accessing an eSignature request with that document.

+- Azure Active Directory collaboration settings restrict document sharing to specific individuals. This event limits who the requests can be sent to.

+### Cancel a signature request

+If you create a signature request and want to cancel it, follow these steps.

+1. From one of your email notifications, select **View Request**.

+2. When the document is open in the document viewer, select **More options** (...), and then select **Cancel request**.

+ 

+3. On the **Cancel signature request** confirmation screen, enter a message detailing why the request is canceled if needed, and then select **Yes, cancel**.

+ 

+ Once canceled, the status of the request is set to **Canceled** and recipients receive an email notification telling them that the request was canceled and that no further action is possible on this request.

+## Review and sign a signature request

+When a signature request is created, an email notification is sent to the recipients. The notification contains details of the request, including all recipients who are required to sign, and any signing instructions. A recipient doesn't need to have a Syntex license or a Microsoft account to sign the request.

+### Access the document to be signed

+When you receive the email notification, select **View signed document** in the email to begin the signing process.

+

+### Consent to use your electronic signature

+To continue the electronic signing process, you must consent to the terms and conditions and agree to use your electronic signature for signing. On the **Electronic Record and Signature Disclosure** screen:

+- Select **Agree** to use your electronic signature and continue with the signing process.

+- Or select **Decline** if you'd prefer [not to use your digital signature](#decline-to-sign-the-document), and contact the person who requested your signature to complete the signature by using a different method.

+- If you close the **Electronic Record and Signature Disclosure** without selecting the **Agree** button, you can reopen the dialog by selecting the **View disclosure** button on the top-left area of the document.

+ 

+### Sign the document

+Once you give your consent, the document viewer opens in a new browser tab. Here you can navigate and read the document, and review the content. When youΓÇÖre ready to sign, select **Start**. This action brings you to the first location where your input is needed.

+

+There are three different types of input you can be asked for:

+- [Signature](#signature)

+- [Initials](#initials)

+- [Date](#date)

+#### Signature

+Electronic signatures let you digitally sign a document by enabling you to add a representation of your physical signature.

+1. To add your signature, type your name. If you want to choose a different font style for your signature, select **Change font** and choose the font you want to use.

+ 

+2. Select **Done** to add your signature to the document.

+3. Select **Next** to go to the next location in the document that requires your input.

+ 

+#### Initials

+In some locations within the document, you might be asked to add your initials to acknowledge a particular clause.

+1. Select **Initial here**, and enter your initials. This action is prepopulated if you've already entered your signature.

+ 

+2. Select **Next** to go to the next location in the document that requires your input.

+#### Date

+The date is prepopulated with the current dayΓÇÖs date.

+### Submit the signed document

+When you have entered all of the required input, select **Submit** to complete the signing process.

+

+The status of the request changes from **In progress** to **Completed**. The document becomes read-only. You'll receive an email notification saying that your signature has been received and the requester will be notified.

+Once everyone has signed the document, you'll receive an email notification saying where you can view the document and request details. The document is available via the **View request** button in the email for 30 days, so make sure you download it for your own records.

+### Decline to sign the document

+If you review the document and donΓÇÖt want to sign it, you can decline to sign.

+1. In the document viewer, select **More options** (...), and then select **Decline to sign**.

+ 

+2. On the **You are declining to sign this document** screen, enter a reason for not signing document, and then select **Decline**. Or if you change your mind, select **Go back**.

+ 

+Once you decline, you won't be able to add your signature, but you'll be able to see the document in read-only mode.

+

+Once you decline, an email notification is sent to the requester saying that you donΓÇÖt want to sign the document. Declining to sign will complete the signing process and change the status of the request from **In progress** to **Declined**.

+

+If there are more recipients, they'll also receive a notification saying that the request has been declined.

+### View request history and details

+Whether you're a requester or a recipient, you can select **View request** from any of your email notifications to view the document and find out more about the request.

+1. In the document viewer, select the **View history** tab to see the status of the request. On the **Request history** panel, you can see the recipients who haven't signed yet and the activities that have happened so far, such as when the request was created and who the recipients are.

+ 

+2. Select the **View details** tab to see the details of the request. On the **Request details** panel, you can see the title of the request, any instructions the requester added when sending the request, and who the request was sent to.

+ 

+## Monitor the status of a request

+When you create a signature request with Syntex eSignature, it goes through different stages that are reflected in the request statuses. You can view the status of a request by selecting **View request** in any of the email notifications you received about the signature request. The following table shows the request statuses and their meaning.

+|Status |Description |

+|||

+|**In&nbsp;progress** |The request is in progress as soon as it's created. The status remains at this state until the request has been reviewed by all recipients or canceled by the sender of the request.|

+|**Completed** |The request is completed when all recipients have signed the document. |

+|**Canceled** |The request has been canceled by the sender. |

+|**Declined** |One of the recipients has declined to sign.|

+When the status of a request is **Completed**, **Canceled**, or **Declined**, the request can no longer be acted on by either the sender or the recipients. As an example, if a recipient declines a request, the sender would need to send a new request after the reason for declining has been addressed. The original declined request can't be edited.

+## Access the signed document

+All parties involved in the request receive an email notification saying that the request has been completed and the status of the request is **Completed**. In the email, you can select **View request** to access the signed document and the request history. Access to the document via the email notification will be available for 30 days after the request is completed.

+Additionally, the signed document also is saved to the folder where the original PDF is located (originating folder). It will be a read-only document with the permissions of the originating folder. The document can be accessed by the requester and anyone who has access to the originating folder.

+> [!NOTE]

+> When you open a PDF document on a SharePoint site, you won't see the details of the request if your default PDF viewer is set to Adobe. You'll need to set PDF viewer as your default viewer.

+### Unable to access the signed document

+Before a signature request is sent and at the completion of the request, certain checks are done to ensure that the sender has the permission to write to the document and the originating folder. If the permission changes when the signature request is in progress, the service might not be able to save a copy of the signed document in the originating folder. This event can happen when:

+- The sender of the request no longer has access to the originating folder. For example, the senderΓÇÖs access has been revoked by the owner of the originating folder or a SharePoint admin.

+- Initial write permission of the sender to the originating folder was downgraded to view only.

+- The originating folder was deleted.

+To avoid potential issues, you should check the status and settings of their documents before starting a signature request. Ensure that there are sufficient permissions and roles to access and share the documents with their intended recipients.

+- Data loss prevention (DLP) policies

+- Azure Active Directory collaboration settings

+- SharePoint sharing settings and policies

+- User permissions and document access

+## Security of the signed document

+After all recipients have signed the document, the signatures are added and an audit trail is appended to the signed PDF. Details of the request, including activities and timestamps of when they occurred throughout the signing process, are included. The details include the date and time the request created, date and time when the recipients signed, and so on. These details provide evidence of the integrity of the signing process. The signed document is then digitally signed by a Microsoft certificate to ensure that it can't be tampered with.

+For setup and technical information for admins, see [Set up Microsoft Syntex eSignature (Preview)](esignature-setup.md).

+ Title: Set up Microsoft Syntex eSignature (Preview)

+audience: admin

+search.appverid:

+ - enabler-strategic

+ - m365initiative-syntex

+ms.localizationpriority: medium

+description: Learn how to set up Microsoft Syntex eSignature to send electronic signature requests to people inside and outside of your organization.

+# Set up Microsoft Syntex eSignature (Preview)

+> [!NOTE]

+> This feature is currently in limited preview and subject to change.

+The Microsoft Syntex eSignature service is set up in the Microsoft 365 admin center.

+## Prerequisites

+### Licensing

+Before you can use Syntex eSignature, you must first link your Azure subscription in [Syntex pay-as-you-go](syntex-azure-billing.md). Syntex eSignature is billed based on the [type and number of transactions](syntex-pay-as-you-go-services.md). (Billing and pricing aren't activated during this preview.)

+### Permissions

+You must have Global admin or SharePoint admin permissions to be able to access the Microsoft 365 admin center and set up Syntex eSignature.

+## Set up Syntex eSignature

+1. In the Microsoft 365 admin center, select <a href="https://go.microsoft.com/fwlink/p/?linkid=2171997" target="_blank">**Setup**</a>, and then select **Use content AI with Microsoft Syntex**.

+2. On the **Use content AI with Microsoft Syntex** page, select **Manage Microsoft Syntex**.

+3. On the **Manage Microsoft Syntex** page, select **Syntex eSignature**.

+4. On the **Syntex eSignature** page, select **Turn on**.

+### Manage sites

+By default, Syntex eSignature is turned on for libraries in all SharePoint sites. Follow these steps to manage which SharePoint sites users can use Syntex eSignature.

+1. On the **Manage Microsoft Syntex** page, select **Syntex eSignature**.

+2. On the **Syntex eSignature** page, under **SharePoint libraries where Syntex eSignature is turned on**, select **Select sites**.

+ a. Choose which site or sites this service should be enabled for.

+ b. To restrict user access to this service, select **No SharePoint libraries** or **Libraries in selected SharePoint sites** and follow the instructions to either select the sites or upload a CSV listing a maximum of 100 sites. Be sure to add your content center site if you want it to be included. You can then manage site access permissions for the sites you selected.

+ c. Select **Save**.

+### Turn off Syntex eSignature

+1. On the **Manage Microsoft Syntex** page, select **Syntex eSignature**.

+2. On the **Turn off Syntex eSignature** page, select **Turn off**.

+## Document storage and retention

+### Document storage

+Syntex eSignature lets a requester start a signature request from a PDF document that is saved in a SharePoint library for which Syntex eSignature has been enabled. After all required parties have signed, the Syntex eSignature service saves a copy of the signed document to the folder of the original document (originating folder). The sender is notified in an email that includes a link to view the document and a separate link to the SharePoint folder where the signed document was saved.

+Before a signature request is sent and at the completion of the request, certain checks are done to ensure that the sender has the permission to write to the document and the originating folder. If the permission changes when the signature request is in progress, the service might not be able to save a copy of the signed document in the originating folder. This event can happen when:

+- The sender of the request no longer has access to the originating folder. For example, the senderΓÇÖs access has been revoked by the owner of the originating folder or a SharePoint admin.

+- Initial write permission of the sender to the originating folder was downgraded to view only.

+- The originating folder was deleted.

+### Document retention

+When a signature request is created for a document in SharePoint, the Syntex eSignature service creates a working copy of the document. It's this working copy that is sent out to all recipients for signing, and it's how the sender can track the status of their requests. The working copy of the request is stored in a hidden document library in SharePoint. The signature will only be added to the working copy of the request document after all parties have signed; otherwise, it will appear as unsigned even if one of the parties has added their signature.

+The working copy of the request is stored and retained for five years or in accordance with the document retention policy set up by the SharePoint or tenant admin. Learn more about [retention policies](/purview/retention-policies-sharepoint).

+### Expiration of URL links in email

+Every email notification sent in relation to a signature request contains a URL link that allows the recipient to view, review, and sign the document. When a request reaches a terminal state (when the status is **Completed**, **Canceled**, or **Declined**), the recipient has 30 days to view, download, and store the document in a preferred location. After the link expires, it can no longer be used to access the document.

+

+For more protection, when a sender cancels a request, recipients immediately lose access to the request document. The email notification received by recipients won't contain a URL link to view the request.

+For user instructions about how to use Syntex eSignature, see [Create, review, and sign signature requests using Microsoft Syntex eSignature (Preview)](esignature-send-requests.md).

+ b. To restrict user access to this service, select **No sites** or **Selected sites** and follow the instructions to either select the sites or upload a CSV listing a maximum of 100 sites. Be sure to add your content center site if you want it to be included. You can then manage site access permissions for the sites you selected.

+ b. To restrict user access to this service, select **No SharePoint libraries** or **Libraries in selected SharePoint sites** and follow the instructions to either select the sites or upload a CSV listing a maximum of 100 sites. Be sure to add your content center site if you want it to be included. You can then manage site access permissions for the sites you selected.

+## Requirements

+<!

+>

+|Structured and freeform document processing | [Set up structured and freeform document processing](structured-freeform-setup.md) |

+ Title: Set up and manage structured and freeform document processing in Microsoft Syntex

+audience: admin

+search.appverid:

+ - enabler-strategic

+ - m365initiative-syntex

+ms.localizationpriority: medium

+description: Learn how to set up and manage structured and freeform document processing in Microsoft Syntex.

+# Set up and manage structured and freeform document processing in Microsoft Syntex

+The structured and freeform document processing service for Microsoft Syntex is set up in the Microsoft 365 admin center.

+## Prerequisites

+### Permissions

+You must have Global admin or SharePoint admin permissions to be able to access the Microsoft 365 admin center and set up structured and freeform document processing in Syntex.

+### Licensing

+> [!NOTE]

+> As of July 1, 2023, per-user licenses are no longer available for purchase. You will need to [set up pay-as-you-go billing](syntex-azure-billing.md).<br><br>

+> Per-user licenses purchased before July 1 can still be assigned to new users. After existing per-user licenses expire, you will need to opt-in to Syntex [pay-as-you-go billing](syntex-azure-billing.md).

+For an overview of licensing options for Microsoft Syntex, see [Licensing for Microsoft Syntex](syntex-licensing.md).

+Each user for structured and freeform document processing must have a license assigned. To assign licenses, see [Set up Microsoft Syntex per-user licensing](set-up-content-understanding.md#assign-licenses).

+## Set up structured and freeform document processing

+### Get AI Builder credits

+To use structured or freeform document processing models, you also need AI Builder credits. For each licensed user of Syntex, an allocation of AI Builder credits is provided each month in your default Power Platform environment.

+### Enable sites

+By default, structured and freeform document processing is turned off for all sites.

+1. In the Microsoft 365 admin center, select <a href="https://go.microsoft.com/fwlink/p/?linkid=2171997" target="_blank">**Setup**</a>, and then select **Use content AI with Microsoft Syntex**.

+2. On the **Use content AI with Microsoft Syntex** page, select **Manage Microsoft Syntex**.

+3. On the **Manage Microsoft Syntex** page, select **Structured and freeform document processing**.

+4. On the **Structured and freeform document processing** page:

+ a. Choose which site or sites this service should be enabled for.

+ > [!NOTE]

+ > Disabling a site after a model is made available to process files on that site will not disable the model. Models can still be used to process files and incur charges. A model can be made available to process files by being created either on that site or in a content center.

+ b. To restrict user access to this service, select **No SharePoint libraries** or **Libraries in selected SharePoint sites** and follow the instructions to either select the sites or upload a CSV listing a maximum of 100 sites. Be sure to add your content center site if you want it to be included. You can then manage site access permissions for the sites you selected.

+ c. Select **Save**.

+## Using a custom Power Platform environment

+Your tenant will come with a default Power Platform environment. If you plan to use a custom Power Platform environment, you must install the *AI Builder for Project Cortex* app in this environment. See [Manage Dynamics 365 apps](/power-platform/admin/manage-apps#install-an-app-in-the-environment-view) for details and look for the *AI Builder for Project Cortex* app in the list of Dynamics 365 apps. The environment must not be of the Sandbox type.

+You also need to [allocate AI Builder credits](/power-platform/admin/capacity-add-on) to the custom environment before you can create document processing models.

+When using a custom environment, model creators must be assigned the Environment Maker security role and model users must be assigned the Basic User security role. For more information, see [Assign a security role to a user](/power-platform/admin/assign-security-roles). You don't need to assign users this role if you're using the default Power Platform environment.

+Users creating models in a [content center site](create-a-content-center.md) must be site members. Users creating models locally outside the content center must be site owners of those sites.

+Microsoft Syntex services are billed on a pay-as-you-go basis. These services use an Azure subscription for billing and track usage and cost with a Syntex meter. Read the [Microsoft Syntex pay-as-you-go terms of service](/legal/microsoft-365/microsoft-syntex-pay-as-you-go-terms) before you configure pay-as-you-go.

+For a list of Microsoft Syntex services that use pay-as-you-go, see [Licensing for Microsoft Syntex](syntex-licensing.md).

+When you set up Microsoft Syntex billing in Azure, events will be sent to the Azure meter in your account, and you'll be able to view the pages processed for unstructured and prebuilt document processing models.

+2. In the **Files and content** section, select **Use content AI with Microsoft Syntex**.

+3. On the **Microsoft Syntex** page, select **Configure billing** to walk through the setup process.

+4. On the **Enter your Azure subscription** panel, choose an Azure subscription from the **Azure subscription** dropdown.

+5. Choose a resource group and region. (The region determines where your tenant ID and usage information such as site names will be stored.)

+6. Read and accept the [Microsoft Syntex pay-as-you-go terms of service](/legal/microsoft-365/microsoft-syntex-pay-as-you-go-terms).

+7. Select **Save**.

+You can monitor your Microsoft Syntex pay-as-you-go usage in Microsoft Cost Management for Azure. You must have at least *read* access to the resource group that you specified for Microsoft Syntex. Note that usage information might take up to 24 hours to appear in Cost Management.

+1. Sign in to [Microsoft Cost Management for Azure](https://portal.azure.com/#view/Microsoft_Azure_CostManagement/Menu/~/overview).

+The following Microsoft Syntex products are currently available:

+- Prebuilt document processing

+- Unstructured document processing

+- Content assembly

+- Image tagging

+- Optical character recognition

+ b. To restrict user access to this service, select **No SharePoint libraries** or **Libraries in selected SharePoint sites** and follow the instructions to either select the sites or upload a CSV listing a maximum of 100 sites. Be sure to add your content center site if you want it to be included. You can then manage site access permissions for the sites you selected.

+ Title: 'Create Package from App Gallery'

+description: How to create package from App Gallery

+search.appverid: MET150

+audience: Software-Vendor

+ms.localizationpriority: medium

+f1.keywords: NOCSH

+# Create Package from App Gallery #

+This section provides the steps necessary to onboard a package from App Gallery onto Test Base.

+> [!IMPORTANT]

+> If you do not have a Test Base account, you will need to create one before proceeding, as described in Creating a Test Base Account.

+In the [Azure portal](https://portal.azure.com/), go to the **Test

+Base** account for which you will be creating and uploading your package

+and perform the steps that follow.

+In the left-hand menu under **Package catalog**, select the **New

+package**. Then click the card '**Create package from App Gallery**'.

+> [!div class="mx-imgBorder"]

+> [](Media/create_package_from_gallery_1.png#lightbox)

+**Step 1. Define content**

+1. In the **Package source** section, click on 'Select app from App Gallery - Winget' then there will be a slide bar pop-up on the right hand side.

+ > [!div class="mx-imgBorder"]

+ > [](Media/create_package_from_gallery_2.png#lightbox)

+2. Then you can either scroll down or search for the applications which you'd like to test. You can also select the version of specific app in the Version drop down.

+3. Once you select the app by checking the box and clicking on the select button, there's a pop-up notification displaying the app license and disclaimer.

+ > [!div class="mx-imgBorder"]

+ > [](Media/create_package_from_gallery_3.png#lightbox)

+4. By clicking on the 'Accept' button, the app will be auto uploaded while the package name and package version will be auto-populated.

+ You can also modify the package name and version as needed.

+ > [!div class="mx-imgBorder"]

+ > [](Media/create_package_from_gallery_4.png#lightbox)

+ > [!Note]

+ > The combination of package name and version must be unique within your Test Base account.

+5. After all the requested information is specified, you can proceed to the next phase by clicking the **Next: Configure test** button.

+ > [!div class="mx-imgBorder"]

+ > [](Media/create_package_from_gallery_5.png#lightbox)

+**Step 2. Configure test**

+1. For now, only **Out of Box (OOB)** **test** is supported for the Winget package:

+ > An **Out of Box (OOB)** **test** performs an install, launch, close,

+ > and uninstall of your package. After the install, the launch-close

+ > routine is repeated 30 times before a single uninstall is run. The OOB

+ > test provides you with standardized telemetry on your package to

+ > compare across Windows builds.

+ >

+ > [!div class="mx-imgBorder"]

+ > [](Media/create_package_from_gallery_6.png#lightbox)

+2. Once all required information is filled out, you can proceed to step 3 by

+ clicking the Next button at the bottom.

+For next steps, please refer to the [Creating and Testing Binary Files on Test Base \| Microsoft Learn](testapplication.md).