| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Priority Accounts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/setup/priority-accounts.md | The **Priority account protection** feature that's described in this topic is av The **Premium Mail Flow Monitoring** feature that's described in this topic is available only to organizations that meet the following requirements: - Your organization needs to have a license count of at least 5,000, from either one of, or a combination of the following products: Office 365 E3, Microsoft 365 E3, Office 365 E5, Microsoft 365 E5. For example, your organization can have 3,000 Office 365 E3 licenses and 2,500 Microsoft 365 E5, for a total of 5,500 licenses from the qualifying products.-- Your organization needs to have at least 50 monthly active users for one or more core workloads ΓÇô Teams, One Drive for Business, SharePoint Online, Exchange Online and Office apps.+- Your organization needs to have at least 50 monthly active users for one or more core workloads ΓÇô Teams, OneDrive for Business, SharePoint Online, Exchange Online and Office apps. > [!NOTE] > You can monitor up to 250 priority accounts. |
| compliance | Classifier Get Started With | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/classifier-get-started-with.md | Watch this video for a quick summary of creating a trainable classifier. You'll </br> -> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWyGL7] +<!-- [!VIDEO https://www.microsoft.com/videoplayer/embed/RWyGL7]--> ## Prerequisites |
| compliance | Classifier How To Retrain Content Explorer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/classifier-how-to-retrain-content-explorer.md | description: "Learn how to provide feedback to a trainable classifier in Content A Microsoft 365 trainable classifier is a tool you can train to recognize various types of content by giving it samples to look at. Once trained, you can use it to identify items for application of Office sensitivity labels, communications compliance policies, and retention label policies. -This article shows you how to improve the performance of custom trainable classifiers by providing them additional feedback. +This article shows you how to improve the performance of custom trainable classifiers by providing them more feedback. To learn more about the different types of classifiers, see [Learn about trainable classifiers](classifier-learn-about.md). Watch this video for a quick summary of the tuning and retraining process. You'l </br> -> [!VIDEO https://www.microsoft.com/videoplayer/embed/RWyGMs] +<!-- > [!VIDEO https://www.microsoft.com/videoplayer/embed/RWyGMs]--> > [!NOTE] > Pre-trained classifiers cannot be retrained. You'll need accounts with these permissions to use classifiers in these scenario > [!IMPORTANT] > You provide feedback in content explorer for auto-apply retention label policies to Exchange items and uses the classifier as a condition. **If you don't have a retention policy that auto-applies a retention label to Exchange items and uses a classifier as a condition, stop here.** -As you use your classifiers, you may want to increase the precision of the classifications that they're making. You do this by evaluating the quality of the classifications made for items it has identified as being a match or not a match. After you make 30 evaluations for a classifier it takes that feedback and automatically retrains itself. +As you use your classifiers, you may want to increase the precision of the classifications that they're making. You do this by evaluating the quality of the classifications made for items it has identified as being a match or not a match. After you make 30 evaluations for a classifier, it takes that feedback, and automatically retrains itself. To understand more about the overall workflow of retraining a classifier, see [Process flow for retraining a classifier](classifier-learn-about.md#retraining-classifiers). To understand more about the overall workflow of retraining a classifier, see [P > [!IMPORTANT] > It can take up to eight days for aggregated items to appear under the trainable classifiers heading. -3. Choose the trainable classifier you used in you auto-apply retention label policy. This is the trainable classifier you will give feedback on. +3. Choose the trainable classifier you used in you auto-apply retention label policy. This is the trainable classifier you'll give feedback on. > [!NOTE] > If an item has an entry in the **Retention label** column, it means that the item was classified as a `match`. If an item doesn't have an entry in the **Retention label** column, it means it was classified as a `close match`. You can improve the classifier precision the most by providing feedback on `close match` items. To understand more about the overall workflow of retraining a classifier, see [P 5. Choose **Provide feedback**. 6. In the **Detailed feedback** pane, if the item is a true positive, choose, **Match**. If the item is a false positive, that is it was incorrectly included in the category, choose **Not a match**.-7. If there is another classifier that would be more appropriate for the item, you can choose it from the **Suggest other trainable classifiers** list. This will trigger the other classifier to evaluate the item. +7. If there's another classifier that would be more appropriate for the item, you can choose it from the **Suggest other trainable classifiers** list. This will trigger the other classifier to evaluate the item. 8. Choose **Send feedback** to send your evaluation of the `match`, `not a match` classifications and suggest other trainable classifiers. When you've provided 30 instances of feedback to a classifier, it will automatically retrain. Retraining can take from one to four hours. Classifiers can only be retrained twice per day. > [!IMPORTANT] To understand more about the overall workflow of retraining a classifier, see [P 12. Review the recommended action, and the prediction comparisons of the retrained and currently published versions of the classifier. 13. If you satisfied with the results of the retraining, choose **Re-publish**.-14. If you are not satisfied with the results of the retraining, you can choose to provide additional feedback to the classifier in the Content Explorer interface and start another retraining cycle or do nothing in which case the currently published version of the classifier will continue to be used. +14. If you aren't satisfied with the results of the retraining, you can choose to provide more feedback to the classifier in the Content Explorer interface and start another retraining cycle or do nothing in which case the currently published version of the classifier will continue to be used. ## Details on republishing recommendations -Here is a little information on how we formulate the recommendation to re-publish a retrained classifier or suggest further retraining. This requires a little deeper understanding of how trainable classifiers work. +Here's a little information on how we formulate the recommendation to republish a retrained classifier or suggest further retraining. This requires a little deeper understanding of how trainable classifiers work. -After a retrain, we evaluate the classifier's performance on both the items with feedback as well as any items originally used to train the classifier. +After a retrain, we evaluate the classifier's performance on both the items with feedback and any items originally used to train the classifier. - For built-in models, items used to train the classifier are the items used by Microsoft to build the model. - For custom models, items used in the original training the classifier are from the sites you had added for test and review. |
| compliance | Dlp Policy Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-policy-reference.md | DLP policies detect sensitive items by matching them to a sensitive information |Power BI|Yes | Yes| No| > [!NOTE]-> DLP supports (in preview) using trainable classifiers as a condition to detect sensitive documents. Content can be defined by trainable classifiers in Exchange Online, Sharepoint Online sites, OneDrive for Business accounts, Teams Chat and Channels, and Devices. For more information, see [Trainable Classifiers](classifier-learn-about.md). +> DLP supports (in preview) using trainable classifiers as a condition to detect sensitive documents. Content can be defined by trainable classifiers in Exchange Online, SharePoint Online sites, OneDrive for Business accounts, Teams Chat and Channels, and Devices. For more information, see [Trainable Classifiers](classifier-learn-about.md). > [!NOTE] > DLP supports detecting sensitivity labels on emails and attachments. For more information, see [Use sensitivity labels as conditions in DLP policies](dlp-sensitivity-label-as-condition.md#use-sensitivity-labels-as-conditions-in-dlp-policies). The actions that are available in a rule are dependent on the locations that hav #### Devices actions <!--- (preview) Audit or restricted activities when users accesses sensitive websites in Microsoft Edge browser on Windows devices. See, [Scenario 6 Monitor or restrict user activities on sensitive service domains (preview)](endpoint-dlp-using.md#scenario-6-monitor-or-restrict-user-activities-on-sensitive-service-domains-preview) for more information.+- (preview) Audit or restricted activities when users access sensitive websites in Microsoft Edge browser on Windows devices. See, [Scenario 6 Monitor or restrict user activities on sensitive service domains (preview)](endpoint-dlp-using.md#scenario-6-monitor-or-restrict-user-activities-on-sensitive-service-domains-preview) for more information. - Audit or restrict activities on Windows devices To use `Audit or restrict activities on Windows devices`, you have to configure options in **DLP settings** and in the policy in which you want to use them. See, [Restricted apps and app groups](dlp-configure-endpoint-settings.md#restricted-apps-and-app-groups) for more information. |
| compliance | Ediscovery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ediscovery.md | The following sections show the minimum subscription requirements for Content se ### eDiscovery (Standard) -- Exchange online Plan 2-- Sharepoint online Plan 2+- Exchange Online Plan 2 +- SharePoint Online Plan 2 - Microsoft 365 E3 subscription - Microsoft 365 G3 subscription - Microsoft 365 Business Premium subscription |
| compliance | Insider Risk Management Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-configure.md | Insider risk management policies include assigned users and define which types o - File extensions: Add up to 50 file extensions. You can include or omit the '.' with the file extension. For example, *.py* or *py* would prioritize Python files. > [!NOTE]- > Users configuring the policy and selecting priority Share Point sites can select SharePoint sites that they have permission to access. If SharePoint sites aren't available for selection in the policy by the current user, another user with the required permissions can select the sites for the policy later or the current user should be given access to the required sites. + > Users configuring the policy and selecting priority SharePoint sites can select SharePoint sites that they have permission to access. If SharePoint sites aren't available for selection in the policy by the current user, another user with the required permissions can select the sites for the policy later or the current user should be given access to the required sites. 12. Select **Next** to continue. 13. If you've selected the *General data leaks* or *Data leaks by priority users* templates, you'll see options on the **Triggers** for this policy page for custom-triggering events and policy indicators. You have the choice to select a DLP policy or indicators for triggering events that bring users assigned to the policy in-scope for activity scoring. If you select the **User matches a data loss prevention (DLP) policy triggering event** option, you must select a DLP policy from the DLP policy dropdown list to enable triggering indicators for the DLP Policy for this insider risk management policy. If you select the **User performs an exfiltration activity triggering event** option, you must select one or more of the listed indicators for the policy triggering event. |
| compliance | Insider Risk Management Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/insider-risk-management-policies.md | For example, your organization has a dedicated SharePoint site for a highly conf When you create an insider risk management policy in the policy wizard, you can choose from the following priorities: -- **SharePoint sites**: Any activity associated with all file types in defined SharePoint sites is assigned a higher risk score. Users configuring the policy and selecting priority Share Point sites can select SharePoint sites that they have permission to access. If SharePoint sites aren't available for selection in the policy by the current user, another user with the required permissions can select the sites for the policy later or the current user should be given access to the required sites.+- **SharePoint sites**: Any activity associated with all file types in defined SharePoint sites is assigned a higher risk score. Users configuring the policy and selecting priority SharePoint sites can select SharePoint sites that they have permission to access. If SharePoint sites aren't available for selection in the policy by the current user, another user with the required permissions can select the sites for the policy later or the current user should be given access to the required sites. - **Sensitive information types**: Any activity associated with content that contains [sensitive information types](sensitive-information-type-entity-definitions.md) are assigned a higher risk score. - **Sensitivity labels**: Any activity associated with content that has specific [sensitivity labels](sensitivity-labels.md) applied are assigned a higher risk score. - **File extensions**: Any activity associated with content that has specific file extensions. Users configuring a data theft/leak policy that select **File extensions to prioritize** in the policy wizard can define up to 50 file extensions to prioritize in the policy. Entered extensions can include or omit a '.' as the first character of the prioritized extension. Complete the following steps to create a new policy: - **File extensions**: Add up to 50 file extensions. You can include or omit the '.' with the file extension. For example, *.py* or *py* would prioritize Python files. >[!NOTE]- >Users configuring the policy and selecting priority Share Point sites can select SharePoint sites that they have permission to access. If SharePoint sites aren't available for selection in the policy by the current user, another user with the required permissions can select the sites for the policy later or the current user should be given access to the required sites. + >Users configuring the policy and selecting priority SharePoint sites can select SharePoint sites that they have permission to access. If SharePoint sites aren't available for selection in the policy by the current user, another user with the required permissions can select the sites for the policy later or the current user should be given access to the required sites. 12. Select **Next** to continue. 13. If you've selected the *General data leaks* or *Data leaks by priority users* templates, you'll see options on the **Triggers** for this policy page for custom triggering events and policy indicators. You have the choice to select a DLP policy or indicators for triggering events that bring users assigned to the policy in-scope for activity scoring. If you select the **User matches a data loss prevention (DLP) policy triggering event** option, you must select a DLP policy from the DLP policy dropdown list to enable triggering indicators for the DLP Policy for this insider risk management policy. If you select the **User performs an exfiltration activity triggering event** option, you must select one or more of the listed indicators for the policy triggering event. Complete the following steps to manage an existing policy: - **File extensions**: Add up to 50 file extensions. You can include or omit the '.' with the file extension. For example, *.py* or *py* would prioritize Python files. >[!NOTE]- >Users configuring the policy and selecting priority Share Point sites can select SharePoint sites that they have permission to access. If SharePoint sites aren't available for selection in the policy by the current user, another user with the required permissions can select the sites for the policy later or the current user should be given access to the required sites. + >Users configuring the policy and selecting priority SharePoint sites can select SharePoint sites that they have permission to access. If SharePoint sites aren't available for selection in the policy by the current user, another user with the required permissions can select the sites for the policy later or the current user should be given access to the required sites. 12. Select **Next** to continue. 13. If you've selected the *General data leaks* or *Data leaks by priority users* templates, you'll see options on the **Triggers** for this policy page for custom triggering events and policy indicators. You have the choice to select a DLP policy or indicators for triggering events that bring users assigned to the policy in-scope for activity scoring. If you select the **User matches a data loss prevention (DLP) policy triggering event** option, you must select a DLP policy from the DLP policy dropdown list to enable triggering indicators for the DLP Policy for this insider risk management policy. If you select the **User performs an exfiltration activity triggering event** option, you must select one or more of the listed indicators for the policy triggering event. |
| compliance | Sensitive Information Type Learn About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitive-information-type-learn-about.md | Every sensitive information type entity is defined by these fields:  -Learn more about confidence levels in this short video. +<!--Learn more about confidence levels in this short video. - > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4Hx60] + > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4Hx60]--> ### Example sensitive information type |
| compliance | Sensitivity Labels Aip | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-aip.md | Remember, when you use this method to disable the AIP add-in, you can still use Many of the labeling features supported by the AIP add-in are now supported by built-in labeling. For a more detailed list of capabilities, minimum versions that might be needed, and configuration information, see [Manage sensitivity labels in Office apps](sensitivity-labels-office-apps.md). -More features are planned and in development. If there's a specific feature that you're interested in, check the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap?filters=Microsoft%20Information%20Protection&searchterms=sensitivity) and consider joining the [Microsoft Information Protection in Office Private Preview](https://aka.ms/MIP/PreviewRing). +More features are planned and in development. If there's a specific feature that you're interested in, check the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap?filters=Microsoft%20Information%20Protection&searchterms=label) and consider joining the [Microsoft Information Protection in Office Private Preview](https://aka.ms/MIP/PreviewRing). Use the following information to help you identify if you're using a feature from the AIP add-in that isn't yet supported by built-in labeling: |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | If you can't upgrade to Microsoft 365 Apps for enterprise for the subscription v ## Support for sensitivity label capabilities in apps -The following tables list the minimum Office version that introduced specific capabilities for sensitivity labels that are built in to Office apps. Or, if the label capability is in public preview or under review for a future release. Use the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap?filters=Microsoft%20Information%20Protection&searchterms=sensitivity) for details about new capabilities that are planned for future releases. +The following tables list the minimum Office version that introduced specific capabilities for sensitivity labels that are built in to Office apps. Or, if the label capability is in public preview or under review for a future release. Use the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap?filters=Microsoft%20Information%20Protection&searchterms=label) for details about new capabilities that are planned for future releases. New versions of Office apps are made available at different times for different update channels. For Windows, you'll get the new capabilities earlier when you are on the Current Channel or Monthly Enterprise Channel, rather than Semi-Annual Enterprise Channel. The minimum version numbers can also be different from one update channel to the next. For more information, see [Overview of update channels for Microsoft 365 Apps](/deployoffice/overview-update-channels) and [Update history for Microsoft 365 Apps](/officeupdates/update-history-microsoft365-apps-by-date). |
| compliance | Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels.md | You can use sensitivity labels to: In all these cases, sensitivity labels from Microsoft Purview can help you take the right actions on the right content. With sensitivity labels, you can classify data across your organization, and enforce protection settings based on that classification. That protection then stays with the content. -For more information about these and other scenarios that are supported by sensitivity labels, see [Common scenarios for sensitivity labels](get-started-with-sensitivity-labels.md#common-scenarios-for-sensitivity-labels). New features are being developed all the time that support sensitivity labels, so you might also find it useful to check the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap?filters=Microsoft%20Information%20Protection&searchterms=sensitivity). +For more information about these and other scenarios that are supported by sensitivity labels, see [Common scenarios for sensitivity labels](get-started-with-sensitivity-labels.md#common-scenarios-for-sensitivity-labels). New features are being developed all the time that support sensitivity labels, so you might also find it useful to check the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap?filters=Microsoft%20Information%20Protection&searchterms=label). ## What a sensitivity label is |
| compliance | Sit Defn Azure Devops App Secret | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sit-defn-azure-devops-app-secret.md | Any combination of 52 characters consisting of: for example: -`ntpi2ch67ci2vjzcohglogyygwo5fuyl365n2zdowwxhsys6jnoa` +`abcdefghijklmnopqrstuvwxyz234567abcdefghijklmnopqrst` ## Checksum This SIT is designed to match the security information that's used to authentica It uses several primary resources: -- Patterns of Base32 encoded 256 bits symmetric key.+- Patterns of Base32 encoded 256-bits symmetric key. - Patterns of CredentialName, CredentialFeatures, AccountIdentityName, AccountIdentityValue, ResourceType, ResourceName. - Patterns of mockup values, redactions, and placeholders. - A dictionary of vocabulary -The patterns are designed to match actual credentials with reasonable confidence. The patterns do not match credentials formatted as examples. Mockup values, redacted values, and placeholders, like credential type or usage descriptions, in the position where an actual secret value should present will not be matched. +The patterns are designed to match actual credentials with reasonable confidence. The patterns don't match credentials formatted as examples. Mockup values, redacted values, and placeholders, like credential type or usage descriptions, in the position where an actual secret value should present won't be matched. ## Keywords |
| contentunderstanding | Content Assembly | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/content-assembly.md | description: Learn how to automatically create documents and other content using # Create documents using content assembly in Microsoft SharePoint Syntex -You can use SharePoint Syntex to help you automatically generate standard repetitive business documents, such as contracts, statements of work, service agreements, letters of consent, sales pitches, and correspondence. You can do all this quicker, more consistentently, and less prone to errors by using content assembly in SharePoint Syntex. +You can use SharePoint Syntex to help you automatically generate standard repetitive business documents, such as contracts, statements of work, service agreements, letters of consent, sales pitches, and correspondence. You can do all this quicker, more consistentently, and with fewer errors by using content assembly in SharePoint Syntex. -With content assembly, you can use an existing document to create a *modern template*, and then use that template to automatically generate new content using SharePoint lists or user inputs as a data source. +With content assembly, you can use an existing document to create a *modern template*, and then use that template to automatically generate new content using SharePoint lists or manual entries as a data source. > [!NOTE] > You must be a licensed SharePoint Syntex user to access and use content assembly capabilities. You also must have permissions to manage SharePoint lists. On the **All placeholders** panel: 4. Select **Add**. + > [!NOTE] + > You can configure multiple date formatters such as MM/DD/YYYY, DD/MM/YYYY, YYYY/MM/DD, and Month DD, including setting time in both 12-hour and 24-hour format. + ### Associate a placeholder by selecting from choices in a column of a list or library On the **All placeholders** panel: |
| enterprise | Portallaunchscheduler | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/PortalLaunchScheduler.md | Formerly, portal launches could only be scheduled through SharePoint PowerShell. **Option 1: Send users to an existing SharePoint page (bidirectional)** ΓÇô Use this option when launching a new modern SharePoint portal to replace an existing SharePoint portal. Users in active waves will be redirected to the new site regardless of whether they navigate to the old or new site. Users in a non-launched wave that try to access the new site will be redirected back to the old site until their wave is launched. > [!NOTE]- > When using the bidirectional option, the person scheduling the launch must also have site owner permissions to the other SharePoint portal. + > When using the bidirectional option, the person scheduling the launch must have site owner permissions to both the new SharePoint portal and existing SharePoint portal. Additionally, the two site URLs must exist within the same tenant/domain in order to validate appropriate permissions. **Option 2: Send users to an autogenerated temporary page (temporary page redirection)** ΓÇô Use a temporary page redirection should be used when no existing SharePoint portal exists. Users are directed to a new modern SharePoint portal and if a user is in a wave that has not been launched, they will be redirected to a temporary page. |
| enterprise | Move Sharepoint Between Geo Locations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/move-sharepoint-between-geo-locations.md | SharePoint 2013 workflows have to be republished after the site move. SharePoint If you are moving a site with apps, you must reinstantiate the app in the site's new geo location as the app and its connections may not be available in the destination geo location. -### Flow +### Power Automate -In most cases, Flows will continue to work after a SharePoint site geo move. We recommend that you test them once the move has completed. +In most cases, Power Automate Flows will continue to work after a SharePoint site geo move. We recommend that you test them once the move has completed. ### Power Apps |
| frontline | Flw Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/flw-overview.md | appliesto: Frontline workers are employees whose primary function is to work directly with customers or the general public providing services, support, and selling products, or employees directly involved in the manufacturing and distribution of products and services. Microsoft 365 for frontline workers helps support employee experiences in the following areas so that your frontline workers can do their best work and help your customers: -- [Connect and engage your workforce](#connect-and-engage-your-workforce)-- [Enhance your workforce management](#enhance-workforce-management)-- [Increase operations efficiency](#increase-operations-efficiency)--Microsoft 365 for frontline workers also: --- Provides [support for modern devices](#modern-devices) and-- Helps [safeguard your business](#safeguard-your-business) with security and compliance offerings.+- [Enhance communications and collaboration](#enhance-communications-and-collaboration) +- [Transform employee experiences](#transform-employee-experiences) +- [Increase frontline operational efficiency](#increase-frontline-operational-efficiency) +- Helps [safeguard your business](#safeguard-your-business) with security and compliance offerings, including providing [support for modern devices](#secure-endpoints-and-apps-across-device-types-and-operating-systems) The following image shows the employee experiences that are key to frontline workers, and common areas where Microsoft 365 can improve experiences for frontline workers: ### Licensing for your frontline workers [Microsoft 365 for frontline workers](https://www.microsoft.com/microsoft-365/enterprise/frontline) is optimized for a mobile workforce that primarily interacts with customers, but also needs to stay connected to the rest of your organization. -Microsoft 365 for frontline workers refers to the Microsoft 365 F3 and F1 licenses or Office 365 F3 license, but you can also use an Enterprise license (E1, E3, E5) to implement any of the frontline scenarios. Learn more about [licensing options for frontline workers](flw-licensing-options.md) and which license types you should use for different types of users in your organization. +Microsoft 365 for frontline workers refers to the Microsoft 365 F3 and F1 licenses or Office 365 F3 license, but you can also use an Enterprise license (E1, E3, E5) to implement any of the frontline scenarios. Learn more about [licensing options for frontline workers](flw-licensing-options.md) and which license types you should use for different types of users in your organization. Some features are available for F3 licenses, but not F1, such as Power Apps and Power Automate. For a detailed comparison of what's included in Microsoft 365 with various licenses, see this [Comparison table](https://go.microsoft.com/fwlink/?linkid=2139145). -## Connect and engage your workforce +## Enhance communications and collaboration -Enrich your communications and employee experiences with Microsoft 365 for frontline workers. Using Microsoft Teams, SharePoint, Viva Connections, and Viva Learning, you can connect employees with the tools, people, and devices they need to do their best work and build skills faster. For example: +Streamline team and one-on-one communication across your entire organization with Microsoft 365 for frontline workers capabilities. You can enrich and expand corporate communications with Viva Connections to make sure each of your workers feels connected to your broader organization. Make sure your workforce is able to seamlessly communicate with Teams chats, notifications, Walkie Talkie, and more. | Icon | Solution area | Description | | | | | |:::image type="icon" source="/office/medi#communications) | Connect your frontline workforce and enable them to communicate and share information effectively, whether within their team, across locations, or across your entire company. |-|:::image type="icon" source="/office/medi#wellbeing--engagement) | Nurture a sense of belonging with your frontline employees by helping them engage with your entire organization.| -|:::image type="icon" source="/office/medi#training--onboarding) | Promote continual growth for your employees and encourage knowledge sharing and exchange.| -## Enhance workforce management +## Transform employee experiences -Enhance workforce management with [Shifts](shifts-for-teams-landing-page.md), the schedule management tool in Teams that keeps your frontline workforce connected and in sync. [Shifts connectors](shifts-connectors.md) enable you to integrate Shifts with your workforce management (WFM) system. After you set up a connection, your frontline workers can seamlessly view and manage their schedules in your WFM system from within Shifts. +Foster an inclusive company culture and increase employee wellbeing while making sure all of your workers have the resources they need to succeed. Using Microsoft Teams, SharePoint, Viva Connections, and Viva Learning, you can connect employees with the tools, people, and devices they need to do their best work and build skills faster. For example: | Icon | Solution area | Description | | | | |-|:::image type="icon" source="/office/medi#schedule-management) | Simplify and streamline schedule coordination with your frontline workforce. Gain visibility into their schedules and enable them to arrange for cover and leave. | +|:::image type="icon" source="/office/medi#wellbeing--engagement) | Nurture a sense of belonging with your frontline employees by helping them engage with your entire organization.| +|:::image type="icon" source="/office/medi#training--onboarding) | Promote continual growth for your employees and encourage knowledge sharing and exchange.| -## Increase operations efficiency +## Increase frontline operational efficiency -Microsoft 365 includes apps liked Lists, Tasks, and Approvals, that can help you streamline operations and bring them from paper-based to digitally-tracked processes. You can enhance these by adding workflow automation, custom apps, and business data tracking with Power Automate, Power Apps, and Power BI from the Power Platform. Extend even further with solutions provided by our partners in the digital ecosystem. +Microsoft 365 includes apps like Lists, Tasks, and Approvals that can help you streamline operations and bring them from paper-based to digitally tracked processes. You can enhance these by adding workflow automation, custom apps, and business data tracking with Power Automate, Power Apps, and Power BI from the Power Platform. Extend even further with solutions provided by our partners in the digital ecosystem. ++Enhance workforce management with [Shifts](shifts-for-teams-landing-page.md), the schedule management tool in Teams that keeps your frontline workforce connected and in sync. [Shifts connectors](shifts-connectors.md) enable you to integrate Shifts with your workforce management (WFM) system. After you set up a connection, your frontline workers can seamlessly view and manage their schedules in your WFM system from within Shifts. | Icon | Solution area | Description | | | | |+|:::image type="icon" source="/office/medi#schedule-management) | Simplify and streamline schedule coordination with your frontline workforce. Gain visibility into their schedules and enable them to arrange for cover and leave. | |:::image type="icon" source="/office/medi#digitized-processes) | Drive operational efficiency by digitizing paper-based processes, and automating routine, repetitive steps. | |:::image type="icon" source="/office/medi#more-scenarios-and-solutions-with-the-digital-ecosystem) | Unite the technology your frontline workforce depends on behind a single pane of glass for a seamless end-to-end experience. Include partner solutions and take advantage of integrations that help streamline processes. | ## Safeguard your business -Safeguard your business with best-in-class security and compliance features. Microsoft 365 for frontline workers offers identity and access management, identity and threat protection, and security management. The offerings available to your workforce in these areas depends on the licenses you assign to your users in the Microsoft 365 admin center. For more information about security and compliance in Microsoft 365, see the following resources: +Safeguard your business with best-in-class security and compliance features. Microsoft 365 for frontline workers offers identity and access management, identity and threat protection, and security management. The offerings available to your workforce in these areas depends on the licenses you assign to your users in the Microsoft 365 admin center. ++### Manage identities and access with Azure Active Directory ++|Capability |License availability | +|--|| +|[Azure Active Directory fundamentals](/azure/active-directory/fundamentals/active-directory-whatis) |Enterprise, F1, F3 | ++### Mitigate compliance and privacy risks ++|Capability |License availability | +|--|| +|[Introduction to security in Microsoft 365](/learn/modules/security-in-m365/) |Enterprise, F1, F3 | +|[Introduction to compliance tools in Microsoft 365](/learn/modules/compliance-in-m365/) |Enterprise, F1, F3 | +|[Quick tasks for getting started with Microsoft Purview](/microsoft-365/compliance/compliance-quick-tasks) |Enterprise, available as an add-on for F3 | ++### Simplify deployment and management at scale ++|Capability |License availability | +|--|| +|[Frontline worker onboarding wizard](flw-onboarding-wizard.md) |Enterprise, F1, F3 | +|[Deploy Teams at scale](deploy-teams-at-scale.md) |Enterprise, F1, F3 | +|[Teams policy packages for frontline workers](/microsoftteams/policy-packages-flw) |Enterprise, F1, F3 | -- [Introduction to security in Microsoft 365](/learn/modules/security-in-m365/)-- [Introduction to compliance tools in Microsoft 365](/learn/modules/compliance-in-m365/)-- [Quick tasks for getting started with Microsoft Purview](/microsoft-365/compliance/compliance-quick-tasks)+### Secure endpoints and apps across device types and operating systems -## Modern devices +Equip your employees with industry-specific devices tailored for their needs, or provide a more secure way to communicate on shared or personal devices with Microsoft 365 and Microsoft Teams. -Equip your employees with industry-specific devices tailored for their needs, or provide a more secure way to communicate on shared or personal devices with Microsoft 365 and Microsoft Teams. To learn more, see [Manage mobile devices for frontline workers](flw-devices.md). +|Capability |License availability | +|--|| +|[Manage mobile devices for frontline workers](flw-devices.md) |Enterprise, F1, F3 | +|[Manage devices with Intune](/microsoft-365/solutions/manage-devices-with-intune-overview) |Enterprise, F1, F3 | +|[Microsoft Endpoint Manager overview](/mem/endpoint-manager-overview) |Enterprise, F1, F3 | +|[Device partner integrations with Intune](/mem/intune/protect/device-compliance-partners) |Enterprise, F1, F3 | ## Adoption principles to help envision and implement business scenarios -You can implement many helpful scenarios for frontline workers quickly, using out-of-the-box capabilities. For a list of scenarios we recommend and provide guidance for, see [Choose your scenarios](flw-choose-scenarios.md). +You can implement many helpful scenarios for frontline workers quickly, using out-of-the-box capabilities. For a list of scenarios we recommend and provide guidance for, see [Choose your scenarios](flw-choose-scenarios.md). -However, it also pays to spend time thinking through exactly what you want to achieve organizationally and setting the appropriate groundwork. Particularly if you need to enhance out-of-the-box scenarios with integrated or custom solutions from solution providers or partners, you'll want to spend time planning and envisioning before you dive in. +However, it also pays to spend time thinking through exactly what you want to achieve organizationally and setting the appropriate groundwork. Particularly if you need to enhance out-of-the-box scenarios with integrated or custom solutions from solution providers or partners, you'll want to spend time planning and envisioning before you dive in. The principles below are based on information from the [Frontline Worker Solutions Success Kit](https://aka.ms/TeamsFLWSuccessKit). Find more adoption resources on the [frontline worker section of the Microsoft Adoption site](https://adoption.microsoft.com/microsoft-teams/frontline-workers/). |
| security | Compare Mdb M365 Plans | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/compare-mdb-m365-plans.md | Microsoft offers a wide variety of cloud solutions and services, including plans | Microsoft Defender for Business (standalone) | Microsoft 365 Business Premium | |:|:|-| Antivirus, antimalware, and ransomware protection capabilities for devices include: <ul><li>[Next-generation protection](../defender-endpoint/microsoft-defender-antivirus-in-windows-10.md) (antivirus/antimalware protection on devices together with cloud protection)</li><li>[Attack surface reduction](../defender-endpoint/overview-attack-surface-reduction.md) (network protection, firewall, and attack surface reduction rules) <sup>[[a](#fna)]</sup></li><li>[Endpoint detection and response](../defender-endpoint/overview-endpoint-detection-response.md) (behavior-based detection and manual response actions)</li><li>[Automated investigation and response](../defender/m365d-autoir.md) (with self-healing for detected threats)</li><li>[Threat and vulnerability management](mdb-view-tvm-dashboard.md) (view exposed devices and recommendations)</li><li>[Cross-platform support for devices](mdb-onboard-devices.md) (Windows, Mac, iOS, and Android) <sup>[[b](#fnb)]</sup></li><li>[Centralized management and reporting](mdb-get-started.md) (Microsoft 365 Defender portal)</li><li>[APIs for integration](../defender-endpoint/management-apis.md) (for Microsoft partners or your custom tools and apps)</li></ul><br/><br/><br/><br/><br/><br/><br/> | Productivity and security capabilities include:<ul><li>[Microsoft 365 Business Standard](../../admin/admin-overview/what-is-microsoft-365-for-business.md) (Office apps and services, and Microsoft Teams)</li><li>[Shared computer activation](/deployoffice/overview-shared-computer-activation) (for deploying Microsoft 365 Apps)</li><li>[Windows 10/11 Business](../../business-premium/m365bp-upgrade-windows-10-pro.md) (upgrade from previous versions of Windows Pro)</li><li>[Windows Autopilot](/mem/autopilot/windows-autopilot) (for setting up and configuring Windows devices)</li><li>[Exchange Online Protection](../office-365-security/exchange-online-protection-overview.md) (antiphishing, antispam, antimalware, and spoof intelligence for email)</li><li>[Defender for Business](mdb-overview.md) (everything listed in the "Defender for Business (standalone)" column) </li><li>[Microsoft Defender for Office 365 Plan 1](../office-365-security/overview.md) (advanced antiphishing, real-time detections, Safe Attachments, Safe Links)</li><li>[Auto-expanding archiving](../../compliance/autoexpanding-archiving.md) (for email)</li><li>[Azure Active Directory Premium Plan 1](/azure/active-directory/fundamentals/active-directory-whatis) (identity management)</li><li>[Microsoft Intune](/mem/intune/fundamentals/what-is-intune) (device onboarding and management)</li><li>[Azure Information Protection Premium Plan 1](/azure/information-protection/what-is-information-protection) (protection for sensitive information)</li><li>[Azure Virtual Desktop](/azure/virtual-desktop/overview) (centrally managed, secure virtual machines in the cloud)</li></ul> | +| Antivirus, antimalware, and ransomware protection capabilities for devices include: <ul><li>[Next-generation protection](../defender-endpoint/microsoft-defender-antivirus-in-windows-10.md) (antivirus/antimalware protection on devices together with cloud protection)</li><li>[Attack surface reduction](../defender-endpoint/overview-attack-surface-reduction.md) (network protection, firewall, and attack surface reduction rules) <sup>[[a](#fna)]</sup></li><li>[Endpoint detection and response](../defender-endpoint/overview-endpoint-detection-response.md) (behavior-based detection and manual response actions)</li><li>[Automated investigation and response](../defender/m365d-autoir.md) (with self-healing for detected threats)</li><li>[Threat and vulnerability management](mdb-view-tvm-dashboard.md) (view exposed devices and recommendations)</li><li>[Cross-platform support for devices](mdb-onboard-devices.md) (Windows, Mac, iOS, and Android) <sup>[[b](#fnb)]</sup></li><li>[Centralized management and reporting](mdb-get-started.md) (Microsoft 365 Defender portal)</li><li>[APIs for integration](../defender-endpoint/management-apis.md) (for Microsoft partners or your custom tools and apps)</li><li>[Microsoft Intune](/mem/intune/fundamentals/what-is-intune) (Endpoint security)</li></ul><br/><br/><br/><br/><br/><br/> | Productivity and security capabilities include:<ul><li>[Microsoft 365 Business Standard](../../admin/admin-overview/what-is-microsoft-365-for-business.md) (Office apps and services, and Microsoft Teams)</li><li>[Shared computer activation](/deployoffice/overview-shared-computer-activation) (for deploying Microsoft 365 Apps)</li><li>[Windows 10/11 Business](../../business-premium/m365bp-upgrade-windows-10-pro.md) (upgrade from previous versions of Windows Pro)</li><li>[Windows Autopilot](/mem/autopilot/windows-autopilot) (for setting up and configuring Windows devices)</li><li>[Exchange Online Protection](../office-365-security/exchange-online-protection-overview.md) (antiphishing, antispam, antimalware, and spoof intelligence for email)</li><li>[Defender for Business](mdb-overview.md) (everything listed in the "Defender for Business (standalone)" column) </li><li>[Microsoft Defender for Office 365 Plan 1](../office-365-security/overview.md) (advanced antiphishing, real-time detections, Safe Attachments, Safe Links)</li><li>[Auto-expanding archiving](../../compliance/autoexpanding-archiving.md) (for email)</li><li>[Azure Active Directory Premium Plan 1](/azure/active-directory/fundamentals/active-directory-whatis) (identity management)</li><li>[Microsoft Intune](/mem/intune/fundamentals/what-is-intune) (Endpoint security)</li><li>[Azure Information Protection Premium Plan 1](/azure/information-protection/what-is-information-protection) (protection for sensitive information)</li><li>[Azure Virtual Desktop](/azure/virtual-desktop/overview) (centrally managed, secure virtual machines in the cloud)</li></ul> | -(<a id="fna">a</a>) Microsoft Intune is required to modify or customize attack surface reduction rules. Intune is included in Microsoft 365 Business Premium. +(<a id="fna">a</a>) Use Microsoft Intune to modify or customize attack surface reduction rules. -(<a id="fnb">b</a>) Microsoft Intune is required to onboard iOS and Android devices. See [Onboard devices to Microsoft Defender for Business](mdb-onboard-devices.md). +(<a id="fnb">b</a>) Use Intune to onboard iOS, iPadOS, and Android devices. See [Onboard devices to Microsoft Defender for Business](mdb-onboard-devices.md). ## Compare Microsoft Defender for Business to Microsoft Defender for Endpoint Plans 1 and 2 Defender for Business brings the enterprise-grade capabilities of Defender for E |Partner APIs|Yes|Yes|Yes| |[Microsoft 365 Lighthouse integration](../../lighthouse/m365-lighthouse-overview.md) <br/>(For viewing security incidents across customer tenants)|Yes |Yes <sup>[[7](#fn7)]</sup>|Yes <sup>[[7](#fn7)]</sup>| -(<a id="fn1">1</a>) Onboard and manage devices in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) or by using Microsoft Intune, managed in the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). +(<a id="fn1">1</a>) Onboard and manage devices in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) or by using Intune, managed in the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). (<a id="fn2">2</a>) Endpoint detection and response (EDR) capabilities in Defender for Business include behavior-based detection and the following manual response actions: - Run antivirus scan |
| security | Get Defender Business | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/get-defender-business.md | When you're ready to get started, you'll work with two main portals: the Microso | The Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) | Use the Microsoft 365 Defender portal to set up and configure Defender for Business.<p>You'll use the Microsoft 365 Defender portal to: <ul><li>View your devices and device protection policies.</li><li>View detected threats and take action.</li><li>View security recommendations and manage your security settings.</li></ul><p>To learn more, see [Get started using the Microsoft 365 Defender portal](mdb-get-started.md). | > [!TIP]-> If you have Microsoft 365 Business Premium, then you also have Microsoft Intune. You can use the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com/](https://endpoint.microsoft.com/)) to manage devices and configure security settings. To learn more about Intune, see [Microsoft Intune is an MDM and MAM provider for your devices](/mem/intune/fundamentals/what-is-intune). +> You can use the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com/](https://endpoint.microsoft.com/)) to onboard devices, and to configure security settings. To learn more about Intune, see [Microsoft Intune is an MDM and MAM provider for your devices](/mem/intune/fundamentals/what-is-intune). ## Next steps |
| security | Mdb Configure Security Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-configure-security-settings.md | The following table describes advanced feature settings. | **Show user details**<br/>(turned on by default) | Enables people in your organization to see details, such as employees' pictures, names, titles, and departments. These details are stored in Azure Active Directory (Azure AD).<br/><br/>[Learn more about user profiles in Azure AD](/azure/active-directory/fundamentals/active-directory-users-profile-azure-portal). | | **Skype for Business integration**<br/>(turned on by default) | Skype for Business was retired in July 2021. If you haven't already moved to Microsoft Teams, see [Set up Microsoft Teams in your small business](/microsoftteams/deploy-small-business). <br/><br/>Integration with Microsoft Teams (or the former Skype for Business) enables one-click communication between people in your business. | | **Web content filtering**<br/>(turned on by default) | Blocks access to websites that contain unwanted content and tracks web activity across all domains. See [Set up web content filtering](#set-up-web-content-filtering). |-| **Microsoft Intune connection**<br/>(we recommend you turn on this setting if you have Intune) | If your organization's subscription includes Microsoft Intune (included in [Microsoft 365 Business Premium](../../business/index.yml)), this setting enables Defender for Business to share information about devices with Intune. | +| **Microsoft Intune connection**<br/>(we recommend you turn on this setting if you have Intune) | If your organization's subscription includes Microsoft Intune, this setting enables Defender for Business to share information about devices with Intune. | | **Device discovery**<br/>(turned on by default) | Enables your security team to find unmanaged devices that are connected to your company network. Unknown and unmanaged devices introduce significant risks to your network, whether it's an unpatched printer, a network device with a weak security configuration, or a server with no security controls.<br/><br/>Device discovery uses onboarded devices to discover unmanaged devices, so your security team can onboard the unmanaged devices and reduce your vulnerability. <br/><br/>[Learn more about device discovery](../defender-endpoint/device-discovery.md). | | **Preview features** | Microsoft is continually updating services such as Defender for Business to include new feature enhancements and capabilities. If you opt in to receive preview features, you'll be among the first to try upcoming features in the preview experience. <br/><br/>[Learn more about preview features](../defender-endpoint/preview.md). | |
| security | Mdb Onboard Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-onboard-devices.md | Choose one of the following options to onboard Windows client devices to Defende - [Local script](#local-script-for-windows-10-and-11) (for onboarding devices manually in the Microsoft 365 Defender portal) - [Group Policy](#group-policy-for-windows-10-and-11) (if you're already using Group Policy in your organization)-- [Microsoft Intune](#intune-for-windows-10-and-11) (included in [Microsoft 365 Business Premium](../../business-premium/index.md))+- [Microsoft Intune](#intune-for-windows-10-and-11) ### Local script for Windows 10 and 11 If you prefer to use Group Policy to onboard Windows clients, follow the guidanc ### Intune for Windows 10 and 11 -If your subscription includes Intune, you can onboard Windows clients and other devices in the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). For example, if you have [Microsoft 365 Business Premium](../../business/index.yml), you already have Intune as part of your subscription, and you can use Intune to onboard devices. --There are several methods available for enrolling devices in Intune. We recommend using one of the following methods: +You can onboard Windows clients and other devices in Intune by using the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). There are several methods available for enrolling devices in Intune. We recommend using one of the following methods: - [Enable Windows automatic enrollment for company-owned or company-managed devices](#enable-automatic-enrollment-for-windows-10-and-11) - [Ask users to enroll their own Windows 10/11 devices in Intune](#ask-users-enroll-their-own-windows-10-and-11-devices) Choose one of the following options to onboard Mac: ### Local script for Mac -When you run the local script on a Mac, it creates a trust with Azure Active Directory, if that trust doesn't already exist; enrolls the Mac in Microsoft Intune, if it isn't already enrolled; and then onboards the Mac to Defender for Business. The local script method works even if you don't currently have Intune. We recommend that you onboard up to 10 devices at a time using this method. +When you run the local script on a Mac, it creates a trust with Azure Active Directory, if that trust doesn't already exist; enrolls the Mac in Microsoft Intune, if it isn't already enrolled; and then onboards the Mac to Defender for Business. We recommend that you onboard up to 10 devices at a time using this method. 1. Go to the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)), and sign in. After a Mac is enrolled in Intune, you can add it to a device group. [Learn more ### Intune for Mac -If your subscription includes Microsoft Intune, you can onboard Mac in the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). For example, if you have [Microsoft 365 Business Premium](../../business/index.yml), you already have Intune as part of your subscription. --There are several methods available for enrolling Mac in Intune. We recommend one of the following methods: +You can enroll Mac computers in Intune by using the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)). There are several methods available for enrolling Mac in Intune. We recommend one of the following methods: - [Choose an option for company-owned Mac](#options-for-company-owned-mac) - [Ask users to enroll their own Mac in Intune](#ask-users-to-enroll-their-own-mac-in-intune) To view the list of devices that are onboarded to Defender for Business, go to t ## Mobile devices -You'll need Microsoft Intune to onboard mobile devices, such as Android and iOS/iPadOS devices. If you have [Microsoft 365 Business Premium](../../business/index.yml), you have Intune. --See the following resources to get help enrolling these devices into Intune: +You can use Microsoft Intune to onboard mobile devices, such as Android and iOS/iPadOS devices. See the following resources to get help enrolling these devices into Intune: - [Enroll Android devices](/mem/intune/enrollment/android-enroll) - [Enroll iOS or iPadOS devices](/mem/intune/enrollment/ios-enroll) |
| security | Mdb Requirements | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-requirements.md | The following table lists the basic requirements you need to configure and use D > [Azure Active Directory (Azure AD)](/azure/active-directory/fundamentals/active-directory-whatis) is used to manage user permissions and device groups. Azure AD is included in your Defender for Business subscription. > - If you don't have a Microsoft 365 subscription before you start your trial, Azure AD will be provisioned for you during the activation process. > - If you do have another Microsoft 365 subscription when you start your Defender for Business trial, you can use your existing Azure AD service. -> - If you're using [Microsoft 365 Business Premium](../../business/index.yml) when you start your Defender for Business trial, you have the option to manage your devices using Intune. ## Next steps |
| security | Mdb Simplified Configuration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-simplified-configuration.md | Microsoft Defender for Business features a simplified configuration process desi To onboard devices and configure security settings for your company's devices, you can choose from these experiences: - The simplified configuration process in Microsoft Defender for Business; or-- Use Microsoft Intune (included in [Microsoft 365 Business Premium](../../business-premium/index.md)).+- Use Microsoft Intune. ## What to do The following table describes each experience. | Portal experience | Description | |||-| The simplified configuration experience in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) <br/>(*This option is recommended for customers who don't have Intune*) | The simplified configuration experience includes a [wizard-like experience](mdb-use-wizard.md) to help you set up and configure Defender for Business. Simplified configuration also includes default security settings and policies to help protect your company's devices as soon as they're onboarded to Defender for Business. You can view and edit your default policies to suit your business needs. To learn more, see [View or edit device policies in Microsoft Defender for Business](mdb-view-edit-policies.md).<br/><br/>With the simplified experience, your security team uses the Microsoft 365 Defender portal as a one-stop shop to: <ul><li>Set up and configure Defender for Business</li><li>View and manage incidents</li><li>Respond to and mitigate threats</li><li>View reports</li><li>Review pending or completed actions | -| The Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) | Microsoft Intune is a cloud-based mobile device management (MDM) and mobile application management (MAM) provider for apps and devices. If you're already using Intune, you can continue to use the Endpoint Manager admin center to manage devices such as mobile phones, tablets, and laptops. See [Microsoft Intune: Device management](/mem/intune/fundamentals/what-is-device-management). <br/><br/>Intune isn't included in the standalone version of Defender for Business, but you can add it to your subscription if necessary. If you have [Microsoft 365 Business Premium](../../business-premium/index.md), then you already have Intune. | +| The simplified configuration experience in the Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) | The simplified configuration experience includes a [wizard-like experience](mdb-use-wizard.md) to help you set up and configure Defender for Business. Simplified configuration also includes default security settings and policies to help protect your company's devices as soon as they're onboarded to Defender for Business. You can view and edit your default policies to suit your business needs. To learn more, see [View or edit device policies in Microsoft Defender for Business](mdb-view-edit-policies.md).<br/><br/>With the simplified experience, your security team uses the Microsoft 365 Defender portal as a one-stop shop to: <ul><li>Set up and configure Defender for Business</li><li>View and manage incidents</li><li>Respond to and mitigate threats</li><li>View reports</li><li>Review pending or completed actions | +| The Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) | Microsoft Intune is a cloud-based mobile device management (MDM) and mobile application management (MAM) provider for apps and devices. If you're already using Intune, you can continue to use the Endpoint Manager admin center to manage devices such as mobile phones, tablets, and laptops. See [Microsoft Intune: Device management](/mem/intune/fundamentals/what-is-device-management). | ## Next steps |
| security | Trial Playbook Defender Business | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/trial-playbook-defender-business.md | audience: Admin ms.localizationpriority: high Last updated : 08/10/2022 ms.prod: m365-security ms.technology: mdb search.appverid: If you used the setup wizard but you need to onboard more devices, such as non-W | Device type | Onboarding methods | |:|:|- | [Windows clients](mdb-onboard-devices.md) | Choose one of the following options to onboard Windows client devices to Defender for Business:<ul><li>Local script (for onboarding devices manually in the Microsoft 365 Defender portal)</li><li>Group Policy (if you're already using Group Policy and prefer this method)</li><li>Microsoft Intune (*recommended*; included in [Microsoft 365 Business Premium](../../business-premium/index.md))</li></ul> | - | [Mac](mdb-onboard-devices.md) | Choose one of the following options to onboard Mac:<ul><li>Local script for Mac (*recommended*)</li><li>Microsoft Intune for Mac (Intune is included in [Microsoft 365 Business Premium](../../business-premium/index.md))</li></ul><p>We recommend you use a local script to onboard Mac. Although you can [set up enrollment for Mac devices in Intune](/mem/intune/enrollment/macos-enroll), the local script is the simplest method for onboarding Mac to Defender for Business. | + | [Windows clients](mdb-onboard-devices.md) | Choose one of the following options to onboard Windows client devices to Defender for Business:<ul><li>Local script (for onboarding devices manually in the Microsoft 365 Defender portal)</li><li>Group Policy (if you're already using Group Policy and prefer this method)</li><li>Microsoft Intune (if you're already using Intune and prefer to continue using it)</li></ul> | + | [Mac](mdb-onboard-devices.md) | Choose one of the following options to onboard Mac:<ul><li>Local script for Mac (*recommended*)</li><li>Microsoft Intune for Mac </li></ul><p>We recommend you use a local script to onboard Mac. Although you can [set up enrollment for Mac devices in Intune](/mem/intune/enrollment/macos-enroll), the local script is the simplest method for onboarding Mac to Defender for Business. | | Windows Server and Linux servers | *The ability to onboard an instance of Windows Server or Linux Server is currently in preview and requires an additional license*. See the following articles to learn more: <ul><li>[Defender for Business requirements](mdb-requirements.md)</li><li>[Onboard devices to Defender for Business](mdb-onboard-devices.md)</li></ul> |- | [Mobile devices](mdb-onboard-devices.md) | You need Microsoft Intune to onboard mobile devices, such as Android and iOS/iPadOS devices. If you have [Microsoft 365 Business Premium](../../business-premium/index.md), Intune is part of your subscription. Intune can also be purchased separately. See the following resources to get help enrolling these devices into Intune:<ul><li>[Enroll Android devices](/mem/intune/enrollment/android-enroll)</li><li>[Enroll iOS or iPadOS devices](/mem/intune/enrollment/ios-enroll)</li></ul> | + | [Mobile devices](mdb-onboard-devices.md) | Use Microsoft Intune to onboard mobile devices, such as Android and iOS/iPadOS devices. See the following resources to get help enrolling these devices into Intune:<ul><li>[Enroll Android devices](/mem/intune/enrollment/android-enroll)</li><li>[Enroll iOS or iPadOS devices](/mem/intune/enrollment/ios-enroll)</li></ul> | 5. **[View and configure your security policies](mdb-configure-security-settings.md)**. After you onboard your company's devices to Defender for Business, the next step is to view and edit your security policies and settings. Defender for Business includes preconfigured security policies that use recommended settings. But you can edit the settings to suit your business needs. |
| security | Attack Surface Reduction Rules Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference.md | Advanced hunting action type: - AsrAdobeReaderChildProcessAudited - AsrAdobeReaderChildProcessBlocked -Dependencies: MDAV +Dependencies: Microsoft Defender Antivirus ### Block all Office applications from creating child processes Advanced hunting action type: - AsrOfficeChildProcessAudited - AsrOfficeChildProcessBlocked -Dependencies: MDAV +Dependencies: Microsoft Defender Antivirus ### Block credential stealing from the Windows local security authority subsystem Advanced hunting action type: - AsrLsassCredentialTheftAudited - AsrLsassCredentialTheftBlocked -Dependencies: MDAV +Dependencies: Microsoft Defender Antivirus ### Block executable content from email client and webmail Advanced hunting action type: - AsrExecutableEmailContentAudited - AsrExecutableEmailContentBlocked -Dependencies: MDAV +Dependencies: Microsoft Defender Antivirus > [!NOTE] > The rule **Block executable content from email client and webmail** has the following alternative descriptions, depending on which application you use: Advanced hunting action type: - AsrUntrustedExecutableAudited - AsrUntrustedExecutableBlocked -Dependencies: MDAV, Cloud Protection +Dependencies: Microsoft Defender Antivirus, Cloud Protection ### Block execution of potentially obfuscated scripts Advanced hunting action type: - AsrObfuscatedScriptAudited - AsrObfuscatedScriptBlocked -Dependencies: MDAV, AMSI +Dependencies: Microsoft Defender Antivirus, AMSI ### Block JavaScript or VBScript from launching downloaded executable content Advanced hunting action type: - AsrScriptExecutableDownloadAudited - AsrScriptExecutableDownloadBlocked -Dependencies: MDAV, AMSI +Dependencies: Microsoft Defender Antivirus, AMSI ### Block Office applications from creating executable content Advanced hunting action type: - AsrExecutableOfficeContentAudited - AsrExecutableOfficeContentBlocked -Dependencies: MDAV, RPC +Dependencies: Microsoft Defender Antivirus, RPC ### Block Office applications from injecting code into other processes Advanced hunting action type: - AsrOfficeProcessInjectionAudited - AsrOfficeProcessInjectionBlocked -Dependencies: MDAV +Dependencies: Microsoft Defender Antivirus ### Block Office communication application from creating child processes Advanced hunting action type: - AsrOfficeCommAppChildProcessAudited - AsrOfficeCommAppChildProcessBlocked -Dependencies: MDAV +Dependencies: Microsoft Defender Antivirus ### Block persistence through WMI event subscription Advanced hunting action type: - AsrPersistenceThroughWmiAudited - AsrPersistenceThroughWmiBlocked -Dependencies: MDAV, RPC +Dependencies: Microsoft Defender Antivirus, RPC ### Block process creations originating from PSExec and WMI commands Advanced hunting action type: - AsrPsexecWmiChildProcessAudited - AsrPsexecWmiChildProcessBlocked -Dependencies: MDAV +Dependencies: Microsoft Defender Antivirus ### Block untrusted and unsigned processes that run from USB Advanced hunting action type: - AsrUntrustedUsbProcessAudited - AsrUntrustedUsbProcessBlocked -Dependencies: MDAV +Dependencies: Microsoft Defender Antivirus ### Block Win32 API calls from Office macros Advanced hunting action type: - AsrOfficeMacroWin32ApiCallsAudited - AsrOfficeMacroWin32ApiCallsBlocked -Dependencies: MDAV, AMSI +Dependencies: Microsoft Defender Antivirus, AMSI ### Use advanced protection against ransomware Advanced hunting action type: - AsrRansomwareAudited - AsrRansomwareBlocked -Dependencies: MDAV, Cloud Protection +Dependencies: Microsoft Defender Antivirus, Cloud Protection |
| security | Configure Conditional Access | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-conditional-access.md | This section guides you through all the steps you need to take to properly imple You need to make sure that all your devices are enrolled in Intune. You can use any of the following options to enroll devices in Intune: -- IT Admin: For more information on how to enabling auto-enrollment, see [Windows Enrollment](/intune/windows-enroll#enable-windows-10-automatic-enrollment)+- IT Admin: For more information on how to enable auto-enrollment, see [Windows Enrollment](/intune/windows-enroll#enable-windows-10-automatic-enrollment) - End-user: For more information on how to enroll your Windows 10 and Windows 11 device in Intune, see [Enroll your Windows 10 device in Intune](/intune/quickstart-enroll-windows-device) - End-user alternative: For more information on joining an Azure AD domain, see [How to: Plan your Azure AD join implementation](/azure/active-directory/devices/azureadjoin-plan). Take the following steps to enable Conditional Access: 6. Select **Enable policy**, and then **Create** to save your changes. +> [!NOTE] +> You can use the Microsoft Defender for Endpoint app along with the Approved Client app policy in Intune to set Device Compliance and Conditional Access policies. There's no exclusion required for the Microsoft Defender for Endpoint app while setting up Conditional Access. Although Microsoft Defender for Endpoint on Android & iOS (App ID - dd47d17a-3194-4d86-bfd5-c6ae6f5651e3) isn't an approved app, it has permission to report device security posture. This permission enables the flow for compliance information to Conditional Access. +> Please note that this change will be available starting September 30, 2022. + For more information, see [Enforce compliance for Microsoft Defender for Endpoint with Conditional Access in Intune](/intune/advanced-threat-protection). > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-conditionalaccess-belowfoldlink) |
| security | Configure Server Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-server-endpoints.md | ms.pagetype: security ms.localizationpriority: medium Last updated : 08/10/2022 audience: ITPro Depending on the server that you're onboarding, the unified solution installs Mi |Windows Server 2016|Built-in|| |Windows Server 2019 or later|Built-in|Built-in| -If you have previously onboarded your servers using MMA, follow the guidance provided in [Server migration](server-migration.md) to migrate to the new solution. +If you've previously onboarded your servers using MMA, follow the guidance provided in [Server migration](server-migration.md) to migrate to the new solution. #### Known issues and limitations in the new, unified solution package for Windows Server 2012 R2 and 2016 The following specifics apply to the new unified solution package for Windows Server 2012 R2 and 2016: -- Ensure connectivity requirements as specified in [Enable access to Microsoft Defender for Endpoint service URLs in the proxy server](/microsoft-365/security/defender-endpoint/configure-proxy-internet?enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server) are met. They are equivalent to those for Windows Server 2019.-- We have identified an issue with Windows Server 2012 R2 connectivity to cloud when static TelemetryProxyServer is used **and** the certificate revocation list (CRL) URLs are not reachable from the SYSTEM account context. The immediate mitigation is to either use an alternative proxy option ("system-wide") that provides such connectivity, or configure the same proxy via the WinInet setting on the SYSTEM account context.+- Ensure connectivity requirements as specified in [Enable access to Microsoft Defender for Endpoint service URLs in the proxy server](/microsoft-365/security/defender-endpoint/configure-proxy-internet?enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server) are met. They're equivalent to those requirements for Windows Server 2019. +- We've identified an issue with Windows Server 2012 R2 connectivity to cloud when static TelemetryProxyServer is used **and** the certificate revocation list (CRL) URLs aren't reachable from the SYSTEM account context. The immediate mitigation is to either use an alternative proxy option ("system-wide") that provides such connectivity, or configure the same proxy via the WinInet setting on the SYSTEM account context. Alternatively, use the instructions provided at [Workaround for a known issue with TelemetryProxyServer on disconnected machines](#workaround-for-a-known-issue-with-telemetryproxyserver-on-disconnected-machines) to install a certificate as a workaround.-- Previously, the use of the Microsoft Monitoring Agent (MMA) on Windows Server 2016 and below allowed for the OMS / Log Analytics gateway to provide connectivity to Defender cloud services. The new solution, like Microsoft Defender for Endpoint on Windows Server 2019, Windows Server 2022, and Windows 10, does not support this gateway.+- Previously, the use of the Microsoft Monitoring Agent (MMA) on Windows Server 2016 and below allowed for the OMS / Log Analytics gateway to provide connectivity to Defender cloud services. The new solution, like Microsoft Defender for Endpoint on Windows Server 2019, Windows Server 2022, and Windows 10, doesn't support this gateway. - On Windows Server 2016, verify that Microsoft Defender Antivirus is installed, is active and up to date. You can download and install the latest platform version using Windows Update. Alternatively, download the update package manually from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623) or from [MMPC](https://go.microsoft.com/fwlink/?linkid=870379&arch=x64).-- On Windows Server 2012 R2, there is no user interface for Microsoft Defender Antivirus. In addition, the user interface on Windows Server 2016 only allows for basic operations. To perform operations on a device locally, refer to [Manage Microsoft Defender for Endpoint with PowerShell, WMI, and MPCmdRun.exe](/microsoft-365/security/defender-endpoint/manage-mde-post-migration-other-tools). As a result, features that specifically rely on user interaction, such as where the user is prompted to make a decision or perform a specific task, may not work as expected. It is recommended to disable or not enable the user interface nor require user interaction on any managed server as it may impact protection capability.+- On Windows Server 2012 R2, there's no user interface for Microsoft Defender Antivirus. In addition, the user interface on Windows Server 2016 only allows for basic operations. To perform operations on a device locally, refer to [Manage Microsoft Defender for Endpoint with PowerShell, WMI, and MPCmdRun.exe](/microsoft-365/security/defender-endpoint/manage-mde-post-migration-other-tools). As a result, features that specifically rely on user interaction, such as where the user is prompted to make a decision or perform a specific task, may not work as expected. It's recommended to disable or not enable the user interface nor require user interaction on any managed server as it may impact protection capability. - Not all Attack Surface Reduction rules are available on all operating systems. See [Attack Surface Reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules).-- To enable [Network Protection](/microsoft-365/security/defender-endpoint/network-protection), additional configuration is required:+- To enable [Network Protection](/microsoft-365/security/defender-endpoint/network-protection), more configurations are required: - `Set-MpPreference -EnableNetworkProtection Enabled` - `Set-MpPreference -AllowNetworkProtectionOnWinServer 1` - `Set-MpPreference -AllowNetworkProtectionDownLevel 1` - `Set-MpPreference -AllowDatagramProcessingOnWinServer 1` - In addition, on machines with a high volume of network traffic, performance testing in your environment is highly recommended before enabling this capability broadly. You may need to account for additional resource consumption. + In addition, on machines with a high volume of network traffic, performance testing in your environment is highly recommended before enabling this capability broadly. You may need to account for extra resource consumption. - On Windows Server 2012 R2, Network Events may not populate in the timeline. This issue requires a Windows Update released as part of the [October 12, 2021 monthly rollup (KB5006714)](https://support.microsoft.com/topic/october-12-2021-kb5006714-monthly-rollup-4dc4a2cd-677c-477b-8079-dcfef2bda09e).-- Operating system upgrades are not supported. Offboard then uninstall before upgrading.-- Automatic exclusions for **server roles** are not supported on Windows Server 2012 R2; however, built-in exclusions for operating system files are. For more information about adding exclusions, see [Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/topic/virus-scanning-recommendations-for-enterprise-computers-that-are-running-currently-supported-versions-of-windows-kb822158-c067a732-f24a-9079-d240-3733e39b40bc).-- On machines that have been upgraded from the previous, MMA-based solution and the EDR sensor is a (preview) version older than 10.8047.22439.1056, uninstalling and reverting back to the MMA-based solution may lead to crashes. If you are on such a preview version, please update using KB5005292.-- To deploy and onboard the new solution using Microsoft Endpoint Manager, this currently requires creating a package. For more information on how to deploy programs and scripts in Configuration Manager, see [Packages and programs in Configuration Manager](/configmgr/apps/deploy-use/packages-and-programs). MECM 2107 with the hotfix rollup or later is required to support policy configuration management using the Endpoint Protection node.+- Operating system upgrades aren't supported. Offboard then uninstall before upgrading. +- Automatic exclusions for **server roles** aren't supported on Windows Server 2012 R2; however, built-in exclusions for operating system files are. For more information about adding exclusions, see [Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/topic/virus-scanning-recommendations-for-enterprise-computers-that-are-running-currently-supported-versions-of-windows-kb822158-c067a732-f24a-9079-d240-3733e39b40bc). +- On machines that have been upgraded from the previous, MMA-based solution and the EDR sensor is a (preview) version older than 10.8047.22439.1056, uninstalling and reverting back to the MMA-based solution may lead to crashes. If you are on such a preview version, update using KB5005292. +- To deploy and onboard the new solution using Microsoft Endpoint Manager, this process currently requires creating a package. For more information on how to deploy programs and scripts in Configuration Manager, see [Packages and programs in Configuration Manager](/configmgr/apps/deploy-use/packages-and-programs). MECM 2107 with the hotfix rollup or later is required to support policy configuration management using the Endpoint Protection node. ## Workaround for a known issue with TelemetryProxyServer on disconnected machines When using the TelemetryProxyServer setting to specify a proxy to be used by the Affected scenario: -Microsoft Defender for Endpoint with Sense version number 10.8048.22439.1065 or earlier preview versions running on Windows Server 2012 R2--Using the TelemetryProxyServer proxy configuration; other methods are not affected+-Using the TelemetryProxyServer proxy configuration; other methods aren't affected Workaround: 1. Ensure the machine is running Sense version 10.8048.22439.1065 or higher by either installing using the latest package available from the onboarding page, or by applying KB5005292. For more information, see [Integration with Microsoft Defender for Cloud](azure- #### Prerequisites for Windows Server 2012 R2 -If you have fully updated your machines with the latest [monthly rollup](https://support.microsoft.com/topic/october-12-2021-kb5006714-monthly-rollup-4dc4a2cd-677c-477b-8079-dcfef2bda09e) package, there are **no** additional prerequisites. +If you've fully updated your machines with the latest [monthly rollup](https://support.microsoft.com/topic/october-12-2021-kb5006714-monthly-rollup-4dc4a2cd-677c-477b-8079-dcfef2bda09e) package, there are **no** other prerequisites. The installer package will check if the following components have already been installed via an update: The installer package will check if the following components have already been i #### Prerequisites for Windows Server 2016 - The Servicing Stack Update (SSU) from September 14, 2021 or later must be installed.-- The Latest Cumulative Update (LCU) from September 20, 2018 or later must be installed. It is recommended to install the latest available SSU and LCU on the server. - The Microsoft Defender Antivirus feature must be enabled/installed and up to date. You can download and install the latest platform version using Windows Update. Alternatively, download the update package manually from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623) or from [MMPC](https://go.microsoft.com/fwlink/?linkid=870379&arch=x64).+- The Latest Cumulative Update (LCU) from September 20, 2018 or later must be installed. It's recommended to install the latest available SSU and LCU on the server +- Enable the Microsoft Defender Antivirus (MDAV) feature and ensure it's up to date. For more information on enabling Defender Antivirus on Windows Server, see [Re-enable Defender Antivirus on Windows Server if it was disabled](enable-update-mdav-to-latest-ws.md#re-enable-microsoft-defender-antivirus-on-windows-server-if-it-was-disabled) and [Re-enable Defender Antivirus on Windows Server if it was uninstalled](enable-update-mdav-to-latest-ws.md#re-enable-microsoft-defender-antivirus-on-windows-server-if-it-was-uninstalled). +- Download and install the latest platform version using Windows Update. Alternatively, download the update package manually from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623) or from [MMPC](https://go.microsoft.com/fwlink/?linkid=870379&arch=x64). #### Prerequisites for running with third-party security solutions If you intend to use a third-party anti-malware solution, you'll need to run Microsoft Defender Antivirus in passive mode. You must remember to set to passive mode during the installation and onboarding process. > [!NOTE]-> If you're installing Microsoft Defender for Endpoint on Servers with McAfee Endpoint Security (ENS) or VirusScan Enterprise (VSE), the version of the McAfee platform may need to be updated to ensure Microsoft Defender Antivirus is not removed or disabled. For more information including the specific version numbers required, see, [McAfee Knowledge Center article](https://kc.mcafee.com/corporate/index?page=content&id=KB88214). +> If you're installing Microsoft Defender for Endpoint on Servers with McAfee Endpoint Security (ENS) or VirusScan Enterprise (VSE), the version of the McAfee platform may need to be updated to ensure Microsoft Defender Antivirus is not removed or disabled. For more information including the specific version numbers required, see, [McAfee Knowledge Center article](https://kcm.trellix.com/corporate/index?page=content&id=KB88214). #### Update package for Microsoft Defender for Endpoint on Windows Server 2012 R2 and 2016 If you're using Windows Server Update Services (WSUS) and/or Microsoft Endpoint ### STEP 1: Download installation and onboarding packages -You will need to download both the **installation** and **onboarding** packages from the portal. +You'll need to download both the **installation** and **onboarding** packages from the portal. > [!NOTE] > The installation package is updated monthly. Be sure to download the latest package before usage. Use the following steps to download the packages: ### STEP 2: Apply the installation and onboarding package -In this step you will install the prevention and detection components required before onboarding your device to the Microsoft Defender for Endpoint cloud environment, to prepare the machine for onboarding. Ensure all [prerequisites](#prerequisites) have been met. +In this step, you'll install the prevention and detection components required before onboarding your device to the Microsoft Defender for Endpoint cloud environment, to prepare the machine for onboarding. Ensure all [prerequisites](#prerequisites) have been met. > [!NOTE] > Microsoft Defender Antivirus will get installed and will be active unless you set it to passive mode. You can use the [installer script](server-migration.md#installer-script) to help > [!NOTE] > The installation script is signed. Any modifications to the script will invalidate the signature. When you download the script from GitHub, the recommended approach to avoid inadvertent modification is to download the source files as a zip archive then extract it to obtain the install.ps1 file (on the main Code page, click the Code dropdown menu and select "Download ZIP"). -This script can be used in a variety of scenarios, including those described in [Server migration scenarios from the previous, MMA-based Microsoft Defender for Endpoint solution](/microsoft-365/security/defender-endpoint/server-migration) and for deployment using Group Policy as described below. +This script can be used in various scenarios, including those scenarios described in [Server migration scenarios from the previous, MMA-based Microsoft Defender for Endpoint solution](/microsoft-365/security/defender-endpoint/server-migration) and for deployment using Group Policy as described below. ##### Apply the Microsoft Defender for Endpoint installation and onboarding packages using Group policy This script can be used in a variety of scenarios, including those described in 10. To link the GPO to an Organization Unit (OU), right-click and select **Link an existing GPO**. In the dialogue box that is displayed, select the Group Policy Object that you wish to link. Click **OK**. -For additional configuration settings, see [Configure sample collection settings](configure-endpoints-gp.md#configure-sample-collection-settings) and [Other recommended configuration settings](configure-endpoints-gp.md#other-recommended-configuration-settings). +For more configuration settings, see [Configure sample collection settings](configure-endpoints-gp.md#configure-sample-collection-settings) and [Other recommended configuration settings](configure-endpoints-gp.md#other-recommended-configuration-settings). ### STEP 3: Complete the onboarding steps After onboarding the device, you can choose to run a detection test to verify th sc.exe query sense ``` - The result should show it is running. If you encounter issues with onboarding, see [Troubleshoot onboarding](troubleshoot-onboarding.md). + The result should show it's running. If you encounter issues with onboarding, see [Troubleshoot onboarding](troubleshoot-onboarding.md). ## Run a detection test |
| security | Enable Update Mdav To Latest Ws | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-update-mdav-to-latest-ws.md | + + Title: Enable and update Microsoft Defender Antivirus on Windows Server +description: Learn how to enable and update Microsoft Defender Antivirus on Windows Server +keywords: Windows Server, Defender Antivirus +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: high Last updated : 08/10/2022++audience: ITPro ++ - M365-security-compliance + - m365-initiative-defender-endpoint +++ms.technology: mde +++# Enable and update Defender Antivirus to the latest version on Windows Server ++If you wish to use Microsoft Defender Antivirus on your Windows Server, and it had been previously disabled or uninstalled, you may need to take further steps to re-enable it and ensure it's fully updated. ++To enable and update Microsoft Defender Antivirus on Windows Server, perform the following steps: ++1. Install the latest Servicing Stack Update (SSU). +2. Install the latest cumulative update (LCU). +3. Reinstall Microsoft Defender Antivirus or re-enable it. For more information on how to reinstall or re-enable Microsoft Defender Antivirus on Windows Server, see [Re-enable Microsoft Defender Antivirus on Windows Server if it was disabled](#re-enable-microsoft-defender-antivirus-on-windows-server-if-it-was-disabled) and [Re-enable Microsoft Defender Antivirus on Windows Server if it was uninstalled](#re-enable-microsoft-defender-antivirus-on-windows-server-if-it-was-uninstalled). +4. Reboot the system. +5. Install the latest version of the platform update. ++ > [!NOTE] + > Re-enabling Microsoft Defender Antivirus doesn't automatically install the platform update. You can download and install the latest platform version using Windows update. Alternatively, you can download the update package from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4052623) or from the [Antimalware and cyber security portal](https://go.microsoft.com/fwlink/?linkid=870379&arch=x64). + > + > If you're preparing to install the modern, unified solution on Windows Server 2016, you can leverage the [Installer help script](https://github.com/microsoft/mdefordownlevelserver/blob/main/Install.ps1) to automate the platform update and the subsequent installation and onboarding. This script can also assist in re-enabling Microsoft Defender Antivirus. ++## Re-enable Microsoft Defender Antivirus on Windows Server if it was disabled ++First, ensure that Microsoft Defender Antivirus is not disabled either through Group Policy or registry. For more information, see [Troubleshoot Microsoft Defender Antivirus while migrating from a third-party solution](/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus-when-migrating). ++On Windows Server 2016, in some cases, you may need to use the [Malware Protection Command-Line Utility](command-line-arguments-microsoft-defender-antivirus.md) to re-enable Microsoft Defender Antivirus. ++As a local administrator on the server, perform the following steps: ++1. Open Command Prompt. +2. Run the following command: + `MpCmdRun.exe -wdenable`. +3. Restart the device. ++## Re-enable Microsoft Defender Antivirus on Windows Server if it was uninstalled ++In case the Defender feature was uninstalled/removed, you can add it back. ++As a local administrator on the server, perform the following steps: ++1. Open Windows PowerShell. ++2. Run the following commands: ++ ```powershell + # For Windows Server 2016 + Dism /Online /Enable-Feature /FeatureName:Windows-Defender-Features + Dism /Online /Enable-Feature /FeatureName:Windows-Defender + Dism /Online /Enable-Feature /FeatureName:Windows-Defender-Gui + + # For Windows Server 1803 and later, including Windows Server 2019 and 2022 + Dism /Online /Enable-Feature /FeatureName:Windows-Defender + ``` ++ When the DISM command is being used within a task sequence running PowerShell, the following path to cmd.exe is required. + + ```powershell + C:\Windows\System32\cmd.exe /c Dism /Online /Enable-Feature /FeatureName:Windows-Defender-Features + C:\Windows\System32\cmd.exe /c Dism /Online /Enable-Feature /FeatureName:Windows-Defender + ``` ++ > [!NOTE] + > You can also use Server Manager or PowerShell cmdlets to install the Microsoft Defender Antivirus feature. ++3. Reboot the system. |
| security | Gov | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/gov.md | OS version|GCC|GCC High|DoD Windows 11||| Windows 10, version 21H1 and above||| Windows 10, version 20H2 (with [KB4586853](https://support.microsoft.com/help/4586853) <sup>1</sup>)|||-Windows 10, version 2004 (with [KB4586853](https://support.microsoft.com/help/4586853) <sup>1</sup>)||| -Windows 10, version 1909 (with [KB4586819](https://support.microsoft.com/help/4586819) <sup>1</sup>)||| -Windows 10, version 1903 (with [KB4586819](https://support.microsoft.com/help/4586819) <sup>1</sup>)||| -Windows 10, version 1809 (with [KB4586839](https://support.microsoft.com/help/4586839) <sup>1</sup>)||| -Windows 10, version 1803 (with [KB4598245](https://support.microsoft.com/help/4598245) <sup>1</sup>)||| +Windows 10, version 2004 (with [KB4586853](https://support.microsoft.com/help/4586853) <sup>1</sup>)| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-version-2004-end-of-servicing), please upgrade| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-version-2004-end-of-servicing), please upgrade| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-version-2004-end-of-servicing), please upgrade +Windows 10, version 1909 (with [KB4586819](https://support.microsoft.com/help/4586819) <sup>1</sup>)| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-1909-end-of-servicing), please upgrade| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-1909-end-of-servicing), please upgrade| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-1909-end-of-servicing), please upgrade +Windows 10, version 1903 (with [KB4586819](https://support.microsoft.com/help/4586819) <sup>1</sup>)| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-1903-end-of-servicing), please upgrade| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-1903-end-of-servicing), please upgrade| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-1903-end-of-servicing), please upgrade +Windows 10, version 1809 (with [KB4586839](https://support.microsoft.com/help/4586839) <sup>1</sup>)| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing), please upgrade| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing), please upgrade| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing), please upgrade +Windows 10, version 1803 (with [KB4598245](https://support.microsoft.com/help/4598245) <sup>1</sup>)| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing), please upgrade| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing), please upgrade| <br /> Note: [Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing), please upgrade Windows 10, version 1709| <br /> Note: Won't be supported| With [KB4499147](https://support.microsoft.com/help/4499147) <sup>1</sup> <br /> Note: [Deprecated](/lifecycle/announcements/revised-end-of-service-windows-10-1709), please upgrade| <br /> Note: Won't be supported Windows 10, version 1703 and earlier| <br /> Note: Won't be supported| <br /> Note: Won't be supported| <br /> Note: Won't be supported Windows Server 2022||| |
| security | Indicator File | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/indicator-file.md | ms.pagetype: security ms.localizationpriority: medium Last updated : 08/10/2022 audience: ITPro It's important to understand the following prerequisites prior to creating indic > [!NOTE] > Windows Server 2016 and Windows Server 2012 R2 will need to be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016) for this feature to work. - > Custom file indicators with the Allow, Block and Remediate actions are now also available in the [public preview for the enhanced antimalware engine capabilities for macOS and Linux](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/enhanced-antimalware-engine-capabilities-for-linux-and-macos/ba-p/3292003). + > Custom file indicators with the Allow, Block and Remediate actions are now also available in the [enhanced antimalware engine capabilities for macOS and Linux](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/enhanced-antimalware-engine-capabilities-for-linux-and-macos/ba-p/3292003). - To start blocking files, you first need to [turn on the "block or allow" feature](advanced-features.md) in Settings. This feature is designed to prevent suspected malware (or potentially malicious 4. Specify the following details: - Indicator - Specify the entity details and define the expiration of the indicator. - Action - Specify the action to be taken and provide a description.- - Scope - Define the scope of the device group (scoping is not available in [Defender for Business](../defender-business/mdb-overview.md)). + - Scope - Define the scope of the device group (scoping isn't available in [Defender for Business](../defender-business/mdb-overview.md)). 5. Review the details in the Summary tab, then select **Save**. Files automatically blocked by an indicator won't show up in the file's Action c > [!IMPORTANT] > Information in this section (**Public Preview for Automated investigation and remediation engine**) relates to prerelease product which might be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -The current supported actions for file IOC are allow, audit and block, and remediate. After choosing to block a file, you can choose whether triggering an alert is needed. In this way you will be able to control the number of alerts getting to your security operations teams and make sure only required alerts are raised. +The current supported actions for file IOC are allow, audit and block, and remediate. After choosing to block a file, you can choose whether triggering an alert is needed. In this way, you'll be able to control the number of alerts getting to your security operations teams and make sure only required alerts are raised. In Microsoft 365 Defender, go to **Settings** > **Endpoints** > **Indicators** > **Add New File Hash**. Choose if to Generate an alert on the file block event and define the alerts set > > For more information about the EnableFileHashComputation group policy, see [Defender CSP](/windows/client-management/mdm/defender-csp). >-> For more details on configuring this feature on Defender for Endpoint on Linux and macOS, see [Configure file hash computation feature on Linux](linux-preferences.md#configure-file-hash-computation-feature) and [Configure file hash computation feature on macOS](mac-preferences.md#configure-file-hash-computation-feature). +> For more information on configuring this feature on Defender for Endpoint on Linux and macOS, see [Configure file hash computation feature on Linux](linux-preferences.md#configure-file-hash-computation-feature) and [Configure file hash computation feature on macOS](mac-preferences.md#configure-file-hash-computation-feature). ## Public Preview: Advanced hunting capabilities Timestamp > ago(30d) For more information about advanced hunting, see [Proactively hunt for threats with advanced hunting](advanced-hunting-overview.md). -Below are additional thread names which can be used in the sample query from above: +Below are other thread names that can be used in the sample query from above: Files: The response action activity can also be viewable in the device timeline. Cert and File IoC policy handling conflict will follow the below order: -- If the file is not allowed by Windows Defender Application Control and AppLocker enforce mode policy/policies, then **Block**+- If the file isn't allowed by Windows Defender Application Control and AppLocker enforce mode policy/policies, then **Block** - Else if the file is allowed by the Microsoft Defender Antivirus exclusion, then **Allow** - Else if the file is blocked or warned by a block or warn file IoC, then **Block/Warn** - Else if the file is allowed by an allow file IoC policy, then **Allow** |
| security | Linux Support Perf | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-support-perf.md | - + Title: Troubleshoot performance issues for Microsoft Defender for Endpoint on Linux description: Troubleshoot performance issues in Microsoft Defender for Endpoint on Linux. keywords: microsoft, defender, Microsoft Defender for Endpoint, linux, performance The following steps can be used to troubleshoot and mitigate these issues: ## Troubleshoot performance issues using Microsoft Defender for Endpoint Client Analyzer + **Applies to:** - Performance issues of all available Defender for Endpoint components such as AV and EDR -The Microsoft Defender for Endpoint Client Analyzer (MDECA) can collect traces, logs, and diagnostic information in order to troubleshoot performance issues on [onboarded devices](/microsoft-365/security/defender-endpoint/onboard-configure) on Linux. --> [!NOTE] -> The Microsoft Defender for Endpoint Client Analyzer tool is regularly used by Microsoft Customer Support Services (CSS) to collect information such as (but not limited to) IP addresses, PC names that will help troubleshoot issues you may be experiencing with Microsoft Defender for Endpoint. For more information about our privacy statement, see [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). --### Requirements --- The client analyzer can run on supported distros of [Linux](microsoft-defender-endpoint-linux.md#system-requirements) either before or after onboarding to Microsoft Defender for Endpoint.-- Download client analyzer for Linux from the latest preview edition available for download here: <https://aka.ms/XMDEClientAnalyzer>-- If your device is behind a proxy, then you can simply pass the proxy server as an environment variable to the mde_support_tool.sh script. For example: `https_proxy=https://myproxy.contoso.com:8080 ./mde_support_tool.sh"`--### Run the client analyzer on Linux --Open a terminal or SSH into the relevant machine and run the following commands: --1. `wget --quiet -O XMDEClientAnalyzer.zip https://aka.ms/XMDEClientAnalyzer` -2. `unzip -q XMDEClientAnalyzer.zip` -3. `cd XMDEClientAnalyzer` -4. `chmod +x mde_support_tool.sh` -5. Run as non-root use to install required pip and lxml which components: `./mde_support_tool.sh` -6. To collect actual diagnostic package and generate the result archive file run again as root: `./mde_support_tool.sh -d` - Example: --  --> [!NOTE] -> - The analyzer requires 'lxml' to produce the result output. If not installed, the analyzer will try to fetch it from the official repository for python packages below: <https://pypi.org/search/?q=lxml> -> -> - In addition, the tool currently requires Python version 3 or later to be installed. -> -> - If you are running on a machine that cannot use Python 3 or fetch the lxml component, then you can download a binary based version of the analyzer that does not have any of the requirements: [XMDE Client Analyzer Binary](https://aka.ms/XMDEClientAnalyzerBinary) --### Additional syntax help: --**-h** \# Help<br> -\# Show help message --**performance** \# Performance<br> -\# Collects extensive tracing for analysis of a performance issue that can be reproduced on demand. Using `--length=<seconds>` to specify the duration of the benchmark. --**-o** \# Output<br> -\# Specify the destination path for the result file --**-nz** \# No-Zip<br> -\# If set, a directory will be created instead of a resulting archive file --**-f** \# Force<br> -\# Overwrite if output already exists in destination path --### Result package contents --- report.html-- Description: The main HTML output file that will contain the findings and guidance that the analyzer script run on the machine can produce. --- mde_diagnostic.zip-- Description: Same diagnostic output that gets generated when running *mdatp diagnostic create* on [Linux](/windows/security/threat-protection/microsoft-defender-atp/linux-resources#collect-diagnostic-information) --- mde.xml-- Description: XML output that is generated while running and is used to build the html report file. --- Processes_information.txt-- Description: contains the details of the running Microsoft Defender for Endpoint related processes on the system. --- Log.txt-- Description: contains the same log messages written on screen during the data collection. --- Health.txt-- Description: The same basic health output that is shown when running *mdatp health* command. --- Events.xml-- Description: Additional XML file used by the analyzer when building the HTML report. --- Audited_info.txt-- Description: details on audited service and related components for [Linux](/microsoft-365/security/defender-endpoint/linux-resources) OS --- perf_benchmark.tar.gz-- Description: The performance test reports. You will see this only if you are using the performance parameter. +The Microsoft Defender for Endpoint Client Analyzer (MDECA) can collect traces, logs, and diagnostic information in order to troubleshoot performance issues on [onboarded devices](/microsoft-365/security/defender-endpoint/onboard-configure) on macOS. > [!NOTE]-> In case after following the above steps the performance problem persists, please contact customer support for further instructions and mitigation. +>- The Microsoft Defender for Endpoint Client Analyzer tool is regularly used by Microsoft Customer Support Services (CSS) to collect information such as (but not limited to) IP addresses, PC names that will help troubleshoot issues you may be experiencing with Microsoft Defender for Endpoint. For more information about our privacy statement, see [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). +>- As a general best practice, it is recommended to update the [ Microsoft Defender for Endpoint agent to latest available version](mac-whatsnew.md)  and confirming that the issue still persists before investigating further. +To run the client analyzer for troubleshooting performance issues, see [Run the client analyzer on macOS and Linux](run-analyzer-macos-linux.md). +>[!NOTE] +>In case after following the above steps, the performance problem persists, please contact customer support for further instructions and mitigation. ## See also |
| security | Mac Support Perf | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-support-perf.md | - + Title: Troubleshoot performance issues for Microsoft Defender for Endpoint on macOS description: Troubleshoot performance issues in Microsoft Defender for Endpoint on macOS. keywords: microsoft, defender, Microsoft Defender for Endpoint, mac, performance ms.technology: mde This topic provides some general steps that can be used to narrow down performance issues related to Microsoft Defender for Endpoint on macOS. -Real-time protection (RTP) is a feature of Microsoft Defender for Endpoint on macOS that continuously monitors and protects your device against threats. It consists of file and process monitoring and other heuristics. Depending on the applications that you're running and your device characteristics, you may experience suboptimal performance when running Microsoft Defender for Endpoint on macOS. In particular, applications or system processes that access many resources over a short timespan can lead to performance issues in Microsoft Defender for Endpoint on macOS. +>[!WARNING] +>Before starting, please make sure that other security products are not currently running on the device. Multiple security products may conflict and impact the host performance. ++## Troubleshoot performance issues using Real-time Protection Statistics +**Applies to:** +- Only performance issues related to AV ++Real-time protection (RTP) is a feature of Defender for Endpoint on macOS that continuously monitors and protects your device against threats. It consists of file and process monitoring and other heuristics. + The following steps can be used to troubleshoot and mitigate these issues: 1. Disable real-time protection using one of the following methods and observe whether the performance improves. This approach helps narrow down whether Microsoft Defender for Endpoint on macOS is contributing to the performance issues. The following steps can be used to troubleshoot and mitigate these issues: 6. Configure Microsoft Defender for Endpoint on macOS with exclusions for the processes or disk locations that contribute to the performance issues and re-enable real-time protection. See [Configure and validate exclusions for Microsoft Defender for Endpoint on macOS](mac-exclusions.md) for details.+++## Troubleshoot performance issues using Microsoft Defender for Endpoint Client Analyzer ++**Applies to:** +- Performance issues of all available Defender for Endpoint components such as AV and EDR ++The Microsoft Defender for Endpoint Client Analyzer (MDECA) can collect traces, logs, and diagnostic information in order to troubleshoot performance issues on [onboarded devices](/microsoft-365/security/defender-endpoint/onboard-configure) on macOS. ++> [!NOTE] +>- The Microsoft Defender for Endpoint Client Analyzer tool is regularly used by Microsoft Customer Support Services (CSS) to collect information such as (but not limited to) IP addresses, PC names that will help troubleshoot issues you may be experiencing with Microsoft Defender for Endpoint. For more information about our privacy statement, see [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). +>- As a general best practice, it is recommended to update the [ Microsoft Defender for Endpoint agent to latest available version](linux-whatsnew.md)  and confirming that the issue still persists before investigating further. ++To run the client analyzer for troubleshooting performance issues, see [Run the client analyzer on macOS and Linux](run-analyzer-macos-linux.md). ++>[!NOTE] +>In case after following the above steps, the performance problem persists, please contact customer support for further instructions and mitigation. +++## See also ++- [Investigate agent health issues](health-status.md) |
| security | Server Migration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/server-migration.md | ms.pagetype: security ms.localizationpriority: medium Last updated : 08/10/2022 audience: ITPro For instructions on how to migrate using Microsoft Endpoint Configuration Manage ## If you are running a non-Microsoft antivirus solution -1. Fully update the machine including Microsoft Defender Antivirus (Windows Server 2016) ensuring [prerequisites](configure-server-endpoints.md#prerequisites) have been met. +1. Fully update the machine including Microsoft Defender Antivirus (Windows Server 2016) ensuring [prerequisites](configure-server-endpoints.md#prerequisites) have been met. For more information on the prerequisites that have to be met, see [Prerequisites for Windows Server 2016](configure-server-endpoints.md#prerequisites-for-windows-server-2016). 2. Ensure third-party antivirus management no longer pushes antivirus agents to these machines.* 3. Author your policies for the protection capabilities in Microsoft Defender for Endpoint and target those to the machine in the tool of your choice.* 4. Install the Microsoft Defender for Endpoint for Windows Server 2012 R2 and 2016 package and **enable passive mode**. See [Install Microsoft Defender Antivirus using command line](configure-server-endpoints.md#install-microsoft-defender-for-endpoint-using-the-command-line). |
| security | Switch To Mde Phase 2 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2.md | ms.pagetype: security ms.localizationpriority: medium Last updated : 08/10/2022 audience: ITPro As you're making the switch to Defender for Endpoint, you might need to take cer |Endpoint type|What to do| |||-|Windows clients (such as endpoints running Windows 10 and Windows 11)|In general, you do not need to take any action for Windows clients (unless Microsoft Defender Antivirus has been uninstalled). In general, Microsoft Defender Antivirus should still be installed, but is most likely disabled at this point of the migration process. <br/><br/> When a non-Microsoft antivirus/antimalware solution is installed and the clients are not yet onboarded to Defender for Endpoint, Microsoft Defender Antivirus is disabled automatically. Later, when the client endpoints are onboarded to Defender for Endpoint, if those endpoints are running a non-Microsoft antivirus solution, Microsoft Defender Antivirus goes into passive mode. <br/><br/> If the non-Microsoft antivirus solution is uninstalled, Microsoft Defender Antivirus goes into active mode automatically.| -|Windows servers|On Windows Server, you'll need to reinstall Microsoft Defender Antivirus, and set it to passive mode manually. On Windows servers, when a non-Microsoft antivirus/antimalware is installed, Microsoft Defender Antivirus cannot run alongside the non-Microsoft antivirus solution. In those cases, Microsoft Defender Antivirus is disabled or uninstalled manually. <br/><br/> To reinstall or enable Microsoft Defender Antivirus on Windows Server, perform the following tasks: <br/>- [Reinstall Microsoft Defender Antivirus on Windows Server 2016](#re-enable-microsoft-defender-antivirus-on-windows-server-2016)<br/>- [Reinstall Microsoft Defender Antivirus on Windows Server, version 1803 or later](#re-enable-microsoft-defender-antivirus-on-windows-server-version-1803-or-later)<br/>- [Set Microsoft Defender Antivirus to passive mode on Windows Server](#set-microsoft-defender-antivirus-to-passive-mode-on-windows-server) <br/><br/>If you run into issues reinstalling or re-enabling Microsoft Defender Antivirus on Windows Server, see [Troubleshooting: Microsoft Defender Antivirus is getting uninstalled on Windows Server](switch-to-mde-troubleshooting.md#microsoft-defender-antivirus-is-getting-uninstalled-on-windows-server).| +|Windows clients (such as endpoints running Windows 10 and Windows 11)|In general, you don't need to take any action for Windows clients (unless Microsoft Defender Antivirus has been uninstalled). In general, Microsoft Defender Antivirus should still be installed, but is most likely disabled at this point of the migration process. <br/><br/> When a non-Microsoft antivirus/antimalware solution is installed and the clients aren't yet onboarded to Defender for Endpoint, Microsoft Defender Antivirus is disabled automatically. Later, when the client endpoints are onboarded to Defender for Endpoint, if those endpoints are running a non-Microsoft antivirus solution, Microsoft Defender Antivirus goes into passive mode. <br/><br/> If the non-Microsoft antivirus solution is uninstalled, Microsoft Defender Antivirus goes into active mode automatically.| +|Windows servers|On Windows Server, you'll need to reinstall Microsoft Defender Antivirus, and set it to passive mode manually. On Windows servers, when a non-Microsoft antivirus/antimalware is installed, Microsoft Defender Antivirus can't run alongside the non-Microsoft antivirus solution. In those cases, Microsoft Defender Antivirus is disabled or uninstalled manually. <br/><br/> To reinstall or enable Microsoft Defender Antivirus on Windows Server, perform the following tasks: <br/>- [Re-enable Defender Antivirus on Windows Server if it was disabled](enable-update-mdav-to-latest-ws.md#re-enable-microsoft-defender-antivirus-on-windows-server-if-it-was-disabled)<br/>- [Re-enable Defender Antivirus on Windows Server if it was uninstalled](enable-update-mdav-to-latest-ws.md#re-enable-microsoft-defender-antivirus-on-windows-server-if-it-was-uninstalled)<br/>- [Set Microsoft Defender Antivirus to passive mode on Windows Server](#set-microsoft-defender-antivirus-to-passive-mode-on-windows-server) <br/><br/>If you run into issues reinstalling or re-enabling Microsoft Defender Antivisrus on Windows Server, see [Troubleshooting: Microsoft Defender Antivirus is getting uninstalled on Windows Server](switch-to-mde-troubleshooting.md#microsoft-defender-antivirus-is-getting-uninstalled-on-windows-server).| > [!TIP] > To learn more about Microsoft Defender Antivirus states with non-Microsoft antivirus protection, see [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md). -### Re-enable Microsoft Defender Antivirus on Windows Server 2016 --You can use the [Malware Protection Command-Line Utility](command-line-arguments-microsoft-defender-antivirus.md) to re-enable Microsoft Defender Antivirus on Windows Server 2016. --1. As a local administrator on the server, open Command Prompt. --2. Run the following command: `MpCmdRun.exe -wdenable` --3. Restart the device. --### Re-enable Microsoft Defender Antivirus on Windows Server, version 1803 or later --> [!IMPORTANT] -> The following procedure applies only to endpoints or devices that are running the following versions of Windows: -> - Windows Server 2022 -> - Windows Server 2019 -> - Windows Server, version 1803 (core-only mode) --1. As a local administrator on the server, open Windows PowerShell. --2. Run the following PowerShell cmdlets: -- ```powershell - # For Windows Server 2016 - Dism /Online /Enable-Feature /FeatureName:Windows-Defender-Features - Dism /Online /Enable-Feature /FeatureName:Windows-Defender - Dism /Online /Enable-Feature /FeatureName:Windows-Defender-Gui - - # For Windows Server 2019 and Windows Server 2022 - Dism /Online /Enable-Feature /FeatureName:Windows-Defender - ``` -- When using the DISM command within a task sequence running PowerShell, the following path to cmd.exe is required. - Example: -- ```powershell - C:\Windows\System32\cmd.exe /c Dism /Online /Enable-Feature /FeatureName:Windows-Defender-Features - C:\Windows\System32\cmd.exe /c Dism /Online /Enable-Feature /FeatureName:Windows-Defender - ``` --3. Restart the device. - ### Set Microsoft Defender Antivirus to passive mode on Windows Server > [!TIP] When you add [exclusions to Microsoft Defender Antivirus scans](/windows/securit Keep the following points in mind: - *Path exclusions* exclude specific files and whatever those files access.-- *Process exclusions* exclude whatever a process touches, but does not exclude the process itself.+- *Process exclusions* exclude whatever a process touches, but doesn't exclude the process itself. - List your process exclusions using their full path and not by their name only. (The name-only method is less secure.) - If you list each executable (.exe) as both a path exclusion and a process exclusion, the process and whatever it touches are excluded. Device groups, device collections, and organizational units enable your security |Collection type|What to do| |||-|[Device groups](/microsoft-365/security/defender-endpoint/machine-groups) (formerly called *machine groups*) enable your security operations team to configure security capabilities, such as automated investigation and remediation. <br/><br/> Device groups are also useful for assigning access to those devices so that your security operations team can take remediation actions if needed. <br/><br/> Device groups are created in the While the attack was detected and stopped, alerts, such as an "initial access alert," were triggered and appeared in the [Microsoft 365 Defender portal](/microsoft-365/security/defender/microsoft-365-defender).|1. Go to the Microsoft 365 Defender portal (<https://security.microsoft.com>).<br/><br/>2. In the navigation pane on the left, choose **Settings** \> **Endpoints** \> **Permissions** \> **Device groups**.<br/><br/>3. Choose **+ Add device group**.<br/><br/>4. Specify a name and description for the device group.<br/><br/>5. In the **Automation level** list, select an option. (We recommend **Full - remediate threats automatically**.) To learn more about the various automation levels, see [How threats are remediated](/microsoft-365/security/defender-endpoint/automated-investigations#how-threats-are-remediated).<br/><br/>6. Specify conditions for a matching rule to determine which devices belong to the device group. For example, you can choose a domain, OS versions, or even use [device tags](/microsoft-365/security/defender-endpoint/machine-tags).<br/><br/>7. On the **User access** tab, specify roles that should have access to the devices that are included in the device group.<br/><br/>8. Choose **Done**.| +|[Device groups](/microsoft-365/security/defender-endpoint/machine-groups) (formerly called *machine groups*) enable your security operations team to configure security capabilities, such as automated investigation and remediation. <br/><br/> Device groups are also useful for assigning access to those devices so that your security operations team can take remediation actions if needed. <br/><br/> Device groups are created while the attack was detected and stopped, alerts, such as an "initial access alert," were triggered and appeared in the [Microsoft 365 Defender portal](/microsoft-365/security/defender/microsoft-365-defender).|1. Go to the Microsoft 365 Defender portal (<https://security.microsoft.com>).<br/><br/>2. In the navigation pane on the left, choose **Settings** \> **Endpoints** \> **Permissions** \> **Device groups**.<br/><br/>3. Choose **+ Add device group**.<br/><br/>4. Specify a name and description for the device group.<br/><br/>5. In the **Automation level** list, select an option. (We recommend **Full - remediate threats automatically**.) To learn more about the various automation levels, see [How threats are remediated](/microsoft-365/security/defender-endpoint/automated-investigations#how-threats-are-remediated).<br/><br/>6. Specify conditions for a matching rule to determine which devices belong to the device group. For example, you can choose a domain, OS versions, or even use [device tags](/microsoft-365/security/defender-endpoint/machine-tags).<br/><br/>7. On the **User access** tab, specify roles that should have access to the devices that are included in the device group.<br/><br/>8. Choose **Done**.| |[Device collections](/mem/configmgr/core/clients/manage/collections/introduction-to-collections) enable your security operations team to manage applications, deploy compliance settings, or install software updates on the devices in your organization. <br/><br/> Device collections are created by using [Configuration Manager](/mem/configmgr/).|Follow the steps in [Create a collection](/mem/configmgr/core/clients/manage/collections/create-collections#bkmk_create).| |[Organizational units](/azure/active-directory-domain-services/create-ou) enable you to logically group objects such as user accounts, service accounts, or computer accounts. <br/><br/> You can then assign administrators to specific organizational units, and apply group policy to enforce targeted configuration settings. <br/><br/> Organizational units are defined in [Azure Active Directory Domain Services](/azure/active-directory-domain-services).|Follow the steps in [Create an Organizational Unit in an Azure Active Directory Domain Services managed domain](/azure/active-directory-domain-services/create-ou).| ## Next step -**Congratulations**! You have completed the Setup phase of [switching to Defender for Endpoint](switch-to-mde-overview.md#the-migration-process)! +**Congratulations**! You've completed the Setup phase of [switching to Defender for Endpoint](switch-to-mde-overview.md#the-migration-process)! - [Proceed to Phase 3: Onboard to Defender for Endpoint](switch-to-mde-phase-3.md) |
| security | Investigate Dlp | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/investigate-dlp.md | Before you start, [turn on alerts for all your DLP policies](/microsoft-365/comp 6. View the matched sensitive content in the **Sensitive info types** tab and the file content in the **Source** tab if you have the required permission (See details <a href="/microsoft-365/compliance/dlp-alerts-dashboard-get-started#roles" target="_blank">here</a>). -7. You can also use Advanced Hunting to search through audit logs of user, files, and site locations for your investigation. The **CloudAppEvents** table contains all audit logs across all locations like Sharepoint, OneDrive, Exchange and Devices. +7. You can also use Advanced Hunting to search through audit logs of user, files, and site locations for your investigation. The **CloudAppEvents** table contains all audit logs across all locations like SharePoint, OneDrive, Exchange and Devices. 8. You can also download the email by selecting **Actions** \> **Download email**. |
| security | Recommended Settings For Eop And Office365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365.md | To create and configure anti-malware policies, see [Configure anti-malware polic |Security feature name|Default|Standard|Strict|Comment| ||::|::|::|| |**Protection settings**|||||-|**Enable the common attachments filter** <br><br> _EnableFileFilter_|Not selected <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|This setting quarantines messages that contain attachments based on file type, regardless of the attachment content. For the list of file types, see [Anti-malware policies](anti-malware-protection.md#anti-malware-policies).| +|**Enable the common attachments filter** <br><br> _EnableFileFilter_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|This setting quarantines messages that contain attachments based on file type, regardless of the attachment content. For the list of file types, see [Anti-malware policies](anti-malware-protection.md#anti-malware-policies).| +|Common attachment filter notifications (**When these file types are found**) <br><br> _FileTypeAction_|**Reject the messages with a non-delivery receipt (NDR)** <br><br> `Reject`|**Reject the messages with a non-delivery receipt (NDR)** <br><br> `Reject`|**Reject the messages with a non-delivery receipt (NDR)** <br><br> `Reject`|| |**Enable zero-hour auto purge for malware** <br><br> _ZapEnabled_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| |**Quarantine policy**|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|When you create a new anti-malware policy, a blank value means the default quarantine policy is used to define the historical capabilities for messages that were quarantined as malware (AdminOnlyAccessPolicy with no quarantine notifications). <br><br> Standard and Strict preset security policies use the default quarantine policy (AdminOnlyAccessPolicy with no quarantine notifications) as described in the table [here](quarantine-policies.md#step-2-assign-a-quarantine-policy-to-supported-features). <br><br> Admins can create and select custom quarantine policies that define more capabilities for users in the default or custom anti-malware policies. For more information, see [Quarantine policies](quarantine-policies.md).| |**Admin notifications**||||| |
| security | Use Arc Exceptions To Mark Trusted Arc Senders | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/use-arc-exceptions-to-mark-trusted-arc-senders.md | from being sent to *Junk* due to authentication failures. Trusted ARC sealers in Microsoft 365 Defender portal shows all the ARC sealers acknowledged by and added to your tenant. -**To add a new Trusted ARC sealer in the admin portal:** +**To add a new Trusted ARC sealer in the Microsoft 365 Defender portal:** -1. Navigate to the [email authentication settings](https://security.microsoft.com/authentication?viewid=ARC) page. +1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Email Authentication Settings** in the **Rules** section \> **ARC** . To go directly to the ARC page, use [email authentication settings](https://security.microsoft.com/authentication?viewid=ARC). 2. If this is the first time you've added a trusted ARC sealer, click the Add button. 3. Add trusted ARC sealers in the textbox shown. |
| solutions | Allow Direct Connect With All Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/allow-direct-connect-with-all-organizations.md | If your organization doesn't have a requirement to restrict collaboration with o > [!NOTE] > Changes to cross-tenant access settings may take two hours to take effect. +> [!NOTE] +> [Guest settings for Microsoft 365 Groups](/microsoft-365/admin/create-groups/manage-guest-access-in-groups) must be enabled to use shared channels with external participants. + ## Allow users to invite people in other organizations to participate in shared channels You can allow your users to invite people from other organizations to use shared resources - such as shared channels in Teams - by default. |
| solutions | Collaborate Teams Direct Connect | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-teams-direct-connect.md | When you enable shared channels in Teams with another organization: - Your organization's custom (line of business) apps will be available in shared channels and external participants will be able to access them. - Your organization's apps list will be available in shared channels and external participants will be able to access them. +> [!NOTE] +> [Guest settings for Microsoft 365 Groups](/microsoft-365/admin/create-groups/manage-guest-access-in-groups) must be enabled to use shared channels with external participants. + ## Video demonstration This video shows the configuration steps described in this document. |
| whiteboard | Manage Clients Gcc High | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-clients-gcc-high.md | description: Learn which clients are currently supported for Whiteboard. # Manage clients for Microsoft Whiteboard in GCC High environments ->[!NOTE] +> [!NOTE] > This guidance applies to US Government Community Cloud (GCC) High environments. -Whiteboard clients are currently being updated to support One Drive for Business. +Whiteboard clients are currently being updated to support OneDrive for Business. ## Clients supported The following clients are planned for future releases of Whiteboard: - Whiteboard in Teams meetings on Surface Hub and Teams meeting rooms - Whiteboard in 1:1 calls in Teams ->[!NOTE] +> [!NOTE] > While users can install the Windows client, they won't be able to sign in until the client is updated. ## See also The following clients are planned for future releases of Whiteboard: [Manage data for Whiteboard - GCC High](manage-data-gcc-high.md) -[Manage sharing for Whiteboard - GCC High](manage-sharing-gcc-high.md) +[Manage sharing for Whiteboard - GCC High](manage-sharing-gcc-high.md) |