| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Remove Former Employee Step 5 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/remove-former-employee-step-5.md | To preserve a former user's OneDrive files, first give yourself access to their > [!NOTE] > - You can move or copy up to 500 MB of files and folders at a time.<br/> > - When you move or copy documents that have version history, only the latest version is moved.-> - Administrative options for an active user under the OneDrive tab in the Microsoft 365 admin center are currently not supported for multi-geo tenants. +> - Administrative options for an active user under the OneDrive tab in the Microsoft 365 admin center are currently not supported for multi-geo tenants. You can also grant access to another user to access a former employee's OneDrive. You can give yourself access to the content in a user's OneDrive, but you may wa ## Access the Outlook data of a former user -To save the email messages, calendar, tasks, and contacts of the former employee, export the information to an Outlook Data File (.pst). - -1. [Add the former employee's email](https://support.microsoft.com/office/6e27792a-9267-4aa4-8bb6-c84ef146101b) to your Outlook. (If you [reset the user's password](reset-passwords.md), you can set it to something only you know.) --2. In Outlook, select **File**. --  - -3. Select **Open & Export** \> **Import/Export**. --  - -4. Select **Export to a file**, and then select **Next**. --  - -5. Select **Outlook Data File (.pst)**, and then select **Next**. --6. Select the account you want to export by selecting the name or email address, such as Mailbox - Anne Weiler or anne@contoso.com. If you want to export everything in your account, including mail, calendar, contacts, tasks, and notes, make sure the **Include subfolders** check box is selected. -- > [!NOTE] - > You can export one account at a time. If you want to export multiple accounts, after one account is exported, repeat these steps. - -  - -7. Select **Next**. --8. Select **Browse** to select where to save the Outlook Data File (.pst). Type a *file name*, and then select **OK** to continue. -- > [!NOTE] - > If you've used export before, the previous folder location and file name appear. Type a *different file name* before selecting **OK**. - -9. If you are exporting to an existing Outlook Data File (.pst), under **Options**, specify what to do when exporting items that already exist in the file. --10. Select **Finish**. --Outlook begins the export immediately unless a new Outlook Data File (.pst) is created or a password-protected file is used. - -- If you're creating an Outlook Data File (.pst), an optional password can help protect the file. When the **Create Outlook Data File** dialog box appears, type the *password* in the **Password** and **Verify Password** boxes, and then select **OK**. In the **Outlook Data File Password** dialog box, type the *password*, and then select **OK**.+To save the email messages, calendar, tasks, and contacts of the former employee, export the information to an Outlook Data File (.pst). For steps on exporting Outlook data, see [Export emails, contacts, and calendar items to a .pst file](https://support.microsoft.com/office/14252b52-3075-4e9b-be4e-ff9ef1068f91). -- If you're exporting to an existing Outlook Data File (.pst) that is password protected, in the **Outlook Data File Password** dialog box, type the *password*, and then select **OK**.+## Give another user access to a former user's email -See how to [Export or backup email, contacts, and calendar to an Outlook .pst file](https://support.microsoft.com/office/14252b52-3075-4e9b-be4e-ff9ef1068f91) in Outlook 2010. -- > [!NOTE] - > By default, your email is available offline for a period of 12 months. If required, see how to [increase the data available offline](/outlook/troubleshoot/mailboxes/only-subset-items-synchronized). --### Give another user access to a former user's email --To give access to the email messages, calendar, tasks, and contacts of the former employee to another employee, import the information to another employee's Outlook inbox. +To give access to the email messages, calendar, tasks, and contacts of the former employee to another employee, import the information to another employee's Outlook inbox. For steps on exporting Outlook data, see [Import email, contacts, and calendar from an Outlook .pst file](https://support.microsoft.com/topic/431a8e9a-f99f-4d5f-ae48-ded54b3440ac). > [!NOTE] > You can also [convert the former user's mailbox to a shared mailbox](/office365/admin/email/convert-user-mailbox-to-shared-mailbox) or [forward a former employee's email to another employee](/office365/admin/add-users/remove-former-employee#forward-a-former-employees-email-to-another-employee-or-convert-to-a-shared-mailbox). -1. In Outlook, go to **File** \> **Open & Export** \> **Import/Export**. -- This starts the Import and Export Wizard. --2. Select **Import from another program or file**, and then select **Next**. --  - -3. Select **Outlook Data File (.pst)**, and select **Next**. --4. Browse to the .pst file you want to import. --5. Under **Options**, choose how you want to deal with duplicates. --6. Select **Next**. --7. If a password was assigned to the Outlook Data File (.pst), enter the password, and then select **OK**. --8. Set the options for importing items. The default settings usually don't need to be changed. --9. Select **Finish**. --> [!NOTE] -> The steps remain the same for accessing an existing user's OneDrive and email data. --> [!TIP] -> If you want to import or restore only a few items from an Outlook Data File (.pst), you can open the Outlook Data File. Then, in the navigation pane, drag the items from Outlook Data File folders to your existing Outlook folders. - ## Related content [Add and remove admins on a OneDrive account](/sharepoint/manage-user-profiles#add-and-remove-admins-for-a-users-onedrive) (article) |
| admin | Admin Center Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/admin-overview/admin-center-overview.md | f1.keywords: Previously updated : 11/18/2020 Last updated : 08/10/2023 audience: Admin |
| admin | Change Email Address | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/email/change-email-address.md | f1.keywords: Previously updated : 02/18/2020 Last updated : 08/10/2023 audience: Admin |
| admin | Set Up Multi Factor Authentication | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication.md | f1.keywords: Previously updated : 03/27/2023 Last updated : 08/10/2023 audience: Admin Check out [Microsoft 365 small business help](https://go.microsoft.com/fwlink/?l Multifactor authentication means you and your employees must provide more than one way to sign in to Microsoft 365 is one of the easiest ways to secure your business. Based on your understanding of [multifactor authentication (MFA) and its support in Microsoft 365](multi-factor-authentication-microsoft-365.md), it's time to set it up and roll it out to your organization. +Multi-factor authentication (MFA) is a very important first step in securing your organization. Microsoft 365 for Business gives you the option to use security defaults or Conditional Access policies to turn on MFA for your admins and user accounts. For most organizations, **Security defaults** offer a good level of sign-in security. But if your organization must meet more stringent requirements, you can use **Conditional Access policies** instead. + > [!IMPORTANT] > If you purchased your subscription or trial after October 21, 2019, and you're prompted for MFA when you sign in, [security defaults](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults) have been automatically enabled for your subscription. Check out this video and others on our [YouTube channel](https://go.microsoft.co ### Turn off legacy per-user MFA -If you've previously turned on per-user MFA, you must turn it off before enabling Security defaults. +Per-user MFA is a legacy service and you should give consideration to using the newer Security defaults or Conditional Access policies. ++If you've previously turned on per-user MFA, you must turn it off before enabling Security defaults. You should also turn off per-user MFA after you've configure your policies and settings in Conditional Access. 1. In the Microsoft 365 admin center, in the left nav choose **Users** \> **Active users**. 1. On the **Active users** page, choose **Multi-factor authentication**. |
| commerce | Change Your Billing Addresses | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/change-your-billing-addresses.md | Title: "Change your billing addresses" + Title: "Change the billing addresses for your Microsoft business subscription" f1.keywords: - NOCSH -description: "Learn how to update your billing addresses or the email address used to receive billing notifications for Microsoft 365 for business." Previously updated : 01/24/2022+description: "Learn how to change your billing address for Microsoft 365 for business." Last updated : 08/10/2023 -# Change your Microsoft 365 for business billing addresses +# Change the billing addresses for your Microsoft business subscription -Your bill or invoice contains three addresses: +Your invoice for Microsoft business products and services that you own contains the following addresses: -- **Sold-To Address** Your company name and address, as shown in your organization profile.+- **Sold to Address** Your company name and address, as shown in your organization profile. +- **Bill to address** The address of your billing department, usually the same as the **Sold to** address. +- **Service usage address** The address where the service is used, usually the same as the **Sold to** address. If your organization has remote users or multiple offices, use the address where most your users are located. This address is only used by customers with a Microsoft Online Services Agreement (MOSA) billing account type. -- **Bill-To address** The address of your billing department, usually the same as the **Sold-To** address.+In most cases, these addresses are the same. If you need to change one or more of the addresses, you can do that in the Microsoft 365 admin center. -- **Service Usage Address** The address where the service is being used, usually the same as the **Sold-To** address. If your organization has remote users or multiple offices, use the address where the majority of your users are located.+## Before you begin -In most cases, these addresses are the same. If you need to change one or more of the addresses, you can do that. You can also provide an alternate email address to receive billing notifications and change the alternate email address for other admins. +- [Find out what type of billing account you have](../manage-billing-accounts.md#view-my-billing-accounts). +- If you have a Microsoft Online Services Agreement (MOSA) billing account type, you must be a global or billing admin to do the tasks in this article. For more information, see [About admin roles](../../admin/add-users/about-admin-roles.md). +- If you have a Microsoft Customer Agreement (MCA) billing account type, you must be a billing account owner or contributor, or a billing profile owner or contributor to do the tasks in this article. For more information about billing account and billing profile roles, see [Understand your Microsoft business billing account](../manage-billing-accounts.md) and [Understand your Microsoft business billing profile](manage-billing-profiles.md). -To learn more about your bill or invoice, see [View your bill or invoice](view-your-bill-or-invoice.md) and [Understand your bill or invoice](understand-your-invoice2.md). +> [!NOTE] +> If you're the person who signed up for the subscription, you're automatically a billing account owner or global admin. -## Change your Sold-To address ---1. In the admin center, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2084771" target="_blank">**Billing accounts**</a> page. ----1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=850627" target="_blank">admin center</a>, go to the **Billing** > **Billing accounts** page. +> [!IMPORTANT] +> You can't change the country/region for your subscription. That's because the country/region where your organization is headquartered determines which services are available to you, the taxes and billing currency, and the location of the data center. To change your organization's country/region, sign up for a new account, choose the desired country/region, and buy a new subscription. --2. Select **Edit billing account information**. +## Change your Sold-To address -3. Update your organization information, then select **Save**. +1. Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>. +2. In the **Navigation menu**, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=2084771" target="_blank">Billing accounts</a> page, then select a billing account. +3. On the billing account details page, in the **Sold to** section, select **Update sold to** or **Edit**. +4. Update your organization information, then select **Save**. ## Change your Bill-To address --1. In the admin center, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=2018806" target="_blank">Payment methods</a> page. --+You can change your **Bill to** address in the Microsoft 365 admin center. However, the steps to change the address depend on the type of billing account that you have. [Find out what type of billing account you have](../manage-billing-accounts.md#view-my-billing-accounts). -1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=850627" target="_blank">admin center</a>, go to the **Billing** > **Payment methods** page. +**If you have an MCA billing account type:** +1. Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>. + - If youΓÇÖre using the **Simplified view**, select **Subscriptions**, then select **View payment methods**. + - If youΓÇÖre using the **Dashboard view**, go to the Billing > <a href="https://go.microsoft.com/fwlink/p/?linkid=848039" target="_blank">Bills & payments</a> page. +2. On the **Bills & payments** page, select the **Billing profile** tab. +3. Select a billing profile. +4. On the billing profile details page, under **Bill-to address**, select **Edit**. +5. In the **Edit bill-to address** pane, update your organization information, then select **Save**. -2. Select the credit card or bank account that you want to change. +**If you have an MOSA billing account type:** -3. On the **Payment method details** page, select **Edit**. --4. Update your billing address, then select **Save** \> **Done**. +1. Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>.admin center. + - If youΓÇÖre using the **Simplified view**, select **Subscriptions**, then select **View payment methods**. + - If youΓÇÖre using the **Dashboard view**, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=848039" target="_blank">Bills & payments</a> page. +2. On the **Bills & payments** page, select the **Payment methods** tab. +3. Select a payment method. +4. In the payment methods details pane, select **Edit**. +5. Update your payment information, select **Save** > **Done**. ## Change your service usage address --1. In the admin center, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page. ----1. In the admin center, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=850626" target="_blank">Your products</a> page. -- If you're using Office 365 operated by 21Vianet in China, see [View your bill or get Fapiaos for Office 365 operated by 21Vianet](../../admin/services-in-chin). ---2. On the **Products** tab, select the subscription that you want to change. +If you have an MOSA billing account type, you can change the service usage address for a subscription. What type of billing account do I have? +1. Go to the admin center. + - If youΓÇÖre using the **Simplified view**, select **Subscriptions**. + - If youΓÇÖre using the **Dashboard view**, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page. +2. Select the subscription to change. 3. On the subscription details page, in the **Service usage address** section, select **Edit service usage address**.- 4. In the **Edit service usage address** pane, update your address, then select **Save**. - ## Related content -[View your bill or invoice](view-your-bill-or-invoice.md) (article)\ -[Understand your bill or invoice](understand-your-invoice2.md) (article)\ -[Pay for your subscription](pay-for-your-subscription.md) (article)\ -[Subscriptions and billing - Admin Help](../index.yml) (link page) +[View your invoice in the Microsoft 365 admin center](view-your-bill-or-invoice.md)\ +[Understand your invoice for your Microsoft MCA billing account](understand-your-invoice.md)\ +[Understand your invoice for your Microsoft MOSA billing account](understand-your-invoice2.md)\ +[Payment options for your Microsoft business subscription](pay-for-your-subscription.md)\ +[How to pay for your Microsoft business subscription with a billing profile](pay-for-subscription-billing-profile.md) |
| commerce | Tax Information | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/commerce/billing-and-payments/tax-information.md | Title: "Tax Information" + Title: "Tax information for Microsoft 365 for business products and services" f1.keywords: - NOCSH -description: "Find out how much tax you will be charged for your Microsoft 365 for business subscription in different regions." Previously updated : 03/17/2021+description: "Learn about tax information for Microsoft 365 billing and payments, including how to update your address and tax status." Last updated : 08/10/2023 -# Microsoft 365 tax information --When you buy Microsoft 365 products and services, the taxes that you pay are determined by one of two things: your business address, or your shipping address, if it's different. If your organization is in the United States, you must provide a Federal Employer Identification Number (FEIN). --Businesses in the following countries or regions can provide their VAT number or local equivalent: -- :::column::: --- Armenia-- Australia-- Austria-- Bahamas-- Bangladesh-- Belarus-- Belgium-- Brazil*-- Bulgaria-- Chile-- Colombia-- Croatia-- Cyprus-- Czech Republic-- Denmark-- Estonia-- Finland-- France-- Germany-- Greece-- Hungary-- India*-- Indonesia-- Ireland-- Isle of Man-- Italy- :::column-end::: - :::column::: -- Korea-- Latvia-- Liechtenstein-- Lithuania-- Luxembourg-- Malaysia-- Malta-- Mexico-- Monaco-- Netherlands-- New Zealand-- Norway-- Poland-- Portugal-- Romania-- Saudi Arabia-- Slovakia-- Slovenia-- South Africa-- Spain-- Sweden-- Switzerland-- Taiwan-- Thailand-- Turkey-- United Arab Emirates-- United Kingdom- :::column-end::: +# Tax information for Microsoft 365 for business products and services -*For most of the countries or regions listed, providing a VAT number or local equivalent is optional. For Brazil and India, the tax identifier number is required. +When you buy Microsoft 365 for business products and services, the tax that you pay is determined by one of two things: your business address, or your shipping address, if it's different. If your organization is in the United States, you must provide a Federal Employer Identification Number (FEIN). -> [!Note] +> [!NOTE] > If you need to contact support, have your FEIN, VAT number, or local equivalent ready to give to the support agent. +## Before you begin ++- [Find out what type of billing account you have](../manage-billing-accounts.md#view-my-billing-accounts). +- If you have a Microsoft Online Services Agreement (MOSA) billing account type, you must be a global or billing admin to do the tasks in this article. For more information, see [About admin roles](../../admin/add-users/about-admin-roles.md). +- If you have a Microsoft Customer Agreement (MCA) billing account type, you must be a billing account owner or billing account contributor to do the tasks in this article. For more information about billing account roles, see [Understand your Microsoft business billing account](../manage-billing-accounts.md). ++> [!NOTE] +> If you're the person who signed up for the subscription, you're automatically a billing account owner or global admin. + ## Europe, the Middle East, and Africa (EMEA) -When you buy Microsoft 365 services in the EMEA region, this purchase could be subject to Value-Added Tax (VAT). +When you buy Microsoft 365 products or services in the EMEA region, the purchase could be subject to Value-Added Tax (VAT). -- If you're located in a European Union Member State, Armenia, Belarus, Norway, Turkey, or United Arab Emirates, and you don't provide your valid local VAT ID, Microsoft Ireland Operations Ltd. will apply the current local VAT rate, based on the billing country or region your account is set to.+- If you're located in a European Union Member State, Armenia, Belarus, Norway, Turkey, or United Arab Emirates, and you don't provide your valid local VAT ID, Microsoft Ireland Operations Ltd. applies the current local VAT rate, based on the billing country/region your account is set to. - If you're located in Liechtenstein, Russia, Serbia, South Africa, or Switzerland, the VAT is applied, whether you provide your VAT ID or not. - For EU customers, before we can validate your VAT ID, it must be available for verification in the VAT Information Exchange System (VIES). If your VAT ID can't be verified, contact your local tax authority. -You might qualify for VAT zero-rating if: +You might qualify for VAT zero-rating if you meet one of the following criteria: -- **You're in a European Union Member State outside Ireland:** You can provide your valid local VAT ID. This lets Microsoft Ireland Operations Ltd. to VAT zero-rate the transaction. However, you might have a local VAT accounting obligation. If you have any concerns, check with your tax advisors. For instructions, see [Add your VAT ID](#add-your-vat-id).+- **You're in a European Union Member State outside Ireland:** You can provide your valid local VAT ID. Providing the VAT ID lets Microsoft Ireland Operations Ltd. VAT zero-rate the transaction. However, you might have a local VAT accounting obligation. If you have any concerns, check with your tax advisors. For instructions about adding the CAR ID for your organization, see [Add your VAT ID](#add-your-vat-id). -- **You're in Ireland and have the relevant valid VAT exemption certification:** Microsoft Ireland Operations Ltd. may be entitled to exempt the transaction from VAT. If you don't, Microsoft Ireland Operations Ltd. applies the current Irish VAT rate, whether you provide a VAT ID or not.+- **You're in Ireland and have the relevant valid VAT exemption certification:** Microsoft Ireland Operations Ltd. might be entitled to exempt the transaction from VAT. If you don't have a VAT exemption certification, Microsoft Ireland Operations Ltd. applies the current Irish VAT rate, whether you provide a VAT ID or not. -- **You're in Armenia, Belarus, Norway, Turkey, or United Arab Emirates:** You can provide your local VAT ID. This entitles Microsoft Ireland Operations Ltd. to VAT zero-rate the transaction. However, you may have a local VAT accounting obligation, so please check with your tax advisors if you have any concerns. For instructions, see [Add your VAT ID](#add-your-vat-id).+- **You're in Armenia, Belarus, Norway, Turkey, or United Arab Emirates:** You can provide your local VAT ID. Providing the VAT ID entitles Microsoft Ireland Operations Ltd. to VAT zero-rate the transaction. However, you might have a local VAT accounting obligation, so check with your tax advisors if you have any concerns. For instructions about adding the VAT ID for your organization, see [Add your VAT ID](#add-your-vat-id). ## Asia Pacific countries/regions (APAC) If you're billed by the Microsoft Regional Sales office, "Microsoft Regional Sales Pte. Ltd." appears on your invoice, and you might be charged for any applicable value-added, sales, or similar taxes. -If you're billed from one of the following locations, the current local tax is applied. The location is included [on your invoice](view-your-bill-or-invoice.md): +If you're billed from one of the following locations, the current local tax is applied. The location is included on your invoice: - India - Japan If you're billed from one of the following locations, the current local tax is a ## North, Central, and South America -In the United States, Canada, Mexico, Chile, and Colombia, various tax rates apply depending on the product nature and your location. +In the United States, Canada, Mexico, Chile, and Colombia, various tax rates apply depending on the nature of the product or service and your location. -If your billing is done by Microsoft Corporation ([see your invoice](view-your-bill-or-invoice.md), and you signed up for Microsoft 365 outside of the United States, Canada, Puerto Rico, Chile, and Colombia, then tax is generally not charged. +If your billing is done by Microsoft Corporation (see your invoice), and you signed up for Microsoft 365 outside of the United States, Canada, Puerto Rico, Chile, and Colombia, then tax generally isn't charged. ## Add your VAT ID -1. In the admin center, go to the **Billing** \> <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page. -2. On the **Products** tab, select the subscription that you want to update. +You can add your VAT ID in the Microsoft 365 admin center. However, the steps to add a VAT ID depend on the type of billing account that you have. [Find out what type of billing account you have](../manage-billing-accounts.md#view-my-billing-accounts). ++### Add your VAT ID for your MCA billing account ++1. Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>. +2. Select the **Navigation menu**, then select **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=2084771" target="_blank">Billing accounts</a>. +3. On the **Billing accounts** page, select the billing account. +4. On the billing account details page, select **Add tax ID**. +5. Enter your VAT ID, then select **Save**. ++### Add your VAT ID for your MOSA billing account ++1. Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>. + - If you're using the **Simplified view**, select **Subscriptions**. + - If you're using the **Dashboard view**, go to the **Billing** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842054" target="_blank">Your products</a> page. +2. Select the subscription that you want to update. 3. On the subscription details page, in the **Service usage address** section, select **Edit service usage address**.-4. On the **Edit service usage address** pane, in the **VAT number** box, enter your VAT ID, including the prefix, and without any spaces. +4. In the **Edit service usage address** pane, in the **VAT number** box, enter your VAT ID, including the prefix, and without any spaces. 5. Select **Save**. ## How taxes are calculated For example: ## Apply for tax-exempt status -If you qualify for tax-exempt status in your market, [start a service request](../../admin/get-help-support.md) to establish tax exempt status for your organization. +If you qualify for tax-exempt status in your market, [start a service request](../../admin/get-help-support.md) to establish tax exempt status for your organization. The following table lists the documentation required to apply for tax-exempt status, based on your country/region. -|Country or region | Documentation | +|Country/region | Documentation | ||-| | Canada | Certificate of Exemption (or equivalent letter of authorization) | | Chile | IVA status/RUT (Registro Unico Tributario) | If you qualify for tax-exempt status in your market, [start a service request](. | Puerto Rico | Certificado de Compras Exentas | ## Related content- -[View your bill or invoice](view-your-bill-or-invoice.md) (article)\ -[Understand your bill or invoice](understand-your-invoice.md) (article) ++[View your invoice in the Microsoft 365 admin center](view-your-bill-or-invoice.md)\ +[Understand your invoice for your Microsoft MCA billing account](understand-your-invoice.md)\ +[Understand your invoice for your Microsoft MOSA billing account](understand-your-invoice2.md) |
| enterprise | Cross Tenant Onedrive Migration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/cross-tenant-onedrive-migration.md | Up to 4,000 OneDrive accounts can be scheduled for migration in advance at a giv ## Licensing -**Cross Tenant User Data Migration** is available as an add-on to the following Microsoft 365 subscription plans for Enterprise Agreement customers. User licenses are per migration (onetime fee). Please contact your Microsoft account team for details. - -Microsoft 365 Business Basic/Business Standard/Business Premium/F1/F3/E3/A3/E5/A5; Office 365 F3/E1/A1/E3/A3/E5/A5; Exchange Online; SharePoint Online; OneDrive for Business. +>[!Important] +>As of Nov. 2022, Cross Tenant User Data Migration is available as an add-on to the following Microsoft 365 subscription plans for Enterprise Agreement customers, and is required for cross-tenant migrations. User licenses are per migration (one-time fee) and can be assigned either on the source or target user object. This license also covers Cross-tenant mailbox migration. Contact your Microsoft account team for details. +> +>The Cross Tenant User Data Migration add-on is available as a separate purchase for Microsoft 365 Business Basic, Standard, and Premium; Microsoft 365 F1/F3/E3/E5; Office 365 F3/E1/E3/E5; Exchange Online; SharePoint Online; and OneDrive for Business. ++>[!Warning] +>You must have purchased, or verified that you can purchase, cross tenant user data migration licenses prior to the next steps. Migrations fail if this step has not been completed. Microsoft does not offer exceptions for this licensing requirement. + ## Prerequisites and settings - **Microsoft SharePoint Online Powershell**. Confirm you have the most recent version installed. [Download SharePoint Online Management Shell from the official Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=35588). -- **Turn off service encryption with Customer Key enabled.** Confirm that the source OneDrive tenant **doesn't** have Service encryption with Microsoft Purview Customer Key enabled. If enabled on the source tenant, the migration will fail. [Learn more on Service encryption with Microsoft Purview Customer Key](/microsoft-365/compliance/customer-key-overview).+- **Confirm that the source OneDrive tenant does not have Service encryption with Microsoft Purview Customer Key enabled.** If enabled on the source tenant, the migration will fail. [Learn more on Service encryption with Microsoft Purview Customer Key](/microsoft-365/compliance/customer-key-overview). - Source OneDrive accounts must be set to Read/Write. If set to Read only, they'll fail. |
| enterprise | Cross Tenant Sharepoint Migration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/cross-tenant-sharepoint-migration.md | For more information on licensing: - **Microsoft SharePoint Online Powershell**. Confirm you have the most recent version installed. [Download SharePoint Online Management Shell from Official Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=35588) -- **Turn off service encryption with Customer Key enabled.** Confirm that the source OneDrive tenant **doesn't** have Service encryption with Microsoft Purview Customer Key enabled. If enabled on Source tenant, the migration will fail. [Learn more on Service encryption with Microsoft Purview Customer Key](/microsoft-365/compliance/customer-key-overview)+- **Confirm that the source SharePoint tenant does not have Service encryption with Microsoft Purview Customer Key enabled.** If enabled on Source tenant, the migration will fail. [Learn more on Service encryption with Microsoft Purview Customer Key](/microsoft-365/compliance/customer-key-overview) - Source SharePoint sites must be set to Read/Write. If set to Read only, the migration will fail. For more information on licensing: > - The 1 million item limit can be any "item", including files (including versions), folders, and list line entries if it is a list or library. > >- Ensure all users and groups identified for migration have been pre-created on the target tenant.->- Assign the appropriate licenses to each user on the target tenant. +>- Assign the appropriate licenses to each user on either the Source **or** the Target tenant. **The license does not need to be applied in both locations.** ## Path size limits |
| enterprise | M365 Dr Workload Spo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/m365-dr-workload-spo.md | Be sure to send your users an email when the move has successfully completed inf #### Scheduling OneDrive site moves You can schedule OneDrive site moves in advance (described later in this article). We recommend that you start with a small number of users to validate your workflows and communication strategies. Once you are comfortable with the process, you can schedule moves as follows:--You can schedule up to 4,000 moves at a time.--As the moves begin, you can schedule more, with a maximum of 4,000 pending moves in the queue and any given time.--The maximum size of a OneDrive that can be moved is 1 terabyte (1 TB).+- You can schedule up to 4,000 moves at a time. +- As the moves begin, you can schedule more, with a maximum of 4,000 pending moves in the queue and any given time. +- The maximum size of a OneDrive that can be moved is 2 terabytes (2 TB). #### **Moving a OneDrive site** To perform a OneDrive _Geography_ move, the _Tenant_ administrator must first set the user's Preferred Data Location (PDL) to the appropriate _Geography_ location. Once the PDL is set, wait for at least 24 hours for the PDL update to sync across the _Geography_ locations before starting the OneDrive _Geography_ move. You can schedule SharePoint site moves in advance (described later in this artic - You can schedule up to 4,000 moves at a time. - As the moves begin, you can schedule more, with a maximum of 4,000 pending moves in the queue and any given time.-- The maximum size of a SharePoint site that can be moved is 1 terabyte (1 TB).+- The maximum size of a SharePoint site that can be moved is 2 terabytes (2 TB). To schedule a SharePoint site _Geography_ move for a later time, include one of the following parameters when you start the move: |
| enterprise | Urls And Ip Address Ranges 21Vianet | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/urls-and-ip-address-ranges-21vianet.md | Title: "URLs and IP address ranges for Office 365 operated by 21Vianet" Previously updated : 08/08/2023 Last updated : 08/10/2023 audience: ITPro hideEdit: true # URLs and IP address ranges for Office 365 operated by 21Vianet - *Applies To: Office 365 operated by 21Vianet - Small Business Admin, Office 365 operated by 21Vianet - Admin* +*Applies To: Office 365 operated by 21Vianet - Small Business Admin, Office 365 operated by 21Vianet - Admin* **Summary**: The following endpoints (FQDNs, ports, URLs, IPv4, and IPv6 prefixes) apply to Office 365 operated by 21 Vianet and are designed to deliver productivity services to organizations using only these plans. - **Office 365 endpoints:** [Worldwide (including GCC)](urls-and-ip-address-ranges.md) | *Office 365 operated by 21 Vianet* | [Office 365 U.S. Government DoD](microsoft-365-u-s-government-dod-endpoints.md) | [Office 365 U.S. Government GCC High](microsoft-365-u-s-government-gcc-high-endpoints.md) | +**Office 365 endpoints:** [Worldwide (including GCC)](urls-and-ip-address-ranges.md) | *Office 365 operated by 21 Vianet* | [Office 365 U.S. Government DoD](microsoft-365-u-s-government-dod-endpoints.md) | [Office 365 U.S. Government GCC High](microsoft-365-u-s-government-gcc-high-endpoints.md) | **Last updated:** 07/31/2023 -  [Change Log subscription](https://endpoints.office.com/version/China?allversions=true&format=rss&clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7) |
| includes | Office 365 Operated By 21Vianet Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/office-365-operated-by-21vianet-endpoints.md | <!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> <!--Please contact the Office 365 Endpoints team with any questions.--> -<!--China endpoints version 2023062900--> -<!--File generated 2023-06-30 08:00:07.8248--> +<!--China endpoints version 2023073100--> +<!--File generated 2023-08-09 16:41:39.6547--> ## Exchange Online ID | Category | ER | Addresses | Ports 8 | Allow<BR>Required | No | `*.onmschina.cn, *.partner.microsoftonline.net.cn, *.partner.microsoftonline-i.net.cn, *.partner.office365.cn`<BR>`101.28.252.0/24, 115.231.150.0/24, 123.235.32.0/24, 171.111.154.0/24, 175.6.10.0/24, 180.210.229.0/24, 211.90.28.0/24` | **TCP:** 443, 80 9 | Allow<BR>Required | No | `*.partner.microsoftonline-p.cn`<BR>`182.50.87.0/24` | **TCP:** 443, 80 10 | Allow<BR>Required | No | `*.partner.microsoftonline.cn`<BR>`103.9.8.0/22` | **TCP:** 443, 80-11 | Allow<BR>Required | No | `activation.sls.microsoft.com, bjb-odcsm.officeapps.partner.office365.cn, bjb-roaming.officeapps.partner.office365.cn, crl.microsoft.com, odc.officeapps.live.com, office15client.microsoft.com, officecdn.microsoft.com, ols.officeapps.partner.office365.cn, roaming.officeapps.partner.office365.cn, sha-odcsm.officeapps.partner.office365.cn, sha-roaming.officeapps.partner.office365.cn`<BR>`40.73.248.0/21` | **TCP:** 443, 80 +11 | Default<BR>Required | No | `activation.sls.microsoft.com, crl.microsoft.com, odc.officeapps.live.com, officecdn.microsoft.com, officeclient.microsoft.com` | **TCP:** 443, 80 13 | Default<BR>Required | No | `*.msauth.cn, *.msauthimages.cn, *.msftauth.cn, *.msftauthimages.cn, login.microsoftonline.com` | **TCP:** 443, 80 15 | Default<BR>Required | No | `loki.office365.cn` | **TCP:** 443 16 | Default<BR>Required | No | `*.cdn.office.net, shellprod.msocdn.com` | **TCP:** 443-17 | Allow<BR>Required | No | `*.auth.microsoft.cn, login.partner.microsoftonline.cn, microsoftgraph.chinacloudapi.cn`<BR>`40.72.70.0/23, 42.159.87.106/32, 42.159.92.96/32, 52.130.2.32/27, 52.130.3.64/27, 52.130.17.192/27, 52.130.18.32/27, 139.217.115.121/32, 139.217.118.25/32, 139.217.118.46/32, 139.217.118.54/32, 139.217.228.95/32, 139.217.231.198/32, 139.217.231.208/32, 139.217.231.219/32, 139.219.132.56/32, 139.219.133.182/32, 2406:e500:5500::/48` | **TCP:** 443, 80 +17 | Allow<BR>Required | No | `*.auth.microsoft.cn, login.partner.microsoftonline.cn, microsoftgraph.chinacloudapi.cn`<BR>`40.72.70.0/23, 52.130.2.32/27, 52.130.3.64/27, 52.130.17.192/27, 52.130.18.32/27, 2406:e500:5500::/48` | **TCP:** 443, 80 18 | Default<BR>Required | No | `*.aadrm.cn, *.protection.partner.outlook.cn` | |
| lighthouse | M365 Lighthouse Alerts Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-alerts-overview.md | description: "For Managed Service Providers (MSPs) using Microsoft 365 Lighthous # Overview of the Alerts page in Microsoft 365 Lighthouse -As an MSP provider, you need to monitor and respond to the security issues of your customers efficiently and effectively. Microsoft 365 Lighthouse introduces alerts, a powerful tool that gives you a consolidated view of all the high priority detections and alerts across your customers. You can see a prioritized list of the most urgent issues that require your attention and take immediate action to resolve them. You can also enable push alerts to your existing support systems and flows, so you never miss a critical alert that needs your intervention. +> [!NOTE] +> Features get rolled out at different speeds to our customers. If you aren't seeing a feature yet, you should see it soon. +> +> To see which new features are currently available in your partner tenant, go to the **Home** page of Microsoft 365 Lighthouse, and then either select the **What's new** link in the upper-right corner of the page or select **What's new** on the **What's new & learning resources** card. ++As an MSP provider, you need to monitor and respond to the security issues of your customers efficiently and effectively. Microsoft 365 Lighthouse introduces alerts, a powerful tool that gives you a consolidated view of all the high-priority detections and alerts across your customers. You can see a prioritized list of the most urgent issues that require your attention and take immediate action to resolve them. You can also enable push alerts to your existing support systems and flows, so you never miss a critical alert that needs your intervention. To help you get started, Lighthouse provides a default set of alerting rules based on best practices and recommendations. You can use these rules as they are or modify them according to your preferences and needs. You can also create rules from scratch for more control and flexibility. |
| security | Android Privacy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/android-privacy.md | Last updated 12/18/2020 > Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) -Defender for Endpoint on Android collects information from your configured Android devices and stores it in the same tenant where you have Defender for Endpoint. The information is collected to help keep Defender for Endpoint for Android secure, up-to-date, performing as expected, and to support the service. +Defender for Endpoint on Android collects information from your configured Android devices and stores it in the same tenant where you have Defender for Endpoint. The information is collected to help keep Defender for Endpoint for Android secure, up to date, performing as expected, and to support the service. For more information about data storage, see [Microsoft Defender for Endpoint data storage and privacy](data-storage-privacy.md). -Information is collected to help keep Defender for Endpoint for Android secure, up-to-date, performing as expected and to support the service. +Information is collected to help keep Defender for Endpoint for Android secure, up to date, performing as expected and to support the service. For more information on most common privacy questions about Microsoft Defender for Endpoint on Android and iOS mobile devices, see [Microsoft Defender for Endpoint and your privacy on Android and iOS mobile devices](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-and-your-privacy-on-android-and-ios-mobile-devices-4109bc54-8ec5-4433-9c33-d359b75ac22a). |
| security | Configure Endpoints Sccm | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-sccm.md | After you install the Endpoint Protection client on your reference computer, ver 1. On the reference computer, open **System Center Endpoint Protection** from the Windows notification area. 1. On the **Home** tab of the **System Center Endpoint Protection** dialog box, verify that **Real-time protection** is set to **On.**-1. Verify that **Up-to-date** is displayed for **Virus and spyware definitions.** +1. Verify that **up to date** is displayed for **Virus and spyware definitions.** 1. To make sure that your reference computer is ready for imaging, under **Scan options,** select **Full,** and then click **Scan now.** |
| security | Configure Server Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-server-exclusions-microsoft-defender-antivirus.md | For a more detailed overview of exclusions, see [Manage exclusions for Microsoft - Appropriate exclusions must be set for software that isn't included with the operating system. - Windows Server 2012 R2 doesn't have Microsoft Defender Antivirus as an installable feature. When you onboard those servers to Defender for Endpoint, you'll install Microsoft Defender Antivirus, and default exclusions for operating system files are applied. However, exclusions for server roles (as specified below) don't apply automatically, and you should configure these exclusions as appropriate. To learn more, see [Onboard Windows servers to the Microsoft Defender for Endpoint service](configure-server-endpoints.md). - Built-in exclusions and automatic server role exclusions don't appear in the standard exclusion lists that are shown in the [Windows Security app](microsoft-defender-security-center-antivirus.md).-- The list of built-in exclusions in Windows is kept up-to-date as the threat landscape changes. This article lists some, but not all, of the built-in and automatic exclusions. +- The list of built-in exclusions in Windows is kept up to date as the threat landscape changes. This article lists some, but not all, of the built-in and automatic exclusions. ## Automatic server role exclusions Built-in exclusions include: - [File Replication Service (FRS) exclusions](#file-replication-service-frs-exclusions) - [Process exclusions for built-in operating system files](#process-exclusions-for-built-in-operating-system-files) -The list of built-in exclusions in Windows is kept up-to-date as the threat landscape changes. +The list of built-in exclusions in Windows is kept up to date as the threat landscape changes. ### Windows "temp.edb" files |
| security | Defender Endpoint Antivirus Exclusions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-antivirus-exclusions.md | Examples include: - Windows Security files - ... and more. -The list of built-in exclusions in Windows is kept up-to-date as the threat landscape changes. To learn more about these exclusions, see [Microsoft Defender Antivirus exclusions on Windows Server: Built-in exclusions](configure-server-exclusions-microsoft-defender-antivirus.md#built-in-exclusions). +The list of built-in exclusions in Windows is kept up to date as the threat landscape changes. To learn more about these exclusions, see [Microsoft Defender Antivirus exclusions on Windows Server: Built-in exclusions](configure-server-exclusions-microsoft-defender-antivirus.md#built-in-exclusions). ### Custom exclusions |
| security | Device Discovery Faq | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-discovery-faq.md | As device discovery uses passive methods to discover devices in the network, any ## How frequent is the active probing? -Devices will actively be probed when changes in device characteristics are observed to make sure the existing information is up-to-date (typically, devices probed no more than once in a three-week period) +Devices will actively be probed when changes in device characteristics are observed to make sure the existing information is up to date (typically, devices probed no more than once in a three-week period) ## My security tool raised alert on UnicastScanner.ps1 / PSScript_{GUID}.ps1 or port scanning activity initiated by it, what should I do? |
| security | Device Health Microsoft Defender Antivirus Health | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-health-microsoft-defender-antivirus-health.md | Following are up-to-date definitions for engine and platform: | The engine/platform on the device is considered: | Situation | |:|:|-| **up-to-date** | If the device communicated with the Defender report event ('Signature refresh time') within last seven days, and the Engine or Platform version build time is within last 60 days. | +| **up to date** | If the device communicated with the Defender report event ('Signature refresh time') within last seven days, and the Engine or Platform version build time is within last 60 days. | | **out-of-date** | If the device communicated with the Defender report event ('Signature refresh time') within last seven days, but Engine or Platform version build time is older than 60 days. | | **unknown (no data available)** | If the device hasn't communicated with the report event ('Signature refresh time') for more than seven days. | Following is the definitions for up-to-date security intelligence: | The security intelligence update is considered: | Situation | |:|:|-|**up-to-date** | If the security intelligence version on the device was written in the past seven days and the device has communicated with the report event in past seven days. | +|**up to date** | If the security intelligence version on the device was written in the past seven days and the device has communicated with the report event in past seven days. | For more information, see: |
| security | Device Health Sensor Health Os | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-health-sensor-health-os.md | For more information about user role management, see [Create and manage roles fo ## Sensor health & OS tab -Sensor health and OS cards report on general operating system health, which includes detection sensor health, up-to-date versus out-of-date operating systems, and Windows 10 versions. +Sensor health and OS cards report on general operating system health, which includes detection sensor health, up to date versus out-of-date operating systems, and Windows 10 versions. >:::image type="content" source="images/device-health-sensor-health-os-tab.png" alt-text="Shows Sensor health and Operating system information." lightbox="images/device-health-sensor-health-os-tab.png"::: |
| security | Ios Privacy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-privacy.md | Last updated 12/18/2020 > [!NOTE] > Defender for Endpoint on iOS uses a VPN to provide the Web Protection feature. This is not a regular VPN and is a local or self-looping VPN that does not take traffic outside the device. **Microsoft or your organization, does not see your browsing activity.** -Defender for Endpoint on iOS collects information from your configured iOS devices and stores it in the same tenant where you have Defender for Endpoint. The information is collected to help keep Defender for Endpoint on iOS secure, up-to-date, performing as expected, and to support the service. +Defender for Endpoint on iOS collects information from your configured iOS devices and stores it in the same tenant where you have Defender for Endpoint. The information is collected to help keep Defender for Endpoint on iOS secure, up to date, performing as expected, and to support the service. For more information about data storage, see [Microsoft Defender for Endpoint data storage and privacy](data-storage-privacy.md). |
| security | Linux Preferences | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-preferences.md | Specify the maximum number of entries to keep in the scan history. Entries inclu |**Possible values**|10000 (default). Allowed values are from 5000 items to 15000 items.| |**Comments**|Available in Defender for Endpoint version 101.04.76 or higher.| +#### Advanced scan options ++The following settings can be configured to enable certain advanced scanning features. ++>[!NOTE] +>Enabling these features might impact device performance. As such, it is recommended to keep the defaults. ++##### Configure scanning of file modify permissions events +When this feature is enabled, Defender for Endpoint will scan files when their permissions have been changed to set the execute bit(s). ++>[!NOTE] +>This feature is applicable only when the `enableFilePermissionEvents` feature is enabled. For more information, see [Advanced optional features](linux-preferences.md#configure-monitoring-of-file-modify-permissions-events) section below for details. ++|Description|Value| +||| +|**Key**|scanFileModifyPermissions| +|**Data type**|Boolean| +|**Possible values**|false (default) <p> true| +|**Comments**|Available in Defender for Endpoint version 101.23062.0010 or higher.| ++##### Configure scanning of file modify ownership events +When this feature is enabled, Defender for Endpoint will scan files for which ownership has changed. ++>[!NOTE] +>This feature is applicable only when the `enableFileOwnershipEvents` feature is enabled. For more information, see [Advanced optional features](linux-preferences.md#configure-monitoring-of-file-modify-ownership-events) section below for details. ++|Description|Value| +||| +|**Key**|scanFileModifyOwnership| +|**Data type**|Boolean| +|**Possible values**|false (default) <p> true| +|**Comments**|Available in Defender for Endpoint version 101.23062.0010 or higher.| ++##### Configure scanning of raw socket events +When this feature is enabled, Defender for Endpoint will scan network socket events such as creation of raw sockets / packet sockets, or setting socket option. ++>[!NOTE] +>This feature is applicable only when Behavior Monitoring is enabled. ++>[!NOTE] +>This feature is applicable only when the `enableRawSocketEvent` feature is enabled. For more information, see [Advanced optional features](linux-preferences.md#configure-monitoring-of-raw-socket-events) section below for details. ++|Description|Value| +||| +|**Key**|scanNetworkSocketEvent| +|**Data type**|Boolean| +|**Possible values**|false (default) <p> true| +|**Comments**|Available in Defender for Endpoint version 101.23062.0010 or higher.| ++ ### Cloud-delivered protection preferences The *cloudService* entry in the configuration profile is used to configure the cloud-driven protection feature of the product. Determines whether cloud-delivered protection is enabled on the device or not. T #### Diagnostic collection level -Diagnostic data is used to keep Defender for Endpoint secure and up-to-date, detect, diagnose and fix problems, and also make product improvements. This setting determines the level of diagnostics sent by the product to Microsoft. +Diagnostic data is used to keep Defender for Endpoint secure and up to date, detect, diagnose and fix problems, and also make product improvements. This setting determines the level of diagnostics sent by the product to Microsoft. |Description|Value| ||| |**Key**|diagnosticLevel| |**Data type**|String| |**Possible values**|optional <p> required (default)|-| #### Configure cloud block level -This setting determines how aggressive Defender for Endpoint is in blocking and scanning suspicious files. If this setting is on, Defender for Endpoint is more aggressive when identifying suspicious files to block and scan; otherwise, it is less aggressive and therefore blocks and scans with less frequency. There are five values for setting cloud block level: +This setting determines how aggressive Defender for Endpoint is in blocking and scanning suspicious files. If this setting is on, Defender for Endpoint is more aggressive when identifying suspicious files to block and scan; otherwise, it is less aggressive and therefore blocks and scans with less frequency. ++There are five values for setting cloud block level: - Normal (`normal`): The default blocking level. - Moderate (`moderate`): Delivers verdict only for high confidence detections. Determines whether security intelligence updates are installed automatically: |**Data type**|Boolean| |**Possible values**|true (default) <p> false| ++### Advanced optional features ++The following settings can be configured to enable certain advanced features. ++>[!NOTE] +>Enabling these features might impact device performance. It is recommended to keep the defaults. ++|Description|Value| +||| +|**Key**|features| +|**Data type**|Dictionary (nested preference)| +|**Comments**|See the following sections for a description of the dictionary contents.| ++#### Module load feature ++Determines whether module load events (file open events on shared libraries) are monitored. ++>[!NOTE] +>This feature is applicable only when Behavior Monitoring is enabled. ++|Description|Value| +||| +|**Key**|moduleLoad| +|**Data type**|String| +|**Possible values**|disabled (default) <p> enabled| +|**Comments**|Available in Defender for Endpoint version 101.68.80 or higher.| ++#### Supplementary sensor configurations ++The following settings can be used to configure certain advanced supplementary sensor features. ++|Description|Value| +||| +|**Key**|supplementarySensorConfigurations| +|**Data type**|Dictionary (nested preference)| +|**Comments**|See the following sections for a description of the dictionary contents.| ++##### Configure monitoring of file modify permissions events +Determines whether file modify permissions events (`chmod`) are monitored. ++>[!NOTE] +>When this feature is enabled, Defender for Endpoint will monitor changes to the execute bits of files, but not scan these events. For more information, see [Advanced scanning features](linux-preferences.md#configure-scanning-of-file-modify-permissions-events) section for more details. ++|Description|Value| +||| +|**Key**|enableFilePermissionEvents| +|**Data type**|String| +|**Possible values**|disabled (default) <p> enabled| +|**Comments**|Available in Defender for Endpoint version 101.23062.0010 or higher.| ++##### Configure monitoring of file modify ownership events +Determines whether file modify ownership events (chown) are monitored. ++>[!NOTE] +>When this feature is enabled, Defender for Endpoint will monitor changes to the ownership of files, but not scan these events. For more information, see [Advanced scanning features](linux-preferences.md#configure-scanning-of-file-modify-ownership-events) section for more details. ++|Description|Value| +||| +|**Key**|enableFileOwnershipEvents| +|**Data type**|String| +|**Possible values**|disabled (default) <p> enabled| +|**Comments**|Available in Defender for Endpoint version 101.23062.0010 or higher.| ++##### Configure monitoring of raw socket events +Determines whether network socket events involving creation of raw sockets / packet sockets, or setting socket option, are monitored. ++>[!NOTE] +>This feature is applicable only when Behavior Monitoring is enabled. ++>[!NOTE] +>When this feature is enabled, Defender for Endpoint will monitor these network socket events, but not scan these events. For more information, see [Advanced scanning features](linux-preferences.md#configure-scanning-of-raw-socket-events) section above for more details. ++|Description|Value| +||| +|**Key**|enableRawSocketEvent| +|**Data type**|String| +|**Possible values**|disabled (default) <p> enabled| +|**Comments**|Available in Defender for Endpoint version 101.23062.0010 or higher.| ++##### Configure monitoring of boot loader events +Determines whether boot loader events are monitored and scanned. ++>[!NOTE] +>This feature is applicable only when Behavior Monitoring is enabled. ++|Description|Value| +||| +|**Key**|enableBootLoaderCalls| +|**Data type**|String| +|**Possible values**|disabled (default) <p> enabled| +|**Comments**|Available in Defender for Endpoint version 101.68.80 or higher.| ++##### Configure monitoring of ptrace events +Determines whether ptrace events are monitored and scanned. ++>[!NOTE] +>This feature is applicable only when Behavior Monitoring is enabled. ++|Description|Value| +||| +|**Key**|enableProcessCalls| +|**Data type**|String| +|**Possible values**|disabled (default) <p> enabled| +|**Comments**|Available in Defender for Endpoint version 101.68.80 or higher.| ++##### Configure monitoring of pseudofs events +Determines whether pseudofs events are monitored and scanned. +> [!NOTE] +> This feature is applicable only when Behavior Monitoring is enabled. ++|Description|Value| +||| +|**Key**|enablePseudofsCalls| +|**Data type**|String| +|**Possible values**|disabled (default) <p> enabled| +|**Comments**|Available in Defender for Endpoint version 101.68.80 or higher.| ++##### Configure monitoring of module load events using eBPF +Determines whether module load events are monitored using eBPF and scanned. ++>[!NOTE] +>This feature is applicable only when Behavior Monitoring is enabled. ++|Description|Value| +||| +|**Key**|enableEbpfModuleLoadEvents| +|**Data type**|String| +|**Possible values**|disabled (default) <p> enabled| +|**Comments**|Available in Defender for Endpoint version 101.68.80 or higher.| ++#### Network protection configurations ++The following settings can be used to configure advanced Network Protection inspection features to control what traffic gets inspected by Network Protection. ++>[!NOTE] +>For these to be effective, Network Protection has to be turned on. For more information, see [Turn on network protection for Linux](network-protection-linux.md). ++|Description|Value| +||| +|**Key**|networkProtection| +|**Data type**|Dictionary (nested preference)| +|**Comments**|See the following sections for a description of the dictionary contents.| ++##### Configure ICMP inspection +Determines whether ICMP events are monitored and scanned. ++>[!NOTE] +>This feature is applicable only when Behavior Monitoring is enabled. ++|Description|Value| +||| +|**Key**|disableIcmpInspection| +|**Data type**|Boolean| +|**Possible values**|true (default) <p> false| +|**Comments**|Available in Defender for Endpoint version 101.23062.0010 or higher.| + ## Recommended configuration profile To get started, we recommend the following configuration profile for your enterprise to take advantage of all protection features that Defender for Endpoint provides. The following configuration profile will: The following configuration profile contains entries for all settings described in this document and can be used for more advanced scenarios where you want more control over the product. -> [!NOTE] -> It is not possible to control all Microsoft Defender for Endpoint communication with only a proxy setting in this JSON. +>[!NOTE] +>It is not possible to control all Microsoft Defender for Endpoint communication with only a proxy setting in this JSON. ### Full profile When you run the `mdatp health` command for the first time, the value for the ta } ``` - > [!NOTE] - > Don't forget to add the comma after the closing curly bracket at the end of the `cloudService` block. Also, make sure that there are two closing curly brackets after adding Tag or Group ID block (please see the above example). At the moment, the only supported key name for tags is `GROUP`. + >[!NOTE] + >Add the comma after the closing curly bracket at the end of the `cloudService` block. Also, make sure that there are two closing curly brackets after adding Tag or Group ID block (please see the above example). At the moment, the only supported key name for tags is `GROUP`. + ## Configuration profile validation The configuration profile must be a valid JSON-formatted file. There are many tools that can be used to verify this. For example, if you have `python` installed on your device: To verify that your /etc/opt/microsoft/mdatp/managed/mdatp_managed.json is worki - real_time_protection_enabled - automatic_definition_update_enabled -> [!NOTE] -> No restart of mdatp daemon is required for changes to _most_ configurations in mdatp_managed.json to take effect. +>[!NOTE] +>No restart of mdatp daemon is required for changes to _most_ configurations in mdatp_managed.json to take effect. **Exception:** The following configurations require a daemon restart to take effect: > - cloud-diagnostic > - log-rotation-parameters |
| security | Linux Privacy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-privacy.md | This section describes the privacy controls for the different types of data that ### Diagnostic data -Diagnostic data is used to keep Defender for Endpoint secure and up-to-date, detect, diagnose and fix problems, and also make product improvements. +Diagnostic data is used to keep Defender for Endpoint secure and up to date, detect, diagnose and fix problems, and also make product improvements. Some diagnostic data is required, while some diagnostic data is optional. We give you the ability to choose whether to send us required or optional diagnostic data by using privacy controls, such as policy settings for organizations. There are two levels of diagnostic data for Defender for Endpoint client software that you can choose from: -- **Required**: The minimum data necessary to help keep Defender for Endpoint secure, up-to-date, and performing as expected on the device it's installed on.+- **Required**: The minimum data necessary to help keep Defender for Endpoint secure, up to date, and performing as expected on the device it's installed on. - **Optional**: Other data that helps Microsoft make product improvements and provides enhanced information to help detect, diagnose, and remediate issues. By default, only required diagnostic data is sent to Microsoft. The following fields are considered common for all events: ### Required diagnostic data -**Required diagnostic data** is the minimum data necessary to help keep Defender for Endpoint secure, up-to-date, and perform as expected on the device it's installed on. +**Required diagnostic data** is the minimum data necessary to help keep Defender for Endpoint secure, up to date, and perform as expected on the device it's installed on. Required diagnostic data helps to identify problems with Microsoft Defender for Endpoint that may be related to a device or software configuration. For example, it can help determine if a Defender for Endpoint feature crashes more frequently on a particular operating system version, with newly introduced features, or when certain Defender for Endpoint features are disabled. Required diagnostic data helps Microsoft detect, diagnose, and fix these problems more quickly so the impact to users or organizations is reduced. |
| security | Mac Preferences | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-preferences.md | Specify whether to enable cloud-delivered protection the device or not. To impro #### Diagnostic collection level -Diagnostic data is used to keep Microsoft Defender for Endpoint secure and up-to-date, detect, diagnose and fix problems, and also make product improvements. This setting determines the level of diagnostics sent by Microsoft Defender for Endpoint to Microsoft. +Diagnostic data is used to keep Microsoft Defender for Endpoint secure and up to date, detect, diagnose and fix problems, and also make product improvements. This setting determines the level of diagnostics sent by Microsoft Defender for Endpoint to Microsoft. <br> |
| security | Mac Privacy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-privacy.md | This section describes the privacy controls for the different types of data coll ### Diagnostic data -Diagnostic data is used to keep Microsoft Defender for Endpoint secure and up-to-date, detect, diagnose and fix problems, and also make product improvements. +Diagnostic data is used to keep Microsoft Defender for Endpoint secure and up to date, detect, diagnose and fix problems, and also make product improvements. Some diagnostic data is required, while some diagnostic data is optional. We give you the ability to choose whether to send us required or optional diagnostic data through the use of privacy controls, such as policy settings for organizations. There are two levels of diagnostic data for Microsoft Defender for Endpoint client software that you can choose from: -- **Required**: The minimum data necessary to help keep Microsoft Defender for Endpoint secure, up-to-date, and performing as expected on the device it's installed on.+- **Required**: The minimum data necessary to help keep Microsoft Defender for Endpoint secure, up to date, and performing as expected on the device it's installed on. - **Optional**: Additional data that helps Microsoft make product improvements and provides enhanced information to help detect, diagnose, and remediate issues. The following fields are considered common for all events: ### Required diagnostic data -**Required diagnostic data** is the minimum data necessary to help keep Microsoft Defender for Endpoint secure, up-to-date, and perform as expected on the device it's installed on. +**Required diagnostic data** is the minimum data necessary to help keep Microsoft Defender for Endpoint secure, up to date, and perform as expected on the device it's installed on. Required diagnostic data helps to identify problems with Microsoft Defender for Endpoint that may be related to a device or software configuration. For example, it can help determine if a Microsoft Defender for Endpoint feature crashes more frequently on a particular operating system version, with newly introduced features, or when certain Microsoft Defender for Endpoint features are disabled. Required diagnostic data helps Microsoft detect, diagnose, and fix these problems more quickly so the impact to users or organizations is reduced. |
| security | Manage Gradual Rollout | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/manage-gradual-rollout.md | Last updated 06/23/2021 **Platforms** - Windows -It is important to ensure that client components are up-to-date to deliver critical protection capabilities and prevent attacks. +It is important to ensure that client components are up to date to deliver critical protection capabilities and prevent attacks. Capabilities are provided through several components: |
| security | Microsoft Defender Antivirus Ring Deployment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-ring-deployment.md | Deploying Microsoft Defender for Endpoint can be done using a ring-based deploym ## Ring deployment overview -It's important to ensure that client components are up-to-date to deliver critical protection capabilities and prevent attacks. +It's important to ensure that client components are up to date to deliver critical protection capabilities and prevent attacks. Capabilities are provided through several components: - [Endpoint Detection & Response](overview-endpoint-detection-response.md) |
| security | Microsoft Defender Antivirus Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates.md | Updates are released for x86, x64, and ARM64 Windows architecture. For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images). +### Version ++- Defender package version: **20230809.1** +- Security intelligence version: **1.395.68.0** +- Engine version: **1.1.23070.1005** +- Platform version: **4.18.23070.1004** ++#### Fixes ++- None + ### 20230604.1 - Defender package version: **20230604.1** |
| security | Tamper Resiliency | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tamper-resiliency.md | One of the most common tampering techniques is to use a vulnerable driver to gai In order to prevent a driver based tampering on a single device, the device needs to be configured to block the loading of that driver before the attack. -Microsoft provides several ways to keep devices well protected and up-to-date against driver based tampering. +Microsoft provides several ways to keep devices well protected and up to date against driver based tampering. ### Broadest protection - Microsoft vulnerable driver blocklist |
| security | Turn On Definition Retirement | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/turn-on-definition-retirement.md | search.appverid: met150 - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) -You can configure definition retirement using Group Policy. Definition retirement checks to see if a computer has the required security updates necessary to protect it against a particular vulnerability. If the system isn't vulnerable to the exploit detected by a definition, then that definition is "retired". If all security intelligence for a given protocol is retired, then that protocol is no longer parsed. Enabling this feature helps to improve performance. On a computer that is up-to-date with all the latest security updates, network protection has no impact on network performance. +You can configure definition retirement using Group Policy. Definition retirement checks to see if a computer has the required security updates necessary to protect it against a particular vulnerability. If the system isn't vulnerable to the exploit detected by a definition, then that definition is "retired". If all security intelligence for a given protocol is retired, then that protocol is no longer parsed. Enabling this feature helps to improve performance. On a computer that is up to date with all the latest security updates, network protection has no impact on network performance. ## Use Group Policy to configure definition retirement |
| security | Fixed Reported Inaccuracies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/fixed-reported-inaccuracies.md | The report inaccuracy capabilities provides a way to report false positive, inac You can use this article to find details on the inaccuracies that have been reported and are now fixed. The following tables present the fixed inaccuracies organized by month: +## July 2023 ++Inaccuracy report ID |Description |Fix date | +:|:|:| +24162 |Fixed inaccuracy in mysql_workbench| 04-Jul-23 +25736 | Fixed inaccuracy in Keepass | 04-Jul-23 +24598 | Fixed inaccuracy in Adobe flash player plugins |04-Jul-23 +ICM -399305402 | Disabled vulnerability assessment for Lenovo CVEs: </br> CVE-2021-3519, CVE-2021-22499, CVE-2021-22500, CVE-2021-22514| 03-Jul-23 +Not applicable| Added Microsoft Defender Vulnerability Management support for Arcserve_udp | 05-Jul-23 +ICM - 399989383 |Added accurate EOS details for Log4j versions| 05-Jul-23 +27379 | Fixed inaccuracy in adobe_animate | 06-Jul-23 +Not applicable | Added Arcserve_udp affected product details in CVE-2023-26258 |05-Jul-23 +26391 | Fixed inaccuracy in CVE-2020-26941 | 09-Jul-23 +25245 | Fixed inaccuracy in CVE-2022-40011 | 11-Jul-23 +Not applicable |Added Microsoft Defender Vulnerability Management support for Microsoft PowerBi Desktop | 13-Jul-23 +Not applicable | Added zero-day details for CVE-2023-36884 | 12-Jul-23 +26421 | Disabled vulnerability assessment for thinkcentre_m75q_gen_2 & thinkpad_l390_firmware | 14-Jul-23 +23876 | Fixed inaccurate recommendation in Microsoft Teams CVE-2023-24881 | 20-Jul-23 +25969 |Fixed inaccuracy in siemens _-sinec-nms | 24-Jul-23 +Not applicable |Added EOS details for win_server_2012 & win_server_2012_r2 | 25-Jul-23 +29096 | Fixed inaccurate detection of Slack version 1.0.0.0 | 25-Jul-23 +27941 | Disabled vulnerability assessment for application_performance_management | 25-Jul-23 +26116 | Fixed inaccuracy in HP CVEs: </br> CVE-2021-33159, CVE-2022-26845, CVE-2022-27497, CVE-2022-29893 | 27-Jul-23 +25809 | Disabled vulnerability assessment for Visio 2010, 2013, 2016 & 2019 | 31-Jul-23 +25810 | Disabled vulnerability assessment for Project 2019 | 31-Jul-23 +28176 | Fixed inaccuracy in VmWare_tools CVE-2021-31693 | 31-Jul-23 +29089 | Fixed inaccuracy in CVE-2023-24329| 31-Jul-23 +28489 | Fixed inaccuracy in CVE-2020-9484 | 31-Jul-23 +28385 | Fixed inaccuracy in CVE-2023-28759| 31-Jul-23 + ## June 2023 Inaccuracy report ID |Description |Fix date | Inaccuracy report ID |Description |Fix date | 26367 | Fixed inaccurate file path detections in Winrar | 28-Jun-23 27146 | Fixed inaccuracy in Windows 2012 r2 - KB5012170 | 28-Jun-23 22866 | Fixed normalization issue in dell optiplex_7470_ firmware | 29-Jun-23++ |
| security | Before You Begin Defender Experts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/before-you-begin-defender-experts.md | The following sections enumerate additional information about the service's data All data used for hunting from existing Defender services will continue to reside in the customer's original Microsoft 365 Defender service storage location. [Learn more](../../enterprise/o365-data-locations.md) -Defender Experts for Hunting operational data, such as case tickets and analyst notes, are generated and stored in a Microsoft data center in the US region for the length of the service, irrespective of the Microsoft 365 Defender service storage location. Data generated for the reporting dashboard is stored in customer's Microsoft 365 Defender service storage location. Reporting data and operational data will be retained for a grace period of no less than 90 days after a customer leaves the service. +Defender Experts for Hunting operational data, such as case tickets and analyst notes, are generated and stored in a Microsoft data center in the US region for the length of the service, irrespective of the Microsoft 365 Defender service storage location. Data generated for the reporting dashboard is stored in customer's Microsoft 365 Defender service storage location. Reporting data and operational data will be retained for a grace period of no more than 90 days after a customerΓÇÖs subscription expires. If the customer terminates their subscription, data will be deleted within 30 days. Microsoft experts hunt over [advanced hunting logs](../../security/defender/advanced-hunting-schema-tables.md) in Microsoft 365 Defender advanced hunting tables. The data in these tables depend on the set of Defender services the customer is enabled for (for example, Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, and Azure Active Directory). Experts also use a large set of internal threat intelligence data to inform their hunting and automation. |
| security | Before You Begin Xdr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/before-you-begin-xdr.md | The following sections enumerate additional information about the service's data All data used for hunting from existing Defender services will continue to reside in the customer's original Microsoft 365 Defender service storage location. [Learn more](/microsoft-365/enterprise/o365-data-locations). -Defender Experts for XDR operational data, such as case tickets and analyst notes, are generated and stored in a Microsoft data center in the US region for the length of the service, irrespective of the Microsoft 365 Defender service storage location. Data generated for the reporting dashboard is stored in customer's Microsoft 365 Defender service storage location. Reporting data and operational data will be retained for a grace period of no less than 90 days after a customer leaves the service. +Defender Experts for XDR operational data, such as case tickets and analyst notes, are generated and stored in a Microsoft data center in the US region for the length of the service, irrespective of the Microsoft 365 Defender service storage location. Data generated for the reporting dashboard is stored in customer's Microsoft 365 Defender service storage location. Reporting data and operational data will be retained for a grace period of no more than 90 days after a customerΓÇÖs subscription expires. If the customer terminates their subscription, data will be deleted within 30 days. Microsoft experts hunt over [advanced hunting logs](advanced-hunting-schema-tables.md) in Microsoft 365 Defender advanced hunting tables. The data in these tables depend on the set of Defender services the customer is enabled for (for example, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Azure AD). Experts also use a large set of internal threat intelligence data to inform their hunting and automation. |
| syntex | Copilot Syntex | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/copilot-syntex.md | -description: Learn how to File Q&A for Copilot to easily find information in Microsoft Syntex. +description: Learn how to use File Q&A for Copilot to easily find information in Microsoft Syntex. # Overview of Syntex File Q&A for Copilot (Preview) |
| syntex | Image Tagging Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/image-tagging-overview.md | |
| syntex | Image Tagging | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/image-tagging.md | |
| syntex | Manage Library Settings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/manage-library-settings.md | |