| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | About Shared Mailboxes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/email/about-shared-mailboxes.md | Before you [create a shared mailbox](create-a-shared-mailbox.md), here are some > [!NOTE] > To access a shared mailbox, a user must have an Exchange Online license, but the shared mailbox doesn't require a separate license. Every shared mailbox has a corresponding user account. Notice how you weren't asked to provide a password when you created the shared mailbox? The account has a password, but it's system-generated (unknown). You shouldn't use the account to log in to the shared mailbox. Without a license, shared mailboxes are limited to 50 GB. To increase the size limit to 100 GB, the shared mailbox must be assigned an Exchange Online Plan 2 license. The Exchange Online Plan 1 license with an Exchange Online Archiving add-on license will only increase the size of the archive mailbox. This will also let you enable auto-expanding archiving for additional archive storage capacity. Similarly, if you want to place a shared mailbox on litigation hold, the shared mailbox must have an Exchange Online Plan 2 license or an Exchange Online Plan 1 license with an Exchange Online Archiving add-on license. If you want to apply advanced features such as Microsoft Defender for Office 365, eDiscovery (Premium), or automatic retention policies, the shared mailbox must be licensed for those features. +> [!NOTE] +> Prior to July 2018, all unlicensed shared mailboxes were provisioned with a size of 100 GB. For more information, see [Correcting Shared Mailbox provisioning and sizing](https://techcommunity.microsoft.com/t5/exchange-team-blog/correcting-shared-mailbox-provisioning-and-sizing/ba-p/607991). + ## Related content [Create a shared mailbox](create-a-shared-mailbox.md) (article)\ |
| admin | Change Nameservers At Any Domain Registrar | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/get-help-with-domains/change-nameservers-at-any-domain-registrar.md | In addition, you can create a CNAME record to help customers find your website. 1. Select **Add record**. 2. In the **Add a custom DNS record** pane, from the **Type** dropdown list, select **CNAME (Alias)**. 3. In the **Host name or Alias** box, type **www**.-4. In the **Points to address** box, type the fully qualified domain name (FQDN) for your website. For example, **contoso.5om**. +4. In the **Points to address** box, type the fully qualified domain name (FQDN) for your website. For example, **contoso.com**. 5. If you want to change the TTL setting for the record, select a new length of time from the **TTL** dropdown list. Otherwise, continue to step 6. 6. Select **Save**. |
| admin | Idle Session Timeout Web Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/idle-session-timeout-web-apps.md | When a user has been inactive in Microsoft 365 web apps for the time period you ## Idle session timeout on unmanaged devices -For idle session timeout to get triggered on unmanaged devices, you'll need to add a Conditional Access policy in the Azure AD admin center. +For idle session timeout to get triggered only on unmanaged devices, you'll need to add a Conditional Access policy in the Azure AD admin center. 1. On the **Conditional Access | Policies** page of the Azure AD admin center, select **New policy** and enter a name for the policy. |
| admin | Manage Feedback Ms Org | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/manage-feedback-ms-org.md | description: "Manage feedback your users can send to Microsoft about Microsoft p # Manage Microsoft feedback for your organization -As the admin of a Microsoft 365 organization, there are now several policies to help you manage the feedback collection and the customer engagement experience of your users when using Microsoft 365 applications. You can create and use existing Azure Active directory groups in your organization for each of these policies. With these polices, you can control how different departments in your organization can send feedback to Microsoft. Microsoft reviews all feedback submitted by customers and uses this feedback to improve the product. Keeping the feedback experiences turned **On** allows you to see what your users are saying about the Microsoft products they're using. The feedback we collect from your users will soon be available in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>. +As the admin of a Microsoft 365 organization, there are now several policies to help you manage the feedback collection and the customer engagement experience of your users when using Microsoft 365 applications. You can create and use existing Azure Active directory groups in your organization for each of these policies. With these polices, you can control how different departments in your organization can send feedback to Microsoft. Microsoft reviews all feedback submitted by customers and uses this feedback to improve the product. Keeping the feedback experiences turned **On** allows you to see what your users are saying about the Microsoft products they're using. The feedback we collect from your users is available in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>. To learn more about the types of feedback and how Microsoft uses user feedback, see [Learn about Microsoft feedback for your organization](../misc/feedback-user-control.md). The table below represents which apps and services are currently connected to th |:--|:--|:--|:--|:--| |**Access**|Yes|Yes|Yes|Yes| |**Excel**|Yes|Yes|Yes|Yes|+|**Forms**|Yes|Yes|Yes|Yes| +|**Intune Company Portal (Android)**|Yes|Yes|Yes|Yes| +|**Microsoft Stream (Android, iOS)**|Yes|Yes|Yes|Yes| +|**Microsoft Whiteboard**|Yes|Yes|Yes|Yes| |**Office.com**|Coming soon|Coming soon|Coming soon|Coming soon| |**OneNote**|Yes|Yes|Yes|Yes| |**OneDrive**|[Some settings currently managed by other controls.](/onedrive/disable-contact-support-send-feedback)||||-|**Outlook**|Coming soon|Coming soon|Coming soon|Coming soon| +|**Outlook (Web, iOS)**|Coming soon|Coming soon|Coming soon|Coming soon| +|**Outlook (Desktop, Android, Mac)**|Coming soon|Coming soon|Coming soon|Coming soon| |**PowerPoint**|Yes|Yes|Yes|Yes| |**Project**|Coming soon|Coming soon|Coming soon|Coming soon| |**Publisher**|Yes|Yes|Yes|Yes| |**SharePoint**|[Some settings currently managed by other controls.](/powershell/module/sharepoint-online/set-spotenant)|||| |**Teams**|[Some settings currently managed by other controls.](/microsoftteams/manage-feedback-policies-in-teams)||||+|**To Do**|Yes|Yes|Yes|Yes| |**Word**|Yes|Yes|Yes|Yes| |**Visio**|Yes|Yes|Yes|Yes|+|**Viva Goals**|Yes|Yes|Yes|Yes| +|**Whiteboard**|Yes|Yes|Yes|Yes| |**Yammer**|Yes|Yes|Yes|Yes| [See here for some examples of in-product surveys and feedback.](/microsoft-365/admin/misc/feedback-user-control#in-product-surveys) |
| admin | Feedback User Control | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/feedback-user-control.md | When a user submits feedback, app information is usually collected along with ap ## How can I see my user's feedback? -To meet MicrosoftΓÇÖs legal obligations to customers, we're working on a new experience in the Microsoft 365 admin center that lets administrators view, delete, and export the feedback data for their organizations. As part of their data controller responsibility, customers own all user feedback data and this functionality will assist administrators to provide direct transparency into their usersΓÇÖ experiences with Microsoft 365 products and enable user feedback data to be provided as part of any Data Subject Request. Global admins and compliance data administrators will have the ability to view, export and delete user feedback. All other administrators, as well as readers, will be able to view and export feedback data but can't perform compliance related tasks or see information about who posted the feedback (such as user name, email, or device name). To access your organization's feedback data, sign in to the Microsoft 365 admin center and customize navigation to show the health node. Access this experience by selecting **Product Feedback** under the Health node. +To meet MicrosoftΓÇÖs legal obligations to customers, we've added a new experience in the Microsoft 365 admin center that lets administrators view, delete, and export the feedback data for their organizations. As part of their data controller responsibility, customers own all user feedback data and this functionality will assist administrators to provide direct transparency into their usersΓÇÖ experiences with Microsoft 365 products and enable user feedback data to be provided as part of any Data Subject Request. Global admins and compliance data administrators now have the ability to view, export and delete user feedback. All other administrators, as well as readers, are able to view and export feedback data but can't perform compliance related tasks or see information about who posted the feedback (such as user name, email, or device name). To access your organization's feedback data, sign in to the Microsoft 365 admin center and customize navigation to show the health node. Access this experience by selecting **Product Feedback** under the Health node. ## Data handling and privacy |
| compliance | Device Onboarding Offboarding Macos Intune | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/device-onboarding-offboarding-macos-intune.md | Onboarding a macOS device into Compliance solutions is a six phase process. 1. [Get the device onboarding package](#get-the-device-onboarding-package) 1. [Deploy the onboarding package](#deploy-the-onboarding-package) 1. [Enable system extension](#enable-system-extension)-1. [Get the installation package](#get-the-installation-package) 1. [Publish application](#publish-application) ### Create system configuration profiles full disk access |[fulldisk.mobileconfig](https://github.com/microsoft/mdatp 1. Choose **Next** to deploy the configuration. -### Get the installation package --1. In **Compliance center** open **Settings** > **Device Onboarding** and choose **Onboarding**. - -1. For **Select operating system to start onboarding process** choose **macOS** - -1. For **Deployment method** choose **Mobile Device Management/Microsoft Intune** - -1. Choose **Download installation package**. This will give you the *wdav.pkg* file. --> [!IMPORTANT] -> Before you can deploy the *wdav.pkg.* package via Intune, it must be reformatted using the *Intune App Wrapping Tools for Mac* into the *wdav.pkg.intunemac* format. - - ### Publish application Microsoft Endpoint DLP is installed as a component of Microsoft Defender for Endpoint (MDE) on macOS |
| compliance | Dlp Policy Tips Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-policy-tips-reference.md | DLP policy tips in Outlook Web Access is supported for all the conditions, excep ## Outlook 2013 and later supports showing policy tips for only some conditions and exceptions -Currently, Outlook 2013 and later supports showing policy tips for policies which do not contain any condition or exception apart from the below mentioned conditions and corresponding exceptions : +Currently, Outlook 2013 and later supports showing policy tips for policies which do not contain any condition or exception apart from the below mentioned conditions and corresponding exceptions: - Content contains (works only for Sensitive information types. Sensitivity labels are not supported) - Content is shared Note that all the conditions work for emails authored in Outlook client app, whe ## Outlook 2013 and later and Office apps on Desktop support showing policy tips for only some sensitive information types -The list of out-of-the-box sensitive information types that will be detected for showing DLP policy tips in Outlook on Desktop (2013 and later) and Office apps (Word, Excel, PowerPoint) on Desktop are the following : +The list of out-of-the-box sensitive information types that will be detected for showing DLP policy tips in Outlook on Desktop (2013 and later) and Office apps (Word, Excel, PowerPoint) on Desktop are the following: - ABA Routing Number - Argentina National Identity (DNI) Number Note that some custom sensitive information types are also supported for DLP pol ## Data Loss Prevention on endpoint devices supports policy tips for only some sensitive information types -The list of out-of-the-box sensitive information types that will be detected in documents residing on endpoint devices are the following : +The list of out-of-the-box sensitive information types that will be detected in documents residing on endpoint devices are the following: - ABA Routing Number - Argentina National Identity (DNI) Number Please note that custom sensitive information types will also be detected in add |**On-prem**|:::image type="icon" source="../media/crsmrk.png" border="false":::|none|none|| |**Word, Excel, PowerPoint Win32 Client**|:::image type="icon" source="../medi#policy-tips-in-excel-powerpoint-and-word) for more details| |**Power BI**|:::image type="icon" source="../media/crsmrk.png" border="false":::|subset|subset|Data loss prevention policies in Power BI are in Public Preview. </br></br> Policy tips and admin alerts are supported. |-|||||| |
| compliance | Sensitivity Labels Coauthoring | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-coauthoring.md | Make sure you understand the following prerequisites before you turn on this fea - Microsoft 365 Apps for enterprise: - **Windows**: Minimum version 2107 from Current Channel or Monthly Enterprise Channel, or minimum version 2202 from Semi-Annual Enterprise Channel - **macOS**: Minimum version 16.51- - **iOS**: In preview when you [opt in](#opt-in-to-the-preview-of-co-authoring-for-ios-and-android) with minimum version 2.58 - - **Android**: In preview when you [opt in](#opt-in-to-the-preview-of-co-authoring-for-ios-and-android) with minimum version 16.0.14931 + - **iOS**: Minimum version 2.58 + - **Android**: Minimum version 16.0.14931 - All apps, services, and operational tools in your tenant must support the new [labeling metadata](#metadata-changes-for-sensitivity-labels). If you use any of the following, check the minimum versions required: Microsoft 365 services automatically support the new labeling metadata when you - [DLP policies that use sensitivity labels as conditions](dlp-sensitivity-label-as-condition.md) - [Microsoft Defender for Cloud Apps configured to apply sensitivity labels](/cloud-app-security/best-practices#discover-classify-label-and-protect-regulated-and-sensitive-data-stored-in-the-cloud) -### Opt in to the preview of co-authoring for iOS and Android --To try the preview of co-authoring for iOS and Android, you must have the minimum versions stated in the previous section, and also request your tenant is added to the preview: [Consent to Enable co-authoring for files encrypted with sensitivity labels on mobile](https://ncv.microsoft.com/5Oob3oDj1O) --For more information, see the following blog post announcement: [Co-authoring on Microsoft Information Protection encrypted documents is now in public preview on mobile devices](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/co-authoring-on-microsoft-information-protection-encrypted/ba-p/3081369) - ## Limitations Before you enable the tenant setting for co-authoring for files encrypted with sensitivity labels, make sure you understand the following limitations of this feature. Before you enable the tenant setting for co-authoring for files encrypted with s Specific to Excel: Metadata for a sensitivity label that doesn't apply encryption can be deleted from a file if somebody edits and saves that file by using a version of Excel that doesn't support the metadata changes for sensitivity labels. -- Supporting Office apps for iOS and Android are currently in [preview](https://office.com/insider).- - Co-authoring and AutoSave aren't supported and don't work for labeled and encrypted Office documents that use any of the following [configurations for encryption](encryption-sensitivity-labels.md#configure-encryption-settings): - **Let users assign permissions when they apply the label** and the checkbox **In Word, PowerPoint, and Excel, prompt users to specify permissions** is selected. This configuration is sometimes referred to as "user-defined permissions". - **User access to content expires** is set to a value other than **Never**. Before you enable the tenant setting for co-authoring for files encrypted with s > [!CAUTION] > Turning on this setting is a one-way action. Enable it only after you have read and understood the metadata changes, prerequisites, limitations, and any known issues documented on this page. -If you've already turned on this setting during the preview period, no further action is needed and you can skip this procedure. - 1. Sign in to the [Microsoft Purview compliance portal](https://compliance.microsoft.com) as a global admin for your tenant. 2. From the navigation pane, select **Settings** > **Co-authoring for files with sensitivity files**. |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | The numbers listed are the minimum Office application versions required for each |[Require users to apply a label to their email and documents](#require-users-to-apply-a-label-to-their-email-and-documents) | Current Channel: 2101+ <br /><br> Monthly Enterprise Channel: 2101+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.45+ | 2.47+ | 16.0.13628+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |-|[Support co-authoring and AutoSave](sensitivity-labels-coauthoring.md) for labeled and encrypted documents | Current Channel: 2107+ <br /><br> Monthly Enterprise Channel: 2107+ <br /><br> Semi-Annual Enterprise Channel: 2202+ | 16.51+ | Preview: 2.58+ when you [opt-in](sensitivity-labels-coauthoring.md#opt-in-to-the-preview-of-co-authoring-for-ios-and-android) | Preview: 16.0.14931+ when you [opt-in](sensitivity-labels-coauthoring.md#opt-in-to-the-preview-of-co-authoring-for-ios-and-android) | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | +|[Support co-authoring and AutoSave](sensitivity-labels-coauthoring.md) for labeled and encrypted documents | Current Channel: 2107+ <br /><br> Monthly Enterprise Channel: 2107+ <br /><br> Semi-Annual Enterprise Channel: 2202+ | 16.51+ | 2.58+ | 16.0.14931+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[PDF support](#pdf-support)| Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review | Under review | - ### Sensitivity label capabilities in Outlook The numbers listed are the minimum Office application versions required for each capability. |
| compliance | Sit Modify Edm Schema Configurable Match | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sit-modify-edm-schema-configurable-match.md | -Exact Data Match (EDM) based classification enables you to create custom sensitive information types that refer to exact values in a database of sensitive information. When you need to allow for variants of a exact string, you can use *configurable match* to tell Microsoft Purview to ignore case and some delimiters. +Exact Data Match (EDM) based classification enables you to create custom sensitive information types that refer to exact values in a database of sensitive information. When you need to allow for variants of an exact string, you can use *configurable match* to tell Microsoft Purview to ignore case and some delimiters. > [!IMPORTANT] > Use this procedure to modify an existing EDM schema and data file. Exact Data Match (EDM) based classification enables you to create custom sensiti > [!TIP] > Optionally, you can run a validation against your csv file before uploading by running: >- > `EdmUploadAgent.exe /ValidateData /DataFile [data file] [schema file]` + > `EdmUploadAgent.exe /ValidateData /DataFile [data file] /Schema [schema file]` + > + > For example: + >`EdmUploadAgent.exe /ValidateData /DataFile C:\data\testdelimiters.csv /Schema C:\EDM\patientrecords.xml` > > For more information on all the EdmUploadAgent.exe supported parameters, run > |
| frontline | Shifts For Teams Landing Page | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/shifts-for-teams-landing-page.md | Use the following resources to help you set up and manage Shifts in your organiz | | | |||-|<img src="/office/media/icons/calendar-teams.png" alt="Calendar symbol."> |**[Manage Shifts](/microsoftteams/expand-teams-across-your-org/shifts/manage-the-shifts-app-for-your-organization-in-teams?bc=/microsoft-365/frontline/breadcrumb/toc.json&toc=/microsoft-365/frontline/toc.json)** Learn how to manage Shifts for your organization. | +|<img src="/office/media/icons/calendar-teams.png" alt="Calendar symbol."> |**[Manage Shifts](/microsoftteams/expand-teams-across-your-org/shifts/manage-the-shifts-app-for-your-organization-in-teams?bc=/microsoft-365/frontline/breadcrumb/toc.json&toc=/microsoft-365/frontline/toc.json)** Get an overview of how to manage Shifts for your organization. Learn how to control access to Shifts, pin Shifts to the Teams app bar for easy access, enable shift-based tags, and more. | |<img src="/office/medi)** This feature lets you elevate the permissions of a team member to a schedule owner without making the employee a team owner. | |<img src="/office/media/icons/help.png" alt="Help symbol."> | **[Shifts data FAQ](/microsoftteams/expand-teams-across-your-org/shifts/shifts-data-faq?bc=/microsoft-365/frontline/breadcrumb/toc.json&toc=/microsoft-365/frontline/toc.json)** Learn where Shifts data is stored and other topics related to Shifts data, including retention, retrieval, and encryption. | |
| includes | Microsoft 365 Content Updates | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/microsoft-365-content-updates.md | +## Week of August 15, 2022 +++| Published On |Topic title | Change | +|||--| +| 8/15/2022 | [Manage billing across multiple tenants in the Microsoft 365 admin center](/microsoft-365/commerce/billing-and-payments/manage-multi-tenant-billing?view=o365-worldwide) | added | +| 8/15/2022 | Payment Services Directive 2 and Strong Customer Authentication for commercial customers | removed | +| 8/15/2022 | [Onboard Windows 10 or Windows 11 devices into Microsoft 365 overview](/microsoft-365/compliance/device-onboarding-overview?view=o365-worldwide) | modified | +| 8/15/2022 | [View and edit your security settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-configure-security-settings?view=o365-worldwide) | modified | +| 8/15/2022 | [Visit the Microsoft 365 Defender portal](/microsoft-365/security/defender-business/mdb-get-started?view=o365-worldwide) | modified | +| 8/15/2022 | [Endpoint detection and response in block mode](/microsoft-365/security/defender-endpoint/edr-in-block-mode?view=o365-worldwide) | modified | +| 8/15/2022 | [Export assessment methods and properties per device](/microsoft-365/security/defender-endpoint/get-assessment-methods-properties?view=o365-worldwide) | modified | +| 8/15/2022 | [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 8/15/2022 | [Collaborate with guests in a site](/microsoft-365/solutions/collaborate-in-site?view=o365-worldwide) | modified | +| 8/15/2022 | [Compliance score calculation](/microsoft-365/compliance/compliance-score-calculation?view=o365-worldwide) | modified | +| 8/15/2022 | [eDiscovery (Premium) limits](/microsoft-365/compliance/limits-ediscovery20?view=o365-worldwide) | modified | +| 8/15/2022 | [Limits for Content search and eDiscovery (Standard) in the compliance center](/microsoft-365/compliance/limits-for-content-search?view=o365-worldwide) | modified | +| 8/15/2022 | [Allow or block emails using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/allow-block-email-spoof?view=o365-worldwide) | modified | +| 8/15/2022 | [What's new in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/whats-new-in-defender-for-office-365?view=o365-worldwide) | modified | +| 8/16/2022 | [Use Power Automate connectors to build Bookings workflows](/microsoft-365/bookings/power-automate-integration?view=o365-worldwide) | added | +| 8/16/2022 | [Share DLP alerts](/microsoft-365/compliance/dlp-share-alerts?view=o365-worldwide) | added | +| 8/16/2022 | [Azure AD configuration for content encrypted by Microsoft Purview Information Protection](/microsoft-365/compliance/encryption-azure-ad-configuration?view=o365-worldwide) | added | +| 8/16/2022 | [Create exact data match sensitive information type workflow classic experience](/microsoft-365/compliance/sit-create-edm-sit-classic-ux-workflow?view=o365-worldwide) | added | +| 8/16/2022 | [Create EDM SIT sample file for the new experience](/microsoft-365/compliance/sit-create-edm-sit-unified-ux-sample-file?view=o365-worldwide) | added | +| 8/16/2022 | [Create EDM SIT using the new experience](/microsoft-365/compliance/sit-create-edm-sit-unified-ux-schema-rule-package?view=o365-worldwide) | added | +| 8/16/2022 | [Create exact data match sensitive information type workflow new experience](/microsoft-365/compliance/sit-create-edm-sit-unified-ux-workflow?view=o365-worldwide) | added | +| 8/16/2022 | [Automate document generation with SharePoint Syntex and Power Automate (preview)](/microsoft-365/contentunderstanding/automate-document-generation) | added | +| 8/16/2022 | [Suspicious password-spray-related IP address activity alert](/microsoft-365/security/defender/alert-grading-password-spray?view=o365-worldwide) | added | +| 8/16/2022 | [Enable auto-expanding archiving](/microsoft-365/compliance/enable-autoexpanding-archiving?view=o365-worldwide) | modified | +| 8/16/2022 | [Manage sensitivity labels in Office apps](/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide) | modified | +| 8/16/2022 | [Get started with exact data match based sensitive information types](/microsoft-365/compliance/sit-get-started-exact-data-match-based-sits-overview?view=o365-worldwide) | modified | +| 8/16/2022 | [Create the schema for exact data match based sensitive information types](/microsoft-365/compliance/sit-get-started-exact-data-match-create-schema?view=o365-worldwide) | modified | +| 8/16/2022 | [Export source data for exact data match based sensitive information type](/microsoft-365/compliance/sit-get-started-exact-data-match-export-data?view=o365-worldwide) | modified | +| 8/16/2022 | [Hash and upload the sensitive information source table for exact data match sensitive information types](/microsoft-365/compliance/sit-get-started-exact-data-match-hash-upload?view=o365-worldwide) | modified | +| 8/16/2022 | [Learn about exact data match based sensitive information types](/microsoft-365/compliance/sit-learn-about-exact-data-match-based-sits?view=o365-worldwide) | modified | +| 8/16/2022 | [Philippines passport number entity definition](/microsoft-365/compliance/sit-defn-philippines-passport-number?view=o365-worldwide) | added | +| 8/16/2022 | [Qatari ID card number](/microsoft-365/compliance/sit-defn-qatari-id-card-number?view=o365-worldwide) | added | +| 8/16/2022 | [Secure Windows devices](/microsoft-365/business-premium/m365bp-secure-windows-devices?view=o365-worldwide) | modified | +| 8/17/2022 | [Microsoft Purview solutions trial playbook](/microsoft-365/compliance/compliance-easy-trials-compliance-playbook?view=o365-worldwide) | modified | +| 8/17/2022 | [Microsoft Defender Vulnerability Management frequently asked questions](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-faq?view=o365-worldwide) | modified | +| 8/17/2022 | About the Microsoft Defender Vulnerability Management public preview trial | removed | +| 8/17/2022 | Trial playbook - Microsoft Defender Vulnerability Management (public preview) | removed | +| 8/17/2022 | [What's new in Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score-whats-new?view=o365-worldwide) | modified | +| 8/17/2022 | [The Microsoft Defender for Office 365 email entity page](/microsoft-365/security/office-365-security/mdo-email-entity-page?view=o365-worldwide) | modified | +| 8/17/2022 | [Protect information subject to data privacy regulation](/microsoft-365/solutions/information-protection-deploy-protect-information?view=o365-worldwide) | modified | +| 8/17/2022 | [Configure privacy settings in Microsoft Whiteboard](/microsoft-365/whiteboard/configure-privacy-settings?view=o365-worldwide) | modified | +| 8/17/2022 | [Onboard and offboard macOS devices into Compliance solutions using Microsoft Intune for Microsoft Defender for Endpoint customers](/microsoft-365/compliance/device-onboarding-offboarding-macos-intune-mde?view=o365-worldwide) | modified | +| 8/17/2022 | [Use network protection to help prevent Linux connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection-linux?view=o365-worldwide) | added | +| 8/17/2022 | [Use network protection to help prevent macOS connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection-macos?view=o365-worldwide) | added | +| 8/17/2022 | [Use network protection to help prevent connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection?view=o365-worldwide) | modified | +| 8/18/2022 | [Integrate Microsoft OneDrive LTI with Desire2Learn Brightspace](/microsoft-365/lti/onedrive-lti-brightspace?view=o365-worldwide) | added | +| 8/18/2022 | Add licenses using a product key | removed | +| 8/18/2022 | [Buy or remove licenses](/microsoft-365/commerce/licenses/buy-licenses?view=o365-worldwide) | modified | +| 8/18/2022 | [Renew Microsoft 365 for business](/microsoft-365/commerce/subscriptions/renew-your-subscription?view=o365-worldwide) | modified | +| 8/18/2022 | [Azure AD configuration for content encrypted by Microsoft Purview Information Protection](/microsoft-365/compliance/encryption-azure-ad-configuration?view=o365-worldwide) | modified | +| 8/18/2022 | [Use Microsoft OneDrive LTI with Blackboard](/microsoft-365/lti/onedrive-lti-blackboard?view=o365-worldwide) | modified | +| 8/18/2022 | [Protect against malware and other threats with Microsoft 365 Business Premium](/microsoft-365/business-premium/m365bp-increase-protection?view=o365-worldwide) | modified | +| 8/18/2022 | [Frontline team collaboration](/microsoft-365/frontline/flw-team-collaboration?view=o365-worldwide) | modified | +| 8/18/2022 | [Investigate devices in the Defender for Endpoint Devices list](/microsoft-365/security/defender-endpoint/investigate-machines?view=o365-worldwide) | modified | +| 8/18/2022 | [Device health and compliance report in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/machine-reports?view=o365-worldwide) | modified | +| 8/18/2022 | [Troubleshoot Microsoft Defender Antivirus while migrating from a third-party solution](/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus-when-migrating?view=o365-worldwide) | modified | +| 8/19/2022 | [Frequently asked questions on tamper protection](/microsoft-365/security/defender-endpoint/faqs-tamper-protection?view=o365-worldwide) | added | +| 8/19/2022 | [Manage tamper protection using tenant attach with Configuration Manager, version 2006](/microsoft-365/security/defender-endpoint/manage-tamper-protection-configuration-manager?view=o365-worldwide) | added | +| 8/19/2022 | [Manage tamper protection on an individual device](/microsoft-365/security/defender-endpoint/manage-tamper-protection-individual-device?view=o365-worldwide) | added | +| 8/19/2022 | [Manage tamper protection for your organization using Microsoft 365 Defender](/microsoft-365/security/defender-endpoint/manage-tamper-protection-microsoft-365-defender?view=o365-worldwide) | added | +| 8/19/2022 | [Manage tamper protection for your organization using Microsoft Endpoint Manager](/microsoft-365/security/defender-endpoint/manage-tamper-protection-microsoft-endpoint-manager?view=o365-worldwide) | added | +| 8/19/2022 | [How to schedule an antivirus scan using Anacron in Microsoft Defender for Endpoint on Linux](/microsoft-365/security/defender-endpoint/schedule-antivirus-scan-in-mde?view=o365-worldwide) | added | +| 8/19/2022 | [View the details and results of an automated investigation](/microsoft-365/security/defender-endpoint/autoir-investigation-results?view=o365-worldwide) | modified | +| 8/19/2022 | [What's new in Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-whatsnew?view=o365-worldwide) | modified | +| 8/19/2022 | [Protect security settings with tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide) | modified | +| 8/19/2022 | [Details and results of an automated investigation](/microsoft-365/security/defender/m365d-autoir-results?view=o365-worldwide) | modified | +| 8/19/2022 | [Microsoft Defender for Cloud Apps in Microsoft 365 Defender (Preview)](/microsoft-365/security/defender/microsoft-365-security-center-defender-cloud-apps?view=o365-worldwide) | modified | +| 8/19/2022 | [Manage submissions](/microsoft-365/security/office-365-security/admin-submission?view=o365-worldwide) | modified | +| 8/19/2022 | [Allow or block emails using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/allow-block-email-spoof?view=o365-worldwide) | modified | +| 8/19/2022 | [Allow or block files using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/allow-block-files?view=o365-worldwide) | modified | +| 8/19/2022 | [Allow or block URLs using the Tenant Allow/Block List](/microsoft-365/security/office-365-security/allow-block-urls?view=o365-worldwide) | modified | +| 8/19/2022 | [Configure the delivery of third-party phishing simulations to users and unfiltered messages to SecOps mailboxes](/microsoft-365/security/office-365-security/configure-advanced-delivery?view=o365-worldwide) | modified | +| 8/19/2022 | [Manage allows and blocks in the Tenant Allow/Block List](/microsoft-365/security/office-365-security/manage-tenant-allow-block-list?view=o365-worldwide) | modified | +| 8/19/2022 | Manage your allows and blocks in the Tenant Allow/Block List | removed | +| 8/19/2022 | [Manage spoofed senders using the spoof intelligence policy and spoof intelligence insight](/microsoft-365/security/office-365-security/walkthrough-spoof-intelligence-insight?view=o365-worldwide) | modified | +| 8/19/2022 | [What's new in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/whats-new-in-defender-for-office-365?view=o365-worldwide) | modified | +| 8/19/2022 | [Microsoft 365 data locations](/microsoft-365/enterprise/o365-data-locations?view=o365-worldwide) | modified | +| 8/19/2022 | [Endpoint detection and response in block mode](/microsoft-365/security/defender-endpoint/edr-in-block-mode?view=o365-worldwide) | modified | +| 8/20/2022 | [Configure and validate Microsoft Defender Antivirus network connections](/microsoft-365/security/defender-endpoint/configure-network-connections-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 8/20/2022 | [Troubleshooting and FAQ - Microsoft Defender for Endpoint on iOS](/microsoft-365/security/defender-endpoint/ios-troubleshoot?view=o365-worldwide) | added | +| 8/20/2022 | [Microsoft 365 admin center Project activity ](/microsoft-365/admin/activity-reports/project-activity?view=o365-worldwide) | added | +| 8/20/2022 | [Automatically retain or delete content by using retention policies](/microsoft-365/compliance/create-retention-policies?view=o365-worldwide) | modified | +| 8/20/2022 | [Microsoft 365 Reports in the admin center - Viva Learning activity](/microsoft-365/admin/activity-reports/viva-learning-activity?view=o365-worldwide) | added | +| 8/20/2022 | [Collect cloud attachments in Advanced eDiscovery](/microsoft-365/compliance/advanced-ediscovery-cloud-attachments?view=o365-worldwide) | added | +| 8/20/2022 | [Automatically apply a retention label to retain or delete content](/microsoft-365/compliance/apply-retention-labels-automatically?view=o365-worldwide) | modified | +| 8/20/2022 | [Learn about retention for SharePoint and OneDrive](/microsoft-365/compliance/retention-policies-sharepoint?view=o365-worldwide) | modified | +| 8/20/2022 | [Microsoft 365 usage analytics data model](/microsoft-365/admin/usage-analytics/usage-analytics-data-model?view=o365-worldwide) | modified | +| 8/20/2022 | [What's new in the Microsoft 365 admin center?](/microsoft-365/admin/whats-new-in-preview?view=o365-worldwide) | modified | +| 8/20/2022 | [Message Encryption FAQ](/microsoft-365/compliance/ome-faq?view=o365-worldwide) | modified | +| 8/20/2022 | [Microsoft Purview compliance documentation # < 60 chars](/microsoft-365/compliance/index?view=o365-worldwide) | modified | +| 8/20/2022 | [Onboard Windows 10 or Windows 11 devices into Microsoft 365 overview](/microsoft-365/compliance/device-onboarding-overview?view=o365-worldwide) | modified | +| 8/20/2022 | [Microsoft 365 Lighthouse Windows 365 (Cloud PCs) page overview](/microsoft-365/lighthouse/m365-lighthouse-win365-page-overview?view=o365-worldwide) | modified | +| 8/20/2022 | [Office TLS Certificate Changes](/microsoft-365/compliance/encryption-office-365-tls-certificates-changes?view=o365-worldwide) | modified | +| 8/20/2022 | [Implement attack surface reduction (ASR) rules deployment](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-implement?view=o365-worldwide) | modified | +| 8/20/2022 | [Operationalize attack surface reduction (ASR) rules deployment](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-operationalize?view=o365-worldwide) | modified | +| 8/20/2022 | [Plan ASR rules attack surface reduction deployment rules deployment](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-plan?view=o365-worldwide) | modified | +| 8/20/2022 | [Test attack surface reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-test?view=o365-worldwide) | modified | +| 8/20/2022 | [ASR rules deployment prerequisites](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment?view=o365-worldwide) | modified | +| 8/20/2022 | [Examples of device control policies for Intune](/microsoft-365/security/defender-endpoint/mac-device-control-intune?view=o365-worldwide) | modified | +| 8/20/2022 | [What's new in Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-whatsnew?view=o365-worldwide) | modified | +| 8/20/2022 | [Use network protection to help prevent connections to bad sites](/microsoft-365/security/defender-endpoint/network-protection?view=o365-worldwide) | modified | +| 8/20/2022 | [Anti-malware protection](/microsoft-365/security/office-365-security/anti-malware-protection?view=o365-worldwide) | modified | +| 8/20/2022 | [Configure anti-malware policies](/microsoft-365/security/office-365-security/configure-anti-malware-policies?view=o365-worldwide) | modified | +| 8/20/2022 | [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-worldwide) | modified | +| 8/20/2022 | [Microsoft 365 Zero Trust deployment plan](/microsoft-365/security/microsoft-365-zero-trust?view=o365-worldwide) | modified | +| 8/20/2022 | [Step 3. Identity for your Microsoft 365 for enterprise tenants](/microsoft-365/solutions/tenant-management-identity?view=o365-worldwide) | modified | +| 8/20/2022 | [View and organize the Microsoft Defender for Endpoint Alerts queue](/microsoft-365/security/defender-endpoint/alerts-queue?view=o365-worldwide) | modified | +| 8/20/2022 | [Onboard non-persistent virtual desktop infrastructure (VDI) devices](/microsoft-365/security/defender-endpoint/configure-endpoints-vdi?view=o365-worldwide) | modified | +| 8/20/2022 | [Get Microsoft Defender for Business](/microsoft-365/security/defender-business/get-defender-business?view=o365-worldwide) | modified | +| 8/20/2022 | [Configure alert notifications in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/configure-email-notifications?view=o365-worldwide) | modified | +| 8/20/2022 | [Configure vulnerability email notifications in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/configure-vulnerability-email-notifications?view=o365-worldwide) | modified | +| 8/20/2022 | [Microsoft Defender Vulnerability Management public preview](/microsoft-365/security/defender-vulnerability-management/get-defender-vulnerability-management?view=o365-worldwide) | modified | +| 8/20/2022 | [Configure Microsoft 365 support integration with AAD OAuth Token](/microsoft-365/admin/manage/servicenow-aad-oauth-token?view=o365-worldwide) | added | +| 8/20/2022 | [Configure support integration with ServiceNow Basic Authentication](/microsoft-365/admin/manage/servicenow-basic-authentication?view=o365-worldwide) | added | +| 8/20/2022 | [Microsoft 365 support integration with ServiceNow configuration overview](/microsoft-365/admin/manage/servicenow-overview?view=o365-worldwide) | added | +| 8/20/2022 | [Testing the ServiceNow configuration](/microsoft-365/admin/manage/servicenow-testing-the-configuration?view=o365-worldwide) | added | +| 8/20/2022 | [Troubleshooting Microsoft 365 support integration with ServiceNow](/microsoft-365/admin/manage/servicenow-troubleshooting?view=o365-worldwide) | added | +| 8/20/2022 | [About the Microsoft Compliance Manager premium assessment trial](/microsoft-365/compliance/compliance-easy-trials-compliance-manager-assessments?view=o365-worldwide) | added | +| 8/20/2022 | [Get started with Microsoft Compliance Manager](/microsoft-365/compliance/compliance-manager-setup?view=o365-worldwide) | modified | +| 8/20/2022 | [Microsoft Compliance Manager templates list](/microsoft-365/compliance/compliance-manager-templates-list?view=o365-worldwide) | modified | +| 8/20/2022 | [Working with assessment templates in Microsoft Compliance Manager](/microsoft-365/compliance/compliance-manager-templates?view=o365-worldwide) | modified | +| 8/20/2022 | [What's new in Microsoft Compliance Manager](/microsoft-365/compliance/compliance-manager-whats-new?view=o365-worldwide) | modified | +| 8/20/2022 | [Set up a connector to import Epic EHR data](/microsoft-365/compliance/import-epic-data?view=o365-worldwide) | added | +| 8/20/2022 | [Set up a connector to import generic healthcare audit data](/microsoft-365/compliance/import-healthcare-data?view=o365-worldwide) | added | +| 8/20/2022 | [Configure Microsoft Defender for Endpoint on Android features](/microsoft-365/security/defender-endpoint/android-configure?view=o365-worldwide) | modified | +| 8/20/2022 | [Preset security policies](/microsoft-365/security/office-365-security/preset-security-policies?view=o365-worldwide) | modified | +| 8/20/2022 | [Quarantined email messages](/microsoft-365/security/office-365-security/quarantine-email-messages?view=o365-worldwide) | modified | +| 8/20/2022 | [Safe Attachments](/microsoft-365/security/office-365-security/safe-attachments?view=o365-worldwide) | modified | +| 8/20/2022 | [Learn about sensitive information types](/microsoft-365/compliance/sensitive-information-type-learn-about?view=o365-worldwide) | modified | +| 8/20/2022 | [Common mistakes to avoid when defining exclusions](/microsoft-365/security/defender-endpoint/common-exclusion-mistakes-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 8/20/2022 | [Microsoft Defender Antivirus Virtual Desktop Infrastructure deployment guide](/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 8/20/2022 | [Protect your organization's data with device control](/microsoft-365/security/defender-endpoint/device-control-report?view=o365-worldwide) | modified | +| 8/20/2022 | [Request to change access level](/microsoft-365/test-base/accesslevel?view=o365-worldwide) | added | +| 8/20/2022 | [Manage Microsoft Defender Antivirus updates and apply baselines](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-worldwide) | modified | +| 8/20/2022 | [Manage auto-claim policies](/microsoft-365/commerce/licenses/manage-auto-claim-policies?view=o365-worldwide) | modified | +| 8/20/2022 | [Learn about retention policies & labels to automatically retain or delete content](/microsoft-365/compliance/retention?view=o365-worldwide) | modified | +| 8/20/2022 | [Search the audit log in the Microsoft 365 compliance center](/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide) | modified | +| 8/20/2022 | [Cross-tenant mailbox migration](/microsoft-365/enterprise/cross-tenant-mailbox-migration?view=o365-worldwide) | modified | +| 8/20/2022 | [Get help and support for Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-get-help-and-support?view=o365-worldwide) | modified | +| 8/20/2022 | [Use Advanced Audit to investigate compromised accounts](/microsoft-365/compliance/mailitemsaccessed-forensics-investigations?view=o365-worldwide) | modified | +| 8/20/2022 | [Work with communications in Advanced eDiscovery](/microsoft-365/compliance/managing-custodian-communications?view=o365-worldwide) | modified | +| 8/20/2022 | [Reports in Microsoft Defender for Business (preview)](/microsoft-365/security/defender-business/mdb-reports?view=o365-worldwide) | modified | +| 8/20/2022 | [Onboard Windows devices to Microsoft Defender for Endpoint via Group Policy](/microsoft-365/security/defender-endpoint/configure-endpoints-gp?view=o365-worldwide) | modified | +| 8/20/2022 | [Admin review for reported messages](/microsoft-365/security/office-365-security/admin-review-reported-message?view=o365-worldwide) | modified | +| 8/20/2022 | [Manage submissions](/microsoft-365/security/office-365-security/admin-submission?view=o365-worldwide) | modified | +| 8/20/2022 | [How to report false positives or false negatives following automated investigation in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/air-report-false-positives-negatives?view=o365-worldwide) | modified | +| 8/20/2022 | [Review and manage remediation actions in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/air-review-approve-pending-completed-actions?view=o365-worldwide) | modified | +| 8/20/2022 | [Configure anti-phishing policies in EOP](/microsoft-365/security/office-365-security/configure-anti-phishing-policies-eop?view=o365-worldwide) | modified | +| 8/20/2022 | [Configure global settings for Safe Links settings in Defender for Office 365](/microsoft-365/security/office-365-security/configure-global-settings-for-safe-links?view=o365-worldwide) | modified | +| 8/20/2022 | [Configure anti-phishing policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/configure-mdo-anti-phishing-policies?view=o365-worldwide) | modified | +| 8/20/2022 | [Configure outbound spam filtering](/microsoft-365/security/office-365-security/configure-the-outbound-spam-policy?view=o365-worldwide) | modified | +| 8/20/2022 | [Configure spam filter policies](/microsoft-365/security/office-365-security/configure-your-spam-filter-policies?view=o365-worldwide) | modified | +| 8/20/2022 | [Email security with Threat Explorer in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/email-security-in-microsoft-defender?view=o365-worldwide) | modified | +| 8/20/2022 | [Investigate malicious email that was delivered in Microsoft 365, Find and investigate malicious email](/microsoft-365/security/office-365-security/investigate-malicious-email-that-was-delivered?view=o365-worldwide) | modified | +| 8/20/2022 | [Threat investigation & response capabilities - Microsoft Defender for Office 365 Plan 2](/microsoft-365/security/office-365-security/office-365-ti?view=o365-worldwide) | modified | +| 8/20/2022 | [Permissions in the Microsoft 365 Defender portal](/microsoft-365/security/office-365-security/permissions-microsoft-365-security-center?view=o365-worldwide) | modified | +| 8/20/2022 | [Responding to a Compromised Email Account](/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-worldwide) | modified | +| 8/20/2022 | [Set up Safe Attachments policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/set-up-safe-attachments-policies?view=o365-worldwide) | modified | +| 8/20/2022 | [Set up Safe Links policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/set-up-safe-links-policies?view=o365-worldwide) | modified | +| 8/20/2022 | [How to use DKIM for email in your custom domain](/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email?view=o365-worldwide) | modified | +| 8/20/2022 | [Use Azure Privileged Identity Management (PIM) in Microsoft Defender for Office 365 to limit admin access to cyber security tools.](/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365?view=o365-worldwide) | modified | +| 8/20/2022 | [User tags in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/user-tags?view=o365-worldwide) | modified | +| 8/20/2022 | [View Defender for Office 365 reports](/microsoft-365/security/office-365-security/view-reports-for-mdo?view=o365-worldwide) | modified | ++ ## Week of August 08, 2022 | 7/21/2022 | [Create notifications for exact data match activities](/microsoft-365/compliance/sit-edm-notifications-activities?view=o365-21vianet) | modified | | 7/22/2022 | [Apply encryption using sensitivity labels](/microsoft-365/compliance/encryption-sensitivity-labels?view=o365-21vianet) | modified | | 7/22/2022 | [Onboard devices without Internet access to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboard-offline-machines?view=o365-21vianet) | modified |---## Week of July 11, 2022 ---| Published On |Topic title | Change | -|||--| -| 7/11/2022 | [Understand the proposal workflow](/microsoft-365/commerce/understand-proposal-workflow?view=o365-21vianet) | modified | -| 7/11/2022 | [Investigate and remediate communication compliance alerts](/microsoft-365/compliance/communication-compliance-investigate-remediate?view=o365-21vianet) | modified | -| 7/11/2022 | [Overview of the eDiscovery (Premium) solution in Microsoft Purview](/microsoft-365/compliance/overview-ediscovery-20?view=o365-21vianet) | modified | -| 7/11/2022 | [Learn about retention for Teams](/microsoft-365/compliance/retention-policies-teams?view=o365-21vianet) | modified | -| 7/11/2022 | Overview of Microsoft Defender Security Center | removed | -| 7/11/2022 | [Trial playbook - Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/defender-endpoint-trial-playbook?view=o365-21vianet) | added | -| 7/11/2022 | [Export incidents queue to CSV files](/microsoft-365/security/defender/export-incidents-queue?view=o365-21vianet) | added | -| 7/11/2022 | [Microsoft Defender for Identity in Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-security-center-mdi?view=o365-21vianet) | added | -| 7/11/2022 | [Report spam, non-spam, phishing, and suspicious emails to Microsoft](/microsoft-365/security/office-365-security/report-junk-email-messages-to-microsoft?view=o365-21vianet) | modified | -| 7/11/2022 | [Enable block at first sight to detect malware in seconds](/microsoft-365/security/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus?view=o365-21vianet) | modified | -| 7/11/2022 | [Evaluate Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/evaluate-microsoft-defender-antivirus?view=o365-21vianet) | modified | -| 7/11/2022 | [Overview of next-generation protection in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/next-generation-protection?view=o365-21vianet) | modified | -| 7/11/2022 | [Onboard previous versions of Windows on Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboard-downlevel?view=o365-21vianet) | modified | -| 7/11/2022 | [Switch to Microsoft Defender for Endpoint - Onboard](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-3?view=o365-21vianet) | modified | -| 7/11/2022 | [What's new in Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score-whats-new?view=o365-21vianet) | modified | -| 7/11/2022 | [Manage GDPR data subject requests in Microsoft Whiteboard](/microsoft-365/whiteboard/gdpr-requests?view=o365-21vianet) | modified | -| 7/11/2022 | [Compare Microsoft Defender for Endpoint plans](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2?view=o365-21vianet) | modified | -| 7/11/2022 | [Microsoft Defender Antivirus in Windows](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows?view=o365-21vianet) | modified | -| 7/12/2022 | [Learn how to mitigate the Log4Shell vulnerability in Microsoft Defender for Endpoint - threat and vulnerability management](/microsoft-365/security/defender-vulnerability-management/tvm-manage-log4shell-guidance?view=o365-21vianet) | renamed | -| 7/12/2022 | [Microsoft 365 feature descriptions](/microsoft-365/admin/m365-feature-descriptions?view=o365-21vianet) | modified | -| 7/12/2022 | [Unassign licenses from users](/microsoft-365/admin/manage/remove-licenses-from-users?view=o365-21vianet) | modified | -| 7/12/2022 | [Block potentially unwanted applications with Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus?view=o365-21vianet) | modified | -| 7/12/2022 | [Microsoft Defender Antivirus compatibility with other security products](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility?view=o365-21vianet) | modified | -| 7/12/2022 | [Understand and use attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction?view=o365-21vianet) | modified | -| 7/12/2022 | [Microsoft 365 Health Dashboard](/microsoft-365/admin/manage/health-dashboard-overview?view=o365-21vianet) | added | -| 7/12/2022 | Admin training video library # < 60 chars | removed | -| 7/12/2022 | [What's new in Microsoft Purview risk and compliance solutions](/microsoft-365/compliance/whats-new?view=o365-21vianet) | modified | -| 7/12/2022 | [Microsoft Threat Experts](/microsoft-365/security/defender-endpoint/microsoft-threat-experts?view=o365-21vianet) | modified | -| 7/12/2022 | [Microsoft Threat Experts in Microsoft 365 Defender overview](/microsoft-365/security/defender/microsoft-threat-experts?view=o365-21vianet) | modified | -| 7/12/2022 | [Spoof intelligence insight](/microsoft-365/security/office-365-security/learn-about-spoof-intelligence?view=o365-21vianet) | modified | -| 7/13/2022 | [Get Microsoft Defender for Business servers](/microsoft-365/security/defender-business/get-defender-business-servers?view=o365-21vianet) | added | -| 7/13/2022 | [Microsoft Defender for Business preview features](/microsoft-365/security/defender-business/mdb-preview?view=o365-21vianet) | added | -| 7/13/2022 | [Onboard your organization's devices to Microsoft Defender for Business](/microsoft-365/business-premium/m365bp-onboard-devices-mdb?view=o365-21vianet) | modified | -| 7/13/2022 | [Decryption in eDiscovery](/microsoft-365/compliance/ediscovery-decryption?view=o365-21vianet) | modified | -| 7/13/2022 | [Compare security features in Microsoft 365 plans for small and medium-sized businesses](/microsoft-365/security/defender-business/compare-mdb-m365-plans?view=o365-21vianet) | modified | -| 7/13/2022 | [Get Microsoft Defender for Business](/microsoft-365/security/defender-business/get-defender-business?view=o365-21vianet) | modified | -| 7/13/2022 | [View and edit your security settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-configure-security-settings?view=o365-21vianet) | modified | -| 7/13/2022 | [Device groups in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-create-edit-device-groups?view=o365-21vianet) | modified | -| 7/13/2022 | [Microsoft Defender for Business frequently asked questions](/microsoft-365/security/defender-business/mdb-faq?view=o365-21vianet) | modified | -| 7/13/2022 | [Firewall in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-firewall?view=o365-21vianet) | modified | -| 7/13/2022 | [Visit the Microsoft 365 Defender portal](/microsoft-365/security/defender-business/mdb-get-started?view=o365-21vianet) | modified | -| 7/13/2022 | [Manage devices in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-manage-devices?view=o365-21vianet) | modified | -| 7/13/2022 | [Understand next-generation protection configuration settings in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-next-gen-configuration-settings?view=o365-21vianet) | modified | -| 7/13/2022 | [Onboard devices to Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-onboard-devices?view=o365-21vianet) | modified | -| 7/13/2022 | [What is Microsoft Defender for Business?](/microsoft-365/security/defender-business/mdb-overview?view=o365-21vianet) | modified | -| 7/13/2022 | [Microsoft Defender for Business and Microsoft partner resources](/microsoft-365/security/defender-business/mdb-partners?view=o365-21vianet) | modified | -| 7/13/2022 | [Reports in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-reports?view=o365-21vianet) | modified | -| 7/13/2022 | [Requirements for Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-requirements?view=o365-21vianet) | modified | -| 7/13/2022 | [Review remediation actions in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-review-remediation-actions?view=o365-21vianet) | modified | -| 7/13/2022 | [Assign roles and permissions in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-roles-permissions?view=o365-21vianet) | modified | -| 7/13/2022 | [Set up and configure Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-setup-configuration?view=o365-21vianet) | modified | -| 7/13/2022 | [The simplified configuration process in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-simplified-configuration?view=o365-21vianet) | modified | -| 7/13/2022 | [Microsoft Defender for Business troubleshooting](/microsoft-365/security/defender-business/mdb-troubleshooting?view=o365-21vianet) | modified | -| 7/13/2022 | [Tutorials and simulations in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-tutorials?view=o365-21vianet) | modified | -| 7/13/2022 | [Use setup wizard in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-use-wizard?view=o365-21vianet) | modified | -| 7/13/2022 | [View or edit policies in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-view-edit-create-policies?view=o365-21vianet) | modified | -| 7/13/2022 | [View and manage incidents in Microsoft Defender for Business](/microsoft-365/security/defender-business/mdb-view-manage-incidents?view=o365-21vianet) | modified | -| 7/13/2022 | [Microsoft Defender for Business trial playbook](/microsoft-365/security/defender-business/trial-playbook-defender-business?view=o365-21vianet) | modified | -| 7/13/2022 | [Configure and manage Microsoft Threat Experts capabilities](/microsoft-365/security/defender-endpoint/configure-microsoft-threat-experts?view=o365-21vianet) | modified | -| 7/13/2022 | [Configure and manage Microsoft Threat Experts capabilities through Microsoft 365 Defender](/microsoft-365/security/defender/configure-microsoft-threat-experts?view=o365-21vianet) | modified | -| 7/13/2022 | [Configure global settings for Safe Links settings in Defender for Office 365](/microsoft-365/security/office-365-security/configure-global-settings-for-safe-links?view=o365-21vianet) | modified | -| 7/13/2022 | [Migrate to Microsoft Defender for Office 365 Phase 2: Setup](/microsoft-365/security/office-365-security/migrate-to-defender-for-office-365-setup?view=o365-21vianet) | modified | -| 7/13/2022 | [Protect against threats in Microsoft Defender for Office 365, Anti-malware, Anti-Phishing, Anti-spam, Safe links, Safe attachments, Zero-hour auto purge (ZAP), MDO security configuration](/microsoft-365/security/office-365-security/protect-against-threats?view=o365-21vianet) | modified | -| 7/13/2022 | [Complete Safe Links overview for Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/safe-links?view=o365-21vianet) | modified | -| 7/13/2022 | [Set up Safe Links policies in Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/set-up-safe-links-policies?view=o365-21vianet) | modified | -| 7/13/2022 | [Learn about communication compliance](/microsoft-365/compliance/communication-compliance?view=o365-21vianet) | modified | -| 7/13/2022 | Secure Windows 10 computers | removed | -| 7/13/2022 | [Paying for your subscription](/microsoft-365/commerce/billing-and-payments/pay-for-your-subscription?view=o365-21vianet) | modified | -| 7/13/2022 | Microsoft 365 Security for Business Decision Makers (BDMs) | removed | -| 7/13/2022 | [Understand and use attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction?view=o365-21vianet) | modified | -| 7/13/2022 | [Microsoft recommendations for EOP and Defender for Office 365 security settings](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-21vianet) | modified | -| 7/14/2022 | [Microsoft Defender for Business frequently asked questions](/microsoft-365/security/defender-business/mdb-faq?view=o365-21vianet) | modified | -| 7/14/2022 | [Compare Microsoft Defender for Endpoint plans](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2?view=o365-21vianet) | modified | -| 7/14/2022 | [Enable the Report Message or the Report Phishing add-ins](/microsoft-365/security/office-365-security/enable-the-report-message-add-in?view=o365-21vianet) | modified | -| 7/14/2022 | [Assess the impact of security configuration changes with Explorer](/microsoft-365/security/office-365-security/step-by-step-guides/assess-the-impact-of-security-configuration-changes-with-explorer?view=o365-21vianet) | added | -| 7/14/2022 | [Deploy and configure the report message add-in](/microsoft-365/security/office-365-security/step-by-step-guides/deploy-and-configure-the-report-message-add-in?view=o365-21vianet) | added | -| 7/14/2022 | [What's new in Microsoft Defender for Endpoint on Mac](/microsoft-365/security/defender-endpoint/mac-whatsnew?view=o365-21vianet) | modified | -| 7/14/2022 | [How to enable DMARC Reporting for Microsoft Online Email Routing Address (MOERA) and parked Domains](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-enable-dmarc-reporting-for-microsoft-online-email-routing-address-moera-and-parked-domains?view=o365-21vianet) | renamed | -| 7/15/2022 | [Enable pay-as-you-go for your subscription in the Microsoft 365 admin center](/microsoft-365/commerce/subscriptions/manage-pay-as-you-go-services?view=o365-21vianet) | added | -| 7/15/2022 | [Block user sign-in in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-block-user-signin?view=o365-21vianet) | modified | -| 7/15/2022 | [Manage self-service password reset in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-manage-sspr?view=o365-21vianet) | modified | -| 7/15/2022 | [Mitigate threats in Microsoft 365 Lighthouse with Microsoft Defender Antivirus](/microsoft-365/lighthouse/m365-lighthouse-mitigate-threats?view=o365-21vianet) | modified | -| 7/15/2022 | [Reset a user password in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-reset-user-password?view=o365-21vianet) | modified | -| 7/15/2022 | [View and manage risky users in Microsoft 365 Lighthouse](/microsoft-365/lighthouse/m365-lighthouse-view-manage-risky-users?view=o365-21vianet) | modified | -| 7/15/2022 | [Set up and configure the Moodle plugin](/microsoft-365/lti/moodle-plugin-configuration?view=o365-21vianet) | modified | -| 7/15/2022 | [Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](/microsoft-365/security/defender-endpoint/android-intune?view=o365-21vianet) | modified | -| 7/15/2022 | [Investigate data loss incidents with Microsoft 365 Defender](/microsoft-365/security/defender/investigate-dlp?view=o365-21vianet) | modified | -| 7/15/2022 | [Virtual appointments with Microsoft Teams and the Bookings app](/microsoft-365/frontline/bookings-virtual-visits?view=o365-21vianet) | added | -| 7/15/2022 | [Manage the join experience for Teams virtual appointments on browsers](/microsoft-365/frontline/browser-join?view=o365-21vianet) | added | -| 7/15/2022 | [Deploy teams at scale for frontline workers in Microsoft Teams](/microsoft-365/frontline/deploy-teams-at-scale?view=o365-21vianet) | added | -| 7/15/2022 | [Virtual appointments with Teams - Integration into Cerner EHR](/microsoft-365/frontline/ehr-admin-cerner?view=o365-21vianet) | added | -| 7/15/2022 | [Virtual appointments with Teams - Integration into Epic EHR](/microsoft-365/frontline/ehr-admin-epic?view=o365-21vianet) | added | -| 7/15/2022 | [Microsoft Teams EHR connector Virtual Appointments report](/microsoft-365/frontline/ehr-connector-report?view=o365-21vianet) | added | -| 7/15/2022 | [Choose your scenarios for Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-choose-scenarios?view=o365-21vianet) | added | -| 7/15/2022 | [Corporate communications with frontline workers](/microsoft-365/frontline/flw-corp-comms?view=o365-21vianet) | added | -| 7/15/2022 | [Learn where to start with a frontline deployment](/microsoft-365/frontline/flw-deploy-overview?view=o365-21vianet) | added | -| 7/15/2022 | [Manage mobile devices for frontline workers](/microsoft-365/frontline/flw-devices?view=o365-21vianet) | added | -| 7/15/2022 | [Understand frontline worker user types and licensing](/microsoft-365/frontline/flw-licensing-options?view=o365-21vianet) | added | -| 7/15/2022 | [Provide initial and ongoing training to help onboard your frontline workers](/microsoft-365/frontline/flw-onboarding-training?view=o365-21vianet) | added | -| 7/15/2022 | [Use the Frontline Worker onboarding wizard to get your frontline workforce up and running](/microsoft-365/frontline/flw-onboarding-wizard?view=o365-21vianet) | added | -| 7/15/2022 | [Get started with Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-overview?view=o365-21vianet) | added | -| 7/15/2022 | [Start with a pilot deployment of Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-pilot?view=o365-21vianet) | added | -| 7/15/2022 | [Set up Microsoft 365 for frontline workers](/microsoft-365/frontline/flw-setup-microsoft-365?view=o365-21vianet) | added | -| 7/15/2022 | [Frontline team collaboration](/microsoft-365/frontline/flw-team-collaboration?view=o365-21vianet) | added | -| 7/15/2022 | [Manage the Frontline Trial in Teams](/microsoft-365/frontline/flw-trial?view=o365-21vianet) | added | -| 7/15/2022 | [Engage your frontline employees and focus on wellbeing](/microsoft-365/frontline/flw-wellbeing-engagement?view=o365-21vianet) | added | -| 7/15/2022 | [Managers - Get your team started with Microsoft 365 for frontline workers](/microsoft-365/frontline/get-up-and-running?view=o365-21vianet) | added | -| 7/15/2022 | [Message delegation](/microsoft-365/frontline/hc-delegates?view=o365-21vianet) | added | -| 7/15/2022 | [Manage shift-based access for frontline workers in Teams](/microsoft-365/frontline/manage-shift-based-access-flw?view=o365-21vianet) | added | -| 7/15/2022 | [Secure Messaging for healthcare organizations using Microsoft Teams](/microsoft-365/frontline/messaging-policies-hc?view=o365-21vianet) | added | -| 7/15/2022 | [Tailor Teams apps for your frontline workers](/microsoft-365/frontline/pin-teams-apps-based-on-license?view=o365-21vianet) | added | -| 7/15/2022 | [Manage schedule owners for shift management](/microsoft-365/frontline/schedule-owner-for-shift-management?view=o365-21vianet) | added | -| 7/15/2022 | [Use PowerShell to connect Shifts to Blue Yonder Workforce Management](/microsoft-365/frontline/shifts-connector-blue-yonder-powershell-setup?view=o365-21vianet) | added | -| 7/15/2022 | [Use PowerShell to manage your Shifts connection to Blue Yonder Workforce Management](/microsoft-365/frontline/shifts-connector-powershell-manage?view=o365-21vianet) | added | -| 7/15/2022 | [Use the Shifts connector wizard to connect Shifts to Blue Yonder Workforce Management](/microsoft-365/frontline/shifts-connector-wizard?view=o365-21vianet) | added | -| 7/15/2022 | [Shifts connectors](/microsoft-365/frontline/shifts-connectors?view=o365-21vianet) | added | -| 7/15/2022 | [Shifts for frontline workers](/microsoft-365/frontline/shifts-for-teams-landing-page?view=o365-21vianet) | added | -| 7/15/2022 | [Simplify business processes for frontline teams](/microsoft-365/frontline/simplify-business-processes?view=o365-21vianet) | added | -| 7/15/2022 | [Changing from a Microsoft 365 E plan to a Microsoft F plan](/microsoft-365/frontline/switch-from-enterprise-to-frontline?view=o365-21vianet) | added | -| 7/15/2022 | [Microsoft 365 for Financial Services](/microsoft-365/frontline/teams-for-financial-services?view=o365-21vianet) | added | -| 7/15/2022 | [Microsoft 365 for Manufacturing](/microsoft-365/frontline/teams-for-manufacturing?view=o365-21vianet) | added | -| 7/15/2022 | [Microsoft 365 for Retail](/microsoft-365/frontline/teams-for-retail-landing-page?view=o365-21vianet) | added | -| 7/15/2022 | [Get started with Microsoft 365 for healthcare organizations](/microsoft-365/frontline/teams-in-hc?view=o365-21vianet) | added | -| 7/15/2022 | [Help your clients and customers use virtual appointments](/microsoft-365/frontline/virtual-appointments-toolkit?view=o365-21vianet) | added | -| 7/15/2022 | [Virtual appointments with Microsoft Teams](/microsoft-365/frontline/virtual-appointments?view=o365-21vianet) | added | -| 7/15/2022 | [Microsoft Teams Virtual Visits usage report](/microsoft-365/frontline/virtual-visits-usage-report?view=o365-21vianet) | added | -| 7/15/2022 | [Set up and configure the Moodle LMS plugins](/microsoft-365/lti/moodle-plugin-configuration?view=o365-21vianet) | modified | -| 7/15/2022 | [Onboard non-persistent virtual desktop infrastructure (VDI) devices](/microsoft-365/security/defender-endpoint/configure-endpoints-vdi?view=o365-21vianet) | modified | -| 7/15/2022 | [Onboard devices without Internet access to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboard-offline-machines?view=o365-21vianet) | modified | |
| security | Enable Network Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/enable-network-protection.md | Last updated [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:**+ - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) - Microsoft Defender Antivirus **Platforms**+ - Windows+- Linux \(See [Network protection for Linux](network-protection-linux.md)\) +- macOS \(See [Network protection for macOS](network-protection-macos.md)\) > [!TIP] > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-assignaccess-abovefoldlink) Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](/windows/ [Update Microsoft Defender antimalware platform to the latest version](https://support.microsoft.com/topic/update-for-microsoft-defender-antimalware-platform-92e21611-8cf1-8e0e-56d6-561a07d144cc) before you enable or disable network protection or enable audit mode. - ### Microsoft Endpoint Manager #### Microsoft Defender for Endpoint Baseline method Use the following procedure to enable network protection on domain-joined comput - **Block** - **Audit** - **Disabled**- -6. Complete the rest of the steps, and save the policy. -7. From the ribbon, select **Deploy** to deploy the policy to a collection. +6. Complete the rest of the steps, and save the policy. +7. From the ribbon, select **Deploy** to deploy the policy to a collection. > [!IMPORTANT] > Once you deploy an Exploit Guard policy from Configuration Manager, the Exploit Guard settings will not be removed from the clients if you remove the deployment. `Delete not supported` is recorded in the Configuration Manager client's ExploitGuardHandler.log if you remove the client's Exploit Guard deployment. <!--CMADO8538577--> Use the following procedure to enable network protection on domain-joined comput - [Network protection](network-protection.md) +- [Network protection for Linux](network-protection-linux.md) ++- [Network protection for macOS](network-protection-macos.md) + - [Network protection and the TCP three-way handshake](network-protection.md#network-protection-and-the-tcp-three-way-handshake) - [Evaluate network protection](evaluate-network-protection.md) |
| security | Get Assessment Methods Properties | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-assessment-methods-properties.md | SecurityUpdateAvailable|Boolean|Indicates whether a security update is available SoftwareName|String|Name of the software product. SoftwareVendor|String|Name of the software vendor. SoftwareVersion|String|Version number of the software product.-VulnerabilitySeverityLevel|String|Severity level that is assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape. +VulnerabilitySeverityLevel|String|Severity level that is assigned to the security vulnerability based on the CVSS score. ### 3.3 Properties (via files) SoftwareName|String|Name of the software product. SoftwareVendor|String|Name of the software vendor. SoftwareVersion|String|Version number of the software product. Status|String|**New** (for a new vulnerability introduced on a device). **Fixed** (for a vulnerability that doesn't exist anymore on the device, which means it was remediated). **Updated** (for a vulnerability on a device that has changed. The possible changes are: CVSS score, exploitability level, severity level, DiskPaths, RegistryPaths, RecommendedSecurityUpdate).-VulnerabilitySeverityLevel|String|Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape. +VulnerabilitySeverityLevel|String|Severity level assigned to the security vulnerability based on the CVSS score. ## 4. Export non product code software inventory assessment |
| security | Get Assessment Software Vulnerabilities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/get-assessment-software-vulnerabilities.md | SecurityUpdateAvailable|Boolean|Indicates whether a security update is available SoftwareName|String|Name of the software product.|Chrome SoftwareVendor|String|Name of the software vendor.|Google SoftwareVersion|String|Version number of the software product.|81.0.4044.138-VulnerabilitySeverityLevel|String|Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape.|Medium +VulnerabilitySeverityLevel|String|Severity level assigned to the security vulnerability based on the CVSS score.|Medium | ### 1.6 Examples SoftwareName|String|Name of the software product.|Chrome SoftwareVendor|String|Name of the software vendor.|Google SoftwareVersion|String|Version number of the software product.|81.0.4044.138 Status|String|**New** (for a new vulnerability introduced on a device) (1) **Fixed** (if this vulnerability doesn't exist anymore on the device, which means it was remediated). (2) **Updated** (if a vulnerability on a device has changed. The possible changes are: CVSS score, exploitability level, severity level, DiskPaths, RegistryPaths, RecommendedSecurityUpdate). |Fixed-VulnerabilitySeverityLevel|String|Severity level that is assigned to the security vulnerability. It's based on the CVSS score and dynamic factors influenced by the threat landscape.|Medium +VulnerabilitySeverityLevel|String|Severity level that is assigned to the security vulnerability. It's based on the CVSS score.|Medium | #### Clarifications |
| security | Web Threat Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/web-threat-protection.md | ms.pagetype: security ms.localizationpriority: medium Last updated : 08/22/2022 audience: ITPro ms.technology: mde Web threat protection is part of [Web protection](web-protection-overview.md) in Defender for Endpoint. It uses [network protection](network-protection.md) to secure your devices against web threats. By integrating with Microsoft Edge and popular third-party browsers like Chrome and Firefox, web threat protection stops web threats without a web proxy and can protect devices while they are away or on premises. Web threat protection stops access to phishing sites, malware vectors, exploit sites, untrusted or low-reputation sites, as well as sites that you have blocked in your [custom indicator list](manage-indicators.md). > [!NOTE]-> It can take up to an hour for devices to receive new custom indicators. +> It might take up to two hours for devices to receive new custom indicators. ## Prerequisites |
| security | Advanced Hunting Modes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-modes.md | + + Title: Choose between guided and advanced modes for hunting in Microsoft 365 Defender +description: Guided hunting in Microsoft 365 Defender does not require KQL knowledge while advanced hunting allows you to write a query from scratch. +keywords: guided mode, advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, schema, kusto +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +++ms.localizationpriority: medium ++audience: ITPro ++ - M365-security-compliance + - m365initiative-m365-defender +++ms.technology: m365d +++# Choose between guided and advanced modes to hunt in Microsoft 365 Defender ++++**Applies to:** +- Microsoft 365 Defender ++You can find the **advanced hunting** page by going to the left navigation bar in Microsoft 365 Defender and selecting **Hunting** > **Advanced hunting**. If the navigation bar is collapsed, select the hunting icon . ++In the **advanced hunting** page, two modes are supported: +- **Guided mode** ΓÇô to query using the query builder +- **Advanced mode** ΓÇô to query using the query editor using Kusto Query Language (KQL) ++The main difference between the two modes is that the guided mode *does not* require the hunter to know KQL to query the database, while advanced mode requires KQL knowledge. ++Guided mode features a query builder that has an easy-to-use, visual, building-block style of constructing queries through dropdown menus containing available filters and conditions. To use guided mode, see [Get started with guided hunting mode](advanced-hunting-modes.md#get-started-with-guided-hunting-mode). ++Advanced mode features a query editor area where users can create queries from scratch. To use advanced mode, see [Get started with advanced hunting mode](advanced-hunting-modes.md#get-started-with-advanced-hunting-mode). ++## Get started with guided hunting mode ++> [!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ++When you open the advanced hunting page for the first time after guided hunting is made available to you, you are invited to take the tour to learn more about the different parts of the page like the tabs and query areas. ++To take the tour, select **Take tour** when this banner appears: +++[  ](../../media/guided-hunting/1-guided-hunting-banner.png#lightbox) ++Follow the blue teaching bubbles that appear throughout the page and select **Next** to move from one step to the next. ++You can take the tour again at any time by going to **Help resources** > **Learn more** and selecting **Take the tour**. ++ +++You can then start building your query to hunt for threats. The following articles can help you get the most out of hunting in guided mode: +++| Learning goal | Description | Resource | +|--|--|--| +| **Craft your first query** | Learn the basics of the query builder like specifying the data domain and adding conditions and filters to help you create a meaningful query. Learn further by running sample queries. | [Build hunting queries using guided mode](advanced-hunting-query-builder.md) | +| **Learn the different query builder capabilities** | Get to know the different supported data types and guided mode capabilities to help you fine-tune your query according to your needs. | [Refine your query in guided mode](advanced-hunting-query-builder-details.md) | +| **Learn what you can do with query results** | Get familiar with the Results view and what you can do with generated results like how to take action on them or link them to an incident. | - [Work with query results in guided mode](advanced-hunting-query-builder-results.md)<br /> - [Take action on query results](advanced-hunting-take-action.md) <br /> - [Link query results to an incident](advanced-hunting-link-to-incident.md) | +| **Create custom detection rules** | Understand how you can use advanced hunting queries to trigger alerts and take response actions automatically. | - [Custom detections overview](custom-detections-overview.md) <br />- [Custom detection rules](custom-detection-rules.md) | ++## Get started with advanced hunting mode +We recommend going through these steps to quickly get started with advanced hunting: ++| Learning goal | Description | Resource | +|--|--|--| +| **Learn the language** | Advanced hunting is based on [Kusto query language](/azure/kusto/query/), supporting the same syntax and operators. Start learning the query language by running your first query. | [Query language overview](advanced-hunting-query-language.md) | +| **Learn how to use the query results** | Learn about charts and various ways you can view or export your results. Explore how you can quickly tweak queries, drill down to get richer information, and take response actions. | - [Work with query results in advanced mode](advanced-hunting-query-results.md)<br /> - [Take action on query results](advanced-hunting-take-action.md) <br /> - [Link query results to an incident](advanced-hunting-link-to-incident.md) | +| **Understand the schema** | Get a good, high-level understanding of the tables in the schema and their columns. Learn where to look for data when constructing your queries. | - [Schema reference](advanced-hunting-schema-tables.md) <br />- [Transition from Microsoft Defender for Endpoint](advanced-hunting-migrate-from-mde.md) | +| **Get expert tips and examples** | Train for free with guides from Microsoft experts. Explore collections of predefined queries covering different threat hunting scenarios. | - [Get expert training](advanced-hunting-expert-training.md) <br />- [Use shared queries](advanced-hunting-shared-queries.md) <br />- [Go hunt](advanced-hunting-go-hunt.md) <br />- [Hunt for threats across devices, emails, apps, and identities](advanced-hunting-query-emails-devices.md) | +| **Optimize queries and handle errors** | Understand how to create efficient and error-free queries. | - [Query best practices](advanced-hunting-best-practices.md)<br />- [Handle errors](advanced-hunting-errors.md) | +| **Create custom detection rules** | Understand how you can use advanced hunting queries to trigger alerts and take response actions automatically. | - [Custom detections overview](custom-detections-overview.md) <br />- [Custom detection rules](custom-detection-rules.md)| ++## See also +- [Understand the schema](advanced-hunting-schema-tables.md) +- [Build hunting queries using guided mode](advanced-hunting-query-builder.md) +- [Learn the query language](advanced-hunting-query-language.md) |
| security | Advanced Hunting Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-overview.md | ms.technology: m365d - Microsoft 365 Defender Advanced hunting is a query-based threat hunting tool that lets you explore up to 30 days of raw data. You can proactively inspect events in your network to locate threat indicators and entities. The flexible access to data enables unconstrained hunting for both known and potential threats.++Advanced hunting supports two modes, guided and advanced. Use [guided mode](advanced-hunting-query-builder.md) if you are not yet familiar with Kusto Query Language (KQL) or prefer the convenience of a query builder. Use [advanced mode](advanced-hunting-query-language.md) if you are comfortable using KQL to create queries from scratch. ++**To start hunting, read [Choose between guided and advanced modes to hunt in Microsoft 365 Defender](advanced-hunting-modes.md).** <br><br> > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4G6DO] You can use the same threat hunting queries to build custom detection rules. These rules run automatically to check for and then respond to suspected breach activity, misconfigured machines, and other findings. -This capability is similar to [advanced hunting in Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview) and supports queries that check a broader data set from: +This capability is similar to [advanced hunting in Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview) and supports queries that check a broader data set coming from: - Microsoft Defender for Endpoint - Microsoft Defender for Office 365 To use advanced hunting, [turn on Microsoft 365 Defender](m365d-enable.md). For more information on advanced hunting in Microsoft Defender for Cloud Apps data, see the [video](https://www.microsoft.com/en-us/videoplayer/embed/RWFISa). -## Get started with advanced hunting --We recommend going through several steps to quickly get started with advanced hunting. -| Learning goal | Description | Resource | -|--|--|--| -| **Learn the language** | Advanced hunting is based on [Kusto query language](/azure/kusto/query/), supporting the same syntax and operators. Start learning the query language by running your first query. | [Query language overview](advanced-hunting-query-language.md) | -| **Learn how to use the query results** | Learn about charts and various ways you can view or export your results. Explore how you can quickly tweak queries, drill down to get richer information, and take response actions. | - [Work with query results](advanced-hunting-query-results.md)<br /> - [Take action on query results](advanced-hunting-take-action.md) | -| **Understand the schema** | Get a good, high-level understanding of the tables in the schema and their columns. Learn where to look for data when constructing your queries. | - [Schema reference](advanced-hunting-schema-tables.md) <br />- [Transition from Microsoft Defender for Endpoint](advanced-hunting-migrate-from-mde.md) | -| **Get expert tips and examples** | Train for free with guides from Microsoft experts. Explore collections of predefined queries covering different threat hunting scenarios. | - [Get expert training](advanced-hunting-expert-training.md) <br />- [Use shared queries](advanced-hunting-shared-queries.md) <br />- [Go hunt](advanced-hunting-go-hunt.md) <br />- [Hunt for threats across devices, emails, apps, and identities](advanced-hunting-query-emails-devices.md) | -| **Optimize queries and handle errors** | Understand how to create efficient and error-free queries. | - [Query best practices](advanced-hunting-best-practices.md)<br />- [Handle errors](advanced-hunting-errors.md) | -| **Create custom detection rules** | Understand how you can use advanced hunting queries to trigger alerts and take response actions automatically. | - [Custom detections overview](custom-detections-overview.md) <br />- [Custom detection rules](custom-detection-rules.md) | ## Get access To use advanced hunting or other [Microsoft 365 Defender](microsoft-365-defender.md) capabilities, you need an appropriate role in Azure Active Directory. [Read about required roles and permissions for advanced hunting](custom-roles.md). Advanced hunting data can be categorized into two distinct types, each consolida - **Entity data**ΓÇöpopulates tables with information about users and devices. This data comes from both relatively static data sources and dynamic sources, such as Active Directory entries and event logs. To provide fresh data, tables are updated with any new information every 15 minutes, adding rows that might not be fully populated. Every 24 hours, data is consolidated to insert a record that contains the latest, most comprehensive data set about each entity. ## Time zone-Time information in advanced hunting is in the UTC time zone. +Time information in advanced hunting is in the UTC (Universal Time Coordinated) time zone. ## Related topics+- [Choose between guided and advanced hunting modes](advanced-hunting-modes.md) +- [Build hunting queries using guided mode](advanced-hunting-query-builder.md) - [Learn the query language](advanced-hunting-query-language.md)-- [Get expert training](advanced-hunting-expert-training.md)-- [Use shared queries](advanced-hunting-shared-queries.md) - [Understand the schema](advanced-hunting-schema-tables.md)-- [Apply query best practices](advanced-hunting-best-practices.md) - [Custom detections overview](custom-detections-overview.md) |
| security | Advanced Hunting Query Builder Details | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-query-builder-details.md | + + Title: Supported data types and filters in guided mode for hunting in Microsoft 365 Defender +description: Refine your query by using the different guided mode capabilities in advanced hunting in Microsoft 365 Defender. +keywords: guided mode, advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, schema, kusto +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +++ms.localizationpriority: medium ++audience: ITPro ++ - M365-security-compliance + - m365initiative-m365-defender ++ms.technology: m365d +++# Refine your query in guided mode ++++**Applies to:** +- Microsoft 365 Defender ++> [!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +## Use different data types ++Advanced hunting in guided mode supports several data types that you can use to fine-tune your query. ++- Numbers<br> + ++- Strings<br> + ++ In the free text box, type the value and press **Enter** to add it. Note that the delimiter between values is **Enter**.<br> ++  ++- Boolean<br> + +++- Datetime<br> + +++- Closed list - You donΓÇÖt need to remember the exact value you are looking for. You can easily choose from a suggested closed list that supports multi-selection.<br> + +++## Use subgroups +You can create groups of conditions by clicking **Add subgroup**: ++ ++ ++## Use smart auto-complete for search +Smart auto-complete for searching devices and user accounts is supported. +You donΓÇÖt need to remember the device ID, full device name, or user account name. You can start typing the first few characters of the device or user you are looking for and a suggested list appears from which you can choose what you need: ++ ++## Use `EventType` +You can even look for specific event types like all failed logons, file modification events, or successful network connections by using the **EventType** filter in any section where it is applicable. ++For instance, if you want to add a condition that looks for registry value deletions, you can go to the **Registry Events** section and select **EventType**. ++ ++Selecting EventType under Registry Events allows you to choose from different registry events, including the one youΓÇÖre hunting for, **RegistryValueDeleted**. ++ ++>[!NOTE] +>`EventType` is the equivalent of `ActionType` in the data schema, which users of advanced mode might be more familiar with. ++## Test your query with a smaller sample size +If youΓÇÖre still working on your query and would like to see its performance and some sample results quickly, adjust the number of records to return by picking a smaller set through the **Sample size** dropdown menu. + + ++The sample size is set to 10,000 results by default. This is the maximum number of records that can be returned in hunting. However, we highly recommend lowering the sample size to 10 or 100 to quickly test your query as doing so consumes less resources while you are still working on improving the query. ++Then, once you finalize your query and are ready to use it to get all the relevant results for your hunting activity, make sure that the sample size is set to 10k, the maximum. ++## Switch to advanced mode after building a query +You can click on **Edit in KQL** to view the KQL query generated by your selected conditions. Editing in KQL opens a new tab in advanced mode, with the corresponding KQL query: ++ ++ ++In the above example, the selected view is All, therefore you can see that the KQL query searches all tables that have file properties of name and SHA256, and in all the relevant columns covering these properties. ++If you change the view to **Emails & collaboration**, the query is narrowed down to: ++ ++## See also + - [Advanced hunting quotas and usage parameters](advanced-hunting-limits.md) + - [Extend advanced hunting coverage with the right settings](advanced-hunting-extend-data.md) |
| security | Advanced Hunting Query Builder Results | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-query-builder-results.md | + + Title: Work with query results in guided mode for hunting in Microsoft 365 Defender +description: Use and customize query results in guided mode for advanced hunting in Microsoft 365 Defender +keywords: guided mode, advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, schema, kusto +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +++ms.localizationpriority: medium ++audience: ITPro ++ - M365-security-compliance + - m365initiative-m365-defender ++ms.technology: m365d +++# Work with query results in guided mode +++**Applies to:** +- Microsoft 365 Defender ++> [!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ++In hunting using guided mode, the results of the query appear in the **Results** tab. ++[ ](../../media/guided-hunting/results-view.png#lightbox) ++You can work on the results further by exporting them to a CSV file by selecting **Export**. This downloads the CSV file for your use. ++You can view other information in the Results view: +- Number of records in the results list (beside the Search button) +- Duration of the query run time +- Resource usage of the query ++## View more columns ++A few standard columns are included in the results for easy viewing. ++To view more columns: +1. Select **Customize columns** in the upper right-hand portion of the results view. + ++2. From here, select the columns to include in the results view and deselect columns to hide. +++[  ](../../media/guided-hunting/results-view-customize-columns-tb.png#lightbox) ++3. Select **Apply** to view results with the added columns. Use the scroll bars if necessary. +++## See also +- [Advanced hunting quotas and usage parameters](advanced-hunting-limits.md) +- [Switch to advanced mode](advanced-hunting-query-builder-details.md#switch-to-advanced-mode-after-building-a-query) +- [Refine your query in guided mode](advanced-hunting-query-builder-details.md) |
| security | Advanced Hunting Query Builder | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-query-builder.md | + + Title: Build queries using guided mode in Microsoft 365 Defender advanced hunting +description: Learn how to build queries in guided mode by combining different available filters and conditions. +keywords: guided mode, advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, custom detections, schema, kusto +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +++ms.localizationpriority: medium ++audience: ITPro ++ - M365-security-compliance + - m365initiative-m365-defender ++ms.technology: m365d +++# Build hunting queries using guided mode in Microsoft 365 Defender ++++**Applies to:** +- Microsoft 365 Defender ++> [!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ++The query builder in guided mode allows analysts to craft meaningful hunting queries *without knowing Kusto Query Language (KQL) or the data schema*. Analysts from every tier of experience can use the query builder to filter through data from the last 30 days to look for threats, expand incident investigations, perform data analytics on threat data, or focus on specific threat areas. ++The analyst can choose which data set to look at and which filters and conditions to use to narrow the data down to what they need. +++## Open Query in builder +In the **Advanced hunting** page, select **Create new** to open a new query tab and select **Query in builder**. ++ ++This brings you to the guided mode, where you can then construct your query by selecting different components using dropdown menus. ++## Specify the data domain to hunt in +You can control the scope of the hunt by selecting which domain the query covers: ++ +++Selecting **All** includes data from all domains you currently have access to. Narrowing down to a specific domain allows filters relevant to that domain only. ++You can choose from: +- All domains - to look through all available data in your query +- Endpoints - to look through endpoint data as provided by Microsoft Defender for Endpoint +- Apps and identities - to look through application and identity data as provided by Microsoft Defender for Cloud Apps and Microsoft Defender for Identity; users familiar with [Activity log](/defender-cloud-apps/activity-filters) can find the same data here +- Email and collaboration - to look through email and collaboration apps data like SharePoint, OneDrive and others; users familiar with [Threat Explorer](/office-365-security/threat-explorer) can find the same data here ++## Use basic filters ++By default, guided hunting includes a few basic filters to get you started fast. ++ ++++When you choose one data source, for instance, **Endpoints**, the query builder displays only the applicable filter groups. You can then choose a filter you are interested in narrowing down by selecting that filter group, for instance, **EventType**, and selecting the filter of your choice. ++ ++++Once the query is ready, select the blue **Run query** button. If the button is grayed out, it means the query needs to be filled out or edited further. ++>[!NOTE] +> The basic filter view uses the **AND** operator only, meaning running the query generates results for which all set filters are true. +++## Load sample queries ++Another quick way to get familiar with guided hunting is to load sample queries using the **Load sample queries** dropdown menu. + ++>[!NOTE] +> Selecting a sample query overrides the existing query. ++Once the sample query is loaded, select **Run query**. ++ ++If you have previously selected a domain, the list of available sample queries changes accordingly. ++ ++To restore the complete list of sample queries, select **All domains** then reopen **Load sample queries**. ++If the loaded sample query uses filters outside of the basic filter set, the toggle button is grayed out. To go back to the basic filter set, select **Clear all** then toggle **All filters**. +++## Use more filters ++To view more filter groups and conditions, select **Toggle to see more filters and conditions**. ++ ++When the **All filters** toggle is active, you can now use the full range of filters and conditions in guided mode. ++ +++++### Create conditions ++To specify a set of data to be used in the query, select **Select a filter**. Explore the different filter sections to find what is available to you. + + ++Type the section's titles in the search box at the top of the list to find the filter. Sections ending in *info* contain filters that provide information about the different components you can look at and filters for the states of entities. Sections ending in *events* contain filters that allow you to look for any monitored event on the entity. For instance, to hunt for activities involving certain devices, you can use the filters under the **Device events** section. ++>[!NOTE] +> Choosing a filter that isn't in the basic filters list deactivates or grays out the toggle to return to the basic filters view. To reset the query or remove existing filters in the current query, select **Clear all**. This also reactivates the basic filters list. +++Next, set the appropriate condition to further filter the data by selecting it from the second dropdown menu and providing entries in the third dropdown menu if necessary: ++ ++You can add more conditions to your query by using **AND**, and **OR** conditions. AND returns results that fulfill all conditions in the query, while OR returns results that fulfill any of the conditions in the query. ++ ++Refining your query allows you to automatically sift through voluminous records to generate a list of results that is already targeted to your specific threat hunting need. ++To get to know what data types are supported and other guided mode capabilities to help you fine-tune your query, read [Refine your query in guided mode](advanced-hunting-query-builder-details.md). ++## Try sample query walk-throughs ++Another way to get familiar with guided hunting is to load sample queries pre-created in guided mode. ++In the **Getting started** section of the hunting page, we have provided three guided query examples that you can load. The query examples contain some of the most common filters and inputs you would typically need in your hunting. Loading any of the three sample queries opens a guided tour of how you would construct the entry using guided mode. ++ ++Follow the instructions in the blue teaching bubbles to construct your query. Select **Run query**. ++## Try some queries ++### Hunt for successful connections to specific IP +To hunt for successful network communications to a specific IP address, start typing ΓÇ£ipΓÇ¥ to get suggested filters: ++ ++To look for events involving a specific IP address where the IP is the destination of the communication, select `DestinationIPAddress` under the IP Address Events section. Then select the **equals** operator. Type the IP in the third dropdown menu and press **Enter**: ++ ++Then, to add a second condition which searches for successful network communication events, search for the filter of a specific event type: ++ ++The **EventType** filter looks for the different event types logged. It is equivalent to the **ActionType** column which exists in most of the tables in advanced hunting. Select it to choose one or more event types to filter for. To look for successful network communication events, expand the **DeviceNetworkEvents** section and then choose `ConnectionSuccess`: ++ ++Finally, select **Run query** to hunt for all successful network communications to the 52.168.117.170 IP address: ++ ++### Hunt for high confidence phish or spam emails delivered to inbox ++To look for all high confidence phish and spam emails that were delivered to the inbox folder at the time of delivery, first select **ConfidenceLevel** under Email Events, select **equals** and choose **High** under both **Phish** and **Spam** from the suggested closed list which supports multi-selection: ++ ++Then, add another condition, this time specifying the folder or **DeliveryLocation, Inbox/folder**. ++ +++++## See also ++- [Refine your query in guided mode](advanced-hunting-query-builder-details.md) +- [Work with query results in guided mode](advanced-hunting-query-builder-results.md) + - [Understand the schema](advanced-hunting-schema-tables.md) |
| security | Microsoft 365 Security Center Defender Cloud Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/microsoft-365-security-center-defender-cloud-apps.md | f1.keywords: Previously updated : 08/04/2022 Last updated : 08/21/2022 audience: ITPro search.appverid: The image and the table below lists the changes in navigation between Microsoft | Defender for Cloud Apps | Microsoft 365 Defender | |||-| **Discover** | | | Cloud Discover dashboard | Cloud apps -> Cloud discovery | | Discovered Apps | tab on Cloud Discovery page | | Discovered resources | tab on Cloud Discovery page | The image and the table below lists the changes in navigation between Microsoft | Devices | tab on Cloud Discovery page | | Cloud app catalog | Cloud apps -> Cloud app catalog | | Create Cloud Discovery snapshot report | On the Cloud Discovery page, under Actions |-| **Investigate** | | | Activity log | Cloud apps -> Activity log |-| Files | Cloud apps -> Files | +| Files | remaining in Defender for Cloud Apps portal | | Users and accounts | Assets -> Identities | | Security configuration | remaining in Defender for Cloud Apps portal | | Identity security posture | [Microsoft Defender for Identity's identity security posture assessments](/defender-for-identity/isp-overview) | | OAuth apps | Cloud apps -> OAuth apps |-| Connected apps | Settings -> Cloud apps -> Connected apps | -| **Control** | | -| Policies | Cloud apps -> Policy management | -| Templates | Cloud apps -> Policy templates | -| **Settings** | | -| Settings | Settings -> Cloud apps | -| System settings | Settings -> Cloud apps | -| Settings/Governance log | Cloud apps -> Governance log | -| Security extensions | Settings -> Cloud apps | -| Playbooks | Settings -> Cloud apps | -| SIEM agents | Settings -> Cloud apps | -| External DLP | Settings -> Cloud apps | -| API tokens | Settings -> Cloud apps | -| Manage admin access | Permissions-> Cloud apps-> Roles | -| Exported reports | Reports -> Cloud apps -> Exported reports | -| Scoped deployment and privacy | Permissions -> Cloud apps -> Activity Privacy permissions | -| Connected Apps/App connectors | Settings -> Cloud Apps -> Connected Apps | -| Conditional Access App Control | Settings -> Cloud apps -> Conditional Access App Control apps | -| IP address ranges | Settings -> Cloud apps | -| User groups | Settings -> Cloud apps | +| Connected apps | remaining in Defender for Cloud Apps portal | > [!NOTE] > The new Defender for Cloud Apps experience in the Microsoft 365 Defender portal is currently available for all users detailed in [Manage admin access](/defender-cloud-apps/manage-admins), except for: |
| security | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/whats-new.md | You can also get product updates and important notifications through the [messag ## August 2022 - (GA) [Microsoft Defender Experts for Hunting](defender-experts-for-hunting.md) is now generally available. If you're a Microsoft 365 Defender customer with a robust security operations center but want Microsoft to help you proactively hunt for threats across endpoints, Office 365, cloud applications, and identity using Microsoft Defender data, then learn more about applying, setting up, and using the service. Defender Experts for Hunting is sold separately from other Microsoft 365 Defender products.+- (Preview) [Guided mode](advanced-hunting-modes.md#get-started-with-guided-hunting-mode) is now available for public preview in advanced hunting. Analysts can now start querying their database for endpoint, identities, email & collaboration, and cloud apps data *without knowing Kusto Query Language (KQL)*. Guided mode features a friendly, easy-to-use, building-block style of constructing queries through dropdown menus containing available filters and conditions. See [Get started with query builder](advanced-hunting-query-builder.md). ## July 2022 - (Preview) Microsoft Defender Experts for Hunting public preview participants can now look forward to receiving monthly reports to help them understand the threats the hunting service surfaced in their environment, along with the alerts generated by their Microsoft 365 Defender products. For details, refer to [Understand the Defender Experts for Hunting report in Microsoft 365 Defender](defender-experts-report.md). |
| security | Attack Simulation Training Get Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-get-started.md | Watch this short video to learn more about Attack simulation training. ## Simulations -*Phishing* is a generic term for email attacks that try to steal sensitive information in messages that appear to be from legitimate or trusted senders. *Phishing* is a part of a subset of techniques we classify as _social engineering_. +*Phishing* is a generic term for email attacks that try to steal sensitive information in messages that appear to be from legitimate or trusted senders. *Phishing* is a part of a subset of techniques we classify as *social engineering*. In Attack simulation training, multiple types of social engineering techniques are available: In Attack simulation training, multiple types of social engineering techniques a - **Link to malware**: An attacker sends the recipient a message that contains a link to an attachment on a well-known file sharing site (for example, SharePoint Online or Dropbox). When the recipient clicks on the URL, the attachment opens and arbitrary code (for example, a macro) is run on the user's device to help the attacker install additional code or further entrench themselves. -- **Drive-by-url**: An attacker sends the recipient a messages that contains a URL. When the recipient clicks on the URL, they're taken to a website that tries to run background code. This background code attempts to gather information about the recipient or deploy arbitrary code on their device. Typically, the destination website is a well-known website that has been compromised or a clone of a well-known website. Familiarity with the website helps convince the user that the link is safe to click. This technique is also known as a _watering hole attack_.+- **Drive-by-url**: An attacker sends the recipient a messages that contains a URL. When the recipient clicks on the URL, they're taken to a website that tries to run background code. This background code attempts to gather information about the recipient or deploy arbitrary code on their device. Typically, the destination website is a well-known website that has been compromised or a clone of a well-known website. Familiarity with the website helps convince the user that the link is safe to click. This technique is also known as a *watering hole attack*. -> [!NOTE] -> Check the availability of the simulated phishing URL in your supported web browsers before you use the URL in a phishing campaign. While we work with many URL reputation vendors to always allow these simulation URLs, we don't always have full coverage (for example, Google Safe Browsing). Most vendors provide guidance that allows you to always allow specific URLs (for example, <https://support.google.com/chrome/a/answer/7532419>). +- **OAuth Consent Grant**: An attacker creates a malicious Azure Application that seeks to gain access to data. The application sends an email request that contains a URL. When the recipient clicks on the URL, the consent grant mechanism of the application asks for access to the data (for example, the user's Inbox). The URLs that are used by Attack simulation training are described in the following list: The URLs that are used by Attack simulation training are described in the follow - <https://www.templatern.com> - <https://www.windocyte.com> +> [!NOTE] +> Check the availability of the simulated phishing URL in your supported web browsers before you use the URL in a phishing campaign. While we work with many URL reputation vendors to always allow these simulation URLs, we don't always have full coverage (for example, Google Safe Browsing). Most vendors provide guidance that allows you to always allow specific URLs (for example, <https://support.google.com/chrome/a/answer/7532419>). + ### Create a simulation For step by step instructions on how to create and send a new simulation, see [Simulate a phishing attack](attack-simulation-training.md). |
| security | Attack Simulation Training Insights | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-insights.md | Click  **Filter** to filt - **In progress** - **All** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. Use  **Search** box to filter the results by **Username** or **Email address**. Wildcards aren't supported. Click  **Filter** to filt - **Malware attachment** - **Link in attachment** - **Link to malware**-- **Drive-by URL** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. Use  **Search** box to filter the results by any of the column values. Wildcards aren't supported. |
| security | Attack Simulation Training Payloads | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-payloads.md | The following information is shown for each payload: - **Link in attachment** - **Link to malware** - **Drive-by URL**+ - **OAuth consent grant** - **Status**: The value is **Ready** or **Draft**. On the **Global payloads** tab, the value is always **Ready**. To find a payload in the list, use the  **Search** box to find the name of the payload. When you select a payload from the list, a details flyout appears with the follo - **Link in attachment** - **Link to malware** - **Drive-by URL**+ - **OAuth Consent Grant** For more information, see [Simulate a phishing attack with Attack simulation training in Defender for Office 365](attack-simulation-training.md). When you select a payload from the list, a details flyout appears with the follo - **Use first name as display name**: By default, this setting is not selected. - **From email**: If you choose an internal email address for your payload's sender, the payload will appear to come from a fellow employee. This sender email address will increase a user's susceptibility to the payload, and will help educate employees on the risk of internal threats. - **Email subject**+ - **Add External tag to email**: By default, this setting is not selected. - **Attachment details** section: This section is available only if you selected **Malware attachment**, **Link in attachment**, or **Link to malware** on the **Select technique** page. Configure the following settings: - **Name your attachment** When you select a payload from the list, a details flyout appears with the follo Later, you'll embed the URL in the body of the message. - - **Phishing link** section: This section is available only if you selected **Credential harvest**, **Link in attachment**, or **Drive-by URL** on the **Select technique** page. + - **Phishing link** section: This section is available only if you selected **Credential harvest**, **Link in attachment**, **Drive-by URL**, or **OAuth Consent Grant** on the **Select technique** page. - For **Credential harvest** or **Drive-by URL**, the name of the box is **Select a URL you want to be your phishing link**. Later, you'll embed the URL in the body of the message. + For **Credential harvest**, **Drive-by URL**, or **OAuth Consent Grant**, the name of the box is **Select a URL you want to be your phishing link**. Later, you'll embed the URL in the body of the message. For **Link in attachment**, the name of the box is **Select a URL in this attachment that you want to be your phishing link**. Later, you'll embed the URL in the attachment. When you select a payload from the list, a details flyout appears with the follo :::image type="content" source="../../media/attack-sim-training-payloads-configure-payload-email-message.png" alt-text="The Email message section on the Configure payload page in the payload creation wizard in Attack simulation training in Microsoft Defender for Office 365" lightbox="../../media/attack-sim-training-payloads-configure-payload-email-message.png"::: - - **Phishing link** control: This control is available only if you selected **Credential harvest**, **Link in attachment**, or **Drive-by URL** on the **Select technique** page. Use this control to name and insert the URL that you previously selected in the **Phishing link** section. + - **Phishing link** control: This control is available only if you selected **Credential harvest**, **Link in attachment**, **Drive-by URL**, or **OAuth Consent Grant** on the **Select technique** page. Use this control to name and insert the URL that you previously selected in the **Phishing link** section. - **Malware attachment link** control: This control is available only if you selected **Link to malware** on the **Select technique** page. Use this control to name and insert the URL that you previously selected in the **Link for attachment** section. When you select a payload from the list, a details flyout appears with the follo - On the **Code** tab, you can view and modify the HTML code directly. Formatting and other controls like **Dynamic tag** and **Phishing link** or **Malware attachment link** aren't available. - - The **Replace all links in the email message with the phishing link** toggle is available only if you selected **Credential harvest**, **Link to malware**, or **Drive-by URL** on the **Select technique** page. This toggle can save time by replacing all links in the message with the previously selected **Phishing link** or **Link for attachment** URL. To do this, toggle the setting to on . + - The **Replace all links in the email message with the phishing link** toggle is available only if you selected **Credential harvest**, **Link to malware**, **Drive-by URL**, or **OAuth Consent Grant** on the **Select technique** page. This toggle can save time by replacing all links in the message with the previously selected **Phishing link** or **Link for attachment** URL. To do this, toggle the setting to on . When you're finished, click **Next**. -6. The **Add indicators** page is available only if you selected **Credential harvest**, **Link in attachment**, or **Drive-by URL** on the **Select technique** page. +6. The **Add indicators** page is available only if you selected **Credential harvest**, **Link in attachment**, **Drive-by URL**, or **OAuth Consent Grant** on the **Select technique** page. Indicators help employees identify the tell-tale signs of phishing messages. When you select a payload from the list, a details flyout appears with the follo ||| |**Attachment type**|Message body| |**Distracting detail**|Message body|- |**Domain spoofing**|Message body <p> From email address| + |**Domain spoofing**|Message body <br/><br/> From email address| |**Generic greeting**|Message body| |**Humanitarian appeals**|Message body| |**Inconsistency**|Message body| When you select a payload from the list, a details flyout appears with the follo |**No/minimal branding**|Message body| |**Poses as friend, colleague, supervisor, or authority figure**|Message body| |**Request for sensitive information**|Message body|- |**Security indicators and icons**|Message body <p> Message subject| - |**Sender display name and email address**|From name <p> From email address| - |**Sense of urgency**|Message body <p> Message subject| - |**Spelling and grammar irregularities**|Message body <p> Message subject| - |**Threatening language**|Message body <p> Message subject| + |**Security indicators and icons**|Message body <br/><br/> Message subject| + |**Sender display name and email address**|From name <br/><br/> From email address| + |**Sense of urgency**|Message body <br/><br/> Message subject| + |**Spelling and grammar irregularities**|Message body <br/><br/> Message subject| + |**Threatening language**|Message body <br/><br/> Message subject| |**Too good to be true offers**|Message body| |**Unprofessional looking design or formatting**|Message body| |**URL hyperlinking**|Message body| |
| security | Attack Simulation Training Simulation Automations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training-simulation-automations.md | On the **Select social engineering techniques** page, select one or more of the - **Link in attachment**: A type of credential harvest hybrid. An attacker inserts a URL into an email attachment. The URL within the attachment follows the same technique as credential harvest. - **Link to malware**: Runs some arbitrary code from a file hosted on a well-known file sharing service. The message sent to the user will contain a link to this malicious file. Opening the file and help the attacker compromise the target's device. - **Drive-by URL**: The malicious URL in the message takes the user to a familiar-looking website that silently runs and/or installs code on the user's device.+- **OAuth Consent Grant**: The malicious URL asks users to grant permissions to data for a malicious Azure Application. If you click the **View details** link in the description, a details flyout opens that describes the technique and the simulation steps that result from the technique. In the  **Search** box, y If you click **Filter**, the following filters are available: - **Complexity**: Calculated based on the number of indicators in the payload that indicate a possible attack (spelling errors, urgency, etc.). More indicators are easier to identify as an attack and indicate lower complexity. The available values are:- - **High** - **Medium** - **Low** If you click **Filter**, the following filters are available: - **Controversial**: The available values are **Yes** or **No**. -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. If you select a payload from the list by clicking anywhere in the row other than the check box, details about the payload are shown in a flyout: - The **Payload** tab contains an example and other details about the payload.-- The **Login page** tab is described in the next section.+- The **Login page** tab is available only in **Credential Harvest** or **Link in attachment** payloads and is described in the next section. - The **Simulations launched** tab contains the **Simulation name**, **Click rate**, **Compromised rate**, and **Action**. :::image type="content" source="../../media/attack-sim-training-simulations-select-payload-details-payload-tab.png" alt-text="The Payload tab in the payload details flyout in Attack simulation training in the Microsoft 365 Defender portal" lightbox="../../media/attack-sim-training-simulations-select-payload-details-payload-tab.png"::: ### Login page +> [!NOTE] +> The **Login page** tab is available only in **Credential Harvest** or **Link in attachment** payloads. + Select the payload from the list by clicking anywhere in the row other than the check box to open the details flyout. The **Login page** tab in the payload details flyout shows the login page that's currently selected for the payload. Back on the payload details flyout, click [Close icon.](../../media/m365-cc-sc-c When you're finished on the **Select a payload and login page**, click **Next**. +## Configure OAuth Payload ++> [!NOTE] +> This page is available only if you selected **OAuth Consent Grant** on the [Select social engineering techniques](#select-one-or-more-social-engineering-techniques) page. Otherwise, you're taken to the **Target users** page. ++On the **Configure OAuth payload** page, configure the following settings: ++- **App name** ++- **App logo**: Click **Browse** to select a .png, .jpeg, or .gif file to use. To remove a file after you've selected it, click **Remove**. ++- **Select app scope**: Choose one of the following values: + - **Read user calendars** + - **Read user contacts** + - **Read user mail** + - **Read all chat messages** + - **Read all files that user can access** + - **Read and write access to user mail** + - **Send mail as a user** ++When you're finished on the **Configure OAuth payload** page, click **Next**. + ## Target users On the **Target users** page, select who will receive the simulation. Configure one of the following settings: On the **Landing page** page, you configure the web page that user are taken to You need to configure the following additional settings on the **Landing page** page: - - **Payload indicators**: This setting is available to select only if both of the following conditions are true: - - You previously selected **Credential harvest**, **Link in attachment**, or **Drive-by URL** on the [Select social engineering techniques](#select-one-or-more-social-engineering-techniques) page. - - After you add the **Dynamic tag** named **Insert email content** into the page content. + - **Add payload indicators to email**: This setting is available to select only if both of the following statements are true: + - You selected **Credential harvest**, **Link in attachment**, **Drive-by URL**, or **OAuth Consent Grant** on the [Select social engineering techniques](#select-one-or-more-social-engineering-techniques) page. + - You've added the **Dynamic tag** named **Insert Payload content** in the landing page content on this page. - - Page content: Two tabs are available: + - Landing page content: Two tabs are available: - **Text**: A rich text editor is available to create your landing page. In addition to the typical font and formatting settings, the following settings are available: - **Dynamic tag**: Select from the following tags:- - **Insert name** - - **Insert sender name** - - **Insert sender email** - - **Insert email subject** - - **Insert email content** - - **Insert date** ++ |Tag name|Tag value| + ||| + |**Insert User name**|`${userName}`| + |**Insert First name**|`${firstName}`| + |**Insert Last name**|`${lastName}`| + |**Insert UPN**|`${upn}`| + |**Insert Email**|`${emailAddress}`| + |**Insert Department**|`${department}`| + |**Insert Manager**|`${manager}`| + |**Insert Mobile phone**|`${mobilePhone}`| + |**Insert City**|`${city}`| + |**Insert sender name**|`${FromName}`| + |**Insert sender email**|`${FromEmail}`| + |**Insert Payload subject**|`${EmailSubject}`| + |**Insert Payload content**|`${EmailContent}`| + |**Insert Date**|`${date|MM/dd/yyyy|offset}`| + - **Use from default**: Select one of the 5 available landing page templates to start with. You can modify the text and layout in the editing area. To reset the landing page back to the default text and layout of the template, click **Reset to default**. - **Training link**: In the **Name training URL** dialog that appears, enter a link title for the training link, and then click **Confirm** to add the link to the landing page. - **Code**: You can view and modify the HTML code directly. When you're finished, click **Next**. On the **Launch details** page, configure the following additional settings for the automation: - **Use unique payloads across simulations within an automation**: By default, this setting is not selected.+- **Target all selected users in every simulation run**: By default, this setting is not selected. - **Target repeat offenders**: By default, this setting is not selected. If you select it, configure the following setting that appears: - **Enter the maximum number of times a user can be targeted within this automation**: Enter a value from 1 to 10. - **Send simulation email based upon the user's current time zone setting from Outlook web app**: By default, this setting is not selected.-- **Display the drive-by technique interstitial data gathered page**: This setting is available only if you selected **Drive-by URL** on the **[Select social engineering techniques](#select-one-or-more-social-engineering-techniques)** page. By default, the setting is on ().++- **Display the drive-by technique interstitial data gathered page**: This setting is available only if you selected **Drive-by URL** on the **[Select social engineering techniques](#select-one-or-more-social-engineering-techniques)** page. You can show the overlay that comes up for drive-by URL technique attacks. By default, the setting is on . To hide the overlay and go directly to the landing page, turn this setting off . ## Review simulation automation |
| security | Attack Simulation Training | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/attack-simulation-training.md | On the **Select technique** page, select an available social engineering techniq - **Link in attachment**: A type of credential harvest hybrid. An attacker inserts a URL into an email attachment. The URL within the attachment follows the same technique as credential harvest. - **Link to malware**: Runs some arbitrary code from a file hosted on a well-known file sharing service. The message sent to the user will contain a link to this malicious file. Opening the file will help the attacker compromise the target's device. - **Drive-by URL**: The malicious URL in the message takes the user to a familiar-looking website that silently runs and/or installs code on the user's device.+- **OAuth Consent Grant**: The malicious URL asks users to grant permissions to data for a malicious Azure Application. If you click the **View details** link in the description, a details flyout opens that describes the technique and the simulation steps that result from the technique. If you click **Filter**, the following filters are available: - **Controversial**: The available values are **Yes** or **No**. -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. If you select a payload from the list by selecting the check box, a  **Send a test** button appears on the main page where you can send a copy of the payload email to yourself (the currently logged in user) for inspection. To create your own payload, click ![Create a payload icon.](../../media/m365-cc- If you select a payload from the list by clicking anywhere in the row other than the check box, details about the payload are shown in a flyout: - The **Payload** tab contains an example and other details about the payload.-- The **Login page** tab is described in the next section.+- The **Login page** tab is available only in **Credential Harvest** or **Link in attachment** payloads and is described in the next section. - The **Simulations launched** tab contains the **Simulation name**, **Click rate**, **Compromised rate**, and **Action**. :::image type="content" source="../../media/attack-sim-training-simulations-select-payload-details-payload-tab.png" alt-text="The Payload tab in the payload details flyout in Attack simulation training in the Microsoft 365 Defender portal" lightbox="../../media/attack-sim-training-simulations-select-payload-details-payload-tab.png"::: ### Login page +> [!NOTE] +> The **Login page** tab is available only in **Credential Harvest** or **Link in attachment** payloads. + Select the payload from the list by clicking anywhere in the row other than the check box to open the details flyout. The **Login page** tab in the payload details flyout shows the login page that's currently selected for the payload. Back on the payload details flyout, click [Close icon.](../../media/m365-cc-sc-c When you're finished on the **Select a payload and login page**, click **Next**. +## Configure OAuth Payload ++> [!NOTE] +> This page is available only if you selected **OAuth Consent Grant** on the [Select technique](#select-a-social-engineering-technique) page. Otherwise, you're taken to the **Target users** page. ++On the **Configure OAuth payload** page, configure the following settings: ++- **App name** ++- **App logo**: Click **Browse** to select a .png, .jpeg, or .gif file to use. To remove a file after you've selected it, click **Remove**. ++- **Select app scope**: Choose one of the following values: + - **Read user calendars** + - **Read user contacts** + - **Read user mail** + - **Read all chat messages** + - **Read all files that user can access** + - **Read and write access to user mail** + - **Send mail as a user** + ## Target users On the **Target users** page, select who will receive the simulation. Configure one of the following settings: Microsoft-curated landing pages are available in 12 languages: Chinese (Simplifi If you select **Use a custom URL**, you need to add the URL in the **Enter the custom landing page URL** box that appears. No other options are available on the page. - **Create your own landing page**: This value has the following associated options to configure:- - **Add payload indicators to email**: This setting is available to select only if both of the following conditions are true: - - You previously selected **Credential harvest**, **Link in attachment**, or **Drive-by URL** on the [Select technique](#select-a-social-engineering-technique) page. - - After you add the **Dynamic tag** named **Insert email content** into the page content. + - **Add payload indicators to email**:This setting is available to select only if both of the following statements are true: + - You selected **Credential harvest**, **Link in attachment**, **Drive-by URL**, or **OAuth Consent Grant** on the [Select technique](#select-a-social-engineering-technique) page. + - You've added the **Dynamic tag** named **Insert Payload content** in the landing page content on this page. - - Page content: Two tabs are available: + - Landing page content: Two tabs are available: - **Text**: A rich text editor is available to create your landing page. In addition to the typical font and formatting settings, the following settings are available: - **Dynamic tag**: Select from the following tags:- - **Insert name** - - **Insert sender name** - - **Insert sender email** - - **Insert email subject** - - **Insert email content** - - **Insert date** ++ |Tag name|Tag value| + ||| + |**Insert User name**|`${userName}`| + |**Insert First name**|`${firstName}`| + |**Insert Last name**|`${lastName}`| + |**Insert UPN**|`${upn}`| + |**Insert Email**|`${emailAddress}`| + |**Insert Department**|`${department}`| + |**Insert Manager**|`${manager}`| + |**Insert Mobile phone**|`${mobilePhone}`| + |**Insert City**|`${city}`| + |**Insert sender name**|`${FromName}`| + |**Insert sender email**|`${FromEmail}`| + |**Insert Payload subject**|`${EmailSubject}`| + |**Insert Payload content**|`${EmailContent}`| + |**Insert Date**|`${date|MM/dd/yyyy|offset}`| + - **Use from default**: Select an available template to start with. You can modify the text and layout in the editing area. To reset the landing page back to the default text and layout of the template, click **Reset to default**. - **Code**: You can view and modify the HTML code directly. The following settings are available: - **Select launch time** - **Configure number of days to end simulation after**: The default value is 2. - **Enable region aware time zone delivery**: Deliver simulated attack messages to your employees during their working hours based on their region.-- **Display the drive-by technique interstitial data gathered page**: You can show the overlay that comes up for the drive-bu URL technique attacks. To hide the overlay and go directly to the landing page, de-select this option.++- **Display the drive-by technique interstitial data gathered page**: This setting is available only if you selected **Drive-by URL** on the [select a technique page](#select-a-social-engineering-technique) page. You can show the overlay that comes up for drive-by URL technique attacks. To hide the overlay and go directly to the landing page, don't select this option. When you're finished, click **Next**. |
| security | Configure Advanced Delivery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-advanced-delivery.md | Messages that are identified by the advanced delivery policy aren't security thr - You open the Microsoft 365 Defender portal at <https://security.microsoft.com>. To go directly to the **Advanced delivery** page, open <https://security.microsoft.com/advanceddelivery>. -- To connect to Security & Compliance PowerShell, see [Connect to Security & Compliance PowerShell](/powershell/exchange/connect-to-scc-powershell).+- To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). - You need to be assigned permissions before you can do the procedures in this article: - To create, modify, or remove configured settings in the advanced delivery policy, you need to be a member of the **Security Administrator** role group in the **Microsoft 365 Defender portal** and a member of the **Organization Management** role group in **Exchange Online**. Configuring a SecOps mailbox in the advanced delivery policy in PowerShell is a #### Step 1: Use PowerShell to create the SecOps override policy -To create the SecOps override policy, use the following syntax: +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax: ```powershell New-SecOpsOverridePolicy -Name SecOpsOverridePolicy -SentTo <EmailAddress1>,<EmailAddress2>,...<EmailAddressN> For detailed syntax and parameter information, see [New-SecOpsOverridePolicy](/p #### Step 2: Use PowerShell to create the SecOps override rule -This example creates the SecOps mailbox rule with the specified settings. +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), run the following command: ```powershell New-SecOpsOverrideRule -Name SecOpsOverrideRule -Policy SecOpsOverridePolicy For detailed syntax and parameter information, see [New-SecOpsOverrideRule](/pow ### Use PowerShell to view the SecOps override policy -This example returns detailed information about the one and only SecOps mailbox policy. +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), this example returns detailed information about the one and only SecOps mailbox policy. ```powershell Get-SecOpsOverridePolicy For detailed syntax and parameter information, see [Get-SecOpsOverridePolicy](/p ### Use PowerShell to view SecOps override rules -This example returns detailed information about SecOps override rules. +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), this example returns detailed information about SecOps override rules. ```powershell Get-SecOpsOverrideRule For detailed syntax and parameter information, see [Get-SecOpsOverrideRule](/pow ### Use PowerShell to modify the SecOps override policy -To modify the SecOps override policy, use the following syntax: +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax: ```powershell Set-SecOpsOverridePolicy -Identity SecOpsOverridePolicy [-AddSentTo <EmailAddress1>,<EmailAddress2>,...<EmailAddressN>] [-RemoveSentTo <EmailAddress1>,<EmailAddress2>,...<EmailAddressN>] For detailed syntax and parameter information, see [Set-SecOpsOverrideRule](/pow ### Use PowerShell to remove the SecOps override policy -This example removes the SecOps Mailbox policy and the corresponding rule. +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), this example removes the SecOps Mailbox policy and the corresponding rule. ```powershell Remove-SecOpsOverridePolicy -Identity SecOpsOverridePolicy For detailed syntax and parameter information, see [Remove-SecOpsOverridePolicy] ### Use PowerShell to remove SecOps override rules -To remove a SecOps override rule, use the following syntax: +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax: ```powershell Remove-SecOpsOverrideRule -Identity <RuleIdentity> Configuring a third-party phishing simulation in PowerShell is a multi-step proc #### Step 1: Use PowerShell to create the phishing simulation override policy -This example creates the phishing simulation override policy. +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), this example creates the phishing simulation override policy. ```powershell New-PhishSimOverridePolicy -Name PhishSimOverridePolicy For detailed syntax and parameter information, see [New-PhishSimOverridePolicy]( #### Step 2: Use PowerShell to create the phishing simulation override rule -Use the following syntax: +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax: ```powershell New-PhishSimOverrideRule -Name PhishSimOverrideRule -Policy PhishSimOverridePolicy -Domains <Domain1>,<Domain2>,...<Domain10> -SenderIpRanges <IPAddressEntry1>,<IPAddressEntry2>,...<IPAddressEntry10> For detailed syntax and parameter information, see [New-TenantAllowBlockListItem ### Use PowerShell to view the phishing simulation override policy -This example returns detailed information about the one and only phishing simulation override policy. +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), this example returns detailed information about the one and only phishing simulation override policy. ```powershell Get-PhishSimOverridePolicy For detailed syntax and parameter information, see [Get-PhishSimOverridePolicy]( ### Use PowerShell to view phishing simulation override rules -This example returns detailed information about phishing simulation override rules. +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), this example returns detailed information about phishing simulation override rules. ```powershell Get-PhishSimOverrideRule For detailed syntax and parameter information, see [Get-PhishSimOverrideRule](/p ### Use PowerShell to view the allowed phishing simulation URL entries -To view the allowed phishing simulation URLs, run the following command: +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), run the following command: ```powershell Get-TenantAllowBlockListItems -ListType Url -ListSubType AdvancedDelivery For detailed syntax and parameter information, see [Get-TenantAllowBlockListItem ### Use PowerShell to modify the phishing simulation override policy -To modify the phishing simulation override policy, use the following syntax: +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax: ```powershell Set-PhishSimOverridePolicy -Identity PhishSimOverridePolicy [-Comment "<DescriptiveText>"] [-Enabled <$true | $false>] For detailed syntax and parameter information, see [Set-PhishSimOverridePolicy]( ### Use PowerShell to modify phishing simulation override rules -To modify the phishing simulation override rule, use the following syntax: +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax: ```powershell Set-PhishSimOverrideRule -Identity PhishSimOverrideRulea0eae53e-d755-4a42-9320-b9c6b55c5011 [-Comment "<DescriptiveText>"] [-AddSenderDomainIs <DomainEntry1>,<DomainEntry2>,...<DomainEntryN>] [-RemoveSenderDomainIs <DomainEntry1>,<DomainEntry2>,...<DomainEntryN>] [-AddSenderIpRanges <IPAddressEntry1>,<IPAddressEntry2>,...<IPAddressEntryN>] [-RemoveSenderIpRanges <IPAddressEntry1>,<IPAddressEntry2>,...<IPAddressEntryN>] For detailed syntax and parameter information, see [Set-PhishSimOverrideRule](/p You can't modify the URL values directly. You can [remove existing URL entries](#use-powershell-to-remove-the-allowed-phishing-simulation-url-entries) and [add new URL entries](#step-3-optional-use-powershell-to-identify-the-phishing-simulation-urls-to-allow) as described in this article. -To modify other properties of an allowed phishing simulation URL entry (for example, the expiration date or comments), use the following syntax: +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), to modify other properties of an allowed phishing simulation URL entry (for example, the expiration date or comments), use the following syntax: ```powershell Set-TenantAllowBlockListItems <-Entries "<URL1>","<URL2>",..."<URLN>" | -Ids <Identity>> -ListType URL -ListSubType AdvancedDelivery <[-NoExpiration] | [-ExpirationDate <DateTime>]> [-Notes <String>] For detailed syntax and parameter information, see [Set-TenantAllowBlockListItem ### Use PowerShell to remove a phishing simulation override policy -This example removes the phishing simulation override policy and the corresponding rule. +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), this example removes the phishing simulation override policy and the corresponding rule. ```powershell Remove-PhishSimOverridePolicy -Identity PhishSimOverridePolicy For detailed syntax and parameter information, see [Remove-PhishSimOverridePolic ### Use PowerShell to remove phishing simulation override rules -To remove a phishing simulation override rule, use the following syntax: +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax: ```powershell Remove-PhishSimOverrideRule -Identity <RuleIdentity> For detailed syntax and parameter information, see [Remove-PhishSimOverrideRule] ### Use PowerShell to remove the allowed phishing simulation URL entries -To remove an existing phishing simulation URL entry, use the following syntax: +In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax: ```powershell Remove-TenantAllowBlockListItems <-Entries "<URL1>","<URL2>",..."<URLN>" | -Ids <Identity>> -ListType URL -ListSubType AdvancedDelivery |
| security | Mdo Sec Ops Guide | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-sec-ops-guide.md | Campaign Views reveals malware and phishing attacks against your organization. F ||||| |Regular, proactive hunting for threats at: <ul><li><https://security.microsoft.com/threatexplorer></li><li><https://security.microsoft.com/v2/advanced-hunting></li></ul>.|Ad-hoc|Search for threats using [Threat Explorer](threat-explorer.md) and [Advanced hunting](../defender-endpoint/advanced-hunting-overview.md).|Security Operations Team <br/><br/> Threat hunting team| |Share hunting queries.|Ad-hoc|Actively share frequently used, useful queries within the security team for faster manual threat hunting and remediation. <br/><br/> Use [Threat trackers](threat-trackers.md) and [shared queries in Advanced hunting](/microsoft-365/security/defender/advanced-hunting-shared-queries).|Security Operations Team <br/><br/> Threat hunting team|-|Create custom detection rules at <https://security.microsoft.com/custom_detection>.|Ad-hoc|[Create custom detection rules](../defender/advanced-hunting-overview.md#get-started-with-advanced-hunting) to proactively monitor events, patterns, and threats based on Defender for Office 365 data in Advance Hunting. Detection rules contain advanced hunting queries that generate alerts based on the matching criteria.|Security Operations Team <br/><br/> Threat hunting team| +|Create custom detection rules at <https://security.microsoft.com/custom_detection>.|Ad-hoc|[Create custom detection rules](../defender/custom-detections-overview.md) to proactively monitor events, patterns, and threats based on Defender for Office 365 data in Advance Hunting. Detection rules contain advanced hunting queries that generate alerts based on the matching criteria.|Security Operations Team <br/><br/> Threat hunting team| ### Review Defender for Office 365 policy configurations |
| security | Recommended Settings For Eop And Office365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365.md | In PowerShell, you use the [New-SafeLinksPolicy](/powershell/module/exchange/new |**URL & click protection settings**|||||| |**Action on potentially malicious URLs within Emails**|||||| |**On: Safe Links checks a list of known, malicious links when users click links in email** <br><br> _EnableSafeLinksForEmail_|Not selected <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`||-|**Apply Safe Links to email messages sent within the organization** <br><br> _EnableForInternalSenders_|Not selected <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| +|**Apply Safe Links to email messages sent within the organization** <br><br> _EnableForInternalSenders_|Not selected <br><br> `$false`|Not selected <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|| |**Apply real-time URL scanning for suspicious links and links that point to files** <br><br> _ScanUrls_|Not selected <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| |**Wait for URL scanning to complete before delivering the message** <br><br> _DeliverMessageAfterScan_|Not selected <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| |**Do not rewrite URLs, do checks via Safe Links API only** <br><br> _DisableURLRewrite_|Not selected <br><br> `$false`|Selected <br><br> `$true`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|| In PowerShell, you use the [New-SafeLinksPolicy](/powershell/module/exchange/new |**Action for potentially malicious URLs in Microsoft Teams**|||||| |**On: Safe Links checks a list of known, malicious links when users click links in Microsoft Teams** <br><br> _EnableSafeLinksForTeams_|Not selected <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| |**Action for potentially malicious URLs in Microsoft Office apps**||||||-|**On: Safe Links checks a list of known, malicious links when users click links in Microsoft Office apps** <br><br> _EnableSafeLinksForO365Clients_|Not selected <br><br> `$false`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Use Safe Links in supported Office 365 desktop and mobile (iOS and Android) apps. For more information, see [Safe Links settings for Office apps](safe-links.md#safe-links-settings-for-office-apps).| +|**On: Safe Links checks a list of known, malicious links when users click links in Microsoft Office apps** <br><br> _EnableSafeLinksForOffice_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Use Safe Links in supported Office 365 desktop and mobile (iOS and Android) apps. For more information, see [Safe Links settings for Office apps](safe-links.md#safe-links-settings-for-office-apps).| |**Click protection settings**|||||| |**Track user clicks** <br><br> _TrackUserClicks_|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|Selected <br><br> `$true`|| |**Let users click through to the original URL** <br><br> _AllowClickThrough_|Selected <br><br> `$true`|Selected <br><br> `$true`|Not selected <br><br> `$false`|Not selected <br><br> `$false`|Turning off this setting (setting _AllowClickThrough_ to `$false`) prevents click through to the original URL.| |
| security | Trial Playbook Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/trial-playbook-defender-for-office-365.md | Respond efficiently using Automated investigation and response (AIR) to review, Use Advanced hunting to write custom detection rules, proactively inspect events in your environment, and locate threat indicators. Explore raw data in your environment. -- [Build custom detection rules](../defender/advanced-hunting-overview.md#get-started-with-advanced-hunting).+- [Build custom detection rules](../defender/custom-detections-overview.md). - [Access shared queries](../defender/advanced-hunting-shared-queries.md) created by others. Watch this video to learn more: [Threat hunting with Microsoft 365 Defender - YouTube](https://www.youtube.com/watch?v=l3OmH4U6XAs&list=PL3ZTgFEc7Lyt1O81TZol31YXve4e6lyQu&index=4). |
| security | View Email Security Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/view-email-security-reports.md | You can filter both the chart and the details table by clicking **Filter** and s - **Activity**: **Restricted** or **Suspicious** - **Tag**: **All** or the specified user tag (including priority accounts). -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. On the **Compromised users** page, the  **[Create schedule](#schedule-report)**,  **[Request report](#request-report)**, and  **[Export](#export-report)** buttons are available. You can filter both the chart and the details table by clicking **Filter** and s - **Direction**: **Outbound** and **Inbound**. - **Severity**: **High severity**, **Medium severity**, and **Low severity** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. On the **Exchange transport rule report** page, the  **[Create schedule](#schedule-report)**,  **[Request report](#request-report)**, and  **[Export](#export-report)** buttons are available. You can filter both the chart and the details table by clicking **Filter** and s - **Direction**: **Outbound** and **Inbound** - **Severity**: **High severity**, **Medium severity**, and **Low severity** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. On the **Exchange transport rule report** page, the  **[Create schedule](#schedule-report)**,  **[Request report](#request-report)**, and  **[Export](#export-report)** buttons are available. You can filter both the chart and the details table by clicking **Filter** and s - **Rule messages** - **Phishing email** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. Back on the **Mailflow status report** page, if you click **Choose a category for more details**, you can select from the following values: You can filter both the chart and the details table by clicking **Filter** and s - **Rule messages** - **Phishing email** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. Back on the **Mailflow status report** page, if you click **Choose a category for more details**, you can select from the following values: You can filter both the chart and the details table by clicking **Filter** and s - **Date (UTC)** **Start date** and **End date**. - **Direction**: **Outbound** and **Inbound**. -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. Back on the **Mailflow status report** page, you can click **Show trends** to see trend graphs in the **Mailflow trends** flyout that appears. If you click **Filter**, the following filters are available: - **Mail flow rule** (transport rule) - **Others** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. ### View data by Email \> Phish and Chart breakdown by Detection Technology If you click **Filter**, the following filters are available: - **Policy name (details table view only)**: **All** or the specified policy. - **Recipients** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. On the **Threat protection status** page, the  **[Create schedule](#schedule-report)**,  **[Request report](#request-report)**, and  **[Export](#export-report)** buttons are available. If you click **Filter**, the following filters are available: - **Policy name (details table view only)**: **All** or the specified policy. - **Recipients** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. On the **Threat protection status** page, the  **[Create schedule](#schedule-report)**,  **[Request report](#request-report)**, and  **[Export](#export-report)** buttons are available. If you click **Filter**, the following filters are available: - **Policy name (details table view only)**: **All** or the specified policy. - **Recipients** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. On the**Threat protection status** page, the  **[Create schedule](#schedule-report)**,  **[Request report](#request-report)**, and  **[Export](#export-report)** buttons are available. If you click **Filter**, the following filters are available: <sup>\*</sup> Defender for Office 365 only -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. On the **Threat protection status** page, the  **[Create schedule](#schedule-report)**,  **[Request report](#request-report)**, and  **[Export](#export-report)** buttons are available. If you click **Filter**, the following filters are available: <sup>\*</sup> Defender for Office 365 only -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. On the **Threat protection status** page, the  **[Create schedule](#schedule-report)**,  **[Request report](#request-report)**, and  **[Export](#export-report)** buttons are available. If you click **Filter**, the following filters are available: - **Detection**: The same values as in the chart. - **Workload**: **Teams**, **SharePoint**, and **OneDrive** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. On the **Threat protection status** page, the  **[Create schedule](#schedule-report)**,  **[Request report](#request-report)**, and  **[Export](#export-report)** buttons are available. If you click **Filter**, the following filters are available: - **Policy name (details table view only)**: **All** - **Recipients** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. On the **Threat protection status** page, the  **[Export](#export-report)** button is available. If you click **Filter**, the following filters are available: <sup>\*</sup> Defender for Office 365 only -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. On the **Threat protection status** page, the  **[Export](#export-report)** button is available. The details table below the graph shows the senders or recipients and message co You can filter both the chart and the details table by clicking **Filter** and selecting **Start date** and **End date**. Users can also filter by user tags. -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. On the **Top senders and recipients** page, the  **Export** button is available. You can filter both the chart and the details table by clicking **Filter** and s - **Spam** - **Phish simulation**: **Yes** or **No** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. To group the entries, click **Group** and select one of the following values from the drop-down list: |
| security | View Reports For Mdo | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/view-reports-for-mdo.md | If you click **Filter**, you can filter both the chart and the details table by - **Inline detonation**: Includes messages that are fully tested before delivery. - **Asynchronous detonation** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. In the details table below the chart, the following information is available: If you click **Filters**, you can modify the report and the details table by sel - **Domains**: The URL domains listed in the report results. - **Recipients** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. The details table below the chart provides the following near-real-time view of all clicks that happened within the organization for the last 7 days: If you click **Filters**, you can modify the report and the details table by sel - **Domains**: The URL domains listed in the report results. - **Recipients** -When you're finished configuring the filters, click **Apply**, **Cancel**, or **Clear filters**. +When you're finished configuring the filters, click **Apply**, **Cancel**, or  **Clear filters**. The details table below the chart provides the following near-real-time view of all clicks that happened within the organization for the last 7 days: |
| solutions | Security Design Principles | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/security-design-principles.md | In this article, [Kozeta Garrett](https://www.linkedin.com/in/kozeta-garrett-530  -In my role as a Cloud Security Architect, I've worked with multiple organizations to provide strategic and technical guidance focusing on designing and implementing security architecture for customers migrating to Microsoft 365 and Azure, developing enterprise security solutions, and helping transform security architecture and culture for business resilience. My experience includes incident detection and response, malware analysis, penetration testing, and recommending improvements to IT security and defense posture. I'm very passionate about leading transformations that result in security as an enabler for the business, including modernization efforts. +In my role as a Cloud Security Architect, I've worked with multiple organizations to provide strategic and technical guidance focusing on designing and implementing security architecture for customers migrating to Microsoft 365 and Azure, developing enterprise security solutions, and helping transform security architecture and culture for business resilience. My experience includes incident detection and response, malware analysis, penetration testing, and recommending improvements to IT security and defense posture. I'm passionate about leading transformations that result in security as an enabler for the business, including modernization efforts. It has been MOST satisfying to see how organizations that adopted a security modernization mindset over the last couple of years are in a great position that is allowing them to continue to operate remotely in a secure manner, despite the recent COVID-19 situation. Unfortunately, these circumstances have also served as a wake-up call for some customers, who weren't ready for this immediate need. Many organizations are realizing they must modernize rapidly, retire their accumulated IT security debt, and improve their security posture overnight so they can operate in these extremely unusual circumstances. I currently live in Northern Virginia, close to our country's Capital, Washingto To begin, I canΓÇÖt emphasize enough how important it is for teams in your organization to coordinate from the start. Security teams must be embraced as critical partners in the early stages of cloud adoption and design. This means getting security teams onboard to champion cloud adoption, not only for the added capabilities to the business (such as a great user experience from secure mobile devices, full functionality applications, or creating value on corporate data beyond the limited functionality email and productivity applications) but also to leverage the storage, AI, and computing analytics capabilities that help solve new and old security challenges. Security teams must be included in managing all aspects of this shift, including people (culture), processes (training), and technology to be successful. It also means investing in the modernization and continuous improvement of the Security Operations Center (SOC). Work together to align your security strategy with your business strategy and environment trends to ensure the digital transformation is done securely. When this is done well, organizations develop the capability to adapt faster to changes, including changes to the business, IT, and security. -Where I see customers trip over hurdles the most is when there's no real partnership between the operations and the SOC teams. While the operations team is being pressured and mandated with tight deadlines to adopt the cloud, the security teams aren't always included early in the process to revise and plan a comprehensive security strategy. This involves integrating different cloud components and components on-prem. This lack of partnership further trickles down to different teams that seem to work in silos to implement controls for their specific components, leading to the added complexity of implementation, troubleshooting, and integration. +Where I see customers trip over hurdles the most is when there's no real partnership between the operations and the SOC teams. While the operations team is being pressured and mandated with tight deadlines to adopt the cloud, the security teams aren't always included early in the process to revise and plan a comprehensive security strategy. This involves integrating different cloud components and components on-premises. This lack of partnership further trickles down to different teams that seem to work in silos to implement controls for their specific components, leading to the added complexity of implementation, troubleshooting, and integration. Customers who sail over these hurdles have good partnerships between the Operations and Governance and the Security and Risk management teams to revamp the security strategy and requirements for protecting hybrid cloud workloads. They laser-focus on the ultimate security goals and outcomesΓÇödata protection and systems and services availability in accordance with cybersecurity governance, risk, and compliance requirements. These organizations develop early-stage partnerships between their Operations and Governance team and SOC, which is critical to the security design approach and will maximize the value of their investments. ## Build a modern (identity-based) security perimeter -Next, adopt a Zero Trust architecture approach. This starts with building a modern, identity-based security perimeter. Design the security architecture where every access attempt, whether on-prem or cloud, is treated as untrusted until it's verifiedΓÇöΓÇ£never trust, always verify.ΓÇ¥ This design approach not only increases security and productivity, but it also allows users to work from anywhere with any device type. The sophisticated cloud controls included with Microsoft 365 help you protect usersΓÇÖ identities while controlling access to valuable resources based on user risk level. +Next, adopt a Zero Trust architecture approach. This starts with building a modern, identity-based security perimeter. Design the security architecture where every access attempt, whether on-premises or cloud, is treated as untrusted until it's verifiedΓÇöΓÇ£never trust, always verify.ΓÇ¥ This design approach not only increases security and productivity, but it also allows users to work from anywhere with any device type. The sophisticated cloud controls included with Microsoft 365 help you protect usersΓÇÖ identities while controlling access to valuable resources based on user risk level. For a recommended configuration, see [Identity and device access configurations](../security/office-365-security/microsoft-365-policies-configurations.md). ## Transition security controls to the cloud -Many security teams are still using the traditional security best practices built for an all on-premises world, including maintaining a ΓÇ£network perimeter securityΓÇ¥ and trying to ΓÇ£forceΓÇ¥ the on-prem security tools and controls to cloud solutions. Such controls were not designed for the cloud, are ineffective, and hinder the adoption of modern cloud capabilities. Processes and tools that work for a network perimeter security approach have proven to be inefficient, obstructive to cloud capabilities, and don't allow for taking advantage of modern and automated security features. +Many security teams are still using the traditional security best practices built for an all on-premises world, including maintaining a ΓÇ£network perimeter securityΓÇ¥ and trying to ΓÇ£forceΓÇ¥ the on-premises security tools and controls to cloud solutions. Such controls were not designed for the cloud, are ineffective, and hinder the adoption of modern cloud capabilities. Processes and tools that work for a network perimeter security approach have proven to be inefficient, obstructive to cloud capabilities, and don't allow for taking advantage of modern and automated security features. You can sail over this hurdle by shifting the defense strategies to cloud-managed protection, automated investigation and remediation, automated pen-testing, Defender for Office 365, and incident analysis. Customers who are using modern device management solutions have implemented automated management, standardized patching, antivirus, policy enforcement, and application protection across all devices (whether a smartphone, personal computer, laptop, or tablet). This eliminates the need for a VPN, Microsoft System Center Configuration Manager (SCCM), and Active Directory group policies. This, combined with conditional access policies, provides powerful control and visibility, as well as streamlined access to resources regardless of where their users are operating from. Organizations that realize users will do whatever it takes to get their jobs don ## Adopt a methodical approach -Most of the challenges I have experienced with implementing cloud security at different organizations, regardless of industry, have been very similar. First of all, while there is plenty of great documentation on specific capabilities and features, there is a level of confusion at the organization level about what applies to them, where security features overlap, and how capabilities should be integrated. There is also a level of uncertainty about which security features come pre-configured out of the box and which require configuration by the organization. In addition, the SOC teams unfortunately have not had the full exposure, training, or the budget allocation needed to prepare for the rapid cloud adoption and digital transformation their organizations are already undergoing. +Most of the challenges I've experienced with implementing cloud security at different organizations, regardless of industry, have been very similar. First of all, while there's plenty of great documentation on specific capabilities and features, there's a level of confusion at the organization level about what applies to them, where security features overlap, and how capabilities should be integrated. There's also a level of uncertainty about which security features come pre-configured out of the box and which require configuration by the organization. In addition, the SOC teams unfortunately have not had the full exposure, training, or the budget allocation needed to prepare for the rapid cloud adoption and digital transformation their organizations are already undergoing. To help you clear these hurdles, Microsoft has curated several resources designed to help you take a methodical approach to your security strategy and implementation. |Resource |More information | ||| |[Top tasks for security teams to support working from home](../security/top-security-tasks-for-remote-work.md) | If you find yourself suddenly supporting a mostly work-at-home workforce, this article helps you ramp up security quickly. It includes top recommended tasks based on your licensing plan. |-|[Microsoft 365 Security for Business Decisions Makers](../security/Microsoft-365-security-for-bdm.md) | When you have time for a more comprehensive plan, this article includes recommendations that span Microsoft 365, prioritized by attack surface. It even comes with a spreadsheet you can use to sort on licensing and area (such as identity, threat protection, and monitoring). | -|[Microsoft security architecture recommendations](/security/compass/compass) | If you are a security architect, be sure to see security recommendations organized by discipline, including identity, networking, and security operations. | -|[Microsoft Security Operations recommendations](/security/compass/security-operations-videos-and-decks)|Learn Microsoft recommendations for setting up and running a Security Operations Center (SOC) | -|[Chief Information Security Officer (CISO) Workshop Training](/security/ciso-workshop/ciso-workshop) | If youΓÇÖre new to cloud security, donΓÇÖt miss this series of videos. | +|[Microsoft 365 Zero Trust deployment plan](../security/microsoft-365-zero-trust.md) | This article provides a deployment plan for building Zero Trust security with Microsoft 365. It includes a downloadable poster you can use to track your progress. | +|[Zero Trust Guidance Center](/security/zero-trust/) | Learn about the Zero Trust security model, its principles, and how to implement a Zero Trust architecture using the deployment plans. | |[docs.security.com/security](/security/) | Technical guidance from across Microsoft for security strategy and architecture. | | | | |