| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Add Users | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/add-users.md | Check out this video and others on our [YouTube channel](https://go.microsoft.co - **Domain** Choose the domain for the user's account. For example, if the user's username is Jakob, and the domain is contoso.com, they'll sign in by using jakob@contoso.com. - **Password settings** Choose to use the autogenerated password or to create your own strong password for the user. - The user must change their password after 90 days. Or you can choose to **Require this user to change their password when they first sign in**.- - Choose whether you want to send the password in email when the user is added. + - Choose whether you want to send the password in email when the user is added. 4. In the **Assign product licenses** pane, select the location and the appropriate license for the user. If you don't have any licenses available, you can still add a user and buy additional licenses. Expand **Apps** and select or deselect apps to limit the apps the user has a license for. Select **Next**. 5. In the **Optional settings** pane, expand **Roles** to make this user an admin. Expand **Profile info** to add additional information about the user. 6. Select **Next**, review your new user's settings, make any changes you like, then select **Finish adding**, then **Close**. If you're seeing this page in the admin center, you're on the **admin simplified ::: moniker-end -2. Select **Create an account for another person**. -3. On the **Add a user account** page, fill in the first and last name, display name, and username they'll use to sign in. -4. Add the email address of the user in the **Up to 5 email addresses...** text box. This will make sure the new user gets the information they need to sign into Microsoft 365 services. -5. Select **Add user** and **Download sign-in info** if you want to save this info. +2. Select **Add user**. You can select either the **Add user** button at the top of the page or in the **Users** tab under **Your organization**. +3. In the **Set up the basics** pane, fill in the basic user information, and then select **Next**. + - **Name** Fill in the first and last name, display name, and username. + - **Domain** Choose the domain for the user's account. For example, if the user's username is Jakob, and the domain is contoso.com, they'll sign in by using jakob@contoso.com. + - **Automatically create a password** Choose to use the autogenerated password or to create your own strong password for the user. + - The user must change their password after 90 days. Or you can choose to **Require this user to change their password when they first sign in**. + - Choose whether you want to send the password in email when the user is added. + - **Send password in email upon completion** - Choose whether you want to send the password in email when the user is added. +4. In the **Assign product licenses** pane, select the location and the appropriate license for the user. If you don't have any licenses available, you can still add a user and buy additional licenses. Expand **Apps** and select or deselect apps to limit the apps the user has a license for. Select **Next**. +5. In the **Optional settings** pane, expand **Roles** to make this user an admin. Expand **Profile info** to add additional information about the user. +6. Select **Next**, review your new user's settings, make any changes you like, then select **Finish adding**, then **Close**. ## Watch: Add multiple user |
| admin | Remove License From Shared Mailbox | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/email/remove-license-from-shared-mailbox.md | f1.keywords: - NOCSH - audience: Admin |
| admin | Minors And Acquiring Addins From The Store | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/minors-and-acquiring-addins-from-the-store.md | To be GDPR compliant for minors you need to ensure that one of following builds |Microsoft 365 Apps for enterprise (Current Channel)|9001.2138| |Microsoft 365 Apps for enterprise (Semi-Annual Enterprise Channel)|8431.2159| |Office 2016 for Windows|16.0.4672.1000|-|Office 2013 for Windows|15.0.5023.1000| |Office 2016 for Mac|16.11.18020200| |Office for the web|N/A| To be GDPR compliant for minors you need to ensure that one of following builds |Outlook mobile for Android|2.2.145| |Outlook.com|N/A| - **Office 2013 requirements** --Word, Excel, and PowerPoint 2013 for Windows will support the same minors checks if Active Directory Authentication Library (ADAL) is enabled. There are two options for compliance, as explained next. --- **Enable ADAL**. This article explains how to enable ADAL for Office 2013: [How modern authentication works for Office 2013, Office 2016, and Office 2019 client apps](../../enterprise/modern-auth-for-office-2013-and-2016.md).<br/>You also need to set the registry keys to enable ADAL as explained in [Enable Modern Authentication for Office 2013 on Windows devices](../security-and-compliance/enable-modern-authentication.md).<br/>Additionally, you need to install the following April updates for Office 2013:-- - [Description of the security update for Office 2013: April 10, 2018](https://support.microsoft.com/help/4018330/description-of-the-security-update-for-office-2013-april-10-2018) -- - [April 3, 2018, update for Office 2013 (KB4018333)](https://support.microsoft.com/help/4018333/april-3-2018-update-for-office-2013-kb4018333) --- **Don't enable ADAL**. If you're unable to enable ADAL in Office 2013, then our recommendation is to use Group Policy to turn off the Store for the Office apps. Information on how to turn off the app for Office settings is located [here](/previous-versions/office/office-2013-resource-kit/cc178992(v=office.15)).- ## Related articles [Deploy add-ins in the admin center](./manage-deployment-of-add-ins.md) |
| admin | Enable Modern Authentication | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/security-and-compliance/enable-modern-authentication.md | - Title: "Enable Modern authentication for Office 2013 on Windows devices"-- NOCSH--- Previously updated : 02/18/2020----- Tier2-- scotvorg-- M365-subscription-management-- Adm_O365-- Adm_TOC--- AdminSurgePortfolio-- okr_smb-- AdminTemplateSet-- BCS160-- MET150-- MOE150 -description: "Learn to set registry keys to enable modern authentication for devices that have Microsoft Office 2013 installed." ---# Enable Modern authentication for Office 2013 on Windows devices --Microsoft Office 2013 on Microsoft Windows computers supports Modern authentication. But, to turn it on, you need to configure the following registry keys: --|Registry key|Type|Value| -|:|::|::| -|HKEY_CURRENT_USER\Software\Microsoft\Exchange\AlwaysUseMSOAuthForAutoDiscover|REG_DWORD|1| -|HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Identity\EnableADAL|REG_DWORD|1| -|HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Identity\Version|REG_DWORD|1| --> [!NOTE] -> Modern authentication is already enabled in Office 2016 or later. You don't need to set these registry keys for later versions of Office. -->[!IMPORTANT] -> Basic authentication is turned off for Exchange Online mailboxes on Microsoft 365. This means that if Outlook 2013 is not configured to use modern authentication, it loses the ability to connect. For more information, see [Basic authentication in exchange online](https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-deprecation-in-exchange-online-september/ba-p/3609437). --## Software requirements --To enable MFA for Office 2013 client apps, you must have the following software installed (the version listed below, or a later version) based on whether you have a [Click-to-run based installation](http://howtomicrosoftofficetutorials.blogspot.com/2016/12/plan-for-multi-factor-authentication.html#bk_clicktorun) or an [MSI-based installation](http://howtomicrosoftofficetutorials.blogspot.com/2016/12/plan-for-multi-factor-authentication.html#bk_msi). --To determine whether your Office installation is Click-to-run or MSI-based: --1. Start Outlook 2013. -2. From the **File** menu, select **Office Account**. -3. For Outlook 2013 Click-to-Run installations, an **Update Options** item displays. For MSI-based installations, an **Update Options** item does not display. -- :::image type="content" source="../../security/defender-endpoint/images/office-2013-run-installation.png" alt-text="Screenshot of office 2013"::: --### Click-to-run installations --For Click-to-run installations, you must have the following files installed. If your file version is not equal to or greater than the file version listed, follow these steps below to update it. --|File name|Install path on your computer|File version| -|||| -|MSO.DLL|C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\MSO.DLL|15.0.4753.1001| -|CSI.DLLL|CSI.DLL C:\Program Files\Microsoft Office 15\root\office15\csi.dll|15.0.4753.1000| -|Groove.EXE*|C:\Program Files\Microsoft Office 15\root\office15\GROOVE.exe|15.0.4763.1000| -|Outlook.exe|C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.exe|15.0.4753.1002| -|ADAL.DLL|C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\ADAL.DLL|1.0.2016.624| -|Iexplore.exe|C:\Program Files\Internet Explorer|Varies| --\* If Groove.EXE isn't part of your Office installation, it doesn't need to be installed for the Azure Active Directory Authentication Library (ADAL) to work. However, if Groove.EXE is present, then the file version listed in the table is required. --### MSI-based installations --For MSI-based installations, you must have the following files installed. If your file version is not equal to or greater than the file version listed, use the link in the Where to get the update column to update it. --|File name|Install path on your computer|Where to get the update|Version| -||||| -|MSO.DLL|C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\MSO.DLL|[KB3085480](https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-office-2013-september-10-2019-0d171ba2-2eba-a2ca-a54d-c0f568de6bcc)|15.0.4753.1001| -|CSI.DLLL|CSI.DLL C:\Program Files\Microsoft Office 15\root\office15\csi.dll|[KB3172545](https://support.microsoft.com/en-us/topic/july-11-2017-update-for-office-2013-kb3172545-d6b47054-04d5-5154-40ba-3436d1e0efdb)|15.0.4753.1000| -|Groove.EXE*|C:\Program Files\Microsoft Office 15\root\office15\GROOVE.exe|[KB4022226](https://support.microsoft.com/en-us/topic/august-7-2018-update-for-onedrive-for-business-for-office-2013-kb4022226-6163bb26-cbde-eb16-ac42-abfda7afbf68)|15.0.4763.1000| -|Outlook.exe|C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.exe|[KB4484096](https://support.microsoft.com/en-us/topic/october-1-2019-update-for-outlook-2013-kb4484096-6513145a-cc75-1cd1-72b7-78cb62d8476b)|15.0.4753.1002| -|ADAL.DLL|C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\ADAL.DLL|[KB3085565](https://support.microsoft.com/en-us/topic/july-5-2016-update-for-office-2013-kb3085565-1d1a6d24-fbd4-1bae-242f-a35e0e2aba40)|1.0.2016.624| -|Iexplore.exe|C:\Program Files\Internet Explorer|[MS14-052](https://support.microsoft.com/en-us/topic/ms14-052-cumulative-security-update-for-internet-explorer-september-9-2014-17d29b71-9e78-0bc1-8961-7b812d04e4e1)|Not applicable| --\* If Groove.EXE isn't part of your Office installation, it doesn't need to be installed for the Azure Active Directory Authentication Library (ADAL) to work. However, if Groove.EXE is present, then the file version listed in the table is required. --## Enable modern authentication for Office 2013 clients --1. Close Outlook. --2. Copy and paste the following text into Notepad: -- ```text - Windows Registry Editor Version 5.00 -- [HKEY_CURRENT_USER\Software\Microsoft\Exchange] - "AlwaysUseMSOAuthForAutoDiscover"=dword:00000001 -- [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common] -- [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Identity] - "EnableADAL"=dword:00000001 - "Version"=dword:00000001 - ``` --3. Save the file with the file extension .reg instead of .txt in a location that's easy for you to find. For example, `C:\Data\Office2013_Enable_ModernAuth.reg`. --4. Open File Explorer (formerly known as Windows Explorer), browse to the location of the .reg file you just saved, and then double-click it. --5. In the **User account control** dialog that appears, click **Yes** to allow the app to make changes to your device. --6. In the **Registry Editor** warning dialog that appears, click **Yes** to accept the changes. --Once you've set the registry keys, you can set Office 2013 apps to use multifactor authentication (MFA) with Microsoft 365. For more information, see [Set up multifactor authentication](set-up-multi-factor-authentication.md). --If you're currently signed in to any of Office client apps, you need to sign out and sign back in for the change to take effect. Otherwise, the MRU and roaming settings will be unavailable until the identity is established. --## Disable modern authentication on devices --The procedure to disable modern authentication on a device is very similar, but fewer registry keys are required, and you need to set their values to 0. --|Registry key|Type|Value| -||::|::| -|HKEY_CURRENT_USER\Software\Microsoft\Exchange\AlwaysUseMSOAuthForAutoDiscover|REG_DWORD|0| -|HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Common\Identity\EnableADAL|REG_DWORD|0| --```text -Windows Registry Editor Version 5.00 --[HKEY_CURRENT_USER\Software\Microsoft\Exchange] -"AlwaysUseMSOAuthForAutoDiscover"=dword:00000000 --[HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common] --[HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Identity] -"EnableADAL"=dword:00000000 -``` --## Related content --[Sign in to Office 2013 with a second verification method](https://support.microsoft.com/office/2b856342-170a-438e-9a4f-3c092394d3cb) --[Outlook prompts for password and doesn't use Modern Authentication to connect to Office 365](/outlook/troubleshoot/authentication/outlook-prompt-password-modern-authentication-enabled) |
| admin | Set Up Multi Factor Authentication | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication.md | Check out this video and others on our [YouTube channel](https://go.microsoft.co - You must be a Global admin to manage MFA. For more information, see [About admin roles](../add-users/about-admin-roles.md). - If you have legacy per-user MFA turned on, [Turn off legacy per-user MFA](#turn-off-legacy-per-user-mfa).-- If you have Office 2013 clients on Windows devices, [turn on Modern Authentication for Office 2013 clients](./enable-modern-authentication.md). - Advanced: If you have third-party directory services with Active Directory Federation Services (AD FS), set up the Azure MFA Server. See [advanced scenarios with Azure AD Multifactor Authentication and third-party VPN solutions](/azure/active-directory/authentication/howto-mfaserver-nps-vpn) for more information. ### Turn off legacy per-user MFA |
| enterprise | Modern Auth For Office 2013 And 2016 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/modern-auth-for-office-2013-and-2016.md | The following table describes the authentication behavior for Office 2013, Offic ## See also -[Enable Modern Authentication for Office 2013 on Windows devices](../admin/security-and-compliance/enable-modern-authentication.md) - [Multi-factor authentication for Microsoft 365](../admin/security-and-compliance/multi-factor-authentication-microsoft-365.md) [Sign in to Microsoft 365 with multi-factor authentication](https://support.microsoft.com/office/sign-in-to-microsoft-365-with-multi-factor-authentication-2b856342-170a-438e-9a4f-3c092394d3cb) |
| security | Collect Diagnostic Data Update Compliance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/collect-diagnostic-data-update-compliance.md | Title: Collect diagnostic data for Update Compliance and Microsoft Defender Antivirus description: Use a tool to collect data to troubleshoot Update Compliance issues when using the Microsoft Defender Antivirus Assessment add-in. -keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender AV, Microsoft Defender Antivirus -search.product: eADQiWindows 10XVcnh -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium Previously updated : 09/03/2018- Last updated : 08/22/2023+ search.appverid: met150 - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) -This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Microsoft Defender Antivirus Assessment section in the Update Compliance add-in. +This article describes how to collect diagnostic data that's used by Microsoft support and engineering teams when they help with troubleshooting issues with Microsoft Defender Antivirus. > [!NOTE] > For performance-specific issues related to Microsoft Defender Antivirus, see: [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md). Before attempting this process, ensure you have read [Troubleshoot Microsoft Defender Antivirus reporting](troubleshoot-reporting.md), met all require prerequisites, and taken any other suggested troubleshooting steps. -On at least two devices that are not reporting or showing up in Update Compliance, obtain the .cab diagnostic file by taking the following steps: +## Obtain the diagnostic file -1. Open an administrator-level version of the command prompt as follows: +On at least two devices that aren't reporting or showing up in Update Compliance, obtain the `.cab` diagnostic file by taking the following steps: ++1. Open Command Prompt as an administrator by following these steps: a. Open the **Start** menu. On at least two devices that are not reporting or showing up in Update Complianc c. Specify administrator credentials or approve the prompt. -2. Navigate to the Windows Defender directory. By default, this is `C:\Program Files\Windows Defender`. +2. Navigate to the Windows Defender directory. By default, it's `C:\Program Files\Windows Defender`. 3. Type the following command, and then press **Enter** On at least two devices that are not reporting or showing up in Update Complianc mpcmdrun -getfiles ``` -4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt. By default, the location is `C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab`. +4. A `.cab` file is generated that contains various diagnostic logs. The location of the file is specified in the output in the command prompt. By default, the location is `C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab`. -5. Copy these .cab files to a location that can be accessed by Microsoft support. An example could be a password-protected OneDrive folder that you can share with us. +5. Copy the `.cab` files to a location that can be accessed by Microsoft support. An example could be a password-protected OneDrive folder that you can share. 6. Send an email using the <a href="mailto:ucsupport@microsoft.com?subject=MDAV assessment issue&body=I%20am%20encountering%20the%20following%20issue%20when%20using%20Windows%20Defender%20AV%20in%20Update%20Compliance%3a%20%0d%0aI%20have%20provided%20at%20least%202%20support%20.cab%20files%20at%20the%20following%20location%3a%20%3Caccessible%20share%2c%20including%20access%20details%20such%20as%20password%3E%0d%0aMy%20OMS%20workspace%20ID%20is%3a%20%0d%0aPlease%20contact%20me%20at%3a">update compliance support email template</a>, and fill out the template with the following information: |
| security | Collect Diagnostic Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/collect-diagnostic-data.md | Title: Collect diagnostic data of Microsoft Defender Antivirus description: Use a tool to collect data to troubleshoot Microsoft Defender Antivirus -keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender av, group policy object, setting, diagnostic data, Microsoft Defender Antivirus -search.product: eADQiWindows 10XVcnh -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium Previously updated : 06/29/2020- Last updated : 08/22/2023+ search.appverid: met150 - [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037) - [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) -This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you might encounter when using the Microsoft Defender Antivirus. +This article describes how to collect diagnostic data that's used by Microsoft support and engineering teams when they help troubleshoot issues with Microsoft Defender Antivirus. > [!NOTE] > As part of the investigation or response process, you can collect an investigation package from a device. Here's how: [Collect investigation package from devices](/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#collect-investigation-package-from-devices). > > For performance-specific issues related to Microsoft Defender Antivirus, see: [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md). -On at least two devices that are experiencing the same issue, obtain the .cab diagnostic file by taking the following steps: +## Get the diagnostic files -1. Open an administrator-level version of the command prompt as follows: +On at least two devices that are experiencing the same issue, obtain the `.cab` diagnostic file by taking the following steps: ++1. Open Command Prompt as an administrator by following these steps: a. Open the **Start** menu. On at least two devices that are experiencing the same issue, obtain the .cab di c. Specify administrator credentials or approve the prompt. -2. Navigate to the directory for Microsoft Defender Antivirus. By default, this is `C:\Program Files\Windows Defender`. +2. Navigate to the directory for Microsoft Defender Antivirus. By default, it's `C:\Program Files\Windows Defender`. > [!NOTE]- > If you're running an [updated Microsoft Defender antimalware platform version](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform), please run `MpCmdRun` from the following location: `C:\ProgramData\Microsoft\Windows Defender\Platform\<version>`. + > If you're running an [updated Microsoft Defender antimalware platform version](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform), run `MpCmdRun` from the following location: `C:\ProgramData\Microsoft\Windows Defender\Platform\<version>`. 3. Type the following command, and then press **Enter** On at least two devices that are experiencing the same issue, obtain the .cab di mpcmdrun.exe -GetFiles ``` -4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt. By default, the location is `C:\ProgramData\Microsoft\Microsoft Defender\Support\MpSupportFiles.cab`. +4. A `.cab` file is generated that contains various diagnostic logs. The location of the file is specified in the output in the command prompt. By default, the location is `C:\ProgramData\Microsoft\Microsoft Defender\Support\MpSupportFiles.cab`. > [!NOTE] > To redirect the cab file to a different path or UNC share, use the following command: To collect diagnostic data on a central repository, you can specify the SupportL mpcmdrun.exe -GetFiles -SupportLogLocation <path> ``` -Copies the diagnostic data to the specified path. If the path is not specified, the diagnostic data will be copied to the location specified in the Support Log Location Configuration. +Copies the diagnostic data to the specified path. If the path isn't specified, the diagnostic data is copied to the location specified in the Support Log Location Configuration. When the SupportLogLocation parameter is used, a folder structure like as follows will be created in the destination path: When the SupportLogLocation parameter is used, a folder structure like as follow <path>\<MMDD>\MpSupport-<hostname>-<HHMM>.cab ``` -<br> --**** - |field|Description| ||| |path|The path as specified on the command line or retrieved from configuration| |MMDD|Month and day when the diagnostic data was collected (for example, 0530)| |hostname|The hostname of the device on which the diagnostic data was collected| |HHMM|Hours and minutes when the diagnostic data was collected (for example, 1422)|-| > [!NOTE] > When using a file share please make sure that account used to collect the diagnostic package has write access to the share. ## Specify location where diagnostic data is created -You can also specify where the diagnostic .cab file will be created using a Group Policy Object (GPO). +You can also specify where the diagnostic `.cab` file is created using a Group Policy Object (GPO). 1. Open the Local Group Policy Editor and find the SupportLogLocation GPO at: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SupportLogLocation`. You can also specify where the diagnostic .cab file will be created using a Grou 4. Specify the directory path where you want to copy the support log files in the **Options** field. :::image type="content" source="images/GPO3-SupportLogLocationGPPageEnabledExample.png" alt-text="The Enabled directory path custom setting" lightbox="images/GPO3-SupportLogLocationGPPageEnabledExample.png":::+ 5. Select **OK** or **Apply**. > [!TIP] You can also specify where the diagnostic .cab file will be created using a Grou - [Troubleshoot Microsoft Defender Antivirus reporting](troubleshoot-reporting.md) - [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md)+ [!INCLUDE [Microsoft Defender for Endpoint Tech Community](../../includes/defender-mde-techcommunity.md)] |
| security | Device Control Removable Storage Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-control-removable-storage-protection.md | Title: Microsoft Defender for Endpoint Device Control Removable Storage Protection -description: Understand the `capabilities that help prevent user or machine or both from using unauthorized removable storage media -keywords: removable storage media +description: Understand capabilities that help prevent user or machine or both from using unauthorized removable storage media -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium Previously updated : 08/01/2022 Last updated : 08/22/2023 audience: ITPro search.appverid: met150 Device control removable storage protection in Microsoft Defender for Endpoint prevents users, endpoints, or both from using unauthorized removable storage media. -## Protection policies --### Removable storage access control +## Removable storage access control **Capabilities** Device control removable storage protection in Microsoft Defender for Endpoint p To manage external storage, use removable storage access control instead of [device installation](#device-installation). -**Windows 10 and Windows 11 support details**: +**Windows 10 and Windows 11 support details** - Applied at either the device level, user level. or both. Only allow specific people performing Read/Write/Execute access to specific removable storage on specific machine. - Support Intune OMA-URI and GPO. - For Windows devices, see [Removable storage Access Control](device-control-removable-storage-access-control.md). -**Supported Platform** - Windows 10, Windows 11 +**Supported Platform** -**macOS support details**: +- Windows 10, Windows 11 ++**macOS support details** - Applied at the device level: the same policy applies for any logged on user. - For macOS specific information, see [Device control for macOS](mac-device-control-overview.md). -**Supported platform** - macOS 11 (Big Sur) or later +**Supported platform** +- macOS 11 (Big Sur) or later -### Device installation +## Device installation **Capabilities** - Prevent installation with or without exclusion based on various device properties. To manage external storage, use removable storage access control instead of [dev - Supports Microsoft Configuration Manager and Group Policy Objects. - For more information on Windows, see [How to control USB devices and other removable media using Microsoft Defender for Endpoint](control-usb-devices-using-intune.md). -**Supported Platform** - Windows 10, Windows 11 +**Supported Platform** ++- Windows 10, Windows 11 -**macOS support details**: +**macOS support details** - Applied at the device level: the same policy applies for any logged on user - For macOS specific information, see [Device control for macOS](mac-device-control-overview.md). -**Supported platform** - macOS 11 (Big Sur) or later +**Supported platform** ++- macOS 11 (Big Sur) or later ++## Endpoint DLP Removable storage ++**Capabilities** -### Endpoint DLP Removable storage +- Audit, warn, or prevent a user from copying an item or information to removable media or USB device. -**Capabilities** - Audit, warn, or prevent a user from copying an item or information to removable media or USB device. +**Description** -**Description** - For more information on Windows, see [Learn about Endpoint data loss prevention](../../compliance/endpoint-dlp-learn-about.md). +- See [Learn about Endpoint data loss prevention](../../compliance/endpoint-dlp-learn-about.md). -**Supported Platform** - Windows 10, Windows 11 +**Supported Platform** -### BitLocker +- Windows 10, Windows 11 -**Capabilities**: +## BitLocker ++**Capabilities** - Block data to be written to removable drives that aren't BitLocker protected. - Block access to removable drives unless they were encrypted on a computer owned by your organization -**Description** - For more information on Windows, see [BitLocker - Removable Drive Settings](/mem/intune/protect/endpoint-security-disk-encryption-profile-settings). +**Description** ++- See [BitLocker - Removable Drive Settings](/mem/intune/protect/endpoint-security-disk-encryption-profile-settings). ++**Supported Platform** ++- Windows 10, Windows 11 + -**Supported Platform** - Windows 10, Windows 11 [!INCLUDE [Microsoft Defender for Endpoint Tech Community](../../includes/defender-mde-techcommunity.md)] |
| security | Indicator File | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/indicator-file.md | Cert and File IoC policy handling conflict will follow the below order: - If the file isn't allowed by Windows Defender Application Control and AppLocker enforce mode policy/policies, then **Block** - Else if the file is allowed by the Microsoft Defender Antivirus exclusion, then **Allow** - Else if the file is blocked or warned by a block or warn file IoC, then **Block/Warn**+- Else if the file is blocked by SmartScreen, then **Block** + - Else if the file is allowed by an allow file IoC policy, then **Allow**-- Else if the file is blocked by ASR rules, CFA, AV, SmartScreen, then **Block**++- Else if the file is blocked by ASR rules, CFA, AV, then **Block** + - Else **Allow** (passes Windows Defender Application Control & AppLocker policy, no IoC rules apply to it) > [!NOTE] Microsoft Defender Vulnerability Management's block vulnerable application featu - [Create indicators for IPs and URLs/domains](indicator-ip-domain.md) - [Create indicators based on certificates](indicator-certificates.md) - [Manage indicators](indicator-manage.md)+ - [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md)+ [!INCLUDE [Microsoft Defender for Endpoint Tech Community](../../includes/defender-mde-techcommunity.md)]+ |
| security | Mde Plan1 Getting Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mde-plan1-getting-started.md | Title: Get started with Microsoft Defender for Endpoint Plan 1 -description: Get started using Defender for Endpoint Plan 1. Learn how to use the Defender for Cloud, manage alerts and devices, and view reports. +description: Get started using Defender for Endpoint Plan 1. Learn how to use the Microsoft 365 Defender portal, manage alerts and devices, and view reports. search.appverid: MET150 audience: ITPro Previously updated : 01/27/2022 Last updated : 08/22/2023 ms.localizationpriority: medium The Microsoft 365 Defender portal ([https://security.microsoft.com](https://secu ## The Microsoft 365 Defender portal -The Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) is where you'll view alerts, manage devices, and view reports. When you sign into the Microsoft 365 Defender portal, you'll start with the Home page, as shown in the following image: +The Microsoft 365 Defender portal ([https://security.microsoft.com](https://security.microsoft.com)) is where you view alerts, manage devices, and view reports. When you sign into the Microsoft 365 Defender portal, you start with the **Home** page, which resembles the following image: :::image type="content" source="../../medie-p1/m365-defender-portal.png"::: -The Home page provides your security team with a snapshot aggregate view of alerts, device status, and threats detected. The Defender for Cloud is set up so that your security operations team can find the information they are looking for quickly and easily. +The Home page provides your security team with a snapshot aggregate view of alerts, device status, and threats detected. Microsoft 365 Defender is set up so that your security operations team can find the information they're looking for quickly and easily. > [!NOTE] > Our examples shown in this article might differ from what you see in your Microsoft 365 Defender portal. What you see in your portal depends on your licenses and permissions. In addition, your security team can customize your organization's portal by adding, removing, and rearranging cards. The navigation bar on the left side of the screen enables you to move easily bet | **Incidents & alerts** | Expands to show **Incidents** and **Alerts**. | | **Incidents & alerts** > **Incidents** | Navigates to the **Incidents** list. Incidents are created when alerts are triggered and/or threats are detected. By default, the **Incidents** list displays data for the last 30 days, with the most recent incident listed first. <br/><br/> To learn more, see [Incidents](view-incidents-queue.md). | | **Incidents & alerts** > **Alerts** | Navigates to the **Alerts** list (also referred to as the **Alerts queue**). Alerts are triggered when a suspicious or malicious file, process, or behavior is detected. By default, the **Alerts** list displays data for the last 30 days, with the most recent alert listed first. <br/><br/> To learn more, see [Alerts](alerts-queue.md). |-| **Action center** | Navigates to the Action center, which tracks remediation and manual response actions. The Action center tracks activities like these: <br/>- Microsoft Defender Antivirus encounters a malicious file and then blocks/removes that file. <br/>- Your security team isolates a device.<br/>- Defender for Endpoint detects and quarantines a file. <br/><br/> To learn more, see [Action center](auto-investigation-action-center.md). | +| **Incidents & alerts** > **Email & collaboration alerts** | If your subscription includes [Microsoft Defender for Office 365](../office-365-security/microsoft-defender-for-office-365-product-overview.md), alerts are generated when potential threats are detected in email and Office files. | +| **Actions & submissions** > **Action center** | Navigates to the Action center, which tracks remediation and manual response actions. The Action center tracks activities like these: <br/>- Microsoft Defender Antivirus encounters a malicious file and then blocks/removes that file. <br/>- Your security team isolates a device.<br/>- Defender for Endpoint detects and quarantines a file. <br/><br/> To learn more, see [Action center](auto-investigation-action-center.md). | +| **Actions & submissions** > **Submissions** | Navigates to the unified submissions portal, where admins can submit files to Microsoft for review. <br/><br/>To learn more, see [Submit files in Microsoft Defender for Endpoint](admin-submissions-mde.md). | | **Secure score** | Displays a representation of your organization's security posture along with a list of recommended actions and metrics. <br/><br/> To learn more, see [Microsoft Secure Score](../defender/microsoft-secure-score.md). | | **Learning hub** | Navigates to a list of learning paths that you can access to learn more about Microsoft 365 security capabilities. |-| **Endpoints** > **Search** | Navigates to a page where you can search for specific devices by device name. In the list of results, you can see details, such as risk level and health state, at a glance. | -| **Endpoints** > **Device inventory** | Navigates to your list of devices that are onboarded to Defender for Endpoint. Provides information about devices, such as their exposure and risk levels. <br/><br/> To learn more, see [Device inventory](machines-view-overview.md). | -| **Endpoints** > **Configuration & baselines** | Expands to show **Security baselines** and **Configuration management**. | -| **Endpoints** > **Configuration & baselines** > **Security baselines** | Security baselines are pre-configured policies and groups of settings that can help you apply recommended security settings efficiently and effectively. Baselines include settings that are based on industry best practices. You can keep the default settings, or customize your baselines to suit your organization's needs. <br/><br/> To learn more, see [Use security baselines to configure Windows 10 devices in Intune](/mem/intune/protect/security-baselines). | -| **Endpoints** > **Configuration & baselines** > **Configuration management** | Navigates to the **Device configuration management** page, where you can view information about onboarded devices, and take steps to onboard more devices. | +| **Trials** | Navigates to a list of free Microsoft 365 trial subscriptions you can start. Starting a trial helps you make informed decisions about purchases or upgrades. Certain terms and conditions apply. See [Microsoft 365 trial terms and conditions](https://go.microsoft.com/fwlink/?linkid=2194722). | +| **Partner catalog** | If you're looking for a Microsoft partner to help you with your security and other settings, check out the lists of partners in this catalog. | +| **Assets** > **Devices** | Navigates to your list of devices that are onboarded to Defender for Endpoint. Provides information about devices, such as their exposure and risk levels. <br/><br/> To learn more, see [Device inventory](machines-view-overview.md). | +| **Endpoints** > **Configuration management** > **Dashboard** | Navigates to a dashboard with cards that show your current security state with links to improve your score, set up your capabilities, onboard devices, and learn more about your capabilities. | | **Reports** | Navigates to your reports, such as your [Threat protection report](threat-protection-reports.md), [Device health and compliance report](device-health-reports.md) and your [Web protection report](web-protection-overview.md). | | **Health** | Includes links to the **Service health** and **Message center**. | | **Health** > **Service health** | Navigates to the Service health page in the Microsoft 365 admin center. This page enables you to view health status across all the services available with your organization's subscriptions. | Use the **Alerts**, **Devices**, and **Users** tabs to view more information, su ## Manage devices -To view and manage your organization's devices, in the navigation bar, under **Endpoints**, select **Device inventory**. You'll see a list of devices as shown in the following image: ---The list includes devices for which alerts were generated. By default, the data shown is for the past 30 days, with the most recent items listed first. Select a device to view more information about it. A flyout pane opens, as shown in the following image: +To view and manage your organization's devices, in the navigation bar, under **Assets**, select **Devices**. You see a list of devices. The list includes devices for which alerts were generated. By default, the data shown is for the past 30 days, with the most recent items listed first. Select a device to view more information about it. A flyout pane opens, as shown in the following image: :::image type="content" source="../../medie-p1/device-inventory-selecteddevice.png"::: In Defender for Endpoint Plan 1, several reports are available in the Microsoft 2. In the navigation bar, choose **Reports**. -3. Select a report in the list. You'll see the following three reports: +3. Select a report in the list. Reports include: - Threat protection report - Device health report Scroll down to see all the views in the Web protection report. Some views includ - [Manage Microsoft Defender for Endpoint Plan 1](manage-mde-post-migration.md) - [Microsoft Defender for Endpoint](microsoft-defender-endpoint.md)+ [!INCLUDE [Microsoft Defender for Endpoint Tech Community](../../includes/defender-mde-techcommunity.md)] |
| security | Fixed Reported Inaccuracies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/fixed-reported-inaccuracies.md | The report inaccuracy capabilities provides a way to report false positive, inac You can use this article to find details on the inaccuracies that have been reported and are now fixed. The following tables present the fixed inaccuracies organized by month: +## August 2023 ++Inaccuracy report ID |Description |Fix date | +|:|:|:| +| - |Fixed inaccuracy in Acrobat Reader DC| 02-Aug-23 +|29672 |Fixed inaccuracy in RedHat Kernel Devel and CentOS Kernel Devel| 03-Aug-23 +| - |Fixed inaccuracy in NetScaler Gateway Plugin| 03-Aug-23 +| - |Added Microsoft Defender Vulnerability Management support for Azul products| 09-Aug-23 +|30082 |Fixed inaccuracy in CVE-2022-43946| 09-Aug-23 +| - |Added accurate EOS details for Outlook (2010 & 2013) and Office build versions(2304,2305,1902,1908,2008,2202)| 10-Aug-23 +|30002 |Fixed inaccuracy in KeePass versions| 10-Aug-23 +| - |Added MDVM support to ODBC and OLEDB| 10-Aug-23 +|29552 |Fixed inaccuracy in Dell Command Update| 14-Aug-23 ++ ## July 2023 Inaccuracy report ID |Description |Fix date | |:|:|:| |24162 |Fixed inaccuracy in MYSQL Workbench| 04-Jul-23-|25736 | Fixed inaccuracy in Keepass | 04-Jul-23 +|25736 | Fixed inaccuracy in KeePass | 04-Jul-23 |24598 | Fixed inaccuracy in Adobe Flash Player plugins |04-Jul-23 | - |Defender Vulnerability Management doesn't currently support assessment for these Lenovo CVEs: </br> CVE-2021-3519, CVE-2021-22499, CVE-2021-22500, CVE-2021-22514| 03-Jul-23 | - |Added Microsoft Defender Vulnerability Management support for Arcserve UDP | 05-Jul-23 |
| security | Email Authentication Dmarc Reports | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/email-authentication-dmarc-reports.md | The only exception is where the MX record for the recipient domain doesn't direc But if the contoso.com domain's MX record points to a *different email security solution* that sits in front of Office 365, then *no DMARC aggregate reports are sent to any sender domain's rua address* (configured in their DMARC record). This is because information about the sending infrastructure is likely affected by the complex mail flow routing. +> [!NOTE] +> Microsoft currently has no plans to send forensic reports (ruf). + ## What DMARC Reports do for you It's recommended that admins set up and regularly review DMARC Reporting in their domain. Ultimately the value of your DMARC investment, how effectively it's working, and [**DMARC**](email-authentication-dmarc-configure.md) email authentication's goal is to make sure that SPF and DKIM information matches the From address. -[**Use trusted ARC Senders for legitimate mailflows**](use-arc-exceptions-to-mark-trusted-arc-senders.md) +[**Use trusted ARC Senders for legitimate mailflows**](use-arc-exceptions-to-mark-trusted-arc-senders.md) |
| security | Identity Access Prerequisites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/identity-access-prerequisites.md | The following email clients support modern authentication and Conditional Access |Platform|Client|Version/Notes| ||||-|**Windows**|Outlook|2019, 2016, 2013 <p> [Enable modern authentication](../../admin/security-and-compliance/enable-modern-authentication.md) <p> [Required updates](https://support.office.com/article/Outlook-Updates-472c2322-23a4-4014-8f02-bbc09ad62213)| +|**Windows**|Outlook|2019, 2016<p>[Required updates](https://support.office.com/article/Outlook-Updates-472c2322-23a4-4014-8f02-bbc09ad62213)| |**iOS**|Outlook for iOS|[Latest](https://itunes.apple.com/us/app/microsoft-outlook-email-and-calendar/id951937596?mt=8)| |**Android**|Outlook for Android|[Latest](https://play.google.com/store/apps/details?id=com.microsoft.office.outlook&hl=en)| |**macOS**|Outlook|2019 and 2016| |
| syntex | Esignature Setup | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/esignature-setup.md | You must have Global admin or SharePoint admin permissions to be able to access 3. On the **Manage Microsoft Syntex** page, select **Syntex eSignature**. -4. On the **Syntex eSignature** page, select **Turn on**. +4. By default, the Syntex eSignature service is turned on. On the **Syntex eSignature** page: ++ - To turn off the service, select **Turn off**. + - To manage which sites the service is available, see [Manage sites](#manage-sites). ### Manage sites By default, Syntex eSignature is turned on for libraries in all SharePoint sites a. Choose which site or sites this service should be enabled for. - b. To restrict user access to this service, select **No SharePoint libraries** or **Libraries in selected SharePoint sites** and follow the instructions to either select the sites or upload a CSV listing a maximum of 100 sites. Be sure to add your content center site if you want it to be included. You can then manage site access permissions for the sites you selected. + b. To restrict user access to this service, select **No SharePoint libraries** or **Libraries in selected sites** and follow the instructions to either select the sites or upload a CSV listing a maximum of 100 sites. Be sure to add your content center site if you want it to be included. You can then manage site access permissions for the sites you selected. c. Select **Save**.-+<! ### Turn off Syntex eSignature 1. On the **Manage Microsoft Syntex** page, select **Syntex eSignature**. 2. On the **Turn off Syntex eSignature** page, select **Turn off**.-+> ## Document storage and retention ### Document storage |