| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Idle Session Timeout Web Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/manage/idle-session-timeout-web-apps.md | When a user has been inactive in Microsoft 365 web apps for the time period you - Users must be inactive on all Microsoft 365 web app tabs for the configured duration. If the user is active on one tab (say OWA) while being inactive on another tab (say SPO), they will be considered active and will not be signed out. - Users wonΓÇÖt get signed out in these cases.- - If they get single sign-on (SSO) into the web app from the device joined account or selected **Stay signed in** at the time of sign-in. For more info on hiding this option for your organization, see [Add branding to your organization's sign-in page](/azure/active-directory/fundamentals/customize-branding). - - If they're on a managed device (one that is compliant or joined to a domain) and using a supported browser like Microsoft Edge or Google Chrome (with the [Windows Accounts extension](https://chrome.google.com/webstore/detail/windows-accounts/ppnbnpeolgkicgegkbkbjmhlideopiji)). For this feature to trigger on an unmanaged device, an eligible Azure AD Premium P1 or P2 subscription, and a specific Conditional Access policy, is required. See below for further details. + - If they get single sign-on (SSO) into the web app from the device joined account. + - If they selected **Stay signed in** at the time of sign-in. For more info on hiding this option for your organization, see [Add branding to your organization's sign-in page](/azure/active-directory/fundamentals/customize-branding). + - If they're on a managed device (one that is compliant or joined to a domain) and using a supported browser like Microsoft Edge or Google Chrome (with the [Windows Accounts extension](https://chrome.google.com/webstore/detail/windows-accounts/ppnbnpeolgkicgegkbkbjmhlideopiji)). ++## Trigger idle session timeout only on unmanaged devices ++By default, the idle session timeout feature triggers on all device types if the other conditions are met. For this feature to trigger only on an unmanaged device, an eligible Azure AD Premium P1 or P2 subscription is required. You'll also need to add a Conditional Access policy in the Azure AD admin center. ## Idle session timeout on unmanaged devices |
| admin | Secure Your Business Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/security-and-compliance/secure-your-business-data.md | Title: Best practices for securing Microsoft 365 for business + Title: Top 10 ways to secure your business data - Best practices for small and medium-sized businesses f1.keywords: - CSH audience: Admin ms.localizationpriority: medium Last updated : 08/23/2022 - Adm_O365 - Adm_TOC ms.assetid: de2da300-dbb6-4725-bb12-b85a9d296e75 description: "Protect your business email and data from cyberthreats, including ransomware, phishing, and malicious attachments." -# Best practices for securing Microsoft 365 for business +# Top 10 ways to secure your data - Best practices for small and medium-sized businesses -Check out [Microsoft 365 small business help](https://go.microsoft.com/fwlink/?linkid=2197659) on YouTube. +**Applies to** -If you are a small or medium-size organization using one of Microsoft's business plans, the guidance in this article helps you tighten the security of your organization. Among your choices, Microsoft 365 Business Premium leads the way since it now includes Microsoft Defender for Business and other [security protections](../../business-premium/get-microsoft-365-business-premium.md). The recommended actions included here will help you achieve the goals described in the Harvard Kennedy School [Cybersecurity Campaign Handbook](https://go.microsoft.com/fwlink/p/?linkid=2015598). +- Microsoft 365 Business Basic +- Microsoft 365 Business Standard +- Microsoft 365 Business Premium -> [!TIP] -> If you need help with the steps in this article, consider [working with a Microsoft small business specialist](https://go.microsoft.com/fwlink/?linkid=2186871). With Business Assist, you and your employees get around-the-clock access to small business specialists as you grow your business, from onboarding to everyday use. --## Watch: A quick overview of security --Check out this video and others on our [YouTube channel](https://go.microsoft.com/fwlink/?linkid=2198012). --> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4mzxI?autoplay=false] --All the Microsoft 365 plans offer baseline protection and security with Microsoft Defender Antivirus, but with Microsoft 365 Business Premium you also have threat protection, data protection, and device management features due to the inclusion of Microsoft Defender for Business. These additional capabilities protect your organization from online threats and unauthorized access, as well as allow you to manage company data on your phones, tablets, and computers. --## Security features comparison --To learn about one of the service plan features, click on the heading in the following table. --|Task|Microsoft 365 Business Standard|Microsoft 365 Business Premium| -|||| -[Protect against lost or stolen passwords](#set-up-multi-factor-authentication) |  |  | -[Train your users](#train-your-users) |  |  | -[Use dedicated admin accounts](#use-dedicated-admin-accounts)| |  | -[Protect against malware](#protect-against-malware) |  <br/>(protection for email) |  <br/>(increased protection for email and devices) | -[Protect against ransomware](#protect-against-ransomware) |  <br/>(protection for email and cloud storage) |  <br/>(increased protection for devices, email, and cloud storage) | -[Encrypt sensitive emails](#send-encrypted-email) |  |  | -[Protect your email from phishing attacks](#protect-sensitive-emails) |  <br/>(anti-phishing protection) |  <br/>(advanced anti-phishing protection) | -[Protect against malicious attachments, files, and URLs in email and Office files](#protect-against-malicious-attachments-files-and-urls) | |  <br/>(Safe Links and Safe Attachments) | -[Increase protection for your organization's devices](#increase-protection-for-your-organizations-devices) | |  <br/>(enterprise-grade device protection) | --You can quickly set up security and begin collaborating safely with the guidance we provide in the [Microsoft 365 Business Premium](../../business-premium/index.md) library. The Business Premium information was developed in partnership with the Microsoft Defending Democracy team to protect all small business customers against cyber threats launched by sophisticated cyber attacks and hackers. --### About the Microsoft 365 Secure Score --It's important that before you begin, you check your [Microsoft 365 Secure Score](../../security/defender/microsoft-secure-score.md) in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. From a centralized dashboard, you can monitor and improve the security for your Microsoft 365 identities, data, apps, devices, and infrastructure. You are given points for configuring recommended security features, performing security-related tasks (such as viewing reports), or addressing recommendations with a third-party application or software. With added insights and more visibility into a broader set of Microsoft products and services, you can feel confident reporting about your organization's security health. -- --## Set up multi-factor authentication --Protect against lost or stolen passwords by using multi-factor authentication (MFA). When multi-factor authentication is set up, it requires people to use a code on their phone to sign into Microsoft 365. This extra step can prevent hackers from taking over if they know your password. --Multi-factor authentication is also called 2-step verification. Individuals can add 2-step verification to most accounts easily, for example, to their Google or Microsoft accounts. Here's how to [add two-step verification to your personal Microsoft account](https://go.microsoft.com/fwlink/p/?linkid=2016403). --For businesses using Microsoft 365, add a setting that requires your users to log in using multi-factor authentication. When you make this change, users will be prompted to set up their phone for two-factor authentication next time they log in. -To see a training video for how to set up MFA and how users complete the setup, see [set up MFA](set-up-multi-factor-authentication.md) and [user set up](https://support.microsoft.com/office/ace1d096-61e5-449b-a875-58eb3d74de14). --### Turn on security defaults --For most organizations, security defaults offer a good level of added sign-in security. For more information, see [What are security defaults?](/azure/active-directory/fundamentals/concept-fundamentals-security-defaults). If your subscription is new, security defaults might already be turned on for you automatically. --Enable or disable security defaults from the **Properties** pane for Azure Active Directory (Azure AD) in the Azure portal. --1. Sign in to the [Microsoft 365 admin center](https://admin.microsoft.com) with global admin credentials. --2. In the left nav choose **Show All** and under **Admin centers**, choose **Azure Active Directory**. --3. In the **Azure Active Directory admin center**, choose **Azure Active Directory** > **Properties**. --4. At the bottom of the page, choose **Manage Security defaults**. --5. Choose **Yes** to enable security defaults or **No** to disable security defaults, and then choose **Save**. --After you set up multi-factor authentication for your organization, your users will be required to set up two-step verification on their devices. For more information, see [Set up 2-step verification for Microsoft 365](https://support.microsoft.com/office/ace1d096-61e5-449b-a875-58eb3d74de14). --> [!Tip] -> If you need more granular control of multi-factor authentication, you can enable Conditional Access with Microsoft 365 Business Premium. If you do this, we recommend implementing the equivalent policies to Security Defaults. Go here for more information about [security defaults](/microsoft-365/business-premium/m365bp-conditional-access). --For more details and recommendations, see [Set up multi-factor authentication for users](set-up-multi-factor-authentication.md). --## Train your users --The Harvard Kennedy School [Cybersecurity Campaign Handbook](https://go.microsoft.com/fwlink/p/?linkid=2015598) provides excellent guidance on establishing a strong culture of security awareness within your organization, including training users to identify phishing attacks. --In addition, Microsoft recommends that your users take the actions described in this article: [Protect your account and devices from hackers and malware](https://support.microsoft.com/office/066d6216-a56b-4f90-9af3-b3a1e9a327d6). These actions include: --- Using strong passwords-- Protecting devices-- Enabling security features on Windows 10 and Mac PCs--Microsoft also recommends that users protect their personal email accounts by taking the actions recommended in the following articles: --- [Help protect your Outlook.com email account](https://support.microsoft.com/office/a4f20fc5-4307-4ece-8231-6d4d4bd8a9ba)--- [Protect your Gmail account with 2-step verification](https://go.microsoft.com/fwlink/p/?linkid=2015688&)--## Use dedicated admin accounts --The administrative accounts you use to administer your Microsoft 365 environment include elevated privileges. These are valuable targets for hackers and cyber attackers. Use admin accounts only for administration. Admins should have a separate user account for regular, non-administrative use and only use their administrative account when necessary to complete a task associated with their job function. Additional recommendations: --- Be sure accounts are added to [Azure Active Directory](../../admin/add-users/add-users.md).-- Be sure admin accounts are also set up for multi-factor authentication.-- Before using admin accounts, close out all unrelated browser sessions and apps, including personal email accounts.-- After completing admin tasks, be sure to log out of the browser session.--## Protect against malware --Your Microsoft 365 environment includes protection against malware. You can increase your malware protection by: --- Using [pre-set policies for Microsoft Office 365](../../../microsoft-365/security/office-365-security/preset-security-policies.md).-- Blocking attachments with certain file types.-- Using antivirus/anti-malware protection on your devices, especially Microsoft Defender for Business. It includes features such as [automated investigative reporting](../../security/office-365-security/air-view-investigation-results.md) (AIR) and the Microsoft Defender Vulnerability Management (MDVM) Dashboard. When Microsoft Defender for Business is not your primary anti-virus software, you can still run it in passive mode and use [endpoint protection and response (EDR)](../../security/defender-endpoint/overview-endpoint-detection-response.md), especially in [block mode](../../security/defender-endpoint/edr-in-block-mode.md) where it works behind the scenes to remediate malicious artifacts that were detected by EDR's capabilities, and missed by the primary virus detector software.--### Block attachments with certain file types --You can increase your malware protection by blocking attachments with file types that are commonly used for malware. To bump up malware protection in email, view [Watch: Raise the level of protection against malware in mail](increase-threat-protection.md#watch-raise-the-level-of-protection-against-malware-in-mail), or complete the following steps: --1. In the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, go to **Email & collaboration** \> **Policies & rules** \> **Threat policies** \> **Anti-malware** in the **Policies** section. -2. On the **Anti-malware** page, double-click on **Default**. A flyout appears. -3. Select **Edit protection settings** at the bottom of the flyout. -4. In the next page, under **Protection settings**, select the checkbox next to **Enable the common attachments filter**. The file types that are blocked are listed directly below this option. To add or delete file types, select **Customize file types** at the end of the list. -5. Select **Save**. --For more information, see [Antimalware protection in EOP](../../security/office-365-security/anti-malware-protection.md). --### Use antivirus and anti-malware protection --Microsoft Defender Antivirus provides strong antivirus and antimalware protection, and is built into the Windows operating system. --If your organization is using Microsoft 365 Business Premium, you get additional device protection that includes: --- Next-generation protection-- Firewall protection-- Web content filtering--These capabilities are included in Microsoft Defender for Business, an offering that will begin rolling out to Microsoft 365 Business Premium customers, beginning March 1, 2022. --[Learn more about Microsoft Defender for Business](../../security/defender-business/mdb-overview.md). --## Protect against ransomware --Ransomware restricts access to data by encrypting files or locking computer screens. It then attempts to extort money from victims by asking for "ransom," usually in form of cryptocurrencies like Bitcoin, in exchange for access to data. --You get ransomware protection for email hosted in Microsoft 365 and for files that are stored in OneDrive. If you have Microsoft 365 Business Premium, you get additional ransomware protection for your organization's devices. --You can protect against ransomware by creating one or more mail flow rules to block file extensions that are commonly used for ransomware, or to warn users who receive these attachments in email. A good starting point is to create two rules: +Microsoft 365 for business plans include security capabilities, such as antiphishing, antispam, and antimalware protection. Microsoft 365 Business Premium includes more capabilities, such as device management, advanced threat protection, and information protection. This article describes steps you can take to secure your business data, and [compares capabilities across Microsoft 365 for business plans](#comparing-microsoft-365-for-business-plans). -- Use OneDrive for moving files, so that they are always access-controlled and protected. -- Warn users before opening Office file attachments that include macros. Ransomware can be hidden inside macros, so we'll warn users to not open these files from people they do not know.+1. **Use multi-factor authentication**. [Multi-factor authentication](multi-factor-authentication-microsoft-365.md) (MFA), also known as two-step verification, requires people to use a code or authentication app on their phone to sign into Microsoft 365, and is a critical first step to protecting your business data. Using MFA can prevent hackers from taking over if they know your password. See [security defaults and MFA](../../business-premium/m365bp-conditional-access.md). -- Block file types that could contain ransomware or other malicious code. We'll start with a common list of executables (listed in the table below). If your organization uses any of these executable types and you expect them to be sent in email, add them to the previous rule (warn users).+2. **Protect your administrator accounts**. Administrator accounts (also called admins) have elevated privileges, making these accounts more susceptible to cyberattacks. See [Protect your administrator accounts](../../business-premium/m365bp-protect-admin-accounts.md). -To create a mail transport rule, view [Watch: Protect against ransomware](increase-threat-protection.md#watch-protect-against-ransomware), or complete the following steps: +3. **Use preset security policies**. Your subscription includes [preset security policies](../../security/office-365-security/preset-security-policies.md) that use recommended settings for anti-spam, anti-malware, and anti-phishing protection. See [Protect against malware and other cyberthreats](../../business-premium/m365bp-increase-protection.md). -1. Go to the <a href="https://go.microsoft.com/fwlink/p/?linkid=2059104" target="_blank">Exchange admin center</a>. +4. **Protect all devices**. Every device is a possible attack avenue into your network and must be configured properly, even those devices that are personally owned but used for work. See the following articles: -2. In the **mail flow** category, select **rules**. + - [Help users set up MFA on their devices](https://support.microsoft.com/office/set-up-your-microsoft-365-sign-in-for-multi-factor-authentication-ace1d096-61e5-449b-a875-58eb3d74de14) + - [Protect unmanaged Windows and Mac computers](../../business-premium/m365bp-protect-pcs-macs.md) + - [Set up managed devices](../../business-premium/m365bp-managed-devices-setup.md) (requires Microsoft 365 Business Premium or Microsoft Defender for Business) -3. Select **+**, and then **Create a new rule**. +5. **Train everyone on email best practices**. Email can contain malicious attacks cloaked as harmless communications. Email systems are especially vulnerable, because email is handled by everyone in the organization, and safety relies on humans making consistently good decisions with those communications. Train everyone to know what to watch for spam or junk mail, phishing attempts, spoofing, and malware in their email. See [Protect yourself against phishing and other attacks](../../business-premium/m365bp-avoid-phishing-and-attacks.md). -4. Select **** at the bottom of the dialog box to see the full set of options. +6. **Use Microsoft Teams for collaboration and sharing**. The best way to collaborate and share securely is to use Microsoft Teams. With Microsoft Teams, all your files and communications are in a protected environment and aren't being stored in unsafe ways outside of it. See the following articles: -5. Apply the settings in the following table for each rule. Leave the rest of the settings at the default, unless you want to change them. + - [Use Microsoft Teams for collaboration](../../business-premium/create-teams-for-collaboration.md) + - [Set up meetings with Microsoft Teams](../../business-premium/set-up-meetings.md) + - [Share files and videos in a safe environment](../../business-premium/share-files-and-videos.md) -6. Select **Save**. +7. **Set sharing settings for SharePoint and OneDrive files and folders**. Your default sharing levels for SharePoint and OneDrive might be set to a more permissive level than you should use. We recommend reviewing and if necessary, changing the default settings to better protect your business. See [Set sharing settings for SharePoint and OneDrive files and folders](../../business-premium/m365bp-increase-protection.md#set-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). -| Setting | Warn users before opening attachments of Office files | Block file types that could contain ransomware or other malicious code | -|:--|:--|:--| -|Name <br/> |Anti-ransomware rule: warn users <br/> |Anti-ransomware rule: block file types <br/> | -|Apply this rule if . . . <br/> |Any attachment . . . file extension matches . . . <br/> |Any attachment . . . file extension matches . . . <br/> | -|Specify words or phrases <br/> |Add these file types: <br/> dotm, docm, xlsm, sltm, xla, xlam, xll, pptm, potm, ppam, ppsm, sldm <br/> |Add these file types: <br/> ade, adp, ani, bas, bat, chm, cmd, com, cpl, crt, hlp, ht, hta, inf, ins, isp, job, js, jse, lnk, mda, mdb, mde, mdz, msc, msi, msp, mst, pcd, reg, scr, sct, shs, url, vb, vbe, vbs, wsc, wsf, wsh, exe, pif <br/> | -|Do the following . . . <br/> |Prepend a disclaimer <br/> |Block the message . . . reject the message and include an explanation <br/> | -|Provide message text <br/> |Do not open these types of filesΓÇöunless you were expecting themΓÇöbecause the files may contain malicious code and knowing the sender isn't a guarantee of safety. <br/> || +8. **Use Microsoft 365 Apps on devices**. Outlook and Microsoft 365 Apps (also referred to as Office apps) enable people to work productively and more securely across devices. Whether you're using the web or desktop version of an app, you can start a document on one device, and pick it up later on another device. Instead of sending files as email attachments, you can share links to files that are stored in SharePoint or OneDrive. See [Install Office apps on all devices](../../business-premium/m365bp-install-office-apps.md). -> [!TIP] -> You can also add the files you want to block to the anti-malware list in [Protect against malware](#protect-against-malware). --For more information, see: --- [Ransomware: how to reduce risk](https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/)--- [Better together: Microsoft Defender Antivirus and Office 365](../../security/defender-endpoint/office-365-microsoft-defender-antivirus.md)--- [Restore your OneDrive](https://support.microsoft.com/office/fa231298-759d-41cf-bcd0-25ac53eb8a15)---## Protect sensitive emails --Microsoft 365 includes Office Message Encryption which allows you to send and receive encrypted email messages between people inside and outside your organization, and only the intended recipients may view them. The encryption works with Outlook.com, Yahoo!, Gmail, and other email services. --> [!Tip] -> If a more stringent security level is needed, your organization should also configure and use sensitivity labeling for emails or files. [Sensitivity labels](../../compliance/sensitivity-labels.md) allow control over content, no matter where it goes. --### Send encrypted email --To encrypt your email: --1. With a new email open, select the **Options** menu. -1. From the **Encrypt** drop-down choose the appropriate permission level. ---### Receive encrypted email --If the recipient has Outlook 2013 or Outlook 2016 and a Microsoft email account, they'll see an alert about the item's restricted permissions in the Reading pane. After opening the message, the recipient can view the message just like any other. --If the recipient is using another email client or email account, such as Gmail or Yahoo, they'll see a link that lets them either sign in to read the email message or request a one-time passcode to view the message in a web browser. If users aren't receiving the email, they should check their Spam or Junk email folder. --> [!TIP] -> For more information, see [Send, view, and reply to encrypted messages in Outlook for PC](https://support.microsoft.com/office/eaa43495-9bbb-4fca-922a-df90dee51980). --## Protect the organization --If you've configured one or more custom domains for your Microsoft 365 environment, you can configure targeted anti-phishing protection. Anti-phishing protection is included in Microsoft Defender for Office 365, and can help protect your organization from malicious impersonation-based phishing and other attacks. --> [!Note] -> If you haven't configured a custom domain, you don't need to do this. --We recommend you get started with this protection by creating a policy for your most important users and your custom domain. A good place to do this is in Microsoft 365 Defender, included with Microsoft Business Premium. To create an anti-phishing policy in Defender for Office 365, complete the following steps: --1. Go to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>. --2. Go to **Email & collaboration** \> **Policies & rules** \> **Threat policies** \> **Anti-phishing** in the **Policies** section. --3. On the Anti-phishing page, select **+ Create**. A wizard launches that steps you through defining your anti-phishing policy. --4. Specify the name, description, and settings for your policy as recommended in the chart below. For more information, see [Learn about anti-phishing policy in Microsoft Defender for Office 365 options](../../security/office-365-security/set-up-anti-phishing-policies.md). --5. After you've reviewed your settings, select **Create this policy** or **Save**, as appropriate. +9. **Manage calendar sharing for your business**. You can help people in your organization share their calendars appropriately for better collaboration. You can manage what level of detail they can share, such as by limiting the details that are shared to free/busy times only. See [Manage calendar sharing](../../business-premium/m365bp-increase-protection.md#manage-calendar-sharing). -|Setting or option|Recommended setting| -||| -|Name|Domain and most valuable campaign staff| -|Description|Ensure most important staff and our domain aren't being impersonated.| -|Add users to protect|Select **+ Add a condition, The recipient is**. Type user names or enter the email address of the candidate, campaign manager, and other important staff members. You can add up to 20 internal and external addresses that you want to protect from impersonation.| -|Add domains to protect|Select **+ Add a condition, The recipient domain is**. Enter the custom domain associated with your Microsoft 365 subscription, if you defined one. You can enter more than one domain.| -|Choose actions|If email is sent by an impersonated user: select **Redirect message to another email address**, and then type the email address of the security administrator; for example, securityadmin@contoso.com. <br/> If email is sent by an impersonated domain: select **Quarantine message**.| -|Mailbox intelligence|By default, mailbox intelligence is selected when you create a new anti-phishing policy. Leave this setting **On** for best results.| -|Add trusted senders and domains|For this example, don't define any overrides.| -|Applied to|Select **The recipient domain is**. Under **Any of these**, select **Choose**. Select **+ Add**. Select the check box next to the name of the domain, for example, contoso.com, in the list, and then select **Add**. Select **Done**.| +10. **Maintain your environment**. After your initial setup and configuration of Microsoft 365 for business is complete, your organization needs a maintenance and operations plan. As employees come and go, you'll need to add or remove users, reset passwords, and maybe even reset devices to factory settings. See [Maintain your environment](../../business-premium/m365bp-maintain-environment.md). -> [!TIP] -> For more information, see [Set up anti-phishing policies in Defender for Office 365](../../security/office-365-security/configure-atp-anti-phishing-policies.md). --## Protect against malicious attachments, files, and URLs --People regularly send, receive, and share attachments, such as documents, presentations, spreadsheets, and more. It's not always easy to tell whether an attachment is safe or malicious just by looking at an email message. Microsoft Defender for Office 365 includes Safe Attachment protection, but this protection isn't turned on by default. We recommend that you create a new rule to begin using this protection. This protection extends to files in SharePoint, OneDrive, and Microsoft Teams. --### Set up Safe Attachments +## Comparing Microsoft 365 for business plans -You can use pre-set Safe Attachments policies, or create your own. To create a Safe Attachments policy, view a [short training video](increase-threat-protection.md), or complete the following steps: +Microsoft 365 for business plans include Microsoft Exchange, Microsoft Teams, SharePoint, and OneDrive for secure email, collaboration, and file storage. These plans also include antiphishing, antimalware, and antispam protection. With Microsoft 365 Business Premium, you get more capabilities, such as device management, advanced threat protection, and information protection. -1. Go to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, and sign in with your admin account. +The following table compares capabilities in Microsoft 365 for business plans. -2. Go to **Email & collaboration** \> **Policies & rules** \> **Threat policies** \> **Anti-malware** in the **Policies** section. +| Capability | [Microsoft 365 Business Basic](../setup/setup-business-basic.md) | [Microsoft 365 Business Standard](../setup/setup-business-standard.md) | [Microsoft 365 Business Premium](../../business-premium/index.md) | +|:|:--:|:--:|:--:| +| **Outlook and Web/mobile versions of Office apps** <br/>Word, Excel, and PowerPoint |  |  | | +| **Desktop versions of Office apps**<br/>Word, Excel, PowerPoint, Publisher, and Access <sup>[[See note 1](#fn1)]</sup> | |  |  | +| **Secure communication, collaboration, and file storage**<br/>Microsoft Teams, Exchange, OneDrive, and SharePoint |  |  |  | +| **Antispam, antiphishing, and antimalware protection** for email <br/>[Exchange Online Protection](../../security/office-365-security/exchange-online-protection-overview.md) |  |  |  | +| **Mobile device management** and mobile app management <br/>[Microsoft Intune](/mem/intune/fundamentals/what-is-intune) | See note <sup>[[2](#fn2)]</sup> | See note <sup>[[2](#fn2)]</sup> |  | +| **Advanced device security** with next-generation protection, firewall, attack surface reduction, automated investigation and response, and more <br/>[Defender for Business](../../security/defender-business/mdb-overview.md) | See note <sup>[[3](#fn3)]</sup> | See note <sup>[[3](#fn3)]</sup> |  | +| **Advanced protection for email and documents** with advanced anti-phishing, Safe Links, Safe Attachments, and real-time detections<br/>[Microsoft Defender for Office 365 Plan 1](../../security/office-365-security/defender-for-office-365.md) | See note <sup>[[4](#fn4)]</sup> | See note <sup>[[4](#fn4)]</sup> |  | +| **Information protection** capabilities to discover, classify, protect, and govern sensitive information <br/>[Azure Information Protection](/azure/information-protection/what-is-information-protection) | | |  | -3. Select **+ Create** to create a new policy. +(<a id="fn1">1</a>) Microsoft Publisher and Microsoft Access run on Windows laptops and desktops only. -4. Apply the settings in the following table. +(<a id="fn2">2</a>) Microsoft Intune is included with certain Microsoft 365 plans. Basic Mobility and Security is part of the Microsoft 365 Business Basic and Standard. [Choose between Basic Mobility and Security or Intune](../basic-mobility-security/choose-between-basic-mobility-and-security-and-intune.md). -5. After you've reviewed your settings, select **Create this policy** or **Save**, as appropriate. +(<a id="fn3">3</a>) Defender for Business is included in Microsoft 365 Business Premium. It can also be purchased as an add-on for Microsoft 365 Business Basic or Microsoft 365 Business Standard. See [Get Defender for Business](/microsoft-365/security/defender-business/get-defender-business). -|Setting or option|Recommended setting| -||| -|Name|Block current and future emails with detected malware.| -|Description|Block current and future emails and attachments with detected malware.| -|Save attachments unknown malware response|Select **Block - Block the current and future emails and attachments with detected malware**.| -|Redirect attachment on detection|Enable redirection (select this box) <br/> Enter the admin account or a mailbox setup for quarantine. <br/> Apply the above selection if malware scanning for attachments times out or error occurs (select this box).| -|Applied to|The recipient domain is . . . select your domain.| +(<a id="fn4">4</a>) Defender for Office 365 Plan 1 is included in Microsoft 365 Business Premium. It can also be purchased as an add-on for Microsoft 365 Business Basic or Microsoft 365 Business Standard. See [Defender for Office 365 Plan 1 and Plan 2](../../security/office-365-security/overview.md#microsoft-defender-for-office-365-plan-1-vs-plan-2-cheat-sheet). > [!TIP]-> For more information, see [Set up anti-phishing policies in Defender for Office 365](../../security/office-365-security/configure-atp-anti-phishing-policies.md). --### Set up Safe Links --Hackers sometimes hide malicious websites in links in email or other files. Safe Links, part of Microsoft Defender for Office 365, can help protect your organization by providing time-of-click verification of web addresses (URLs) in email messages and Office documents. Protection is defined through Safe Links policies. --Do the following to protect against attacks: --- Modify the default policy to increase protection.--- Add a new policy targeted to all recipients in your domain.--To get to Safe Links, view [Watch: Protect your email from phishing attacks](increase-threat-protection.md#watch-protect-your-email-from-phishing-attacks), or complete the following steps: --1. Go to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender portal</a>, and sign in with your admin account. --2. Go to **Email & collaboration** \> **Policies & rules** \> **Threat policies** \> **Anti-malware** in the **Policies** section. --3. Select **+ Create** to create a new policy, or modify the default policy. --To modify the default policy: --1. Double-click the **Default** policy. A flyout appears. --2. Select **Edit protection settings** at the bottom of the flyout. --3. After modifying the default policy, select **Save**. --|Setting or option|Recommended setting| -||| -|Name|Safe links policy for all recipients in the domain| -|Select the action for unknown potentially malicious URLs in messages|Select **On - URLs will be rewritten and checked against a list of known malicious links when user clicks on the link**.| -|Apply real-time URL scanning for suspicious links and links that point to files|Select this box.| -|Applied to|The recipient domain is . . . select your domain.| --> [!TIP] -> For more information, see [Safe Links in Microsoft Defender for Office 365](../../security/office-365-security/atp-safe-links.md). --## Increase protection for your organization's devices --Microsoft Defender Antivirus is built into the Windows operating system and provides good protection against viruses and malware. However, you can increase protection for your organization's devices by onboarding them to Microsoft Defender for Business which is a new offering for small and medium-sized businesses like yours, and is included with [Microsoft 365 Business Premium](../../business-premium/index.md). With Defender for Business, your organization's devices are better protected from ransomware, malware, phishing, and other threats. --With Microsoft 365 Business Premium you get heightened security features such as device management and advanced threat protection. When you enroll devices to Microsoft 365 Business for Defender, the devices are monitored and protected by InTune. ---To learn more, see the following resources: --- [Overview of Microsoft Defender for Business](../../security/defender-business/mdb-overview.md)--- [Set up and configure Microsoft Defender for Business](../../security/defender-business/mdb-setup-configuration.md)+> For more information about what each plan includes, see [Reimagine productivity with Microsoft 365 and Microsoft Teams](https://www.microsoft.com/en-us/microsoft-365/business/compare-all-microsoft-365-business-products-b?ef_id=8c2a86ec9ea514a008c6e419e036519c:G:s&OCID=AIDcmmwf9kwzdj_SEM_8c2a86ec9ea514a008c6e419e036519c:G:s&lnkd=Bing_O365SMB_Brand&msclkid=8c2a86ec9ea514a008c6e419e036519c). -- [Get started using the Microsoft 365 Defender portal](../../security/defender-business/mdb-get-started.md) -## Related content +## See also -[Multi-factor authentication for Microsoft 365](multi-factor-authentication-microsoft-365.md) (article)\ -[Manage and monitor priority accounts](../setup/priority-accounts.md) (article)\ -[Microsoft 365 Reports in the admin center](../activity-reports/activity-reports.md) (video)\ -[Microsoft 365 Business Premium ΓÇö cybersecurity for small business](/microsoft-365/business-premium/) (article)\ +- [What is Defender for Business?](../../security/defender-business/mdb-overview.md) +- [Microsoft 365 Business PremiumΓÇöcybersecurity for small business](/microsoft-365/business-premium/) +- [Compare security features in Microsoft 365 plans for small and medium-sized businesses](../../security/defender-business/compare-mdb-m365-plans.md) (for more details about Defender for Business and Microsoft 365 Business Premium) +- [Compare Microsoft endpoint security plans](../../security/defender-endpoint/defender-endpoint-plan-1-2.md) (for securing and managing devices) |
| compliance | Data Classification Activity Explorer | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/data-classification-activity-explorer.md | An account must be explicitly assigned membership in any one of these role group There are roles and role groups that you can use to fine-tune your access controls. -Here's a list of applicable roles that are in preview. To learn more about them, see [Roles in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center) +Here's a list of applicable roles that you can use. To learn more about them, see [Roles in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#roles-in-the-security--compliance-center) - Information Protection Admin - Information Protection Analyst - Information Protection Investigator - Information Protection Reader -Here's a list of applicable role groups that are in preview. To learn more about the, see [Role groups in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#role-groups-in-the-security--compliance-center) +Here's a list of applicable role groups that you can use. To learn more about the, see [Role groups in the Security & Compliance Center](../security/office-365-security/permissions-in-the-security-and-compliance-center.md#role-groups-in-the-security--compliance-center) - Information Protection - Information Protection Admins |
| compliance | Exchange Online Uses Tls To Secure Email Connections | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/exchange-online-uses-tls-to-secure-email-connections.md | Learn how Exchange Online and Microsoft 365 use Transport Layer Security (TLS) a ## TLS basics for Microsoft 365 and Exchange Online -Transport Layer Security (TLS), and SSL that came before TLS, are cryptographic protocols that secure communication over a network by using security certificates to encrypt a connection between computers. TLS supersedes Secure Sockets Layer (SSL) and is often referred to as SSL 3.1. Exchange Online uses TLS to encrypt the connections between Exchange servers and the connections between Exchange servers and other servers such as your on-premises Exchange servers or your recipients' mail servers. Once the connection is encrypted, all data sent through that connection is sent through the encrypted channel. However, if you forward a message that was sent through a TLS-encrypted connection, that message isn't necessarily encrypted. TLS doesn't encrypt the message, just the connection. +Transport Layer Security (TLS), and SSL that came before TLS, are cryptographic protocols that secure communication over a network by using security certificates to encrypt a connection between computers. TLS supersedes Secure Sockets Layer (SSL) and is often referred to as SSL 3.1. Exchange Online uses TLS to encrypt the connections between Exchange servers and the connections between Exchange servers and other servers such as your on-premises Exchange servers or your recipients' mail servers. Once the connection is encrypted, all data sent through that connection is sent through the encrypted channel. However, if you forward a message that was sent through a TLS-encrypted connection to a recipient organization that doesn't support TLS encryption, that message isn't necessarily encrypted. TLS doesn't encrypt the message, just the connection. If you want to encrypt the message, use an encryption technology that encrypts the message contents. For example, you can use Microsoft Purview Message Encryption or S/MIME. See [Email encryption in Office 365](email-encryption.md) and [Message encryption](ome.md) for information on message encryption in Office 365. |
| compliance | Ome Message Access Logs | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/ome-message-access-logs.md | Access logs are available for encrypted messages through the encrypted message p ## Enabling message access audit logs in PowerShell -Access log can be enabled using Exchange Online PowerShell. The *-EnablePortalTrackingLogs* parameter of Set-IrmConfiguration specifies whether to enable the audit logs of accessing the encrypted message portal. Valid values are: +Access log can be enabled using [Exchange Online PowerShell V2 module](/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps). The *-EnablePortalTrackingLogs* parameter of Set-IrmConfiguration specifies whether to enable the audit logs of accessing the encrypted message portal. Valid values are: - $true: Turn on audit feature. - $false: Turn off audit feature |
| compliance | Sensitivity Labels Office Apps | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-office-apps.md | The numbers listed are the minimum Office application versions required for each |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using sensitive info types | Current Channel: 2009+ <br /><br> Monthly Enterprise Channel: 2009+ <br /><br> Semi-Annual Enterprise Channel: 2102+ | 16.44+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Apply a sensitivity label to content automatically](apply-sensitivity-label-automatically.md) <br /> - Using trainable classifiers | Current Channel: 2105+ <br /><br> Monthly Enterprise Channel: 2105+ <br /><br> Semi-Annual Enterprise Channel: 2108+ | 16.49+ | Under review | Under review | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) | |[Support co-authoring and AutoSave](sensitivity-labels-coauthoring.md) for labeled and encrypted documents | Current Channel: 2107+ <br /><br> Monthly Enterprise Channel: 2107+ <br /><br> Semi-Annual Enterprise Channel: 2202+ | 16.51+ | 2.58+ | 16.0.14931+ | [Yes - opt-in](sensitivity-labels-sharepoint-onedrive-files.md) |-|[PDF support](#pdf-support)| Preview: Rolling out to [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review | Under review | +|[PDF support](#pdf-support)| Preview: [Current Channel (Preview)](https://office.com/insider) | Under review | Under review | Under review | Under review | ### Sensitivity label capabilities in Outlook |
| compliance | Sensitivity Labels Teams Groups Sites | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sensitivity-labels-teams-groups-sites.md | In addition to using [sensitivity labels](sensitivity-labels.md) to protect docu When you apply this sensitivity label to a supported container, the label automatically applies the sensitivity category and configured protection settings to the site or group. +Be aware that some label options can extend configuration settings to site owners, that are otherwise restricted to administrators. When you configure and publish the label settings for external sharing options and the authentication context, a site owner can now set and change these options for a site by applying or changing the sensitivity label for a team or site. Don't configure these specific label settings if you don't want site owners to be able to make these changes. + Content in these containers however, do not inherit the labels for the sensitivity category or settings for files and emails, such as content markings and encryption. So that users can label their documents in SharePoint sites or team sites, make sure you've [enabled sensitivity labels for Office files in SharePoint and OneDrive](sensitivity-labels-sharepoint-onedrive-files.md). Container labels don't support displaying [other languages](create-sensitivity-labels.md#additional-label-settings-with-security--compliance-powershell) and display the original language only for the label name and description. |
| contentunderstanding | Content Assembly | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/contentunderstanding/content-assembly.md | Follow these steps to create a modern template. - [Select from managed metadata term set or term](#associate-a-placeholder-by-selecting-from-managed-metadata-term-set-or-term) > [!NOTE]- > You can create placeholders for text only. Images, smart art, tables, and bullet lists are currently not supported. + > You can create placeholders for text, and also placeholders for text within cells in a table. However, images, smart art, complete tables, and bulleted lists are currently not supported. ++ ### Associate a placeholder by entering text or selecting a date You can use a *published* modern template to quickly create similar documents wi >- Only Microsoft Word documents (.docx extension) are currently supported for creating a template. Before uploading a Word document, ensure that it doesn't include comments or have **Track changes** enabled. If the document contains text placeholders for images, ensure that they are not text-wrapped. Content controls in Word are currently not supported. If you want to create a template from a Word document with content controls, remove them before you create a modern template. >- The template and the document are associated with one document library. To use the template in another document library, you will need to create the template again in that document library. >- The uploaded document that is used to create the modern template will be saved as a separate copy and placed in the /forms directory of the document library. The original file on the disk will be unaffected.->- You can create placeholders for text only. Images, smart art, tables, and bullet lists are currently not supported. +>- You can create placeholders for text, and also placeholders for text within cells in a table. However, images, smart art, complete tables, and bulleted lists are currently not supported. >- Once a document is created from a template, it's not associated with the template. |
| lighthouse | M365 Lighthouse Deploy Standard Tenant Configurations Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-deploy-standard-tenant-configurations-overview.md | Lighthouse baseline configurations are designed to make sure all managed tenants | Configure Microsoft Defender Antivirus for Windows 10 and later | A device configuration profile for Windows devices with pre-configured Microsoft Defender Antivirus settings. For more information about this baseline, see [Configure Microsoft Defender for Endpoint in Intune](/mem/intune/protect/advanced-threat-protection-configure).| | Configure Microsoft Defender Firewall for Windows 10 and later | A firewall policy to help secure devices by preventing unwanted and unauthorized network traffic. For more information about this baseline, see [Best practices for configuring Windows Defender Firewall](/windows/security/threat-protection/windows-firewall/best-practices-configuring). | | Configure a device compliance policy for Windows 10 and later | A Windows device policy with pre-configured settings to meet basic compliance requirements. For more information about this baseline, see [Conditional Access: Require compliant or hybrid Azure AD joined device](/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device). |+| Configure Microsoft Edge | A Microsoft Edge browser policy for Windows 10 or later with preconfigured settings to stay protected from phishing scams and malicious software. This policy also allows Microsoft Edge to safely save and monitor passwords and suggest strong passwords when needed. | ## Deployment Plans |
| lighthouse | M365 Lighthouse Requirements | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-requirements.md | In addition, each MSP customer tenant must qualify for Lighthouse by meeting the - Must have at least one Microsoft 365 Business Premium, Microsoft 365 E3, Microsoft 365 E5, Windows 365 Business, or Microsoft Defender for Business license - Must have no more than 2500 licensed users - \* Either Granular Delegated Admin Privileges (GDAP or a Delegated Admin Privileges (DAP) relationship is required to onboard customers to Lighthouse. An indirect reseller relationship is no longer required to onboard to Lighthouse. If DAP and GDAP coexist in a customer tenant, GDAP permissions take precedence for MSP technicians in GDAP-enabled security groups. + \* Either Granular Delegated Admin Privileges (GDAP) plus an indirect reseller relationship or a Delegated Admin Privileges (DAP) relationship is required to onboard customers to Lighthouse. If DAP and GDAP coexist in a customer tenant, GDAP permissions take precedence for MSP technicians in GDAP-enabled security groups. Coming soon, customers with GDAP-only relationships (without indirect reseller relationships) will be able to onboard to Lighthouse. ## Requirements for enabling device management |
| lti | Teams Classes Meetings With Moodle | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lti/teams-classes-meetings-with-moodle.md | Follow the [instructions for installing and configuring the Moodle plugin](moodl ## Register Microsoft Teams LTI for use in Moodle -> [!IMPORTANT] -> The person who performs this integration should be a Moodle administrator and a Microsoft 365 tenant administrator. +The person who performs this integration should be a Moodle administrator and a Microsoft 365 tenant administrator. 1. Visit [Microsoft LMS Gateway](https://lti.microsoft.com/) and select the **Go to registration portal** button. Follow the [instructions for installing and configuring the Moodle plugin](moodl 15. Copy and paste the values from Moodle's **Tool configuration details** to Microsoft's **LMS provided registration keys** step. - Paste the values as follows: + Paste the values as follows: - | On Moodle | On Microsoft LTI registration portal | - | | | - | Platform ID | Issuer ID URL | - | Client ID | Client ID | - | Deployment ID | Deployment ID | - | Public keyset URL | Keyset URL | - | Access token URL | Access token URL | - | Authentication request URL | Platform authentication URL | + | On Moodle | On Microsoft LTI registration portal | + | | | + | Platform ID | Issuer ID URL | + | Client ID | Client ID | + | Deployment ID | Deployment ID | + | Public keyset URL | Keyset URL | + | Access token URL | Access token URL | + | Authentication request URL | Platform authentication URL | - Select **Next**. + >[!NOTE] + > Make sure that the public keyset URL isn't restricted by your network settings for requests originating from the Microsoft LMS Gateway. ++ Select **Next**. 16. Review the **Review and add** page. If there are no errors, select **Save and exit**. You should see a message indicating successful registration. |
| security | Defender Vulnerability Management Trial | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-trial.md | + + Title: About the Microsoft Defender Vulnerability Management public preview trial +description: Learn about the Microsoft Defender Vulnerability Management trial +keywords: defender vulnerability management +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: +- NOCSH +++ms.localizationpriority: medium ++audience: ITPro +++ms.technology: m365d +++# About the Microsoft Defender Vulnerability Management public preview trial +++**Applies to:** ++- [Microsoft Defender Vulnerability Management](../defender-vulnerability-management/index.yml) +- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) +++Microsoft Defender Vulnerability Management is a new service that provides advanced vulnerability management capabilities to minimize your organization's cyber risk. Get real-time asset discovery, continuous risk-based assessment and prioritization, and built in remediation tools. ++It includes the existing vulnerability management capabilities in Microsoft Defender for Endpoint and new capabilities to further provide enhanced tools so your teams can intelligently assess, prioritize, and seamlessly remediate the biggest risks to your organization. ++## How to sign up for the Defender Vulnerability Management public preview trial ++> [!NOTE] +> The sign up process outlined below is only relevant to customers who have access to the [Microsoft Defender 365 portal](https://security.microsoft.com/homepage). +> +> If you don't have access to the Microsoft Defender 365 portal learn more about how you can sign up to the [Microsoft Defender Vulnerability Management Standalone public preview trial](../defender-vulnerability-management/get-defender-vulnerability-management.md#try-defender-vulnerability-management-standalone). ++To sign up for the Defender Vulnerability Management trial, you can go directly to the [Microsoft 365 trials hub](https://security.microsoft.com/trialHorizontalHub) page or by selecting **Trials** on the left navigation from the [Microsoft Defender 365 portal](https://security.microsoft.com/homepage). ++Once you've reached the [Microsoft 365 trials hub](https://security.microsoft.com/trialHorizontalHub), sign up depends on whether you already have Microsoft Defender for Endpoint Plan 2 or not: ++- If you have Defender for Endpoint Plan 2, find the **Defender Vulnerability Management add-on** card and select **Try now**. +- If you don't have have Defender for Endpoint Plan 1 or Plan 2, or Microsoft 365 E3, choose the **Defender Vulnerability Management** card and select **Try now**. ++2. Review the information about what's included in the trial, then select **Begin trial**. ++Your trial will be effective immediately for 120 days. It can take up to 6 hours for all vulnerability management features to appear in your left navigation. Sign out and sign back in to see the updates. ++> [!NOTE] +> This is a public preview trial. Details on your purchase options for this new offering will be made available once the offering is generally available. ++## Required roles for starting the trial ++As a Global Administrator, you can start the trial or you can allow to users start the trial on behalf of your organization by enabling this option: ++1. In the Microsoft 365 admin center, go to **Settings** > **Org settings** > **Services** > **User owned apps and services** +2. Check **Let users start trials on behalf of your organization** +3. Select **Save** +++> [!NOTE] +> If you don't want users in your organization to be able to start trials, as a Global Administrator you must disable this option once you've activated the trial. +> +> Only a Global Administrator can end the trial. ++It can take a few hours for the changes to take effect. Once it does, return to the trial setup page and select **Begin trial**. ++## Licensing ++As part of the trial setup, the new Defender Vulnerability Management trial licenses will be applied to users automatically. Therefore, no assignment is needed (_The trial can automatically apply up to 1,000,000 licenses_). The licenses are active for 120 days. ++## Getting started, extending, and ending the trial ++### Getting started ++You can start using Defender Vulnerability Management features as soon as you see them in the Microsoft 365 Defender portal. Nothing is created automatically and users won't be affected. When you navigate to each solution, you may be guided to make extra setup configurations to start using features. ++### Extending the trial ++You can extend the trial within the last 15 days of the trial period. You're limited to a maximum of two trial periods. If you don't extend by the time your trial period ends, you'll need to wait at least 30 days before signing up for a second trial. ++### Ending the trial ++Admins can disable the trial anytime by selecting **Trials** on the left navigation, going to the **Defender Vulnerability Management** trial card and selecting **End trial**. ++Unless stated otherwise for the solution your trial data will be maintained for time, usually 180 days, before being permanently deleted. You may continue to access the data gathered during the trial until that time. ++## Terms and conditions ++See the [terms and conditions](/legal/microsoft-365/microsoft-365-trial) for Microsoft 365 trials. ++## Learn more about Defender Vulnerability Management ++Wondering what you can experience in your free trial? The Defender Vulnerability Management trial includes: ++- **[Security baselines assessment](tvm-security-baselines.md)**: When the trial ends security baseline profiles may be stored for a short additional time before being deleted. +- **[Blocking vulnerable applications (beta)](tvm-block-vuln-apps.md)**: When the trial ends blocked applications will be immediately unblocked whereas baseline profiles may be stored for a short additional time before being deleted. +- **[Browser extensions assessment](tvm-browser-extensions.md)** +- **[Digital certificates assessment](tvm-certificate-inventory.md)** +- **[Network shares analysis](tvm-network-share-assessment.md)** |
| security | Trial Playbook Defender Vulnerability Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/trial-playbook-defender-vulnerability-management.md | + + Title: Trial playbook - Microsoft Defender Vulnerability Management (public preview) +description: Learn how Microsoft Defender Vulnerability Management can help you protect all your users and data. +keywords: vulnerability management, threat and vulnerability management, Microsoft Defender for Endpoint TVM, Microsoft Defender for Endpoint-TVM, vulnerability management, vulnerability assessment, threat and vulnerability scanning, secure configuration assessment, Microsoft Defender for Endpoint, Microsoft Defender Vulnerability Management, endpoint vulnerabilities, next generation +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro +++ms.technology: mde ++++# Trial playbook: Microsoft Defender Vulnerability Management ++## Welcome to the Microsoft Defender Vulnerability Management trial playbook ++This playbook is a simple guide to help you make the most of your free trial. Using the suggested steps in this playbook from the Microsoft Security team, you'll learn how vulnerability management can help you protect all your users and data. ++## What is Microsoft Defender Vulnerability Management? ++Reducing cyber risk requires a comprehensive risk-based vulnerability management program to identify, assess, remediate, and track important vulnerabilities across your most critical assets. ++Microsoft Defender Vulnerability Management is a new service that proactively provides continuous real-time discovery and assessment of vulnerabilities, context-aware threat & business prioritization, and built-in remediation processes. It includes all Defender Vulnerability Management capabilities in Microsoft Defender for Endpoint and new enhanced capabilities so your teams can further intelligently assess, prioritize, and seamlessly remediate the biggest risks to your organization. +++Watch the following video to learn more about Defender Vulnerability Management: ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4Y1FX] ++## Let's get started ++### Step 1: Set-up ++> [!NOTE] +> Users need to have the global admin role defined in Azure AD to onboard the trial. ++1. Check [permissions and pre-requisites.](tvm-prerequisites.md) +2. The Microsoft Defender Vulnerability Management preview trial can be accessed in several ways: ++ Via the [Microsoft 365 Defender portal](https://security.microsoft.com) under Trials. ++ :::image type="content" source="../../medivm-trialshub.png" alt-text="Screenshot of Microsoft Defender Vulnerability Management trial hub landing page."::: ++ Via the [Microsoft Admin Center](https://admin.microsoft.com/#/catalog) (global admins only). ++3. Sign up for the trial depends on whether you already have Microsoft Defender for Endpoint Plan 2 or not. + - If you have Defender for Endpoint Plan 2, choose [Defender Vulnerability Management Add-on](/microsoft-365/security/defender-vulnerability-management/get-defender-vulnerability-management#try-the-defender-vulnerability-management-add-on-public-preview-trial-for-defender-for-endpoint-plan-2-customers). + - If you don't have Defender for Endpoint Plan 1 or Plan 2, or Microsoft 365 E3, choose [Defender Vulnerability Management Standalone](/microsoft-365/security/defender-vulnerability-management/get-defender-vulnerability-management#try-defender-vulnerability-management-standalone). +4. When you're ready to get started, visit the [Microsoft 365 Defender portal](https://security.microsoft.com) to start using the Defender Vulnerability Management trial. ++> [!NOTE] +> This is a public preview trial. Details on your purchase options for this new offering will be made available once the offering is generally available. ++> [!NOTE] +> Once you activate the trial it can take up to 6 hours for the new features to become available in the portal. ++Now that you have set up your trial, it's time to try key capabilities. ++### Step 2: Know what to protect in a single view ++Built-in and agentless scanners continuously monitor and detect risk even when devices aren't connected to the corporate network. Expanded asset coverage consolidates software applications, digital certificates, network shares, and browser extensions into a single inventory view. ++1. [**Device inventory**](../defender-endpoint/machines-view-overview.md) - The device inventory shows a list of the devices in your network. By default, the list displays devices seen in the last 30 days. At a glance, you'll see information such as domains, risk levels, OS platform, associated CVEs, and other details for easy identification of devices most at risk. ++2. Discover and assess your organization's software in a single, consolidated inventory view: + - [**Software application inventory**](tvm-software-inventory.md) - the software inventory in Defender Vulnerability Management is a list of known applications in your organization. The view includes vulnerability and misconfiguration insights across installed software with prioritized impact scores and details such as OS platforms, vendors, number of weaknesses, threats, and an entity-level view of exposed devices. + - [**Browser extension assessments**](tvm-browser-extensions.md) - the browser extensions page displays a list of the extensions installed across different browsers in your organization. Extensions usually need different permissions to run properly. Defender Vulnerability Management provides detailed information on the permissions requested by each extension and identifies those with the highest associated risk levels, the devices with the extension turned on, installed versions, and more. + - [**Certificate inventory**](tvm-certificate-inventory.md) - the certificate inventory allows you to discover, assess, and manage digital certificates installed across your organization in a single view. This can help you: + - Identify certificates that are about to expire so you can update them and prevent service disruption. + - Detect potential vulnerabilities due to the use of weak signature algorithm (for example, SHA-1-RSA), short key size (for example, RSA 512 bit), or weak signature hash algorithm (for example, MD5). + - Ensure compliance with regulatory guidelines and organizational policy. ++3. [Assign device value](tvm-assign-device-value.md) - defining a device's value helps you differentiate between asset priorities. The device value is used to incorporate the risk appetite of an individual asset into the Defender Vulnerability Management exposure score calculation. Devices assigned as "high value" will receive more weight. Device value options: + - Low + - Normal (Default) + - High ++ You can also use the [set device value API](/microsoft-365/security/defender-endpoint/set-device-value). ++### Step 3: Track and mitigate remediation activities ++1. [**Request remediation**](tvm-remediation.md#request-remediation) - vulnerability management capabilities bridge the gap between Security and IT administrators through the remediation request workflow. Security admins like you can request for the IT Administrator to remediate a vulnerability from the **Recommendation** pages to [Intune](/mem/intune/). +2. [**View your remediation activities**](tvm-remediation.md#view-your-remediation-activities) - when you submit a remediation request from the Security recommendations page, it kicks-off a remediation activity. A security task is created that can be tracked on a **Remediation** page, and a remediation ticket is created in Microsoft Intune. +3. [**Block vulnerable applications**](tvm-block-vuln-apps.md) - Remediating vulnerabilities takes time and can be dependent on the responsibilities and resources of the IT team. Security admins can temporarily reduce the risk of a vulnerability by taking immediate action to block all currently known vulnerable versions of an application or warn users with customizable messages before opening vulnerable app versions until the remediation request is completed. The block option gives IT teams time to patch the application without security admins worrying that the vulnerabilities will be exploited in the meantime. ++ - [How to block vulnerable applications](tvm-block-vuln-apps.md#how-to-block-vulnerable-applications) + - [View remediation activities](tvm-block-vuln-apps.md#view-remediation-activities) + - [View blocked applications](tvm-block-vuln-apps.md#view-blocked-applications) + - [Unblock applications](tvm-block-vuln-apps.md#unblock-applications) ++4. Use enhanced assessment capabilities such as [Network shares analysis](tvm-network-share-assessment.md) to protect vulnerable network shares. As network shares can be easily accessed by network users, small common weaknesses can make them vulnerable. These types of misconfigurations are commonly used in the wild by attackers for lateral movement, reconnaissance, data exfiltration, and more. That's why we built a new category of configuration assessments in Defender Vulnerability Management that identify the common weaknesses that expose your endpoints to attack vectors in Windows network shares. This helps you: + - Disallow offline access to shares + - Remove shares from the root folder + - Remove share write permission set to 'Everyone' + - Set folder enumeration for shares + +5. View and monitor your organization's devices using a [**Vulnerable devices report**](tvm-vulnerable-devices-report.md) that shows graphs and bar charts with vulnerable device trends and current statistics. The goal is for you to understand the breath and scope of your device exposure. ++### Step 4: Set up security baseline assessments ++Instead of running point-in-time compliance scans, security baselines assessment helps you to continuously and proactively monitor your organization's compliance against industry security benchmarks in real time. A security baseline profile is a customized profile that you can create to assess and monitor endpoints in your organization against industry security benchmarks (CIS, NIST, MS). When you create a security baseline profile, you're creating a template that consists of multiple device configuration settings and a base benchmark to compare against. ++Security baselines provide support for Center for Internet Security (CIS) benchmarks for Windows 10, Windows 11, and Windows Server 2008 R2 and above, as well as Security Technical Implementation Guides (STIG) benchmarks for Windows 10 and Windows Server 2019. ++1. Get started with [security baselines assessment](tvm-security-baselines.md#get-started-with-security-baselines-assessment) +2. Review [security baseline profile assessment results](tvm-security-baselines.md#review-security-baseline-profile-assessment-results) +3. [Use advanced hunting](tvm-security-baselines.md#use-advanced-hunting) ++### Step 5: Create meaningful reports to get in-depth insights using APIs and Advanced Hunting ++Defender Vulnerability Management APIs can help drive clarity in your organization with customized views into your security posture and automation of vulnerability management workflows. Alleviate your security team's workload with data collection, risk score analysis, and integrations with your other organizational processes and solutions. For more information, see: ++- [Export assessment methods and properties per device](../defender-endpoint/get-assessment-methods-properties.md) +- [Defender Vulnerability Management APIs blog](https://techcommunity.microsoft.com/t5/microsoft-defender-vulnerability/new-threat-amp-vulnerability-management-apis-create-reports/ba-p/2445813) ++Advanced hunting enables flexible access to Defender Vulnerability Management raw data, which allows you to proactively inspect entities for known and potential threats. +For more information, see [Hunt for exposed devices](../defender-endpoint/advanced-hunting-overview.md). ++## Additional resources ++- Compare offerings: [Microsoft Defender Vulnerability Management](defender-vulnerability-management-capabilities.md) +- [Defender Vulnerability Management documentation](../defender-vulnerability-management/index.yml) +- Datasheet: [Microsoft Defender Vulnerability Management: Reduce cyber risk with continuous vulnerability discovery and assessment, risk-based prioritization, and remediation](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4XR02) |
| security | Allow Block Urls | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/allow-block-urls.md | For instructions, see [Report questionable URLs to Microsoft](admin-submission.m You create block entries for URLs directly in the Tenant Allow/Block List. > [!NOTE]-> Email messages that contain these blocked URLs are blocked as *phishing*. +> Email messages that contain these blocked URLs are blocked as *high confidence phishing*. 1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>. |
| security | Configure Advanced Delivery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/configure-advanced-delivery.md | You use the _advanced delivery policy_ in Microsoft 365 to prevent inbound messa - [AIR and clustering in Defender for Office 365](office-365-air.md) ignores these messages. - Specifically for third-party phishing simulations: - [Admin submissions](admin-submission.md) generates an automatic response saying that the message is part of a phishing simulation campaign and isn't a real threat. Alerts and AIR will not be triggered. The admin submissions experience will show these messages as a simulated threat.- - When a user reports a phishing simulation message using the [Report Message or the Report Phishing add-ins](enable-the-report-message-add-in.md), the system will not generate an alert, investigation, or incident. The links or files will not be detonated, but the message will also show up on the **User reported messages** tab of the **Submissions** page. + - When a user reports a phishing simulation message using the [Report Message or the Report Phishing add-ins](enable-the-report-message-add-in.md), the system will not generate an alert, investigation, or incident. The links or files will not be detonated, but the message will appear on the **User reported messages** tab of the **Submissions** page. - [Safe Links in Defender for Office 365](safe-links.md) doesn't block or detonate the specifically identified URLs in these messages at time of click. URLs are still wrapped, but they aren't blocked. - [Safe Attachments in Defender for Office 365](safe-attachments.md) doesn't detonate attachments in these messages. Messages that are identified by the advanced delivery policy aren't security thr - Click  **Edit**. - If there are no configured SecOps mailboxes, click **Add**. -3. On the **Edit SecOps mailboxes** flyout that opens, enter an existing Exchange Online mailbox that you want to designate as SecOps mailbox by doing one of the following steps: +3. In the **Edit SecOps mailboxes** flyout that opens, enter an existing Exchange Online mailbox that you want to designate as SecOps mailbox by doing one of the following steps: - Click in the box, let the list of mailboxes resolve, and then select the mailbox. - Click in the box start typing an identifier for the mailbox (name, display name, alias, email address, account name, etc.), and select the mailbox (display name) from the results. Messages that are identified by the advanced delivery policy aren't security thr To remove an existing value, click remove  next to the value. -4. When you're finished, click **Save**. +4. When you're finished, click **Add**, and then click **Close**. -The SecOps mailbox entries that you configured are displayed on the **SecOps mailbox** tab. To make changes, click  **Edit** on the tab. +The SecOps mailbox entries that you configured are displayed on the **SecOps mailbox** tab. ++## Use the Microsoft 365 Defender portal to modify or remove SecOps mailboxes in the advanced delivery policy ++1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Advanced delivery** in the **Rules** section. To go directly to the **Advanced delivery** page, use <https://security.microsoft.com/advanceddelivery>. ++2. On the **Advanced delivery** page, verify that the **SecOps mailbox** tab is selected, and then click  **Edit**. ++3. In the **Edit SecOps mailboxes** flyout that opens, you add or remove mailboxes as described in the previous section. ++ To remove all mailboxes, click remove  next to each value until there are no more mailboxes selected. ++4. When you're finished, click **Save** and then click **Close**. ++The SecOps mailbox entries that you configured are displayed on the **SecOps mailbox** tab. If you removed all SecOps mailbox entries, the list will be empty. ## Use the Microsoft 365 Defender portal to configure third-party phishing simulations in the advanced delivery policy The SecOps mailbox entries that you configured are displayed on the **SecOps mai - Click  **Edit**. - If there are no configured phishing simulations, click **Add**. -3. On the **Edit third-party phishing simulation** flyout that opens, configure the following settings: +3. In the **Edit third-party phishing simulation** flyout that opens, configure the following settings: - **Domain**: Expand this setting and enter at least one email address domain (for example, contoso.com) by clicking in the box, entering a value, and then pressing Enter or selecting the value that's displayed below the box. Repeat this step as many times as necessary. You can add up to 20 entries. The SecOps mailbox entries that you configured are displayed on the **SecOps mai > - The DKIM domain. > - At least one **Sending IP**. >- > You may optionally include **Simulation URLs to allow** to ensure that URLs in simulation messages are not blocked. - > You may specify up to 10 entries for each field. + > You can optionally include **Simulation URLs to allow** to ensure that URLs in simulation messages are not blocked. + > + > You can specify up to 10 entries for each field. + > > There must be a match on at least one **Domain** and one **Sending IP**, but no association between values is maintained. -4. When you're finished, do one of the following steps: - - **First time**: Click **Add**, and then click **Close**. - - **Edit existing**: Click **Save** and then click **Close**. +4. When you're finished, click **Add**, and then click **Close**. ++The third-party phishing simulation entries that you configured are displayed on the **Phishing simulation** tab. ++## Use the Microsoft 365 Defender portal to modify or remove third-party phishing simulations in the advanced delivery policy ++1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Advanced delivery** in the **Rules** section. To go directly to the **Advanced delivery** page, use <https://security.microsoft.com/advanceddelivery>. ++2. On the **Advanced delivery** page, select the **Phishing simulation** tab, and then click  **Edit**. ++3. In the **Edit third-party phishing simulation** flyout that opens, you add or remove entries for **Domain**, **Sending IP**, and **Simulation URLs** as described in the previous section. ++ To remove all entries, click remove  next to each value until there are no more domains, IPs, or URLs selected. -The third-party phishing simulation entries that you configured are displayed on the **Phishing simulation** tab. To make changes, click  **Edit** on the tab. +4. When you're finished, click **Save** and then click **Close**. ## Additional scenarios that require filtering bypass -In addition to the two scenarios that the advanced delivery policy can help you with, there are other scenarios that might require you bypass filtering: +In addition to the two scenarios that the advanced delivery policy can help you with, there are other scenarios where you might need to bypass filtering: - **Third-party filters**: If your domain's MX record _doesn't_ point to Office 365 (messages are routed somewhere else first), [secure by default](secure-by-default.md) _is not available_. If you'd like to add protection, you'll need to enable Enhanced Filtering for Connectors (also known as _skip listing_). For more information, see [Manage mail flow using a third-party cloud service with Exchange Online](/exchange/mail-flow-best-practices/manage-mail-flow-using-third-party-cloud). If you don't want Enhanced Filtering for Connectors, use mail flow rules (also known as transport rules) to bypass Microsoft filtering for messages that have already been evaluated by third-party filtering. For more information, see [Use mail flow rules to set the SCL in messages](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl). |
| security | Manage Tenant Allow Block List | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/manage-tenant-allow-block-list.md | Use the Submissions portal (also known as *admin submission*) at <https://securi - **Files**: Email messages that contain these blocked files are blocked as *malware*. -- **URLs**: Email messages that contain these blocked URLs are blocked as *phishing*.+- **URLs**: Email messages that contain these blocked URLs are blocked as *high confidence phishing*. In the Tenant Allow/Block List, you can also directly create block entries for the following types of items: |
| security | Deploy And Configure The Report Message Add In | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/step-by-step-guides/deploy-and-configure-the-report-message-add-in.md | Title: Deploy and configure the report message add-in -description: The steps to deploy and configure Microsoft's phish reporting add-in(s) aimed at security administrators + Title: How-to deploy and configure the report message add-in +description: The steps to deploy and configure Microsoft's phish reporting add-in(s) aimed at security administrators. search.product: search.appverid: ms.prod: m365-security |
| security | Use Arc Exceptions To Mark Trusted Arc Senders | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/use-arc-exceptions-to-mark-trusted-arc-senders.md | Email authentication mechanisms like [SPF](set-up-spf-in-office-365-to-help-prev ## Authenticated Received Chain (ARC) in Microsoft 365 Defender for Office -Services that modify content during transport of the message before delivery to your organization, can invalidate the DKIM email signature and affect the authentication of the message. When these intermediary services, perform such actions, they can use ARC can be used to provide details of the original authentication before the modifications occurred, which your organization can then trust to help with authenticating the message. +Services that modify message content in transit before delivery to your organization can invalidate DKIM email signatures and affect authentication of the message. When these intermediary services perform such actions, they can use ARC to provide details of the original authentication before the modifications occurred. Your organization can then trust these details to help with authenticating the message. **Trusted ARC sealers lets admins add a list of *trusted* intermediaries into the Microsoft 365 Defender portal.** Trusted ARC sealers allows Microsoft to honor ARC signatures from these trusted intermediaries, preventing these legitimate messages from failing the authentication chain. |