| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Strong Password | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/add-users/strong-password.md | This article explains how to turn off strong password requirements for your user ## Before you begin -This article is for people who manage password policy for a business, school, or nonprofit. To complete these steps, you need to sign in with your Microsoft 365 admin account. [What's an admin account?](Overview of the Microsoft 365 admin center](../admin-overview/admin-center-overview.md) You must be an [global admin or password administrator](about-admin-roles.md) to perform these steps. +This article is for people who manage password policy for a business, school, or nonprofit. To complete these steps, you need to sign in with your Microsoft 365 admin account. [What's an admin account?](../admin-overview/admin-center-overview.md#overview-of-the-microsoft-365-admin-center) You must be a [global admin or password administrator](about-admin-roles.md) to perform these steps. You must also connect to Microsoft 365 with PowerShell. |
| admin | Adoption Score | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/adoption/adoption-score.md | + + Title: "Microsoft Adoption Score" +f1.keywords: +- NOCSH ++++audience: Admin +++ms.localizationpriority: high +monikerRange: 'o365-worldwide' ++- M365-subscription-management +- Adm_O365 +- Adm_TOC ++- AdminSurgePortfolio +- AdminTemplateSet +search.appverid: +- MET150 +- MOE150 +description: "Learn how Microsoft Adoption Score reflects people and technology experience measurements and compare to organizations of similar size." +++# Microsoft Adoption Score ++Adoption Score supports the journey to digital transformation with insights about how your organization uses Microsoft 365 and the technology experiences that support it. Your organization's score reflects people and technology experience measurements and can be compared to benchmarks from organizations similar in size to yours. ++> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE53oqt?autoplay=false] ++It provides: ++- **Metrics** to help you see where you are on your digital transformation journey. +- **Insights** about the data to help you identify opportunities to improve productivity and satisfaction in your organization. +- **Recommended actions** you can take to help your organization use Microsoft 365 products efficiently. ++We provide metrics, insights, and recommendations in two areas: ++- **People experiences:** Quantifies how the organization works using Microsoft 365 categories like content collaboration, mobility, communication, meetings, and teamwork. ++ For each of the mentioned categories, we look at public research to identify some best practices and associated benefits in the form of organizational effectiveness. For example, Forrester research has shown that when people collaborate and share content in the cloud (instead of emailing attachments), they can save up to 100 minutes a week. Furthermore, we quantify the use of these best practices in your organization to help you see where you are on your digital transformation journey. ++- **Technology experiences:** Your organization depends on reliable and well-performing technology, as well as the efficient use of Microsoft 365. [Endpoint analytics](https://aka.ms/endpointanalytics) helps you understand how your organization can be impacted by performance and health issues with your hardware and software. Microsoft 365 apps health helps you understand whether the devices in your organization are running Microsoft 365 apps on recommended channels. ++## Before you begin ++See [What is Endpoint Analytics](/mem/analytics/overview) for an overview and prerequisite details. To learn more about Microsoft 365 network connectivity insights, read [the network connectivity overview](../../enterprise/microsoft-365-networking-overview.md). ++For people experiences data, you need a Microsoft 365 for business or Office 365 for enterprise subscription. For endpoint analytics data for your tenant, you need to add Microsoft Intune to your subscription. Intune helps protect your organization's data by managing devices and apps. Once you have Intune, you can turn on endpoint analytics within the Intune experience. To learn more about Microsoft Intune, see the [Microsoft Intune documentation](/mem/intune/). ++> [!NOTE] +> A license to Workplace Analytics is not required to get the Adoption Score features. ++Adoption Score is only available in the Microsoft 365 admin center and can only be accessed by IT professionals who have one of the following roles: ++- Global admin +- Exchange admins +- SharePoint admin +- Skype for Business admin +- Teams admin +- Global Reader +- Reports Reader +- Usage Summary Reports Reader ++> [!NOTE] +> Only an IT professional with the Global Administrator role can sign up or opt in a tenant for Adoption Score. ++The role-based access control model for Adoption Score helps organizations further digital transformation efforts with Microsoft 365 by providing the flexibility to assign roles to IT professionals within an organization. ++Microsoft is committed to protecting individual privacy. This [privacy document](privacy.md) explains the controls we provide you, as your organization's IT administrator, to ensure that the information is actionable while not compromising the trust you place in Microsoft. ++You can access the experience from Microsoft 365 Admin home under **Reports** > **Adoption Score**. + +## How the score is calculated ++Your Adoption Score is based on the combined scores of your people and technology experiences categories. Each category is weighted equally, with a total of 100 points. The highest possible Adoption Score is 800. ++### Score categories ++- Communication (100 points) +- Meetings (100 points) +- Content collaboration (100 points) +- Teamwork (100 points) +- Mobility (100 points) +- Endpoint analytics (100 points) +- Network connectivity (100 points) +- Microsoft 365 Apps Health (100 points) +- **Total possible = 800 points** + +In each score category, we quantify the key indicators for how your organization is using Microsoft 365 in its journey towards digital transformation. We provide 28-day and 180-day views of the key activities. We also provide supporting metrics that are not part of the score calculation, but are important for helping you identify underlying usage statistics and configurations that you can address. ++### Products included in Adoption Score ++Adoption Score includes data from Exchange, SharePoint, OneDrive, Teams, Word, Excel, PowerPoint, OneNote, Outlook, Yammer, and Skype. ++Your organization's score is updated daily and reflects user actions completed in the last 28 (including the current day). ++## Interpreting your organization's Adoption Score ++The Adoption Score home page shows your organization's total score and score history and the primary insight for each category. +++**Your organization's score** is shown as a percent value and in points. You can see your points in the numerator and the maximum possible points in the denominator. ++**Peer benchmarks** allow you to compare your organization's score with organizations like yours. The peer benchmark for the people experiences categories is calculated as the average of measures within a set of similar organizations. The set of organizations is composed of organizations in your region with a similar number of licensed users, types of licenses, industry, and tenure with Microsoft 365. ++> [!NOTE] +> Microsoft uses internal data to determine the industry that an organization maps to. Tenants under a parent organization get mapped to the same industry as the parent organization. Organizations cannot view or modify industry mappings. ++The endpoint analytics peer benchmark includes targets for device startup performance and recommended software configuration based on aggregated median values across all tenants. ++For network connectivity, the recommended benchmark is 80 points. ++The **Score breakdown** section provides a breakdown of your Adoption Score with benchmarks by people and technology experience areas. ++Score history displays how your score in each category has changed in the past six months. ++The **People experiences** and **Technology experiences** areas contain the primary insights for the categories in those areas. You can select each category to see deeper insights. ++## Category details pages ++Each category details page shows the primary insight and supporting metrics as well as related research and actions you can take to drive change in your organization. Research supports the importance and rationale behind the primary insights for each category. For more information, [read the Forrester report](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2PBrb). ++The details pages are: +- [Content collaboration ΓÇô people experiences](content-collaboration.md) +- [Communication ΓÇô people experiences](communication.md) +- [Meetings ΓÇô people experiences](meetings.md) +- [Mobility ΓÇô people experiences](mobility.md) +- [Teamwork ΓÇô people experiences](teamwork.md) +- [Microsoft 365 Apps health ΓÇô technology experiences](apps-health.md) +- [Endpoint Analytics](/mem/analytics/productivity-score) ++## Business resilience special report ++The Business resilience report is a limited-time Workplace Intelligence report available to all Microsoft 365 customers to help them guide their organizations during this challenging time. ++This report helps organizations understand: ++- How collaboration and communication are affected by the shift to remote work. ++- The impact on work-life balance as people adjust to working from home. ++- Whether remote meetings support effective decision-making. ++[Learn more about the Business resilience report](/Workplace-Analytics/tutorials/bcrps) ++[Learn more about Microsoft Graph](/graph/) ++> [!NOTE] +> Users also have the option to get productivity insights from the [MyAnalytics dashboard](/workplace-analytics/myanalytics/use/dashboard-2). +++## We want to hear from you ++Share your thoughts about Adoption Score and your ideas about how to improve it. Use the **Feedback** sections within the product and/or reach out to the Adoption Score team at **adoptscorefeedback@microsoft.com**. ++## Related content ++[Monitor Microsoft 365 activity by using reports](../../admin/activity-reports/activity-reports.md) (article)\ +[Enable Microsoft 365 usage analytics](../../admin/usage-analytics/enable-usage-analytics.md) (article)\ +[Overview of the Microsoft 365 admin center](../admin-overview/admin-center-overview.md) (video) |
| admin | Apps Health | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/adoption/apps-health.md | + + Title: "Microsoft Adoption Score - Microsoft 365 apps health" +f1.keywords: +- NOCSH ++++audience: Admin +++ms.localizationpriority: medium ++- Microsoft 365-subscription-management +- Adm_O365 +- Adm_TOC ++monikerRange: 'o365-worldwide' +search.appverid: +- MET150 +- MOE150 +description: "Details of the Microsoft 365 Apps health - technology experiences Adoption Score." +++# Microsoft 365 Apps health ΓÇô technology experiences ++Adoption Score provides insights into your organization's digital transformation journey through its use of Microsoft 365 and the technology experiences that support it. Your organization's score reflects people and technology experience measurements and can be compared to benchmarks from organizations similar to yours. The apps health category is part of the measurements that falls under technology experiences. To learn more, check out the [Adoption Score overview](adoption-score.md) and read [Microsoft's Privacy Statement](https://privacy.microsoft.com/privacystatement). ++## Why your organization's Microsoft 365 apps health score matters ++Your organizational productivity is dependent on healthy application environment. Devices running most current versions of Microsoft 365 apps on recommended channel are more secure and help people in your organization get the most out of the features in Microsoft 365. ++## How we calculate the Microsoft 365 apps health score ++We calculate your Microsoft 365 apps health score by measuring the number of devices on each update channel. We also determine whether the devices are running a supported version, and the most current release of Microsoft 365 apps. ++We provide a primary insight in the experience that contains the key metrics for this category. Then, a scoring framework, detailed in the following sections, is used to calculate your score. ++### Primary insight ++The primary insight is calculated from devices that are running Microsoft 365 Apps on recommended updated channel. +++Information considered for this include Microsoft 365 apps channel, build, and version that is running on the device. ++1. **Header:** Shows percentage of devices on recommended update channel +1. **Body:** Provides more information on how running the devices on recommended update channel will help getting latest update and running current versions on devices. +1. **Visualization (current state):** + - Horizontal bars where the blue-colored portions represent the percentage of devices running recommended updated channel. + - Highlight the (numerator/denominator) of the fraction used to calculate the percentage expressed in horizontal bars. + - Peer Benchmark value for devices running on recommended updated channel is also shown as a percentage. ++#### Trend visualization of the primary insight ++The following chart shows the number of devices in the recommended update channel over the last 180 days. The data point on the line chart is an aggregate of activity for the last 28 days. +++### Scoring framework ++The Microsoft 365 apps health score measures whether devices are running Microsoft 365 apps on recommended channel and on latest versions. ++## Explore your organization Microsoft 365 app channels and versions ++We also provide supporting information that helps you gain additional visibility into what channels and versions devices in your organization are currently running. These additional metrics do not contribute to your Adoption Score but can help you create an action plan to increase your Microsoft 365 apps health score by making sure devices run Microsoft 365 apps on recommended channels. ++### Devices on current channel and running supported versions +++1. **Header:** Highlights the percentage of devices on the Current Channel are running supported versions of Microsoft 365 Apps +1. **Body:** Provides information about the value of devices running Microsoft 365 apps on recommended channel. +1. **Visualization:** The breakdown in the visualization represents the extent to what percentage of devices on latest and supported versions of Microsoft 365 apps across different channel), as follows: + - **Supported versions:** The blue bar represents the percentage of devices running on supported version of Microsoft 365 apps. + - **Latest releases:** The teal color bar represents percentage of devices on latest releases. +1. **Learn more:** Select this link to view help content. ++### Devices running latest and supported versions +++1. **Header:** Highlights the percentage of devices running supported versions and devices running the most recent versions. +1. **Body:** Provides information about the value running devices on recommended channels and supported/latest versions. +1. **Visualization:** The breakdown in the visualization is meant to represent the extent to show how many devices running supported versions and most recent versions of Microsoft 365 apps): + - **Supported versions:** The blue (colored) portion of the bar and the fraction (numerator/denominator) on the bar represents the percentage of devices running supported version of Microsoft 365 apps. + - Numerator: The number of devices on supported versions of Microsoft 365 apps within the last 28 days + - Denominator: The number of devices using Microsoft 365 apps within the last 28 days + - **Most recent versions:** The teal (colored) portion of the bar and the fraction (numerator/denominator) on the bar represents the percentage of devices running recent versions of Microsoft 365 apps. + - Numerator: The number of devices on recent versions of Microsoft 365 apps within the last 28 days + - Denominator: The number of devices using Microsoft 365 apps within the last 28 days +1. **Learn more:** Select this link to view help content. ++#### Trend visualization of the devices ++This chart shows the trend-line of the devices running supported versions and latest versions of Microsoft 365 apps over the last 180 days. +++## Devices in your organization ++This section helps you act on the metrics you want to focus on by providing relevant information to all the metrics for Microsoft 365 apps health - technology experiences. ++The following columns are presented in the table at the channel/version level: ++- **Channel**: Current Microsoft 365 apps channel on the devices. +- **Status**: Microsoft 365 apps support state of the devices based on current channel and version. +- **Versions**: Current Microsoft 365 apps versions on the devices. +- **# of devices**: Number of devices. ++## Related content ++[Communication ΓÇô People experiences](communication.md) (article)\ +[Content collaboration ΓÇô People experiences](content-collaboration.md) (article)\ +[Meetings ΓÇô People experiences](meetings.md) (article)\ +[Mobility ΓÇô People experiences](mobility.md) (article)\ +[Privacy controls for Adoption Score](privacy.md) (article)\ +[Teamwork ΓÇô People experiences](teamwork.md) (article) |
| admin | Communication | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/adoption/communication.md | + + Title: "Microsoft Adoption Score - Communication" +f1.keywords: +- NOCSH ++++audience: Admin +++ms.localizationpriority: medium ++- M365-subscription-management +- Adm_O365 +- Adm_TOC ++monikerRange: 'o365-worldwide' +search.appverid: +- MET150 +- MOE150 +description: "Details of the Communication - People experience Adoption Score." +++# Communication insights score ΓÇô People experiences ++Adoption Score supports the journey to digital transformation with insights about how your organization uses Microsoft 365 and the technology experiences that support it. Your organizationΓÇÖs score reflects people and technology experience measurements and can be compared to benchmarks from organizations similar in size to yours. The communication category is part of the people experiences measures. To learn more, check out the [Adoption Score overview](adoption-score.md) and read [Microsoft's Privacy Statement](https://privacy.microsoft.com/privacystatement). ++## Prerequisites ++To get started with Communication insights, people in your organization need to be licensed for: ++- Microsoft Teams +- Yammer +- Exchange Online ++For more information, see [assign licenses to users](../manage/assign-licenses-to-users.md). ++After people have been active in the above products at least once in the last 28 days, you will start to see the insights. ++## Why your organizationΓÇÖs Communication score matters ++Microsoft understands that people have different communication needs. To get a quick response to a question, you might choose to send an instant message. If you want to send status updates to your leadership, you may choose an email message. To reach a broader audience, you may choose to post a community message. Microsoft 365 enables this flexibility in communication modes to fit everyone's needs. Research shows that using real-time communication tools creates a more unified organization and builds morale, regardless of location. ++## How we calculate the communication score ++For Communication, we provide a primary insight, which contains the key metrics associated with communication in your organization, combined with a scoring framework for using these metrics to calculate your organization's score. ++### Primary insight ++Microsoft 365 provides people the flexibility to fit everyone's communication style by offering multiple modes. The primary insight provides a measure of people in your org that are using multiple modes to communicate. +++1. **Header:** Provides the key metric of people using more than one communication mode, namely: ++ - Sending emails through Exchange + - Sending messages through Teams + - Posting on communities in Yammer ++ This key metric is shown as a percentage of all people who are using two or more of Exchange, Teams, or Yammer. ++2. **Body:** Provides more information on how flexibility in the modes of communication is valuable to people in your org. ++3. **Visualization of current state:** ++ - Horizontal bar where the blue portion represents the percentage expressed in the header + - Highlights the (numerator/denominator) used for computing the percentage expressed in the header: + - **Numerator**: # of people using more than one communication mode in the last 28 days + - **Denominator**: # of people marked as enabled for more than one communication product in the last 28 days + - **Peer Benchmark** value of the key metric is also shown as a percentage ++4. **View communication resources:** Clicking here would enlist all the support content in the form of videos/articles related to Communication. From these you can navigate to the custom playlist for Communication and subsequently, for all Adoption Score categories. ++#### Trend visualization of primary insight ++ This chart provides the trend of numerator of the key metric in the primary insight ΓÇô that is, the number of people in your org using more than one communication mode over the last 180 days. Here that the daily value is an aggregate of the number of people who use multiple forms of communication over the last 28 days. +++### Scoring model ++The communication score for your organization measures at an aggregate (organization) level whether people are consistently communicating using multiple modes among email, chat, and community posts over a 28-day window. ++Scores are not provided at the individual user level. ++## Explore how your organization communicates ++We also provide you with information that helps you gain visibility into how your organization communicates. These additional metrics don't directly influence your Adoption Score, but can help you create an action plan as a part of your digital transformation. ++### Breakdown of communication by modes +++1. **Header:** Highlights the goal of the insight to provide a detailed breakdown across the different communication modes being considered within Communication. ++2. **Body:** Provides information on the value of using different modes for sharing knowledge. ++3. **Visualization:** The breakdown represents the use for each mode. The colored portion and the fraction on each bar represent the number of people sending emails,messages, or community posts as a percentage of number of people enabled for that mode: ++ - **People sending emails:** The colored portion and the fraction represent the percentage of users enabled for Exchange who are sending emails. This fraction is constructed from: ++ - **Numerator**: People sending emails in the last 28 days. + - **Denominator**: People enabled for Exchange in the last 28 days. ++ - **People sending messages in Microsoft Teams:** The colored portion and the fraction represent the percentage of users enabled for Microsoft Teams who are sending messages. This fraction is constructed from: ++ - **Numerator**: People sending messages on Microsoft Teams in the last 28 days. + - **Denominator**: People enabled for Microsoft Teams in the last 28 days. ++ - **People posting in communities:** The colored portion and the fraction represent the percentage of users enabled for Yammer that are posting in communities. This fraction is constructed from: ++ - **Numerator:** People posting in Yammer communities in the last 28 days. + - **Denominator:** People enabled for Yammer in the last 28 days. ++4. **View related content:** Select this link to view collated videos, and other related help content. ++### @mentions in emails +++1. **Header:** Highlights the increase in response rate for new email threads started in the last 28 days when they contain @mentions. ++2. **Body:** Provides information on the value of using @mentions in emails. Additionally, people using @mentions is expressed as a percentage of all users who have sent an email in the last 28 days. ++3. **Visualization:** Breaks down the response rate for new email threads based on whether they had @mentions or not: ++ - **Responses to emails with \@mentions:** The colored portion and the fraction represent the response rate for new email threads containing @mentions. This fraction is constructed from: ++ - **Numerator:** New email threads containing @mentions that were started and received a response in the last 28 days. + - **Denominator:** New email threads containing @mentions that were started in the last 28 days. ++ - **Responses to emails without \@mentions:** The colored portion and the fraction represent the response rate for new email threads containing @mentions. This fraction is constructed from: ++ - **Numerator:** New email threads that do not contain @mentions, which were started and also received a response in the last 28 days. + - **Denominator:** New email threads not containing @mentions that were started in the last 28 days. ++4. **View related content:** Select this link to view collated videos, and other related help content. +++### Breakdown of messages by type in Microsoft Teams +++1. **Header:** Highlights the people who sent channel messages as a percentage of people who sent any kind of message (including chat and channel messages) in the last 28 days. ++2. **Body:** Provides information on the value of using channel messages within Microsoft Teams. ++3. **Visualization:** Breaks down the use of chat and channel messages: ++ - **People sending chat messages:** The colored portion and the fraction represent the use of chat messages within people who sent messages on Microsoft Teams. The fraction is constructed from: ++ - **Numerator:** People who sent chat messages on Microsoft Teams in the last 28 days. + - **Denominator:** People who sent messages on Microsoft Teams in the last 28 days. ++ - **People sending Channel messages:** The colored portion and the fraction represent the use of channel messages within people sending messages on Microsoft Teams. The fraction is constructed from: ++ - **Numerator:** People who sent channel messages on Microsoft Teams in the last 28 days. + - **Denominator:** People who sent messages on Microsoft Teams in the last 28 days. ++4. **View related content:** Select this link to view collated videos, and other related help content. ++### Questions and Answers in Yammer +++1. **Header:** Highlights the posts marked as questions on Yammer that have received an answer marked as "Best answer" as a percentage of all posts marked as questions on Yammer in the last 28 days. ++2. **Body:** Provides information on the value of using questions and answers in Yammer to share knowledge. ++3. **Visualization:** Breaks down the use of the questions and answers feature in your organization: ++ - **Questions:** The colored portion of the bar and associated number represents the total number of posts marked as questions in the last 28 days. + - **Questions with answers:** The colored portion of the bar and the associated number represents the number of posts marked as questions and have received answers in the last 28 days. + - **Questions with best answers:** The colored portion of the bar and the associated number represents the number of posts that were marked as questions and have also received a "best answer" in the last 28 days. ++4. **View related content:** Select this link to view collated videos, and other related help content. ++## View communication trends over time ++For each of the insights above, you can see how the metrics trend over time by selecting an option from the dropdown shown below: +++After you select an option, the charts in the report will update to show a trend over time rather than a snapshot of the past month. +++## Related content ++[Microsoft 365 apps health ΓÇô Technology experiences](apps-health.md) (article)\ +[Content collaboration ΓÇô People experiences](content-collaboration.md) (article)\ +[Meetings ΓÇô People experiences](meetings.md) (article)\ +[Mobility ΓÇô People experiences](mobility.md) (article)\ +[Privacy controls for Adoption Score](privacy.md) (article)\ +[Teamwork ΓÇô People experiences](teamwork.md) (article) |
| admin | Content Collaboration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/adoption/content-collaboration.md | + + Title: "Microsoft Adoption Score - Content collaboration" +f1.keywords: +- NOCSH ++++audience: Admin +++ms.localizationpriority: medium ++- M365-subscription-management +- Adm_O365 +- Adm_TOC ++monikerRange: 'o365-worldwide' +search.appverid: +- MET150 +- MOE150 +description: "Details of the Content collaboration - people experiences Adoption Score." +++# Content collaboration ΓÇô People experiences ++Adoption Score provides insights into your organization's digital transformation journey through its use of Microsoft 365 and the technology experiences that support it. Your organization's score reflects people and technology experience measurements and can be compared to benchmarks from organizations similar to yours. The content collaboration category is part of the people experiences measurements. To learn more, check out the [Adoption Score overview](adoption-score.md) and read [Microsoft's Privacy Statement](https://privacy.microsoft.com/privacystatement). ++## Prerequisites ++To get started with Content collaboration insights, people in your organization need to be licensed for: ++- OneDrive for Business +- SharePoint +- Exchange Online ++For more information, see [assign licenses to users](../manage/assign-licenses-to-users.md). ++ After people have been active in the above products at least once in the last 28 days, you will start to see the insights. ++## Why your organization's content collaboration score matters ++A key aspect of digital transformation is how people collaborate in files. With your content on Microsoft 365, people access, create, modify, and collaborate on content with other people from any location. Research shows that when people collaborate with online files, each person saves an average of 100 minutes per week. ++## How we calculate the content collaboration score ++We provide a primary insight that contains the key metrics for content collaboration in your organization. Then, a scoring framework detailed below is used for these metrics to calculate your organization's score. ++> [!NOTE] +> On April 22, 2021, we changed how the collaborators metric is calculated. This affects the [primary insight](#primary-insight), the [file collaboration insight](#number-of-files-collaborated-on), and the way the content collaboration score is measured. This change helps reduce noise in the data from non-human agents (or bots) from Microsoft and other third-party applications, resulting in a more accurate and actionable score. ++### Primary insight ++Microsoft OneDrive for Business and SharePoint help people to easily create, read, and discover their individual and shared content in Microsoft 365 from across devices and applications. They also allow people to securely share and collaborate on content. The primary insight contains information from everyone who can use OneDrive for Business and SharePoint. Additionally it breaks down the details about how many people read, create, and collaborate on content stored in OneDrive for Business and SharePoint. +++Types considered for this information include Word, Excel, PowerPoint, OneNote, and PDF files. ++1. **Header:** Shows the percentage of people in your org who have access to OneDrive or SharePoint who are collaborating on content. +2. **Body:** Provides more information on how the behaviors of reading and creating files online are linked to collaborating on files. +3. **Visualization (current state):** + - Horizontal bars where the blue-colored portions represent the percentage of people enabled for file collaboration through OneDrive or SharePoint who have been **readers, creators,** or **collaborators** on online files in the last 28 days. ++ They're defined as follows:</br> + **Readers:** People who access or download online files in OneDrive or SharePoint.</br> + **Creators:** People who create, modify, upload, sync, check in, copy, or move online OneDrive or SharePoint files.</br> + **Collaborators:** People who collaborate with online files by using OneDrive or SharePoint. Two people are collaborators if one of them reads or edits an online Office app or PDF after the other person has created or modified it, within a 28-day window. ++ > [!NOTE] + > The files considered in the visualization are Word, Excel, PowerPoint, OneNote, or PDF files that are online and saved to OneDrive or SharePoint. ++ - Highlight (numerator/denominator) of the fraction is used to calculate the percentage expressed in each of the horizontal bars. + - **Readers:**</br> + - Numerator: Number of people who access or download online files in OneDrive or SharePoint in the last 28 days + - Denominator: Number of people who had access to OneDrive or SharePoint for at least 1 of the last 28 days</br> + - **Creators:**</br> + - Numerator: Number of people who create, modify, upload, sync, check in, copy, or move online files in OneDrive or SharePoint in the last 28 days</br> + - Denominator: Number of people who have had access to OneDrive or SharePoint for at least 1 of the last 28 days. </br> + - **Collaborators:**</br> + - Numerator: Number of people who have collaborated on online files in OneDrive or SharePoint in the last 28 days </br> + - Denominator: Number of people who have had access to for OneDrive or SharePoint for at least 1 of the last 28 days ++ - Peer benchmark value for each of readers, creators, and collaborators is also shown as a percentage. In other words, the value of the number of creators is shown as a percentage of the number of people who have access to OneDrive or SharePoint. +4. **Link to resources:** Select this link to view collated videos, and other related help content. ++#### Trend visualization of primary insight ++The trend visualizations chart shows the trend-line of the primary insight key metrics for readers, creators, and collaborators, over the last 180 days. Each data point on the chart is an aggregate of activity for the last 28 days. Each creator data-point provides a count of all people who were tagged as creators within the last 28 days for each date on the x axis. +++### Scoring framework ++The content collaboration score for your organization measures at an aggregate (organization) level whether people are consistently reading, creating, or collaborating on online Office files such as Word, Excel, PowerPoint, OneNote, or PDFs, or in OneDrive or SharePoint. ++Scores are not provided at the individual user level. ++## Explore how your organization collaborates ++We also provide you with information that helps you gain visibility into how your organization collaborates on content. These additional metrics don't directly contribute to your Adoption Score but help you create an action plan as part of your digital transformation to help optimize the way people work. ++### Creating files in OneDrive or SharePoint +++1. **Header:** Highlights the percentage of people active on Microsoft 365 Office applications who create files on OneDrive or SharePoint. +2. **Body:** Provides information about the value of content creation in OneDrive and SharePoint. +3. **Visualization:** The breakdown in the visualization represents the extent to which people who are using Microsoft Office apps to create files in OneDrive and SharePoint, as follows: + - **OneDrive:** The blue (colored) portion of the bar and the fraction on the bar represent the percentage of people active on Office applications creating content on OneDrive as follows: + - Numerator: The number of people who create, modify, upload, sync, check in, copy, or move online Office files in OneDrive within the last 28 days.</br> + - Denominator: The number of people who have access to OneDrive or SharePoint and access office files within the last 28 days. + - **SharePoint:** The blue (colored) portion of the bar and the fraction on the bar represent the percentage of people who are active on Office applications and create content on SharePoint as:</br> + - Numerator: The number of people who create, modify, upload, sync, check in, copy, or move online Office files (Microsoft Word, Excel, PowerPoint, or OneNote files) on SharePoint within the last 28 days. </br> + - Denominator: The number of people who have access to OneDrive or SharePoint and have accessed Office files within the last 28 days. ++4. **Link to resources:** Select this link to view help content. ++### Use of attachments in email ++**Use of attachments in email** +Understand how many users are attaching physical files in email rather than links to content in the cloud, and monitor the reduction of this number over time. +++1. **Header:** Highlights the percentage of people who use attachments in emails that were not saved to online files. +2. **Body:** Provides information about the value of sharing links to online files from a collaboration and security perspective. +3. **Visualization:** The breakdown in the visualization is meant to represent the extent to which people who are attaching content in emails are using different modes (files not saved to online files, links to online files): + - **Attach files:** The blue (colored) portion of the bar and the fraction (numerator/denominator) on the bar represents the percentage of people using attachments in emails. + - Numerator: The number of people who attach files to email that weren't saved to online file within the last 28 days. + - Denominator: The number of people who have had access to Exchange and OneDrive, SharePoint, or both within the last 28 days. + - **Links to online files:** The blue (colored) portion of the bar and the fraction (numerator/denominator) on the bar represent the percentage of people using attachments and attaching links to files in emails. + - Numerator: The number of people attaching links to online files to emails within the last 28 days. + - Denominator: The number of people who have access to Exchange and OneDrive, SharePoint, or both within the last 28 days. +4. **Link to resources:** Select this link to view help content. ++### Sharing of online files +++1. **Header:** Highlights the percentage of people who have access to for OneDrive or SharePoint who are sharing files externally. +2. **Body:** Provides information about the admins' ability to change the file- sharing settings in the organization to enable the level of collaboration best suited to your organization. +3. **Visualization:** Represents the extent to which people who have access to OneDrive or SharePoint are sharing files internally or externally: + - **Externally:** The blue (colored) portion of the bar and the fraction (numerator/denominator) on the bar represent the percentage of people who have access to OneDrive or SharePoint and are sharing files externally. + - Numerator: The number of people who have shared files externally with in the last 28 days + - Denominator: The total number of people who have had access to OneDrive or SharePoint for at least 1 of the last 28 days. + - **Internally only:** The blue (colored) portion of the bar and the fraction (numerator/denominator) on the bar represent the percentage of people who have access to OneDrive or SharePoint and are sharing files internally only. + - Numerator: The number of people who have shared files internally only within the last 28 days + - Denominator: The total number of people who have had access to OneDrive or SharePoint for at least 1 of the last 28 days. +4. **Link to resources:** Select this link to view help content. ++### Number of files collaborated on +++1. **Header:** Highlights the percentage of people who have access to OneDrive or SharePoint who are collaborating on 4 or more files. +2. **Body:** Provides information about how people can leverage online files for better collaboration. +3. **Visualization:** Shows a distribution of the people who have access to OneDrive or SharePoint, based on the number of files they collaborate on. This is shown through the following 4 categories (for each, the blue portion of the bar and the fraction represent the percentage of people who have access to OneDrive or SharePoint that fall into that category): + - **No collaboration:** + - Numerator: Number of people not collaborating on any files in the last 28 days. + - Denominator: Total number of people who have access to OneDrive or SharePoint for at least 1 of the last 28 days. + - **Collaboration on 1-3 files:** + - Numerator: Number of people collaborating on 1-3 files in the last 28 days. + - Denominator: Total number of people who have had access to OneDrive or SharePoint for at least 1 of the last 28 days. + - **Collaboration on 4-10 files:** + - Numerator: Number of people collaborating on 4-10 files in the last 28 days. + - Denominator: Total number of people who have had access to OneDrive or SharePoint for at least 1 of the last 28 days. + - **Collaboration on 11 or more files:** + - Numerator: Number of people collaborating on 11 or more files in the last 28 days. + - Denominator: Total number of people who have had access to OneDrive or SharePoint for at least 1 of the last 28 days. +4. **Link to resources:** Select this link to view help content. ++### Network performance strength for OneDrive and SharePoint +++1. **Header:** Highlights the percentage of devices out of all tested that has poor network connection to OneDrive and SharePoint. +2. **Body:** Provides information about why network connection performance important for collaboration. +3. **Visualization:** Shows a percentage of devices with different levels of network connectivity performance related to OneDrive and SharePoint: + - **81-100 (best)**: The dark green (colored) portion of the bar represents the percentage of devices with the best performance. + - **61-80**: The green (colored) portion of the bar represents the percentage of devices with a network performance score between 60-80. + - **41-60**: The orange (colored) portion of the bar represents the percentage of devices with a network performance score between 40-60. + - **21-40**: The red (colored) portion of the bar represents the percentage of devices with a network performance score between 20-40. + - **0-20**: The dark red (colored) portion of the bar represents the percentage of devices with the worst network performance score between 0-20. ++## View content collaboration trends over time ++For each of the insights above, you can see how the metrics trend over time by selecting an option from the dropdown shown below: ++ ++After you select an option, the charts in the report will update to show a trend over time rather than a snapshot of the past month. ++## Related content ++[Microsoft 365 apps health ΓÇô Technology experiences](apps-health.md) (article)\ +[Communication ΓÇô People experiences](communication.md) (article)\ +[Meetings ΓÇô People experiences](meetings.md) (article)\ +[Mobility ΓÇô People experiences](mobility.md) (article)\ +[Privacy controls for Adoption Score](privacy.md) (article)\ +[Teamwork ΓÇô People experiences](teamwork.md) (article) |
| admin | Meetings | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/adoption/meetings.md | + + Title: "Microsoft Adoption Score - Meetings" +f1.keywords: +- NOCSH ++++audience: Admin +++ms.localizationpriority: medium ++- M365-subscription-management +- Adm_O365 +- Adm_TOC ++monikerRange: 'o365-worldwide' +search.appverid: +- MET150 +- MOE150 +description: "Details of the Meetings - people experiences Adoption Score." +++# Meetings insights score ΓÇô People experiences ++Adoption Score provides insights into your organization's digital transformation journey through its use of Microsoft 365 and the technology experiences that support it. Your organization's score reflects people and technology experience measurements and can be compared to benchmarks from organizations similar to yours. The meetings category is part of the people experiences measures. To learn more, check out the [Adoption Score overview](adoption-score.md) and read [Microsoft's Privacy Statement](https://privacy.microsoft.com/privacystatement). ++## Prerequisites ++To get started with Meetings insights, people in your organization need to be licensed for: ++- Microsoft Teams ++For more information, see [assign licenses to users](../manage/assign-licenses-to-users.md). ++After people have been active in Teams at least once in the last 28 days, you will start to see the insights. ++## Why your organization's meetings score matters ++Meetings, where people explore ideas, plan, solve problems, and make decisions, are a fundamental pillar for organizational productivity. Research indicates that when people use online meeting tools effectively, they tend to save up to 104 minutes per week. ++## How we calculate the meetings score ++We provide a primary insight in the experience that contains the key metrics for this category. Then, a scoring framework, detailed below, is used for these metrics to calculate your organization's score. ++### Primary insight ++Microsoft Teams integrate with Outlook calendar and provides a host of capabilities to make your meetings more engaging and effective. The primary insight looks at all Microsoft Teams online meetings that were held in your organization. The Primary insight also tracks how many meetings follow at least one of the best practices for Teams meetings. +++1. **Header:** Shows the percentage of online meetings on Microsoft Teams held in the past 28 days that had video or screen sharing during the meeting. +2. **Body:** Provides more information on how following best practices for engagement during a meeting, such as use of video or screen sharing, can make meetings more effective. +3. **Visualization (current state):** ++ - In this horizontal bar chart, the blue (colored) portion represents the percentage shown in the header + - The fraction (numerator/denominator) is used for calculating the percentage shown in the header + - Numerator: The number of online Microsoft Teams meetings including people from your organization who have used video or screen sharing. + - Denominator: The number of online Microsoft Teams meetings including people from your organization that were held in the last 28 days. + - The peer benchmark value of the key metric is also shown as a percentage. +1. **Link to resources:** Select this link to view help content. ++#### Trend visualization of the primary insight ++The following chart shows the trend-lines of both the numerator and the denominator of the key metric from the primary insight. In other words, it shows the number of online Microsoft Teams meetings with best practices, such as video or screen sharing, and the total number of online Microsoft Teams meetings held over the last 180 days. Each data point on the line chart is an aggregate of activity for the last 28 days. +++### Scoring framework ++The meetings score for your organization measures the degree to which online Microsoft Teams meetings in your organization followed best practices in the last 28 days. It is weighted based on the number of people in your org attending the meetings and the meetings' duration. ++## Explore more about meetings in your organization ++We also provide you with supporting information to hep you understand how people in your organization, as an aggregate, conduct meetings. These additional metrics don't directly contribute to your Adoption Score, but can help you create an action plan as part of your digital transformation. ++### Breakdown of how many meetings follow best practices +++1. **Header:** Highlights the percentage of online Microsoft Teams meetings that use video best practices considered in the primary insight and scoring. +2. **Body:** Hrovides information on the value of using these practices during meetings to make them more engaging. +3. **Visualization:** The breakdown in the visualization is meant to represent the extent to which online Microsoft Teams meetings are following each of the following best practices: + - **Video**: The colored portion and the fraction represent the percentage of online Microsoft Teams meetings that have video turned on. The fraction is constructed from: + - Numerator: Online Microsoft Teams meetings held in the last 28 days that had video from at least one participant turned on. + - Denominator: The total number of online Microsoft Teams meetings held in your organization in the last 28 days + - **Screen sharing**: The colored portion and the fraction represent the percentage of online Microsoft Teams meetings in which people used the screen-sharing feature. The fraction includes: + - Numerator: Online Microsoft Teams meetings held in the last 28 days that had at least one participant sharing their screen. + - Denominator: The total number of online Microsoft Teams meetings conducted in your organization in the last 28 days +++### Distribution of time spent by people in meetings +++1. **Header:** Shows the percentage of people in your organization who attend online Microsoft Teams meetings for more than 20 hours per week on average, based on their activity in the last 28 days. +2. **Body:** Provides details on the value of using meeting best practices to make meetings engaged and productive +3. **Visualization:** Provides a view of people in your organization based on their average time spent per week in meetings within the last 28 days. The following information is provided for each category: + - **Total meeting attendees:** Shows the number of people in your organization who attended meetings, based on the average meeting duration range, in the last 28 days. For example, the 6-10 hours category indicates the number of people who attended meetings for an average of that many hours per week in the last 28 days. + - **Attendees in meetings with video:** For each category, this shows how many people in your organization were in any meeting with video in the last 28 days. + - **Attendees in meetings with screen sharing:** For each category, this shows how many people were in a meeting that included screen sharing in the last 28 days. ++### Distribution of meeting length by type +++1. **Header:** Shows the percentage of instant (not previously scheduled) online Microsoft Teams meetings in the last 28 days that are under 30 minutes long. +2. **Body:** Provides information about the value of using instant meetings to resolve issues quickly. +3. **Visualization:** Provides the distribution of length (in minutes) of instant and scheduled meetings that took place in your organization in the last 28 days. The distribution categorizes each meeting into 1-15 minutes, 16-30 minutes, 31-60 minutes, and greater than 60 minutes. ++ > [!NOTE] + > the scheduled meetings include all meetings that appeared on people's calendars. The instant meetings include calls, including both 1:1 and group calls, as well as meetings started using the "Meet now" feature in Microsoft Teams channels. +++### Use of different meeting types +++1. **Header:** Highlights the percentage of instant online Microsoft Teams meetings over the preceding 28 days that are less than 30 minutes long. +2. **Body:** Provides information about the value of using "Meet now" in the Microsoft Teams channel feature. +3. **Visualization:** Shows what type of meetings are being attended by people who are attending any online Microsoft Teams meetings. Each meeting type is represented as a horizontal bar, where the colored portion and the fraction represent the following: + - **Instant 1:1 calls**: + - Numerator: The number of people attending 1:1 calls in the last 28 days + - Denominator: The number of people attending any online Microsoft Teams meeting in the last 28 days + - **Instant group calls**: + - Numerator: The number of people attending group calls in the last 28 days + - Denominator : The number of people attending any online Microsoft Teams meeting in the last 28 days + - **Instant Meet now in channel**: + - Numerator: The number of people using "Meet now" feature within Microsoft Teams channels (for instant meetings) in the last 28 days + - Denominator: The number of people attending any online Microsoft Teams meeting in the last 28 days + - **Scheduled one-off meetings:** + - Numerator: The number of people attending one-off online Microsoft Teams meetings on their calendar (scheduled) in the last 28 days + - Denominator: The number of people attending any online Microsoft Teams meeting in the last 28 days + - **Scheduled recurring meetings:** + - Numerator: The number of people attending instances of recurring meetings on their calendar (scheduled) in the last 28 days + - Denominator: The number of people attending any online Microsoft Teams meeting in the last 28 days ++## Related content ++[Microsoft 365 apps health ΓÇô Technology experiences](apps-health.md) (article)\ +[Communication ΓÇô People experiences](communication.md) (article)\ +[Content collaboration ΓÇô People experiences](content-collaboration.md) (article)\ +[Mobility ΓÇô People experiences](mobility.md) (article)\ +[Privacy controls for Adoption Score](privacy.md) (article)\ +[Teamwork ΓÇô People experiences](teamwork.md) (article) |
| admin | Mobility | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/adoption/mobility.md | + + Title: "Microsoft Adoption Score - Mobility" +f1.keywords: +- NOCSH ++++audience: Admin +++ms.localizationpriority: medium ++- M365-subscription-management +- Adm_O365 +- Adm_TOC ++monikerRange: 'o365-worldwide' +search.appverid: +- MET150 +- MOE150 +description: "Details of the Mobility - people experiences Adoption Score." +++# Mobility insights score ΓÇô People experiences ++Adoption Score provides insights into your organization's digital transformation journey through its use of Microsoft 365 and the technology experiences that support it. Your organization's score reflects people and technology experience measurements and can be compared to benchmarks from organizations similar to yours. The mobility category is part of the people experiences measures. To learn more, check out the [Adoption Score overview](adoption-score.md) and read [Microsoft's Privacy Statement](https://privacy.microsoft.com/privacystatement). ++## Prerequisites ++To get started with Mobility insights, people in your organization need to be licensed for: ++- Microsoft Teams +- Exchange Online +- Word +- Excel +- PowerPoint +- OneNote ++For more information, see [assign licenses to users](../manage/assign-licenses-to-users.md). ++After people have been active in the above products at least once in the last 28 days, you will start to see the insights. ++## Why your organization's mobility score matters ++A fundamental pillar of organizational productivity is how well people are able to work flexibly from wherever they are. With Microsoft 365, people can stay connected with Outlook, Microsoft Teams, and Yammer. People can also seamlessly collaborate on content by using Word, Excel, PowerPoint, and OneNote from any location, and platforms. ++## How we calculate the score ++We provide a primary insight in the experience that contains the key metrics for this category. Then, a scoring framework detailed below is used for these metrics to calculate your organization's score. ++### Primary insight ++Microsoft 365 lets people work flexibly across apps, including Microsoft Outlook, Word, Excel, PowerPoint, OneNote, Microsoft Teams, Yammer, and Skype for Business. People can also work from anywhere by using a seamless experience across desktop, web, and mobile platforms. The primary insight looks at the products that are enabled for people in your organization ΓÇô and how many of these people are active on at least two platforms. +++1. **Header:** Shows the percentage of people in your org who have access to any of Microsoft 365 Apps, and who are active on at least one of these applications on more than one platform. +2. **Body:** Provides more information on how the use of these applications on multiple platforms can promote efficiency and satisfaction. +3. **Visualization (current state):** Shows how many people use more than one platform across desktop, mobile, and web for at least one Microsoft 365 (list below) as follows: + - **Horizontal bar** where the blue (colored) portion represents the percentage expressed in the header. + - **The fraction** on the bar highlights the (numerator/denominator) used for calculating the percentage in the header. + - Numerator: The number of people in your org using any application within Microsoft Outlook, Word, Excel, PowerPoint, OneNote and Microsoft Teams, Yammer, and Skype on more than one platform from desktop, web, and mobile in the last 28 days. + - Denominator: The number of people licensed for Microsoft 365 Apps, Exchange, Yammer, Microsoft Teams, or Skype for at least 1 of the last 28 days. + - The **peer benchmark** value for the key metric is also shown as a percentage. +4. **View Mobility resources:** Select this link to view help content. ++#### Trend visualization of the primary insight +++This chart shows the trend-line, where the numerator is the number of people who have used apps, over the last 180 days. Each data point on the line chart is an aggregate of activity for the last 28 days. Each data point provides a count of all people in your org using an application across at least two platforms in the last 28 days for each date on the x-axis. ++### Scoring framework ++The mobility score for your organization measures at an organization (aggregate) level whether people are using Microsoft 365 Apps - Outlook, Teams, Word, Excel, PowerPoint, OneNote, Yammer, and Skype - across the different platforms - desktop, web, and mobile. ++The scores are not provided at the individual user level. ++## Explore how your org works across platforms and locations ++We also provide you with information that helps you gain visibility into how people in your organization work across platforms. These additional metrics do not directly contribute to your Adoption Score, but help you create an action plan as part of your digital transformation. ++### Use of Outlook across platforms +++1. **Header:** Shows the percentage of people active on Outlook who are using Outlook on multiple platforms. +2. **Body:** Provides information about the value of using Outlook on mobile devices to help stay connected from anywhere on email. +3. **Visualization:** Shows the percentage of people who are active on Outlook and are using either one or more than one platform: + - **Multiple platforms:** + - Numerator: The number of people who have used Outlook on at least two platforms from desktop, mobile, or web in the last 28 days. + - Denominator: The number of people who have used Outlook at least once in the last 28 days. + - **Desktop only:** + - Numerator: The number of people who have used Outlook on only a desktop platform in the last 28 days. + - Denominator: The number of people who have used Outlook at least once in the last 28 days + - **Web only:** + - Numerator: The number of people who have used Outlook on only a web platform in the last 28 days. + - Denominator: The number of people who have used Outlook at least once in the last 28 days. + - **Mobile only:** + - Numerator: Number of people who have used Outlook on only a mobile platform in the last 28 days. + - *Denominator: Number of people who have used Outlook at least once in the last 28 days. ++### Use of Teams across platforms +++1. **Header:** Shows what percentage of people who are active on Microsoft Teams are using it on multiple platforms. +2. **Body:** Provides information about the value of using Teams on mobile devices to help people stay up to date on messages while working from any location. +3. **Visualization:** Shows the percentage of people active on Microsoft Teams who are using it on either a single platform, or multiple ones: + - **Multiple platforms:** + - Numerator: The number of people who have used Teams in the last 28 days on 2 or more of the following platforms: desktop, mobile, or web. + - Denominator: The number of people who have used Microsoft Teams at least once in the last 28 days. + - **Desktop only:** + - Numerator: The number of people who have used Microsoft Teams only on a desktop platform in the last 28 days + - Denominator: The number of people who have used Teams at least once in the last 28 days + - **Web only:** + - Numerator: The number of people who have used Microsoft Teams only on a web platform in the last 28 days + - Denominator: The number of people who have used Microsoft Teams at least once in the last 28 days + - **Mobile only:** + - Numerator: The number of people who have used Microsoft Teams only on a mobile platform in the last 28 days + - Denominator: The number of people who have used Teams at least once in the last 28 days ++### Use of Microsoft 365 Apps across platforms +++1. **Header:** Shows the percentage of people active on Microsoft 365 Apps (Word, Excel, PowerPoint, and OneNote) on multiple platforms. +2. **Body:** Provides information about the value of providing people in your organization the flexibility to access their files from anywhere. +3. **Visualization:** The grouped vertical is meant to represent the number of people who are using each of the apps consideredΓÇôWord, Excel, PowerPoint, and OneNote ΓÇö across single or multiple platforms. For each of these applications, bars represent the following: + - **Multiple platforms:** The number of users active on an app across at least two platforms in the last 28 days. + - **Desktop only:** The number of users active on app on only the desktop platform in the last 28 days. + - **Web only:** The number of users active on app on only the web platform in the last 28 days. + - **Mobile only:** The number of users active on app on only mobile platform in the last 28 days. ++### Remote work +++1. **Header:** Shows the percentage of people working only from home or location outside of their company's network. +2. **Body:** Highlights the importance of facilitating remote work for people without access to your organization's physical offices. +3. **Visualization:** Shows trend-line for daily percentage of people who only work remotely as well as daily percentage of people who also work onsite. Users are considered onsite if they perform at least three hours of activity in Microsoft 365 Apps in a day. ++## View mobility trends over time ++For each of the insights above, you can see how the metrics trend over time by selecting an option from the dropdown shown below: ++ ++After you select an option, the charts in the report will update to show a trend over time rather than a snapshot of the past month. ++## Related content ++[Microsoft 365 apps health ΓÇô Technology experiences](apps-health.md) (article)\ +[Communication ΓÇô People experiences](communication.md) (article)\ +[Content collaboration ΓÇô People experiences](content-collaboration.md) (article)\ +[Meetings ΓÇô People experiences](meetings.md) (article)\ +[Privacy controls for Adoption Score](privacy.md) (article)\ +[Teamwork ΓÇô People experiences](teamwork.md) (article) |
| admin | Privacy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/adoption/privacy.md | + + Title: "Microsoft Adoption Score - Privacy" +f1.keywords: +- NOCSH ++++audience: Admin +++ms.localizationpriority: medium +monikerRange: 'o365-worldwide' ++- M365-subscription-management +- Adm_O365 +++search.appverid: +- MET150 +- MOE150 +description: "How privacy is protected with the Adoption Score." +++# Privacy controls for Adoption Score ++Adoption Score provides insights into your organizationΓÇÖs digital transformation journey through its use of Microsoft 365 and the technology experiences that support it. Your organizationΓÇÖs score reflects people and technology experience measurements and can be compared to benchmarks from organizations similar to yours. For more details, view the [Adoption Score overview](adoption-score.md). ++Your privacy is important to Microsoft. To learn how we protect your privacy, see [Microsoft's privacy statement](https://privacy.microsoft.com/privacystatement). Adoption Score gives you, as your organization's IT administrator, access to privacy settings to help make sure any Adoption Score information you view is actionable, while not compromising the trust your organization places in Microsoft. ++Within the people experiences area, metrics are available at the organizational level only. This area looks at how people use Microsoft 365 by looking at the categories of content collaboration, mobility, meetings, teamwork, and communication. We enable you with several levels of controls to help you meet your internal privacy policy needs. +The controls give you: ++- Flexible admin roles to control who can see the information in Adoption Score. +- The capability to opt out of the people experiences area. ++## Flexible admin roles to control who can see the information in Adoption Score ++To view the entire Adoption Score, you need be one of the following admin roles: ++- Global admin +- Exchange admins +- SharePoint admin +- Skype for Business admin +- Teams admin +- Global Reader +- Reports Reader +- Usage Summary Reports Reader ++Assign the Reports Reader or the Usage Summary Reports Reader role to anyone who's responsible for change management and adoption, but not necessarily an IT administrator. This role gives them access to the complete Adoption Score experience in the Microsoft 365 admin Center. ++The Usage Summary Reports Reader role will have to be assigned through PowerShell cmdlets until it becomes assignable from the Microsoft 365 admin center later in 2020. ++To assign the Usage Summary Reports Reader role with PowerShell: ++- Run the following PowerShell: ++```powershell +Connect-AzureAD +Enable-AzureADDirectoryRole -RoleTemplateId '75934031-6c7e-415a-99d7-48dbd49e875e' +$role=Get-AzureADDirectoryRole -Filter "roleTemplateId eq '75934031-6c7e-415a-99d7-48dbd49e875e'" +Get-AzureADDirectoryRoleMember -ObjectId $role.ObjectId +$u=Get-AzureADUser -ObjectId <user upn> +Add-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -RefObjectId $u.ObjectId +``` ++## Capability to opt out of people experiences ++You can also opt out of the people experiences area of Adoption Score. If you opt out, no one from your organization will be able to view these metrics, and your organization will be removed from any calculations that involve communication, meetings, teamwork, content collaboration, and mobility. You have to be a Global admin to opt your organization out of the people experiences reports. ++To opt out: ++1. In the admin center, go to **Settings** > **Org Settings** > **Adoption Score**. +2. Un-check the box that says **Allow Microsoft 365 usage data to be used for people experiences insights**. To understand how to modify data-sharing settings for Endpoint Analytics in the Intune configuration manager, select **Learn more**. +3. Select **Save**. + |
| admin | Teamwork | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/adoption/teamwork.md | + + Title: "Microsoft Adoption Score - Teamwork" +f1.keywords: +- NOCSH ++++audience: Admin +++ms.localizationpriority: medium ++- M365-subscription-management +- Adm_O365 +- Adm_TOC ++monikerRange: 'o365-worldwide' +search.appverid: +- MET150 +- MOE150 +description: "Details of the Teamwork - people experiences Adoption Score." +++# Teamwork ΓÇô People experiences ++Adoption Score provides insights into your organization's digital transformation journey through its use of Microsoft 365 and the technology experiences that support it. Your organization's score reflects people and technology experience measurements and can be compared to benchmarks from organizations similar to yours. The teamwork category is part of the measurements that falls under people experiences. To learn more, check out the [Adoption Score overview](adoption-score.md) and read [Microsoft's Privacy Statement](https://privacy.microsoft.com/privacystatement). ++## Prerequisites ++To get started with teamwork insights, people in your organization need to be licensed for: ++- Microsoft Teams +- SharePoint +- Exchange Online ++For more information, see [assign licenses to users](../manage/assign-licenses-to-users.md). ++After people have been active in the above products at least once in the last 28 days, you will start to see the insights. ++## Why your org's teamwork score matters ++A fundamental pillar for organizational productivity is when a group of people with a common goal work with each other and with common resources for collective success. Research indicates that when people share information and collaborate in shared workspaces, they save up to 4 hours a week. They can find related documents, find context for previous discussions, and deliver towards shared goals. See the[evidence](https://www.microsoft.com/microsoft-365/blog/wp-content/uploads/sites/2/2019/04/Total-Economic-Impact-Microsoft-Teams.pdf) ++## How we calculate the teamwork score ++We provide a primary insight in the experience that contains the key metrics for this category in your organization. Then, a scoring framework, detailed below, is used for these metrics to calculate your organizationΓÇÖs score. ++### Primary insight ++The primary insight looks at all the people who are communicating using email and messages on Microsoft Teams, and interacting with content on the cloud in shared workspaces. Within Microsoft 365, Microsoft 365 Groups are the foundation for people to come together in a shared workspace with the ability to send emails to the group mailbox, share files on the SharePoint team site, and send channel messages through Microsoft Teams. +++1. **Header:** Provides the key metric of people inyour org performing any one the following activities: + - Sending email to a group mailbox through Exchange. + - Sending channel messages through Teams + - Reading and creating content (what we collectively refer to as content interaction) in SharePoint team sites. ++ As a percentage of all people in your org who are performing any of the following activities (within or outside of shared workspaces): + - Sending email through Exchange. + - Sending messages (chat or channel messages) on Microsoft Teams. + - Reading and creating content on OneDrive or SharePoint. ++ And have access to at least one of the following ++1. **Body:** Provides more information on how communicating and interacting with content, when done within a shared workspace, can have positive outcomes for productivity in your organization. +2. **Visualization (current state):** + - Horizontal bar where the blue portion represents the percentage expressed in the header + - Highlights the fraction (numerator/denominator) used for computing the percentage shown in the header + - Numerator: The number of people in your organization who send email to a group mailbox through Exchange, OR who are sending channel messages through Teams, OR reading and creating content in SharePoint team sites. + - Denominator: The number of people in your org who send emails through Exchange, OR send messages (chat or channel messages) on Microsoft Teams, OR read and create content on OneDrive or SharePoint, AND have access to at least one of the following + - The peer benchmark value of the key metric is also shown as a percentage. +3. **View resources about teamwork:** Select this link to view help content. ++#### Trend visualization of the primary insight ++The following chart provides the trend of the numerator and the denominator of the key metric in the primary insight. It shows the number of people engaged in shared workspaces, and the number of people communicating or interacting with content within the last 180 days. Each data point on the line chart is an aggregate of activity for the last 28 days. +++### Scoring framework ++The teamwork score for your organization measures at an aggregate (organizational) level whether users are consistently communicating or engaging in file activity in shared workspaces within the last 28 days. ++Scores are not provided at the individual user level . ++## Explore more about teamwork in your organization ++We also provide additional information about how people in your organization work together. These additional metrics don't directly contribute to your Adoption Score, but are relevant in helping you create an action plan as part of your digital transformation. ++### Breakdown of how people engage in shared workspaces +++1. **Header:** Shows a detailed breakdown across the different types of teamwork being measured. +2. **Body:** Provides information on the value of working in shared workspaces to help teams be more effective. +3. **Visualization:** The visualization shows the extent to which people who are communicating or interacting with content are doing so in shared workspaces, as follows: + - **Sending email**: The colored portion and the fraction represent the percentage of people sending email to group mailboxes. The fraction is comprised of: + - Numerator: People sending emails to group mailboxes in the last 28 days. + - Denominator: People sending emails in the last 28 days. This is the same group of people who are marked as sending email in the primary insight of communication Adoption Score. + - **Sending messages**: The colored portion and the fraction represent the percentage of people sending messages in channels in Microsoft Teams. The fraction is comprised of: + - Numerator: People sending channel messages within the last 28 days. + - Denominator: People sending chat or channel messages in the last 28 days. This is the same group of people who are marked as sending messages in Microsoft Teams in the primary insight of the communication category in Adoption Score. + - **Creating content**: The colored portion and the fraction represent the percentage of people reading or creating content on Microsoft 365 SharePoint team sites. + - Numerator: Number of people reading or creating content on Microsoft 365 group connected team sites. + - Denominator: Number of people with access to SharePoint, who read or created content of any kind in OneDrive or SharePoint sites in the last 28 days. +4. **View related content:** Select this link to view help content. ++### Breakdown of workspace engagement by size and age +++1. **Header:** Shows the categorization of engagement in workspaces, broken out by size for the number of members in the workspace, and the workspace age in months. +2. **Body:** Provides information about the value of encouraging people in your organization to keep only the workspaces that are needed to promote more effective teamwork. +3. **Visualization:** The engagement breakdown is shown in the form of a heat-map across two dimensions. ++ - **Size of workspace:** Workspaces are broken down into three categories based on the number of members: 2-10 people, 11-100 people, and over 100 people. The "All" category includes all size categories. + - **Age of workspace:** Workspaces are categorized by the number of months since the workspace was first created. The "All" category includes all age categories. ++ Each cell in the chart has a number and color based on the percentage of engaged workspaces that belong in that category. The workspace categories are based on the age and size shown in the intersection of that cell. For example, if the cell at the intersection of 11-100 people and 4-12 months has a value of 52%, it means that 52% of the workspaces with 11-100 members that are between 4-12 months old, have some form of engagement. The percentage is calculated as: ++ - **Numerator:** Workspaces that have engagement in the form of communication (email and channel messages) or content interaction in the last 28 days + - **Denominator:** all workspaces that are available in your org for the last 28 days ++1. **View related content:** Select this link to view help content. ++### Breakdown of workspaces by level of engagement +++1. **Header:** Provides a breakdown of workspaces broken out by level of engagement, using group email, channel messages, and content interaction. +2. **Body:** Provides information on the value of consistent engagement in the shared workspaces to help make them more effective at teamwork. +3. **Visualization:** Provides a view of the workspaces in your organization based on the intensity of engagement per week. The view includes distributions for different activity types measured within teamwork, in addition to any engagement, which covers the following categories: + - **Group email:** Percent of workspaces that have no days/1 day/2-3 days/4+ days of group email activity per week over the last 28 days. + - **Channel messages:** Percent of workspaces that have no days/1 day/2-3 days/4+ days of channel messages per week over the last 28 days. + - **Content reading or creation:** Percent of workspaces that have no days/1 day/2-3 days/4+ days of reading or creating content per week over the last 28 days. +4. **View related content:** Select this link to view help content. ++### Use of teams within Microsoft Teams +++1. **Header:** Shows the number of shared workspaces that have a Microsoft Teams team associated with them. +2. **Body:** Provides information about the value of having a Microsoft Teams team attached to the shared workspaces, to help make people associated with them more effective at teamwork. +3. **Visualization:** The colored part of the donut chart reflects the percentage of workspaces that have a Microsoft Teams team attached to them. The percentage is calculated as follows: ++ - Numerator: The number of shared workspaces in your organization that had a Microsoft Teams team associated with them in the last 28 days + - Denominator: The number of shared workspaces in your org in the last 28 days ++ The number in the center of the donut chart represents the total number of shared workspaces that have a Microsoft Teams team associated with them. +4. **View related content:** Select this link to view help content. ++## View teamwork trends over time ++For each of the insights above, you can see how the metrics trend over time by selecting an option from the dropdown shown below: ++ ++After you select an option, the charts in the report will update to show a trend over time rather than a snapshot of the past month. ++## Related content ++[Microsoft 365 apps health ΓÇô Technology experiences](apps-health.md) (article)\ +[Communication ΓÇô People experiences](communication.md) (article)\ +[Content collaboration ΓÇô People experiences](content-collaboration.md) (article)\ +[Meetings ΓÇô People experiences](meetings.md) (article)\ +[Mobility ΓÇô People experiences](mobility.md) (article)\ +[Privacy controls for Adoption Score](privacy.md) (article) |
| admin | Experience Insights Dashboard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/misc/experience-insights-dashboard.md | For the first time, you can now see what articles your users are consuming on Su <!-- :::image type="content" source="../../media/additional-resources.png" alt-text="Screenshot: Image showing additional resources you can select"::: --> -### View your organization's Productivity Score +### View your organization's Adoption Score -Productivity Score supports the journey to digital transformation with insights about how your organization uses Microsoft 365 and the technology experiences that support it. Your organization's score reflects people and technology experience measurements and can be compared to benchmarks from organizations similar in size to yours. For more information on Productivity Score, read, [Productivity Score](../productivity/productivity-score.md). +Adoption Score supports the journey to digital transformation with insights about how your organization uses Microsoft 365 and the technology experiences that support it. Your organization's score reflects people and technology experience measurements and can be compared to benchmarks from organizations similar in size to yours. For more information on Adoption Score, read, [Adoption Score](../adoption/adoption-score.md). ### Take training for adoption specialists |
| admin | Secure Your Business Data | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/security-and-compliance/secure-your-business-data.md | Microsoft 365 for business plans include security capabilities, such as antiphis :::image type="content" source="../../media/top-10-ways-secure-data.png" alt-text="Diagram listing top 10 ways to secure business data."::: -1. **Use multi-factor authentication**. [Multi-factor authentication](multi-factor-authentication-microsoft-365.md) (MFA), also known as two-step verification, requires people to use a code or authentication app on their phone to sign into Microsoft 365, and is a critical first step to protecting your business data. Using MFA can prevent hackers from taking over if they know your password. See [security defaults and MFA](../../business-premium/m365bp-conditional-access.md). --2. **Protect your administrator accounts**. Administrator accounts (also called admins) have elevated privileges, making these accounts more susceptible to cyberattacks. You'll need to set up and manage the right number of admin and user accounts for your business. We also recommend adhering to the information security principle of least privilege, which means that users and applications should be granted access only to the data and operations they require to perform their jobs. See [Protect your administrator accounts](../../business-premium/m365bp-protect-admin-accounts.md). --3. **Use preset security policies**. Your subscription includes [preset security policies](../../security/office-365-security/preset-security-policies.md) that use recommended settings for anti-spam, anti-malware, and anti-phishing protection. See [Protect against malware and other cyberthreats](../../business-premium/m365bp-increase-protection.md). --4. **Protect all devices**. Every device is a possible attack avenue into your network and must be configured properly, even those devices that are personally owned but used for work. See the following articles: -- - [Help users set up MFA on their devices](https://support.microsoft.com/office/set-up-your-microsoft-365-sign-in-for-multi-factor-authentication-ace1d096-61e5-449b-a875-58eb3d74de14) - - [Protect unmanaged Windows and Mac computers](../../business-premium/m365bp-protect-pcs-macs.md) - - [Set up managed devices](../../business-premium/m365bp-managed-devices-setup.md) (requires Microsoft 365 Business Premium or Microsoft Defender for Business) --5. **Train everyone on email best practices**. Email can contain malicious attacks cloaked as harmless communications. Email systems are especially vulnerable, because email is handled by everyone in the organization, and safety relies on humans making consistently good decisions with those communications. Train everyone to know what to watch for spam or junk mail, phishing attempts, spoofing, and malware in their email. See [Protect yourself against phishing and other attacks](../../business-premium/m365bp-avoid-phishing-and-attacks.md). --6. **Use Microsoft Teams for collaboration and sharing**. The best way to collaborate and share securely is to use Microsoft Teams. With Microsoft Teams, all your files and communications are in a protected environment and aren't being stored in unsafe ways outside of it. See the following articles: -- - [Use Microsoft Teams for collaboration](../../business-premium/create-teams-for-collaboration.md) - - [Set up meetings with Microsoft Teams](../../business-premium/set-up-meetings.md) - - [Share files and videos in a safe environment](../../business-premium/share-files-and-videos.md) --7. **Set sharing settings for SharePoint and OneDrive files and folders**. Your default sharing levels for SharePoint and OneDrive might be set to a more permissive level than you should use. We recommend reviewing and if necessary, changing the default settings to better protect your business. Grant people only the access they need to do their jobs. See [Set sharing settings for SharePoint and OneDrive files and folders](../../business-premium/m365bp-increase-protection.md#set-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). --8. **Use Microsoft 365 Apps on devices**. Outlook and Microsoft 365 Apps (also referred to as Office apps) enable people to work productively and more securely across devices. Whether you're using the web or desktop version of an app, you can start a document on one device, and pick it up later on another device. Instead of sending files as email attachments, you can share links to files that are stored in SharePoint or OneDrive. See [Install Office apps on all devices](../../business-premium/m365bp-install-office-apps.md). --9. **Manage calendar sharing for your business**. You can help people in your organization share their calendars appropriately for better collaboration. You can manage what level of detail they can share, such as by limiting the details that are shared to free/busy times only. See [Manage calendar sharing](../../business-premium/m365bp-increase-protection.md#manage-calendar-sharing). --10. **Maintain your environment**. After your initial setup and configuration of Microsoft 365 for business is complete, your organization needs a maintenance and operations plan. As employees come and go, you'll need to add or remove users, reset passwords, and maybe even reset devices to factory settings. You'll also want to make sure people have only the access they need to do their jobs. See [Maintain your environment](../../business-premium/m365bp-maintain-environment.md). +| Step | Task | Description | +|:--:|:|:| +| 1 | **Use multi-factor authentication**. | [Multi-factor authentication](multi-factor-authentication-microsoft-365.md) (MFA), also known as two-step verification, requires people to use a code or authentication app on their phone to sign into Microsoft 365, and is a critical first step to protecting your business data. Using MFA can prevent hackers from taking over if they know your password. See [security defaults and MFA](../../business-premium/m365bp-conditional-access.md). | +| 2 | **Protect your administrator accounts**. | Administrator accounts (also called admins) have elevated privileges, making these accounts more susceptible to cyberattacks. You'll need to set up and manage the right number of admin and user accounts for your business. We also recommend adhering to the information security principle of least privilege, which means that users and applications should be granted access only to the data and operations they require to perform their jobs. See [Protect your administrator accounts](../../business-premium/m365bp-protect-admin-accounts.md). | +| 3 | **Use preset security policies**. | Your subscription includes [preset security policies](../../security/office-365-security/preset-security-policies.md) that use recommended settings for anti-spam, anti-malware, and anti-phishing protection. See [Protect against malware and other cyberthreats](../../business-premium/m365bp-increase-protection.md). | +| 4 | **Protect all devices**. | Every device is a possible attack avenue into your network and must be configured properly, even those devices that are personally owned but used for work. See the following articles: <br/>- [Help users set up MFA on their devices](https://support.microsoft.com/office/set-up-your-microsoft-365-sign-in-for-multi-factor-authentication-ace1d096-61e5-449b-a875-58eb3d74de14)<br/>- [Protect unmanaged Windows and Mac computers](../../business-premium/m365bp-protect-pcs-macs.md) <br/>- [Set up managed devices](../../business-premium/m365bp-managed-devices-setup.md) (requires Microsoft 365 Business Premium or Microsoft Defender for Business) | +| 5 | **Train everyone on email best practices**. | Email can contain malicious attacks cloaked as harmless communications. Email systems are especially vulnerable, because email is handled by everyone in the organization, and safety relies on humans making consistently good decisions with those communications. Train everyone to know what to watch for spam or junk mail, phishing attempts, spoofing, and malware in their email. See [Protect yourself against phishing and other attacks](../../business-premium/m365bp-avoid-phishing-and-attacks.md). | +| 6 | **Use Microsoft Teams for collaboration and sharing**. | The best way to collaborate and share securely is to use Microsoft Teams. With Microsoft Teams, all your files and communications are in a protected environment and aren't being stored in unsafe ways outside of it. See the following articles: <br/>- [Use Microsoft Teams for collaboration](../../business-premium/create-teams-for-collaboration.md) <br/>- [Set up meetings with Microsoft Teams](../../business-premium/set-up-meetings.md) <br/>- [Share files and videos in a safe environment](../../business-premium/share-files-and-videos.md) | +| 7 | **Set sharing settings for SharePoint and OneDrive files and folders**. | Your default sharing levels for SharePoint and OneDrive might be set to a more permissive level than you should use. We recommend reviewing and if necessary, changing the default settings to better protect your business. Grant people only the access they need to do their jobs. See [Set sharing settings for SharePoint and OneDrive files and folders](../../business-premium/m365bp-increase-protection.md#set-sharing-settings-for-sharepoint-and-onedrive-files-and-folders). | +| 8 | **Use Microsoft 365 Apps on devices**. | Outlook and Microsoft 365 Apps (also referred to as Office apps) enable people to work productively and more securely across devices. Whether you're using the web or desktop version of an app, you can start a document on one device, and pick it up later on another device. Instead of sending files as email attachments, you can share links to files that are stored in SharePoint or OneDrive. See [Install Office apps on all devices](../../business-premium/m365bp-install-office-apps.md). | +| 9 | **Manage calendar sharing for your business**. | You can help people in your organization share their calendars appropriately for better collaboration. You can manage what level of detail they can share, such as by limiting the details that are shared to free/busy times only. See [Manage calendar sharing](../../business-premium/m365bp-increase-protection.md#manage-calendar-sharing). | +| 10 | **Maintain your environment**. | After your initial setup and configuration of Microsoft 365 for business is complete, your organization needs a maintenance and operations plan. As employees come and go, you'll need to add or remove users, reset passwords, and maybe even reset devices to factory settings. You'll also want to make sure people have only the access they need to do their jobs. See [Maintain your environment](../../business-premium/m365bp-maintain-environment.md). | ## Comparing Microsoft 365 for business plans |
| admin | Add Or Replace Your Onmicrosoftcom Domain | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/setup/add-or-replace-your-onmicrosoftcom-domain.md | To add, modify, or remove domains, you **must** be a **Domain Name Administrator > [!NOTE]-> Before changing your fallback domain to a new onmicrosoft.com domain, you may want to consider changing your onmicrosoft.com SharePoint domain. Creating an additional onmicrosoft domain and using it as your fallback domain will not do a rename for SharePoint Online. Your existing SharePoint and OneDrive URLs will remain the same. You are able to change your.onmicrosoft SharePoint domain through the PowerShell steps provided in [SharePoint domain rename preview](/sharepoint/change-your-sharepoint-domain-name) (currently available to any tenant with less than 1,000 sites). +> Before changing your fallback domain to a new onmicrosoft.com domain, you may want to consider changing your onmicrosoft.com SharePoint domain. Creating an additional onmicrosoft domain and using it as your fallback domain will not do a rename for SharePoint Online. Your existing SharePoint and OneDrive URLs will remain the same. You are able to change your.onmicrosoft SharePoint domain through the PowerShell steps provided in [SharePoint domain rename preview](/sharepoint/change-your-sharepoint-domain-name) (currently available to any tenant with less than 10,000 sites). After you have created your new onmicrosoft.com domain, do the following to change it to your fallback domain. |
| compliance | Apply Retention Labels Automatically | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/apply-retention-labels-automatically.md | After you select a policy template, you can add or remove any types of sensitive For more information about these options, see the following guidance from the DLP documentation [Tuning rules to make them easier or harder to match](data-loss-prevention-policies.md#tuning-rules-to-make-them-easier-or-harder-to-match). > [!IMPORTANT]-> Sensitive information types have two different ways of defining the max unique instance count parameters. To learn more, see [Instance count supported values for SIT](create-a-custom-sensitive-information-type.md#instance-count-supported-values-for-sit). +> Sensitive information types have two different ways of defining the max unique instance count parameters. To learn more, see [Instance count supported values for SIT](sit-limits.md#instance-count-supported-values-for-sit). To consider when using sensitive information types to auto-apply retention labels: |
| compliance | Apply Sensitivity Label Automatically | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/apply-sensitivity-label-automatically.md | Similarly to when you configure DLP policies, you can then refine your condition You can learn more about these configuration options from the DLP documentation: [Tuning rules to make them easier or harder to match](data-loss-prevention-policies.md#tuning-rules-to-make-them-easier-or-harder-to-match). > [!IMPORTANT]-> Sensitive information types have two different ways of defining the max unique instance count parameters. To learn more, see [Instance count supported values for SIT](create-a-custom-sensitive-information-type.md#instance-count-supported-values-for-sit). +> Sensitive information types have two different ways of defining the max unique instance count parameters. To learn more, see [Instance count supported values for SIT](sit-limits.md#instance-count-supported-values-for-sit). Also similarly to DLP policy configuration, you can choose whether a condition must detect all sensitive information types, or just one of them. And to make your conditions more flexible or complex, you can add [groups and use logical operators between the groups](data-loss-prevention-policies.md). |
| compliance | Create A Custom Sensitive Information Type | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/create-a-custom-sensitive-information-type.md | There are two ways to create a new sensitive information type: - [Sensitive information type functions](sit-functions.md) - [confidence levels](sensitive-information-type-learn-about.md#more-on-confidence-levels) +- Familiarize yourself with [Sensitive information type limits](sit-limits.md). + - Your organization must have a subscription, such as Office 365 Enterprise, that includes Microsoft Purview Data Loss Prevention (DLP). See [Messaging Policy and Compliance ServiceDescription](/office365/servicedescriptions/exchange-online-protection-service-description/messaging-policy-and-compliance-servicedesc). - Your organization must have a subscription, such as Office 365 Enterprise, that includes data loss prevention (DLP). See [Messaging Policy and Compliance ServiceDescription](/office365/servicedescriptions/exchange-online-protection-service-description/messaging-policy-and-compliance-servicedesc). You can test any sensitive information type in the list. We suggest that you tes 4. On the **Matches results** page, review the results and choose **Finish**. -## Custom sensitive information types limits --To ensure high performance and lower latency, there are limitations in custom SITs configurations. --|Limit|Value| -||| -|maximum number of custom SITs created through the Compliance center| 500 | -|maximum length of regular expression| 1024 characters| -|maximum length for a given term in a keyword list| 50 characters| -|maximum number of terms in keyword list| 2048| -|maximum number of distinct regexes per sensitive information type| 20| -|maximum size of a keyword dictionary (post compression)| 1MB (~1,000,000 characters)| -|maximum number of keyword dictionary based SITs in a tenant|50 | --> [!NOTE] -> If you have a business need to create more than 500 custom SITs, please raise a support ticket. --### Instance count supported values for SIT --The SIT instance count limit applies when SITs are used in these solutions: --- DLP policies-- Information Protection-- Data Lifecycle Management-- Communication Compliance-- Records Management-- Microsoft Defender for Cloud Apps-- Microsoft Priva--For a scanned item to satisfy rule criteria, the number of unique instances of a SIT in any single item must fall between the min and max values. This is called the **Instance count**. --- **Min** field: the lower limit (minimum number) of unique instances of a SIT that must be found in an item to trigger a match. The min field supports values of:- - 1 to 500 -- **Max** field: the upper limit on the number of unique instances of a SIT that can be found in an item and still trigger a match. The max field supports values of:- - 1 to 500 - Use this when you want to set a specific upper limit that is 500 or less on the number of instances of a SIT in an item. - - Any - Use `Any` when you want the unique instance count criteria to be satisfied when an undefined number of unique instances of a SIT are found in a scanned item and that number of unique instances meets or exceeds the minimum number of unique instances value. In other words, the unique instance count criteria are met as long as the min value is met. --For example, if you want the rule to trigger a match when at least 500 unique instances of a SIT are found in a single item, set the **min** value to `500` and the **max** value to `Any`. --> [!NOTE] -> We support up to 100 exact data match (EDM) evaluations. Policies that use EDM SITs should not be written with a **min** or **max** instance count value greater than 100. - > [!NOTE]-> Microsoft 365 Information Protection supports double byte character set languages for: +> Microsoft Purview information protection supports double byte character set languages for: > > - Chinese (simplified) > - Chinese (traditional) |
| compliance | Dlp Policy Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/dlp-policy-reference.md | The rule will only look for the presence of any **sensitivity labels** and **ret SITs have a pre-defined [**confidence level**](https://www.microsoft.com/videoplayer/embed/RE4Hx60) which you can alter if needed. For more information, see [More on confidence levels](sensitive-information-type-learn-about.md#more-on-confidence-levels). > [!IMPORTANT]-> SITs have two different ways of defining the max unique instance count parameters. To learn more, see [Instance count supported values for SIT](create-a-custom-sensitive-information-type.md#instance-count-supported-values-for-sit). +> SITs have two different ways of defining the max unique instance count parameters. To learn more, see [Instance count supported values for SIT](sit-limits.md#instance-count-supported-values-for-sit). #### Condition context |
| compliance | Encryption Sensitivity Labels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/encryption-sensitivity-labels.md | Before you can use encryption, you might need to do some configuration tasks. Wh 4. On the **Encryption** page, select one of the following options: - - **Remove encryption if the file is encrypted**: This option is supported by the Azure Information Protection unified labeling client only. When you select this option and use built-in labeling, the label might not display in apps, or display and not make any encryption changes. + - **Remove encryption if the file or email is encrypted**: This option is supported by the Azure Information Protection unified labeling client only. When you select this option and use built-in labeling, the label might not display in apps, or display and not make any encryption changes. For more information about this scenario, see the [What happens to existing encryption when a label's applied](#what-happens-to-existing-encryption-when-a-labels-applied) section. It's important to understand that this setting can result in a sensitivity label that users might not be able to apply when they don't have sufficient permissions. Before you can use encryption, you might need to do some configuration tasks. Wh ### What happens to existing encryption when a label's applied +> [!NOTE] +> The option **Remove encryption if the file or email is encrypted** is supported only by the Azure Information Protection unified labeling client. You can achieve the same effect for emails by [configuring a mail flow rule](define-mail-flow-rules-to-encrypt-email.md#use-the-eac-to-create-a-rule-to-remove-encryption-from-email-messages-with-microsoft-purview-message-encryption). + If a sensitivity label is applied to unencrypted content, the outcome of the encryption options you can select is self-explanatory. For example, if you didn't select **Encrypt files and emails**, the content remains unencrypted. However, the content might be already encrypted. For example, another user might have applied: |
| compliance | Retention Policies Teams | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/retention-policies-teams.md | When a Skype for Business chat comes into Teams, it becomes a message in a Teams However, if conversation history is turned on for Skype for Business and from the Skype for Business client side that history is being saved into a mailbox, that chat data isn't handled by a Teams retention policy. For this content, use a retention policy that's configured for Skype for Business. -## Meetings and external users +## Messages and external users -Channel meeting messages are stored the same way as channel messages, so for this data, select the **Teams channel messages** location when you configure your retention policy. +When external users are included in a meeting or chat that your organization hosts: -Impromptu and scheduled meeting messages are stored in the same way as group chat messages, so for this data, select the **Teams chats** location when you configure your retention policy. +- If an external user joins by using a guest account in your tenant, any Teams messages are stored in both your users' mailbox and a shadow mailbox that's granted to the guest account. However, retention policies aren't supported for shadow mailboxes, even though they can be reported as included in a retention policy for the entire location (sometimes known as an "organization-wide policy"). -When external users are included in a meeting that your organization hosts: --- If an external user joins by using a guest account in your tenant, any messages from the meeting are stored in both your users' mailbox and a shadow mailbox that's granted to the guest account. However, retention policies aren't supported for shadow mailboxes, even though they can be reported as included in a retention policy for the entire location (sometimes known as an "organization-wide policy").--- If an external user joins by using an account from another Microsoft 365 organization, your retention policies can't delete messages for this user because they're stored in that user's mailbox in another tenant. For the same meeting however, your retention policies can delete messages for your users.+- If an external user joins by using an account from another Microsoft 365 organization, your retention policies can't delete messages for this user because they're stored in that user's mailbox in another tenant. For the same meeting or chat however, your retention policies can delete messages for your users. ## When a user leaves the organization |
| compliance | Sit Limits | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/sit-limits.md | + + Title: "Sensitive information type limits" +f1.keywords: +- NOCSH ++++audience: Admin ++ Last updated :+ms.localizationpriority: medium ++- M365-security-compliance +search.appverid: +- MOE150 +- MET150 +description: "Learn about instance count and other sensitive information type limits" +++# Sensitive information type limits ++These limits apply to all sensitive information types (SIT) except exact data match sensitive information types. ++These limits apply to all Microsoft Purview policies that use SITs. ++To ensure high performance and lower latency, there are limitations in custom SITs configurations. ++|Limit|Value| +||| +|maximum number of custom SITs created through the Compliance center| 500 | +|maximum length of regular expression| 1024 characters| +|maximum length for a given term in a keyword list| 50 characters| +|maximum number of terms in keyword list| 2048| +|maximum number of distinct regexes per sensitive information type| 20| +|maximum size of a keyword dictionary (post compression)| 1MB (~1,000,000 characters)| +|maximum number of keyword dictionary based SITs in a tenant|50 | ++> [!NOTE] +> If you have a business need to create more than 500 custom SITs, please raise a support ticket. ++### Instance count supported values for SIT ++The SIT instance count limit applies when SITs are used in these solutions: ++- Microsoft Purview Data Loss Prevention policies +- Microsoft Purview Information Protection policies +- Microsoft Purview Data Lifecycle Management +- Communication Compliance +- Microsoft Purview Records Management +- Microsoft Defender for Cloud Apps +- Microsoft Priva ++For a scanned item to satisfy rule criteria, the number of unique instances of a SIT in any single item must fall between the min and max values. This is called the **Instance count**. ++- **Min** field: the lower limit (minimum number) of unique instances of a SIT that must be found in an item to trigger a match. The min field supports values of: + - 1 to 500 +- **Max** field: the upper limit on the number of unique instances of a SIT that can be found in an item and still trigger a match. The max field supports values of: + - 1 to 500 - Use this when you want to set a specific upper limit that is 500 or less on the number of instances of a SIT in an item. + - Any - Use `Any` when you want the unique instance count criteria to be satisfied when an undefined number of unique instances of a SIT are found in a scanned item and that number of unique instances meets or exceeds the minimum number of unique instances value. In other words, the unique instance count criteria are met as long as the min value is met. ++For example, if you want the rule to trigger a match when at least 500 unique instances of a SIT are found in a single item, set the **min** value to `500` and the **max** value to `Any`. ++> [!NOTE] +> We support up to 100 exact data match (EDM) evaluations. Policies that use EDM SITs should not be written with a **min** or **max** instance count value greater than 100. + |
| compliance | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/whats-new.md | Whether it be adding new solutions to the [Microsoft Purview compliance portal]( > > And visit the [Microsoft 365 Roadmap](https://www.microsoft.com/microsoft-365/roadmap) to learn about Microsoft 365 features that were launched, are rolling out, are in development, have been cancelled, or previously released. +## July 2022 ++### Compliance Manager ++- [Compliance Manager templates list](compliance-manager-templates-list.md) - added new premium template in the Asia-Pacific countries category for "Hong Kong - Code of Banking Practice and Payment Card". ++### Compliance offerings & service assurance ++- [SharePoint and OneDrive data resiliency in Microsoft 365](/compliance/assurance/assurance-sharepoint-onedrive-data-resiliency) - changes to blob storage resilience section. ++### Data lifecycle management and records management ++- [Combined licensing section](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#microsoft-purview-data-lifecycle-management--microsoft-purview-records-management) with added details for scenarios. +- The retention of SharePoint document versions no longer uses separate files in the Preservation Hold library. For more information, see the updated documentation, [How retention works with document versions](retention-policies-sharepoint.md#how-retention-works-with-document-versions). +- Guidance how to [validate records that you've migrated to SharePoint or OneDrive](records-management.md#validating-migrated-records). +- Updated Cohasset Assessment report for [SEC 17a-4(f), FINRA 4511(c), and CFTC 1.31(c)-(d)](retention-regulatory-requirements.md#sec-17a-4f-finra-4511c-and-cftc-131c-d). +- Removed preview disclaimers for retention policies for Teams shared channels now that this feature is rolling out in GA. ++### Data Loss Prevention ++- [DLP policy reference](dlp-policy-reference.md#blocking-and-notifications-in-sharepoint-online-and-onedrive-for-business) - added new section on Blocking and notifications in SharePoint Online, and OneDrive for Business in response to customer escalations. Updated to support the public preview of sensitive services domains. Updated support for Power BI. Updated support for trainable classifiers. +- [Configure endpoint DLP settings](dlp-configure-endpoint-settings.md#sensitive-service-domains-preview) - added new content in support of the public preview release of sensitive service domains public preview. Updated URL matching behavior. +- [Using endpoint DLP](endpoint-dlp-using.md#scenario-6-monitor-or-restrict-user-activities-on-sensitive-service-domains-preview) - new scenario content in support of the public preview release of sensitive services domains. Updated subscription information. ++### eDiscovery ++- [Keyword queries and search conditions for eDiscovery](keyword-queries-and-search-conditions.md) - removed superseded information. ++### Sensitive information types ++- [Sensitive information type entity definitions](sensitive-information-type-entity-definitions.md) - We added 41 new SIT entity definitions in support of the 41 new credential scanning SITs. SIT entity definitions content was completely reworked from a single monolithic article into more easily referenceable and supportable individual articles. There are now 303 articles in total including the 42 new credential scanning SITs. ++### Sensitivity labels ++- In preview: [Default sensitivity label for a SharePoint document library](sensitivity-labels-sharepoint-default-label.md). +- In preview: [Organization-wide custom permissions](encryption-sensitivity-labels.md#support-for-organization-wide-custom-permissions) for Windows when a sensitivity label is configured to let users assign permissions. For more information, see [Support for organization-wide custom permissions](encryption-sensitivity-labels.md#support-for-organization-wide-custom-permissions). +- Now rolling out to Current Channel (Preview) for Windows: Default label for existing documents. +- Now available with the Semi-Annual Enterprise Channel: [Co-authoring for files encrypted with sensitivity labels](sensitivity-labels-coauthoring.md). +- The [label scope name](sensitivity-labels.md#label-scopes) of "Files & emails" that you see when configuring a sensitivity label is now "Items". + ## June 2022 ### Compliance Manager To meet the challenges of today's decentralized, data-rich workplace, we're intr - Now in preview: Mobile devices (iOS and Android) support [co-authoring](sensitivity-labels-coauthoring.md) when you have minimum versions and opt in to this preview. - Support for setting the default sharing link type is extended to individual documents in SharePoint and OneDrive. For more information, see the new article [Use sensitivity labels to configure the default sharing link type for sites and documents in SharePoint and OneDrive]( sensitivity-labels-default-sharing-link.md). - Teams admin center now supports container labels (sensitivity labels with the scope of Groups & sites).--## January 2022 --### Microsoft Purview Data Lifecycle Management --- The documentation for what was formerly Microsoft Information Governance has been substantially revised and restructured to help you more easily find information that relates to the solutions you configure in the Microsoft Purview compliance portal: Data Connectors, Data Lifecycle Management, and Records Management. As part of this revision, the documentation provides a clearer distinction for the retention scenarios for data lifecycle management vs. records management.-- [Learn about data lifecycle management](data-lifecycle-management.md) - new, to support the restructure.-- [Get started with data lifecycle management](get-started-with-data-lifecycle-management.md) - new, to replace "Get started with retention", this article includes getting started steps for all data lifecycle management capabilities, which include retention.-- [Create retention labels for exceptions to your retention policies](create-retention-labels-data-lifecycle-management.md) - new, identified scenario for using retention labels for data lifecycle management rather than records management.-- [Learn about archive mailboxes](archive-mailboxes.md) - new, to support the restructure, contains conceptual information that was previously in the "Enable archive mailboxes" article.--### Microsoft Priva --- [Privacy management is now Microsoft Priva](/privacy/priva/priva-overview) - updated to rebrand the product and its solutions, Priva Privacy Risk Management and Priva Subject Rights Requests.--### Sensitivity labels --- Support for new [role groups and roles](get-started-with-sensitivity-labels.md#permissions-required-to-create-and-manage-sensitivity-labels), now in preview.-- New [monitoring capabilities](apply-sensitivity-label-automatically.md#monitoring-your-auto-labeling-policy) for auto-labeling policies.-- Now rolling out: default label for existing documents, and justification text for Office on the web.-- Announced for the July Semi-Annual Enterprise Channel with version 2202+: Co-authoring and auditing for Outlook. |
| frontline | Deploy Teams At Scale | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/frontline/deploy-teams-at-scale.md | You use the ```New-CsBatchTeamsDeployment``` cmdlet to submit a batch of teams t 1. Run the following to check the status of the batch you submitted. ```powershell- Get-CsBatchTeamsDeploymentStatus -OrchestrationId "OrchestrationId" + Get-CsBatchTeamsDeployment -OrchestrationId "OrchestrationId" ``` ## Send us feedback |
| security | Android Configure Mam | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/android-configure-mam.md | Select **Setting > Max allowed device threat level** in **Device Conditions** an 6. Select **Continue** to log into the managed application. -### Configure privacy controls +## Configure privacy controls +>[!IMPORTANT] +>Privacy controls on Microsoft Defender for Endpoint on MAM are in public preview. The following information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +>**If you want to try out this feature or provide feedback, please reach out to us at mdatpmobile@microsoft.com.** + Admins can use the following steps to enable privacy and not collect the domain name, app details and network information as part of the alert report for corresponding threats. 1. In Microsoft Endpoint Manager admin center, go to **Apps > App configuration policies > Add > Managed apps**. Admins can use the following steps to enable privacy and not collect the domain 6. Review and create the policy. ## Optional permissions +>[!IMPORTANT] +>Optional Permissions on Microsoft Defender for Endpoint is in public preview. The following information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +>**If you want to try out this feature or provide feedback, please reach out to us at mdatpmobile@microsoft.com.** Microsoft Defender for Endpoint on Android enables Optional Permissions in the onboarding flow. Currently the permissions required by MDE are mandatory in the onboarding flow. With this feature, admin can deploy MDE on Android devices with MAM policies without enforcing the mandatory VPN and Accessibility Permissions during onboarding. End Users can onboard the app without the mandatory permissions and can later review these permissions. |
| security | Android Support Signin | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/android-support-signin.md | Enable the required permission on Xiaomi devices. ## Unable to allow permission for 'Permanent protection' during onboarding on some OEM devices + **Applies to:** Specific OEM devices only. -- **Xiaomi with Android 11**+- **Xiaomi** Defender App asks for Battery Optimization/Permanent Protection permission on devices as part of app onboarding, and selecting **Allow** returns an error that the permission couldn't be set. It only affects the last permission called "Permanent Protection." Xiaomi changed the battery optimization permissions in Android 11. Defender for **Solution:** -We are working with OEM to find a solution to enable this permission from the app onboarding screen. We will update the documentation when this is resolved. -Users can follow these steps to enable the same permissions from the device settings: --1. Go to **Settings** on your device. --2. Search for and select **Battery Optimization**. -- :::image type="content" source="images/search-battery-optimisation.png" alt-text="The page on which you can search and select Battery Optimisation" lightbox="images/search-battery-optimisation.png"::: --3. In **Special app access**, select **Battery Optimization**. -- :::image type="content" source="images/special-app-access.png" alt-text="The Special app access pane from which you can select Battery Optimisation" lightbox="images/special-app-access.png"::: --4. Change the Dropdown to show **All Apps**. -- :::image type="content" source="images/show-all-apps-2.png" alt-text="The drop-down from which you can change the value to All Apps under the Battery Optimisation pane" lightbox="images/show-all-apps-2.png"::: -- :::image type="content" source="images/show-all-apps-1.png" alt-text="The drop-down that displays the All Apps option under the Battery Optimisation pane" lightbox="images/show-all-apps-1.png"::: --5. Locate "Microsoft Defender for Endpoint" and select **Don't Optimize**. -- :::image type="content" source="images/select-dont-optimise.png" alt-text="The page that enables location of the option Microsoft Defender for Endpoint and selection of Don't Optimize" lightbox="images/select-dont-optimise.png"::: +>[!IMPORTANT] +>This issue has been resolved. Please update to the latest app version to complete the onboarding process. If the issue persists, please send an **[in-app feedback](/microsoft-365/security/defender-endpoint/android-support-signin#send-in-app-feedback)**. -Return to the Microsoft Defender for Endpoint onboarding screen, select **Allow**, and you will be redirected to the dashboard screen. ## Send in-app feedback |
| security | Android Whatsnew | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/android-whatsnew.md | ms.technology: mde Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) ->[!NOTE] +>[!IMPORTANT] > Microsoft Defender for Endpoint's **Anti malware engine** is now generally available. All the users are required to have a Microsoft Defender for Endpoint version above **1.0.3815.0000** to utilize this new malware protection capability. Users on Microsoft Defender for Endpoint version below 1.0.3815.0000 will be sent notifications and in-app overlay messages to update their Microsoft Defender for Endpoint application. Users can click on the link provided in the overlay message to go to the managed play store and update the application. > > If users can't access the play store, the app can be updated through the company portal. +## Privacy Controls ++Microsoft Defender for Endpoint on Android enables Privacy Controls for both the Admins and the End Users. This includes the controls for enrolled (MDM) as well as unenrolled (MAM) devices (in preview). Admins can configure the privacy in the alert report while End Users can configure the information shared to their organization. For more information, see [privacy controls(MDM)](/microsoft-365/security/defender-endpoint/android-configure#privacy-controls) and [privacy controls (MAM)](/microsoft-365/security/defender-endpoint/android-configure-mam#configure-privacy-controls). ++## Optional Permissions and Disable Web Protection ++Microsoft Defender for Endpoint on Android enables **Optional Permissions** in the onboarding flow. Currently the permissions required by MDE are mandatory in the onboarding flow. With this feature, admin can deploy MDE on devices without enforcing the mandatory **VPN** and **Accessibility** permissions during onboarding. End Users can onboard the app without the mandatory permissions and can later review these permissions. This feature is currently present only for unenrolled devices (MAM). For more information, see [optional permissions](/microsoft-365/security/defender-endpoint/android-configure-mam#optional-permissions). + ## Microsoft defender on Android enterprise BYOD personal profile Microsoft Defender for Endpoint is now supported on Android Enterprise personal profile (BYOD only) with all the key features including malware scanning, protection from phishing links, network protection and vulnerability management. This support is coupled with [privacy controls](/microsoft-365/security/defender-endpoint/android-configure#privacy-controls) to ensure user privacy on personal profile. For more information, read the [announcement](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-the-public-preview-of-defender-for-endpoint-personal/ba-p/3370979) and the [deployment guide](/microsoft-365/security/defender-endpoint/android-intune#set-up-microsoft-defender-in-personal-profile-on-android-enterprise-in-byod-mode). |
| security | Configure Contextual File Folder Exclusions Microsoft Defender Antivirus | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-contextual-file-folder-exclusions-microsoft-defender-antivirus.md | ms.pagetype: security ms.localizationpriority: medium Previously updated : 08/11/2022 Last updated : 08/25/2022 audience: ITPro As a starting point, you may already have exclusions in place that you wish to m Keep in mind that _all_ **types** and **values** are case sensitive. +> [!NOTE] +> Conditions inside `{}` MUST be true for the restriction to match. For example, if you specify two scan triggers this cannot be true, and the exclusion will not apply. To specify two restrictions of the same type, create two separate exclusions. ++ ### Examples The following string excludes "c:\documents\design.doc" only if it's a file and only in on-access scans: |
| security | Configure Endpoints Vdi | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-vdi.md | In a VDI environment, VDI instances can have short lifespans. VDI devices can ap - Single portal entry for each VDI instance. If the VDI instance was already onboarded to Microsoft Defender for Endpoint and at some point deleted then recreated with the same host name, a new object representing this VDI instance will NOT be created in the portal. - > [!NOTE] > In this case, the *same* device name must be configured when the session is created, for example using an unattended answer file. The following steps will guide you through onboarding VDI devices and will highl 2. Follow the [server onboarding process](configure-server-endpoints.md). -## Updating non-persistent virtual desktop infrastructure (VDI) images +## Updating virtual desktop infrastructure (VDI) images (persistent or non-persistent) With the ability to easily deploy updates to VMs running in VDIs, we've shortened this guide to focus on how you can get updates on your machines quickly and easily. You no longer need to create and seal golden images on a periodic basis, as updates are expanded into their component bits on the host server and then downloaded directly to the VM when it's turned on. For more information, follow the guidance in [Deployment guide for Microsoft Defender Antivirus in a Virtual Desktop Infrastructure (VDI) environment](/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus). > [!NOTE]- > If you have onboarded the master image of your Non-Persistent VDI environment (SENSE service is running), then you must offboard and clear some data before putting the image back into production. + > If you have onboarded the master image of your VDI environment (SENSE service is running), then you must offboard and clear some data before putting the image back into production. > 1. Ensure the sensor is stopped by running the command below in a CMD window: > ```console > sc query sense For more information, follow the guidance in [Deployment guide for Microsoft Def > exit > ``` - ## Other recommended configuration settings After onboarding devices to the service, it's important to take advantage of the included threat protection capabilities by enabling them with the following recommended configuration settings. - ### Next generation protection configuration The following configuration settings are recommended: The following configuration settings are recommended: - Cloud-delivered protection level: Not configured - Defender Cloud Extended Timeout In Seconds: 20 - #### Exclusions - Disable local admin merge: Not configured - Defender processes to exclude: The following configuration settings are recommended: - `%Programfiles%\FSLogix\Apps\frxccds.exe` - `%Programfiles%\FSLogix\Apps\frxsvc.exe` - - File extensions to exclude from scans and real-time protection: - `%Programfiles%\FSLogix\Apps\frxccd.sys` - `%Programfiles%\FSLogix\Apps\frxdrv.sys` The following configuration settings are recommended: - `\\stroageaccount.file.core.windows.net\share**.VHD` - `\\stroageaccount.file.core.windows.net\share**.VHDX` - #### Real-time Protection - Turn on all settings and set to monitor all files The following configuration settings are recommended: - Low threat: Clean - Moderate threat, High threat, Severe threat: Quarantine -- #### Scan - Scan archived files: Yes The following configuration settings are recommended: #### User experience - Allow user access to Microsoft Defender app: Not configured - #### Enable Tamper protection - Enable tamper protection to prevent Microsoft Defender being disabled: Enable The following configuration settings are recommended: - Enable network protection: Audit mode - Require SmartScreen for Microsoft Edge: Yes-- Block maclious site access: Yes+- Block malicious site access: Yes - Block unverified file download: Yes #### Attack surface reduction rules - Configure all available rules to Audit. - > [!NOTE] > Blocking these activities may interrupt legitimate business processes. The best approach is setting everything to audit, identifying which ones are safe to turn on, and then enabling those settings on endpoints which do not have false positive detections. ----- ## Related topics - [Onboard Windows devices using Group Policy](configure-endpoints-gp.md) - [Onboard Windows devices using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) |
| security | Event Error Codes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/event-error-codes.md | For example, if devices aren't appearing in the **Devices list**, you might need **Open Event Viewer and find the Microsoft Defender for Endpoint service event log:** -1. Click **Start** on the Windows menu, type **Event Viewer**, and press **Enter**. +1. Select **Start** on the Windows menu, type **Event Viewer**, and press **Enter**. 2. In the log list, under **Log Summary**, scroll until you see **Microsoft-Windows-SENSE/Operational**. Double-click the item to open the log. - You can also access the log by expanding **Applications and Services Logs** \> **Microsoft** \> **Windows** \> **SENSE** and click on **Operational**. + You can also access the log by expanding **Applications and Services Logs** \> **Microsoft** \> **Windows** \> **SENSE** and select **Operational**. > [!NOTE] > SENSE is the internal name used to refer to the behavioral sensor that powers Microsoft Defender for Endpoint. For example, if devices aren't appearing in the **Devices list**, you might need |3|Microsoft Defender for Endpoint service failed to start. Failure code: `variable`.|Service didn't start.|Review other messages to determine possible cause and troubleshooting steps.| |4|Microsoft Defender for Endpoint service contacted the server at `variable`.|Variable = URL of the Defender for Endpoint processing servers. <p> This URL will match that seen in the Firewall or network activity.|Normal operating notification; no action required.| |5|Microsoft Defender for Endpoint service failed to connect to the server at `variable`.|Variable = URL of the Defender for Endpoint processing servers. <p> The service couldn't contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](configure-proxy-internet.md).|- |6|Microsoft Defender for Endpoint service is not onboarded and no onboarding parameters were found.|The device didn't onboard correctly and won't be reporting to the portal.|Onboarding must be run before starting the service. <p> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows 10 devices](configure-endpoints.md).| - |7|Microsoft Defender for Endpoint service failed to read the onboarding parameters. Failure: `variable`.|Variable = detailed error description. The device didn't onboard correctly and won't be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows 10 devices](configure-endpoints.md).| - |8|Microsoft Defender for Endpoint service failed to clean its configuration. Failure code: `variable`.|**During onboarding:** The service failed to clean its configuration during the onboarding. The onboarding process continues. <p> **During offboarding:** The service failed to clean its configuration during the offboarding. The offboarding process finished but the service keeps running.|**Onboarding:** No action required. <p> **Offboarding:** Reboot the system. <p> See [Onboard Windows 10 devices](configure-endpoints.md).| - |9|Microsoft Defender for Endpoint service failed to change its start type. Failure code: `variable`.|**During onboarding:** The device didn't onboard correctly and won't be reporting to the portal. <p>**During offboarding:** Failed to change the service start type. The offboarding process continues. |Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows 10 devices](configure-endpoints.md).| - |10|Microsoft Defender for Endpoint service failed to persist the onboarding information. Failure code: `variable`.|The device didn't onboard correctly and won't be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows 10 devices](configure-endpoints.md).| + |6|Microsoft Defender for Endpoint service isn't onboarded and no onboarding parameters were found.|The device didn't onboard correctly and won't be reporting to the portal.|Onboarding must be run before starting the service. <p> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows client devices](configure-endpoints.md).| + |7|Microsoft Defender for Endpoint service failed to read the onboarding parameters. Failure: `variable`.|Variable = detailed error description. The device didn't onboard correctly and won't be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows client devices](configure-endpoints.md).| + |8|Microsoft Defender for Endpoint service failed to clean its configuration. Failure code: `variable`.|**During onboarding:** The service failed to clean its configuration during the onboarding. The onboarding process continues. <p> **During offboarding:** The service failed to clean its configuration during the offboarding. The offboarding process finished but the service keeps running.|**Onboarding:** No action required. <p> **Offboarding:** Reboot the system. <p> See [Onboard Windows client devices](configure-endpoints.md).| + |9|Microsoft Defender for Endpoint service failed to change its start type. Failure code: `variable`.|**During onboarding:** The device didn't onboard correctly and won't be reporting to the portal. <p>**During offboarding:** Failed to change the service start type. The offboarding process continues. |Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows client devices](configure-endpoints.md).| + |10|Microsoft Defender for Endpoint service failed to persist the onboarding information. Failure code: `variable`.|The device didn't onboard correctly and won't be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows client devices](configure-endpoints.md).| |11|Onboarding or re-onboarding of Defender for Endpoint service completed.|The device onboarded correctly.|Normal operating notification; no action required. <p> It may take several hours for the device to appear in the portal.| |12|Microsoft Defender for Endpoint failed to apply the default configuration.|Service was unable to apply the default configuration.|This error should resolve after a short period of time.| |13|Microsoft Defender for Endpoint device ID calculated: `variable`.|Normal operating process.|Normal operating notification; no action required.| |15|Microsoft Defender for Endpoint cannot start command channel with URL: `variable`.|Variable = URL of the Defender for Endpoint processing servers. <p> The service couldn't contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](configure-proxy-internet.md).|- |17|Microsoft Defender for Endpoint service failed to change the Connected User Experiences and Telemetry service location. Failure code: `variable`.|An error occurred with the Windows telemetry service.|[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy)">Ensure the diagnostic data service is enabled. <p> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows 10 devices](configure-endpoints.md).| + |17|Microsoft Defender for Endpoint service failed to change the Connected User Experiences and Telemetry service location. Failure code: `variable`.|An error occurred with the Windows telemetry service.|[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy)">Ensure the diagnostic data service is enabled. <p> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows client devices](configure-endpoints.md).| |18|OOBE (Windows Welcome) is completed.|Service will only start after any Windows updates have finished installing.|Normal operating notification; no action required.| |19|OOBE (Windows Welcome) has not yet completed.|Service will only start after any Windows updates have finished installing.|Normal operating notification; no action required. <p> If this error persists after a system restart, ensure all Windows updates have full installed.| |20|Cannot wait for OOBE (Windows Welcome) to complete. Failure code: `variable`.|Internal error.|If this error persists after a system restart, ensure all Windows updates have full installed.|- |25|Microsoft Defender for Endpoint service failed to reset health status in the registry. Failure code: `variable`.|The device didn't onboard correctly. It will report to the portal, however the service may not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows 10 devices](configure-endpoints.md).| - |26|Microsoft Defender for Endpoint service failed to set the onboarding status in the registry. Failure code: `variable`.|The device didn't onboard correctly. <p> It will report to the portal, however the service may not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows 10 devices](configure-endpoints.md).| - |27|Microsoft Defender for Endpoint service failed to enable SENSE aware mode in Microsoft Defender Antivirus. Onboarding process failed. Failure code: `variable`.|Normally, Microsoft Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the device, and the device is reporting to Defender for Endpoint.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows 10 devices](configure-endpoints.md). <p> Ensure real-time antimalware protection is running properly.| - |28|Microsoft Defender for Endpoint Connected User Experiences and Telemetry service registration failed. Failure code: `variable`.|An error occurred with the Windows telemetry service.|[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy). <p> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows 10 devices](configure-endpoints.md).| + |25|Microsoft Defender for Endpoint service failed to reset health status in the registry. Failure code: `variable`.|The device didn't onboard correctly. It will report to the portal, however the service may not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows client devices](configure-endpoints.md).| + |26|Microsoft Defender for Endpoint service failed to set the onboarding status in the registry. Failure code: `variable`.|The device didn't onboard correctly. <p> It will report to the portal, however the service may not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows client devices](configure-endpoints.md).| + |27|Microsoft Defender for Endpoint service failed to enable SENSE aware mode in Microsoft Defender Antivirus. Onboarding process failed. Failure code: `variable`.|Normally, Microsoft Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the device, and the device is reporting to Defender for Endpoint.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows client devices](configure-endpoints.md). <p> Ensure real-time antimalware protection is running properly.| + |28|Microsoft Defender for Endpoint Connected User Experiences and Telemetry service registration failed. Failure code: `variable`.|An error occurred with the Windows telemetry service.|[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy). <p> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows client devices](configure-endpoints.md).| |29|Failed to read the offboarding parameters. Error type: %1, Error code: %2, Description: %3|This event occurs when the system can't read the offboarding parameters.|Ensure the device has Internet access, then run the entire offboarding process again. Ensure the offboarding package hasn't expired.|- |30|Microsoft Defender for Endpoint service failed to disable SENSE aware mode in Microsoft Defender Antivirus. Failure code: `variable`.|Normally, Microsoft Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the device, and the device is reporting to Defender for Endpoint.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows 10 devices](configure-endpoints.md). <p> Ensure real-time antimalware protection is running properly.| + |30|Microsoft Defender for Endpoint service failed to disable SENSE aware mode in Microsoft Defender Antivirus. Failure code: `variable`.|Normally, Microsoft Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the device, and the device is reporting to Defender for Endpoint.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows client devices](configure-endpoints.md). <p> Ensure real-time antimalware protection is running properly.| |31|Microsoft Defender for Endpoint Connected User Experiences and Telemetry service unregistration failed. Failure code: `variable`.|An error occurred with the Windows telemetry service during onboarding. The offboarding process continues.|[Check for errors with the Windows telemetry service](troubleshoot-onboarding.md#ensure-the-diagnostic-data-service-is-enabled).| |32|Microsoft Defender for Endpoint service failed to request to stop itself after offboarding process. Failure code: %1|An error occurred during offboarding.|Reboot the device.| |33|Microsoft Defender for Endpoint service failed to persist SENSE GUID. Failure code: `variable`.|A unique identifier is used to represent each device that is reporting to the portal. <p> If the identifier doesn't persist, the same device might appear twice in the portal.|Check registry permissions on the device to ensure the service can update the registry.|- |34|Microsoft Defender for Endpoint service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: `variable`.|An error occurred with the Windows telemetry service.|[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy). <p> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows 10 devices](configure-endpoints.md).| + |34|Microsoft Defender for Endpoint service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: `variable`.|An error occurred with the Windows telemetry service.|[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy). <p> Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. <p> See [Onboard Windows client devices](configure-endpoints.md).| |35|Microsoft Defender for Endpoint service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: `variable`.|An error occurred with the Windows telemetry service during offboarding. The offboarding process continues.|Check for errors with the Windows diagnostic data service.| |36|Microsoft Defender for Endpoint Connected User Experiences and Telemetry service registration succeeded. Completion code: `variable`.|Registering Defender for Endpoint with the Connected User Experiences and Telemetry service completed successfully.|Normal operating notification; no action required.| |37|Microsoft Defender for Endpoint A module is about to exceed its quota. Module: %1, Quota: {%2} {%3}, Percentage of quota utilization: %4.|The device has almost used its allocated quota of the current 24-hour window. It's about to be throttled.|Normal operating notification; no action required.| For example, if devices aren't appearing in the **Devices list**, you might need |100|Microsoft Defender for Endpoint executable failed to start. Failure code: %1|The SenseCE executable has failed to start.|Reboot the device. If this error persists, contact Support.| |102|Microsoft Defender for Endpoint Network Detection and Response executable has started|The SenseNdr executable has started.|Normal operating notification; no action required.| |103|Microsoft Defender for Endpoint Network Detection and Response executable has ended|The SenseNdr executable has ended.|Normal operating notification; no action required.|+ |104|Failed to queue asynchronous driver unload. Failure code: %1.|Occurs during offboarding.|Normal operating notification; no action required.| + |105 |Failed to wait for driver unload| Occurs during offboarding.|Normal operating notification; no action required.| + |106 |Microsoft Defender for Endpoint service failed to start. Failure code %1 ; Failed to load MsSense DLL. Module. | Occurs during startup. | Contact support. | + |107 | Microsoft Defender for Endpoint service failed to start. Failure code %1 ; Issue with MsSense DLL Module. | Occurs during startup. | Contact support. | + |108 |Update phase:%1, new platform version: %2, message: %3.|Occurs during update.|Normal operating notification; no action required.| + |109 | Update phase:%1 new platform version: %2, failure message: %3, error: %4. | Occurs during update. |Contact support. | + |110 |Failed to remove MDEContain WFP filters. | Occurs during offboarding. | Contact support. | + |307| Failed to update driver permissions Failure code: %1. |Occurs during onboarding. |Contact support. | + |308 | Failed to ACL on Folder %1 Failure code: %2. |Occurs during onboarding. | Contact support. | + |401 | Microsoft Defender for Endpoint service failed to generate key. Failure code: %1. | Failed to create crypto key.|If machine is not reporting, contact support. Otherwise, no action required. | + |402 |Microsoft Defender for Endpointservice failed to persist authentication state. Failure code: %1.| Failed to persist authentication state. | If machine is not reporting, contact support. Otherwise, no action required. | + |403|Registration of Microsoft Defender for Endpoint service completed.|Successful registration to authentication service.|Normal operating notification; no action required.| + |404 |Microsoft Defender for Endpoint service successfully generated a key. |Successful crypto key generation. |Normal operating notification; no action required.| + |405|Failed to communicate with authentication service. %1 request failed, hresult: %2, HTTP error code: %3. |Failed to send request to authentication service.|Normal operating notification; no action required.| + |406|Request for %1 rejected by authentication service. Hresult: %2, error code: %3. | Request returned undesired response. |Normal operating notification; no action required. | + |407|Microsoft Defender for Endpoint service failed to sign message (authentication). Failure code: %1. |Failed to sign request. |Normal operating notification; no action required. | + |408|Microsoft Defender for Endpoint service failed to remove persist authentication state. State: %1, Failure code: %2. |Failed to persist authentication state. |If machine is not reporting, contact support. Otherwise, no action required.| + |409| Microsoft Defender for Endpoint service failed to open key. Failure code: %1. |Failed to open crypto key.|If machine is not reporting, contact support. Otherwise, no action required.| + |410|Registration is required as part of re-onboarding of Microsoft Defender for Endpoint service. |Occurs during reonboarding. |Normal operating notification; no action required.| + |411|Cyber telemetry upload has been suspended for Microsoft Defender for Endpoint service due to invalid/expired token.|Cyber upload temporarily suspended.|Normal operating notification; no action required.| + |412|Cyber telemetry upload been resumed for Microsoft Defender for Endpoint service due to newly refreshed token.|Cyber upload successfully resumed.|Normal operating notification; no action required.| + |1800| CSP: Get `Node's` Value. NodeId: (%1), TokenName: (%2). | An operation of Get is about to start. | Contact support. | + |1801|CSP: Failed to Get `Node's` Value. NodeId: (%1), TokenName: (%2), Result: (%3). | An operation of Get has failed. |Contact support.| + |1802| CSP: Get `Node's` Value complete. NodeId: (%1), TokenName: (%2), Result: (%3). | An operation of Get has succeeded. |Contact support. | + |1803| CSP: Get Last Connected value complete. Result (%1), IsDefault: (%2). |Last time the device communicated with CNC. | Normal operating notification; no action required. | + |1804| CSP: Get Org ID value complete. Result: (%1), IsDefault: (%2). |The org ID device get during onboarding. |Normal operating notification; no action required. | + |1805|CSP: Get Sense Is Running value complete. Result: (%1). | Sense running message after onboarding. |Normal operating notification; no action required. | + |1806| CSP: Get Onboarding State value complete. Result: (%1), IsDefault: (%2). | Get is Sense onboarded. | Normal operating notification; no action required. | + |1807| CSP: Get Onboarding value complete. Onboarding Blob Hash: (%1), IsDefault: (%2), Onboarding State: (%3), Onboarding State IsDefault: (%4). | Get is Sense onboarded and onboarding blob hash. | Normal operating notification; no action required. | + |1808| CSP: Get Offboarding value complete. Offboarding Blob Hash: (%1), IsDefault: (%2). |Get offboarding blob hash. | Normal operating notification; no action required. | + |1809| CSP: Get Sample Sharing value complete. Result: (%1), IsDefault: (%2). |Get is sample upload is allowed. | Normal operating notification; no action required. | + |1810| CSP: Onboarding process. Started. |Started onboarding flow.| Normal operating notification; no action required. | + |1811| CSP: Onboarding process. Delete Offboarding blob complete. Result: (%1). |Deleted offboarding blob as part of onboarding flow. |Normal operating notification; no action required. | + |1812|CSP: Onboarding process. Write Onboarding blob complete. Result: (%1). | Wrote onboarding blob to registry as part of onboarding flow. |Normal operating notification; no action required. | + |1813| CSP: Onboarding process. The service started successfully. | Started Sense service as part of onboarding flow. |Normal operating notification; no action required. | + |1814| CSP: Onboarding process. Pending service running state complete. Result: (%1). | Finished waiting for Sense to start as part of onboarding flow. |Normal operating notification; no action required. | + |1815|CSP: Set Sample Sharing value complete. Previous Value: (%1), IsDefault: (%2), New Value: (%3), Result: (%4). |Set sample sharing value. |Normal operating notification; no action required. | + |1816|CSP: Offboarding process. Delete Onboarding blob complete. Result (%1). |Deleted onboarding blob as part of offboarding flow. | Normal operating notification; no action required. | + |1817|CSP: Offboarding process. Write Offboarding blob complete. Result (%1).|Wrote offboarding blob to registry as part of offboarding flow. |Normal operating notification; no action required. | + |1818|CSP: Set `Node's` Value started. NodeId: (%1), TokenName: (%2). | An operation of Set is about to start. |Normal operating notification; no action required.| + |1819|CSP: Failed to Set `Node's` Value. NodeId: (%1), TokenName: (%2), Result: (%3). | An operation of Set has failed. |Contact support. | + |1820|CSP: Set `Node's` Value complete. NodeId: (%1), TokenName: (%2), Result: (%3). | An operation of Set has succeeded. |Normal operating notification; no action required. | + |1821|CSP: Set Telemetry Reporting Frequency started. New value: (%1). | Start setting the value of TelemetryReportingFrequency. | Normal operating notification; no action required.| + |1822| CSP: Set Telemetry Reporting Frequency complete. Previous value: (%1), IsDefault: (%2), New value: (%3), Result: (%4). | Finish setting the value of TelemetryReportingFrequency.| Normal operating notification; no action required. | + |1823| CSP: Get Telemetry Reporting Frequency complete. Value: (%1), Registry Value: (%2), IsDefault: (%3). | Gets the value of TelemetryReportingFrequency.| Normal operating notification; no action required. | + |1824| CSP: Get Group Ids complete. Value: (%1), IsDefault: (%2). |Got groupIds from registry. |Normal operating notification; no action required. | + |1825| CSP: Set Group Ids exceeded allowed limit. Allowed: (%1), Actual: (%2). | Failed to set groupIds due to length. | Normal operating notification; no action required. | + |1826| CSP: Set Group Ids complete. Value: (%1), Result: (%2). | Set groupIds. | Normal operating notification; no action required. | + |1827| CSP: Onboarding process. Service is running: (%1), Previous Onboarding Blob Hash: (%2), IsDefault: (%3), Onboarding State: (%4), Onboarding State IsDefault: (%5), New Onboarding Blob Hash: (%6). | Trace values as part of onboarding. | Normal operating notification; no action required. | + |1828| CSP: Onboarding process. Service is running: (%1), Previous Offboarding Blob Hash: (%2), IsDefault: (%3), Onboarding State: (%4), Onboarding State IsDefault: (%5), New Offboarding Blob Hash: (%6). | Trace values as part of offboarding. | Normal operating notification; no action required. | + |1829|CSP: Failed to Set Sample Sharing Value. Requested Value: (%1), Allowed Values between (%2) and (%3). |Invalid value for SampleSharing operation. |Contact support. | + |1830| CSP: Failed to Set Telemetry Reporting Frequency Value. Requested Value: (%1). | Setting the value of TelemetryReportingFrequency failed. | Contact support if problem persists.| + |1831|CSP: Get Sense is running. Service is configured as delay-start, and `hasn't` started yet. |Get SenseIsRunning result. |Normal operating notification; no action required. | + |1832| CSP: Get Device Tagging Group complete. Value: (%1), IsDefault: (%2). | Get DeviceTagging Group from registry completed. | Normal operating notification; no action required. | + |1833| CSP: Get Device Tagging Criticality value complete. In Registry: (%1), IsDefault: (%2), Conversion Succeeded: (%3), Result: (%4). | Get DeviceTagging Criticality from registry completed. | Normal operating notification; no action required. | + |1834| CSP: Get Device Tagging Identification Method value complete. In Registry: (%1), IsDefault: (%2), Conversion Succeeded: (%3), Result: (%4). | Get DeviceTagging Id Method from registry completed. | Normal operating notification; no action required. | + |1835| CSP: Set Device Tagging Group complete. Value: (%1), Result: (%2). | Set DeviceTagging Group in registry completed. | Normal operating notification; no action required.| + |1836| CSP: Set Device Tagging Group exceeded allowed limit. Allowed: (%1), Actual: (%2). | Set DeviceTagging Group failed as maximum Length Limit exceeded. |Contact support if problem persists. | + |1837| CSP: Set Device Tagging Criticality value complete. Previous Value: (%1), IsDefault: (%2), New Value: (%3), Result: (%4). | Set DeviceTagging Criticality in registry completed. |Normal operating notification; no action required. | + |1838| CSP: Failed to Set Device Tagging Criticality Value. Requested Value: (%1), Allowed Values between (%2) and (%3). | Set DeviceTagging Criticality failed as value was not within expected range. | Contact support if problem persists. | + |1839| CSP: Set Device Tagging Identification Method value complete. Previous Value: (%1), IsDefault: (%2), New Value: (%3), Result: (%4). | Set DeviceTagging Id Method in registry completed. | Normal operating notification; no action required. | + |1840| CSP: Failed to Set Device Tagging Identification Method Value. Requested Value: (%1), Allowed Values between (%2) and (%3). | Set DeviceTagging Id Method failed as value was not within expected range. | Contact support if problem persists. | |--> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-eventerrorcodes-belowfoldlink) -+ ## See also-- [Onboard Windows 10 devices](configure-endpoints.md)+- [Onboard Windows client devices](configure-endpoints.md) - [Configure device proxy and Internet connectivity settings](configure-proxy-internet.md) - [Troubleshoot Microsoft Defender for Endpoint](troubleshoot-onboarding.md) - [Client analyzer overview](overview-client-analyzer.md) |
| security | Schedule Antivirus Scan In Mde | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/schedule-antivirus-scan-in-mde.md | Use the following steps to schedule scans: ``` #!/bin/sh set -e- echo $(date) ΓÇ£Time Scan BeginsΓÇ¥ >>/logs/mdav_avacron_full_scan.log/bin/mdatp scan full >> /logs/mdav_avacron_full_scan.log + echo $(date) ΓÇ£Time Scan BeginsΓÇ¥ >>/logs/mdav_avacron_full_scan.log + /bin/mdatp scan full >> /logs/mdav_avacron_full_scan.log echo $(date) ΓÇ£Time Scan FinishedΓÇ¥ >>/logs/mdav_avacron_full_scan.log exit 0 ~ |
| security | Whats New In Microsoft Defender Endpoint | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint.md | ms.pagetype: security ms.localizationpriority: medium Last updated : 08/25/2022 audience: ITPro For more information on Microsoft Defender for Endpoint on other operating syste ## August 2022 - [Device health status](investigate-machines.md#device-health-status)<br>The Device health status card shows a summarized health report for the specific device.- - [Device health reporting (Preview)](/microsoft-365/security/defender-endpoint/machine-reports)<br> The devices status report provides high-level information about the devices in your organization. The report includes trending information showing the sensor health state, antivirus status, OS platforms, and Windows 10 versions.+- [Tamper protection on macOS is now generally available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/tamper-protection-on-macos-is-now-generally-available/ba-p/3595422)<br> This feature will be released with audit mode enabled by default, and you can decide whether to enforce (block) or turn off the capability. Later this year, we will offer a gradual rollout mechanism that will automatically switch endpoints to block mode; note this will only apply if you have not specifically made a choice to either enable (block mode) or disable the capability. +- [Network Protection and Web Protection for macOS and Linux is now in Public Preview!](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/network-protection-and-web-protection-for-macos-and-linux-is-now/ba-p/3601576)<br>Network Protection helps reduce the attack surface of your devices from Internet-based events. It prevents employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. It is the foundation on which our Web Protection for Microsoft Defender for Endpoint is built. These capabilities include Web threat protection, Web content filtering, and IP/URL Custom indicators. Web protection enables you to secure your devices against web threats and helps to regulate unwanted content. +- [Improved Microsoft Defender for Endpoint (MDE) onboarding for Windows Server 2012 R2 and Windows Server 2016](/mem/configmgr/core/plan-design/changes/whats-new-in-version-2207#improved-microsoft-defender-for-endpoint-mde-onboarding-for-windows-server-2012-r2-and-windows-server-2016)<br>Configuration Manager version 2207 now supports automatic deployment of modern, unified Microsoft Defender for Endpoint for Windows Server 2012 R2 & 2016. Windows Server 2012 and 2016 devices that are targeted with Microsoft Defender for Endpoint onboarding policy will use the unified agent versus the existing Microsoft Monitoring Agent based solution, if configured through Client Settings. ## July 2022--+- [Add domain controller devices - Evaluation lab enhancement](evaluation-lab.md#add-a-domain-controller)<br>Now generally available - Add a domain controller to run complex scenarios such as lateral movement and multistage attacks across multiple devices. +- [Announcing File page enhancements in Microsoft Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-file-page-enhancements-in-microsoft-defender-for/ba-p/3584004)<br>Have you ever investigated files in Microsoft Defender for Endpoint? We now make it even easier with our recent announcement of enhancements to the File page and side panel. Users can now streamline processes by having a more efficient navigation experience that hosts all this information in one place. +- [Introducing the new alert suppression experience](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/introducing-the-new-alert-suppression-experience/ba-p/3562719)<br>We are excited to share the new and advanced alert suppression experience is now Generally Available. The new experience provides tighter granularity and control, allowing users to tune Microsoft Defender for Endpoint alerts. +- [Prevent compromised unmanaged devices from moving laterally in your organization with “Contain](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/prevent-compromised-unmanaged-devices-from-moving-laterally-in/ba-p/3482134)<br>Starting today, when a device that is not enrolled in Microsoft Defender for Endpoint is suspected of being compromised, as a SOC analyst, you will be able to “Contain” it. As a result, any device enrolled in Microsoft Defender for Endpoint will now block any incoming/outgoing communication with the suspected device. +- [Mobile device support is now available for US Government Customers using Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/mobile-device-support-is-now-available-for-us-government/ba-p/3472590)<br>Microsoft Defender for Endpoint for US Government customers is built in the Azure US Government environment and uses the same underlying technologies as Defender in Azure Commercial. This offering is available to GCC, GCC High and DoD customers and further extends our platform availability from Windows, MacOS, and Linux, to Android and iOS devices as well. ## June 2022 - [Defender for Servers Plan 2 now integrates with MDE unified solution](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/defender-for-servers-plan-2-now-integrates-with-mde-unified/ba-p/3527534)<br>You can now start deploying the modern, unified solution for Windows Server 2012 R2 and 2016 to servers covered by Defender for Servers Plan 2 using a single button.+- [Mobile Network Protection in Microsoft Defender for Endpoint on Android & iOS now in Public Preview](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/mobile-network-protection-in-microsoft-defender-for-endpoint-on/ba-p/3559121)<br>Microsoft offers a mobile network protection feature in Defender for Endpoint that helps organizations identify, assess, and remediate endpoint weaknesses with the help of robust threat intelligence. We are delighted to announce that users can now benefit from this new feature on both Android and iOS platforms with Microsoft Defender for Endpoint. ## May 2022 - [Tamper protection for macOS (preview)](tamperprotection-macos.md)<br>Tamper protection helps prevent unauthorized removal of Microsoft Defender for Endpoint on macOS.- - [Add domain controller devices - Evaluation lab enhancement (preview)](evaluation-lab.md#add-a-domain-controller)<br>Add a domain controller to run complex scenarios such as lateral movement and multistage attacks across multiple devices.+- [Troubleshooting mode for Microsoft Defender for Endpoint now Generally Available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/troubleshooting-mode-for-microsoft-defender-for-endpoint-now/ba-p/3347344)<br>Introducing troubleshooting mode, a unique, innovative, and secure way to investigate and adjust configurations on your devices. This mode will enable the local admin on the device to override Microsoft Defender Antivirus security policy configurations on the device, including tamper protection. +- [Announcing the public preview of Defender for Endpoint personal profile for Android Enterprise](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-the-public-preview-of-defender-for-endpoint-personal/ba-p/3370979)<br>We are happy to announce that users who wish to enroll their own devices in their workplace’s BYOD program can now benefit from the protection provided by Microsoft Defender for Endpoint in their personal profile as well. +- [Security Settings Management in Microsoft Defender for Endpoint is now generally available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/security-settings-management-in-microsoft-defender-for-endpoint/ba-p/3356970)<br>In late 2021, we announced that Microsoft Defender for Endpoint expanded its configuration management capabilities. This release empowered security teams to configure devices with their desired security settings without needing to deploy and implement additional tools or infrastructure. Made possible with Microsoft Endpoint Manager, organizations have been able to manage antivirus (AV), endpoint detection and response (EDR), and firewall (FW) policies from a single view for all enlisted devices. Today, we are announcing that this capability is now generally available for Windows client and Windows server, supporting Windows 10, Windows 11, and Windows Server 2012 R2 or later. ## April 2022 - [Updated onboarding and feature parity for Windows Server 2012 R2 and Windows Server 2016)](configure-server-endpoints.md)<br/> The new unified solution package is now generally available and makes it easier to onboard servers by removing dependencies and installation steps. In addition, this unified solution package comes with many new feature improvements.-- Integration with Tunnel. Microsoft Defender for Endpoint on iOS can now integrate with Microsoft Tunnel, a VPN gateway solution to enable security and connectivity in a single app. This feature was earlier available only on Android. [Learn more](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/what-s-new-in-microsoft-endpoint-manager-2204-april-edition/ba-p/3297995)+- [Integration with Tunnel for iOS](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/what-s-new-in-microsoft-endpoint-manager-2204-april-edition/ba-p/3297995). Microsoft Defender for Endpoint on iOS can now integrate with Microsoft Tunnel, a VPN gateway solution to enable security and connectivity in a single app. This feature was earlier available only on Android. +- [Enhanced Antimalware Protection in Microsoft Defender for Endpoint Android](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/enhanced-antimalware-protection-in-microsoft-defender-for/ba-p/3290320)<br>We are excited to share major updates to the Malware protection capabilities of Microsoft Defender for Endpoint on Android. These new capabilities form a major component of your next-generation protection in Microsoft Defender for Endpoint. This protection brings together machine learning, big-data analysis, in-depth threat research, and the Microsoft cloud infrastructure to protect Android devices (or endpoints) in your organization. +- [Enhanced antimalware engine capabilities for Linux and macOS](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/enhanced-antimalware-engine-capabilities-for-linux-and-macos/ba-p/3292003)<br>We are announcing a significant upgrade to our next-generation protection on Linux and macOS with a new, enhanced engine. The Microsoft Defender Antivirus antimalware engine is a key component of next-generation protection. This protection brings machine learning, big-data analysis, in-depth threat research, and the Microsoft cloud infrastructure, to protect devices (or endpoints) in your organization. The main benefits of this major update include performance and prevention improvements, as well as adding support for custom file indicators on macOS and Linux. +- [New Reporting Functionality for Device Control and Windows Defender Firewall](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/new-reporting-functionality-for-device-control-and-windows/ba-p/3290601)<br>We are excited to announce the new Endpoint reporting capabilities within the Microsoft 365 Defender portal. This work brings new endpoint reports together so you can see what is happening in your environment with just a couple clicks. Our reports are designed to provide insight into device behavior and activity while allowing you to take full advantage of the integrated experiences within Microsoft 365 Defender portal, such as device timeline and advanced hunting. +- [Unified submissions in Microsoft 365 Defender now Generally Available!](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/unified-submissions-in-microsoft-365-defender-now-generally/ba-p/3270770)<br>Your security team now has a “one-stop shop” for submitting emails, URLs, email attachments, and files in one, easy-to-use submission experience. To simplify the submission process, we are excited to announce a new unified submissions experience in the Microsoft 365 Defender portal (https://security.microsoft.com). With unified submissions, you can submit files to Microsoft 365 Defender for review from within the portal. We are also adding the ability to submit a file directly from a Microsoft Defender for Endpoint Alert page. +- [Announcing expanded support and functionality for Live Response APIs](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-expanded-support-and-functionality-for-live-response/ba-p/3178432)<br>We are happy to share that we continue to expand support of existing APIs across all of our supported platforms in Microsoft Defender for Endpoint, alongside announcing new ones that will help simplify and augment organization's response automation and orchestration. -## January 2022 +## February 2022 -- Evaluation lab enhancements: You can now add Windows 11 and Linux devices to the lab. +- [The Splunk Add-on for Microsoft Security is now available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/the-splunk-add-on-for-microsoft-security-is-now-available/ba-p/3171272)<br>We're happy to share that the Splunk-supported Splunk Add-on for Microsoft Security is now available. This add-on builds on the Microsoft 365 Defender Add-on for Splunk 1.3.0 and maps the Microsoft Defender for Endpoint Alerts API properties or the Microsoft 365 Defender Incidents API properties onto Splunk's Common Information Model (CIM). +- [Deprecating the legacy SIEM API - Postponed](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/deprecating-the-legacy-siem-api-postponed/ba-p/3139643)<br>We previously announced the SIEM REST API would be deprecated on 4/1/2022. We've listened to customer feedback and the API deprecation has been postponed for now, more details expected in Q3, 2022. We look forward to sharing exciting details about the ​Microsoft 365 Defender APIs in Microsoft Graph in Q3 2022. -- Vulnerability management for Android and iOS is now generally available. [Learn more](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-general-availability-of-vulnerability-management/ba-p/3071663).+## January 2022 -## December 2021 +- [Vulnerability management for Android and iOS is now generally available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-general-availability-of-vulnerability-management/ba-p/3071663)<br>With this new cross-platform coverage, threat and vulnerability management capabilities now support all major device platforms across the organization - spanning workstations, servers, and mobile devices. +- [Microsoft Defender for Endpoint Plan 1 Now Included in M365 E3/A3 Licenses](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-for-endpoint-plan-1-now-included-in-m365-e3/ba-p/3060639)<br>Starting January 14, Microsoft Defender for Endpoint Plan 1 (P1) will be automatically included in Microsoft 365 E3/A3 licenses. +- [Zero-touch onboarding of Microsoft Defender for Endpoint on iOS now in public preview](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/zero-touch-onboarding-of-microsoft-defender-for-endpoint-on-ios/ba-p/3038045)<br>With this new capability, enterprises can now deploy Microsoft Defender for Endpoint on iOS devices that are enrolled with Microsoft Endpoint Manager automatically, without needing end-users to interact with the app. This eases the deployment frictions and significantly reduces the time needed to deploy the app across all devices as Microsoft Defender for Endpoint gets silently activated on targeted devices and starts protecting your iOS estate. -- Microsoft Defender Vulnerability Management can help identify Log4j vulnerabilities in applications and components. [Learn more](https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/#TVM).+## December 2021 +- [Microsoft Defender Vulnerability Management can help identify Log4j vulnerabilities in applications and components](https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/#TVM)<br>Threat and vulnerability management automatically and seamlessly identifies devices affected by the Log4j vulnerabilities and the associated risk in the environment and significantly reduces time-to-mitigate. Microsoft continues to iterate on these features based on the latest information from the threat landscape. - Discover IoT devices (preview): [Device discovery](device-discovery.md) now has the ability to help you find unmanaged IoT devices connected to your corporate network. This gives you a single unified view of your IoT inventory alongside the rest of your IT devices (workstations, servers, and mobile).- - [Microsoft Defender for IoT integration (preview)](enable-microsoft-defender-for-iot-integration.md): This integration enhances your device discovery capabilities with the agentless monitoring capabilities provided by Microsoft Defender for IoT. This provides increased visibility to help locate, identify, and secure the IoT devices in your network. ## November 2021 - [Security configuration management](security-config-management.md) <br/> A capability for devices that aren't managed by a Microsoft Endpoint Manager, either Microsoft Intune or Microsoft Endpoint Configuration Manager, to receive security configurations for Microsoft Defender directly from Endpoint Manager.--- Enhancements to cross-platform support.+- [Evaluation Lab: Expanded OS support & Atomic Red Team simulations](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/evaluation-lab-expanded-os-support-amp-atomic-red-team/ba-p/2993927)<br>the Evaluation Lab now supports adding Windows 11, Windows Server 2016, and Linux devices. In addition, we’d also like to announce a new partnership with Red Canary’s open-source simulation library, Atomic Red Team! +- [Announcing the public preview of Microsoft Defender for Endpoint Mobile - Tamper protection](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-the-public-preview-of-microsoft-defender-for-endpoint/ba-p/2971038)<br>Mark a device non-compliant after 7 days of inactivity in the Microsoft Defender for Endpoint mobile app. +- [Boost protection of your Linux estate with behavior monitoring, extended distro coverage, and more](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/boost-protection-of-your-linux-estate-with-behavior-monitoring/ba-p/2909320)<br>We are thrilled to share the latest news about Microsoft Defender for Endpoint on Linux next generation protection, endpoint detection and response (EDR), threat and vulnerability management (TVM). Microsoft protection for your Linux estate is getting an impressive boost across the full spectrum of the security suite. With recent Microsoft Defender for Endpoint on Linux integration into Azure Security Center, the benefits of our Linux EDR and TVM now extend to Azure Defender customers. ## October 2021 - [Updated onboarding and feature parity for Windows Server 2012 R2 and Windows Server 2016 (preview)](configure-server-endpoints.md)<br/> The new unified solution package makes it easier to onboard servers by removing dependencies and installation steps. In addition, this unified solution package comes with many new feature improvements.- - Windows 11 support added to Microsoft Defender for Endpoint and Microsoft 365 Defender. ## September 2021 For more information on Microsoft Defender for Endpoint on other operating syste - (Preview) [Microsoft Defender for Endpoint Plan 1 ](defender-endpoint-plan-1.md) <br/>Defender for Endpoint Plan 1 (preview) is an endpoint protection solution that includes next-generation protection, attack surface reduction, centralized management and reporting, and APIs. Defender for Endpoint Plan 1 (preview) is a new offering for customers who want to try our endpoint protection capabilities, have Microsoft 365 E3, and do not yet have Microsoft 365 E5. To learn more, see [Microsoft Defender for Endpoint Plan 1 (preview)](defender-endpoint-plan-1.md). Existing [Defender for Endpoint](microsoft-defender-endpoint.md) capabilities will be known as Defender for Endpoint Plan 2. - - (Preview) [Web Content Filtering](web-content-filtering.md)<br> Web content filtering is part of web protection capabilities in Microsoft Defender for Endpoint. It enables your organization to track and regulate access to websites based on their content categories. Many of these websites, while not malicious, might be problematic because of compliance regulations, bandwidth usage, or other concerns. ## July 2021 For more information on Microsoft Defender for Endpoint on other operating syste ## June 2021 - [Delta export software vulnerabilities assessment](get-assessment-methods-properties.md#31-methods) API <br> An addition to the [Export assessments of vulnerabilities and secure configurations](get-assessment-methods-properties.md) API collection. <br> Unlike the full software vulnerabilities assessment (JSON response) - which is used to obtain an entire snapshot of the software vulnerabilities assessment of your organization by device - the delta export API call is used to fetch only the changes that have happened between a selected date and the current date (the "delta" API call). Instead of getting a full export with a large amount of data every time, you'll only get specific information on new, fixed, and updated vulnerabilities. Delta export API call can also be used to calculate different KPIs such as "how many vulnerabilities were fixed" or "how many new vulnerabilities were added to an organization."- - [Export assessments of vulnerabilities and secure configurations](get-assessment-methods-properties.md) API <br> Adds a collection of APIs that pull Defender Vulnerability Management data on a per-device basis. There are different API calls to get different types of data: secure configuration assessment, software inventory assessment, and software vulnerabilities assessment. Each API call contains the requisite data for devices in your organization.- - [Remediation activity](get-remediation-methods-properties.md) API <br> Adds a collection of APIs with responses that contain Defender Vulnerability Management remediation activities that have been created in your tenant. Response information types include one remediation activity by ID, all remediation activities, and exposed devices of one remediation activity.- - [Device discovery](device-discovery.md) <br> Helps you find unmanaged devices connected to your corporate network without the need for extra appliances or cumbersome process changes. Using onboarded devices, you can find unmanaged devices in your network and assess vulnerabilities and risks. You can then onboard discovered devices to reduce risks associated with having unmanaged endpoints in your network. > [!IMPORTANT] > Standard discovery will be the default mode for all customers starting July 19, 2021. You can choose to retain the basic mode through the settings page. - [Device group definitions](/microsoft-365/security/defender-endpoint/machine-groups) can now include multiple values for each condition. You can set multiple tags, device names, and domains to the definition of a single device group.- - [Mobile Application management support](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-new-capabilities-on-android-and-ios/ba-p/2442730) <br> This enhancement enables Microsoft Defender for Endpoint protect an organization's data within a managed application when Intune is being used to manage mobile applications. For more information about mobile application management, see [this documentation](/mem/intune/apps/mam-faq).- - [Microsoft Tunnel VPN integration](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-new-capabilities-on-android-and-ios/ba-p/2442730) <br> Microsoft Tunnel VPN capabilities is now integrated with Microsoft Defender for Endpoint app for Android. This unification enables organizations to offer a simplified end user experience with one security app – offering both mobile threat defense and the ability to access on-premesis resources from their mobile device, while security and IT teams are able to maintain the same admin experiences they are familiar with.- - [Jailbreak detection on iOS](/microsoft-365/security/defender-endpoint/ios-configure-features#conditional-access-with-defender-for-endpoint-on-ios) <br> Jailbreak detection capability in Microsoft Defender for Endpoint on iOS is now generally available. This adds to the phishing protection that already exists. For more information, see [Setup Conditional Access Policy based on device risk signals](/microsoft-365/security/defender-endpoint/ios-configure-features). |
| security | Defender Vulnerability Management Trial | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-trial.md | - Title: About the Microsoft Defender Vulnerability Management public preview trial -description: Learn about the Microsoft Defender Vulnerability Management trial -keywords: defender vulnerability management -ms.sitesec: library -ms.pagetype: security -- NOCSH--------# About the Microsoft Defender Vulnerability Management public preview trial ---**Applies to:** --- [Microsoft Defender Vulnerability Management](../defender-vulnerability-management/index.yml)-- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)-- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)---Microsoft Defender Vulnerability Management is a new service that provides advanced vulnerability management capabilities to minimize your organization's cyber risk. Get real-time asset discovery, continuous risk-based assessment and prioritization, and built in remediation tools. --It includes the existing vulnerability management capabilities in Microsoft Defender for Endpoint and new capabilities to further provide enhanced tools so your teams can intelligently assess, prioritize, and seamlessly remediate the biggest risks to your organization. --## How to sign up for the Defender Vulnerability Management public preview trial --> [!NOTE] -> The sign up process outlined below is only relevant to customers who have access to the [Microsoft Defender 365 portal](https://security.microsoft.com/homepage). -> -> If you don't have access to the Microsoft Defender 365 portal learn more about how you can sign up to the [Microsoft Defender Vulnerability Management Standalone public preview trial](../defender-vulnerability-management/get-defender-vulnerability-management.md#try-defender-vulnerability-management-standalone). --To sign up for the Defender Vulnerability Management trial, you can go directly to the [Microsoft 365 trials hub](https://security.microsoft.com/trialHorizontalHub) page or by selecting **Trials** on the left navigation from the [Microsoft Defender 365 portal](https://security.microsoft.com/homepage). --Once you've reached the [Microsoft 365 trials hub](https://security.microsoft.com/trialHorizontalHub), sign up depends on whether you already have Microsoft Defender for Endpoint Plan 2 or not: --- If you have Defender for Endpoint Plan 2, find the **Defender Vulnerability Management add-on** card and select **Try now**.-- If you don't have have Defender for Endpoint Plan 1 or Plan 2, or Microsoft 365 E3, choose the **Defender Vulnerability Management** card and select **Try now**.--2. Review the information about what's included in the trial, then select **Begin trial**. --Your trial will be effective immediately for 120 days. It can take up to 6 hours for all vulnerability management features to appear in your left navigation. Sign out and sign back in to see the updates. --> [!NOTE] -> This is a public preview trial. Details on your purchase options for this new offering will be made available once the offering is generally available. --## Required roles for starting the trial --As a Global Administrator, you can start the trial or you can allow to users start the trial on behalf of your organization by enabling this option: --1. In the Microsoft 365 admin center, go to **Settings** > **Org settings** > **Services** > **User owned apps and services** -2. Check **Let users start trials on behalf of your organization** -3. Select **Save** ---> [!NOTE] -> If you don't want users in your organization to be able to start trials, as a Global Administrator you must disable this option once you've activated the trial. -> -> Only a Global Administrator can end the trial. --It can take a few hours for the changes to take effect. Once it does, return to the trial setup page and select **Begin trial**. --## Licensing --As part of the trial setup, the new Defender Vulnerability Management trial licenses will be applied to users automatically. Therefore, no assignment is needed (_The trial can automatically apply up to 1,000,000 licenses_). The licenses are active for 120 days. --## Getting started, extending, and ending the trial --### Getting started --You can start using Defender Vulnerability Management features as soon as you see them in the Microsoft 365 Defender portal. Nothing is created automatically and users won't be affected. When you navigate to each solution, you may be guided to make extra setup configurations to start using features. --### Extending the trial --You can extend the trial within the last 15 days of the trial period. You're limited to a maximum of two trial periods. If you don't extend by the time your trial period ends, you'll need to wait at least 30 days before signing up for a second trial. --### Ending the trial --Admins can disable the trial anytime by selecting **Trials** on the left navigation, going to the **Defender Vulnerability Management** trial card and selecting **End trial**. --Unless stated otherwise for the solution your trial data will be maintained for time, usually 180 days, before being permanently deleted. You may continue to access the data gathered during the trial until that time. --## Terms and conditions --See the [terms and conditions](/legal/microsoft-365/microsoft-365-trial) for Microsoft 365 trials. --## Learn more about Defender Vulnerability Management --Wondering what you can experience in your free trial? The Defender Vulnerability Management trial includes: --- **[Security baselines assessment](tvm-security-baselines.md)**: When the trial ends security baseline profiles may be stored for a short additional time before being deleted.-- **[Blocking vulnerable applications (beta)](tvm-block-vuln-apps.md)**: When the trial ends blocked applications will be immediately unblocked whereas baseline profiles may be stored for a short additional time before being deleted.-- **[Browser extensions assessment](tvm-browser-extensions.md)**-- **[Digital certificates assessment](tvm-certificate-inventory.md)**-- **[Network shares analysis](tvm-network-share-assessment.md)** |
| security | Trial Playbook Defender Vulnerability Management | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/trial-playbook-defender-vulnerability-management.md | - Title: Trial playbook - Microsoft Defender Vulnerability Management (public preview) -description: Learn how Microsoft Defender Vulnerability Management can help you protect all your users and data. -keywords: vulnerability management, threat and vulnerability management, Microsoft Defender for Endpoint TVM, Microsoft Defender for Endpoint-TVM, vulnerability management, vulnerability assessment, threat and vulnerability scanning, secure configuration assessment, Microsoft Defender for Endpoint, Microsoft Defender Vulnerability Management, endpoint vulnerabilities, next generation -ms.sitesec: library -ms.pagetype: security ---------# Trial playbook: Microsoft Defender Vulnerability Management --## Welcome to the Microsoft Defender Vulnerability Management trial playbook --This playbook is a simple guide to help you make the most of your free trial. Using the suggested steps in this playbook from the Microsoft Security team, you'll learn how vulnerability management can help you protect all your users and data. --## What is Microsoft Defender Vulnerability Management? --Reducing cyber risk requires a comprehensive risk-based vulnerability management program to identify, assess, remediate, and track important vulnerabilities across your most critical assets. --Microsoft Defender Vulnerability Management is a new service that proactively provides continuous real-time discovery and assessment of vulnerabilities, context-aware threat & business prioritization, and built-in remediation processes. It includes all Defender Vulnerability Management capabilities in Microsoft Defender for Endpoint and new enhanced capabilities so your teams can further intelligently assess, prioritize, and seamlessly remediate the biggest risks to your organization. ---Watch the following video to learn more about Defender Vulnerability Management: --> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4Y1FX] --## Let's get started --### Step 1: Set-up --> [!NOTE] -> Users need to have the global admin role defined in Azure AD to onboard the trial. --1. Check [permissions and pre-requisites.](tvm-prerequisites.md) -2. The Microsoft Defender Vulnerability Management preview trial can be accessed in several ways: -- Via the [Microsoft 365 Defender portal](https://security.microsoft.com) under Trials. -- :::image type="content" source="../../medivm-trialshub.png" alt-text="Screenshot of Microsoft Defender Vulnerability Management trial hub landing page."::: -- Via the [Microsoft Admin Center](https://admin.microsoft.com/#/catalog) (global admins only). --3. Sign up for the trial depends on whether you already have Microsoft Defender for Endpoint Plan 2 or not. - - If you have Defender for Endpoint Plan 2, choose [Defender Vulnerability Management Add-on](/microsoft-365/security/defender-vulnerability-management/get-defender-vulnerability-management#try-the-defender-vulnerability-management-add-on-public-preview-trial-for-defender-for-endpoint-plan-2-customers). - - If you don't have Defender for Endpoint Plan 1 or Plan 2, or Microsoft 365 E3, choose [Defender Vulnerability Management Standalone](/microsoft-365/security/defender-vulnerability-management/get-defender-vulnerability-management#try-defender-vulnerability-management-standalone). -4. When you're ready to get started, visit the [Microsoft 365 Defender portal](https://security.microsoft.com) to start using the Defender Vulnerability Management trial. --> [!NOTE] -> This is a public preview trial. Details on your purchase options for this new offering will be made available once the offering is generally available. --> [!NOTE] -> Once you activate the trial it can take up to 6 hours for the new features to become available in the portal. --Now that you have set up your trial, it's time to try key capabilities. --### Step 2: Know what to protect in a single view --Built-in and agentless scanners continuously monitor and detect risk even when devices aren't connected to the corporate network. Expanded asset coverage consolidates software applications, digital certificates, network shares, and browser extensions into a single inventory view. --1. [**Device inventory**](../defender-endpoint/machines-view-overview.md) - The device inventory shows a list of the devices in your network. By default, the list displays devices seen in the last 30 days. At a glance, you'll see information such as domains, risk levels, OS platform, associated CVEs, and other details for easy identification of devices most at risk. --2. Discover and assess your organization's software in a single, consolidated inventory view: - - [**Software application inventory**](tvm-software-inventory.md) - the software inventory in Defender Vulnerability Management is a list of known applications in your organization. The view includes vulnerability and misconfiguration insights across installed software with prioritized impact scores and details such as OS platforms, vendors, number of weaknesses, threats, and an entity-level view of exposed devices. - - [**Browser extension assessments**](tvm-browser-extensions.md) - the browser extensions page displays a list of the extensions installed across different browsers in your organization. Extensions usually need different permissions to run properly. Defender Vulnerability Management provides detailed information on the permissions requested by each extension and identifies those with the highest associated risk levels, the devices with the extension turned on, installed versions, and more. - - [**Certificate inventory**](tvm-certificate-inventory.md) - the certificate inventory allows you to discover, assess, and manage digital certificates installed across your organization in a single view. This can help you: - - Identify certificates that are about to expire so you can update them and prevent service disruption. - - Detect potential vulnerabilities due to the use of weak signature algorithm (for example, SHA-1-RSA), short key size (for example, RSA 512 bit), or weak signature hash algorithm (for example, MD5). - - Ensure compliance with regulatory guidelines and organizational policy. --3. [Assign device value](tvm-assign-device-value.md) - defining a device's value helps you differentiate between asset priorities. The device value is used to incorporate the risk appetite of an individual asset into the Defender Vulnerability Management exposure score calculation. Devices assigned as "high value" will receive more weight. Device value options: - - Low - - Normal (Default) - - High -- You can also use the [set device value API](/microsoft-365/security/defender-endpoint/set-device-value). --### Step 3: Track and mitigate remediation activities --1. [**Request remediation**](tvm-remediation.md#request-remediation) - vulnerability management capabilities bridge the gap between Security and IT administrators through the remediation request workflow. Security admins like you can request for the IT Administrator to remediate a vulnerability from the **Recommendation** pages to [Intune](/mem/intune/). -2. [**View your remediation activities**](tvm-remediation.md#view-your-remediation-activities) - when you submit a remediation request from the Security recommendations page, it kicks-off a remediation activity. A security task is created that can be tracked on a **Remediation** page, and a remediation ticket is created in Microsoft Intune. -3. [**Block vulnerable applications**](tvm-block-vuln-apps.md) - Remediating vulnerabilities takes time and can be dependent on the responsibilities and resources of the IT team. Security admins can temporarily reduce the risk of a vulnerability by taking immediate action to block all currently known vulnerable versions of an application or warn users with customizable messages before opening vulnerable app versions until the remediation request is completed. The block option gives IT teams time to patch the application without security admins worrying that the vulnerabilities will be exploited in the meantime. -- - [How to block vulnerable applications](tvm-block-vuln-apps.md#how-to-block-vulnerable-applications) - - [View remediation activities](tvm-block-vuln-apps.md#view-remediation-activities) - - [View blocked applications](tvm-block-vuln-apps.md#view-blocked-applications) - - [Unblock applications](tvm-block-vuln-apps.md#unblock-applications) --4. Use enhanced assessment capabilities such as [Network shares analysis](tvm-network-share-assessment.md) to protect vulnerable network shares. As network shares can be easily accessed by network users, small common weaknesses can make them vulnerable. These types of misconfigurations are commonly used in the wild by attackers for lateral movement, reconnaissance, data exfiltration, and more. That's why we built a new category of configuration assessments in Defender Vulnerability Management that identify the common weaknesses that expose your endpoints to attack vectors in Windows network shares. This helps you: - - Disallow offline access to shares - - Remove shares from the root folder - - Remove share write permission set to 'Everyone' - - Set folder enumeration for shares - -5. View and monitor your organization's devices using a [**Vulnerable devices report**](tvm-vulnerable-devices-report.md) that shows graphs and bar charts with vulnerable device trends and current statistics. The goal is for you to understand the breath and scope of your device exposure. --### Step 4: Set up security baseline assessments --Instead of running point-in-time compliance scans, security baselines assessment helps you to continuously and proactively monitor your organization's compliance against industry security benchmarks in real time. A security baseline profile is a customized profile that you can create to assess and monitor endpoints in your organization against industry security benchmarks (CIS, NIST, MS). When you create a security baseline profile, you're creating a template that consists of multiple device configuration settings and a base benchmark to compare against. --Security baselines provide support for Center for Internet Security (CIS) benchmarks for Windows 10, Windows 11, and Windows Server 2008 R2 and above, as well as Security Technical Implementation Guides (STIG) benchmarks for Windows 10 and Windows Server 2019. --1. Get started with [security baselines assessment](tvm-security-baselines.md#get-started-with-security-baselines-assessment) -2. Review [security baseline profile assessment results](tvm-security-baselines.md#review-security-baseline-profile-assessment-results) -3. [Use advanced hunting](tvm-security-baselines.md#use-advanced-hunting) --### Step 5: Create meaningful reports to get in-depth insights using APIs and Advanced Hunting --Defender Vulnerability Management APIs can help drive clarity in your organization with customized views into your security posture and automation of vulnerability management workflows. Alleviate your security team's workload with data collection, risk score analysis, and integrations with your other organizational processes and solutions. For more information, see: --- [Export assessment methods and properties per device](../defender-endpoint/get-assessment-methods-properties.md)-- [Defender Vulnerability Management APIs blog](https://techcommunity.microsoft.com/t5/microsoft-defender-vulnerability/new-threat-amp-vulnerability-management-apis-create-reports/ba-p/2445813)--Advanced hunting enables flexible access to Defender Vulnerability Management raw data, which allows you to proactively inspect entities for known and potential threats. -For more information, see [Hunt for exposed devices](../defender-endpoint/advanced-hunting-overview.md). --## Additional resources --- Compare offerings: [Microsoft Defender Vulnerability Management](defender-vulnerability-management-capabilities.md)-- [Defender Vulnerability Management documentation](../defender-vulnerability-management/index.yml)-- Datasheet: [Microsoft Defender Vulnerability Management: Reduce cyber risk with continuous vulnerability discovery and assessment, risk-based prioritization, and remediation](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4XR02) |
| security | Defenderexpertsforhuntingprev | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/defenderexpertsforhuntingprev.md | - Title: Microsoft Defender Experts for Hunting preview- -description: Microsoft Defender Experts for Hunting provides an additional layer of expertise to Microsoft Defender for Endpoint. -keywords: managed threat hunting service, managed threat hunting, managed detection and response (MDR) service, MTE, Microsoft Threat Experts, MTE-TAN, targeted attack notification, Targeted Attack Notification, Microsoft Defender Experts for hunting -search.product: Windows 10 -ms.sitesec: library -ms.pagetype: security ----- - m365-security-compliance - - m365initiative-defender-endpoint ----# Microsoft Defender Experts for Hunting preview --> [!IMPORTANT] -> Some information relates to pre-released products which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ----**Applies to:** --- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)--Microsoft Defender Experts for Hunting (Defender Experts for Hunting) is a managed threat hunting service that can help your Security Operation Centers (SOCs) with expert level monitoring, analysis, and support to identify and respond to critical threats in your unique environment. --[Watch this short video](https://youtu.be/4t1JgE0X0jc) to learn more about how Microsoft Defender Experts for Hunting can help you track the latest advanced threats in your environment. --Defender Experts for Hunting provides targeted attack notifications directly through the Microsoft 365 Defender portal. These notifications will help you protect your organization's endpoints, email, cloud apps, and identities. You will also receive access to Experts on Demand that lets you click a button in the Microsoft 365 Defender portal to get expert advice about threats your organization is facing. You can consult experts and seek help with the threats your organization faces. In this preview, you can try the service for free and enjoy the following capabilities: --- **Threat hunting and analysis** ΓÇô Defender Experts for Hunting look deeper to expose advanced threats and identify the scope and impact of malicious activity associated with human adversaries or hands-on-keyboard attacks.-- **Targeted attack notification** ΓÇô Notifications show up as incidents in Microsoft 365 Defender, helping to improve your security operations' incident response with specific information about the scope, method of entry, and remediation instructions.-- **Experts on Demand** ΓÇô Consult a threat expert about a specific incident, nation-state actor, or attack vector.-- **Hunter-trained AI** ΓÇô Our Defender Experts for Hunting share their learning back into the automated tools they use to improve threat discovery and prioritization.-- **Reports** ΓÇô An interactive report summarizing what we hunted, what we found, and what we recommended.--## Apply for Microsoft Defender Experts for Hunting service preview -->[!IMPORTANT] ->Before you apply, make sure to discuss the eligibility requirements for Defender Experts for Hunting with your Microsoft Technical Service provider and account team. The preview is filling up fast and availability is very limited. If we can't get you in, we'll reach out to you soon as Microsoft Defender Experts for Hunting service is ready for general availability. --If you haven't done so yet, you can apply for Defender Experts for Hunting: --1. Click [**Apply**](https://aka.ms/expandedMTEprev). Anyone from your company can request to join the preview, but if you are accepted, only your Global Admin can sign the legal agreement and enter the preview. -2. Enter your **company email ID**. -3. Select **Submit**. You will get a confirmation message that your application has been received. --## Register to Microsoft Defender Experts for Hunting service preview --You need to follow these steps to join the preview: --1. In the application acceptance email that you've received, click **Register**. This opens the sign-in dialog box to your Microsoft 365 account. -2. Ask your global administrator to register your company (the link will be provided in the email you'll get). Sign in. The **Settings** page opens. -3. Go to **Settings > Microsoft Defender Experts**. -4. Read the **Microsoft Defender Experts for Hunting preview terms and conditions**. If you have any questions or concerns, contact the Microsoft Defender Experts Team at defenderexpertshelp@microsoft.com. -5. Click **Accept**, to accept the terms and conditions. -6. Get your free preview in [Microsoft 365 admin center](https://www.microsoft.com/microsoft-365/business/office-365-administration). -You can only place the order after you've accepted the terms and conditions. Select **Get license** to initiate provisioning in the admin center. This will take you to the checkout page to verify the order details. The service might become commercially available less than six months after you begin your free preview. Microsoft reserves the right to end your preview at that time. -7. In the **Checkout** page, select **Place order**. --## Start using your Microsoft Defender Experts for Hunting service preview --Around six hours after you place your order and get confirmation, you'll receive a welcome email that says your Microsoft Defender Experts preview is set up and ready to use. Our experts will immediately start hunting for advanced threats inside your environment. --## Receive targeted attack notification --The targeted attack notification capability includes: --- Threat monitoring and analysis, reducing dwell time and the risk to your business.-- Hunter-trained artificial intelligence to discover and target both known attacks and emerging threats.-- Identification of the most pertinent risks, helping SOCs maximize their effectiveness.-- Help scoping compromises and providing as much context as can be quickly delivered to enable a swift SOC response.--See the screenshot of a sample below: -- --## Collaborate with experts on demand --You can consult with Defender Experts for Hunting directly inside the Microsoft 365 security portal for a swift and accurate threat response. Experts can provide insight to better understand the complex threats your organization may face. Consult an expert to: --- Gather additional information on alerts and incidents, including root causes and scope-- Gain clarity into suspicious devices, alerts, or incidents and get next steps if faced with an advanced attacker-- Determine risks and available protections related to threat actors, campaigns, or emerging attacker techniques--The option to **Consult a threat expert** is available in several places throughout the portal: --### Device page actions menu -- --### Device inventory page flyout menu -- --### Alerts page flyout menu -- --### Incidents page actions menu -The Microsoft Defender Experts for Hunting - Experts on Demand menu option in the Device page action menu in the Microsoft 365 Defender portal - --### Incidents inventory page -- -->[!NOTE] -> If you would like to track the status of your Experts on Demand cases through Microsoft Services Hub, reach out to your Customer Success Account Manager. Watch this **[video](https://www.microsoft.com/videoplayer/embed/RE4pk9f)** for a quick overview of the Microsoft Services Hub. --## Opt out of preview --In case you change your mind and don't want to continue with the Defender Experts for Hunting preview, you can follow the steps to [cancel a self-service subscription](../../commerce/subscriptions/manage-self-service-purchases-admins.md#cancel-a-self-service-purchase-subscription). --### Related topics --- [Microsoft Threat Experts overview](microsoft-threat-experts.md)-- [Configure and manage Microsoft Threat Experts capabilities](configure-microsoft-threat-experts.md) |
| security | Allow Block Email Spoof | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/allow-block-email-spoof.md | For instructions, see [Report questionable email to Microsoft](admin-submission. You create block entries for domains and email addresses directly in the Tenant Allow/Block List. > [!NOTE]-> Email messages from these blocked domains and email addresses are identified as *high confidence spam* (SCL = 9) and is moved to the Junk Email folder by default. +> Email messages from these senders are marked as *high confidence spam* (SCL = 9). What happens to the messages is determined by the [anti-spam policy](configure-your-spam-filter-policies.md) that detected the message for the recipient. In the default anti-spam policy and new custom policies, messages that are marked as high confidence spam are delivered to the Junk Email folder by default. In Standard and Strict [preset security policies](preset-security-policies.md), high confidence spam messages are quarantined. > > Users in the organization can't send email to these blocked domains and addresses. They'll receive the following non-delivery report (also known as an NDR or bounce message): `5.7.1 Your message can't be delivered because one or more recipients are blocked by your organization's tenant allow/block list policy.` |
| security | Manage Tenant Allow Block List | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/manage-tenant-allow-block-list.md | These articles contain procedures in the Microsoft 365 Defender Portal and in Po Use the Submissions portal (also known as *admin submission*) at <https://security.microsoft.com/reportsubmission> to create block entries for the following types of items as you report them as false positives to Microsoft: - **Domains and email addresses**:- - Email messages from these senders are blocked as *high confidence spam* (SCL = 9) and moved to the Junk Email folder. + - Email messages from these senders are marked as *high confidence spam* (SCL = 9). What happens to the messages is determined by the [anti-spam policy](configure-your-spam-filter-policies.md) that detected the message for the recipient. In the default anti-spam policy and new custom policies, messages that are marked as high confidence spam are delivered to the Junk Email folder by default. In Standard and Strict [preset security policies](preset-security-policies.md), high confidence spam messages are quarantined. - Users in the organization can't send email to these blocked domains and addresses. They'll receive the following non-delivery report (also known as an NDR or bounce message): `5.7.1 Your message can't be delivered because one or more recipients are blocked by your organization's tenant allow/block list policy.` - **Files**: Email messages that contain these blocked files are blocked as *malware*. |
| security | Mdo Sec Ops Guide | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/mdo-sec-ops-guide.md | A companion article to this guide provides an overview to [manage incidents and The [Microsoft 365 Defender Security Operations Guide](/microsoft-365/security/defender/integrate-microsoft-365-defender-secops) contains additional information that you can use for planning and development. +For a video about this information, see <https://youtu.be/eQanpq9N1Ps>. + ## Daily activities ### Monitor the Microsoft 365 Defender Incidents queue |
| security | Preset Security Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/preset-security-policies.md | A profile determines the level of protection. The following profiles are availab - **Groups**: - Members of the specified distribution groups or mail-enabled security groups. - The specified Microsoft 365 Groups.++ > [!NOTE] + > Dynamic distribution groups are not supported. + - **Domains**: All recipients in the specified [accepted domains](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) in your organization. You can only use a condition or exception once, but you can specify multiple values for the condition or exception. Multiple values of the same condition or exception use OR logic (for example, _\<recipient1\>_ or _\<recipient2\>_). Different conditions or exceptions use AND logic (for example, _\<recipient1\>_ and _\<member of group 1\>_). You might want to apply the **Standard** or **Strict** preset security policies - **All recipients** - **Specific recipients**: - **Users**- - **Groups** - - **Domains** + - **Groups**: + - Members of the specified distribution groups or mail-enabled security groups. + - The specified Microsoft 365 Groups. ++ Dynamic distribution groups are not supported. ++ - **Domains** Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, click remove  next to the value. You might want to apply the **Standard** or **Strict** preset security policies When you're finished, click **Next**. -8. On the **Add trusted email addresses and domains to not flag as impersonation** page, enter the sender email addresses and domains that you want to excluded from impersonation protection. Messages from these senders will never be flagged as an impersonation attack, but the senders are still subject to scanning by other filters in EOP and Defender for Office 365. +8. On the **Add trusted email addresses and domains to not flag as impersonation** page, enter the sender email addresses and domains that you want excluded from impersonation protection. Messages from these senders will never be flagged as an impersonation attack, but the senders are still subject to scanning by other filters in EOP and Defender for Office 365. Enter the email address or domain in the box, and then click **Add**. Repeat this step as many times as necessary. Therefore, we typically don't recommend exceptions to the **Built-in protection* 3. On the **Exclude from Built-in protection** flyout that appears, identify the internal recipients that are excluded from the built-in Safe Links and Safe Attachments protection: - **Users**- - **Groups** + - **Groups**: + - Members of the specified distribution groups or mail-enabled security groups. + - The specified Microsoft 365 Groups. ++ Dynamic distribution groups are not supported. + - **Domains** Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, click remove  next to the value. |
| security | Quarantine Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/quarantine-policies.md | The individual quarantine policy permissions that are contained in the preset pe <sup>\*</sup>The **Allow recipients to release a message from quarantine** permission is not honored in anti-malware policies or for the high confidence phishing verdict in anti-spam policies. Users cannot release their own malware or high confidence phishing messages from quarantine. At best, you can use the **Allow recipients to request a message to be released from quarantine** permission. -The default quarantine policies, their associated permission groups, and whether quarantine notifications are enabled are described in the following table: +The default quarantine policies, their associated permission groups, and whether quarantine notifications are enabled is described in the following table: |Default quarantine policy|Permission group used|Quarantine notifications enabled?| ||::|::| The global settings for quarantine policies allow you to customize the quarantin :::image type="content" source="../../media/quarantine-tags-esn-customization-selected-languages.png" alt-text="The selected languages in the global quarantine notification settings of quarantine policies." lightbox="../../media/quarantine-tags-esn-customization-selected-languages.png"::: - - **Use my company logo**: Select this option to replace the default Microsoft logo that's used at the top of quarantine notifications. Before you do this step, you need to follow the instructions in [Customize the Microsoft 365 theme for your organization](../../admin/setup/customize-your-organization-theme.md) to upload your custom logo. + - **Use my company logo**: Select this option to replace the default Microsoft logo that's used at the top of quarantine notifications. Before you do this step, you need to follow the instructions in [Customize the Microsoft 365 theme for your organization](../../admin/setup/customize-your-organization-theme.md) to upload your custom logo. This option is not supported if your organization has custom logo pointing to a URL instead of an uploaded custom logo file. The following screenshot shows a custom logo in a quarantine notification: |
| security | What S The Difference Between Junk Email And Bulk Email | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/what-s-the-difference-between-junk-email-and-bulk-email.md | Anti-spam polices have a default BCL threshold that's used to identify bulk emai - [EOP anti-spam policy settings](recommended-settings-for-eop-and-office365.md#eop-anti-spam-policy-settings) Another option that's easy to overlook: if a user complains about receiving bulk email, but the messages are from reputable senders that pass spam filtering in EOP, have the user check for a unsubscribe option in the bulk email message.++## How to tune bulk email ++In Septemeber 2022, Microsoft Defender for Office 365 Plan 2 customers can access BCL from [advanced hunting](/microsoft-365/security/defender/advanced-hunting-overview). This feature allows admins to look at all bulk senders who sent mail to their organization, along with the corresponding BCL values and the email volume received. You can drill down into the bulk senders by using other columns in **EmailEvents** table in the **Email & collaboration** schema. For more information, see [EmailEvents](/microsoft-365/security/defender/advanced-hunting-emailevents-table). ++For example, if Contoso has set their current bulk threshold to 7 in anti-spam policies, Contoso recipients will receive email from all senders with BCL \< 7 in their Inbox. Admins can run the following query to get a list of all bulk senders in the organization: ++```console +EmailEvents +| where BulkComplaintLevel >= 1 and Timestamp > datetime(2022-09-XXT00:00:00Z) +| summarize count() by SenderMailFromAddress, BulkComplaintLevel +``` ++This query allows admins to identify wanted and unwanted senders. If a bulk sender has a BCL score that doesn't meet the bulk threshold, admins can [submit the senderΓÇÖs messages to Microsoft for analysis](allow-block-email-spoof.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-domains-and-email-addresses-in-the-submissions-portal), which adds the sender as an allow entry to the Tenant Allow/Block List. ++Organizations without Defender for Office 365 Plan 2 can use the [Threat protection status report](view-email-security-reports.md#threat-protection-status-report) to identify wanted and unwanted bulk senders: ++1. Go to Threat protection status report at <https://security.microsoft.com/reports/URLProtectionActionReport> and filter by **View data by Email** \> **Spam**. + +2. Filter for Bulk email, select an email to investigate and click on email entity to learn more about the sender. Email entity is available only for Defender for Office 365 Plan 2 customers. ++3. Once you have identified wanted and unwanted senders, adjust the bulk threshold to your desired level. If there are bulk senders with BCL score that doesn't fit within your bulk threshold, [submit the messages to Microsoft for analysis](allow-block-email-spoof.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-domains-and-email-addresses-in-the-submissions-portal), which adds the sender as an allow entry to the Tenant Allow/Block List. ++Admins can follow the recommeded bulk threshold values or choose a bulk threshold value that suits the needs of their organization. |
| whiteboard | Manage Clients Gcc | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-clients-gcc.md | + + Title: Manage clients for Microsoft Whiteboard in GCC environments +++++audience: admin +++search.appverid: MET150 ++ms.localizationpriority: medium +description: Learn which clients are currently supported for Whiteboard. +++++# Manage clients for Microsoft Whiteboard in GCC environments ++> [!NOTE] +> This guidance applies to US Government Community Cloud (GCC) environments. ++Whiteboard clients are currently being updated to support OneDrive for Business. ++## Clients supported ++The following clients are currently supported in Whiteboard: ++- Standalone Whiteboard web application at [https://whiteboard.office365.us](https://whiteboard.office365.us) +- Microsoft Teams meetings, chats, and channels using Teams desktop and web +- Standalone Whiteboard application for mobile ++## Clients planned ++The following clients are planned for future releases of Whiteboard: ++- Standalone Whiteboard application for Windows 10 or later versions +- Standalone Whiteboard application for Surface Hub (currently can be used in anonymous mode) +- Whiteboard in the Office.com app launcher +- Whiteboard in Teams meetings on Surface Hub and Teams meeting rooms +- Whiteboard in 1:1 calls in Teams ++> [!NOTE] +> While users can install the Windows client, they won't be able to sign in until the client is updated. ++## See also ++[Manage access to Whiteboard - GCC High](manage-whiteboard-access-gcc-high.md) ++[Manage data for Whiteboard - GCC High](manage-data-gcc-high.md) ++[Manage sharing for Whiteboard - GCC High](manage-sharing-gcc-high.md) |
| whiteboard | Manage Data Gcc | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-data-gcc.md | + + Title: Manage data for Microsoft Whiteboard in GCC environments +++++audience: admin +++search.appverid: MET150 ++ms.localizationpriority: medium +description: Learn how to enable, disable, and manage access to Whiteboard. +++++# Manage data for Microsoft Whiteboard in GCC environments ++>[!NOTE] +> This guidance applies to US Government Community Cloud (GCC) environments. ++Data is stored as .whiteboard files in OneDrive for Business. An average whiteboard might be anywhere from 50 KB to 1 MB in size and located wherever your OneDrive for Business content resides. To check where new data is created, see [Where your Microsoft 365 customer data is stored](/microsoft-365/enterprise/o365-data-locations). Look at the location for OneDrive for Business. All properties that apply to general files in OneDrive for Business also apply to Whiteboard, except for external sharing. ++In order to manage data, you must first ensure that Whiteboard is enabled for your organization. For more information, see [Manage access to Whiteboard in GCC High environments](manage-whiteboard-access-gcc-high.md). ++You can manage Whiteboard data using existing OneDrive for Business controls. For more information, see [OneDrive guide for enterprises](/onedrive/plan-onedrive-enterprise). ++You can use existing OneDrive for Business tooling to satisfy data subject requests (DSRs) for General Data Protection Regulation (GDPR). Whiteboard files can be moved in the same way as other content in OneDrive for Business. However, share links and permissions might not move. ++## Data controls supported ++The following data controls are currently supported in Whiteboard: ++- Retention policies +- Quota +- DLP +- eDiscovery +- Legal hold ++## Data controls planned ++The following data controls are planned for future releases of Whiteboard: ++- Sensitivity labels +- Auditing +- Analytics +- Storing whiteboards in SharePoint sites ++## See also ++[Manage access to Whiteboard - GCC High](manage-whiteboard-access-gcc-high.md) ++[Manage sharing for Whiteboard - GCC High](manage-sharing-gcc-high.md) ++[Manage clients for Whiteboard - GCC High](manage-clients-gcc-high.md) |
| whiteboard | Manage Data Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-data-organizations.md | description: Learn about data retention for Microsoft Whiteboard in Azure and On # Manage data for Microsoft Whiteboard -Whiteboard content is stored in both Azure and OneDrive for Business. New whiteboards will be stored in OneDrive for Business; the only exception is whiteboards started from a Surface Hub will be stored in Azure (which will be moved to OneDrive for Business in the future). For more information, see [Manage sharing in Whiteboard](manage-sharing-organizations.md). +Whiteboard content is stored in OneDrive for Business and Azure. OneDrive for Business is the default storage for all new whiteboards. Whiteboards that were originally created in Azure, and whiteboards that were initiated on a Surface Hub or a Microsoft Teams Room device, are stored in Azure. In order to manage data, you must first ensure that Whiteboard is enabled for your organization. For more information, see [Manage access to Whiteboard](manage-whiteboard-access-organizations.md). ## Azure storage overview +>[!NOTE] +> The following information applies to whiteboards that are stored in Azure. + Whiteboard currently stores content securely in Azure. Data might be stored in different locations, depending on the country and when Whiteboard switched to storing new content in those locations. To check where new data is created, see [Where your Microsoft 365 customer data is stored](/microsoft-365/enterprise/o365-data-locations). -Content in Azure doesn't support Data Loss Prevention (DLP), eDiscovery, retention policies, and similar features. Content can be managed using [Whiteboard PowerShell cmdlets](/powershell/module/whiteboard/) and over time, this content will need to be either migrated to OneDrive for Business or deleted. +Content in Azure doesn't support Data Loss Prevention (DLP), eDiscovery, retention policies, and similar features. This content can be managed using [Whiteboard PowerShell cmdlets](/powershell/module/whiteboard/). Eventually, whiteboards stored in Azure will need to be migrated to OneDrive for Business or deleted. ### If a user account is deleted in Azure An average whiteboard might be anywhere from 50 KB to 1 MB in size and located w You can manage Whiteboard data using existing OneDrive for Business controls. For more information, see [OneDrive guide for enterprises](/onedrive/plan-onedrive-enterprise). -You can use existing OneDrive for Business tooling to satisfy data subject requests (DSRs) for General Data Protection Regulation (GDPR). If you want to ensure that all previous changes are removed from the file, you must delete the entire file. +You can use existing OneDrive for Business tooling to satisfy data subject requests (DSRs) for General Data Protection Regulation (GDPR). If you want to ensure all previous changes are removed from the file, you must delete the entire file. Whiteboard files can be moved in the same way as other content in OneDrive for Business. However, share links and permissions might not move. |
| whiteboard | Manage Sharing Gcc | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-sharing-gcc.md | + + Title: Manage sharing for Microsoft Whiteboard in GCC environments +++++audience: admin +++search.appverid: MET150 ++ms.localizationpriority: medium +description: Learn how to manage sharing for Microsoft Whiteboard in GCC environments. +++++# Manage sharing for Microsoft Whiteboard in GCC environments ++> [!NOTE] +> This guidance applies to US Government Community Cloud (GCC) environments. The sharing experience differs based on the device and client being used. ++## Share in Teams meetings ++When you share a whiteboard in a Teams meeting, Whiteboard creates a sharing link. This link is accessible by anyone within the organization. The whiteboard is also shared with any in-tenant users in the meeting. Whiteboards are shared using company-shareable links, regardless of the default setting. Support for the default sharing link type is planned. ++There's more capability for temporary collaboration by most external and shared device accounts during a meeting. Users can temporarily view and collaborate on whiteboards when they're shared in a Teams meeting, similar to PowerPoint Live sharing. ++In this case, Whiteboard provides temporary viewing and collaboration on the whiteboard during the Teams meeting only. A share link isn't created and Whiteboard doesn't grant access to the file. ++If you have external sharing enabled for OneDrive for Business, no further action is required. ++If you restrict external sharing for OneDrive for Business, you can keep it restricted, and just enable a new setting in order for external and shared device accounts to work. To do so, follow these steps: ++1. Ensure that Whiteboard is enabled for your organization. For more information, see [Manage access to Whiteboard](manage-whiteboard-access-gcc-high.md). ++2. Using PowerShell, connect to your tenant and ensure the SharePoint Online module is updated by running the following command: ++ ```powershell + Update-Module -Name Microsoft.Online.SharePoint.PowerShell + ``` ++3. Then run the following **Set-SPOTenant** command: ++ ```powershell + Set-SPOTenant -AllowAnonymousMeetingParticipantsToAccessWhiteboards On + ``` ++This setting applies only to whiteboards and replaces the previously shared settings: **OneDriveLoopSharingCapability** and **CoreLoopSharingCapability**. Those settings are no longer applicable and can be disregarded. ++> [!NOTE] +> This applies only to guests and federated users. It does not apply to anonymous meeting users at this time. ++These changes should take approximately 60 minutes to apply across your tenancy. ++|Scenario|Storage and ownership|Sharing settings|Sharing experience| +||||| +|Start the whiteboard from a desktop or mobile device|Storage: OneDrive for Business<br><br>Owner: User who creates the whiteboard|Enabled|In-tenant users: Can create, view, and collaborate<br><br>External users: Can view and collaborate during the meeting only (the button to share a whiteboard won't appear for external users)<br><br>Shared device accounts: Can view and collaborate during the meeting only| +|Start the whiteboard from a Surface Hub or Microsoft Teams Rooms|Not yet available||| ++## Add as a tab in Teams channels and chats ++When you add a whiteboard as a tab in a Teams channel or chat, Whiteboard will create a sharing link that's accessible by anyone in the organization. ++|Scenario|Storage and ownership|Sharing settings|Sharing experience| +||||| +|Add the whiteboard to a channel or chat from a desktop or mobile device|Storage: OneDrive for Business<br><br>Owner: User who creates the whiteboard|Not applicable|In-tenant users: Can initiate, view, and collaborate<br><br>External users: Not supported| ++## Create and share in Whiteboard native clients ++When you share a whiteboard from the web, desktop, or mobile clients, you can choose specific people. You can also create a sharing link that's accessible by anyone in the organization. ++>[!NOTE] +> External sharing during a Teams meeting is not yet available, but will be added in a future release. ++|Scenario|Storage and ownership|Sharing settings|Sharing experience| +||||| +|Create the whiteboard from a desktop or mobile device|Storage: OneDrive for Business<br><br>Owner: User who creates the whiteboard|Not applicable|In-tenant users: Can share within their organization<br><br>External users: Sharing with external users isn't supported at this time| +|Create the whiteboard from a Surface Hub|Storage: Local<br><br>Owner: None|Not applicable|In-tenant users (coming soon): User will be able to sign in to save and share the board<br><br>External users: Sharing with external users isn't supported at this time| +|Create the whiteboard from Microsoft Teams Rooms|Not yet available||| ++## See also ++[Manage access to Whiteboard - GCC High](manage-whiteboard-access-gcc-high.md) ++[Manage data for Whiteboard - GCC High](manage-data-gcc-high.md) ++[Manage clients for Whiteboard - GCC High](manage-clients-gcc-high.md) |
| whiteboard | Manage Whiteboard Access Gcc | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-whiteboard-access-gcc.md | + + Title: Manage access to Microsoft Whiteboard for GCC environments +++++audience: admin +++search.appverid: MET150 ++ms.localizationpriority: medium +description: Learn how to enable, disable, and manage Whiteboard data. +++++# Manage access to Microsoft Whiteboard for GCC environments ++>[!NOTE] +> This guidance applies to US Government Community Cloud (GCC) environments. ++Microsoft Whiteboard on OneDrive for Business is enabled by default for applicable Microsoft 365 tenants. It can be enabled or disabled at a tenant-wide level. You should also ensure that **Microsoft Whiteboard Services** is enabled in the **Azure Active Directory admin center** > **Enterprise applications**. ++The following URLs are required: ++- 'https://*.office365.us/' +- 'https://login.microsoftonline.us/' +- 'https://graph.microsoft.us/' +- 'https://graph.microsoftazure.us/' +- 'https://admin.onedrive.us' +- 'https://shell.cdn.office.net/' +- 'https://config.ecs.gov.teams.microsoft.us' +- 'https://tb.events.data.microsoft.com/' ++You can control access to Whiteboard in the following ways: ++- Enable or disable Whiteboard for your entire tenant using the [SharePoint Online PowerShell module](/microsoft-365/enterprise/manage-sharepoint-online-with-microsoft-365-powershell). ++- Show or hide Whiteboard for specific users in meetings using a Teams meeting policy. It will still be visible via the web, native clients, and the Teams tab app. ++- Require conditional access policies for accessing Whiteboard using the Azure Active Directory admin center. ++>[!NOTE] +> Whiteboard on OneDrive for Business doesn't appear in the Microsoft 365 admin center. Teams meeting policy only hides Whiteboard entry points, it doesn't prevent users from using Whiteboard. Conditional access ploicies prevent access to Whiteboard, but doesn't hide the entry points. ++## Enable or disable Whiteboard ++To enable or disable Whiteboard for your tenant, do the following steps: ++1. Use the [SharePoint Online PowerShell module](/microsoft-365/enterprise/manage-sharepoint-online-with-microsoft-365-powershell) to enable or disable all Fluid Experiences across your Microsoft 365 tenant. ++2. Connect to [SharePoint Online PowerShell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online). ++3. Enable Fluid using the following <code>Set-SPOTenant</code> cmdlet: ++ <pre><code class="lang-powershell">Set-SPOTenant -IsWBFluidEnabled $true</code></pre> ++The change should take approximately 60 minutes to apply across your tenancy. If you don't see this option, you'll need to update the module. ++>[!NOTE] +> By default, Whiteboard is enabled. If it has been disabled in the Azure Active Directory enterprise applications, then Whiteboard on OneDrive for Business will not work. ++## Show or hide Whiteboard ++To show or hide Whiteboard in meetings, see [Meeting policy settings](/microsoftteams/meeting-policies-content-sharing). ++## See also ++[Manage data for Whiteboard - GCC High](manage-data-gcc-high.md) ++[Manage sharing for Whiteboard - GCC High](manage-sharing-gcc-high.md) ++[Manage clients for Whiteboard - GCC High](manage-clients-gcc-high.md) ++++ |